# Anticollusion Attack Noninteractive Security Hierarchical Key Agreement Scheme in WHMS

Authors: Kefei Mao; Jianwei Liu; Jie Chen
Journal: Journal of Electrical and Computer Engineering
 (2016)

---

## Abstract

Wireless Health Monitoring Systems (WHMS) have potential to change the way of health care and bring numbers of benefits to patients, physicians, hospitals, and society. However, there are crucial barriers not only to transmit the biometric information but also to protect the privacy and security of the patients’ information. The key agreement between two entities is an essential cryptography operation to clear the barriers. In particular, the noninteractive hierarchical key agreement scheme becomes an attractive direction in WHMS because each sensor node or gateway has limited resources and power. Recently, a noninteractive hierarchical key agreement scheme has been proposed by Kim for WHMS. However, we show that Kim’s cryptographic scheme is vulnerable to the collusion attack if the physicians can be corrupted. Obviously, it is a more practical security condition. Therefore, we proposed an improved key agreement scheme against the attack. Security proof, security analysis, and experimental results demonstrate that our proposed scheme gains enhanced security and more efficiency than Kim’s previous scheme while inheriting its qualities of one-round communication and security properties.


---

## Body

## 1. Introduction

Wireless Health Monitoring System (WHMS) is a dedicated network environment that supports the biometric information acquisition devices to gather people’s health data anytime and anywhere [1]. Moreover, WHMS is a typical example of using wireless technologies to reduce medical expense and improve social benefits, such as detecting the lonely stroke patients timely [2, 3]. Security and privacy are the major concerns in medical activities, and WHMS is not an exception [4–6]. To provide privacy and security assurances in WHMS, it is important to provide security services by using cryptographic algorithms. Thus, obtaining cryptographic keys is an essential operation to achieve the security goals in WHMS. There are several key agreement schemes that have been proposed for WHMS applications [5, 7–10].The noninteractive scheme is becoming a very active direction in the sensors networks [11–14] because sensor nodes have limited energy and processing and storage abilities. A noninteractive hierarchical key agreement scheme, called the Freshness-Preserving Noninteractive Hierarchical Key Agreement Protocol (FNKAP), was proposed by Kim [8] in 2014. The major advantages of the proposed scheme in Kim [8] go as follows. Firstly, there is only one-round communication to agree on a session key between two entities. Secondly, it is declared that the FNKAP achieves the patient anonymity and the session key confidentiality, and it can resist active and passive security attacks. However, we found that there is a flaw in the FNKAP when the physicians are not to be trusted. The scheme is not strong enough against the collusion attack where there are two adversaries who are a physician and a patient, separately. More precisely, in order to obtain a specific patient’s electronic medical data, the adversary can pretend to be sick and become the same physician’s patient with the victim in the real world. Then, the adversary bribes any other physician to get the private values of a physician. Finally, the adversary could calculate the session key and decrypts the victim’s electronic health data freely. Note that a physician can casually expose the private values because the disclosed values are untraceable in Kim’s scheme. As a result, this method of attack is reasonable and straightforward to implement.The contributions of this paper are twofold. First, we illustrate that there is a weakness in FNKAP and introduce specific attack methods. Second, we propose an enhanced security hierarchical key agreement scheme with noninteracting for WHMS based on pairings. Security proof and analysis illustrate our scheme enhances security strength of FNKAP, and it can resist the collusion attack. Moreover, theoretical analysis results show that our scheme is more efficient than Kim’s work.The rest of this paper is organized as follows. We formalize a basic system structure for WHMS in Section2, and we also give the security model and define the adversary’s ability in the same section. We simply highlight Kim’s scheme [8] in Section 3. The weakness of Kim’s scheme is discussed in Section 4. We detail our enhanced security hierarchical key agreement scheme against the security attacks in Section 5. We present the analysis of our improvements regarding correctness and security in Section 6. We compare our scheme with Kim’s scheme in terms of functionality and performance in Section 7. Finally, this paper is concluded in Section 8.


## 2. Preliminaries

We first illustrate the basic system structure of WHMS in this section. Moreover, we introduce security threats, security model, bilinear group, and mathematic assumption, separately. Basic notations are provided in Notations section.


### 2.1. Basic Structure

As depicted in Figure1, a typical hierarchical key agreement for WHMS involves five types of parties. They are, namely, the u-Health Server (S
V), the physicians (P
H), the patients (P
A), the gateways (G
W), and the sensor nodes (S
N). There is a hierarchical permission structure from the u-Health Server S
V to the physicians P
H
i, i
∈
(
1,2
,
…
), to the gateway G
W
i
,
j, i
,
j
∈
(
1,2
,
…
) of patients P
A
i
,
j and to the sensor node S
N
i
,
j
,
d, i
,
j
,
d
∈
(
1,2
,
…
) of the gateway G
W
i
,
j [7, 8].Figure 1
Basic hierarchical key agreement structure in WHMS.As the root authority,S
V is responsible for managing the entities’ authorities in WHMS. S
V produces the private keys of entities such as G
W, S
N, and P
H. When P
A wants to use WHMS, his/her G
W and S
N should agree on the session keys with the physician (P
H), separately. Similarly, when P
H wants to send a diagnostic report to P
A, he/she should also agree on a session key with P
A.


### 2.2. Security Threats

Kim assumes that the physicians are trusted in paper [8]. However, we point out that the scheme should take the risk of the physician’s corruption because it is more practical. In practice, not all physicians are trusted all the time. For example, as reported, the staff of a famous hospital sold the patient’s personal medical data in USA [7], and 500 patients’ medical information may have been compromised at a medical center in LA because an employee’s laptop was stolen [15].Thus, we assume a security model in which the adversary has the following abilities. First, the adversary can totally control the channel. Therefore, the adversary can eavesdrop, intercept, modify, replay, or inject any data via the channel. Second, the adversary can compromise the secure information from the physicians except for the victim’s current physician. Third, the adversary can also compromise several sensor nodes and gateways except for the victim’s currentG
W and S
N.We aim to achieve the following security goals under the above security threats.Key Agreement. Two entities establish a session key which is only known by specific entities.Anonymity and Untraceability. The identities of G
W and S
N should be kept confidential from the adversary and cannot be traced by the adversary.Resistance Passive and Active Attacks. The scheme is secure against the passive and active attacks.


### 2.3. Security Model

Inspired by the security model for a noninteractive hierarchical key agreement scheme [11] and the original Bellare-Rogaway key exchange model [16], the security model of our scheme is stated as follows.Participants. We model the scheme participants as a finite set U of fixed size with each A being a Probabilistic Polynomial Time (PPT) turing machine. Each scheme participant A
∈
U may execute a polynomial number of protocol instances in parallel. We will refer to sth instance of principal A communicating with peer B as ∏
A
,
B
s
‍.Adversary Model. The adversary A is modeled as a PPT Turing machine and can be given all public parameters of the system, and he/she can access the oracle by issuing some specified queries:(i)
S
e
n
d
(
∏
A
,
B
s
‍
,
D
). The adversary A sends the message D to the session s executed by A communicating with B. Since our proposal is a noninteractive scheme, the query does not need to be responded to.
(ii)
E
s
t
a
b
l
i
s
h
(
A
). The adversary A names a node A and obtains all the secret values held by the node. Neither of the patient’s gateway and sensor nodes named in the test query or any of their ancestors can be established.
(iii)
R
e
v
e
a
l
(
∏
A
,
B
s
‍
). If the query is achieved, the system returns the session key to the adversary A. The session between the target patient’s facilities (a gateway and sensor nodes) and the physician cannot be revealed.
(iv)
T
e
s
t
(
∏
A
,
B
s
‍
). Only one query of this form is allowed for the adversary A. The adversary A names I
D
A and I
D
B and executes this query at any time. Then, a number s
k is returned as follows. A bit b is chosen at random in {
0,1
}. If b
=
1 then the adversary gets the secret key shared between the two nodes, and if b
=
0 it gets a key chosen at random from the set of all possible shared keys.Definition 1 (HKA-security).
As a function of the security parameterk, we define the advantage A
d
v
A
,
∑
H
K
A of the PPT adversary A in an attacking scheme ∑ as(1)
A
d
v
A
,
∑
H
K
A
=
2
S
u
c
c
A
,
∑
H
K
A
-
1
.Here,S
u
c
c
A
,
∑
H
K
A is the probability that the adversary queries T
e
s
t
(
∏
A
,
B
s
‍
) and outputs a bit b
∗ such that b is used by the test query. We call a hierarchical key agreement scheme ∑ to be HKA secure if for any PPT adversary the A function is negligible.


### 2.4. Bilinear Groups

Definition 2 (bilinear map).
G
1 is an additive cyclic group of prime order q and G
2 is a multiplicative cyclic group of prime order p. The bilinear pairing is a map e
^
:
G
1
×
G
1
→
G
2 with the following properties [17].Bilinearity. For all P
,
Q
∈
G
1 and a
,
b
∈
Z
q
∗, we have e
^
(
a
P
,
b
Q
)
=
e
^
(
P
,
Q
)
a
b.Nondegeneracy. The map does not send all pairs in G
1
×
G
1 to the identity in G
2.Computability. There exists an efficient algorithm to compute e
^
(
P
,
Q
) for all P
,
Q
∈
G
1.


### 2.5. Mathematic Assumption

The mathematic assumptions used in the paper are listed as follows.Definition 3 (Elliptic Curve Discrete Logarithm Problem, ECDL problem).
SupposeE is an elliptic curve over a finite field F
q. Given Q
,
P
∈
E to find the n
∈
Z
q
∗, n
P
=
Q is believed to be hard [18].Definition 4 (Bilinear Diffie-Hellman Problem, BDH problem).
BDH problem is defined as follows. There is a bilinear mape
^
:
G
1
×
G
1
→
G
2. Given (
P
,
a
P
,
b
P
,
c
P
∈
G
1
) for a
,
b
,
c
∈
Z
q
∗, to compute the e
^
(
P
,
P
)
a
b
c
∈
G
2 is believed to be hard [17].Definition 5 (Decisional Bilinear Diffie-Hellman Problem, DBDH problem).
DBDH problem is defined as follows. There is a bilinear mape
^
:
G
1
×
G
1
→
G
2. Given (
P
,
a
P
,
b
P
,
c
P
∈
G
1
) for a
,
b
,
c
,
r
∈
Z
q
∗, to differentiate the e
^
(
P
,
P
)
a
b
c
∈
G
2 and e
^
(
P
,
P
)
r
∈
G
2 is believed to be hard [17].


### 2.6. Notations

To provide a quick reference, the basic notations used in the paper are listed in Notations section.


## 2.1. Basic Structure

As depicted in Figure1, a typical hierarchical key agreement for WHMS involves five types of parties. They are, namely, the u-Health Server (S
V), the physicians (P
H), the patients (P
A), the gateways (G
W), and the sensor nodes (S
N). There is a hierarchical permission structure from the u-Health Server S
V to the physicians P
H
i, i
∈
(
1,2
,
…
), to the gateway G
W
i
,
j, i
,
j
∈
(
1,2
,
…
) of patients P
A
i
,
j and to the sensor node S
N
i
,
j
,
d, i
,
j
,
d
∈
(
1,2
,
…
) of the gateway G
W
i
,
j [7, 8].Figure 1
Basic hierarchical key agreement structure in WHMS.As the root authority,S
V is responsible for managing the entities’ authorities in WHMS. S
V produces the private keys of entities such as G
W, S
N, and P
H. When P
A wants to use WHMS, his/her G
W and S
N should agree on the session keys with the physician (P
H), separately. Similarly, when P
H wants to send a diagnostic report to P
A, he/she should also agree on a session key with P
A.


## 2.2. Security Threats

Kim assumes that the physicians are trusted in paper [8]. However, we point out that the scheme should take the risk of the physician’s corruption because it is more practical. In practice, not all physicians are trusted all the time. For example, as reported, the staff of a famous hospital sold the patient’s personal medical data in USA [7], and 500 patients’ medical information may have been compromised at a medical center in LA because an employee’s laptop was stolen [15].Thus, we assume a security model in which the adversary has the following abilities. First, the adversary can totally control the channel. Therefore, the adversary can eavesdrop, intercept, modify, replay, or inject any data via the channel. Second, the adversary can compromise the secure information from the physicians except for the victim’s current physician. Third, the adversary can also compromise several sensor nodes and gateways except for the victim’s currentG
W and S
N.We aim to achieve the following security goals under the above security threats.Key Agreement. Two entities establish a session key which is only known by specific entities.Anonymity and Untraceability. The identities of G
W and S
N should be kept confidential from the adversary and cannot be traced by the adversary.Resistance Passive and Active Attacks. The scheme is secure against the passive and active attacks.


## 2.3. Security Model

Inspired by the security model for a noninteractive hierarchical key agreement scheme [11] and the original Bellare-Rogaway key exchange model [16], the security model of our scheme is stated as follows.Participants. We model the scheme participants as a finite set U of fixed size with each A being a Probabilistic Polynomial Time (PPT) turing machine. Each scheme participant A
∈
U may execute a polynomial number of protocol instances in parallel. We will refer to sth instance of principal A communicating with peer B as ∏
A
,
B
s
‍.Adversary Model. The adversary A is modeled as a PPT Turing machine and can be given all public parameters of the system, and he/she can access the oracle by issuing some specified queries:(i)
S
e
n
d
(
∏
A
,
B
s
‍
,
D
). The adversary A sends the message D to the session s executed by A communicating with B. Since our proposal is a noninteractive scheme, the query does not need to be responded to.
(ii)
E
s
t
a
b
l
i
s
h
(
A
). The adversary A names a node A and obtains all the secret values held by the node. Neither of the patient’s gateway and sensor nodes named in the test query or any of their ancestors can be established.
(iii)
R
e
v
e
a
l
(
∏
A
,
B
s
‍
). If the query is achieved, the system returns the session key to the adversary A. The session between the target patient’s facilities (a gateway and sensor nodes) and the physician cannot be revealed.
(iv)
T
e
s
t
(
∏
A
,
B
s
‍
). Only one query of this form is allowed for the adversary A. The adversary A names I
D
A and I
D
B and executes this query at any time. Then, a number s
k is returned as follows. A bit b is chosen at random in {
0,1
}. If b
=
1 then the adversary gets the secret key shared between the two nodes, and if b
=
0 it gets a key chosen at random from the set of all possible shared keys.Definition 1 (HKA-security).
As a function of the security parameterk, we define the advantage A
d
v
A
,
∑
H
K
A of the PPT adversary A in an attacking scheme ∑ as(1)
A
d
v
A
,
∑
H
K
A
=
2
S
u
c
c
A
,
∑
H
K
A
-
1
.Here,S
u
c
c
A
,
∑
H
K
A is the probability that the adversary queries T
e
s
t
(
∏
A
,
B
s
‍
) and outputs a bit b
∗ such that b is used by the test query. We call a hierarchical key agreement scheme ∑ to be HKA secure if for any PPT adversary the A function is negligible.


## 2.4. Bilinear Groups

Definition 2 (bilinear map).
G
1 is an additive cyclic group of prime order q and G
2 is a multiplicative cyclic group of prime order p. The bilinear pairing is a map e
^
:
G
1
×
G
1
→
G
2 with the following properties [17].Bilinearity. For all P
,
Q
∈
G
1 and a
,
b
∈
Z
q
∗, we have e
^
(
a
P
,
b
Q
)
=
e
^
(
P
,
Q
)
a
b.Nondegeneracy. The map does not send all pairs in G
1
×
G
1 to the identity in G
2.Computability. There exists an efficient algorithm to compute e
^
(
P
,
Q
) for all P
,
Q
∈
G
1.


