# An Efficient and Provable Multifactor Mutual Authentication Protocol for Multigateway Wireless Sensor Networks

Authors: Shuailiang Zhang; Xiujuan Du; Xin Liu
Journal: Security and Communication Networks
 (2021)

---

## Abstract

As the most popular way of communication technology at the moment, wireless sensor networks have been widely concerned by academia and industry and plays an important role in military, agriculture, medicine, and other fields. Identity authentication offers the first line of defence to ensure the security communication of wireless sensor networks. Since the sensor nodes are resource-limited in the wireless networks, how to design an efficient and secure protocol is extremely significant. The current authentication protocols have the problem that the sensor nodes need to execute heavy calculation and communication consumption during the authentication process and cannot resist node capture attack, and the protocols also cannot provide perfect forward and backward security and cannot resist replay attack. Multifactor identity authentication protocols can provide a higher rank of security than single-factor and two-factor identity authentication protocols. The multigateway wireless sensor networks’ structure can provide a larger communication coverage area than the single-gateway network structure, so it has become the focus of recent studies. Therefore, we design a novel multifactor authentication protocol for multigateway wireless sensor networks, which only apply the lightweight hash function and are given biometric information to achieve a higher level of security and efficiency and a larger communication coverage area. We separately apply BAN logic, random oracle model, and AVISPA tool to validate the security of our authentication protocol in Case 1 and Case 2. We put forward sixteen evaluation criteria to comprehensively evaluate our authentication protocol. Compared with the related authentication protocols, our authentication protocol is able to achieve higher security and efficiency.


---

## Body

## 1. Introduction

As the prevalent way of communication and the significant section of the Internet of Things, wireless sensor networks are composed of massive sensor nodes, which have collection and computing abilities, and communicate with the corresponding communication parties via wireless technology [1]. Wireless sensor networks’ communications are widely applied in military, industrial, agricultural monitoring, wearable health monitoring systems, smart home environment, intelligent transportation systems, and other fields. These sensor nodes are small and resource-constrained, and they are often randomly deployed in unattended or hostile region under the regulation of one or more gateway nodes to gather and transmit the information on public network channel [2]. Due to the characteristics of the communication channel in wireless sensor network, the communication information is prone to various types of attacks. Mutual authentication plays a significant role in guaranteeing the security among the existing security mechanisms [3] and is considered as the basic access control that the user must first pass through the verification of the sensor node before accessing the gathered information [4].The current identity authentication technology can be divided into three types: password based single-factor authentication technology, password and smart card based two-factor authentication technology, and password, smart card, and biometric based three-factor authentication technology [5]. The aforementioned third type is the most commonly used authentication technology, and it enhances the security of the wireless network works to a higher level [6, 7]. At present, most of the researches are keen on the identity authentication technology of single gateway, while only a few people are engaged in identity authentication technology of multigateway structure [8]. We can apply multiple gateway nodes to extend the communication coverage area and increase scalability [9]. However, the current multigateway authentication technology has some disadvantages such as high computational complexity and heavy storage consumption and is vulnerable to various attacks. Therefore, for the sake of eliminating the security flaws and increasing the computation efficiency, we design a novel lightweight mutual authentication protocol for the multiple gateway nodes networks.


### 1.1. Network Model

As shown in Figure1, it involves three communication entities, that is, sensor nodes, home/foreign gateway node, and user in case 1. The sensor node and user should complete registration at the gateway node. After registration, the user delivers the login request to the gateway node. The gateway authenticates are in charge of transmitting authentication information between the user and the sensor node. After completing authentication process, the registered user has ability to obtain information gathered by the sensors under the negotiated session key.Figure 1
Network architecture in case 1.As shown in Figure2, it involves four communication entities, that is, sensor nodes, home gateway node, foreign gateway node, and user in case 2. In addition to completing the authentication of case 1, it is also necessary to achieve the authentication between the home gateway node and the foreign gateway node.Figure 2
Network architecture in case 2.


### 1.2. Related Works

Gope and Hwang [10] proposed an efficient and secure authentication scheme and claimed that their scheme is able to preserve the user anonymity for roaming services in global mobility networks by way of using the one-way hash function operation. Xu et al. [11] discovered that the scheme of Gope and Hwang is vulnerable to reply attacks and has a heavy storage cost. Similarly, Lu et al. [3] also pointed out that scheme of Gope and Hwang is susceptible to specific known information attack, and the password alteration section is inaccurate. Fan et al. [12] found that the scheme of Gope and Hwang is vulnerable to offline guessing attack and the desynchronization attack and does not retain robust forward security. Then, they proposed a novel efficient mutual and key agreement scheme with desynchronization for anonymous roaming service in global mobility networks. However, Mohit and Narendra [13] reviewed the scheme of Wu and showed that the scheme has the problem of the traceability of the mobile user and inefficient wrong password detection.In order to preserve security and privacy and reduce communication and computation costs, Das et al. [14] proposed a biometric-based authentication protocol for the Industrial Internet of Things. Unfortunately, Hussain and Chaudhry [15] discovered that the protocol of Das et al. is unable to prevent the assailant from obtaining the public parameters kept in the smart device and fails to resist session key attack and achieve perfect forward secrecy. So, against offline password guessing attack and user impersonation attack, Amin et al. [16] demonstrated a secure three-factor mutual authentication protocol, and this protocol lengthens the lifetime of network by means of decreasing the cost of sensor nodes. Later, Sharif et al. [17] claimed that the protocol of Amin et al. cannot boycott strong reply attacks and cannot realize the prefect forward secrecy. However, Wu et al. [18] pointed out that both of the two protocols [14, 17] suffer from under offline surmising attack.To overcome user and sensor node impersonation attacks, He et al. [19] introduced a novel mutual authentication design based on the temporal credential for wireless sensor networks. Afterwards, Kumari et al. [20] demonstrated that there are seven security problems in the design of He et al. Jiang et al. [21] revealed that the design of He et al. is prone to malicious user impersonation attack, stolen smart card attack, and tracking attack in the authentication process and proposed an untraceable and secure two-factor authentication design based on elliptic curve cryptography for wireless sensor networks. After analyzing the design of Jiang et al., Xiong et al. [22] received the result that the design has no detection mechanism for unauthorized login and clock synchronization problem and introduced a three-factor anonymous authentication design for wireless sensor networks by applying the fuzzy commitment to deal with biometric information.For the purpose of withstanding the node capture attack, impersonation attack, and man-in-the-middle attack, Das [23] then put forward an original biometric-based mutual authentication design for wireless sensor networks. In the same year, Lu et al. [24] found that the design of Das does not really implement the three-factor security and user anonymity and has no ability to boycott user impersonation attack. Li et al. [25] pointed out that the design of Ruhul et al. [26] is vulnerable to DoS attack and lacks forward secrecy. In view of previous studies, Li introduced a three-factor mutual authentication design with forward secrecy for wireless medical sensor networks, which settles the contradiction of local password verification and mobile device lost attack via fuzzy verifier and honey_list technology. Nevertheless, Mo and Chen [27] discovered that the protocol of Xiong et al. [22] is vulnerable to resist stolen smart card attack and divulge the biometric information. Mo and Chen [27] pointed out that the protocol of Lu et al. [24] is prone to known session-specific temporary information attack and cannot realize three-factor security and backward secrecy. Mo and Chen [27] found that the protocol of Li et al. [25] is susceptible to withstanding replay attack.Mutual authentication is used to supply the fundamental security requirement by confirming the legality of the communication parities for various network applications, such as smart city [28, 29], Internet of Drones [30, 31], vehicular networks [32, 33], multiserver environment [34, 35], and mobile devise [36, 37].


### 1.3. Organization

The remainder of the paper is organized as follows. In part 2, we discuss the preliminaries. In part 3, we present our proposed mutual authentication protocol. In part 4, we show formal analysis of our proposed mutual authentication protocol through three methods, that is, BAN logic, random oracle model, and AVISPA. In part 5, we demonstrate informal analysis of our proposed mutual authentication protocol through sixteen security authentication protocol evaluation criteria. In part 6, we compare our proposed mutual authentication protocol with other related authentication protocols in terms of security, computation time, and communication cost. Finally, we come to a conclusion in part 7.


## 1.1. Network Model

As shown in Figure1, it involves three communication entities, that is, sensor nodes, home/foreign gateway node, and user in case 1. The sensor node and user should complete registration at the gateway node. After registration, the user delivers the login request to the gateway node. The gateway authenticates are in charge of transmitting authentication information between the user and the sensor node. After completing authentication process, the registered user has ability to obtain information gathered by the sensors under the negotiated session key.Figure 1
Network architecture in case 1.As shown in Figure2, it involves four communication entities, that is, sensor nodes, home gateway node, foreign gateway node, and user in case 2. In addition to completing the authentication of case 1, it is also necessary to achieve the authentication between the home gateway node and the foreign gateway node.Figure 2
Network architecture in case 2.


## 1.2. Related Works

Gope and Hwang [10] proposed an efficient and secure authentication scheme and claimed that their scheme is able to preserve the user anonymity for roaming services in global mobility networks by way of using the one-way hash function operation. Xu et al. [11] discovered that the scheme of Gope and Hwang is vulnerable to reply attacks and has a heavy storage cost. Similarly, Lu et al. [3] also pointed out that scheme of Gope and Hwang is susceptible to specific known information attack, and the password alteration section is inaccurate. Fan et al. [12] found that the scheme of Gope and Hwang is vulnerable to offline guessing attack and the desynchronization attack and does not retain robust forward security. Then, they proposed a novel efficient mutual and key agreement scheme with desynchronization for anonymous roaming service in global mobility networks. However, Mohit and Narendra [13] reviewed the scheme of Wu and showed that the scheme has the problem of the traceability of the mobile user and inefficient wrong password detection.In order to preserve security and privacy and reduce communication and computation costs, Das et al. [14] proposed a biometric-based authentication protocol for the Industrial Internet of Things. Unfortunately, Hussain and Chaudhry [15] discovered that the protocol of Das et al. is unable to prevent the assailant from obtaining the public parameters kept in the smart device and fails to resist session key attack and achieve perfect forward secrecy. So, against offline password guessing attack and user impersonation attack, Amin et al. [16] demonstrated a secure three-factor mutual authentication protocol, and this protocol lengthens the lifetime of network by means of decreasing the cost of sensor nodes. Later, Sharif et al. [17] claimed that the protocol of Amin et al. cannot boycott strong reply attacks and cannot realize the prefect forward secrecy. However, Wu et al. [18] pointed out that both of the two protocols [14, 17] suffer from under offline surmising attack.To overcome user and sensor node impersonation attacks, He et al. [19] introduced a novel mutual authentication design based on the temporal credential for wireless sensor networks. Afterwards, Kumari et al. [20] demonstrated that there are seven security problems in the design of He et al. Jiang et al. [21] revealed that the design of He et al. is prone to malicious user impersonation attack, stolen smart card attack, and tracking attack in the authentication process and proposed an untraceable and secure two-factor authentication design based on elliptic curve cryptography for wireless sensor networks. After analyzing the design of Jiang et al., Xiong et al. [22] received the result that the design has no detection mechanism for unauthorized login and clock synchronization problem and introduced a three-factor anonymous authentication design for wireless sensor networks by applying the fuzzy commitment to deal with biometric information.For the purpose of withstanding the node capture attack, impersonation attack, and man-in-the-middle attack, Das [23] then put forward an original biometric-based mutual authentication design for wireless sensor networks. In the same year, Lu et al. [24] found that the design of Das does not really implement the three-factor security and user anonymity and has no ability to boycott user impersonation attack. Li et al. [25] pointed out that the design of Ruhul et al. [26] is vulnerable to DoS attack and lacks forward secrecy. In view of previous studies, Li introduced a three-factor mutual authentication design with forward secrecy for wireless medical sensor networks, which settles the contradiction of local password verification and mobile device lost attack via fuzzy verifier and honey_list technology. Nevertheless, Mo and Chen [27] discovered that the protocol of Xiong et al. [22] is vulnerable to resist stolen smart card attack and divulge the biometric information. Mo and Chen [27] pointed out that the protocol of Lu et al. [24] is prone to known session-specific temporary information attack and cannot realize three-factor security and backward secrecy. Mo and Chen [27] found that the protocol of Li et al. [25] is susceptible to withstanding replay attack.Mutual authentication is used to supply the fundamental security requirement by confirming the legality of the communication parities for various network applications, such as smart city [28, 29], Internet of Drones [30, 31], vehicular networks [32, 33], multiserver environment [34, 35], and mobile devise [36, 37].


## 1.3. Organization

The remainder of the paper is organized as follows. In part 2, we discuss the preliminaries. In part 3, we present our proposed mutual authentication protocol. In part 4, we show formal analysis of our proposed mutual authentication protocol through three methods, that is, BAN logic, random oracle model, and AVISPA. In part 5, we demonstrate informal analysis of our proposed mutual authentication protocol through sixteen security authentication protocol evaluation criteria. In part 6, we compare our proposed mutual authentication protocol with other related authentication protocols in terms of security, computation time, and communication cost. Finally, we come to a conclusion in part 7.


## 2. Preliminaries

This part presents the preliminaries in our designed mutual authentication protocol involving biometric fuzzy extractor, threat model, and protocol evaluation criteria.


