# Secure D2D Group Authentication Employing Smartphone Sensor Behavior Analysis
## 4 Proposed Secure Certificateless Group Authentication Scheme for D2D Communication
### Authentication Phase  
In this phase, the essential communication rounds between SN and UEs are conducted with the purpose of providing valid D2D verification. The group authentication process is assumed to be initialized with one broadcast conducted by SN. That is, SN computes the public key to be broadcast as:  
\[PK=g^{mk}, \tag{2}\]  
where \(mk\) is the system master key generated in the previous registration phase. Thereafter, SN broadcast \(\langle Request,PK\rangle\) to all entities, where the authentication request, along with the public key is delivered.  
After receiving the request, each UE adopts the stored \(\langle X_{i},\mathcal{U}_{i},\mathcal{V}_{i}\rangle\), along with the derived \(PK\) to verify whether the following formula holds:  
\[\varepsilon(\mathcal{U}_{i},PK)\mathcal{V}_{i}\overset{?}{=}\varepsilon(X_{i},PK). \tag{3}\]  
The correctness of the above equation follows from direct verification of the equalities below:  
\[\begin{split}&\hat{\varepsilon}(\mathcal{U}_{i},PK)\mathcal{V}_{i}\\ &=\hat{\varepsilon}(\mathcal{U}_{i},PK)\hat{\varepsilon}( \zeta_{i},g^{-r_{i}})^{mk}\\ &=\hat{\varepsilon}(X_{i}\zeta_{i}^{r_{i}},g^{mk})\hat{ \varepsilon}(\zeta_{i},g^{-r_{i}})^{mk}\\ &=\hat{\varepsilon}(X_{i}\zeta_{i}^{r_{i}},\delta)^{mk}\hat{ \varepsilon}(\zeta_{i}^{-r_{i}},g)^{mk},\\ &=\hat{\varepsilon}(X_{i},g^{mk})\\ &=\hat{\varepsilon}(X_{i},PK)\\ &=\eta_{i}\end{split} \tag{4}\]  
where the security relies on the DBDH assumption. If the equation does not hold, UE terminates the process and abandons the received message. Otherwise, UE randomly generates its own partial secret key \(\vartheta_{i}\in\mathbb{Z}_{\mathcal{P}}\) and computes  
\[\mathcal{T}_{i}=PK^{\vartheta_{i}} \tag{5}\]  
for subsequent verification. In this case, the full secret key set of UE is denoted as \(\langle X_{i},\vartheta_{i}\rangle\), which are respectively generated by UE and SN. Moreover, the previous calculated authentication result of \(\hat{\varepsilon}(\mathcal{U}_{i},PK)\mathcal{V}_{i}\) is stored as \(\eta_{i}=\hat{\varepsilon}(\mathcal{U}_{i},PK)\mathcal{V}_{i}\). Consequently, the temporary identity \(Tid_{i}\) of UE is derived as  
\[Tid_{i}=\mathcal{U}_{i}X_{i}{}^{-1}=X_{i}X_{i}{}^{-1}\zeta_{i}^{r_{i}}=\zeta_{ i}^{r_{i}}. \tag{6}\]  
Additionally, the certificate \(Auth_{i}\) involving the aforementioned information can be calculated as  
\[Auth_{i}=H_{2}(Tid_{i},\mathcal{T}_{i},\eta_{i}), \tag{7}\]  
which is transmitted to SN in the form of \(\langle Tid_{i},\mathcal{T}_{i},Auth_{i}\rangle\).  
It is worth nothing that, due to the broadcasting feature, multiple replying messages are transmitted to SN simultaneously. Hence SN first compares the received \(Tid_{i}\) with its database in order to search for the matched UE. Note that the corresponding values \(\{\zeta_{1}^{r_{1}},\ldots,\zeta_{i}^{r_{i}}\}\) are computed and stored previously so that repetitive operations are prevented. Thereafter, SN checks the correctness of the received \(Auth_{i}\), where \(\eta_{i}\) can be acquired according to \(\eta_{i}=\hat{\varepsilon}(X_{i},PK)\). If it matches, SN computes  
\[g^{\vartheta_{i}}=\mathcal{T}_{i}g^{-mk}, \tag{8}\]  
which will be used in the subsequent group key distribution phase.