## 2.5. Mathematic Assumption

The mathematic assumptions used in the paper are listed as follows.Definition 3 (Elliptic Curve Discrete Logarithm Problem, ECDL problem).
SupposeE is an elliptic curve over a finite field F
q. Given Q
,
P
∈
E to find the n
∈
Z
q
∗, n
P
=
Q is believed to be hard [18].Definition 4 (Bilinear Diffie-Hellman Problem, BDH problem).
BDH problem is defined as follows. There is a bilinear mape
^
:
G
1
×
G
1
→
G
2. Given (
P
,
a
P
,
b
P
,
c
P
∈
G
1
) for a
,
b
,
c
∈
Z
q
∗, to compute the e
^
(
P
,
P
)
a
b
c
∈
G
2 is believed to be hard [17].Definition 5 (Decisional Bilinear Diffie-Hellman Problem, DBDH problem).
DBDH problem is defined as follows. There is a bilinear mape
^
:
G
1
×
G
1
→
G
2. Given (
P
,
a
P
,
b
P
,
c
P
∈
G
1
) for a
,
b
,
c
,
r
∈
Z
q
∗, to differentiate the e
^
(
P
,
P
)
a
b
c
∈
G
2 and e
^
(
P
,
P
)
r
∈
G
2 is believed to be hard [17].


## 2.6. Notations

To provide a quick reference, the basic notations used in the paper are listed in Notations section.


## 3. Review of the Kim’s Scheme

In this section, we briefly review Kim’s key agreement scheme [8], which consists of three phases: System Initialization Phase, Physician and Patient Registration Phase, and Noninteractive Key Agreement and Secure Communication Phase.


### 3.1. System Initialization Phase

S
V generates two groups G
1 and G
2 of prime order p with a bilinear map e
^
:
G
1
×
G
1
→
G
2. Also, it chooses a cryptographic hash function H
:
{
0,1
}
∗
→
G
1. After that, S
V picks four random numbers s
1
,
s
2
,
s
3
,
s
4
←
Z
q
∗ as the master private keys. Then, S
V computes an amplified identity A
D
S
V
=
H
(
I
D
S
V
) and a public key s
1
A
D
S
V. Finally, S
V keeps the master private keys and the amplified identity, securely.


### 3.2. Physician and Patient Registration Phase

Before providing service, the patientP
A and his/her physician P
H must register in S
V. Here, the statement A
⇒
B
:
M denotes that B receives a message M from A via a secure channel. The Physician and Patient Registration Phase is basically shown in Figure 2.Figure 2
Physician and patient registration phase in Kim’s paper [8].Step R1 (S
V
⇒
P
H
i
:
R
e
g
P
H
i). When a physician P
H
i wants to be a legal e-medical physician, he/she sends his/her identity I
D
P
H
i to S
V via a secure channel. Then, S
V validates the identity I
D
P
H
i. If the solution is positive, S
V sends R
e
g
P
H
i
=
{
(
s
1
A
D
S
V
,
s
2
A
D
P
H
i
,
s
3
,
s
4
)
∥
(
A
D
S
V
,
A
D
P
H
i
)
}. Here, A
D
P
H
i
=
H
(
I
D
P
H
i
). Finally, P
H
i stores the received information, securely.Step R2 (S
V
⇒
G
W
i
,
j
:
R
e
g
G
W
i
,
j and S
V
⇒
S
N
i
,
j
,
d
:
R
e
g
S
N
i
,
j
,
d). When a patient P
A
i
,
j of P
H
i wants to use the service in the WHMS, he/she should register his/her gateway G
W
i
,
j and k sensor nodes S
N
i
,
j
,
d, 1
≤
d
≤
k in S
V. S
V validates the identity I
D
P
H
i submitted by P
A
i
,
j. If the solution is positive, S
V receives the gateway’s identity I
D
G
W
i
,
j and the sensor nodes’ identity I
D
S
N
i
,
j
,
d, 1
≤
d
≤
k. Then, S
V sends R
e
g
G
W
i
,
j and R
e
g
S
N
i
,
j
,
d to them via a secure channel. Here, R
e
g
G
W
i
,
j and R
e
g
S
N
i
,
j
,
d as follows:(2)
R
e
g
G
W
i
,
j
=
s
1
A
D
S
V
,
s
2
A
D
P
H
i
,
s
3
A
D
G
W
i
,
j
,
s
4
∥
A
D
S
V
,
A
D
P
H
i
,
A
D
G
W
i
,
j
,
R
e
g
S
N
i
,
j
,
d
=
s
1
A
D
S
V
,
s
2
A
D
P
H
i
,
s
3
A
D
G
W
i
,
j
,
s
4
A
D
S
N
i
,
j
,
d
∥
A
D
S
V
,
A
D
P
H
i
,
A
D
G
W
i
,
j
,
A
D
S
N
i
,
j
,
d
.Finally,G
W
i
,
j and S
N
i
,
j
,
d store their received information, securely.


### 3.3. Noninteractive Key Agreement and Secure Communication

In this phase, the sensor nodeS
N
i
,
j
,
d and the gateway G
W
i
,
j of the patient P
A
i and the physician P
H
i agree on a fresh session key for establishing a secure communication channel. Here, the statement A
→
B
:
M denotes that B receives a message M from A via a unsecure channel. The Noninteractive Key Agreement and Secure Communication is basically shown in Figure 3.Figure 3
Noninteractive key agreement and secure communication in Kim’s paper [8].Step K1 (S
N
i
,
j
,
d
→
S
V
:
{
R
1
,
M
1
,
A
D
S
N
i
,
j
,
d
,
M
A
C
1
}). S
N
i
,
j
,
d chooses a random number r
1 and computes R
1
=
r
1
A
D
S
N
i
,
j
,
d. The fresh session key s
k
1 is computed as follows:(3)
s
k
1
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
s
3
A
D
G
W
i
,
j
,
A
D
P
H
i
·
e
^
s
4
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
r
1
.Then, S
N
i
,
j
,
d computes M
1
=
E
s
k
1
(
D
a
t
a
i
) and M
A
C
1
=
H
(
s
k
1
∥
R
1
∥
M
1
), where D
a
t
a
i is the data collected by S
N
i
,
j
,
d.Step K2. When P
H
i is authenticated by S
V, he/she can check the data of the patient P
A
i. P
H
i computes the fresh session key s
k
1
′ as follows:(4)
s
k
1
′
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
A
D
P
H
i
,
A
D
G
W
i
,
j
s
3
·
e
^
A
D
P
H
i
,
R
1
s
4
.Then, P
H
i computes M
A
C
1
′
=
H
(
s
k
1
′
∥
R
1
∥
M
1
). Only if M
A
C
1
′ is equal to M
A
C
1 does P
H
i assure the correctness of s
k
1
′. Then, P
H
i decrypts M
1 to get D
a
t
a
i by using the key s
k
1
′.Step K3 (P
H
i
→
G
W
i
,
j
:
{
R
2
,
M
2
,
A
D
G
W
i
,
j
,
M
A
C
2
}). When P
H
i wants to send the electronic health report to P
A
i, he/she chooses a random number r
2 and computes R
2
=
r
2
A
D
P
H
i. P
H
i computes the fresh session key s
k
2 as follows:(5)
s
k
2
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
A
D
P
H
i
,
A
D
G
W
i
,
j
s
3
·
e
^
A
D
P
H
i
,
A
D
G
W
i
,
j
s
4
r
2
.In addition, P
H
i computes M
2
=
E
s
k
2
(
D
a
t
a
i
) and M
A
C
2
=
H
(
s
k
2
∥
R
2
∥
M
2
). Here, D
a
t
a
i is the electronic health report composed by P
H
i.Step K4. When G
W
i
,
j is authenticated by S
V, he/she can receive the report of the patient P
A
i from S
V. G
W
i
,
j computes the fresh session key s
k
2
′ as follows:(6)
s
k
2
′
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
s
3
A
D
G
W
i
,
j
,
A
D
P
H
i
·
e
^
A
D
G
W
i
,
j
,
R
2
s
4
.Then, G
W
i
,
j computes M
A
C
2
′
=
H
(
s
k
2
′
∥
R
2
∥
M
2
). Only if M
A
C
2
′ is equal to M
A
C
2 does G
W
i
,
j assure the correctness of s
k
2
′. Then, G
W
i
,
j decrypts M
2 to get D
a
t
a
i by using the key s
k
2
′.


## 3.1. System Initialization Phase

S
V generates two groups G
1 and G
2 of prime order p with a bilinear map e
^
:
G
1
×
G
1
→
G
2. Also, it chooses a cryptographic hash function H
:
{
0,1
}
∗
→
G
1. After that, S
V picks four random numbers s
1
,
s
2
,
s
3
,
s
4
←
Z
q
∗ as the master private keys. Then, S
V computes an amplified identity A
D
S
V
=
H
(
I
D
S
V
) and a public key s
1
A
D
S
V. Finally, S
V keeps the master private keys and the amplified identity, securely.


## 3.2. Physician and Patient Registration Phase

Before providing service, the patientP
A and his/her physician P
H must register in S
V. Here, the statement A
⇒
B
:
M denotes that B receives a message M from A via a secure channel. The Physician and Patient Registration Phase is basically shown in Figure 2.Figure 2
Physician and patient registration phase in Kim’s paper [8].Step R1 (S
V
⇒
P
H
i
:
R
e
g
P
H
i). When a physician P
H
i wants to be a legal e-medical physician, he/she sends his/her identity I
D
P
H
i to S
V via a secure channel. Then, S
V validates the identity I
D
P
H
i. If the solution is positive, S
V sends R
e
g
P
H
i
=
{
(
s
1
A
D
S
V
,
s
2
A
D
P
H
i
,
s
3
,
s
4
)
∥
(
A
D
S
V
,
A
D
P
H
i
)
}. Here, A
D
P
H
i
=
H
(
I
D
P
H
i
). Finally, P
H
i stores the received information, securely.Step R2 (S
V
⇒
G
W
i
,
j
:
R
e
g
G
W
i
,
j and S
V
⇒
S
N
i
,
j
,
d
:
R
e
g
S
N
i
,
j
,
d). When a patient P
A
i
,
j of P
H
i wants to use the service in the WHMS, he/she should register his/her gateway G
W
i
,
j and k sensor nodes S
N
i
,
j
,
d, 1
≤
d
≤
k in S
V. S
V validates the identity I
D
P
H
i submitted by P
A
i
,
j. If the solution is positive, S
V receives the gateway’s identity I
D
G
W
i
,
j and the sensor nodes’ identity I
D
S
N
i
,
j
,
d, 1
≤
d
≤
k. Then, S
V sends R
e
g
G
W
i
,
j and R
e
g
S
N
i
,
j
,
d to them via a secure channel. Here, R
e
g
G
W
i
,
j and R
e
g
S
N
i
,
j
,
d as follows:(2)
R
e
g
G
W
i
,
j
=
s
1
A
D
S
V
,
s
2
A
D
P
H
i
,
s
3
A
D
G
W
i
,
j
,
s
4
∥
A
D
S
V
,
A
D
P
H
i
,
A
D
G
W
i
,
j
,
R
e
g
S
N
i
,
j
,
d
=
s
1
A
D
S
V
,
s
2
A
D
P
H
i
,
s
3
A
D
G
W
i
,
j
,
s
4
A
D
S
N
i
,
j
,
d
∥
A
D
S
V
,
A
D
P
H
i
,
A
D
G
W
i
,
j
,
A
D
S
N
i
,
j
,
d
.Finally,G
W
i
,
j and S
N
i
,
j
,
d store their received information, securely.


## 3.3. Noninteractive Key Agreement and Secure Communication

In this phase, the sensor nodeS
N
i
,
j
,
d and the gateway G
W
i
,
j of the patient P
A
i and the physician P
H
i agree on a fresh session key for establishing a secure communication channel. Here, the statement A
→
B
:
M denotes that B receives a message M from A via a unsecure channel. The Noninteractive Key Agreement and Secure Communication is basically shown in Figure 3.Figure 3
Noninteractive key agreement and secure communication in Kim’s paper [8].Step K1 (S
N
i
,
j
,
d
→
S
V
:
{
R
1
,
M
1
,
A
D
S
N
i
,
j
,
d
,
M
A
C
1
}). S
N
i
,
j
,
d chooses a random number r
1 and computes R
1
=
r
1
A
D
S
N
i
,
j
,
d. The fresh session key s
k
1 is computed as follows:(3)
s
k
1
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
s
3
A
D
G
W
i
,
j
,
A
D
P
H
i
·
e
^
s
4
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
r
1
.Then, S
N
i
,
j
,
d computes M
1
=
E
s
k
1
(
D
a
t
a
i
) and M
A
C
1
=
H
(
s
k
1
∥
R
1
∥
M
1
), where D
a
t
a
i is the data collected by S
N
i
,
j
,
d.Step K2. When P
H
i is authenticated by S
V, he/she can check the data of the patient P
A
i. P
H
i computes the fresh session key s
k
1
′ as follows:(4)
s
k
1
′
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
A
D
P
H
i
,
A
D
G
W
i
,
j
s
3
·
e
^
A
D
P
H
i
,
R
1
s
4
.Then, P
H
i computes M
A
C
1
′
=
H
(
s
k
1
′
∥
R
1
∥
M
1
). Only if M
A
C
1
′ is equal to M
A
C
1 does P
H
i assure the correctness of s
k
1
′. Then, P
H
i decrypts M
1 to get D
a
t
a
i by using the key s
k
1
′.Step K3 (P
H
i
→
G
W
i
,
j
:
{
R
2
,
M
2
,
A
D
G
W
i
,
j
,
M
A
C
2
}). When P
H
i wants to send the electronic health report to P
A
i, he/she chooses a random number r
2 and computes R
2
=
r
2
A
D
P
H
i. P
H
i computes the fresh session key s
k
2 as follows:(5)
s
k
2
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
A
D
P
H
i
,
A
D
G
W
i
,
j
s
3
·
e
^
A
D
P
H
i
,
A
D
G
W
i
,
j
s
4
r
2
.In addition, P
H
i computes M
2
=
E
s
k
2
(
D
a
t
a
i
) and M
A
C
2
=
H
(
s
k
2
∥
R
2
∥
M
2
). Here, D
a
t
a
i is the electronic health report composed by P
H
i.Step K4. When G
W
i
,
j is authenticated by S
V, he/she can receive the report of the patient P
A
i from S
V. G
W
i
,
j computes the fresh session key s
k
2
′ as follows:(6)
s
k
2
′
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
s
3
A
D
G
W
i
,
j
,
A
D
P
H
i
·
e
^
A
D
G
W
i
,
j
,
R
2
s
4
.Then, G
W
i
,
j computes M
A
C
2
′
=
H
(
s
k
2
′
∥
R
2
∥
M
2
). Only if M
A
C
2
′ is equal to M
A
C
2 does G
W
i
,
j assure the correctness of s
k
2
′. Then, G
W
i
,
j decrypts M
2 to get D
a
t
a
i by using the key s
k
2
′.


## 4. Security Analysis of Kim’s Scheme

The author of [8] proposed a noninteractive key agreement scheme for freshness-preserving in WHMS. Under our security model, there is a weakness in the scheme as explained in the following section.