### 2.1. Biometric Fuzzy Extractor

So as to prevent the given biometric informationBIOi from various noises in the process of information acquisition, this paper introduces the biometric fuzzy extractor. There are two functions in biometric fuzzy extractor [28, 36]:GEN function and REP function. The concrete representations of the two functions are as follows:(1)
GENBIOi=σi,τi. GEN is a probabilistic generation function that separates out the secret string σi and an auxiliary string τi from the given biometric information BIOi(2)
REPBIOi,τi=σi. REP is a deterministic function that recovers the secret string σi from the given biometric information BIOi with the assistance of the auxiliary string τi


### 2.2. Threat Model

The threat model presents the possibilities of an assailant obtaining the information about the authentication protocol without authorizing and the competence of potential destruction. Before evaluating the security authentication protocol, we assume that the assailant has the following abilities in the authentication process:(1)
The assailant is able to revise, intercept, delete, and transmit the communication information on the public network channel [38, 39](2)
The assailant is able to obtain the parameters kept in the smart card via power analysis attack [40], in case the smart card is stolen or lost(3)
The assailant is able to carry out the online and offline password guessing attack [35](4)
The assailant is able to implement the impersonation attack [4](5)
The assailant is aware of the authentication protocol system [41](6)
The assailant may be a legitimate user or an external entity [42, 43]


### 2.3. Protocol Evaluation Criteria

Since the information is interacted on the public network channel, the assailant is able to intercept and manipulate the interactive information [41, 44]. To guarantee the security of the interactive information on the public network channel, we design a mutual authentication and session key agreement protocol among the communication parties for the multiple gateway nodes networks. From four aspects of users, gateway nodes, sensor nodes, and communication protocol itself, we define the following sixteen security authentication protocol evaluation criteria:(1)
Session key security(2)
Three-factor security(3)
Perfect forward and backward security(4)
Resist sensor node capture attack(5)
Resist stolen smart card attack(6)
Resist user impersonation attack(7)
Resist gateway impersonation attack(8)
Resist sensor node impersonation attack(9)
Resist reply attack(10)
Resist privileged insider attack(11)
Resist online password-guessing attack(12)
Resist offline password-guessing attack(13)
Resist user tracking attack(14)
Biometric template protection(15)
Mutual authentication(16)
User anonymity


## 2.1. Biometric Fuzzy Extractor

So as to prevent the given biometric informationBIOi from various noises in the process of information acquisition, this paper introduces the biometric fuzzy extractor. There are two functions in biometric fuzzy extractor [28, 36]:GEN function and REP function. The concrete representations of the two functions are as follows:(1)
GENBIOi=σi,τi. GEN is a probabilistic generation function that separates out the secret string σi and an auxiliary string τi from the given biometric information BIOi(2)
REPBIOi,τi=σi. REP is a deterministic function that recovers the secret string σi from the given biometric information BIOi with the assistance of the auxiliary string τi


## 2.2. Threat Model

The threat model presents the possibilities of an assailant obtaining the information about the authentication protocol without authorizing and the competence of potential destruction. Before evaluating the security authentication protocol, we assume that the assailant has the following abilities in the authentication process:(1)
The assailant is able to revise, intercept, delete, and transmit the communication information on the public network channel [38, 39](2)
The assailant is able to obtain the parameters kept in the smart card via power analysis attack [40], in case the smart card is stolen or lost(3)
The assailant is able to carry out the online and offline password guessing attack [35](4)
The assailant is able to implement the impersonation attack [4](5)
The assailant is aware of the authentication protocol system [41](6)
The assailant may be a legitimate user or an external entity [42, 43]


## 2.3. Protocol Evaluation Criteria

Since the information is interacted on the public network channel, the assailant is able to intercept and manipulate the interactive information [41, 44]. To guarantee the security of the interactive information on the public network channel, we design a mutual authentication and session key agreement protocol among the communication parties for the multiple gateway nodes networks. From four aspects of users, gateway nodes, sensor nodes, and communication protocol itself, we define the following sixteen security authentication protocol evaluation criteria:(1)
Session key security(2)
Three-factor security(3)
Perfect forward and backward security(4)
Resist sensor node capture attack(5)
Resist stolen smart card attack(6)
Resist user impersonation attack(7)
Resist gateway impersonation attack(8)
Resist sensor node impersonation attack(9)
Resist reply attack(10)
Resist privileged insider attack(11)
Resist online password-guessing attack(12)
Resist offline password-guessing attack(13)
Resist user tracking attack(14)
Biometric template protection(15)
Mutual authentication(16)
User anonymity


## 3. The Proposed Protocol

In this part, we will demonstrate our three-factor remote user authentication and key agreement protocol in the wireless sensor network environment with multiple gateways. Our protocol is related to five sections, which are initialization section, registration section, login section, authentication and key agreement section, and password change section.


### 3.1. Initialization Section

SA picks the distinctive identity IDSNj and private key SXSNj, for the SN, calculates the value SNXj=hIDSNj‖SXSNj and dispatches the information IDSNj,SNXj to the SN. SA chooses the distinctive identity IDGWNh and private key SXGWNh for the HGWN. SA selects the distinctive identity IDGWNf and private key SXGWNf for the FGWN in the same way. Each pair of HGWN and FGWN keeps a private session key Khf.


### 3.2. Registration Section

The registration section is divided into two parts, namely, sensor node registration and user registration.


#### 3.2.1. Sensor Node Registration

A1: in the light of the received informationIDSNj,SNXj in the initialization section, SNj calculates MSNj=SNXj⊕hIDSNj and dispatches the information IDSNj,MSNj to GWNH. A2: after obtaining the information sent by the SN, HGWN computes SNXj=MSNj⊕hIDSNj, preserves the information IDSNj,MSNj, and replies to the sensor node with a confirmation message.


#### 3.2.2. User Registration

A1:Ui picks the essential parameters, identity IDi, password PWi, and two stochastic digits ri and rp and counts UIDi=hIDi‖ri and UPWi=hPWi‖ri‖rp. After the calculation, Ui delivers UIDi and UPWi to HGWN as the registration request.A2: after getting the registration request,HGWN generates a stochastic digit rGWNh and computes GUIDi=hrGWNhSXGWNhIDGWNh⊕UIDi, GEi=hUIDi‖UPWi, and GFi=GEi⊕GUIDi⊕UIDi in combination with its own privacy parameters. HGWN loads GEi and GFi into the smart card and transmits the smart card to Ui.A3: after reception of the smart card,Ui imprints his or her unique biometric BIOUi on the sensor device specific terminal and further counts GENBIOUi=σUi,τUi, USC1=ri⊕hIDi‖PWi‖σUi,USC2=rp⊕hσUi‖ri, and USC3=hUIDi‖UPWi‖σUi‖ri‖rp. Then, Ui loads USC1,USC2,USC3 into the smart card.


### 3.3. Login Section

A1:Ui inserts smart card and inputs his or her identity IDi, password PWi, and biometric BIOUi. A2: smart card counts REPBIOUi,τUi=σUi, ri∗=USC1⊕hIDi‖PWi‖σUi, rp∗=USC2⊕hσUi‖ri, UIDi∗=hIDi‖ri∗, UPWi∗=hPWi‖ri∗‖rp∗, and USC3∗=hUIDi∗‖UPWi∗‖σUi‖ri∗‖rp∗ and confirms the correctness of the formula USC3∗=USC3. A3: if it is not right, smart card suspends the session promptly. Otherwise, smart card picks stochastic identity SCNi, stochastic digit rSCn, and time stamp Tsc and counts SCG1=GUIDi⊕SCNi, SCG2=rSCn⊕hSCNi‖Tsc, SCG3=GFi⊕hUIDi‖UPWi, and SCG4=hSCNi‖rSCn‖Tsc‖GUIDi‖SCG3‖IDSNj. Finally, Ui delivers the login request SCG1,SCG2,SCG4,Tsc,UIDi,IDSNj to GWNH.


### 3.4. Authentication and Key Agreement Section

On the basis ofUIDi in the login request, GWNH computes GUIDi=hrGWNh‖SXGWNh‖IDGWNh⊕UIDi, SCNi∗=GUIDi⊕SCG1, rSCn∗=SCG2⊕hSCNi∗‖Tsc, SCG3∗=GUIDi⊕UIDi, and SCG4∗=hSCNi∗‖rSCn∗‖Tsc‖GUIDi‖SCG3∗‖IDSNj and confirms the correctness of the formula SCG4∗=SCG4. If it is not right, GWNH terminates the session promptly. Otherwise, GWNH finds whether IDSNj is in the information about the sensor node it preserves. If it is in the information, execute case 1 as shown in Figure 3; if it is not, execute case 2 as shown in Figure 4.Case 1:A1:GWNH generates time stamp Tgwnh and computes the freshness of the login request by the formula Tgwnh−Tsc≤ΔT. If it is not right, GWNH terminates the session promptly. Otherwise, GWNH computes HSN1=SNXj⊕UIDi, HSN2=IDSNj⊕hrSCn‖SCNi, HSN3=HSN1⊕UID⊕irGWNh, and HSN4=hUIDi‖SNXj‖hrSCn‖SCNirGWNhTgwnh and transmits the information HSN1,HSN2,HSN3,HSN4,Tgwnh to SNj.A2: upon receiving the informationHSN1,HSN2,HSN3,HSN4,Tgwnh at time Tsnj, SNj calculates the freshness of the information by the formula Tsnj−Tgwnh≤ΔT. If it is not right, SNj ends the session promptly. Otherwise, SNj calculates UIDi∗=SNXj⊕HSN1, hrSCn‖SCNi∗=IDSNj⊕HSN2, rGWNh∗=HSN1⊕UIDi∗⊕HSN3, and HSN4∗=hUIDi∗‖SNXj‖hrSCn‖SCNi∗‖rGWNh∗‖Tgwnh and confirms the correctness of the formula HSN4∗=HSN4.A3: if it is not right,SNj ends the session promptly. Otherwise, SNj selects stochastic digit rSNj and calculates SKs=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXj, SHN1=rSNj⊕hhrSCn||SCNi‖rGWNh|Tsnj, and SHN2=hrGWNh‖UIDi‖SKs‖SNXj‖Tsnj. Then, SNj dispatches the information SHN1,SHN2,Tsnj to GWNH.A4: upon receiving the informationSHN1,SHN2,Tsnj at time Tgwnh1, GWNH computes the freshness of the information by the formula Tgwnh1−Tsnj≤ΔT. If it is not right, GWNH terminates the session promptly. Otherwise, GWNH computes rSNj∗=SHN1⊕hhrSCn‖SCNi‖rGWNh|Tsnj, SKh=hrSNj∗|rGWNh‖UIDi‖hrSCn‖SCNi‖SNXj, and SHN2∗=hrGWNh‖UIDi‖SKh‖SNXj‖Tsnj and confirms the correctness of the formula SHN2∗=SHN2.A5: if it is not right,GWNH terminates the session promptly. Otherwise, GWNH generates new stochastic digit rGWNhnew and computes GUIDinew=hrGWNhnew‖SXGWNh‖IDGWNh⊕UIDi,GSC1=SNXj⊕GUIDi, GSC2=rSNj⊕hrSCn‖SCNi, GSC3=GUIDinew⊕hUIDi‖UPWi, and GSC4=hrSCn‖GUIDinew‖SNXj‖SKh‖GFi‖Tgwnh1. Then, GWNH transmits the information HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1 to Ui.A6: upon receiving the informationHSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1 at time Tui, Ui computes the freshness of the information by the formula Tui−Tgwnh1≤ΔT. If it is not right, Ui suspends the session promptly. Otherwise, Ui counts SNXj∗=GSC1⊕GUIDi, rSNj∗=GSC2⊕hrSCn‖SCNi,rGWNh∗=SNXj∗⊕HSN3, SKu=hrSNj∗‖rGWNh∗‖UIDi‖hrSCn‖SCNi‖SNXj∗, GUIDinew=GSC3⊕hUIDi‖UPWi, and GSC4∗=hrSCn‖GUIDinew‖SNXj∗‖SKu‖GFi‖Tgwnh1 and confirms the correctness of the formula GSC4∗=GSC4.A7: if it is not right,Ui suspends the session promptly. Otherwise, Ui counts GFinew=GEi⊕GUIDinew⊕UIDi and substitutes GFinew,GUIDinew for GFi,GUIDi in smart card.Case 2:A1: first,GWNH broadcasts the information IDSNj,IDGWNh among all gateway nodes. GWNF finds whether IDSNj is in the information about the sensor node it preserves. If it is in the information, GWNF finds SNXj based on IDSNj. Next, GWNF finds and computes FHN1=hSNXj‖KFH⊕SXGWNf, FHN2=KFH⊕SNXj, FHN3=IDSNj⊕IDGWNf, and FHN4=hKFH‖IDGWNh‖IDGWNf‖SNXj‖IDSNj‖SXGWNf. Then, GWNF transmits the information FHN1,FHN2,FHN3,FHN4 to GWNH.A2: after reception of the informationFHN1,FHN2,FHN3,FHN4, GWNH computes IDGWNf=IDSNj⊕FHN3. GWNH finds the private key KFH between them according to identity IDGWNf of GWNF and computes SNXj∗=KFH⊕FHN2, SXGWNf∗=hSNXj∗‖KFH⊕FHN1, and FHN4∗=hKFH‖IDGWNh‖IDGWNf‖SNXj∗‖IDSNj‖SXGWNf∗. Then, GWNH confirms the correctness of the formula FHN4∗=FHN4.A3: if it is not right,GWNH terminates the session promptly. Otherwise, GWNH computes GSC5=hSNXj‖IDSNj, GSC6=UIDi⊕SNXj, and GSC7=FHN1⊕GSC5 and transmits the information FHN2,GSC6,GSC7 to Ui.A4: after reception of the informationFHN2,GSC6,GSC7, Ui counts SNXj=UIDi⊕GSC6, KFH=FHN2⊕SNXj, FHN1=GSC7⊕hIDSNj‖SNXj, and SXGWNf=hSNXj‖KFH⊕FHN1. Then, Ui picks the stochastic digit rui and time stamp Tui and counts SCF5=hSNXj‖KFH⊕rui, SCF6=UIDi⊕FHN1, and SCF7=hrui‖UIDi‖Tui‖SXGWNf‖KFH‖SNXj. Finally, Ui delivers the information SCF5,SCF6,SCF7,Tui to GWNF.A5: upon receiving the informationSCF5,SCF6,SCF7,Tui at time Tgwnf, GWNF computes the freshness of the information by the formula Tgwnf−Tui≤ΔT. If it is not right, GWNF terminates the session promptly. Otherwise, GWNF computes rui∗=hSNXj‖KFH⊕SCF5, UIDi∗=SCF6⊕FHN1, and SCF7∗=hrui∗‖UIDi∗‖Tui‖SXGWNf‖KFH‖SNXj and confirms the correctness of the formula SCF7∗=SCF7.A6: if it is not right,GWNF terminates the session promptly. Otherwise, GWNF generates stochastic digit rGWNf and computes FSN1=SNXj⊕UIDi, FSN2=IDSNj⊕hUIDi‖rui, FSN3=rGWNf⊕UIDi⊕hrui‖UIDi, and FSN4=hUIDi‖SNXj‖hrui‖UIDi‖rGWNf‖Tgwnf. Then, GWNF transmits the information FSN1,FSN2,FSN3,FSN4,Tgwnf to SNj.A7: upon receiving the informationFSN1,FSN2,FSN3,FSN4,Tgwnf at time Tsnj, SNj calculates the freshness of the information by the formula Tsnj−Tgwnf≤ΔT. If it is not right, SNj ends the session promptly. Otherwise, SNj calculates UIDi∗=SNXj⊕FSN1, hrui‖UIDi∗=IDSNj⊕FSN2, rGWNf∗=FSN3⊕UIDi∗⊕hrui‖UIDi∗, and FSN4∗=hUIDi∗‖SNXj‖hrui‖UIDi∗‖rGWNf∗‖Tgwnf and confirms the correctness of the formula FSN4∗=FSN4.A8: if it is not right,SNj ends the session promptly. Otherwise, SNj selects stochastic digit rSNj and calculates SKs=hrSNj‖rGWNf‖UIDi‖hrui‖UIDi, SFN1=hUIDi‖rGWNf|SNXj, SFN2=rSNj⊕hrGWNf‖UIDi‖SNXj, and SFN3=hrSNj‖rGWNf‖SKs‖UIDi‖SNXj‖Tsnj. Then, SNj dispatches the information SFN2,SFN3,Tsnj to GWNF.A9: upon receiving the informationSFN2,SFN3,Tsnj at time Tgwnf1, GWNF computes the freshness of the information by the formula Tgwnf1−Tsnj≤ΔT. If it is not right, GWNF terminates the session promptly. Otherwise, GWNF computes rSNj∗=SFN2⊕hrGWNf‖UIDi‖SNXj, SKf=hrSNj∗‖rGWNf‖UIDi‖hrui‖UIDi, and SFN3∗=hrSNj∗‖rGWNf‖SKf‖UIDi‖NXj‖Tsnj and confirms the correctness of the formula SFN3∗=SFN3.A10: if it is not right,GWNF terminates the session promptly. Otherwise, GWNF generates new stochastic digit rGWNfnew and computes GUIDinew=hrGWNfnew‖SXGWNf‖IDGWNf⊕UIDi, FSC1=KFH⊕rGWNf, FSC2=rSNj⊕hSNXj‖KFH‖SXGWNf, FSC3=GUIDinew⊕hUIDi‖rui, and FSC4=hrSNj‖GUIDinew‖SNXj‖KFH‖SXGWNf‖SKf‖Tgwnf1. Then, GWNF transmits the information FSC1,FSC2,FSC3,FSC4,Tgwnf1 to Ui.A11: upon receiving the informationFSC1,FSC2,FSC3,FSC4,Tgwnf1 at time Tui, Ui computes the freshness of the information by the formula Tui−Tgwnf1≤ΔT. If it is not right, Ui suspends the session promptly. Otherwise, Ui counts rGWNf∗=KFH⊕FSC1, rSNj∗=FSC2⊕hSNXj‖KFH‖SXGWNf, GUIDinew=FSC3⊕hUIDi‖rui, SKu=hrSNj∗‖rGWNf∗‖UIDi‖hrui‖UIDi, rGWNh∗=SNXj∗⊕HSN3, and FSC4=hrSNj∗‖GUIDinew‖SNXj‖KFH‖SXGWNf‖SKu‖Tgwnf1 and confirms the correctness of the formula FSC4∗=FSC4.A12: if it is not right,Ui suspends the session promptly. Otherwise, Ui counts GFinew=GEi⊕GUIDinew⊕UIDi and substitutes GFinew,GUIDinew for GFi,GUIDi in smart card.Figure 3
The main authentication steps in case 1.Figure 4
The main authentication steps in case 2.


