# Towards a Provably Secure Authentication Protocol for Fog-Driven IoT-Based Systems
## 4 Security Analysis
### Formal Security Analysis
When \(\mathcal{A}_{att}\) initiates a \(\mathit{Send}\) (\(\mathcal{U}_{k}^{i},(\mathit{FN}_{f},\mathit{START})\)) query, \(C\) generates \(\{\mathit{M}_{1},\mathit{TID}_{k},\mathit{auth}_{k}\}\) and forwards \(\mathit{Message}_{1}=\{\mathit{M}_{1},\mathit{TID}_{k},\mathit{auth}_{k}\}\) to \(\mathcal{A}_{alt}\). When \(\mathcal{A}_{att}\) generates a _Send_ query \((FN_{f}^{j},\textit{Message}_{1})\), \(C\) generates a message \(\{M_{1},M_{2},TID_{k},TID_{f},auth_{k},auth_{f}\}\) to \(\mathcal{A}_{att}\). 3. When \(\mathcal{A}_{att}\) initiates a _Send_ query \((\mathcal{CSP}^{k},\textit{Message}_{2})\), \(C\) sets \(Sk_{k-f-csp}=h((r_{3}\oplus r_{5}\oplus r_{7})\|N_{1}\|ID_{csp})\) and terminates the instance. 4. When \(\mathcal{A}_{att}\) initiates a _Send_ query \((FN_{f}^{j},\textit{Message}_{3})\), \(C\) sets \((r_{3}\|r_{7})=N_{2}\oplus r_{5}\) and returns message \(\{N_{1},Q_{k},auth_{csp_{1}}\}\) to \(\mathcal{A}_{att}\). It is demonstrated that if the hard assumption \(DBDH\) holds, then the difference between \(Gm_{2}\) and \(Gm_{3}\) is ignorable, just as follows: \[|P_{r}[S_{3}]-P_{r}[S_{2}]|\leq q_{sn}Adv_{Gm_{1},Gm_{2}}^{DBDH}\] (6) If there is a differentiator which can easily differentiate \(Gm_{2}\) and \(Gm_{3}\), then \(C\) can solve the \(DBDH\) problem by using a differentiator. In the case that the differentiator interacts with \(Gm_{2}\), then \(C\) outputs 1; otherwise, it outputs 0. So, we get \(Adv_{Gm_{1},Gm_{2}}^{DBDH}\leq(\frac{1}{q_{sn}})|P_{r}[S_{3}]-P_{r}[S_{2}]\), and Equation (5) holds; the \(\mathcal{A}_{att}\) can easily differentiate the true and random session key because the values used in \(Gm_{3}\) are random. This can only be possible if the following events occur. * **Event (\(E_{C}\))**: \(\mathcal{A}_{att}\) queried \(h_{5}\) oracle, which has probability of \[P_{r}[E_{c}]=q_{l5}|P\] (7) * **Event (\(E_{D}\))**: \(\mathcal{A}_{att}\) impersonates the user by forging the \(\textit{message}_{1}=\{M_{1},TID_{k},auth_{k}\}\) which posseses the verification executed by \(\mathcal{CSP}\). The probability of generating a valid \(\textit{Message}_{1}\) by \(\mathcal{A}_{att}\) is: \[\mathit{Send}(\mathit{FN}_{f}^{j},\mathit{Message}_{1})\]0 (8)
* **Event (\(E_{E}\))**: \(\mathcal{A}_{att}\) successfully impersonates the fog-node by forging \(\textit{Message}_{2}\), which passes the verification executed by \(\mathcal{CSP}\). Like Event \(E_{D}\), the probability of generating a valid \(\textit{Message}_{2}\) by \(\mathcal{A}_{att}\) is: \[\mathit{Send}(\mathit{FN}_{f}^{j},\mathit{Message}_{1})\]1 (9) Then: \[\mathit{Send}(\mathit{FN}_{f}^{j},\mathit{Message}_{1})\]2 (10) Using Equations (1) to (5) and (9): \[ \begin{split} Adv_{p}^{tKA}(\mathcal{A}_{ah})\leq\Sigma_{a=0}^{a =4}&\frac{q_{h_{0}}^{2}=(q_{sn}+q_{ex})^{2}}{2p}+\frac{q_{h5}}{p} +\\ &\frac{2q_{h_{0}}q_{h_{2}}}{p^{2}}+q_{sn}Adv_{Gm_{1},Gm_{2}}^{DBDH }\end{split} \] (11) Hence, \[Adv_{Gm_{1},Gm_{2}}^{DBDH}\leq\frac{1}{q_{sd}}Advt_{p}^{tKA}(\mathcal{A}_{att })-\] \[ \begin{split}\frac{\Sigma_{a=0}^{a=4}q_{h_{0}}^{2}+(q_{sn}+q_{ ex})^{2}}{2 pq_{sn}}+\\ &\frac{q_{h5}}{pq_{sn}}+\frac{2q_{h0}q_{h3}}{p^{2}q_{sn}}\end{split} \] (12) Now, it can be concluded from Theorem 1 that as much as the \(DBDH\) problem is hard, for any challenger, it is computationally challenging to break the \(AKA\) security of the proposed protocol in polynomial time.