### 4.1. Security against Collusion Attack

We now demonstrate that Kim’s scheme is vulnerable to the collusion attack as claimed. One adversaryA
1 has registered as a legal physician P
H
A, and the other adversary A
2 has registered as a normal patient P
A
A, as shown in Figure 4. The adversaries can obtain the electronic health data of any patient who is diagnosed by the same physician P
H
i with the adversary A
2. The adversaries attack a patient P
A
i
,
j as follows.Figure 4
Security against collusion attack.Step A1. Assume that A
1 is an attacker who has registered as a physician P
H
A in S
V, and then he/she can legally receive a private key set (
s
1
A
D
S
V
,
s
2
A
D
P
H
A
,
s
3
,
s
4
) from S
V (Step R1). Then, A
1 sends a part of private key set (
s
1
A
D
S
V
,
s
2
A
D
P
H
A
,
s
3
,
s
4
) to A
2.Step A2. A
2 is an adversary who has registered as a patient of the physician P
H
i. He/she can legally receive a secure data set (
A
D
S
V
,
A
D
P
H
i
,
A
D
G
W
i
,
A
) and a private key set (
s
1
A
D
S
V
,
s
2
A
D
P
H
i
,
s
3
A
D
G
W
i
,
A
,
s
4
) of his/her gateway G
W
i
,
A from S
V (Step R2).Step A3. Suppose S
N
i
,
j
,
d is a victim P
A’s smart node that sends information through the gateway G
W
i
,
j. P
A is diagnosed by the same physician P
H
i with A
2. When S
N
i
,
j
,
d runs the Step K1, an adversary can intercept the data {
R
1
,
M
1
,
A
D
S
N
i
,
j
,
d
,
M
A
C
1
} because the communications are unsecure between S
N
i
,
j
,
d and S
V.Step A4. When P
H
i sends the electronic health report to P
A
i at the Step K3, an adversary can intercept data {
R
2
,
M
2
,
A
D
G
W
i
,
j
,
M
A
C
2
} because the communications are also unsecure between P
H
i and S
V.Step A5. A
2 can compute the session key after the above steps. A
2 receives (
s
3
,
s
4
) from A
1 at Step A1. Then, he/she gets (
s
1
A
D
S
V
,
s
2
A
D
P
H
i
) and (
A
D
S
V
,
A
D
P
H
i
) at Step A2. Moreover, the information {
R
1
,
M
1
,
A
D
S
N
i
,
j
,
d
,
M
A
C
1
} and {
R
2
,
M
2
,
A
D
G
W
i
,
j
,
M
A
C
2
} is intercepted at Steps A3 and A4, separately. Therefore, A
2 can compute the same session keys s
k
1 and s
k
2 as follows:(7)
s
k
1
A
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
3
·
e
^
A
D
P
H
i
,
R
1
s
4
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
s
3
A
D
G
W
i
,
j
,
A
D
P
H
i
·
e
^
s
4
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
r
1
=
s
k
1
,
s
k
2
A
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
A
D
P
H
i
,
A
D
G
W
i
,
j
s
3
·
e
^
A
D
G
W
i
,
j
,
R
2
s
4
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
A
D
P
H
i
,
A
D
G
W
i
,
j
s
3
·
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
4
r
2
=
s
k
2
.Step A6. A
2 decrypts M
1 and M
2 to obtain the victim’s medical information using the session keys s
k
1
A and s
k
2
A, respectively.


## 4.1. Security against Collusion Attack

We now demonstrate that Kim’s scheme is vulnerable to the collusion attack as claimed. One adversaryA
1 has registered as a legal physician P
H
A, and the other adversary A
2 has registered as a normal patient P
A
A, as shown in Figure 4. The adversaries can obtain the electronic health data of any patient who is diagnosed by the same physician P
H
i with the adversary A
2. The adversaries attack a patient P
A
i
,
j as follows.Figure 4
Security against collusion attack.Step A1. Assume that A
1 is an attacker who has registered as a physician P
H
A in S
V, and then he/she can legally receive a private key set (
s
1
A
D
S
V
,
s
2
A
D
P
H
A
,
s
3
,
s
4
) from S
V (Step R1). Then, A
1 sends a part of private key set (
s
1
A
D
S
V
,
s
2
A
D
P
H
A
,
s
3
,
s
4
) to A
2.Step A2. A
2 is an adversary who has registered as a patient of the physician P
H
i. He/she can legally receive a secure data set (
A
D
S
V
,
A
D
P
H
i
,
A
D
G
W
i
,
A
) and a private key set (
s
1
A
D
S
V
,
s
2
A
D
P
H
i
,
s
3
A
D
G
W
i
,
A
,
s
4
) of his/her gateway G
W
i
,
A from S
V (Step R2).Step A3. Suppose S
N
i
,
j
,
d is a victim P
A’s smart node that sends information through the gateway G
W
i
,
j. P
A is diagnosed by the same physician P
H
i with A
2. When S
N
i
,
j
,
d runs the Step K1, an adversary can intercept the data {
R
1
,
M
1
,
A
D
S
N
i
,
j
,
d
,
M
A
C
1
} because the communications are unsecure between S
N
i
,
j
,
d and S
V.Step A4. When P
H
i sends the electronic health report to P
A
i at the Step K3, an adversary can intercept data {
R
2
,
M
2
,
A
D
G
W
i
,
j
,
M
A
C
2
} because the communications are also unsecure between P
H
i and S
V.Step A5. A
2 can compute the session key after the above steps. A
2 receives (
s
3
,
s
4
) from A
1 at Step A1. Then, he/she gets (
s
1
A
D
S
V
,
s
2
A
D
P
H
i
) and (
A
D
S
V
,
A
D
P
H
i
) at Step A2. Moreover, the information {
R
1
,
M
1
,
A
D
S
N
i
,
j
,
d
,
M
A
C
1
} and {
R
2
,
M
2
,
A
D
G
W
i
,
j
,
M
A
C
2
} is intercepted at Steps A3 and A4, separately. Therefore, A
2 can compute the same session keys s
k
1 and s
k
2 as follows:(7)
s
k
1
A
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
3
·
e
^
A
D
P
H
i
,
R
1
s
4
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
s
3
A
D
G
W
i
,
j
,
A
D
P
H
i
·
e
^
s
4
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
r
1
=
s
k
1
,
s
k
2
A
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
A
D
P
H
i
,
A
D
G
W
i
,
j
s
3
·
e
^
A
D
G
W
i
,
j
,
R
2
s
4
=
e
^
s
1
A
D
S
V
,
A
D
S
V
·
e
^
s
2
A
D
P
H
i
,
A
D
P
H
i
·
e
^
A
D
P
H
i
,
A
D
G
W
i
,
j
s
3
·
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
4
r
2
=
s
k
2
.Step A6. A
2 decrypts M
1 and M
2 to obtain the victim’s medical information using the session keys s
k
1
A and s
k
2
A, respectively.


## 5. Our Proposed Scheme

In this section, we propose an improved scheme that can overcome the flaw of Kim’s scheme in Section4. Our scheme construction is inspired by the practical noninteractive key distribution scheme in [12] and Kim’s paper [8]. Our scheme consists of four operational phases: Setup Phase, Key Generation Phase, Key Agreement from S
N to P
H Phase, and Key Agreement from P
H to G
W Phase. The details of our scheme are described as follows.


### 5.1. Setup Phase

In this phase, the u-Health ServerS
V, as the Private Key Generator (PKG), takes as inputs a security parameter k and the maximal number of the physicians N. Then, S
V outputs the system public parameters p
a
r
a
m
s and the master private key sets s
k. S
V publishes p
a
r
a
m
s and keeps s
k private.Similar to the identity-based cryptography scheme,S
V generates two groups G
1 and G
2 of prime order p with a bilinear map e
^
:
G
1
×
G
1
→
G
2. However, it chooses three cryptographic hash functions H
1
:
{
0,1
}
∗
→
G
1, H
2
:
G
2
×
G
1
3
→
{
0,1
}
k, and H
3
:
{
0,1
}
∗
×
G
1
3
→
{
0,1
}
k. After that, S
V generates 3
+
N random numbers {
s
1
,
s
2
,
s
3
,
s
r
i
←
Z
q
∗
∣
i
∈
(
1,2
,
…
,
N
)
} and selects a random generator P
0
∈
G
1. Finally, S
V keeps the master key s
k
=
{
s
1
,
s
2
,
s
3
,
s
r
i
∣
i
∈
(
1,2
,
…
,
N
)
} secret and publishes p
a
r
a
m
s
=
(
q
,
G
1
,
G
2
,
P
0
,
e
^
,
H
1
,
H
2
,
H
3
,
s
1
P
0
,
s
2
P
0
,
s
3
P
0
,
s
1
s
r
i
P
0
,
s
2
s
r
i
P
0, s
3
s
r
i
P
0
∣
i
∈
(
1,2
,
…
,
N
)
). Here, P
0 is used to verify the correctness of the secret key sets.It is important to note that although our proposal increase the storage space because of the valuess
r
i
,
i
∈
[
1
,
N
], there is a one-to-one mapping between a physician P
H
i and a value s
r
i. In addition, the list of physicians must be stored in S
V. Thus, we can use the mapping to reduce the storage space. For instance, S
V gets the list of the registration physicians. Then, S
V chooses a secret hash function H
∗
:
{
0,1
}
q
→
Z
q
∗ and a random value s
r
0. Finally, S
V can compute the i times hash function H
∗
(
·
) to get the secret value s
r
i
=
H
∗
(
⋯
(
H
∗
(
s
r
0
)
)
). In this way, S
V only needs to store the selected hash function and initial value s
r
0, secretly. On one hand, the proposal can save the storage resources by using the hash function. On the other hand, it increases the consumption of the computing resources. In order to balance the computing cost and the storage space, S
V can store not only the initial value s
r
0, but also some intermediate random values s
r
j. We introduce the scheme by using the secret values s
r
i, i
∈
[
1
,
N
] to help the analysis.


### 5.2. Key Generation Phase

In this phase,S
V takes the identity I
D
P
H
i as an input and outputs a secret key set s
k
P
H
i. Moreover, P
H
i takes his/her secret key set s
k
P
H
i and the identities I
D
G
W
i
,
j and I
D
S
N
i
,
j
,
d as inputs and outputs two secret key sets s
k
G
W
i
,
j and s
k
S
N
i
,
j
,
d, separately.Step 1.
A physicianP
H
i, i
∈
(
1,2
,
…
,
N
) submits his/her identity I
D
P
H
i to S
V for registration. If the identity of P
H
i is validated, Then, S
V computes A
D
S
V
i
=
H
1
(
I
D
S
V
∥
s
r
i
), A
D
P
H
i
=
H
1
I
D
P
H
i
∥
s
r
i, and a private key set of P
H
i, i
∈
(
1,2
,
…
,
N
) as follows:(8)
s
k
P
H
i
=
s
1
s
r
i
A
D
P
H
i
,
s
2
s
r
i
,
s
3
s
r
i
.In addition, S
V packs a data package containing a private key set and two amplified identities {
s
k
P
H
i
∥
(
A
D
S
V
i
,
A
D
P
H
i
)
} and delivers the data package to P
H
i via a secure channel. Here, the secure channel could be a smart card passed by a trusted person. Finally, P
H
i keeps the received information, securely.Step 2.
When a patientP
A
i
,
j goes to see a doctor in a real clinic, they decide to use the WHMS to monitor his/her health directed by a physician P
H
i. The patient submits his/her identity I
D
P
A
i
,
j and the identity of gateway I
D
G
W
i
,
j and sensor nodes I
D
S
N
i
,
j
,
d to P
H
i for registration. If the patients’ identity is validated, P
H
i generates a random value a
i
,
j
∈
Z
q
∗ and computes the amplified identities A
D
G
W
i
,
j
=
H
1
(
I
D
G
W
i
,
j
∥
a
i
,
j
) and A
D
S
N
i
,
j
,
d
=
H
1
(
I
D
S
N
i
,
j
,
d
∥
a
i
,
j
). P
H
i computes the private key sets of G
W
i
,
j and S
N
i
,
j
,
d as follows:(9)
s
k
G
W
i
,
j
=
s
1
s
r
i
A
D
P
H
i
,
s
2
s
r
i
A
D
G
W
i
,
j
,
s
k
S
N
i
,
j
,
d
=
s
1
s
r
i
A
D
P
H
i
,
s
3
s
r
i
A
D
S
N
i
,
j
,
d
.Next, P
H
i packs a data package containing a private key set and three amplified identities {
s
k
G
W
i
,
j
∥
(
A
D
S
V
i
,
A
D
P
H
i
,
A
D
G
W
i
,
j
)
} and delivers the data package to G
W
i
,
j via a secure channel. Furthermore, S
V packs a data package containing a private key set {
s
k
S
N
i
,
j
,
d
∥
(
A
D
S
V
i
,
A
D
P
H
i
,
A
D
G
W
i
,
j
,
A
D
S
N
i
,
j
,
d
)
} and delivers it to S
N
i
,
j
,
d via a secure channel. Finally, G
W
i
,
j and S
N
i
,
j
,
d store their received information in a secure area, respectively.


### 5.3. Key Agreement from SN to PH Phase

In this phase, a sensor nodeS
N
i
,
j
,
d of the patient P
A
i
,
j makes a connection with the physician P
H
i. The sensor node S
N
i
,
j
,
d and the physician P
H
i achieve a key agreement.Step 1.
When a sensor nodeS
N
i
,
j
,
d wants to upload the patient’s medical data, S
N
i
,
j
,
d chooses a random number r
1 and computes R
1
=
r
1
A
D
S
N
i
,
j
,
d using its amplified identity A
D
S
N
i
,
j
,
d. The session key s
k
1 is calculated as follows:(10)
K
1
=
e
^
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
·
e
^
s
3
s
r
i
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
r
1
,
s
k
1
=
H
2
K
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
.Then, S
N
i
,
j
,
d computes M
1
=
E
s
k
1
(
D
a
t
a
i
,
j
,
d
) and V
1
=
H
3
(
s
k
1
∥
M
1
∥
T
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
). Here, D
a
t
a
i
,
j
,
d is the data collected by S
N
i
,
j
,
d and T
1 is a current timestamp. Finally, S
N
i
,
j
,
d sends a message package D
1
=
{
R
1
,
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
,
T
1
,
M
1
,
V
1
} to S
V.Step 2.
After receiving the data packageD
1, S
V verifies the timestamp T
1 whether it is within the valid time for communication. If it is invalid, the key agreement terminates. Otherwise, it can assure the package by judging V
1
∗
=
V
1 as follows:(11)
K
1
∗
=
e
^
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
s
1
s
r
i
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
,
s
k
1
∗
=
H
2
K
1
∗
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
,
V
1
∗
=
H
3
s
k
1
∗
∥
M
1
∥
T
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
.Only if V
1
∗ is equal to V
1 included in D
1 does S
V assure the source of package from a sensor node A
D
S
N
i
,
j
,
d and send a notice to P
H
i. Finally, S
V store the package D
1 in its database.Step 3.
WhenP
H
i is authenticated by S
V, he/she can check the data of a sensor node S
N
i
,
j
,
d. P
H
i computes the fresh session key s
k
1
′ as follows:(12)
K
1
′
=
e
^
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
,
s
k
1
′
=
H
2
K
1
′
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
.In addition, P
H
i computes V
1
′
=
H
3
(
s
k
1
′
∥
M
1
∥
T
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) by using the information of D
1. Only if V
1
′ is equal to V
1 does P
H
i assure the correctness of s
k
1
′ and decrypt M
1 to get D
a
t
a
i
,
j
,
d by using the key s
k
1
′.