### 3.5. Password and Biometric Change Section

A1:Ui inserts smart card and inputs his or her identity IDi, password PWi, and biometric BIOUi.A2: smart card countsREPBIOUi,τUi=σUi, ri∗, rp∗, UIDi∗, UPWi∗, and USC3∗ and confirms the correctness of the formula USC3∗=USC3.A3: if it is not right, smart card suspends the session promptly. Otherwise,Ui picks the new parameters, identity IDi, password PWinew, and two stochastic digits ri and rp, and counts UIDi=hIDi‖ri and UPWinew=hPWi‖ri‖rp. After the calculation, Ui delivers UIDi and UPWinew to HGWN as the change request.A4: after getting the change request,HGWN generates a stochastic digit rGWNh and computes GUIDinew, GEinew, and GFinew in combination with its own privacy parameters. HGWN loads GEinew andGFjnew into the smart card and transmits the smart card to Ui.A5: after reception of the smart card,Ui imprints his or her unique biometric BIOUinew on the sensor device specific terminal and further counts GENBIOUinew=σUinew,τUinew, USC1new, USC2new, and USC3new. Then, Ui loads USC1new,USC2new,USC3new into the smart card to replace the old parameters.


## 3.1. Initialization Section

SA picks the distinctive identity IDSNj and private key SXSNj, for the SN, calculates the value SNXj=hIDSNj‖SXSNj and dispatches the information IDSNj,SNXj to the SN. SA chooses the distinctive identity IDGWNh and private key SXGWNh for the HGWN. SA selects the distinctive identity IDGWNf and private key SXGWNf for the FGWN in the same way. Each pair of HGWN and FGWN keeps a private session key Khf.


## 3.2. Registration Section

The registration section is divided into two parts, namely, sensor node registration and user registration.


### 3.2.1. Sensor Node Registration

A1: in the light of the received informationIDSNj,SNXj in the initialization section, SNj calculates MSNj=SNXj⊕hIDSNj and dispatches the information IDSNj,MSNj to GWNH. A2: after obtaining the information sent by the SN, HGWN computes SNXj=MSNj⊕hIDSNj, preserves the information IDSNj,MSNj, and replies to the sensor node with a confirmation message.


### 3.2.2. User Registration

A1:Ui picks the essential parameters, identity IDi, password PWi, and two stochastic digits ri and rp and counts UIDi=hIDi‖ri and UPWi=hPWi‖ri‖rp. After the calculation, Ui delivers UIDi and UPWi to HGWN as the registration request.A2: after getting the registration request,HGWN generates a stochastic digit rGWNh and computes GUIDi=hrGWNhSXGWNhIDGWNh⊕UIDi, GEi=hUIDi‖UPWi, and GFi=GEi⊕GUIDi⊕UIDi in combination with its own privacy parameters. HGWN loads GEi and GFi into the smart card and transmits the smart card to Ui.A3: after reception of the smart card,Ui imprints his or her unique biometric BIOUi on the sensor device specific terminal and further counts GENBIOUi=σUi,τUi, USC1=ri⊕hIDi‖PWi‖σUi,USC2=rp⊕hσUi‖ri, and USC3=hUIDi‖UPWi‖σUi‖ri‖rp. Then, Ui loads USC1,USC2,USC3 into the smart card.


## 3.2.1. Sensor Node Registration

A1: in the light of the received informationIDSNj,SNXj in the initialization section, SNj calculates MSNj=SNXj⊕hIDSNj and dispatches the information IDSNj,MSNj to GWNH. A2: after obtaining the information sent by the SN, HGWN computes SNXj=MSNj⊕hIDSNj, preserves the information IDSNj,MSNj, and replies to the sensor node with a confirmation message.


## 3.2.2. User Registration

A1:Ui picks the essential parameters, identity IDi, password PWi, and two stochastic digits ri and rp and counts UIDi=hIDi‖ri and UPWi=hPWi‖ri‖rp. After the calculation, Ui delivers UIDi and UPWi to HGWN as the registration request.A2: after getting the registration request,HGWN generates a stochastic digit rGWNh and computes GUIDi=hrGWNhSXGWNhIDGWNh⊕UIDi, GEi=hUIDi‖UPWi, and GFi=GEi⊕GUIDi⊕UIDi in combination with its own privacy parameters. HGWN loads GEi and GFi into the smart card and transmits the smart card to Ui.A3: after reception of the smart card,Ui imprints his or her unique biometric BIOUi on the sensor device specific terminal and further counts GENBIOUi=σUi,τUi, USC1=ri⊕hIDi‖PWi‖σUi,USC2=rp⊕hσUi‖ri, and USC3=hUIDi‖UPWi‖σUi‖ri‖rp. Then, Ui loads USC1,USC2,USC3 into the smart card.


## 3.3. Login Section

A1:Ui inserts smart card and inputs his or her identity IDi, password PWi, and biometric BIOUi. A2: smart card counts REPBIOUi,τUi=σUi, ri∗=USC1⊕hIDi‖PWi‖σUi, rp∗=USC2⊕hσUi‖ri, UIDi∗=hIDi‖ri∗, UPWi∗=hPWi‖ri∗‖rp∗, and USC3∗=hUIDi∗‖UPWi∗‖σUi‖ri∗‖rp∗ and confirms the correctness of the formula USC3∗=USC3. A3: if it is not right, smart card suspends the session promptly. Otherwise, smart card picks stochastic identity SCNi, stochastic digit rSCn, and time stamp Tsc and counts SCG1=GUIDi⊕SCNi, SCG2=rSCn⊕hSCNi‖Tsc, SCG3=GFi⊕hUIDi‖UPWi, and SCG4=hSCNi‖rSCn‖Tsc‖GUIDi‖SCG3‖IDSNj. Finally, Ui delivers the login request SCG1,SCG2,SCG4,Tsc,UIDi,IDSNj to GWNH.


