## 4 Security Analysis and Simulation Verification
### Informal Analysis of Protocol Security  
#### 4.2.1 Detailed Steps for Formal Security Analysis  
Anti-Imitation Attack  
During the authentication key negotiation phase, attacker C imitates protocol instance A to participate in the session by performing the following steps:  
1. Select a random number \(r_{c}\). Because the registration fails, a random number \(y_{c}\), \(ID_{C}\) is selected as the long-term key. Calculate \(N_{c}=(r_{c}\cdot ID_{c})\cdot P\).
2. Generate the timestamp \(TS_{c}\).
3. Calculate the summary value \(H_{c}=H(ID_{C}||TS_{c}\ ||N_{c})\).  
* Obtain \(Ecx\) by XOR scrambling the x-axis of point \(N_{c}\) of the elliptic curve: \(Ecx=N_{c-x}\oplus(y_{c}-x_{c})\).
* Obtain \(Ecy\) by XOR scrambling the y-axis of the point of the elliptic curve \(N_{c}\): \(Ecy=N_{c-y}\oplus(y_{c}-x_{c})\).
* Send the message \(E_{yc-xx}(ID_{C})\), \(Ecx,Ecy\), \(H_{c},TS_{c}\) to protocol entity B.  
After receiving the attacker's message, protocol entity B performs the following steps:  
* Decrypt the x-axis information: \(N^{\prime}_{c-x}=Ecx\oplus(y_{c}-x_{c})\).
* Decrypt the y-axis information: \(N^{\prime}_{c-y}=Ecy\oplus(y_{c}-x_{c})\).
* By combining the above x- and y-axis information, we obtain \(N^{\prime}_{c}=(N^{\prime}_{c-x^{\prime}},N^{\prime}_{c-y})\).
* Decrypt \(E_{yc-xc}(ID_{C})\) by using a symmetric decryption algorithm to obtain the ID: \(ID^{\prime}_{c}=D_{yb-xb}(E_{yc-xc}(ID_{C}))\).
* Calculate using a one-way hash function: \(H^{\prime}_{c}=H(ID^{\prime}_{C}||TS^{\prime}_{c}||N^{\prime}_{c})\).
* Because \(y_{c}\) is not legally registered, the calculated \(y_{c}-x_{c}\
eq y_{b}-x_{b}\); that is, \(H_{c}\
eq H^{\prime}_{c}\), and thus, the session is rejected.  
In summary, the authentication key-negotiation phase can resist impersonation attacks.  
Perfect Forward Security  
We assume that the long-term keys \(y_{a},y_{b},ID_{A},ID_{B}\) of protocol entities A and B are leaked. Because the session key is obtained by calculating \(SSK_{AB}=H(r_{a}\cdot ID_{A}\cdot r_{b}\cdot ID_{B}\cdot P)\), under normal circumstances, attacker C cannot obtain the temporary information \(r_{a},r_{b}\) of the session during the authentication key-agreement phase, and it cannot obtain the session key \(SSK_{AB}\) for each session. Therefore, the disclosure of the long-term key does not affect the security of the session key of the previous session. Thus, the protocol has complete forward security.  
Anti-Repetition Attack  
Supposing that attacker C sends the message \(``E_{yu-xx}(ID_{A})\), \(Eax\), \(Eay\), \(H_{a}\), \(TS_{a}\)\", the replay is sent to protocol entity B. Because protocol entity B has already received the above data packet, that is, there is the same timestamp information \(TS_{a}\), protocol entity B will reject the data packet because of the uniqueness of the timestamp. If attacker C constructs the timestamp information \(TS_{c}\) itself and sends it to the protocol entity B after exchanging \(TS_{c}\), B can evaluate the timeliness of \(TS_{c}\). If the time interval exceeds the threshold value, the data packet is rejected. Therefore, the protocol prevents replay attacks. The steps for analyzing replay attacks for other messages are the same as those for the messages mentioned above.  
Known Key Security  
Assume that an attacker successfully obtains session key \(SSK_{AB}\) for a session. As each session key is associated with temporary session information \(r_{a},r_{b}\), even if the attacker obtains a specific session key, the session key has no correlation with that of the current session. Therefore, the attacker cannot use it to infer the session key of the current session. Thus, the protocol has known key security.