### 5.4. Key Agreement from PH to GW Phase

In this phase, the physicianP
H
i makes a connection with a patient’s gateway G
W
i
,
j, and they agree on a fresh session key for communication.Step 1.
WhenP
H
i wants to communicate with P
A
i
,
j such as sending the electronic health report, he/she chooses a random number r
2 and computes R
2
=
r
2
A
D
P
H
i. P
H
i computes the fresh session key s
k
2 as follows:(13)
K
2
=
e
^
A
D
G
W
i
,
j
,
s
1
s
r
i
A
D
P
H
i
·
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
2
s
r
i
r
2
,
s
k
2
=
H
2
K
2
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
.In addition, P
H
i computes M
2
=
E
s
k
2
(
D
a
t
a
i
,
j
) and V
2
=
H
3
(
s
k
2
∥
M
2
∥
T
2
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
). Here, D
a
t
a
i
,
j is the electronic health report composed by P
H
i, and T
2 is a current timestamp. Finally, P
H
i sends a message package D
2
=
{
R
2
,
A
D
P
H
i
,
A
D
G
W
i
,
j
,
T
2
,
M
2
,
V
2
} to S
V.Step 2.
After receiving the data packageD
2, S
V checks the validity of the timestamp T
2. If it has grown stale, S
V quits the session. Otherwise, S
V can assure the package by judging V
2
∗
=
V
2 as follows:(14)
K
2
∗
=
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
1
s
r
i
·
e
^
A
D
G
W
i
,
j
,
R
2
s
2
s
r
i
,
s
k
2
∗
=
H
2
K
2
∗
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
,
V
2
∗
=
H
3
s
k
2
∗
∥
M
2
∥
T
2
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
.Only if V
2
∗ is equal to V
2 included in D
2 does S
V assure the source of package from a physician A
D
P
H
i and send a notice to P
A
i
,
j. Finally, S
V stores the package D
2 in its database.Step 3.
WhenG
W
i
,
j is authenticated by S
V, he/she can get the report of the patient P
A
i
,
j from S
V. G
W
i
,
j computes the fresh session key s
k
2
′ as follows:(15)
K
2
′
=
e
^
A
D
G
W
i
,
j
,
s
1
s
r
i
A
D
P
H
i
·
e
^
s
2
s
r
i
A
D
G
W
i
,
j
,
R
2
,
s
k
2
′
=
H
2
K
2
′
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
.Then, G
W
i
,
j computes V
2
′
=
H
3
(
s
k
2
′
∥
M
2
∥
T
2
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
). Only if V
2
′ is equal to V
2 does G
W
i
,
j assure the correctness of s
k
2
′ and decrypt M
2 to get D
a
t
a
i
,
j by using the key s
k
2
′.


## 5.1. Setup Phase

In this phase, the u-Health ServerS
V, as the Private Key Generator (PKG), takes as inputs a security parameter k and the maximal number of the physicians N. Then, S
V outputs the system public parameters p
a
r
a
m
s and the master private key sets s
k. S
V publishes p
a
r
a
m
s and keeps s
k private.Similar to the identity-based cryptography scheme,S
V generates two groups G
1 and G
2 of prime order p with a bilinear map e
^
:
G
1
×
G
1
→
G
2. However, it chooses three cryptographic hash functions H
1
:
{
0,1
}
∗
→
G
1, H
2
:
G
2
×
G
1
3
→
{
0,1
}
k, and H
3
:
{
0,1
}
∗
×
G
1
3
→
{
0,1
}
k. After that, S
V generates 3
+
N random numbers {
s
1
,
s
2
,
s
3
,
s
r
i
←
Z
q
∗
∣
i
∈
(
1,2
,
…
,
N
)
} and selects a random generator P
0
∈
G
1. Finally, S
V keeps the master key s
k
=
{
s
1
,
s
2
,
s
3
,
s
r
i
∣
i
∈
(
1,2
,
…
,
N
)
} secret and publishes p
a
r
a
m
s
=
(
q
,
G
1
,
G
2
,
P
0
,
e
^
,
H
1
,
H
2
,
H
3
,
s
1
P
0
,
s
2
P
0
,
s
3
P
0
,
s
1
s
r
i
P
0
,
s
2
s
r
i
P
0, s
3
s
r
i
P
0
∣
i
∈
(
1,2
,
…
,
N
)
). Here, P
0 is used to verify the correctness of the secret key sets.It is important to note that although our proposal increase the storage space because of the valuess
r
i
,
i
∈
[
1
,
N
], there is a one-to-one mapping between a physician P
H
i and a value s
r
i. In addition, the list of physicians must be stored in S
V. Thus, we can use the mapping to reduce the storage space. For instance, S
V gets the list of the registration physicians. Then, S
V chooses a secret hash function H
∗
:
{
0,1
}
q
→
Z
q
∗ and a random value s
r
0. Finally, S
V can compute the i times hash function H
∗
(
·
) to get the secret value s
r
i
=
H
∗
(
⋯
(
H
∗
(
s
r
0
)
)
). In this way, S
V only needs to store the selected hash function and initial value s
r
0, secretly. On one hand, the proposal can save the storage resources by using the hash function. On the other hand, it increases the consumption of the computing resources. In order to balance the computing cost and the storage space, S
V can store not only the initial value s
r
0, but also some intermediate random values s
r
j. We introduce the scheme by using the secret values s
r
i, i
∈
[
1
,
N
] to help the analysis.


## 5.2. Key Generation Phase

In this phase,S
V takes the identity I
D
P
H
i as an input and outputs a secret key set s
k
P
H
i. Moreover, P
H
i takes his/her secret key set s
k
P
H
i and the identities I
D
G
W
i
,
j and I
D
S
N
i
,
j
,
d as inputs and outputs two secret key sets s
k
G
W
i
,
j and s
k
S
N
i
,
j
,
d, separately.Step 1.
A physicianP
H
i, i
∈
(
1,2
,
…
,
N
) submits his/her identity I
D
P
H
i to S
V for registration. If the identity of P
H
i is validated, Then, S
V computes A
D
S
V
i
=
H
1
(
I
D
S
V
∥
s
r
i
), A
D
P
H
i
=
H
1
I
D
P
H
i
∥
s
r
i, and a private key set of P
H
i, i
∈
(
1,2
,
…
,
N
) as follows:(8)
s
k
P
H
i
=
s
1
s
r
i
A
D
P
H
i
,
s
2
s
r
i
,
s
3
s
r
i
.In addition, S
V packs a data package containing a private key set and two amplified identities {
s
k
P
H
i
∥
(
A
D
S
V
i
,
A
D
P
H
i
)
} and delivers the data package to P
H
i via a secure channel. Here, the secure channel could be a smart card passed by a trusted person. Finally, P
H
i keeps the received information, securely.Step 2.
When a patientP
A
i
,
j goes to see a doctor in a real clinic, they decide to use the WHMS to monitor his/her health directed by a physician P
H
i. The patient submits his/her identity I
D
P
A
i
,
j and the identity of gateway I
D
G
W
i
,
j and sensor nodes I
D
S
N
i
,
j
,
d to P
H
i for registration. If the patients’ identity is validated, P
H
i generates a random value a
i
,
j
∈
Z
q
∗ and computes the amplified identities A
D
G
W
i
,
j
=
H
1
(
I
D
G
W
i
,
j
∥
a
i
,
j
) and A
D
S
N
i
,
j
,
d
=
H
1
(
I
D
S
N
i
,
j
,
d
∥
a
i
,
j
). P
H
i computes the private key sets of G
W
i
,
j and S
N
i
,
j
,
d as follows:(9)
s
k
G
W
i
,
j
=
s
1
s
r
i
A
D
P
H
i
,
s
2
s
r
i
A
D
G
W
i
,
j
,
s
k
S
N
i
,
j
,
d
=
s
1
s
r
i
A
D
P
H
i
,
s
3
s
r
i
A
D
S
N
i
,
j
,
d
.Next, P
H
i packs a data package containing a private key set and three amplified identities {
s
k
G
W
i
,
j
∥
(
A
D
S
V
i
,
A
D
P
H
i
,
A
D
G
W
i
,
j
)
} and delivers the data package to G
W
i
,
j via a secure channel. Furthermore, S
V packs a data package containing a private key set {
s
k
S
N
i
,
j
,
d
∥
(
A
D
S
V
i
,
A
D
P
H
i
,
A
D
G
W
i
,
j
,
A
D
S
N
i
,
j
,
d
)
} and delivers it to S
N
i
,
j
,
d via a secure channel. Finally, G
W
i
,
j and S
N
i
,
j
,
d store their received information in a secure area, respectively.


## 5.3. Key Agreement from SN to PH Phase

In this phase, a sensor nodeS
N
i
,
j
,
d of the patient P
A
i
,
j makes a connection with the physician P
H
i. The sensor node S
N
i
,
j
,
d and the physician P
H
i achieve a key agreement.Step 1.
When a sensor nodeS
N
i
,
j
,
d wants to upload the patient’s medical data, S
N
i
,
j
,
d chooses a random number r
1 and computes R
1
=
r
1
A
D
S
N
i
,
j
,
d using its amplified identity A
D
S
N
i
,
j
,
d. The session key s
k
1 is calculated as follows:(10)
K
1
=
e
^
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
·
e
^
s
3
s
r
i
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
r
1
,
s
k
1
=
H
2
K
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
.Then, S
N
i
,
j
,
d computes M
1
=
E
s
k
1
(
D
a
t
a
i
,
j
,
d
) and V
1
=
H
3
(
s
k
1
∥
M
1
∥
T
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
). Here, D
a
t
a
i
,
j
,
d is the data collected by S
N
i
,
j
,
d and T
1 is a current timestamp. Finally, S
N
i
,
j
,
d sends a message package D
1
=
{
R
1
,
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
,
T
1
,
M
1
,
V
1
} to S
V.Step 2.
After receiving the data packageD
1, S
V verifies the timestamp T
1 whether it is within the valid time for communication. If it is invalid, the key agreement terminates. Otherwise, it can assure the package by judging V
1
∗
=
V
1 as follows:(11)
K
1
∗
=
e
^
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
s
1
s
r
i
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
,
s
k
1
∗
=
H
2
K
1
∗
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
,
V
1
∗
=
H
3
s
k
1
∗
∥
M
1
∥
T
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
.Only if V
1
∗ is equal to V
1 included in D
1 does S
V assure the source of package from a sensor node A
D
S
N
i
,
j
,
d and send a notice to P
H
i. Finally, S
V store the package D
1 in its database.Step 3.
WhenP
H
i is authenticated by S
V, he/she can check the data of a sensor node S
N
i
,
j
,
d. P
H
i computes the fresh session key s
k
1
′ as follows:(12)
K
1
′
=
e
^
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
,
s
k
1
′
=
H
2
K
1
′
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
.In addition, P
H
i computes V
1
′
=
H
3
(
s
k
1
′
∥
M
1
∥
T
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) by using the information of D
1. Only if V
1
′ is equal to V
1 does P
H
i assure the correctness of s
k
1
′ and decrypt M
1 to get D
a
t
a
i
,
j
,
d by using the key s
k
1
′.


## 5.4. Key Agreement from PH to GW Phase

In this phase, the physicianP
H
i makes a connection with a patient’s gateway G
W
i
,
j, and they agree on a fresh session key for communication.Step 1.
WhenP
H
i wants to communicate with P
A
i
,
j such as sending the electronic health report, he/she chooses a random number r
2 and computes R
2
=
r
2
A
D
P
H
i. P
H
i computes the fresh session key s
k
2 as follows:(13)
K
2
=
e
^
A
D
G
W
i
,
j
,
s
1
s
r
i
A
D
P
H
i
·
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
2
s
r
i
r
2
,
s
k
2
=
H
2
K
2
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
.In addition, P
H
i computes M
2
=
E
s
k
2
(
D
a
t
a
i
,
j
) and V
2
=
H
3
(
s
k
2
∥
M
2
∥
T
2
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
). Here, D
a
t
a
i
,
j is the electronic health report composed by P
H
i, and T
2 is a current timestamp. Finally, P
H
i sends a message package D
2
=
{
R
2
,
A
D
P
H
i
,
A
D
G
W
i
,
j
,
T
2
,
M
2
,
V
2
} to S
V.Step 2.
After receiving the data packageD
2, S
V checks the validity of the timestamp T
2. If it has grown stale, S
V quits the session. Otherwise, S
V can assure the package by judging V
2
∗
=
V
2 as follows:(14)
K
2
∗
=
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
1
s
r
i
·
e
^
A
D
G
W
i
,
j
,
R
2
s
2
s
r
i
,
s
k
2
∗
=
H
2
K
2
∗
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
,
V
2
∗
=
H
3
s
k
2
∗
∥
M
2
∥
T
2
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
.Only if V
2
∗ is equal to V
2 included in D
2 does S
V assure the source of package from a physician A
D
P
H
i and send a notice to P
A
i
,
j. Finally, S
V stores the package D
2 in its database.Step 3.
WhenG
W
i
,
j is authenticated by S
V, he/she can get the report of the patient P
A
i
,
j from S
V. G
W
i
,
j computes the fresh session key s
k
2
′ as follows:(15)
K
2
′
=
e
^
A
D
G
W
i
,
j
,
s
1
s
r
i
A
D
P
H
i
·
e
^
s
2
s
r
i
A
D
G
W
i
,
j
,
R
2
,
s
k
2
′
=
H
2
K
2
′
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
.Then, G
W
i
,
j computes V
2
′
=
H
3
(
s
k
2
′
∥
M
2
∥
T
2
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
). Only if V
2
′ is equal to V
2 does G
W
i
,
j assure the correctness of s
k
2
′ and decrypt M
2 to get D
a
t
a
i
,
j by using the key s
k
2
′.


## 6. Correctness and Security

In this section, we present the correctness of our improved scheme. Then, we illustrate that our enhanced key agreement scheme can overcome the two security weaknesses of security analysis of FNKAP by security analysis.


### 6.1. Correctness

We verify the correctness of key agreement in our scheme as follows:(16)
K
1
=
e
^
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
·
e
^
s
3
s
r
i
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
r
1
=
e
^
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
s
1
s
r
i
·
e
^
r
1
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
s
3
s
r
i
=
e
^
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
s
1
s
r
i
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
=
K
1
∗
=
e
^
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
=
K
1
′
.Thus, the agreed session keyss
k
1, s
k
1
∗, and s
k
1
′ computed by P
H
i, S
V, and S
N
i
,
j
,
d are equal. The same as above, we prove that s
k
2 is equal to s
k
2
′ because K
2 is equal to K
2
∗ and K
2
′:(17)
K
2
=
e
^
A
D
G
W
i
,
j
,
s
1
s
r
i
A
D
P
H
i
·
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
2
s
r
i
r
2
=
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
1
s
r
i
·
e
^
A
D
G
W
i
,
j
,
r
2
A
D
P
H
i
s
2
s
r
i
=
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
1
s
r
i
·
e
^
A
D
G
W
i
,
j
,
R
2
s
2
s
r
i
=
K
2
∗
=
e
^
A
D
G
W
i
,
j
,
s
1
s
r
i
A
D
P
H
i
·
e
^
s
2
s
r
i
A
D
G
W
i
,
j
,
R
2
=
K
2
′
.