## 3.4. Authentication and Key Agreement Section

On the basis ofUIDi in the login request, GWNH computes GUIDi=hrGWNh‖SXGWNh‖IDGWNh⊕UIDi, SCNi∗=GUIDi⊕SCG1, rSCn∗=SCG2⊕hSCNi∗‖Tsc, SCG3∗=GUIDi⊕UIDi, and SCG4∗=hSCNi∗‖rSCn∗‖Tsc‖GUIDi‖SCG3∗‖IDSNj and confirms the correctness of the formula SCG4∗=SCG4. If it is not right, GWNH terminates the session promptly. Otherwise, GWNH finds whether IDSNj is in the information about the sensor node it preserves. If it is in the information, execute case 1 as shown in Figure 3; if it is not, execute case 2 as shown in Figure 4.Case 1:A1:GWNH generates time stamp Tgwnh and computes the freshness of the login request by the formula Tgwnh−Tsc≤ΔT. If it is not right, GWNH terminates the session promptly. Otherwise, GWNH computes HSN1=SNXj⊕UIDi, HSN2=IDSNj⊕hrSCn‖SCNi, HSN3=HSN1⊕UID⊕irGWNh, and HSN4=hUIDi‖SNXj‖hrSCn‖SCNirGWNhTgwnh and transmits the information HSN1,HSN2,HSN3,HSN4,Tgwnh to SNj.A2: upon receiving the informationHSN1,HSN2,HSN3,HSN4,Tgwnh at time Tsnj, SNj calculates the freshness of the information by the formula Tsnj−Tgwnh≤ΔT. If it is not right, SNj ends the session promptly. Otherwise, SNj calculates UIDi∗=SNXj⊕HSN1, hrSCn‖SCNi∗=IDSNj⊕HSN2, rGWNh∗=HSN1⊕UIDi∗⊕HSN3, and HSN4∗=hUIDi∗‖SNXj‖hrSCn‖SCNi∗‖rGWNh∗‖Tgwnh and confirms the correctness of the formula HSN4∗=HSN4.A3: if it is not right,SNj ends the session promptly. Otherwise, SNj selects stochastic digit rSNj and calculates SKs=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXj, SHN1=rSNj⊕hhrSCn||SCNi‖rGWNh|Tsnj, and SHN2=hrGWNh‖UIDi‖SKs‖SNXj‖Tsnj. Then, SNj dispatches the information SHN1,SHN2,Tsnj to GWNH.A4: upon receiving the informationSHN1,SHN2,Tsnj at time Tgwnh1, GWNH computes the freshness of the information by the formula Tgwnh1−Tsnj≤ΔT. If it is not right, GWNH terminates the session promptly. Otherwise, GWNH computes rSNj∗=SHN1⊕hhrSCn‖SCNi‖rGWNh|Tsnj, SKh=hrSNj∗|rGWNh‖UIDi‖hrSCn‖SCNi‖SNXj, and SHN2∗=hrGWNh‖UIDi‖SKh‖SNXj‖Tsnj and confirms the correctness of the formula SHN2∗=SHN2.A5: if it is not right,GWNH terminates the session promptly. Otherwise, GWNH generates new stochastic digit rGWNhnew and computes GUIDinew=hrGWNhnew‖SXGWNh‖IDGWNh⊕UIDi,GSC1=SNXj⊕GUIDi, GSC2=rSNj⊕hrSCn‖SCNi, GSC3=GUIDinew⊕hUIDi‖UPWi, and GSC4=hrSCn‖GUIDinew‖SNXj‖SKh‖GFi‖Tgwnh1. Then, GWNH transmits the information HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1 to Ui.A6: upon receiving the informationHSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1 at time Tui, Ui computes the freshness of the information by the formula Tui−Tgwnh1≤ΔT. If it is not right, Ui suspends the session promptly. Otherwise, Ui counts SNXj∗=GSC1⊕GUIDi, rSNj∗=GSC2⊕hrSCn‖SCNi,rGWNh∗=SNXj∗⊕HSN3, SKu=hrSNj∗‖rGWNh∗‖UIDi‖hrSCn‖SCNi‖SNXj∗, GUIDinew=GSC3⊕hUIDi‖UPWi, and GSC4∗=hrSCn‖GUIDinew‖SNXj∗‖SKu‖GFi‖Tgwnh1 and confirms the correctness of the formula GSC4∗=GSC4.A7: if it is not right,Ui suspends the session promptly. Otherwise, Ui counts GFinew=GEi⊕GUIDinew⊕UIDi and substitutes GFinew,GUIDinew for GFi,GUIDi in smart card.Case 2:A1: first,GWNH broadcasts the information IDSNj,IDGWNh among all gateway nodes. GWNF finds whether IDSNj is in the information about the sensor node it preserves. If it is in the information, GWNF finds SNXj based on IDSNj. Next, GWNF finds and computes FHN1=hSNXj‖KFH⊕SXGWNf, FHN2=KFH⊕SNXj, FHN3=IDSNj⊕IDGWNf, and FHN4=hKFH‖IDGWNh‖IDGWNf‖SNXj‖IDSNj‖SXGWNf. Then, GWNF transmits the information FHN1,FHN2,FHN3,FHN4 to GWNH.A2: after reception of the informationFHN1,FHN2,FHN3,FHN4, GWNH computes IDGWNf=IDSNj⊕FHN3. GWNH finds the private key KFH between them according to identity IDGWNf of GWNF and computes SNXj∗=KFH⊕FHN2, SXGWNf∗=hSNXj∗‖KFH⊕FHN1, and FHN4∗=hKFH‖IDGWNh‖IDGWNf‖SNXj∗‖IDSNj‖SXGWNf∗. Then, GWNH confirms the correctness of the formula FHN4∗=FHN4.A3: if it is not right,GWNH terminates the session promptly. Otherwise, GWNH computes GSC5=hSNXj‖IDSNj, GSC6=UIDi⊕SNXj, and GSC7=FHN1⊕GSC5 and transmits the information FHN2,GSC6,GSC7 to Ui.A4: after reception of the informationFHN2,GSC6,GSC7, Ui counts SNXj=UIDi⊕GSC6, KFH=FHN2⊕SNXj, FHN1=GSC7⊕hIDSNj‖SNXj, and SXGWNf=hSNXj‖KFH⊕FHN1. Then, Ui picks the stochastic digit rui and time stamp Tui and counts SCF5=hSNXj‖KFH⊕rui, SCF6=UIDi⊕FHN1, and SCF7=hrui‖UIDi‖Tui‖SXGWNf‖KFH‖SNXj. Finally, Ui delivers the information SCF5,SCF6,SCF7,Tui to GWNF.A5: upon receiving the informationSCF5,SCF6,SCF7,Tui at time Tgwnf, GWNF computes the freshness of the information by the formula Tgwnf−Tui≤ΔT. If it is not right, GWNF terminates the session promptly. Otherwise, GWNF computes rui∗=hSNXj‖KFH⊕SCF5, UIDi∗=SCF6⊕FHN1, and SCF7∗=hrui∗‖UIDi∗‖Tui‖SXGWNf‖KFH‖SNXj and confirms the correctness of the formula SCF7∗=SCF7.A6: if it is not right,GWNF terminates the session promptly. Otherwise, GWNF generates stochastic digit rGWNf and computes FSN1=SNXj⊕UIDi, FSN2=IDSNj⊕hUIDi‖rui, FSN3=rGWNf⊕UIDi⊕hrui‖UIDi, and FSN4=hUIDi‖SNXj‖hrui‖UIDi‖rGWNf‖Tgwnf. Then, GWNF transmits the information FSN1,FSN2,FSN3,FSN4,Tgwnf to SNj.A7: upon receiving the informationFSN1,FSN2,FSN3,FSN4,Tgwnf at time Tsnj, SNj calculates the freshness of the information by the formula Tsnj−Tgwnf≤ΔT. If it is not right, SNj ends the session promptly. Otherwise, SNj calculates UIDi∗=SNXj⊕FSN1, hrui‖UIDi∗=IDSNj⊕FSN2, rGWNf∗=FSN3⊕UIDi∗⊕hrui‖UIDi∗, and FSN4∗=hUIDi∗‖SNXj‖hrui‖UIDi∗‖rGWNf∗‖Tgwnf and confirms the correctness of the formula FSN4∗=FSN4.A8: if it is not right,SNj ends the session promptly. Otherwise, SNj selects stochastic digit rSNj and calculates SKs=hrSNj‖rGWNf‖UIDi‖hrui‖UIDi, SFN1=hUIDi‖rGWNf|SNXj, SFN2=rSNj⊕hrGWNf‖UIDi‖SNXj, and SFN3=hrSNj‖rGWNf‖SKs‖UIDi‖SNXj‖Tsnj. Then, SNj dispatches the information SFN2,SFN3,Tsnj to GWNF.A9: upon receiving the informationSFN2,SFN3,Tsnj at time Tgwnf1, GWNF computes the freshness of the information by the formula Tgwnf1−Tsnj≤ΔT. If it is not right, GWNF terminates the session promptly. Otherwise, GWNF computes rSNj∗=SFN2⊕hrGWNf‖UIDi‖SNXj, SKf=hrSNj∗‖rGWNf‖UIDi‖hrui‖UIDi, and SFN3∗=hrSNj∗‖rGWNf‖SKf‖UIDi‖NXj‖Tsnj and confirms the correctness of the formula SFN3∗=SFN3.A10: if it is not right,GWNF terminates the session promptly. Otherwise, GWNF generates new stochastic digit rGWNfnew and computes GUIDinew=hrGWNfnew‖SXGWNf‖IDGWNf⊕UIDi, FSC1=KFH⊕rGWNf, FSC2=rSNj⊕hSNXj‖KFH‖SXGWNf, FSC3=GUIDinew⊕hUIDi‖rui, and FSC4=hrSNj‖GUIDinew‖SNXj‖KFH‖SXGWNf‖SKf‖Tgwnf1. Then, GWNF transmits the information FSC1,FSC2,FSC3,FSC4,Tgwnf1 to Ui.A11: upon receiving the informationFSC1,FSC2,FSC3,FSC4,Tgwnf1 at time Tui, Ui computes the freshness of the information by the formula Tui−Tgwnf1≤ΔT. If it is not right, Ui suspends the session promptly. Otherwise, Ui counts rGWNf∗=KFH⊕FSC1, rSNj∗=FSC2⊕hSNXj‖KFH‖SXGWNf, GUIDinew=FSC3⊕hUIDi‖rui, SKu=hrSNj∗‖rGWNf∗‖UIDi‖hrui‖UIDi, rGWNh∗=SNXj∗⊕HSN3, and FSC4=hrSNj∗‖GUIDinew‖SNXj‖KFH‖SXGWNf‖SKu‖Tgwnf1 and confirms the correctness of the formula FSC4∗=FSC4.A12: if it is not right,Ui suspends the session promptly. Otherwise, Ui counts GFinew=GEi⊕GUIDinew⊕UIDi and substitutes GFinew,GUIDinew for GFi,GUIDi in smart card.Figure 3
The main authentication steps in case 1.Figure 4
The main authentication steps in case 2.


## 3.5. Password and Biometric Change Section

A1:Ui inserts smart card and inputs his or her identity IDi, password PWi, and biometric BIOUi.A2: smart card countsREPBIOUi,τUi=σUi, ri∗, rp∗, UIDi∗, UPWi∗, and USC3∗ and confirms the correctness of the formula USC3∗=USC3.A3: if it is not right, smart card suspends the session promptly. Otherwise,Ui picks the new parameters, identity IDi, password PWinew, and two stochastic digits ri and rp, and counts UIDi=hIDi‖ri and UPWinew=hPWi‖ri‖rp. After the calculation, Ui delivers UIDi and UPWinew to HGWN as the change request.A4: after getting the change request,HGWN generates a stochastic digit rGWNh and computes GUIDinew, GEinew, and GFinew in combination with its own privacy parameters. HGWN loads GEinew andGFjnew into the smart card and transmits the smart card to Ui.A5: after reception of the smart card,Ui imprints his or her unique biometric BIOUinew on the sensor device specific terminal and further counts GENBIOUinew=σUinew,τUinew, USC1new, USC2new, and USC3new. Then, Ui loads USC1new,USC2new,USC3new into the smart card to replace the old parameters.


## 4. Formal Security Analysis of Protocol

In this section, we separately apply BAN logic and AVISPA tool to validate the security of our proposed authentication and key agreement protocol in case 1 and case 2.


### 4.1. BAN Logic (Case 1)

In this section, we will validate our proposed designed authentication protocol by applying the BAN logic in case 1.BAN logic notations are as follows:(1)
∂|≡β: ∂ trusts the realness in β(2)
∂⊲β: ∂ obtains or sees information β(3)
∂|∼β: ∂ sent or said information β(4)
∂|⇒β: ∂ has jurisdiction over β(5)
#β: β is fresh(6)
∂⟷SKβ: SK is the private session key between ∂ and β(7)
βSK: β is encrypted with the private session key SKBAN logic postulate rules:PR1: Message-meaning rule:∂|≡β⟷SK∂,∂⊲Μk/∂|≡β|∼ΜPR2: Nonce-verification rule:∂|≡#Μ,∂|≡β|∼Μ/∂|≡β|≡ΜPR3: Jurisdiction rule:∂|≡β|≡Μ,∂|≡β|⇒Μ/∂|≡ΜPR4: Fresh rule:∂|≡#Μ/∂|≡#Μ,ΡPR5: Belief rule:∂|≡β|≡Μ,Ρ/∂|≡β|≡ΜSecurity goals are as follows:Goal 1:Ui|≡Ui⟷SKGWNhGoal 2:Ui|≡GWNh|≡Ui⟷SKGWNhGoal 3:GWNh|≡Ui⟷SKGWNhGoal 4:GWNh|≡Ui|≡Ui⟷SKGWNhGoal 5:SNj|≡SNj⟷SKGWNhGoal 6:SNj|≡GWNh|≡SNj⟷SKGWNhGoal 7:GWNh|≡SNj⟷SKGWNhGoal 8:GWNh|≡SNj|≡SNj⟷SKGWNhRational assumptions are as follows:RA1:GWNh|≡Ui⟷GUIDiGWNhRA2:GWNh|≡#TscRA3:SNj|≡GWNh⟷SNXjSNjRA4:SNj|≡#SNXjRA5:GWNh|≡SNj⟷rSNjGWNhRA6:GWNh|≡#TsnjRA7:GWNh|≡SNj|⇒SNj⟷SKGWNhRA8:Ui|≡GWNh⟷GFiUiRA9:Ui|≡#Thgwn1RA10:Ui|≡GWNh|⇒Ui⟷SKGWNhRA11:SNj|≡GWNh|⇒SNj⟷SKGWNhRA12:GWNh|≡Ui|⇒Ui⟷SKGWNhThe idealized form of the information is as follows:Inf 1:Ui⟶GWNhSCG1,SCG2,SCG4,Tsc,UIDi,IDSNjInf 2:GWNh⟶SNjHSN1,HSN2,HSN3,HSN4,TgwnhInf3:SNj⟶GWNhSHN1,SHN2,TsnjInf4:GWNh⟶UiHSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1In view of Inf1, we are ready to receive the following:F1:GWNh⊲SCG1,SCG2,SCG4,Tsc,UIDi,IDSNjGUIDiIn view of F1, RA1, and PR1, we are ready to receive the following:F2:GWNh|≡Ui|∼SCG1,SCG2,SCG4,Tsc,UIDi,IDSNjThe equivalent form of F2 is the following:F3:GWNh|≡Ui|∼UIDi,SCNi,rSCn,TscIn view of F3, RA2, PR4, and PR2, we are ready to receive the following:F4:GWNh|≡Ui|≡UIDi,SCNi,rSCn,TscIn view of F4 and PR5, we are ready to receive the following:F5:GWNh|≡Ui|≡UIDi,SCNi,rSCnIn view of Inf2, we are ready to receive the following:F6:SNj⊲HSN1,HSN2,HSN3,HSN4,TgwnhSNXjIn view of F6, RA3, and PR1, we are ready to receive the following:F7:SNj|≡GWNh|∼HSN1,HSN2,HSN3,HSN4,TgwnhThe equivalent form of F7 is the following:F8:SNj|≡GWNh|∼SNXj,UIDi,rSCn,SCNi,rGWNh,TgwnhIn view of F8, RA4, PR4, and PR2, we are ready to receive the following:F9:SNj|≡GWNh|≡SNXj,UIDi,rSCn,SCNi,rGWNh,TgwnhIn view of F9 and PR5, we are ready to receive the following:F10:SNj|≡GWNh|≡SNXj,UIDi,rSCn,SCNi,rGWNhIn view of Inf3, we are ready to receive the following:F11:GWNh⊲SHN1,SHN2,TsnjrSNjIn view of F11, RA5, and PR1, we are ready to receive the following:F12:GWNh|≡SNj|∼SHN1,SHN2,TsnjThe equivalent form of F12 is the following:F13:GWNh|≡SNj|∼rSNj,rGWNh,rSCn,SCNi,Tsnj,UIDi,SNXjIn view of F13, RA6, PR4, and PR2, we are ready to receive the following:F14:GWNh|≡SNj|≡rSNj,rGWNh,rSCn,SCNi,Tsnj,UIDi,SNXjIn view of F14 and PR5, we are ready to receive the following:F15:GWNh|≡SNj|≡rSNj,rGWNh,rSCn,SCNi,UIDi,SNXjThe private session key isSK=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXjIn view of F15, we are ready to receive the following:F16:GWNh|≡SNj|≡SNj⟷SKGWNh Goal 8In view of F16, RA7, and PR3, we are ready to receive the following:F17:GWNh|≡SNj⟷SKGWNh Goal 7In view of Inf4, we are ready to receive the following:F18:Ui⊲HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1GFiIn view of F18, RA8, and PR1, we are ready to receive the following:F19:Ui|≡GWNh|∼HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1The equivalent form of F19 is the following:F20:Ui|≡GWNh|∼SNXj,UIDi,rGWNh,rSNj,rSCn,SCNi,Thgwn1In view of F20, RA9, PR4, and PR2, we are ready to receive the following:F20:Ui|≡GWNh|≡SNXj,UIDi,rGWNh,rSNj,rSCn,SCNi,Thgwn1In view of F20 and PR5, we are ready to receive the following:F21:Ui|≡GWNh|≡SNXj,UIDi,rGWNh,rSNj,rSCn,SCNiThe private session key isSK=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXjIn view of F21, we are ready to receive the following:F22:Ui|≡GWNh|≡Ui⟷SKGWNh Goal 2In view of F22, RA10, and PR3, we are ready to receive the following:F23:Ui|≡Ui⟷SKGWNh Goal 1The private session key isSK=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXjIn view of F10 and F15, we are ready to receive the following:F24:SNj|≡GWNh|≡SNj⟷SKGWNh Goal 6In view of F24, RA11, and PR3, we are ready to receive the following:F25:SNj|≡SNj⟷SKGWNh Goal 5The private session key isSK=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXjIn view of F5 and F21, we are ready to receive the following:F26:GWNh|≡Ui|≡Ui⟷SKGWNh Goal 4In view of F26, RA12, and PR3, we are ready to receive the following:F27:GWNh|≡Ui⟷SKGWNh Goal 3


