### Background
Finally, M3 is a response message that the SDj generates to prove itself to the GWN and has the values IDjs, CTj1, and Vj1: IDjs is the SDj's identity; CTj1 is an encrypted value of the SDj's timestamp and random number; and Vj1 is a hash value used on the GWN side to verify the CTj1 value. In the SAP, as illustrated in Figure 3, mutual authentication is achieved between the Pi and SDj through the direct exchange of authentication messages M1 and M2. The PSij that was received by both sides during the LAP will be used to encrypt the authentication parameters. In this phase, both authentication sides maintained a session counter (C0 ij) to determine how many times the PSij value will derive a new key for the next direct mutual authentication session without going back to execute the LAP for a new PSij key. M1 is a request authentication message generated by the Pi to prove itself to the SDj and has the values C0 ij, CTi2, and Vi3: C0 ij is a session counter as mentioned; CTj2 is an encrypted value of the Pi's timestamp and random number with C0 ij using the derived subsequent key (PSij); and Vi3 is a hash value used on the SDj side to verify the CTi2 value. On other hand, the M2 message is a response message that the SDj generates to prove itself to the Pi. In the same manner, M2 comprises IDij, CTj2, and Vj3: IDij represents the pseudonym for SDj generated by the Pi to derive a new value of the PSij key for the current authentication session, and Vj3 is a hash value on the Pi side that verifies the CTj2 value. As shown in Figure 4, the exchange of M1 and M2 achieves mutual authentication between the SDj and Sk in the WAP. The SDj generates a secret key (SKk) to calculate the authentication parameters of the request message by performing a set of one-way hash functions, and the Sk derives the same SKk value to calculate the authentication parameters of the response message using the same hash functions that used on the SDj side. In this phase, both of the authentication sides maintain a pair of sequence numbers, SSk0 and SSk1, to maintain mutual synchronization. M1 is a request authentication message that is the SDj generates to prove itself to the connected Sk and has the values CTk, Vk0 and SSk0: CTk hides the hash value of the SKk and the authentication session number; Vk0 is a hash value on the Sk side that verifies CTk; and SSk0 is a sequence number on the SDj side. Finally, M2 is a response message that the Sk generates to prove itself to the SDj and consists of IDk and Vk2: IDk is a pseudonym for the Sk generated by the SDj to identify the Sk, and Vk2 value is a hash value used on the SDj side to verify the connected Sk. From the aforementioned discussion, the main execution points of the E2 EA scheme can be summarized as follows:1. The Pi executes the LAP by sending an authentication request message to the GWN and delegates the GWN to perform mutual authentication with the SDj, wherein both of the Pi and SDj obtain the seed value of the PSij key;
2. The Pi and SDj can execute the SAP to authenticate each other a maximum of \(m\) times directly without going back to execute the LAP. In each SAP execution, the Pi and SDj derive a new value from the PSij key to encrypt the authentication parameters of the messages exchanged between them;
3. The WAP can be executed between the SDj and connected Sk after either the LAP or SAP execution to exchange either the vital signs or the medical orders of the patient. Therefore, the WAP can execute a maximum of \(m+1\) times without going back to the LAP execution. For further clarification of the relationship among the three phases, consider the timeline diagram in Figure 5. Suppose that the Pi sends a new authentication request to the GWN at time \(\tau_{1,1}\). Then, the LAP is executed and a new PSij key is created by the GWN. So, both of the Pi and SDj obtained the first value of the PSij0 key. Mutual authentication is performed between the SDj and Sk by executing WAP using the first value of SKk1.