### 6.2. Security Proof

In the following, we will show that our scheme is provably secure under DBDH assumption in the random oracle model. We treatH
1, H
2, and H
3 as three random oracles.Theorem 6.
LetG
1 and G
2 be two groups of order q and e
^ be a bilinear mapping that together satisfy the DBDH assumption. Let the hash functions H
1, H
2, and H
3 used in the scheme be modeled as the random oracles. Suppose that the DBDH assumption holds; the proposed scheme is a secure key agreement in our security model.Proof.
Suppose an adversaryA is an attack algorithm that breaks our scheme in the probability ϵ; we will show how to use the ability of A to build an algorithm B that solves the DBDH assumption with probability of at least ϵ
′. Thus, A’s advantage must be negligible because the DBDH assumption holds.We refer toB as “the simulator” because it simulates a real attacking environment for A. B is initialized with the DBDH parameters {
G
1
,
G
2
,
e
^
,
q
} and the points {
P
,
a
P
,
b
P
,
c
P
∈
G
1
,
D
,
R
∈
G
2
}, D
=
e
^
(
P
,
P
)
a
b
c, and R
=
e
^
(
P
,
P
)
r. The idea of the proof is that B will embed the DBDH problem into the queries issued by A. Since the hash function H
2 is modeled as random oracle, after the adversary issues the test query, it has only two unneglected cases to distinguish the tested session key s
k
1 or s
k
2 from a random string.Case 1 (key-replication attack).
The adversaryA forces a nonmatching session to have the same session key with the T
e
s
t
(
∏
A
,
B
s
‍
). In this case, the adversary A can get the session key by querying the nonmatching session. However, the input of hash function H
2 includes the entities’ identities and the random nonce. Furthermore, they and a timestamp are integrally protected by H
3. For example, in Step 1, the session key s
k
1
=
H
2
(
K
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) includes the identities A
D
P
H
i and A
D
S
N
i
,
j
,
d and the random nonce R
1. The certification value V
1
=
H
3
(
s
k
1
∥
M
1
∥
T
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) includes them and the timestamp T
1. Therefore, two nonmatching sessions cannot have the same values and when H
2 and H
3 are modeled as a random oracle, the success probability of key-replication attack is negligible.Case 2 (forging attack).
The adversaryA queries H
2 on the value H
2
(
K
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) or H
2
(
K
2
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
) in the test query. Obviously, in this case the adversary A can compute the value K
1 or K
2 by itself.In the following, we mainly analyze the Case2 forging attack. A simulator B is interested in using the A to turn A’s advantage in distinguishing the tested session key from a random string into an advantage in solving the DBDH problem. During the game, B has to answer all queries of the A.Setup.
B simulates theSetup algorithm as follows. B starts by choosing security and public parameters for our scheme using its input DBDH parameters {
G
1
,
G
2
,
e
^
,
q
} and {
P
,
a
P
,
b
P
,
c
P
∈
G
1
,
Q
=
D
o
r
R
,
D
=
e
^
(
P
,
P
)
a
b
c
,
R
=
e
^
(
P
,
P
)
r
}. B also chooses a random master key set {
s
1
,
s
2
,
s
3
,
s
r
i
∣
i
∈
(
1
,
…
,
N
)
} from Z
q
∗, as the PKG would do. Using these keys, B sets the random generator P
0
=
P, and then S
V’s public parameters are p
a
r
a
m
s
=
{
q
,
G
1
,
G
2
,
P
,
e
^
,
H
1
,
H
2
,
H
3
,
c
P
,
s
2
P
,
s
3
P
,
s
r
i
c
P
,
s
2
s
r
i
P
,
s
3
s
r
i
P
∣
i
∈
(
1
,
…
,
N
)
}. B invokes the adversary A, providing it with the public parameters p
a
r
a
m
s. Note that the DBDH parameters c
P have been embedded in the game and the simulator B has no idea about the value c. With the probability at least 1
/
n
(
k
)
2, B guesses the adversary A will select one patient I
D
P
A
i
,
j and his/her physician I
D
P
H
i. With the probability at least 1
/
s
(
k
), B guesses the adversary A will select the session s as test session.Queries. When the adversary A makes his/her queries, the simulator B answers the queries in arbitrary order as follows. Note that I
D
P
H
i, I
D
G
W
i
,
j, and I
D
S
N
i
,
j
,
d are the guessed victims physician and devices.H
1
(
·
)
. In order to enhance simulation’s fidelity, B maintains an initially empty list H
1
l
i
s
t of tuples (
I
D
A
,
R
A
,
u
A
,
h
A
,
R
A
)
∈
{
0,1
}
∗
×
G
1
×
Z
q
∗
×
{
0,1
}
k. When A queries the oracle H
1 as an input (
I
D
A
∥
R
A
), B responds to the query in the following way.(i)
B checks the list H
1
l
i
s
t; if (
I
D
A and R
A
) are already there, then B responds with stored value h
A
,
R
A.
(ii)
Otherwise, ifI
D
A
=
I
D
P
H
i and R
A
=
s
r
i, B randomly chooses u
P
H
i
∈
Z
q
∗, and it computes h
P
H
i
,
s
r
i
=
u
P
H
i
a
P. Then, it inserts (
I
D
P
H
i
,
s
r
i
,
u
P
H
i
,
h
P
H
i
,
s
r
i
) into the H
1
l
i
s
t. Finally, it responds with H
1
(
I
D
P
H
i
∥
s
r
i
)
=
h
P
H
i
,
s
r
i.
(iii)
Otherwise, ifI
D
A
=
I
D
G
W
i
,
j, B randomly chooses u
G
W
i
,
j
∈
Z
q
∗ and computes the value h
G
W
i
,
j
,
a
i
,
j
=
u
G
W
i
,
j
b
P. Then, it inserts (
I
D
G
W
i
,
j
,
a
i
,
j
,
u
G
W
i
,
j
,
h
G
W
i
,
j
,
a
i
,
j
) into the H
1
l
i
s
t. Here, a
i
,
j
=
R
A. Finally, it responds with H
1
(
I
D
G
W
i
,
j
∥
a
i
,
j
)
=
h
G
W
i
,
j
,
a
i
,
j
=
u
G
W
i
,
j
b
P.
(iv)
Otherwise, ifI
D
A
=
I
D
S
N
i
,
j
,
d, B randomly chooses u
S
N
i
,
j
,
d
∈
Z
q
∗ and computes the value h
S
N
i
,
j
,
d
,
a
i
,
j
=
u
S
N
i
,
j
,
d
b
P. Then, it inserts (
I
D
S
N
i
,
j
,
d
,
a
i
,
j
,
u
S
N
i
,
j
,
d
,
h
S
N
i
,
j
,
d
,
a
i
,
j
) into the H
1
l
i
s
t. Here, a
i
,
j
=
R
A. Finally, it responds with H
1
(
I
D
G
W
i
,
j
∥
a
i
,
j
)
=
h
G
W
i
,
j
,
a
i
,
j
=
u
S
N
i
,
j
,
d
b
P.
(v)
Otherwise,B randomly chooses u
A
∈
Z
q
∗, computes h
A
,
R
A
=
u
A
P, and inserts (
I
D
A
,
R
A
,
u
A
,
h
A
,
R
A
) in the list. Finally, it responds with H
1
(
I
D
A
∥
R
A
)
=
h
A
,
R
A
=
u
A
P.H
2
(
·
). The simulator B maintains an initially empty list H
2
l
i
s
t with entries of the form (
K
A
B
,
R
A
B
,
A
D
A
,
A
D
B
,
h
A
B
,
R
A
B
)
∈
G
2
×
G
1
3
×
{
0,1
}
k. When A queries the oracle H
2 as a input (
K
A
B
,
R
A
B
,
A
D
A
,
A
D
B
), the simulator B responds to the query in the following way.(i)
B checks the list H
2
l
i
s
t; if (
K
A
B
,
R
A
B
,
A
D
A
,
A
D
B
) is already there, B responds with the value h
A
B
,
R
A
B.
(ii)
Otherwise,B randomly chooses h
A
B
,
R
A
B
∈
{
0,1
}
k and sends back the value to A. Finally, B stores the new tuple (
K
A
B
,
R
A
B
,
A
D
A
,
A
D
B
,
h
A
B
,
R
A
B
) in the list H
2
l
i
s
t.H
3
(
·
). The simulator B maintains an initially empty list H
3
l
i
s
t with entries of the form (
K
A
B
,
M
A
B
,
T
A
B
,
R
A
B
,
A
D
A
,
A
D
B
,
h
A
B
,
T
A
B
)
∈
{
0,1
}
k
×
{
0,1
}
∗
×
G
1
3
×
{
0,1
}
k. The simulator B responds to these queries in the following ways.(i)
B checks the list H
3
l
i
s
t; if (
K
A
B
,
M
A
B
,
T
A
B
,
R
A
B
,
A
D
A
,
A
D
B
) is already there, B responds with the value h
A
B
,
R
A
B.
(ii)
Otherwise,B randomly chooses h
A
B
,
R
A
B
∈
{
0,1
}
k and sends back h
A
B
,
R
A
B to A. Finally, B stores the new tuple (
K
A
B
,
M
A
B
,
T
A
B
,
R
A
B
,
A
D
A
,
A
D
B
,
h
A
B
,
T
A
B
) in the list H
3
l
i
s
t.E
s
t
a
b
l
i
s
h
(
I
D
A
)
. When receiving this query, B responds to the query in the following way.(i)
IfI
D
A is the target physician or the target patient’s gateway or sensor nodes, B aborts the game.
(ii)
Otherwise, ifI
D
A is a physician P
H
j, B looks in H
1
l
i
s
t for the entries (
I
D
S
V
j
,
s
r
j
,
u
S
V
j
,
h
S
V
j
,
s
r
j
) and (
I
D
P
H
j
,
s
r
j
,
u
P
H
j
,
h
P
H
j
,
s
r
j
). Then, B returns {
(
s
r
j
u
P
H
j
c
P
,
s
2
s
r
j
,
s
3
s
r
j
)
∥
u
S
V
j
P
,
u
P
H
j
P
}.
(iii)
Otherwise, ifI
D
A is a patient’s G
W
j
,
k, B looks in H
1
l
i
s
t for the entries (
I
D
S
V
j
,
s
r
j
,
u
S
V
j
,
h
S
V
j
,
s
r
j
), (
I
D
P
H
j
,
s
r
j
,
u
P
H
j
,
h
P
H
j
,
s
r
j
), and (
I
D
G
W
j
,
k
,
s
r
j
,
u
G
W
j
,
k
,
h
G
W
j
,
k
,
s
r
j
). Then, B returns {
(
s
r
j
u
P
H
j
c
P
,
s
2
s
r
j
u
G
W
j
,
k
P
)
∥
u
S
V
j
P
,
u
P
H
j
P
,
u
G
W
j
,
k
P
}.
(iv)
Otherwise, ifI
D
A is a physician S
N
j
,
k
,
d, the simulator B looks in H
1
l
i
s
t for the entries (
I
D
S
V
j
,
s
r
j
,
u
S
V
j
,
h
S
V
j
,
s
r
j
), (
I
D
P
H
j
,
s
r
j
,
u
P
H
j
,
h
P
H
j
,
s
r
j
), (
I
D
G
W
j
,
k
,
s
r
j
,
u
G
W
j
,
k
,
h
G
W
j
,
k
,
s
r
j
), and (
I
D
S
N
j
,
k
,
d
,
s
r
j
,
u
S
N
j
,
k
,
d
,
h
S
N
j
,
k
,
d
,
s
r
j
). Then, B returns {
(
s
r
j
u
P
H
j
c
P
,
s
3
s
r
j
u
S
N
j
,
k
,
d
P
)
∥
u
S
V
j
P
,
u
P
H
j
P
,
u
G
W
j
,
k
P
,
u
S
N
j
,
k
,
d
P
}.S
e
n
d
(
∏
A
,
B
s
‍
,
D
)
. Since the H
2 and H
3 are the random oracles, the adversary cannot change the communication message. the simulator B needs only to store the values according to the scheme. Moreover, the parameters are included in the data D, which can be found in the lists H
3
l
i
s
t and H
2
l
i
s
t.R
e
v
e
a
l
(
∏
A
,
B
s
‍
). B maintains a list s
k
l
i
s
t with tuples of the form (
I
D
A
,
I
D
B
,
R
A
B
,
∏
A
,
B
s
‍
). The simulator B responds to the query in the following way.(i)
IfI
D
A and I
D
B are the target physician and the target patient’s gateway or sensor nodes, B aborts the game.
(ii)
Otherwise, ifI
D
A is a target physician P
H
i and I
D
B is not target patients’ facilities, B proceeds in the following way to respond:
(a)
IfI
D
B is an identity of gateway, B computes K
A
B
=
e
^
(
u
G
W
i
,
j
∗
c
P
,
s
r
i
u
P
H
i
a
P
)
·
e
^
(
s
2
s
r
i
u
G
W
i
,
j
∗
P
,
R
2
). Then, B finds the value h
A
B
,
R
A
B from H
2
l
i
s
t and returns h
A
B
,
R
A
B as the response.
(b)
OtherwiseI
D
B should be an identity of sensor node; the simulator B computes K
A
B
=
e
^
(
u
S
N
i
,
j
∗
,
d
∗
c
P
,
s
r
i
u
P
H
i
a
P
)
·
e
^
(
R
1
,
s
3
s
r
i
u
P
H
i
a
P
). Then, B finds the value h
A
B
,
R
A
B from H
2
l
i
s
t and returns h
A
B
,
R
A
B as the response.
(iii)
Otherwise, ifI
D
A is another physician P
H
j and I
D
B is his/her patients facilities, B proceeds in the following way to respond:
(a)
IfI
D
B is an identity of gateway, B computes K
A
B
=
e
^
(
u
G
W
j
,
j
∗
c
P
,
s
r
j
u
P
H
j
P
)
·
e
^
(
s
2
s
r
j
u
G
W
j
,
j
∗
P
,
R
2
). Then, B finds the value h
A
B
,
R
A
B from H
2
l
i
s
t and returns h
A
B
,
R
A
B as the response.
(b)
OtherwiseI
D
B should be an identity of sensor node; B computes K
A
B
=
e
^
(
u
S
N
j
,
j
∗
,
d
∗
c
P
,
s
r
j
u
P
H
j
P
)
·
e
^
(
R
1
,
s
3
s
r
j
u
P
H
j
P
). Then, B finds the value h
A
B
,
R
A
B from H
2
l
i
s
t and returns h
A
B
,
R
A
B as the response.T
e
s
t
(
∏
A
,
B
s
‍
). A issues a test query. Suppose the identity tuple of the first node A is I
D
P
H
i and the second target node B is I
D
G
W
i
,
j or I
D
S
N
i
,
j
,
d.(i)
IfA and B do not belong to our guessed victims P
H
i and P
A
i
,
j, B aborts the game.
(ii)
Otherwise,B queries A
D
S
V
i, A
D
P
H
i, A
D
G
W
i
,
j, and A
D
S
N
i
,
j
,
d.
(a)
IfB
=
G
W
i
,
j, B computes K
2
=
Q
u
G
W
i
,
j
u
P
H
i
s
r
i
·
e
^
(
A
D
G
W
i
,
j
,
R
2
)
s
2
s
r
i.
(b)
Otherwise,B computes K
1
=
Q
u
S
N
i
,
j
,
d
u
P
H
i
s
r
i
·
e
^
(
R
1
,
A
D
P
H
i
)
s
3
s
r
i.
B looks in the list H
2
l
i
s
t and returns the value s
k
1 or s
k
2 to the adversary A.The test query is answered byB with its DBDH input D or R. Consider the following two cases:(i)
IfQ
=
D, since D
=
e
^
(
P
,
P
)
a
b
c in the DBDH instance, then(18)
K
1
=
D
u
S
N
i
,
j
,
d
u
P
H
i
s
r
i
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
=
e
^
u
S
N
i
,
j
,
d
b
P
,
u
P
H
i
a
P
s
r
i
c
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
=
e
^
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
s
1
s
r
i
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
,
K
2
=
D
u
G
W
i
,
j
u
P
H
i
s
r
i
·
e
^
A
D
G
W
i
,
j
,
R
2
s
2
s
r
i
=
e
^
u
G
W
i
,
j
b
P
,
u
P
H
i
a
P
s
r
i
c
·
e
^
A
D
G
W
i
,
j
,
R
2
s
2
s
r
i
=
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
1
s
r
i
·
e
^
A
D
G
W
i
,
j
,
R
2
s
2
s
r
i
.
Thus, the response byB corresponds to the real values s
k
1 and s
k
2.
(ii)
IfQ
=
R, since R
=
e
^
(
P
,
P
)
r is random, then the response by B to the test query of A is a random element in G
2.If the adversaryA succeeds in getting the session key s
k
1 or s
k
2, it shall distinguish between the value s
k
1 or s
k
2 and a random value; then, it outputs the correct bit b
=
1 or b
=
0. B can give the correct answer to the DBDH problem by using A’s output.The success probability ofB is(19)
ϵ
′
≥
1
s
k
n
k
2
t
k
ϵ
.Here, ϵ is the probability that the adversary A succeeds in launching the attack. t
(
k
) is the polynomial bound on the number of the adversary A’s queries.If the adversaryA succeeds with nonnegligible probability to attack our scheme, we can also solve the DBDH problem with a nonnegligible probability. Thus, our scheme is based on the DBDH problem.