### 4.2. AVISPA Tool (Case 1)

In this section, we will validate our proposed designed authentication protocol by applying the AVISPA tool in case 1. In AVISPA tool, four validation models are supported: OFMC, ATSE, SATMC, and TA4SP. The security of our designed authentication protocol is simulated by applying the HLPSL (High Level Protocol Specifications Language). Figures5 and 6 present the result of the simulation by applying the OFMC and ATSE.Figure 5
The simulation result of OFMC.Figure 6
The simulation result of ATSE.


### 4.3. BAN Logic (Case 2)

In this section, we will validate our proposed designed authentication protocol by applying the BAN logic in case 2.Goal 1:Ui|≡Ui⟷SKGWNfGoal 2:Ui|≡GWNf|≡Ui⟷SKGWNfGoal 3:GWNf|≡Ui⟷SKGWNfGoal 4:GWNf|≡Ui|≡Ui⟷SKGWNfGoal 5:SNj|≡SNj⟷SKGWNfGoal 6:SNj|≡GWNf|≡SNj⟷SKGWNfGoal 7:GWNf|≡SNj⟷SKGWNfGoal 8:GWNf|≡SNj|≡SNj⟷SKGWNfRational assumptions are as follows:RA1:GWNf|≡Ui⟷UIDiGWNfRA2:GWNf|≡#TuiRA3:SNj|≡GWNf⟷rGWNfSNjRA4:SNj|≡#TgwnfRA5:GWNf|≡SNj⟷FSN1GWNfRA6:GWNf|≡#TsnjRA7:GWNf|≡SNj|⇒SNj⟷SKGWNfRA8:Ui|≡GWNf⟷FSC1UiRA9:Ui|≡#Tgwnf1RA10:Ui|≡GWNf|⇒Ui⟷SKGWNfRA11:SNj|≡GWNf|⇒SNj⟷SKGWNfRA12:GWNf|≡Ui|⇒Ui⟷SKGWNfThe idealized form of the information is as follows:Inf1:Ui⟶GWNfSCF5,SCF6,SCF7,TuiInf2:GWNf⟶SNjFSN1,FSN2,FSN3,FSN4,TgwnfInf3:SNj⟶GWNfSFN2,SFN3,TsnjInf4:GWNf⟶UiFSC1,FSC2,FSC3,FSC4,Tgwnf1In view of Inf1, we are ready to receive the following:F1:GWNf⊲SCF5,SCF6,SCF7,TuiUIDiIn view of F1, RA1, and PR1, we are ready to receive the following:F2:GWNf|≡Ui|∼SCF5,SCF6,SCF7,TuiThe equivalent form of F2 is the following:F3:GWNf|≡Ui|∼SNXj,KFH,rui,UIDi,IDSNj,SXGWNf,TuiIn view of F3, RA2, PR4, and PR2, we are ready to receive the following:F4:GWNf|≡Ui|≡SNXj,KFH,rui,UIDi,IDSNj,SXGWNf,TuiIn view of F4 and PR5, we are ready to receive the following:F5:GWNf|≡Ui|≡rui,UIDiIn view of Inf2, we are ready to receive the following:F6:SNj⊲FSN1,FSN2,FSN3,FSN4,TgwnfrGWNfIn view of F6, RA3, and PR1, we are ready to receive the following:F7:SNj|≡GWNf|∼FSN1,FSN2,FSN3,FSN4,TgwnfThe equivalent form of F7 is the following:F8:SNj|≡GWNf|∼SNXj,UIDi,IDSNj,rui,rGWNf,TgwnfIn view of F8, RA4, PR4, and PR2, we are ready to receive the following:F9:SNj|≡GWNf|≡SNXj,UIDi,IDSNj,rui,rGWNf,TgwnfIn view of F9 and PR5 we are ready to receive the following:F10:SNj|≡GWNf|≡UIDi,rui,rGWNfIn view of Inf3, we are ready to receive the following:F11:GWNf⊲SFN2,SFN3,TsnjSFN1In view of F11, RA5, and PR1, we are ready to receive the following:F12:GWNf|≡SNj|∼SFN2,SFN3,TsnjThe equivalent form of F12 is the following:F13:GWNf|≡SNj|∼rSNj,rGWNf,rui,UIDi,SNXj,TsnjIn view of F13, RA6, PR4, and PR2, we are ready to receive the following:F14:GWNf|≡SNj|≡rSNj,rGWNf,rui,UIDi,SNXj,TsnjIn view of F14 and PR5, we are ready to receive the following:F15:GWNf|≡SNj|≡rSNj,rGWNf,rui,UIDiThe private session key isSK=hrSNj‖rGWNf‖UIDi‖hrui‖UIDiIn view of F15, we are ready to receive the following:F16:GWNf|≡SNj|≡SNj⟷SKGWNf Goal 8In view of F16, RA7, and PR3, we are ready to receive the following:F17:GWNf|≡SNj⟷SKGWNf Goal 7In view of Inf4, we are ready to receive the following:F18:Ui⊲FSC1,FSC2,FSC3,FSC4,Tgwnf1FSC1In view of F18, RA8, and PR1, we are ready to receive the following:F19:Ui|≡GWNf|∼FSC1,FSC2,FSC3,FSC4,Tgwnf1The equivalent form of F19 is the following:F20:Ui|≡GWNf|∼KFH,rGWNf,rSNj,SNXj,UIDi,rui,SXGWNf,Tgwnf1In view of F20, RA9, PR4, and PR2, we are ready to receive the following:F20:Ui|≡GWNf|≡KFH,rGWNf,rSNj,SNXj,UIDi,rui,SXGWNf,Tgwnf1In view of F20 and PR5, we are ready to receive the following:F21:Ui|≡GWNf|≡rGWNf,rSNj,UIDi,ruiThe private session key isSK=hrSNj‖rGWNf‖UIDi‖hrui‖UIDiIn view of F21, we are ready to receive the following:F22:Ui|≡GWNf|≡Ui⟷SKGWNf Goal 2In view of F22, RA10, and PR3, we are ready to receive the following:F23:Ui|≡Ui⟷SKGWNf Goal 1The private session key isSK=hrSNj‖rGWNf‖UIDi‖hrui‖UIDiIn view of F10 and F15, we are ready to receive the following:F24:SNj|≡GWNf|≡SNj⟷SKGWNf Goal 6In view of F24, RA11, and PR3, we are ready to receive the following:F25:SNj|≡SNj⟷SKGWNf Goal 5The private session key isSK=hrSNj‖rGWNf‖UIDi‖hrui‖UIDiIn view of F5 and F21, we are ready to receive the following:F26:GWNf|≡Ui|≡Ui⟷SKGWNf Goal 4In view of F26, RA12, and PR3, we are ready to receive the following:F27:GWNf|≡Ui⟷SKGWNf Goal 3


### 4.4. AVISPA Tool (Case 2)

In this section, we will validate our proposed designed authentication protocol by applying the AVISPA tool in case 2. Figures7 and 8 present the result of the simulation by applying the ATSE and OFMC.Figure 7
The simulation result of ATSE.Figure 8
The simulation result of OFMC.


## 4.1. BAN Logic (Case 1)

In this section, we will validate our proposed designed authentication protocol by applying the BAN logic in case 1.BAN logic notations are as follows:(1)
∂|≡β: ∂ trusts the realness in β(2)
∂⊲β: ∂ obtains or sees information β(3)
∂|∼β: ∂ sent or said information β(4)
∂|⇒β: ∂ has jurisdiction over β(5)
#β: β is fresh(6)
∂⟷SKβ: SK is the private session key between ∂ and β(7)
βSK: β is encrypted with the private session key SKBAN logic postulate rules:PR1: Message-meaning rule:∂|≡β⟷SK∂,∂⊲Μk/∂|≡β|∼ΜPR2: Nonce-verification rule:∂|≡#Μ,∂|≡β|∼Μ/∂|≡β|≡ΜPR3: Jurisdiction rule:∂|≡β|≡Μ,∂|≡β|⇒Μ/∂|≡ΜPR4: Fresh rule:∂|≡#Μ/∂|≡#Μ,ΡPR5: Belief rule:∂|≡β|≡Μ,Ρ/∂|≡β|≡ΜSecurity goals are as follows:Goal 1:Ui|≡Ui⟷SKGWNhGoal 2:Ui|≡GWNh|≡Ui⟷SKGWNhGoal 3:GWNh|≡Ui⟷SKGWNhGoal 4:GWNh|≡Ui|≡Ui⟷SKGWNhGoal 5:SNj|≡SNj⟷SKGWNhGoal 6:SNj|≡GWNh|≡SNj⟷SKGWNhGoal 7:GWNh|≡SNj⟷SKGWNhGoal 8:GWNh|≡SNj|≡SNj⟷SKGWNhRational assumptions are as follows:RA1:GWNh|≡Ui⟷GUIDiGWNhRA2:GWNh|≡#TscRA3:SNj|≡GWNh⟷SNXjSNjRA4:SNj|≡#SNXjRA5:GWNh|≡SNj⟷rSNjGWNhRA6:GWNh|≡#TsnjRA7:GWNh|≡SNj|⇒SNj⟷SKGWNhRA8:Ui|≡GWNh⟷GFiUiRA9:Ui|≡#Thgwn1RA10:Ui|≡GWNh|⇒Ui⟷SKGWNhRA11:SNj|≡GWNh|⇒SNj⟷SKGWNhRA12:GWNh|≡Ui|⇒Ui⟷SKGWNhThe idealized form of the information is as follows:Inf 1:Ui⟶GWNhSCG1,SCG2,SCG4,Tsc,UIDi,IDSNjInf 2:GWNh⟶SNjHSN1,HSN2,HSN3,HSN4,TgwnhInf3:SNj⟶GWNhSHN1,SHN2,TsnjInf4:GWNh⟶UiHSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1In view of Inf1, we are ready to receive the following:F1:GWNh⊲SCG1,SCG2,SCG4,Tsc,UIDi,IDSNjGUIDiIn view of F1, RA1, and PR1, we are ready to receive the following:F2:GWNh|≡Ui|∼SCG1,SCG2,SCG4,Tsc,UIDi,IDSNjThe equivalent form of F2 is the following:F3:GWNh|≡Ui|∼UIDi,SCNi,rSCn,TscIn view of F3, RA2, PR4, and PR2, we are ready to receive the following:F4:GWNh|≡Ui|≡UIDi,SCNi,rSCn,TscIn view of F4 and PR5, we are ready to receive the following:F5:GWNh|≡Ui|≡UIDi,SCNi,rSCnIn view of Inf2, we are ready to receive the following:F6:SNj⊲HSN1,HSN2,HSN3,HSN4,TgwnhSNXjIn view of F6, RA3, and PR1, we are ready to receive the following:F7:SNj|≡GWNh|∼HSN1,HSN2,HSN3,HSN4,TgwnhThe equivalent form of F7 is the following:F8:SNj|≡GWNh|∼SNXj,UIDi,rSCn,SCNi,rGWNh,TgwnhIn view of F8, RA4, PR4, and PR2, we are ready to receive the following:F9:SNj|≡GWNh|≡SNXj,UIDi,rSCn,SCNi,rGWNh,TgwnhIn view of F9 and PR5, we are ready to receive the following:F10:SNj|≡GWNh|≡SNXj,UIDi,rSCn,SCNi,rGWNhIn view of Inf3, we are ready to receive the following:F11:GWNh⊲SHN1,SHN2,TsnjrSNjIn view of F11, RA5, and PR1, we are ready to receive the following:F12:GWNh|≡SNj|∼SHN1,SHN2,TsnjThe equivalent form of F12 is the following:F13:GWNh|≡SNj|∼rSNj,rGWNh,rSCn,SCNi,Tsnj,UIDi,SNXjIn view of F13, RA6, PR4, and PR2, we are ready to receive the following:F14:GWNh|≡SNj|≡rSNj,rGWNh,rSCn,SCNi,Tsnj,UIDi,SNXjIn view of F14 and PR5, we are ready to receive the following:F15:GWNh|≡SNj|≡rSNj,rGWNh,rSCn,SCNi,UIDi,SNXjThe private session key isSK=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXjIn view of F15, we are ready to receive the following:F16:GWNh|≡SNj|≡SNj⟷SKGWNh Goal 8In view of F16, RA7, and PR3, we are ready to receive the following:F17:GWNh|≡SNj⟷SKGWNh Goal 7In view of Inf4, we are ready to receive the following:F18:Ui⊲HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1GFiIn view of F18, RA8, and PR1, we are ready to receive the following:F19:Ui|≡GWNh|∼HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1The equivalent form of F19 is the following:F20:Ui|≡GWNh|∼SNXj,UIDi,rGWNh,rSNj,rSCn,SCNi,Thgwn1In view of F20, RA9, PR4, and PR2, we are ready to receive the following:F20:Ui|≡GWNh|≡SNXj,UIDi,rGWNh,rSNj,rSCn,SCNi,Thgwn1In view of F20 and PR5, we are ready to receive the following:F21:Ui|≡GWNh|≡SNXj,UIDi,rGWNh,rSNj,rSCn,SCNiThe private session key isSK=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXjIn view of F21, we are ready to receive the following:F22:Ui|≡GWNh|≡Ui⟷SKGWNh Goal 2In view of F22, RA10, and PR3, we are ready to receive the following:F23:Ui|≡Ui⟷SKGWNh Goal 1The private session key isSK=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXjIn view of F10 and F15, we are ready to receive the following:F24:SNj|≡GWNh|≡SNj⟷SKGWNh Goal 6In view of F24, RA11, and PR3, we are ready to receive the following:F25:SNj|≡SNj⟷SKGWNh Goal 5The private session key isSK=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXjIn view of F5 and F21, we are ready to receive the following:F26:GWNh|≡Ui|≡Ui⟷SKGWNh Goal 4In view of F26, RA12, and PR3, we are ready to receive the following:F27:GWNh|≡Ui⟷SKGWNh Goal 3


