# Lightweight and Security-Enhanced Key Agreement Protocol Using PUF for IoD Environments
## 6 Proposed Protocol
### Key Agreement Phase  
The mobile device inputs \(ID_{M}\) and \(PW_{M}\), computes \(HPW_{M}=h(ID_{M}\parallel PW_{M}\parallel r_{M}),HID_{M}=h(ID_{M}\parallel HPW_{M} \parallel r_{M}),F_{M}=h(h(HID_{M}\parallel r_{M})\oplus h(HPW_{M} \parallel r_{M}))\), \(K_{M}=K_{M}^{*}\oplus F_{M},G_{M}^{{}^{\prime}}=h(F_{M}\parallel K_{M} \parallel r_{M})\), and checks \(G_{M}^{{}^{\prime}}=G_{M}\). Next, the mobile device chooses a random number (\(r_{3}\)) and a timestamp (\(T_{1}\)) and computes \(R_{1}=h(HID_{M}\parallel K_{M})\oplus r_{3}\), \(R_{2}=h(HID_{M}\parallel K_{M}\parallel r_{3})\oplus PID_{D},V_{M}=h(HID_{M} \parallel K_{M}\parallel r_{3}\parallel T_{1})\). Then, the mobile device sends \(\{HID_{M},V_{M},R_{1},R_{2},T_{1}\}\) to the GCS.  
The GCS checks \(T_{2}-T_{1}\leq\Delta T\), retrieves \(HID_{M},r_{2}\), and computes \(K_{M}=h(HID_{M}\parallel k\parallel r_{2}),r_{3}=h(HID_{M}\parallel K_{M} \oplus R_{1},PID_{D}=h(HID_{M}\parallel K_{M}\parallel r_{3})\oplus R_{2},V_{ M}^{{}^{\prime}}=h(HID_{M}\parallel K_{M}\parallel r_{3}\parallel T_{1})\). Afterward, the GCS checks \(V_{M}^{{}^{\prime}}=V_{M}\), updates \(HID_{M}^{new}=h(HID_{M}\parallel r_{3})\), and chooses \(r_{4}\). Then, the GCS computes \(K_{D}=h(PID_{D}\parallel k\parallel r_{1}),R_{3}=h(PID_{D}\parallel K_{D} \oplus(r_{3}\parallel r_{4}),R_{4}=h(PID_{D}\parallel K_{D}\parallel r_{3}) \oplus h(HID_{M}\parallel K_{M}),V_{G}=h(h(HID_{M}\parallel K_{M})\parallel PID _{D}\parallel K_{D}\parallel r_{3}\parallel r_{4}\parallel T_{2})\) and sends \(\{C_{j},V_{G},R_{3},R_{4},T_{2}\}\) to the drone.  
The drone checks \(T_{3}-T_{2}\leq\Delta T\) and computes \(R_{j}=PUF(C_{j}),K_{D}=K_{D}^{*}\oplus R_{j},(r_{3}\parallel r_{4})=h(PID_{D} \parallel K_{D})\oplus R_{3},h(HID_{M}\parallel K_{M})=R_{4}\oplus h(PID_{D} \parallel K_{D}\parallel r_{3}),V_{G}^{{}^{\prime}}=h(h(HID_{M}\parallel K_{M} )\parallel PID_{D}\parallel K_{D}\parallel r_{3}\parallel r_{4}\parallel T_{2})\). Then, the drone confirms \(V_{G}^{{}^{\prime}}=V_{G}\), chooses a random number (\(r_{5}\)), and computes \(R_{5}=h(h(HID_{M}\parallel K_{M})\parallel PID_{D}\parallel K_{D} \parallel r_{3})\oplus(r_{5}\parallel R_{j}),SK_{D}=h(h(PID_{D} \parallel K_{D}\parallel R_{j})\parallel h(HID_{M}\parallel K_{M})\parallel r _{3}\parallel r_{4}\parallel r_{5}),Auth_{D}=h(SK_{D}\parallel r_{4}\parallel r _{5})\). Then, the drone sends \(\{R_{5},Auth_{D},T_{3}\}\) to the GCS.  
The GCS checks \(T_{4}-T_{3}\leq\Delta T\) and computes \((r_{5}\parallel R_{j})=R_{5}\oplus h(h(HID_{M}\parallel K_{M})\parallel PID_{D} \parallel K_{D}\parallel r_{3}),Auth_{D}=h(SK_{D}\parallel r_{4}\parallel r_{5})\). Afterward, the GCS checks \(Auth_{D}^{{}^{\prime}}=Auth_{D}\) and computes \(R_{6}=h(HID_{M}\parallel K_{M})\oplus(r_{4}\parallel r_{5}\parallel R_{j}),R_{ 9}=h(HID_{M}\parallel K_{M}\parallel r_{5})\oplus h(PID_{D}\parallel K_{D}),Auth _{GCS}=h(Auth_{D}\parallel r_{3}\parallel r_{4}\parallel T_{4})\). Then, the GCS sends \(\{R_{5},R_{6},Auth_{GCS},T_{4}\}\) to the mobile device.  
The mobile device checks \(T_{5}-T_{4}\leq\Delta T\) and computes \((r_{4}\parallel r_{5}\parallel R_{j})=R_{6}\oplus h(HID_{M}\parallel K_{M} ),h(PID_{D}\parallel K_{D})=R_{9}\oplus h(HID_{M}\parallel K_{M}\parallel r_{5}), SK_{M}=h(h(PID_{D}\parallel K_{D}\parallel R_{j})\parallel h(HID_{M} \parallel K_{M})\parallel r_{3}\parallel r_{4}\parallel r_{5}),Auth_{D}^{{}^{ \prime}}=h(SK_{D}\parallel r_{4}\parallel r_{5}),Auth_{GCS}^{{}^{\prime}}=h(Auth _{D}\parallel r_{3}\parallel r_{4}\parallel T_{4})\). Then, the mobile device checks \(Auth_{GCS}^{{}^{\prime}}=Auth_{GCS}^{{}^{\prime}}\) and updates \(HID_{M}^{new}=h(HID_{M}\parallel r_{3}),K_{M}^{new}=h(HID_{M}^{new}\parallel k \parallel r_{2})\). The key agreement phase is presented in Figure 4.