### 6.3. Security Analysis

In the following, we will directly analyze how our proposed scheme achieves entity anonymity and untraceability and resists collusion attack and whether the security requirements have been satisfied.Proposition 7.
The proposed scheme can resist the replay attack.Proof.
It should be noted that our proposed scheme inherits the structure of FNKAP. We also use the random numbersr
1 and r
2 to achieve the freshness key agreement. The adversary cannot compute the r
i, i
∈
{
1,2
} from R
1
=
r
1
A
D
S
N
i
,
j
,
d and R
2
=
r
2
A
D
P
H
i because of the difficulty of the ECDL problem. Moreover, the proposed scheme can efficiently resist the replay attack by considering the following scenarios. (
1
) An adversary cannot replay the data package D
1 to cheat S
V and P
H
i. During the Key Agreement from SN to PH Phase, when S
V receives a data package D
1, it verifies the timestamp T
1 with the current time. If the data package is a replay attack, S
V will detect it. Moreover, if the adversary changes the timestamp T
1 in D
1, S
V will find the behavior by checking the equation V
1
∗
=
H
3
(
s
k
1
∗
∥
M
1
∥
T
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) because it cannot obtain the session key s
k
1
∗. (
2
) An adversary cannot replay the data package D
2 to cheat S
V and P
H
i. Similar to the above, an adversary cannot replay the data package D
2 to cheat S
V and P
A
i
,
j. During the key agreement from PH to GW Phase, when S
V receives a data package D
2, it verifies the timestamp T
2 with the current time. If the data package is a replay attack, then S
V will detect it. Moreover, if the adversary changes the timestamp T
2 in D
2, S
V will find the behavior by checking the equation V
2
∗
=
H
3
(
s
k
2
∗
∥
M
2
∥
T
2
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
) because it cannot know the session key s
k
2
∗.Proposition 8.
The proposed scheme can provide basic forward secrecy.Proof.
To establish session key between SN and PH,S
N
i
,
j
,
d and P
H
i use various r
1
A
D
S
N
i
,
j
,
d for each session. Thus, the current session key s
k
1
=
H
2
(
K
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) is disclosed, and an adversary cannot obtain the information about K
1
=
e
^
(
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
)
·
e
^
(
s
3
s
r
i
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
)
r
1. In other words, the adversary cannot get more opportunities to guess previous key s
k
1
∗
=
H
2
(
K
1
∗
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) than before, even if he/she knows the current key s
k
1. Similarly, because R
2 is equal to r
2
A
D
P
H
i, the adversary cannot gain any benefits to guess previous key s
k
2
∗
=
H
2
(
K
2
∗
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
) between PH and GW compared to before, even if he/she knows the current key s
k
2. Thus, our proposal can provide basic forward secrecy.Proposition 9.
The proposed scheme can prevent fraud attack.Proof.
Our proposal provides mutual authentication betweenP
H
i and G
W
i
,
j or P
H
i and S
N
i
,
j
,
d. The proposed scheme can prevent fraud attack by considering the following scenarios. (
1
) An adversary cannot impersonate S
N
i
,
j
,
d to cheat P
H
i. P
H
i can authenticate S
N
i
,
j
,
d by verifying V
1
′ in Step 3. Since the adversary cannot obtain s
3
s
r
i or s
3
s
r
i
r
1
A
D
S
N
i
,
j
,
d, he/she cannot compute K
1
′
=
e
^
(
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
)
·
e
^
(
R
1
,
A
D
P
H
i
)
s
3
s
r
i, K
1
∗
=
e
^
(
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
)
s
1
s
r
i
·
e
^
(
R
1
,
A
D
P
H
i
)
s
3
s
r
i, or K
1
=
e
^
(
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
)
·
e
^
(
s
3
s
r
i
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
)
r
1. Thus, the adversary cannot get s
k
1
′
=
H
2
(
K
1
′
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) and V
1
′
=
H
3
(
s
k
1
′
∥
R
1
∥
M
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
∥
T
1
), sequentially. Thus, the adversary cannot generate the valid verifier to P
H
i. (
2
) An adversary cannot impersonate P
H
i to cheat G
W
i
,
j. Similar to the above, G
W
i
,
j can authenticate P
H
i by verifying V
2
′ in Step 3. Since the adversary cannot obtain s
2
s
r
i or s
2
s
r
i
A
D
G
W
i
,
j, he/she cannot compute K
2
′, K
2
∗, or K
2. Thus, the adversary cannot get s
k
2
′ and V
2
′, sequentially. Thus, the adversary cannot generate the valid verifier to G
W
i
,
j.Proposition 10.
The proposed scheme can provide entity anonymity and untraceability.Proof.
In the proposed scheme, the adversary can obtain the amplified identitiesH
1
(
I
D
S
V
∥
s
r
i
), H
1
(
I
D
P
H
i
∥
s
r
i
), H
1
(
I
D
G
W
i
,
j
∥
a
i
,
j
), and H
1
(
I
D
S
N
i
,
j
,
d
∥
a
i
,
j
) instead of H
(
I
D
S
V
), H
(
I
D
P
H
i
), H
(
I
D
G
W
i
,
j
), and H
(
I
D
S
N
i
,
j
,
d
) in Steps K1 and K3. Here, s
r
i and a
i
,
j are big random numbers in Z
q
∗. Therefore, the adversary cannot verify whether the guessed identity is correct or incorrect by testing all possible identities without the secret s
r
i and a
i
,
j. For example, to guess H
1
(
I
D
P
H
i
∥
s
r
i
), the adversary should input the guess values of I
D
P
H
i and s
r
i at the same time. Suppose the identity I
D
P
H
i is composed of m bits; it is infeasible for adversary to launch an exhausted search for 2
m
+
q possible solutions. Here, q is the group order of Z
q
∗, and it is a big random number. In particular, if the physicians reregister on a period, s
r
i would be fresh regularly. Thus, this risk of corruption will be lower to I
D
P
H
i. Moreover, a
i
,
j is also a big random number in Z
q
∗, and each patient has a different value. Even if it is the same patient, there are different values on the various diagnoses. Based on the similar reason, the adversary cannot know the identities of I
D
G
W
i
,
j and I
D
S
N
i
,
j
,
d or trace them. Furthermore, it is also intractable to derive the identity from H
1
(
I
D
S
V
∥
s
r
i
), H
1
(
I
D
P
H
i
∥
s
r
i
), H
1
(
I
D
G
W
i
,
j
∥
a
i
,
j
), and H
1
(
I
D
S
N
i
,
j
,
d
∥
a
i
,
j
) because H
1 is a secure one-way cryptography hash function. Thus, our proposal can achieve anonymity and untraceability.Proposition 11.
The proposed scheme can withstand the collusion attack.Proof.
In our proposal,S
V distributes different secret values (
s
1
s
r
i
A
D
P
H
i
,
s
2
s
r
i
,
s
3
s
r
i
) for various physicians P
H
i. Thus, the adversary physician P
H
A and his/her patients P
A
A
,
j cannot get the victim’s information s
2
s
r
i
,
s
3
s
r
i, directly. Furthermore, the adversary A who has registered as a normal patient of the physician P
H
i can legally obtain (
s
1
s
r
i
A
D
P
H
i
,
s
2
s
r
i
A
D
G
W
i
,
j
) from S
V. However, he/she cannot obtain s
1
s
r
i or s
2
s
r
i from (
s
1
s
r
i
A
D
P
H
i
,
s
2
s
r
i
A
D
G
W
i
,
j
) except when he/she can solve the ECDL problem. Similarly, the adversary A cannot obtain s
3
s
r
i from s
3
s
r
i
A
D
S
N
i
,
j
,
d because of the difficulty of the ECDL problem. Obviously, our scheme destructs the attack conditions at Steps A1 and A2 in Section 4. As a result, the scheme can resist the collusion attack and prevent the adversary from generating the session keys s
k
1 and s
k
2. Furthermore, if an insider adversary wants to attack the key agreement from SN to PH, he/she should get the secure information about s
3
s
r
i
A
D
S
N
i
,
j
,
d. The adversary receives up to s
3
s
r
i
A
D
S
N
i
,
j
,
d
∗; he/she cannot get the information except whens he/she can solve the ECDL problem. Similarly, an insider adversary cannot launch an attack to the key agreement from PH to GW phase, because he/she cannot get the value s
2
s
r
i
A
D
G
W
i
,
j. Thus, our proposal resists the collusion attack, effectively.


## 6.1. Correctness

We verify the correctness of key agreement in our scheme as follows:(16)
K
1
=
e
^
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
·
e
^
s
3
s
r
i
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
r
1
=
e
^
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
s
1
s
r
i
·
e
^
r
1
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
s
3
s
r
i
=
e
^
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
s
1
s
r
i
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
=
K
1
∗
=
e
^
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
=
K
1
′
.Thus, the agreed session keyss
k
1, s
k
1
∗, and s
k
1
′ computed by P
H
i, S
V, and S
N
i
,
j
,
d are equal. The same as above, we prove that s
k
2 is equal to s
k
2
′ because K
2 is equal to K
2
∗ and K
2
′:(17)
K
2
=
e
^
A
D
G
W
i
,
j
,
s
1
s
r
i
A
D
P
H
i
·
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
2
s
r
i
r
2
=
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
1
s
r
i
·
e
^
A
D
G
W
i
,
j
,
r
2
A
D
P
H
i
s
2
s
r
i
=
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
1
s
r
i
·
e
^
A
D
G
W
i
,
j
,
R
2
s
2
s
r
i
=
K
2
∗
=
e
^
A
D
G
W
i
,
j
,
s
1
s
r
i
A
D
P
H
i
·
e
^
s
2
s
r
i
A
D
G
W
i
,
j
,
R
2
=
K
2
′
.