## 4.2. AVISPA Tool (Case 1)

In this section, we will validate our proposed designed authentication protocol by applying the AVISPA tool in case 1. In AVISPA tool, four validation models are supported: OFMC, ATSE, SATMC, and TA4SP. The security of our designed authentication protocol is simulated by applying the HLPSL (High Level Protocol Specifications Language). Figures5 and 6 present the result of the simulation by applying the OFMC and ATSE.Figure 5
The simulation result of OFMC.Figure 6
The simulation result of ATSE.


## 4.3. BAN Logic (Case 2)

In this section, we will validate our proposed designed authentication protocol by applying the BAN logic in case 2.Goal 1:Ui|≡Ui⟷SKGWNfGoal 2:Ui|≡GWNf|≡Ui⟷SKGWNfGoal 3:GWNf|≡Ui⟷SKGWNfGoal 4:GWNf|≡Ui|≡Ui⟷SKGWNfGoal 5:SNj|≡SNj⟷SKGWNfGoal 6:SNj|≡GWNf|≡SNj⟷SKGWNfGoal 7:GWNf|≡SNj⟷SKGWNfGoal 8:GWNf|≡SNj|≡SNj⟷SKGWNfRational assumptions are as follows:RA1:GWNf|≡Ui⟷UIDiGWNfRA2:GWNf|≡#TuiRA3:SNj|≡GWNf⟷rGWNfSNjRA4:SNj|≡#TgwnfRA5:GWNf|≡SNj⟷FSN1GWNfRA6:GWNf|≡#TsnjRA7:GWNf|≡SNj|⇒SNj⟷SKGWNfRA8:Ui|≡GWNf⟷FSC1UiRA9:Ui|≡#Tgwnf1RA10:Ui|≡GWNf|⇒Ui⟷SKGWNfRA11:SNj|≡GWNf|⇒SNj⟷SKGWNfRA12:GWNf|≡Ui|⇒Ui⟷SKGWNfThe idealized form of the information is as follows:Inf1:Ui⟶GWNfSCF5,SCF6,SCF7,TuiInf2:GWNf⟶SNjFSN1,FSN2,FSN3,FSN4,TgwnfInf3:SNj⟶GWNfSFN2,SFN3,TsnjInf4:GWNf⟶UiFSC1,FSC2,FSC3,FSC4,Tgwnf1In view of Inf1, we are ready to receive the following:F1:GWNf⊲SCF5,SCF6,SCF7,TuiUIDiIn view of F1, RA1, and PR1, we are ready to receive the following:F2:GWNf|≡Ui|∼SCF5,SCF6,SCF7,TuiThe equivalent form of F2 is the following:F3:GWNf|≡Ui|∼SNXj,KFH,rui,UIDi,IDSNj,SXGWNf,TuiIn view of F3, RA2, PR4, and PR2, we are ready to receive the following:F4:GWNf|≡Ui|≡SNXj,KFH,rui,UIDi,IDSNj,SXGWNf,TuiIn view of F4 and PR5, we are ready to receive the following:F5:GWNf|≡Ui|≡rui,UIDiIn view of Inf2, we are ready to receive the following:F6:SNj⊲FSN1,FSN2,FSN3,FSN4,TgwnfrGWNfIn view of F6, RA3, and PR1, we are ready to receive the following:F7:SNj|≡GWNf|∼FSN1,FSN2,FSN3,FSN4,TgwnfThe equivalent form of F7 is the following:F8:SNj|≡GWNf|∼SNXj,UIDi,IDSNj,rui,rGWNf,TgwnfIn view of F8, RA4, PR4, and PR2, we are ready to receive the following:F9:SNj|≡GWNf|≡SNXj,UIDi,IDSNj,rui,rGWNf,TgwnfIn view of F9 and PR5 we are ready to receive the following:F10:SNj|≡GWNf|≡UIDi,rui,rGWNfIn view of Inf3, we are ready to receive the following:F11:GWNf⊲SFN2,SFN3,TsnjSFN1In view of F11, RA5, and PR1, we are ready to receive the following:F12:GWNf|≡SNj|∼SFN2,SFN3,TsnjThe equivalent form of F12 is the following:F13:GWNf|≡SNj|∼rSNj,rGWNf,rui,UIDi,SNXj,TsnjIn view of F13, RA6, PR4, and PR2, we are ready to receive the following:F14:GWNf|≡SNj|≡rSNj,rGWNf,rui,UIDi,SNXj,TsnjIn view of F14 and PR5, we are ready to receive the following:F15:GWNf|≡SNj|≡rSNj,rGWNf,rui,UIDiThe private session key isSK=hrSNj‖rGWNf‖UIDi‖hrui‖UIDiIn view of F15, we are ready to receive the following:F16:GWNf|≡SNj|≡SNj⟷SKGWNf Goal 8In view of F16, RA7, and PR3, we are ready to receive the following:F17:GWNf|≡SNj⟷SKGWNf Goal 7In view of Inf4, we are ready to receive the following:F18:Ui⊲FSC1,FSC2,FSC3,FSC4,Tgwnf1FSC1In view of F18, RA8, and PR1, we are ready to receive the following:F19:Ui|≡GWNf|∼FSC1,FSC2,FSC3,FSC4,Tgwnf1The equivalent form of F19 is the following:F20:Ui|≡GWNf|∼KFH,rGWNf,rSNj,SNXj,UIDi,rui,SXGWNf,Tgwnf1In view of F20, RA9, PR4, and PR2, we are ready to receive the following:F20:Ui|≡GWNf|≡KFH,rGWNf,rSNj,SNXj,UIDi,rui,SXGWNf,Tgwnf1In view of F20 and PR5, we are ready to receive the following:F21:Ui|≡GWNf|≡rGWNf,rSNj,UIDi,ruiThe private session key isSK=hrSNj‖rGWNf‖UIDi‖hrui‖UIDiIn view of F21, we are ready to receive the following:F22:Ui|≡GWNf|≡Ui⟷SKGWNf Goal 2In view of F22, RA10, and PR3, we are ready to receive the following:F23:Ui|≡Ui⟷SKGWNf Goal 1The private session key isSK=hrSNj‖rGWNf‖UIDi‖hrui‖UIDiIn view of F10 and F15, we are ready to receive the following:F24:SNj|≡GWNf|≡SNj⟷SKGWNf Goal 6In view of F24, RA11, and PR3, we are ready to receive the following:F25:SNj|≡SNj⟷SKGWNf Goal 5The private session key isSK=hrSNj‖rGWNf‖UIDi‖hrui‖UIDiIn view of F5 and F21, we are ready to receive the following:F26:GWNf|≡Ui|≡Ui⟷SKGWNf Goal 4In view of F26, RA12, and PR3, we are ready to receive the following:F27:GWNf|≡Ui⟷SKGWNf Goal 3


## 4.4. AVISPA Tool (Case 2)

In this section, we will validate our proposed designed authentication protocol by applying the AVISPA tool in case 2. Figures7 and 8 present the result of the simulation by applying the ATSE and OFMC.Figure 7
The simulation result of ATSE.Figure 8
The simulation result of OFMC.


## 5. Informal Security Analysis of Protocol

In this section, we demonstrate informal security analysis of our proposed mutual authentication protocol through sixteen evaluation criteria as defined in Section2.3.


### 5.1. Session Key Security

In our designed protocol, the private session key is derived from the relevant privacy parameters of the three parties involved in the communication process through hash function operation. In case 1, the private session key isSK=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXj. The information HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1 transmitted from GWNH to Ui comprises the session key; that is, GSC4=hrSCn‖GUIDinew‖SNXj‖SKh‖GFi‖Tgwnh1. Let us assume that the assailant captures the information; then the assailant intends to figure out SK∗=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXj by creating rSNj, rGWNh, rSCn, SNXj=hIDSNj‖SXSNj, hrSCn‖SCNi, and UIDi=hIDi‖ri. In case 2, the private session key is SKs=hrSNj‖rGWNf‖UIDi‖hrui‖UIDi. The information SFN2,SFN3,Tsnj dispatched from SNj to GWNF includes the session key; that is, SFN3=hrSNj‖rGWNf‖SKs‖UIDi‖SNXj‖Tsnj. By creating rSNj, rGWNh, UIDi=hIDi‖ri, and hrUi‖UIDi, the assailant is able to figure out the session key SK∗=hrSNj‖rGWNf‖UIDi‖hrui‖UIDi. Nevertheless, it is impracticable for the assailant to figure out the session key without knowing these privacy parameters and finishing inversion of hash function in polynomial time. Thus, our designed protocol is capable of achieving session key security.


### 5.2. Three-Factor Security

In our designed protocol, if the assailant only knows two of three factors, he is unable to launch an attack in our designed protocol. The first possibility is that the assailant only knows smart card and biometric. In this condition, assume that the assailant capturesGEi,GFi,USC1,USC2,USC3 kept in smart card and regains σUi by the formula GENBIOUi=σUi,τUi. Later, the assailant will speculate IDi, PWi, ri, and rp to figure out UIDi∗=hIDi∗‖ri∗, UPWi∗=hPWi∗‖ri∗‖rp∗, and USC3=hUIDi‖UPWi‖σUi‖ri‖rp and confirms the correctness of the formula USC3∗=USC3. Nevertheless, the assailant cannot obtain password and sensitive parameters at the same time [4]. The smart card will suspend the session promptly after the assailant inputs the speculated password and sensitive parameters. The second possibility is that the assailant only knows password and biometric. Although the assailant has no ability to regain σUi by the formula REPBIOUi,τUi=σUi, he is able to capture the communication information SCG1,SCG2,SCG4,Tsc,UIDi,IDSNj. Even if the assailant obtains the correct password and biometric, he still cannot pass the verification of the smart card and cannot simulate the communication information. The third possibility is that the assailant only knows smart card and password. Assume that the assailant captures GEi,GFi,USC1,USC2,USC3 kept in smart card, where USC1=ri⊕hIDi‖PWi‖σUi, USC2=rp⊕hσUi‖ri, and USC3=hUIDi‖UPWi‖σUi‖ri‖rp. Due to the uniqueness of biometric, the assailant has no ability to regain σUi by the formula GENBIOUi=σUi,τUi. Without obtaining accurate biometric information to figure out USC1, USC2, and USC3, it is impossible for the assailant to imitate user to log into the gateway.


