## 4 The Proposed Scheme: LDAKM-EIoT
### Pre-Deployment Phase
#### 4.1.1 Registration of IoT Devices  
The \(TA\) firsts picked a distinct unique identity \(ID_{D_{i}}\) for every IoT device \(D_{i}\) and computed its corresponding pseudo identity as \(RID_{D_{i}}=h(n||ID_{D_{i}})\), temporal credentials \(TC_{D_{i}}=h(RID_{D_{i}}\)\(||ID_{EN}\)\(||ID_{TA}\)\(||n\)\(||RTS_{D_{i}})\), \(AD_{i}=h(K_{EN-D_{i}}||\)\(ID_{D_{i}}\)\(||ID_{EN}||\)\(RTS_{D_{i}})\) where \(RTS_{D_{i}}\) is the registration timestamp for \(D_{i}\), \(K_{EN-D_{i}}\) is a 1024 bit shared secret key between each IoT device \(D_{i}\) and edge nodes generated by the \(TA\), where \(i=1,2,\cdots n_{d}\), and \(n_{d}\) is the total count of IoT devices. Moreover, \(ID_{EN}\) is the identity of an edge node \(EN\) where the IoT devices need to authenticate a cloud server \(CS_{j}\) with an IoT device \(D_{i}\). \(ID_{TA}\) is the identity of \(TA\), and \(n\) is a 160 bit secret number of \(TA\) that is only disclosed to the \(TA\). After that, \(TA\) generates a temporary identity \(TID_{D_{i}}\) for each \(D_{i}\). Note that temporal credentials are different for each IoT device \(D_{i}\), which protects against various attacks including impersonation attack, in case any IoT device is physically compromised by an attacker. Lastly, the trusted authority stores the credentials \(\{RID_{D_{i}},\)\(TID_{D_{i}},\)\(TC_{D_{i}},\)\(AD_{i},h(\cdot)\}\) in the memory of \(D_{i}\) prior to its placement in the IoT network.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Symbol** & **Meaning** \\ \hline \(D_{i}\), \(ID_{D_{i}}\) & \(i\)th IoT device and its identity, respectively \\ \(CS_{j}\), \(ID_{CS_{j}}\) & \(j\)th cloud server and its identity, respectively \\ \(EN\), \(ID_{EN}\) & Edge node and its identity, respectively \\ \(TA\), \(ID_{TA}\) & Trusted authority and its identity, respectively \\ \(RID_{D_{i}}\), \(RID_{CS_{j}}\) & Pseudo identities of \(D_{i}\) and \(CS_{j}\), respectively \\ \(TID_{D_{i}}\) & Temporary identity of \(D_{i}\) \\ \(K_{EN-D_{i}}\) & 1024 bit shared secret key of the IoT device and edge node generated by \(TA\) \\ \(K_{EN-CS_{i}}\) & 1024 bit shared secret key of the edge node and cloud server generated by \(TA\) \\ \(n\) & 160 bit secret secret of \(TA\), which is only known to \(TA\). \\ \(RTS_{D_{i}}\) & Registration timestamp of \(D_{i}\) \\ \(n_{d}\), \(n_{c}\) & Number of IoT devices and cloud servers deployed initially, respectively \\ \(r_{d,}\), \(r_{em}\), \(r_{em}\), \(r_{em}\), \(r_{cs_{j}}\) & 128 bit random numbers of \(D_{i}\), \(EN\), and \(CS_{j}\), respectively \\ \(T_{1}\), \(T_{2}\), \(T_{3}\), \(T_{4}\) & Current timestamps generated by different entities \\ \(\Delta\)\(T\) & “Maximum transmission delay” associated with a message \\ \(h(\cdot)\) & “Collision resistant cryptographic one way hash function” \\ \(SK_{D_{i}-CS_{j}}\) & Session key between \(D_{i}\) and \(CS_{j}\) \\ \(||\), \(\oplus\) & Concatenation and bitwise \(XOR\) operations, respectively \\ \hline \hline \end{tabular}
\end{table}
Table 1: Notations used in the lightweight authenticated key management mechanism for the edge-based IoT environment (LDAKM-EIoT).