## 6.2. Security Proof

In the following, we will show that our scheme is provably secure under DBDH assumption in the random oracle model. We treatH
1, H
2, and H
3 as three random oracles.Theorem 6.
LetG
1 and G
2 be two groups of order q and e
^ be a bilinear mapping that together satisfy the DBDH assumption. Let the hash functions H
1, H
2, and H
3 used in the scheme be modeled as the random oracles. Suppose that the DBDH assumption holds; the proposed scheme is a secure key agreement in our security model.Proof.
Suppose an adversaryA is an attack algorithm that breaks our scheme in the probability ϵ; we will show how to use the ability of A to build an algorithm B that solves the DBDH assumption with probability of at least ϵ
′. Thus, A’s advantage must be negligible because the DBDH assumption holds.We refer toB as “the simulator” because it simulates a real attacking environment for A. B is initialized with the DBDH parameters {
G
1
,
G
2
,
e
^
,
q
} and the points {
P
,
a
P
,
b
P
,
c
P
∈
G
1
,
D
,
R
∈
G
2
}, D
=
e
^
(
P
,
P
)
a
b
c, and R
=
e
^
(
P
,
P
)
r. The idea of the proof is that B will embed the DBDH problem into the queries issued by A. Since the hash function H
2 is modeled as random oracle, after the adversary issues the test query, it has only two unneglected cases to distinguish the tested session key s
k
1 or s
k
2 from a random string.Case 1 (key-replication attack).
The adversaryA forces a nonmatching session to have the same session key with the T
e
s
t
(
∏
A
,
B
s
‍
). In this case, the adversary A can get the session key by querying the nonmatching session. However, the input of hash function H
2 includes the entities’ identities and the random nonce. Furthermore, they and a timestamp are integrally protected by H
3. For example, in Step 1, the session key s
k
1
=
H
2
(
K
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) includes the identities A
D
P
H
i and A
D
S
N
i
,
j
,
d and the random nonce R
1. The certification value V
1
=
H
3
(
s
k
1
∥
M
1
∥
T
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) includes them and the timestamp T
1. Therefore, two nonmatching sessions cannot have the same values and when H
2 and H
3 are modeled as a random oracle, the success probability of key-replication attack is negligible.Case 2 (forging attack).
The adversaryA queries H
2 on the value H
2
(
K
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) or H
2
(
K
2
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
) in the test query. Obviously, in this case the adversary A can compute the value K
1 or K
2 by itself.In the following, we mainly analyze the Case2 forging attack. A simulator B is interested in using the A to turn A’s advantage in distinguishing the tested session key from a random string into an advantage in solving the DBDH problem. During the game, B has to answer all queries of the A.Setup.
B simulates theSetup algorithm as follows. B starts by choosing security and public parameters for our scheme using its input DBDH parameters {
G
1
,
G
2
,
e
^
,
q
} and {
P
,
a
P
,
b
P
,
c
P
∈
G
1
,
Q
=
D
o
r
R
,
D
=
e
^
(
P
,
P
)
a
b
c
,
R
=
e
^
(
P
,
P
)
r
}. B also chooses a random master key set {
s
1
,
s
2
,
s
3
,
s
r
i
∣
i
∈
(
1
,
…
,
N
)
} from Z
q
∗, as the PKG would do. Using these keys, B sets the random generator P
0
=
P, and then S
V’s public parameters are p
a
r
a
m
s
=
{
q
,
G
1
,
G
2
,
P
,
e
^
,
H
1
,
H
2
,
H
3
,
c
P
,
s
2
P
,
s
3
P
,
s
r
i
c
P
,
s
2
s
r
i
P
,
s
3
s
r
i
P
∣
i
∈
(
1
,
…
,
N
)
}. B invokes the adversary A, providing it with the public parameters p
a
r
a
m
s. Note that the DBDH parameters c
P have been embedded in the game and the simulator B has no idea about the value c. With the probability at least 1
/
n
(
k
)
2, B guesses the adversary A will select one patient I
D
P
A
i
,
j and his/her physician I
D
P
H
i. With the probability at least 1
/
s
(
k
), B guesses the adversary A will select the session s as test session.Queries. When the adversary A makes his/her queries, the simulator B answers the queries in arbitrary order as follows. Note that I
D
P
H
i, I
D
G
W
i
,
j, and I
D
S
N
i
,
j
,
d are the guessed victims physician and devices.H
1
(
·
)
. In order to enhance simulation’s fidelity, B maintains an initially empty list H
1
l
i
s
t of tuples (
I
D
A
,
R
A
,
u
A
,
h
A
,
R
A
)
∈
{
0,1
}
∗
×
G
1
×
Z
q
∗
×
{
0,1
}
k. When A queries the oracle H
1 as an input (
I
D
A
∥
R
A
), B responds to the query in the following way.(i)
B checks the list H
1
l
i
s
t; if (
I
D
A and R
A
) are already there, then B responds with stored value h
A
,
R
A.
(ii)
Otherwise, ifI
D
A
=
I
D
P
H
i and R
A
=
s
r
i, B randomly chooses u
P
H
i
∈
Z
q
∗, and it computes h
P
H
i
,
s
r
i
=
u
P
H
i
a
P. Then, it inserts (
I
D
P
H
i
,
s
r
i
,
u
P
H
i
,
h
P
H
i
,
s
r
i
) into the H
1
l
i
s
t. Finally, it responds with H
1
(
I
D
P
H
i
∥
s
r
i
)
=
h
P
H
i
,
s
r
i.
(iii)
Otherwise, ifI
D
A
=
I
D
G
W
i
,
j, B randomly chooses u
G
W
i
,
j
∈
Z
q
∗ and computes the value h
G
W
i
,
j
,
a
i
,
j
=
u
G
W
i
,
j
b
P. Then, it inserts (
I
D
G
W
i
,
j
,
a
i
,
j
,
u
G
W
i
,
j
,
h
G
W
i
,
j
,
a
i
,
j
) into the H
1
l
i
s
t. Here, a
i
,
j
=
R
A. Finally, it responds with H
1
(
I
D
G
W
i
,
j
∥
a
i
,
j
)
=
h
G
W
i
,
j
,
a
i
,
j
=
u
G
W
i
,
j
b
P.
(iv)
Otherwise, ifI
D
A
=
I
D
S
N
i
,
j
,
d, B randomly chooses u
S
N
i
,
j
,
d
∈
Z
q
∗ and computes the value h
S
N
i
,
j
,
d
,
a
i
,
j
=
u
S
N
i
,
j
,
d
b
P. Then, it inserts (
I
D
S
N
i
,
j
,
d
,
a
i
,
j
,
u
S
N
i
,
j
,
d
,
h
S
N
i
,
j
,
d
,
a
i
,
j
) into the H
1
l
i
s
t. Here, a
i
,
j
=
R
A. Finally, it responds with H
1
(
I
D
G
W
i
,
j
∥
a
i
,
j
)
=
h
G
W
i
,
j
,
a
i
,
j
=
u
S
N
i
,
j
,
d
b
P.
(v)
Otherwise,B randomly chooses u
A
∈
Z
q
∗, computes h
A
,
R
A
=
u
A
P, and inserts (
I
D
A
,
R
A
,
u
A
,
h
A
,
R
A
) in the list. Finally, it responds with H
1
(
I
D
A
∥
R
A
)
=
h
A
,
R
A
=
u
A
P.H
2
(
·
). The simulator B maintains an initially empty list H
2
l
i
s
t with entries of the form (
K
A
B
,
R
A
B
,
A
D
A
,
A
D
B
,
h
A
B
,
R
A
B
)
∈
G
2
×
G
1
3
×
{
0,1
}
k. When A queries the oracle H
2 as a input (
K
A
B
,
R
A
B
,
A
D
A
,
A
D
B
), the simulator B responds to the query in the following way.(i)
B checks the list H
2
l
i
s
t; if (
K
A
B
,
R
A
B
,
A
D
A
,
A
D
B
) is already there, B responds with the value h
A
B
,
R
A
B.
(ii)
Otherwise,B randomly chooses h
A
B
,
R
A
B
∈
{
0,1
}
k and sends back the value to A. Finally, B stores the new tuple (
K
A
B
,
R
A
B
,
A
D
A
,
A
D
B
,
h
A
B
,
R
A
B
) in the list H
2
l
i
s
t.H
3
(
·
). The simulator B maintains an initially empty list H
3
l
i
s
t with entries of the form (
K
A
B
,
M
A
B
,
T
A
B
,
R
A
B
,
A
D
A
,
A
D
B
,
h
A
B
,
T
A
B
)
∈
{
0,1
}
k
×
{
0,1
}
∗
×
G
1
3
×
{
0,1
}
k. The simulator B responds to these queries in the following ways.(i)
B checks the list H
3
l
i
s
t; if (
K
A
B
,
M
A
B
,
T
A
B
,
R
A
B
,
A
D
A
,
A
D
B
) is already there, B responds with the value h
A
B
,
R
A
B.
(ii)
Otherwise,B randomly chooses h
A
B
,
R
A
B
∈
{
0,1
}
k and sends back h
A
B
,
R
A
B to A. Finally, B stores the new tuple (
K
A
B
,
M
A
B
,
T
A
B
,
R
A
B
,
A
D
A
,
A
D
B
,
h
A
B
,
T
A
B
) in the list H
3
l
i
s
t.E
s
t
a
b
l
i
s
h
(
I
D
A
)
. When receiving this query, B responds to the query in the following way.(i)
IfI
D
A is the target physician or the target patient’s gateway or sensor nodes, B aborts the game.
(ii)
Otherwise, ifI
D
A is a physician P
H
j, B looks in H
1
l
i
s
t for the entries (
I
D
S
V
j
,
s
r
j
,
u
S
V
j
,
h
S
V
j
,
s
r
j
) and (
I
D
P
H
j
,
s
r
j
,
u
P
H
j
,
h
P
H
j
,
s
r
j
). Then, B returns {
(
s
r
j
u
P
H
j
c
P
,
s
2
s
r
j
,
s
3
s
r
j
)
∥
u
S
V
j
P
,
u
P
H
j
P
}.
(iii)
Otherwise, ifI
D
A is a patient’s G
W
j
,
k, B looks in H
1
l
i
s
t for the entries (
I
D
S
V
j
,
s
r
j
,
u
S
V
j
,
h
S
V
j
,
s
r
j
), (
I
D
P
H
j
,
s
r
j
,
u
P
H
j
,
h
P
H
j
,
s
r
j
), and (
I
D
G
W
j
,
k
,
s
r
j
,
u
G
W
j
,
k
,
h
G
W
j
,
k
,
s
r
j
). Then, B returns {
(
s
r
j
u
P
H
j
c
P
,
s
2
s
r
j
u
G
W
j
,
k
P
)
∥
u
S
V
j
P
,
u
P
H
j
P
,
u
G
W
j
,
k
P
}.
(iv)
Otherwise, ifI
D
A is a physician S
N
j
,
k
,
d, the simulator B looks in H
1
l
i
s
t for the entries (
I
D
S
V
j
,
s
r
j
,
u
S
V
j
,
h
S
V
j
,
s
r
j
), (
I
D
P
H
j
,
s
r
j
,
u
P
H
j
,
h
P
H
j
,
s
r
j
), (
I
D
G
W
j
,
k
,
s
r
j
,
u
G
W
j
,
k
,
h
G
W
j
,
k
,
s
r
j
), and (
I
D
S
N
j
,
k
,
d
,
s
r
j
,
u
S
N
j
,
k
,
d
,
h
S
N
j
,
k
,
d
,
s
r
j
). Then, B returns {
(
s
r
j
u
P
H
j
c
P
,
s
3
s
r
j
u
S
N
j
,
k
,
d
P
)
∥
u
S
V
j
P
,
u
P
H
j
P
,
u
G
W
j
,
k
P
,
u
S
N
j
,
k
,
d
P
}.S
e
n
d
(
∏
A
,
B
s
‍
,
D
)
. Since the H
2 and H
3 are the random oracles, the adversary cannot change the communication message. the simulator B needs only to store the values according to the scheme. Moreover, the parameters are included in the data D, which can be found in the lists H
3
l
i
s
t and H
2
l
i
s
t.R
e
v
e
a
l
(
∏
A
,
B
s
‍
). B maintains a list s
k
l
i
s
t with tuples of the form (
I
D
A
,
I
D
B
,
R
A
B
,
∏
A
,
B
s
‍
). The simulator B responds to the query in the following way.(i)
IfI
D
A and I
D
B are the target physician and the target patient’s gateway or sensor nodes, B aborts the game.
(ii)
Otherwise, ifI
D
A is a target physician P
H
i and I
D
B is not target patients’ facilities, B proceeds in the following way to respond:
(a)
IfI
D
B is an identity of gateway, B computes K
A
B
=
e
^
(
u
G
W
i
,
j
∗
c
P
,
s
r
i
u
P
H
i
a
P
)
·
e
^
(
s
2
s
r
i
u
G
W
i
,
j
∗
P
,
R
2
). Then, B finds the value h
A
B
,
R
A
B from H
2
l
i
s
t and returns h
A
B
,
R
A
B as the response.
(b)
OtherwiseI
D
B should be an identity of sensor node; the simulator B computes K
A
B
=
e
^
(
u
S
N
i
,
j
∗
,
d
∗
c
P
,
s
r
i
u
P
H
i
a
P
)
·
e
^
(
R
1
,
s
3
s
r
i
u
P
H
i
a
P
). Then, B finds the value h
A
B
,
R
A
B from H
2
l
i
s
t and returns h
A
B
,
R
A
B as the response.
(iii)
Otherwise, ifI
D
A is another physician P
H
j and I
D
B is his/her patients facilities, B proceeds in the following way to respond:
(a)
IfI
D
B is an identity of gateway, B computes K
A
B
=
e
^
(
u
G
W
j
,
j
∗
c
P
,
s
r
j
u
P
H
j
P
)
·
e
^
(
s
2
s
r
j
u
G
W
j
,
j
∗
P
,
R
2
). Then, B finds the value h
A
B
,
R
A
B from H
2
l
i
s
t and returns h
A
B
,
R
A
B as the response.
(b)
OtherwiseI
D
B should be an identity of sensor node; B computes K
A
B
=
e
^
(
u
S
N
j
,
j
∗
,
d
∗
c
P
,
s
r
j
u
P
H
j
P
)
·
e
^
(
R
1
,
s
3
s
r
j
u
P
H
j
P
). Then, B finds the value h
A
B
,
R
A
B from H
2
l
i
s
t and returns h
A
B
,
R
A
B as the response.T
e
s
t
(
∏
A
,
B
s
‍
). A issues a test query. Suppose the identity tuple of the first node A is I
D
P
H
i and the second target node B is I
D
G
W
i
,
j or I
D
S
N
i
,
j
,
d.(i)
IfA and B do not belong to our guessed victims P
H
i and P
A
i
,
j, B aborts the game.
(ii)
Otherwise,B queries A
D
S
V
i, A
D
P
H
i, A
D
G
W
i
,
j, and A
D
S
N
i
,
j
,
d.
(a)
IfB
=
G
W
i
,
j, B computes K
2
=
Q
u
G
W
i
,
j
u
P
H
i
s
r
i
·
e
^
(
A
D
G
W
i
,
j
,
R
2
)
s
2
s
r
i.
(b)
Otherwise,B computes K
1
=
Q
u
S
N
i
,
j
,
d
u
P
H
i
s
r
i
·
e
^
(
R
1
,
A
D
P
H
i
)
s
3
s
r
i.
B looks in the list H
2
l
i
s
t and returns the value s
k
1 or s
k
2 to the adversary A.The test query is answered byB with its DBDH input D or R. Consider the following two cases:(i)
IfQ
=
D, since D
=
e
^
(
P
,
P
)
a
b
c in the DBDH instance, then(18)
K
1
=
D
u
S
N
i
,
j
,
d
u
P
H
i
s
r
i
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
=
e
^
u
S
N
i
,
j
,
d
b
P
,
u
P
H
i
a
P
s
r
i
c
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
=
e
^
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
s
1
s
r
i
·
e
^
R
1
,
A
D
P
H
i
s
3
s
r
i
,
K
2
=
D
u
G
W
i
,
j
u
P
H
i
s
r
i
·
e
^
A
D
G
W
i
,
j
,
R
2
s
2
s
r
i
=
e
^
u
G
W
i
,
j
b
P
,
u
P
H
i
a
P
s
r
i
c
·
e
^
A
D
G
W
i
,
j
,
R
2
s
2
s
r
i
=
e
^
A
D
G
W
i
,
j
,
A
D
P
H
i
s
1
s
r
i
·
e
^
A
D
G
W
i
,
j
,
R
2
s
2
s
r
i
.
Thus, the response byB corresponds to the real values s
k
1 and s
k
2.
(ii)
IfQ
=
R, since R
=
e
^
(
P
,
P
)
r is random, then the response by B to the test query of A is a random element in G
2.If the adversaryA succeeds in getting the session key s
k
1 or s
k
2, it shall distinguish between the value s
k
1 or s
k
2 and a random value; then, it outputs the correct bit b
=
1 or b
=
0. B can give the correct answer to the DBDH problem by using A’s output.The success probability ofB is(19)
ϵ
′
≥
1
s
k
n
k
2
t
k
ϵ
.Here, ϵ is the probability that the adversary A succeeds in launching the attack. t
(
k
) is the polynomial bound on the number of the adversary A’s queries.If the adversaryA succeeds with nonnegligible probability to attack our scheme, we can also solve the DBDH problem with a nonnegligible probability. Thus, our scheme is based on the DBDH problem.


## 6.3. Security Analysis

In the following, we will directly analyze how our proposed scheme achieves entity anonymity and untraceability and resists collusion attack and whether the security requirements have been satisfied.Proposition 7.
The proposed scheme can resist the replay attack.Proof.
It should be noted that our proposed scheme inherits the structure of FNKAP. We also use the random numbersr
1 and r
2 to achieve the freshness key agreement. The adversary cannot compute the r
i, i
∈
{
1,2
} from R
1
=
r
1
A
D
S
N
i
,
j
,
d and R
2
=
r
2
A
D
P
H
i because of the difficulty of the ECDL problem. Moreover, the proposed scheme can efficiently resist the replay attack by considering the following scenarios. (
1
) An adversary cannot replay the data package D
1 to cheat S
V and P
H
i. During the Key Agreement from SN to PH Phase, when S
V receives a data package D
1, it verifies the timestamp T
1 with the current time. If the data package is a replay attack, S
V will detect it. Moreover, if the adversary changes the timestamp T
1 in D
1, S
V will find the behavior by checking the equation V
1
∗
=
H
3
(
s
k
1
∗
∥
M
1
∥
T
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) because it cannot obtain the session key s
k
1
∗. (
2
) An adversary cannot replay the data package D
2 to cheat S
V and P
H
i. Similar to the above, an adversary cannot replay the data package D
2 to cheat S
V and P
A
i
,
j. During the key agreement from PH to GW Phase, when S
V receives a data package D
2, it verifies the timestamp T
2 with the current time. If the data package is a replay attack, then S
V will detect it. Moreover, if the adversary changes the timestamp T
2 in D
2, S
V will find the behavior by checking the equation V
2
∗
=
H
3
(
s
k
2
∗
∥
M
2
∥
T
2
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
) because it cannot know the session key s
k
2
∗.Proposition 8.
The proposed scheme can provide basic forward secrecy.Proof.
To establish session key between SN and PH,S
N
i
,
j
,
d and P
H
i use various r
1
A
D
S
N
i
,
j
,
d for each session. Thus, the current session key s
k
1
=
H
2
(
K
1
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) is disclosed, and an adversary cannot obtain the information about K
1
=
e
^
(
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
)
·
e
^
(
s
3
s
r
i
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
)
r
1. In other words, the adversary cannot get more opportunities to guess previous key s
k
1
∗
=
H
2
(
K
1
∗
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) than before, even if he/she knows the current key s
k
1. Similarly, because R
2 is equal to r
2
A
D
P
H
i, the adversary cannot gain any benefits to guess previous key s
k
2
∗
=
H
2
(
K
2
∗
∥
R
2
∥
A
D
P
H
i
∥
A
D
G
W
i
,
j
) between PH and GW compared to before, even if he/she knows the current key s
k
2. Thus, our proposal can provide basic forward secrecy.Proposition 9.
The proposed scheme can prevent fraud attack.Proof.
Our proposal provides mutual authentication betweenP
H
i and G
W
i
,
j or P
H
i and S
N
i
,
j
,
d. The proposed scheme can prevent fraud attack by considering the following scenarios. (
1
) An adversary cannot impersonate S
N
i
,
j
,
d to cheat P
H
i. P
H
i can authenticate S
N
i
,
j
,
d by verifying V
1
′ in Step 3. Since the adversary cannot obtain s
3
s
r
i or s
3
s
r
i
r
1
A
D
S
N
i
,
j
,
d, he/she cannot compute K
1
′
=
e
^
(
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
)
·
e
^
(
R
1
,
A
D
P
H
i
)
s
3
s
r
i, K
1
∗
=
e
^
(
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
)
s
1
s
r
i
·
e
^
(
R
1
,
A
D
P
H
i
)
s
3
s
r
i, or K
1
=
e
^
(
A
D
S
N
i
,
j
,
d
,
s
1
s
r
i
A
D
P
H
i
)
·
e
^
(
s
3
s
r
i
A
D
S
N
i
,
j
,
d
,
A
D
P
H
i
)
r
1. Thus, the adversary cannot get s
k
1
′
=
H
2
(
K
1
′
∥
R
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
) and V
1
′
=
H
3
(
s
k
1
′
∥
R
1
∥
M
1
∥
A
D
S
N
i
,
j
,
d
∥
A
D
P
H
i
∥
T
1
), sequentially. Thus, the adversary cannot generate the valid verifier to P
H
i. (
2
) An adversary cannot impersonate P
H
i to cheat G
W
i
,
j. Similar to the above, G
W
i
,
j can authenticate P
H
i by verifying V
2
′ in Step 3. Since the adversary cannot obtain s
2
s
r
i or s
2
s
r
i
A
D
G
W
i
,
j, he/she cannot compute K
2
′, K
2
∗, or K
2. Thus, the adversary cannot get s
k
2
′ and V
2
′, sequentially. Thus, the adversary cannot generate the valid verifier to G
W
i
,
j.Proposition 10.
The proposed scheme can provide entity anonymity and untraceability.Proof.
In the proposed scheme, the adversary can obtain the amplified identitiesH
1
(
I
D
S
V
∥
s
r
i
), H
1
(
I
D
P
H
i
∥
s
r
i
), H
1
(
I
D
G
W
i
,
j
∥
a
i
,
j
), and H
1
(
I
D
S
N
i
,
j
,
d
∥
a
i
,
j
) instead of H
(
I
D
S
V
), H
(
I
D
P
H
i
), H
(
I
D
G
W
i
,
j
), and H
(
I
D
S
N
i
,
j
,
d
) in Steps K1 and K3. Here, s
r
i and a
i
,
j are big random numbers in Z
q
∗. Therefore, the adversary cannot verify whether the guessed identity is correct or incorrect by testing all possible identities without the secret s
r
i and a
i
,
j. For example, to guess H
1
(
I
D
P
H
i
∥
s
r
i
), the adversary should input the guess values of I
D
P
H
i and s
r
i at the same time. Suppose the identity I
D
P
H
i is composed of m bits; it is infeasible for adversary to launch an exhausted search for 2
m
+
q possible solutions. Here, q is the group order of Z
q
∗, and it is a big random number. In particular, if the physicians reregister on a period, s
r
i would be fresh regularly. Thus, this risk of corruption will be lower to I
D
P
H
i. Moreover, a
i
,
j is also a big random number in Z
q
∗, and each patient has a different value. Even if it is the same patient, there are different values on the various diagnoses. Based on the similar reason, the adversary cannot know the identities of I
D
G
W
i
,
j and I
D
S
N
i
,
j
,
d or trace them. Furthermore, it is also intractable to derive the identity from H
1
(
I
D
S
V
∥
s
r
i
), H
1
(
I
D
P
H
i
∥
s
r
i
), H
1
(
I
D
G
W
i
,
j
∥
a
i
,
j
), and H
1
(
I
D
S
N
i
,
j
,
d
∥
a
i
,
j
) because H
1 is a secure one-way cryptography hash function. Thus, our proposal can achieve anonymity and untraceability.Proposition 11.
The proposed scheme can withstand the collusion attack.Proof.
In our proposal,S
V distributes different secret values (
s
1
s
r
i
A
D
P
H
i
,
s
2
s
r
i
,
s
3
s
r
i
) for various physicians P
H
i. Thus, the adversary physician P
H
A and his/her patients P
A
A
,
j cannot get the victim’s information s
2
s
r
i
,
s
3
s
r
i, directly. Furthermore, the adversary A who has registered as a normal patient of the physician P
H
i can legally obtain (
s
1
s
r
i
A
D
P
H
i
,
s
2
s
r
i
A
D
G
W
i
,
j
) from S
V. However, he/she cannot obtain s
1
s
r
i or s
2
s
r
i from (
s
1
s
r
i
A
D
P
H
i
,
s
2
s
r
i
A
D
G
W
i
,
j
) except when he/she can solve the ECDL problem. Similarly, the adversary A cannot obtain s
3
s
r
i from s
3
s
r
i
A
D
S
N
i
,
j
,
d because of the difficulty of the ECDL problem. Obviously, our scheme destructs the attack conditions at Steps A1 and A2 in Section 4. As a result, the scheme can resist the collusion attack and prevent the adversary from generating the session keys s
k
1 and s
k
2. Furthermore, if an insider adversary wants to attack the key agreement from SN to PH, he/she should get the secure information about s
3
s
r
i
A
D
S
N
i
,
j
,
d. The adversary receives up to s
3
s
r
i
A
D
S
N
i
,
j
,
d
∗; he/she cannot get the information except whens he/she can solve the ECDL problem. Similarly, an insider adversary cannot launch an attack to the key agreement from PH to GW phase, because he/she cannot get the value s
2
s
r
i
A
D
G
W
i
,
j. Thus, our proposal resists the collusion attack, effectively.