### 5.3. Perfect Forward and Backward Security

In our designed protocol, the private session key in case 1 isSK=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNiSNXj and it is counted by the stochastic digits rSNj, rGWNh, ri, and rSCn, the identities IDi, SCNi, and IDSNj, and the private key SXSNj. The private session key in case 2 is SK=hrSNj‖rGWNf‖UIDi‖hrui‖UIDi and it is counted by the stochastic digits rSNj, rGWNh, rui, and ri and the identity IDi. The private session key is counted by the hash function and the stochastic digits are variable in each session. Even if the assailant compromises the private session key SK in case 1 and case 2, he is unable to obtain any previous or future private session keys. Consequently, our designed protocol is capable of achieving perfect forward and backward security.


### 5.4. Resist Sensor Node Capture Attack

In our designed protocol, the assailant is able to capture the sensor node and obtain the informationIDSNj,SNXj kept in the sensor nodes, since the sensor nodes are placed in an unattended environment. SNXj is calculated as SNXj=hIDSNj‖SXSNj and SXSNj is the private key of sensor node that is only known to himself. Even if the assailant compromises the information kept in the sensor nodes, he is unable to accurately figure out the private parameters in sensor nodes and create the effective information in the communication process. Consequently, our designed protocol is capable of resisting sensor node capture attack.


### 5.5. Resist Stolen Smart Card Attack

In our designed protocol, smart card is one of the three factors; hence, the case where the smart card is stolen is supposed to be taken into consideration. Smart card includesGEi, GFi, USC1, USC2, and USC3, where GEi=hUIDi‖UPWi, GFi=GEi⊕GUIDi⊕UIDi, USC1=ri⊕hIDi‖PWi‖σUi, USC2=rp⊕hσUi‖ri, and USC3=hUIDi‖UPWi‖σUi‖ri‖rp; ri and rp are stochastic digits picked by Ui; and σUi is counted by GEN. Assume that the smart card is stolen by the assailant through power analysis method and the information GEi,GFi,USC1,USC2,USC3 kept in smart card is available to the assailant. The assailant is unable to speculate IDi, PWi, and σUi through USC1 and is also unable to speculate rGWNh and SXGWNh through GUIDi. Without these important parameters, the assailant is unable to imitate the smart card information. Thus, our designed protocol is capable of resisting stolen smart card attack.


### 5.6. Resist User Impersonation Attack

In our designed protocol, assume that the login request informationSCG1,SCG2,SCG4,Tsc,UIDi,IDSNj is known by the assailant. In order to compute SCG1, the assailant has to calculate GUIDi and SCNi. In order to compute SCG2, the assailant has to calculate rSCn and hSCNi‖Tsc. In order to compute SCG4, the assailant has to calculate GUIDi, SCG3, rSCn, and SCNi. To implement impersonation attack, the assailant has to speculate accurate parameters rSCn,SCNi,Tsc,rGWNh,SXGWNh,IDGWNh,IDi,PWi,ri,rp. However, it is impossible for the assailant to gain these parameters. Without these important parameters, the assailant is unable to imitate the user to participate in the communication process. Thus, our designed protocol is capable of resisting user impersonation attack.


### 5.7. Resist Gateway Impersonation Attack

In our designed protocol, whenUi delivers the registration request UIDi,UPWi to GWNH, where UIDi=hIDi‖ri and UPWi=hPWi‖ri‖rp, the assailant is able to capture this registration information and demands to reply information GEi∗,GFi∗ to Ui, where GFi∗=GEi∗⊕GUIDi∗⊕UIDi∗, GEi∗=hUIDi∗‖UPWi∗, and GUIDi∗=hrGWNh∗‖SXGWNh∗‖IDGWNh∗⊕UIDi∗. In order to accurately calculate these parameters, the assailant needs to speculate rGWNh,ri,rp,IDi,PWi,SXGWNh,IDGWNh. As the stochastic digits rGWNh,ri,rp are variable in each session, this reply will not be successful. Consequently, our designed protocol is capable of resisting gateway impersonation attack.


### 5.8. Resist Sensor Node Impersonation Attack

In our designed protocol, the assailant is able to capture the informationHSN1,HSN2,HSN3,HSN4,Tgwnh and counts UIDi∗=SNXj⊕HSN1, hrSCn‖SCNi∗=IDSNj⊕HSN2, and rGWNh∗=HSN1⊕UIDi∗⊕HSN3. Then, the assailant chooses stochastic digit rASSk and time Tass to count SKs=hrASSK‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXj, SHN1=rASSk⊕hhrSCn‖SCNi‖rGWNh|Tass, and SHN2=hrGWNh‖UIDi‖SKs‖SNXj‖Tass as the valid sensor nodes. Nevertheless, SNXj includes the private key SXSNj of SN; hence, the assailant is unable to count the accurate information SHN1,SHN2,Tass and the session key SKA. The aforementioned sensor node impersonation attack is in case 1, and case 2 is identical to case 1. Consequently, our designed protocol is capable of resisting the sensor node impersonation attack.


### 5.9. Resist Reply Attack

In our designed protocol, we apply the time stamp in our communication information to resist reply attack. Suppose that the assailant captures the foregone communication informationSCG1,SCG2,SCG4,Tsc,UIDi,IDSNj and intends to imitate the legitimate user to reply the information. GWNH computes the freshness of the information by the formula Tgwnh−Tsc≤ΔT. If it is not right, GWNH terminates the session promptly. Suppose that the assailant captures the foregone communication information HSN1,HSN2,HSN3,HSN4,Tgwnh and intends to imitate the legitimate gateway to reply the information. SNj calculates the freshness of the information by the formula Tsnj−Tgwnh≤ΔT. If it is not right, SNj terminates the session promptly. Consequently, our designed protocol is capable of resisting reply attack.


### 5.10. Resist Privileged Insider Attack

In our designed protocol,Ui delivers UIDi and UPWi to GWNH as the registration request in registration section, where UIDi=hIDi‖ri and UPWi=hPWi‖ri‖rp. If the identity and password are leaked to any privileged insider at GWNH, this will lead to abundant security risks. The privileged insider is unable to extract the accurate identity IDi and password PWi from UIDi and UPWi in the registration section on account of the irreversible one-way hash function h⋅. Unaware of the stochastic digits ri and rp, the privileged insider is also unable to extract the accurate identity IDi and password PWi from UIDi and UPWi in the registration section. Consequently, our designed protocol is capable of resisting privileged insider attack.


### 5.11. Resist Online Password-Guessing Attack

In our designed protocol, passwordPWi never emerges in the delivered information in the communication process. Although the assailant is able to capture the communication information SCG1,SCG2,SCG4,Tsc,UIDi,IDSNj, HSN1,HSN2,HSN3,HSN4,Tgwnh, SHN1,SHN2,Tsnj, and HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1, all the communication information does not directly associate with password PWi. The aforementioned condition is in case 1, and case 2 is identical to case 1. Consequently, our designed protocol is capable of resisting online password-guessing attack.


### 5.12. Resist Offline Password-Guessing Attack

In our designed protocol, the assailant is able to capture the smart card and obtain the kept informationGEi, GFi, USC1, USC2, and USC3. The smart card contents containing password are USC1=ri⊕hIDi‖PWi‖σUi and USC3=hUIDi‖UPWi‖σUi‖ri‖rp. For the purpose of speculating the password accurately, the assailant has to obtain IDi and σUi at the same time for USC1 and has to obtain IDi, ri, rp, and σUi at the same time for USC3. It is impossible for the assailant to accurately compute these parameters at the same time. Consequently, our designed protocol is capable of resisting offline password-guessing attack.


### 5.13. Resist User Tracking Attack

In our designed protocol, parameterGUIDi computed by the gateway node for the user is transformed into GUIDinew=GSC3⊕hUIDi‖UPWi after finishing the authentication process in case 1. Parameter GUIDi computed by the gateway node for the user is transformed into GUIDinew=hrGWNfnew‖SXGWNf‖IDGWNf⊕UIDi after finishing the authentication process in case 2. Without knowing the relevant parameter, only known Ui, the assailant is unable to figure out the following GUIDinew. Consequently, our designed protocol is capable of resisting user tracking attack.


### 5.14. Biometric Template Protection

In our designed protocol, the biometric information kept in smart card is first counted viaGENBIOUi=σUi,τUi and the masked with the irreversible one-way hash function USC1=ri⊕hIDi‖PWi‖σUi, USC2=rp⊕hσUi‖ri, and USC3=hUIDi‖UPWi‖σUi‖ri‖rp. Even though the smart card is captured by the assailant, he is incapable of gaining any useful biometric information because the hash function is irreversible operation. Consequently, our designed protocol is capable of protecting the biometric template.


### 5.15. Mutual Authentication

In our designed protocol,Ui delivers the login request SCG1,SCG2,SCG4,Tsc,UIDi,IDSNj to GWNH. After reception of the information, GWNH authenticates Ui by computing SCG4∗. GWNH transmits HSN1,HSN2,HSN3,HSN4,Tgwnh to SNj. After reception of the information, SNj authenticates GWNH by computing HSN4∗. SNj dispatches SHN1,SHN2,Tsnj to GWNH. After reception of the information, GWNH authenticates SNj by computing SHN2∗. GWNH transmits HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1 to Ui. After reception of the information, Ui authenticates GWNH by computing GSC4∗. The aforementioned mutual authentication is in case 1, and case 2 is identical to case 1. Consequently, our designed protocol is capable of achieving the mutual authentication.


### 5.16. User Anonymity

In our designed protocol, the assailant is able to capture the login requestSCG1,SCG2,SCG4,Tsc,UIDi,IDSNj and obtain the kept information GEi, GFi, USC1, USC2, and USC3 in the stolen smart card. The assailant will figure out identity IDi via hUIDi‖UPWi=GFi⊕SCG3, where UIDi=hIDi‖ri. In order to figure out GFi, the assailant has to speculate parameters rGWNh and SXGWNh, which are only known to GWNH. Moreover, UPWi includes parameters PWi and rp, which are only known to Ui. Consequently, our designed protocol is capable of achieving user anonymity.


## 5.1. Session Key Security

In our designed protocol, the private session key is derived from the relevant privacy parameters of the three parties involved in the communication process through hash function operation. In case 1, the private session key isSK=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXj. The information HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1 transmitted from GWNH to Ui comprises the session key; that is, GSC4=hrSCn‖GUIDinew‖SNXj‖SKh‖GFi‖Tgwnh1. Let us assume that the assailant captures the information; then the assailant intends to figure out SK∗=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXj by creating rSNj, rGWNh, rSCn, SNXj=hIDSNj‖SXSNj, hrSCn‖SCNi, and UIDi=hIDi‖ri. In case 2, the private session key is SKs=hrSNj‖rGWNf‖UIDi‖hrui‖UIDi. The information SFN2,SFN3,Tsnj dispatched from SNj to GWNF includes the session key; that is, SFN3=hrSNj‖rGWNf‖SKs‖UIDi‖SNXj‖Tsnj. By creating rSNj, rGWNh, UIDi=hIDi‖ri, and hrUi‖UIDi, the assailant is able to figure out the session key SK∗=hrSNj‖rGWNf‖UIDi‖hrui‖UIDi. Nevertheless, it is impracticable for the assailant to figure out the session key without knowing these privacy parameters and finishing inversion of hash function in polynomial time. Thus, our designed protocol is capable of achieving session key security.


## 5.2. Three-Factor Security

In our designed protocol, if the assailant only knows two of three factors, he is unable to launch an attack in our designed protocol. The first possibility is that the assailant only knows smart card and biometric. In this condition, assume that the assailant capturesGEi,GFi,USC1,USC2,USC3 kept in smart card and regains σUi by the formula GENBIOUi=σUi,τUi. Later, the assailant will speculate IDi, PWi, ri, and rp to figure out UIDi∗=hIDi∗‖ri∗, UPWi∗=hPWi∗‖ri∗‖rp∗, and USC3=hUIDi‖UPWi‖σUi‖ri‖rp and confirms the correctness of the formula USC3∗=USC3. Nevertheless, the assailant cannot obtain password and sensitive parameters at the same time [4]. The smart card will suspend the session promptly after the assailant inputs the speculated password and sensitive parameters. The second possibility is that the assailant only knows password and biometric. Although the assailant has no ability to regain σUi by the formula REPBIOUi,τUi=σUi, he is able to capture the communication information SCG1,SCG2,SCG4,Tsc,UIDi,IDSNj. Even if the assailant obtains the correct password and biometric, he still cannot pass the verification of the smart card and cannot simulate the communication information. The third possibility is that the assailant only knows smart card and password. Assume that the assailant captures GEi,GFi,USC1,USC2,USC3 kept in smart card, where USC1=ri⊕hIDi‖PWi‖σUi, USC2=rp⊕hσUi‖ri, and USC3=hUIDi‖UPWi‖σUi‖ri‖rp. Due to the uniqueness of biometric, the assailant has no ability to regain σUi by the formula GENBIOUi=σUi,τUi. Without obtaining accurate biometric information to figure out USC1, USC2, and USC3, it is impossible for the assailant to imitate user to log into the gateway.


## 5.3. Perfect Forward and Backward Security

In our designed protocol, the private session key in case 1 isSK=hrSNj‖rGWNh‖UIDi‖hrSCn‖SCNiSNXj and it is counted by the stochastic digits rSNj, rGWNh, ri, and rSCn, the identities IDi, SCNi, and IDSNj, and the private key SXSNj. The private session key in case 2 is SK=hrSNj‖rGWNf‖UIDi‖hrui‖UIDi and it is counted by the stochastic digits rSNj, rGWNh, rui, and ri and the identity IDi. The private session key is counted by the hash function and the stochastic digits are variable in each session. Even if the assailant compromises the private session key SK in case 1 and case 2, he is unable to obtain any previous or future private session keys. Consequently, our designed protocol is capable of achieving perfect forward and backward security.


