# Secure D2D Group Authentication Employing Smartphone Sensor Behavior Analysis
## 4 Proposed Secure Certificateless Group Authentication Scheme for D2D Communication
### Group Key Distribution Phase  
In our design, a commonly shared secret key is allocated to provide universal group communication channel between SN and all the legitimate UEs. In this way, message broadcasting is available for practical applications such as emergency rescue. Instead of delivering the keying message to individual devices one by one, SN conducts a one-time broadcast to all, offering a more efficient way for key distribution.  
It is assumed that \(t\) UEs (\(ID_{i}\in S\)) has passed the previous verification in SN side. Hence the group key should be successfully delivered to all UEs, while the outsiders cannot derive the group key through eavesdropping. Accordingly, for \(i\in[1,t]\), SN computes  
\[\varphi_{i}=H_{3}(\hat{e}(g^{\theta_{i}},X_{i}),\eta_{i}), \tag{9}\]  
which involves the UE partial secret key and SN information as well. Hence \(\varphi_{i}\) is one-to-one mapped to certain UE with \(ID_{i}\). With the calculated set \(\{\varphi_{1},\ldots,\varphi_{t}\}\), SN randomly generates the group key \(\gamma\in\mathbb{Z}_{\mathcal{P}}\) and constructs the following function:  
\[f(x) =(x-\varphi_{1})\ldots(x-\varphi_{t})+\gamma\] \[=\prod_{i=1}^{t}(x-\varphi_{i})+\gamma\qquad\qquad, \tag{10}\]  
which can then be further illustrated as  
\[f(x) =x^{t}+a_{t-1}x^{t-1}+a_{t-2}x^{t-2}\ldots+a_{1}x+a_{0}\] \[=x^{t}+\sum_{i=1}^{t-1}a_{i}x^{i}+a_{0}\qquad\qquad\qquad, \tag{11}\]  
where \(\{a_{0},a_{1},\ldots,a_{t-1}\}\) are the coefficients composing the \(f(x)\) formula. It is worth nothing that for \(\forall i\in[1,t]\), \(f(x)=\gamma\) holds. Subsequently, SN computes  
\[\left\{\begin{array}{l}\delta=w^{mk}\\ \wp=H_{4}(\zeta_{i},a_{0},\ldots,a_{t-1})\end{array}\right. \tag{12}\]  
and delivers the following packet \(\langle\delta,\wp,a_{0},\ldots,a_{t-1}\rangle\) to all.  
Upon receiving the packet, the correctness of \(\wp\) is validated, as well as the following equation:  
\[\hat{e}(\delta,g)\overset{?}{=}\hat{e}(w,PK). \tag{13}\]  
At this point, all the UE are able to construct \(f(x)\) according to the derived coefficient set \(\{a_{0},a_{1},\ldots,a_{t-1}\}\). In this case, UE computes its corresponding  
\[\varphi_{i}=H_{3}(\hat{e}(g^{\theta_{i}},X_{i}),\eta_{i}) \tag{14}\]  
and adopts \(\varphi_{i}\) into  
\[f(\varphi_{i})=\gamma, \tag{15}\]  
where the distributed group key \(\gamma\) is derived in UE side. Note that the coefficient set \(\{a_{0},a_{1},\ldots,a_{t-1}\}\) are distributed in plaintext, indicating that all devices can build the formula \(f(x)\). However, only the validated UEs can acquire the correct group key \(\gamma\) with self-computed \(\varphi_{i}\). In this way, the group key is preserved.  
At this point, the group communication channel is enabled by utilizing the group key \(\gamma\). For two strings \(a\) and \(b\), let \([a]_{\ell}\) represents the first \(\ell\) bits of \(a\), \(a||b\) represents the concatenation of \(a\) and \(b\). Hence the following one-time-pad format can be applied for D2D transmission:  
\[\left(\left[H_{1}(\gamma,TS)\right]_{\ell_{m}}\oplus m\right)\left|\left| \left[H_{1}\left(\gamma,TS\right)\right]_{(\ell-\ell_{m})},\right.\right. \tag{16}\]  
where \(TS\) denotes the current timestamp. Moreover, the length of hashed value \(H_{1}(\gamma,TS)\) is defined as \(\ell\), the length of the transmitted message is defined as \(\ell_{m}\) with \(\ell_{m}\leq\ell\), exclusive disjunction is conducted between message \(m\) and the first \(\ell_{m}\) bits of hashed value, while the remaining \((\ell-\ell_{m})\) bits is used for validation by the receiver. The destination devices can easily decrypt it and derive \(m\), where the hashed value \(H_{1}(\gamma,TS)\) is used as the symmetric key for both encryption and decryption. Hence, the group key is successfully distributed, D2D secure transmission is provided in this way.