## 2 Review of [PERSON] et al.'s Scheme
### Group Access Authentication and Key Agreement Phase between Massive MDs and SN  
This phase refers to the group access authentication and key agreement process between MDs and SN, which is performed through a public channel. The MTC group leader \(MD_{n}\) aggregates the group member \(MD_{i}\)'s data and sends it to SN to authenticate between group members and SN. A detailed description of the process is presented as follows. 1. The MTC device \(MD_{i}\) precompute \(T_{m_{i}}(K_{sn}||ID_{SN_{j}})\) mod \(p\), \(T_{m_{i}}(K_{md}||GD)\) mod \(p\), \(K_{M_{2}}=(T_{m_{i}}(T_{s_{j}}(K_{sn}||ID_{SN_{j}})\) mod \(p)) mod \(p\)) mod \(p\), \(K_{G1}=T_{m_{g}}(T_{s_{j}}(K_{sn}||ID_{SN_{j}})\) mod \(p)\) mod \(p\). \(MD_{i}\) selects \(x_{i},z_{i}\) and computes \(K_{M_{2i}}=T_{x_{i}}(T_{s_{j}}(K_{sn}||ID_{SN_{j}})\) mod \(p)\) mod \(p\), \(MAC_{1}=H_{1}(K_{M_{1}}||K_{M_{2}}||K_{G_{1}}||GD||ID_{MD_{1}}||ID_{SN_{j}}||T_{m_{ }}(K_{md_{i}}||GD||ID_{MD_{1}})\) mod \(p\), \(T_{m_{g}}(K_{md_{g}}\)\(||GD)\) mod \(p||T_{x_{i}}(K_{sn}||ID_{SN_{j}})\) mod \(p||z_{i})\). Then, \(MD_{i}\) encrypts \(E_{1}=ENC_{K_{M_{1}}}(ID_{MD_{i}}\)\(||T_{m_{i}}(K_{md_{i}}||GID||ID_{MD_{i}})\) mod \(p||T_{m_{i}}(K_{md}||GD)\) mod \(p||T_{m_{i}}(K_{sn}||ID_{SN_{j}}\) mod \(p||z_{i})\) by the secret parameter \(K_{M_{ii}}\) and sends the access request \(\{ID_{SN_{j}},T_{x_{i}}(K_{sn}||ID_{SN_{j}})\) mod \(p\), \(E_{1i},MAC_{1i}\}\) to \(MD_{n}\). 3. After receiving the access request from \(MD_{i}\), \(MD_{n}\) computes \(MAC_{1}=\oplus_{i=1}^{n}MAC_{1i}\) and \(\oplus_{i=1}^{n}E_{1n}=\)\(ENC_{K_{M_{1n}}}(GID||ID_{MD_{n}}||T_{m_{n}}(K_{md_{n}}|GID||ID_{MD_{n}}\) mod \(p||T_{m_{g}}(K_{md}||GID)\) mod \(p||T_{m_{n}}(K_{md}||GD)\) mod \(p||T_{m_{n}}(K_{md}||GD)\) mod \(p||T_{m_{g}}(K_{md}||GD)\) mod \(p||z_{n})\), where \(\oplus_{i=1}^{n}\) is function of the aggregating access request for group members, and sends the aggregation request \(\{ID_{SN_{j}},\oplus_{i=1}^{n}T_{x_{i}}(K_{sn}||ID_{SN_{j}})\) mod \(p\), \(\oplus_{i=1}^{n}E_{1i}\), \(MAC_{1}\) to \(SN_{j}\). 4. On receiving the aggregation request from \(MD_{n}\), \(SN_{j}\) computes \(K^{\prime}_{M_{1i}}=T_{s_{j}}(T_{x_{i}}(K_{sn}||ID_{SN_{j}})\) mod \(p)\) mod \(p\), decrypts \(E_{1i}\) and obtains \(ID_{MD_{i}}\), \(GID\), \(T_{m_{i}}(K_{md_{i}}||GD||ID_{MD_{i}})\) mod \(p\) and \(z_{i}\). Then, \(SN_{j}\) checks whether \(ID_{MD_{i}}\) and GID are exist in a database, If they exist, \(SN_{j}\) verifies that \(H_{1}(T_{m_{g}}(K_{md_{g}}||GID)\) mod \(p||ID_{MD_{i}})\) and \(H_{1}(T_{m_{i}}(K_{md_{i}}||GD||ID_{MD_{i}})\) mod \(p||GD||ID_{MD_{i}})\) are correct. 5. \(SN_{j}\) computes \(K^{\prime}_{2i}=T_{s_{j}}(T_{m_{i}}(K_{sn}||ID_{SN_{j}})\) mod \(p)\) mod \(p\), \(K^{\prime}_{G1}=T_{s_{j}}(T_{m_{g}}(K_{sn}||ID_{SN_{j}})\) mod \(p)\) mod \(p\) and verifies that \(MAC_{1}\) is correct. If \(MAC_{1}\) is correct, \(SN_{j}\) generates \(y_{j}\) and computes \(T_{y_{j}}(K_{sn}||ID_{SN_{j}})\) mod \(p\), \(T_{s_{j}}(K_{md}||GD)\) mod \(p\), \(K_{G2}=\)\(T_{s_{j}}(T_{m_{g}}(K_{md}||GID)\) mod \(p)\) mod \(p\)), \(K_{M_{3i}}=T_{s_{j}}(T_{m_{i}}(K_{md}||GID)\) mod \(p)\) mod \(p\)). 6. \(SN_{j}\) computes \(Z=\prod_{i=1}^{n}z_{i}\), \(Z_{i}=Z/z_{i}\), \(y_{i}=Z_{i}^{-1}\) using Chinese remainder theorem (CRT). Then, \(SN_{j}\) get \(S=(\sum_{i=1}^{n}H_{2}(K^{\prime}_{M_{1i}},K_{M_{3i}},K_{G2},ID_{MD_{i}},ID_{SN _{j}}),y_{i},Z_{i})\) mod \(Z\). Then, \(SN_{j}\) computes the session key \(SK_{ij}=\)\(H_{2}(T_{y_{j}}(T_{X_{i}}(K_{sn}||ID_{SN_{j}})\) mod \(p)\) mod \(p\), \(K^{\prime}_{M_{1i}}\), \(K^{\prime}_{M_{2i}}\), \(K_{M_{3i}}\), \(K^{\prime}_{G1}\), \(K_{G2}\), \(ID_{MD_{i}}\), \(GID\), \(ID_{SN_{j}}\)) and sends the group authentication request \(\{ENC_{K^{\prime}_{G1}}(T_{y_{j}}(K_{sn}||ID_{SN_{j}})\) mod \(p\), \(T_{s_{j}}(K_{md}||GD)\) mod \(p,S\}\) to \(MD_{i}\). 7.