## 4 Security Fixes  
In [PERSON] et al.'s scheme [PERSON] et al. (2018), the major security issues is that the secret parameters are stored in a smartcard (SC) or memory of devices without applying any cryptographic method. An adversary can easily extract and obtain the secret parameters using power analysis because of this problem. It makes the scheme vulnerable to a single point of failure, UE impersonation, MD impersonation attacks, inability to achieve secure mutual authentication and to exhibit a wrong threat model. These major security issues are discussed in Section 3.  
In the last decades, several authentication and key agreement protocols have been designed to ensure user and data privacy. These protocols store the secret parameters in the memory of devices such as UE, micro-sensor, smartcard, etc., which use it to authenticate and establish the session key between entities. Like other studies, [PERSON] et al. proposed the LSAA scheme using the same approach. However, according to [PERSON] et al.'s threat model, we assume that an adversary can easily compromise the physical IoT devices and extract the sensitive data stored in the memory of the devices. Although [PERSON] et al. realized that an adversary can easily compromise IoT devices, they did not consider these problems in the design of their proposed protocol.  
Herein, we suggest the necessary guidelines to mitigate the security weaknesses of the [PERSON] et al.'s scheme.  
Figure 13: Simulation result of Scenario 2.  
* In the registration phase of [PERSON] et al.'s scheme, the KGC should not issue the secret parameters as plaintext to prevent stolen device attacks. The UE and MD should store the secret parameters in encrypted form using XOR operation and a hash function.
* The LSAA scheme adopts the two-factor authentication technique using smartcard and secret parameters. However, the LSAA scheme does not verify whether UE and MD are from a legitimate entity that has the same security as the one-factor authentication scheme. Thus, the UE and MD need to ensure that the user is a legitimate user using a password or biometrics to improve the security level. We suggest the three-factor authentication with biometrics using a fuzzy extractor [24]
* In the [PERSON] et al.'s scheme, the KGC selects only one MTG group leader per group and this leads to a single point of failure attack. The KGC recodes the group leader list and related parameters in a blockchain to ensure that all members can freely access the leader of other groups. This prevents the issue of a single point of failure attack because the group members can freely access other group leaders when there is a problem with its group leader.  
In these suggested solutions, the UE, and MD impersonation attacks can be mitigated and we do not assert that our suggested solutions are perfect against the above-mentioned security issues. However, it will definitely improve the security of the system and increase the attack complexity for an adversary.  
[PERSON] et al. did well by designing a novel group access authentication scheme in 5G networks. However, they would have looked at their scheme from various angles. Bringing improvements in a field of study is a difference in the individual approaches of researchers. Surely, this paper will bring about awareness of the need to design a secure and efficient authentication scheme for IoT environments.