## 7. Functionality and Performance Comparison

In this section, security and functionality are compared between our scheme and FNKAP. Then, we illustrate a comparison of the communication and computation costing performances.


### 7.1. Functionality Comparison

As shown in Table1, our scheme not only provides the functionality in [8] but also resists the collusion attack. Therefore, we can conclude that the proposed scheme achieves a higher security level than FNKAP.Table 1
Security and functionality comparison with Kim’s scheme.
Replay and fraud attack
Basic forward secrecy
Anonymity and untraceability
Collusion attack
Kim’s
Resistance
Yes
Yes
No
Ours
Resistance
Yes
Yes
Resistance


### 7.2. Performance Comparison

To compare the actual computational costs, we have implemented our scheme and Kim’s scheme with JPBC Library (Java Pairing-Based Cryptography Library [19]) in an ARM platform and a desktop platform. The detailed parameters of the platform are listed in Table 2. To provide a similar environment in WHMS, the weak processing ability is simulated on an android smartphone (HTC M7) running Android 4.1 with Snapdragon APQ8064 1.7 GHz, and the powerful processing ability is simulated on a desktop computer running Windows 7 with Intel Core i5-3470.Table 2
Detailed platform parameters.
Testbed
CPU
RAM
Operating system
ARM
Snapdragon APQ8064 1.7 GHz
2 GB
Android 4.1
Desktop
Intel Core i53.2
×
4 GHz
4 GB
Windows 7–32 bits and Open JDK 1.8.0Table3 summarizes the detailed parameters about the elliptic curve and pairing parameters for JPBC. We use a 512 bits elliptic curve y
3
=
x
3
+
x to evaluate our scheme in the platforms. In Table 4, top row is the results in the ARM platform, and the second row is the result in the desktop platform. Here, all the experiment results are averaged over 10 independent runs.Table 3
Detailed elliptic curve and pairing parameters.
Elliptic curve
Group order ofZ
q
∗
Element size inG
1
Type A:y
3
=
x
3
+
x
Around 160 bits
Around 512 bitsTable 4
Detailed performance parameters.
T
p
T
h
T
m
q
T
a
q
ARM
442 ms
≪1 ms
<1 ms
<1 ms
Desktop
25 ms
≪1 ms
≪1 ms
=1 ms
T
e
T
m
2
T
m
1
T
a
1
ARM
450 ms
1 ms
124 ms
<1 ms
Desktop
4 ms
≪1 ms
22 ms
<1 msIn order to provide detailed comparison, we test the basic operation inZ
q
∗, G
1, and G
2, separately. The time of a pairing computation is indicated by T
p. The time of a hash operation is indicated by T
h. The time complexity of computing multiplication in Z
q
∗, G
1, and G
2 is indicated by T
m
q, T
m
1, and T
m
2, respectively. The time of the addition in Z
q
∗ and G
1 is indicated by T
a
q and T
a
1, independently. The time of the exponentiation in G
2 is indicated by T
e. Note that the time of hash operation T
h is the smallest because it needs very limited computation. On the contrary, the time of pairing operation T
p is the highest consumption.Tables5 and 6 illustrate the performance comparison with Kim’s scheme. In Tables 5 and 6, the notation i
d is a unit length of identity; the notation p
r is a unit length of private key. First, in order to achieve the session key freshness, we maintain one-round communication to exchange a random value R
1 or R
2 in FNKAP. Second, our scheme increases the amplified identity randomness against the passive offline attack. However, the amplified identity space is equal to that of FNKAP because the amplified identity is still a hash value. Third, the private key space of G
W and S
N decreases because we reduce the redundancy of private key information to G
W and S
N. Moreover, it shrinks the risk of insider attack because only S
V knows total secure information. Fourth, the computation time of our scheme is near half of FNKAP because we decrease half of the pairing operations. Finally, we should point out that our scheme computation and store cost for the S
V are higher than those of Kim’s work. More precisely, we should choose and store N random numbers more than FNKAP, and 4
N multiplications in Z
p
∗ should be added in Initial Section. Commonly, the above propositions only increase the computation cost and the storage requirement in S
V. S
V has enough computing and storing power to hold the operations because the u-Health Server is usually a server cluster. Furthermore, the computing operations are only increased in Initial Phase. For the resources limited entities G
W and S
N, the computation and storage requirements do not increase instead of decreasing. Thus, the scheme is feasible to key agreement in WHMS.Table 5
Basic performance comparison with Kim’s scheme [8].
Round
Private key space
SV
PH
GW
SN
Kim’s
One
4pr
4pr
4pr
4pr
Ours
One
(3
+
N)pr
3pr
2pr
2prTable 6
Computation performance comparison with Kim’s scheme [8].
ID space
Computation
PH
SN/GW
Sum
Kim’s SN to PH
4id
T
h
+
2
T
a
1
+
4
T
p
+
3
T
m
2
≈
102 ms
T
h
+
2
T
a
1
+
4
T
p
+
3
T
m
2
≈
1773 ms
1875 ms
Our SN to PH
4id
2
T
h
+
T
a
1
+
2
T
p
+
T
m
2
≈
51 ms
2
T
h
+
2
T
a
1
+
2
T
p
+
T
m
2
≈
887 ms
938 ms
Kim’s PH to GW
4id
T
h
+
3
T
a
1
+
4
T
p
+
3
T
m
2
≈
103 ms
T
h
+
T
a
1
+
4
T
p
+
3
T
m
2
≈
1772 ms
1875 ms
Our PH to GW
4id
2
T
h
+
2
T
a
1
+
2
T
p
+
T
m
2
≈
52 ms
2
T
h
+
2
T
p
+
T
m
2
≈
885 ms
937 msOur proposed scheme inherits the advantage of Kim’s hierarchical scheme in WHMS. At the same time, our scheme provides security enhancement against collusion attack in our security model. Furthermore, it preserves the low computation and private key space inS
N and G
W compared to FNKAP. Therefore, it is an enhanced security hierarchical key agreement scheme with the noninteractive property that is suitable for the application in WHMS.


## 7.1. Functionality Comparison

As shown in Table1, our scheme not only provides the functionality in [8] but also resists the collusion attack. Therefore, we can conclude that the proposed scheme achieves a higher security level than FNKAP.Table 1
Security and functionality comparison with Kim’s scheme.
Replay and fraud attack
Basic forward secrecy
Anonymity and untraceability
Collusion attack
Kim’s
Resistance
Yes
Yes
No
Ours
Resistance
Yes
Yes
Resistance


## 7.2. Performance Comparison

To compare the actual computational costs, we have implemented our scheme and Kim’s scheme with JPBC Library (Java Pairing-Based Cryptography Library [19]) in an ARM platform and a desktop platform. The detailed parameters of the platform are listed in Table 2. To provide a similar environment in WHMS, the weak processing ability is simulated on an android smartphone (HTC M7) running Android 4.1 with Snapdragon APQ8064 1.7 GHz, and the powerful processing ability is simulated on a desktop computer running Windows 7 with Intel Core i5-3470.Table 2
Detailed platform parameters.
Testbed
CPU
RAM
Operating system
ARM
Snapdragon APQ8064 1.7 GHz
2 GB
Android 4.1
Desktop
Intel Core i53.2
×
4 GHz
4 GB
Windows 7–32 bits and Open JDK 1.8.0Table3 summarizes the detailed parameters about the elliptic curve and pairing parameters for JPBC. We use a 512 bits elliptic curve y
3
=
x
3
+
x to evaluate our scheme in the platforms. In Table 4, top row is the results in the ARM platform, and the second row is the result in the desktop platform. Here, all the experiment results are averaged over 10 independent runs.Table 3
Detailed elliptic curve and pairing parameters.
Elliptic curve
Group order ofZ
q
∗
Element size inG
1
Type A:y
3
=
x
3
+
x
Around 160 bits
Around 512 bitsTable 4
Detailed performance parameters.
T
p
T
h
T
m
q
T
a
q
ARM
442 ms
≪1 ms
<1 ms
<1 ms
Desktop
25 ms
≪1 ms
≪1 ms
=1 ms
T
e
T
m
2
T
m
1
T
a
1
ARM
450 ms
1 ms
124 ms
<1 ms
Desktop
4 ms
≪1 ms
22 ms
<1 msIn order to provide detailed comparison, we test the basic operation inZ
q
∗, G
1, and G
2, separately. The time of a pairing computation is indicated by T
p. The time of a hash operation is indicated by T
h. The time complexity of computing multiplication in Z
q
∗, G
1, and G
2 is indicated by T
m
q, T
m
1, and T
m
2, respectively. The time of the addition in Z
q
∗ and G
1 is indicated by T
a
q and T
a
1, independently. The time of the exponentiation in G
2 is indicated by T
e. Note that the time of hash operation T
h is the smallest because it needs very limited computation. On the contrary, the time of pairing operation T
p is the highest consumption.Tables5 and 6 illustrate the performance comparison with Kim’s scheme. In Tables 5 and 6, the notation i
d is a unit length of identity; the notation p
r is a unit length of private key. First, in order to achieve the session key freshness, we maintain one-round communication to exchange a random value R
1 or R
2 in FNKAP. Second, our scheme increases the amplified identity randomness against the passive offline attack. However, the amplified identity space is equal to that of FNKAP because the amplified identity is still a hash value. Third, the private key space of G
W and S
N decreases because we reduce the redundancy of private key information to G
W and S
N. Moreover, it shrinks the risk of insider attack because only S
V knows total secure information. Fourth, the computation time of our scheme is near half of FNKAP because we decrease half of the pairing operations. Finally, we should point out that our scheme computation and store cost for the S
V are higher than those of Kim’s work. More precisely, we should choose and store N random numbers more than FNKAP, and 4
N multiplications in Z
p
∗ should be added in Initial Section. Commonly, the above propositions only increase the computation cost and the storage requirement in S
V. S
V has enough computing and storing power to hold the operations because the u-Health Server is usually a server cluster. Furthermore, the computing operations are only increased in Initial Phase. For the resources limited entities G
W and S
N, the computation and storage requirements do not increase instead of decreasing. Thus, the scheme is feasible to key agreement in WHMS.Table 5
Basic performance comparison with Kim’s scheme [8].
Round
Private key space
SV
PH
GW
SN
Kim’s
One
4pr
4pr
4pr
4pr
Ours
One
(3
+
N)pr
3pr
2pr
2prTable 6
Computation performance comparison with Kim’s scheme [8].
ID space
Computation
PH
SN/GW
Sum
Kim’s SN to PH
4id
T
h
+
2
T
a
1
+
4
T
p
+
3
T
m
2
≈
102 ms
T
h
+
2
T
a
1
+
4
T
p
+
3
T
m
2
≈
1773 ms
1875 ms
Our SN to PH
4id
2
T
h
+
T
a
1
+
2
T
p
+
T
m
2
≈
51 ms
2
T
h
+
2
T
a
1
+
2
T
p
+
T
m
2
≈
887 ms
938 ms
Kim’s PH to GW
4id
T
h
+
3
T
a
1
+
4
T
p
+
3
T
m
2
≈
103 ms
T
h
+
T
a
1
+
4
T
p
+
3
T
m
2
≈
1772 ms
1875 ms
Our PH to GW
4id
2
T
h
+
2
T
a
1
+
2
T
p
+
T
m
2
≈
52 ms
2
T
h
+
2
T
p
+
T
m
2
≈
885 ms
937 msOur proposed scheme inherits the advantage of Kim’s hierarchical scheme in WHMS. At the same time, our scheme provides security enhancement against collusion attack in our security model. Furthermore, it preserves the low computation and private key space inS
N and G
W compared to FNKAP. Therefore, it is an enhanced security hierarchical key agreement scheme with the noninteractive property that is suitable for the application in WHMS.


## 8. Conclusions

In this paper, we have illustrated that there is a security weakness in Kim’s work [8] under a practical security model with the physicians corruption. The security flaw is due to the fact that the physicians’ parts of the private key are the same. Therefore, the adversary, as a legal physician, can acquire the entire patient’s private information. To enhance the scheme, we proposed an authenticated key agreement scheme which randomizes each physician’s private key. Moreover, we have reduced the numbers of the private keys and the operations of the bilinear pairing. Thus, the performance of our scheme is more suitable for the WHMS environment than Kim’s work. We also prove the security of our scheme. The proof shows that the proposed scheme is secure under the DBDH assumption in the random oracle model.



---

*Source: 1905872-2016-06-02.xml*