## 7 Security Analysis
### Formal Security Analysis Using ROR Model  
ROR model [14] is the formal security analysis to verify session key (SK) security of protocol from active/passive attacker \(U_{A}\). We first discuss the ROR model before performing the proof of SK security for the proposed protocol. In our protocol, there are two participants SG device \(P_{SD_{i}}^{t_{1}}\) and UC \(P_{UC_{j}}^{t_{2}}\), where \(P_{SD_{i}}^{t_{1}}\) and \(P_{UC_{j}}^{t_{2}}\) are instances \(t_{1}^{th}\) of \(SD_{i}\) and \(t_{2}^{th}\) of \(UC_{j}\), respectively. Table 4 defines queries for ROR model to perform security analysis, including _Execute_, \(CorruptSD\), _Reveal_, \(Send\), and _Test_ queries. _Hash_ is also a random oracle, which is a collision-resistant hash function. We uses [PERSON]'s law [29] to prove SK security of the proposed protocol, which has been widely applied to verify recent authentication schemes [30; 31]. **Theorem 1**: _If \(Adv_{U_{A}}\) denotes the advantage function of a malicious attacker \(U_{A}\) in violating SK security of the proposed authentication scheme, then_  
\[Adv_{U_{A}}\leq\frac{q_{h}^{2}}{|Hash|}+2\{C\cdot q_{send}^{s}\}\]  
_where Hash, \(q_{send}\) and \(q_{h}\) are the number of Hash query, the number of Send query, and the range space of the hash function \(h(. )\), respectively, and \(s\) and \(C\) are the [PERSON]'s parameters [29]._  
**Proof. ** Similarly, we adopt the proof as presented in [32; 33]. A sequence of four games is denoted by \(GM_{i}\), where \(i\in[0,3]\) are defined for demonstrating the SK security of the proposed authentication scheme. We denote that \(Succ_{i}\) is the probability a malicious attacker \(U_{A}\) wins the game \(GM_{i}\). The detailed descriptions of these four games are shown in Game 0-3. * **Game \(GM_{0}\)**: This game is the initial game in which \(U_{A}\) selects the random bit \(c\). In addition, this game denotes actual attack of \(U_{A}\) for the protocol and \(c\) is guessed at the beginning of \(G_{0}\). According to this game, we can get, \[Adv_{U_{A}}=|2\cdot Pr[Succ_{0}]-1|\] (1)
* **Game \(GM_{1}\)**: This game denotes that \(U_{A}\) performs an eavesdropping attack, in which it intercepts all transmitted messages \(\{M_{1},M_{2},M_{3}\}\) and \(\{M_{4},M_{5},M_{6}\}\) during authentication process utilizing _Execute_ query. Once the game ends, \(U_{A}\) sends _Test_ and _Reveal_ queries. The output of the _Test_ and \begin{table}
\begin{tabular}{p{142.3 pt} p{284.5 pt}} \hline \hline
**Query** & **Description** \\ \hline \(Execute(P_{SD_{i}}^{t_{1}},P_{UC_{j}}^{t_{2}})\) & This query denotes that \(U_{A}\) can eavesdrop transmitted messages between \(SD\) and \(UC\) over insecure channel. This query is modeled as an eavesdropping attack. \\ \hline \(CorruptSD(P_{SD_{i}}^{t_{1}})\) & This corrupt SG device query means that \(U_{A}\) can extract sensitive information stored in the SG device utilizing power-analysis attack. This query is modeled as an active attack. \\ \hline \(Send(P^{t},M)\) & This query denotes that \(U_{A}\) can transmit message \(M\) to \(P^{t}\) and can also receive the corresponding message from \(P^{t}\). This query is modeled as an active attack. \\ \hline \(Test(P^{t})\) & This query means that an unbiased coin \(c\) is first flipped before the experiment begins and its output is used as a decider. \(U_{A}\) execute this query and if session key \(SK_{ij}\) between \(SD\) and \(UC\) is fresh, \(P^{t}\) returns \(SK_{ij}\) if \(c=1\) or a random number when \(c=0\). Otherwise, it returns the null value \(\bot\). \\ \hline \(Reveal(P^{t})\) & The query means that \(U_{A}\) can compromise \(SK_{ij}\) between \(P^{t}\) and its partner in the current session. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Queries of ROR model. _Reveal_ queries decide if \(U_{A}\) obtains random numbers and shared session key \(SK_{ij}=h(R_{SD}||R_{UC})\) between \(SD\) and \(UC\). To derive \(SK_{ij}\), \(U_{A}\) needs secret information \(R_{SD}\), \(R_{UC}\), and \(X_{i}\).