## 5.4. Resist Sensor Node Capture Attack

In our designed protocol, the assailant is able to capture the sensor node and obtain the informationIDSNj,SNXj kept in the sensor nodes, since the sensor nodes are placed in an unattended environment. SNXj is calculated as SNXj=hIDSNj‖SXSNj and SXSNj is the private key of sensor node that is only known to himself. Even if the assailant compromises the information kept in the sensor nodes, he is unable to accurately figure out the private parameters in sensor nodes and create the effective information in the communication process. Consequently, our designed protocol is capable of resisting sensor node capture attack.


## 5.5. Resist Stolen Smart Card Attack

In our designed protocol, smart card is one of the three factors; hence, the case where the smart card is stolen is supposed to be taken into consideration. Smart card includesGEi, GFi, USC1, USC2, and USC3, where GEi=hUIDi‖UPWi, GFi=GEi⊕GUIDi⊕UIDi, USC1=ri⊕hIDi‖PWi‖σUi, USC2=rp⊕hσUi‖ri, and USC3=hUIDi‖UPWi‖σUi‖ri‖rp; ri and rp are stochastic digits picked by Ui; and σUi is counted by GEN. Assume that the smart card is stolen by the assailant through power analysis method and the information GEi,GFi,USC1,USC2,USC3 kept in smart card is available to the assailant. The assailant is unable to speculate IDi, PWi, and σUi through USC1 and is also unable to speculate rGWNh and SXGWNh through GUIDi. Without these important parameters, the assailant is unable to imitate the smart card information. Thus, our designed protocol is capable of resisting stolen smart card attack.


## 5.6. Resist User Impersonation Attack

In our designed protocol, assume that the login request informationSCG1,SCG2,SCG4,Tsc,UIDi,IDSNj is known by the assailant. In order to compute SCG1, the assailant has to calculate GUIDi and SCNi. In order to compute SCG2, the assailant has to calculate rSCn and hSCNi‖Tsc. In order to compute SCG4, the assailant has to calculate GUIDi, SCG3, rSCn, and SCNi. To implement impersonation attack, the assailant has to speculate accurate parameters rSCn,SCNi,Tsc,rGWNh,SXGWNh,IDGWNh,IDi,PWi,ri,rp. However, it is impossible for the assailant to gain these parameters. Without these important parameters, the assailant is unable to imitate the user to participate in the communication process. Thus, our designed protocol is capable of resisting user impersonation attack.


## 5.7. Resist Gateway Impersonation Attack

In our designed protocol, whenUi delivers the registration request UIDi,UPWi to GWNH, where UIDi=hIDi‖ri and UPWi=hPWi‖ri‖rp, the assailant is able to capture this registration information and demands to reply information GEi∗,GFi∗ to Ui, where GFi∗=GEi∗⊕GUIDi∗⊕UIDi∗, GEi∗=hUIDi∗‖UPWi∗, and GUIDi∗=hrGWNh∗‖SXGWNh∗‖IDGWNh∗⊕UIDi∗. In order to accurately calculate these parameters, the assailant needs to speculate rGWNh,ri,rp,IDi,PWi,SXGWNh,IDGWNh. As the stochastic digits rGWNh,ri,rp are variable in each session, this reply will not be successful. Consequently, our designed protocol is capable of resisting gateway impersonation attack.


## 5.8. Resist Sensor Node Impersonation Attack

In our designed protocol, the assailant is able to capture the informationHSN1,HSN2,HSN3,HSN4,Tgwnh and counts UIDi∗=SNXj⊕HSN1, hrSCn‖SCNi∗=IDSNj⊕HSN2, and rGWNh∗=HSN1⊕UIDi∗⊕HSN3. Then, the assailant chooses stochastic digit rASSk and time Tass to count SKs=hrASSK‖rGWNh‖UIDi‖hrSCn‖SCNi‖SNXj, SHN1=rASSk⊕hhrSCn‖SCNi‖rGWNh|Tass, and SHN2=hrGWNh‖UIDi‖SKs‖SNXj‖Tass as the valid sensor nodes. Nevertheless, SNXj includes the private key SXSNj of SN; hence, the assailant is unable to count the accurate information SHN1,SHN2,Tass and the session key SKA. The aforementioned sensor node impersonation attack is in case 1, and case 2 is identical to case 1. Consequently, our designed protocol is capable of resisting the sensor node impersonation attack.


## 5.9. Resist Reply Attack

In our designed protocol, we apply the time stamp in our communication information to resist reply attack. Suppose that the assailant captures the foregone communication informationSCG1,SCG2,SCG4,Tsc,UIDi,IDSNj and intends to imitate the legitimate user to reply the information. GWNH computes the freshness of the information by the formula Tgwnh−Tsc≤ΔT. If it is not right, GWNH terminates the session promptly. Suppose that the assailant captures the foregone communication information HSN1,HSN2,HSN3,HSN4,Tgwnh and intends to imitate the legitimate gateway to reply the information. SNj calculates the freshness of the information by the formula Tsnj−Tgwnh≤ΔT. If it is not right, SNj terminates the session promptly. Consequently, our designed protocol is capable of resisting reply attack.


## 5.10. Resist Privileged Insider Attack

In our designed protocol,Ui delivers UIDi and UPWi to GWNH as the registration request in registration section, where UIDi=hIDi‖ri and UPWi=hPWi‖ri‖rp. If the identity and password are leaked to any privileged insider at GWNH, this will lead to abundant security risks. The privileged insider is unable to extract the accurate identity IDi and password PWi from UIDi and UPWi in the registration section on account of the irreversible one-way hash function h⋅. Unaware of the stochastic digits ri and rp, the privileged insider is also unable to extract the accurate identity IDi and password PWi from UIDi and UPWi in the registration section. Consequently, our designed protocol is capable of resisting privileged insider attack.


## 5.11. Resist Online Password-Guessing Attack

In our designed protocol, passwordPWi never emerges in the delivered information in the communication process. Although the assailant is able to capture the communication information SCG1,SCG2,SCG4,Tsc,UIDi,IDSNj, HSN1,HSN2,HSN3,HSN4,Tgwnh, SHN1,SHN2,Tsnj, and HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1, all the communication information does not directly associate with password PWi. The aforementioned condition is in case 1, and case 2 is identical to case 1. Consequently, our designed protocol is capable of resisting online password-guessing attack.


## 5.12. Resist Offline Password-Guessing Attack

In our designed protocol, the assailant is able to capture the smart card and obtain the kept informationGEi, GFi, USC1, USC2, and USC3. The smart card contents containing password are USC1=ri⊕hIDi‖PWi‖σUi and USC3=hUIDi‖UPWi‖σUi‖ri‖rp. For the purpose of speculating the password accurately, the assailant has to obtain IDi and σUi at the same time for USC1 and has to obtain IDi, ri, rp, and σUi at the same time for USC3. It is impossible for the assailant to accurately compute these parameters at the same time. Consequently, our designed protocol is capable of resisting offline password-guessing attack.


## 5.13. Resist User Tracking Attack

In our designed protocol, parameterGUIDi computed by the gateway node for the user is transformed into GUIDinew=GSC3⊕hUIDi‖UPWi after finishing the authentication process in case 1. Parameter GUIDi computed by the gateway node for the user is transformed into GUIDinew=hrGWNfnew‖SXGWNf‖IDGWNf⊕UIDi after finishing the authentication process in case 2. Without knowing the relevant parameter, only known Ui, the assailant is unable to figure out the following GUIDinew. Consequently, our designed protocol is capable of resisting user tracking attack.


## 5.14. Biometric Template Protection

In our designed protocol, the biometric information kept in smart card is first counted viaGENBIOUi=σUi,τUi and the masked with the irreversible one-way hash function USC1=ri⊕hIDi‖PWi‖σUi, USC2=rp⊕hσUi‖ri, and USC3=hUIDi‖UPWi‖σUi‖ri‖rp. Even though the smart card is captured by the assailant, he is incapable of gaining any useful biometric information because the hash function is irreversible operation. Consequently, our designed protocol is capable of protecting the biometric template.


## 5.15. Mutual Authentication

In our designed protocol,Ui delivers the login request SCG1,SCG2,SCG4,Tsc,UIDi,IDSNj to GWNH. After reception of the information, GWNH authenticates Ui by computing SCG4∗. GWNH transmits HSN1,HSN2,HSN3,HSN4,Tgwnh to SNj. After reception of the information, SNj authenticates GWNH by computing HSN4∗. SNj dispatches SHN1,SHN2,Tsnj to GWNH. After reception of the information, GWNH authenticates SNj by computing SHN2∗. GWNH transmits HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1 to Ui. After reception of the information, Ui authenticates GWNH by computing GSC4∗. The aforementioned mutual authentication is in case 1, and case 2 is identical to case 1. Consequently, our designed protocol is capable of achieving the mutual authentication.


## 5.16. User Anonymity

In our designed protocol, the assailant is able to capture the login requestSCG1,SCG2,SCG4,Tsc,UIDi,IDSNj and obtain the kept information GEi, GFi, USC1, USC2, and USC3 in the stolen smart card. The assailant will figure out identity IDi via hUIDi‖UPWi=GFi⊕SCG3, where UIDi=hIDi‖ri. In order to figure out GFi, the assailant has to speculate parameters rGWNh and SXGWNh, which are only known to GWNH. Moreover, UPWi includes parameters PWi and rp, which are only known to Ui. Consequently, our designed protocol is capable of achieving user anonymity.


## 6. Performance Comparison

In this section, we will demonstrate performance comparisons of our proposed mutual authentication protocol with other related mutual authentication protocols in terms of security, computation time, and communication cost.


### 6.1. Security Comparison

The security comparison result is shown in Table1. From [1], we know that [25] cannot resist offline and online password-guessing attack. As shown in [25], the authors’ security analysis does not mention or refer to IF5, IF7, IF10, and IF13. As shown in [46], the authors’ security analysis does not mention or refer to IF2, IF4, and IF11. From [1], we know that [45] and [9] cannot resist IF5 and cannot achieve IF16 and IF3. As shown in [50], the authors’ security analysis does not mention or refer to IF2, IF4, IF11, IF12, and IF14. As shown in [8], the authors’ security analysis does not mention or refer to IF3, IF5, IF7, and IF14. From [47], we know that [48] cannot resist reply and sensor node capture attacks. As shown in [47], the authors’ security analysis does not mention or refer to IF2, IF11, and IF12. As shown in [49], the authors’ security analysis does not mention or refer to IF2, IF13, IF14, and IF15.Table 1
Security comparison.
[45][9][46][25][47][48][8][49][50]OursIF1YYYYYYYYYYIF2YYNYNYYNNYIF3NNYYYYNYYYIF4YYNYYNYYNYIF5NNYNYYNYYYIF6YYYYYYYYYYIF7YYYNYYNYYYIF8YYYYYYYYYYIF9YYYYYNYYYYIF10YYYNYYYYYYIF11YYNNNYYYNYIF12YYYNNYYYNYIF13YYYNYYYNYYIF14YYYYYYNNNYIF15YYYYYYYNYYIF16NNYYYYYYYYIF1: session key security; IF2: three-factor security; IF3: perfect forward and backward security; IF4: resist sensor node capture attack; IF5: resist stolen smart card attack; IF6: resist user impersonation attack; IF7: resist gateway impersonation attack; IF8: resist sensor node impersonation attack; IF9: resist reply attack; IF10: resist privileged insider attack; IF11: resist online password-guessing attack; IF12: resist offline password-guessing attack; IF13: resist user tracking attack; IF14: biometric template protection; IF15: mutual authentication; IF16: user anonymity; Y: yes; N: no or not mentioned.


### 6.2. Computation Time Comparison

The computation time comparison result is presented in Table2. We directly obtain the communication costs in the corresponding references as shown in Table 2. We can see that some references [47–49] add fingerprint operations to communication cost, while some references [8, 9, 25, 45] do not. In order to make a unified communication cost comparison, we will not add the fingerprint operations to communication cost. In this comparison, we specify that H represents the time of hash function operation, E/D represents the time of encryption and decryption operation, MM represents the time of modular multiplication operation, and EM represents the time of ECC point multiplication operation. We apply the experimental results of EM = 0.0171 s [46], H = 0.00032 s [7], E/D = 0.0056 s [7], and MM = 0.0002586 s [47] to compute computation cost. The total communication time in our designed protocol is 27H = 0.00864 s in case 1 and 43H = 0.0137 s in case 2. Although the communication cost is higher than the communication time in [7], our designed protocol has higher level of security. Compared with other authentication protocols, no matter in case 1 or in case 2, our designed protocol has higher level of computation cost and is more suitable for the resource-constrained wireless sensor networks.Table 2
Computation time comparison.
UserSensor nodeHome gateway/base stationForeign gateway/base stationTotal time[45]6H + 2E/D5H + 1E/D8H + 3E/D5H + 2E/D24H + 8E/D = 0.0524 s[9]14H4H17H035H = 0.0112 s[46]8H + 3EM07H + 3EM015H + 6EM = 0.107 s[25]8H + 3EM4H + 2EM8H + EM020H + 6EM = 0.109 s[47]9H+ 2EM5H10H + 1EM024H + 3EM = 0.0589 s[48]9H + 1E/D4H + 2E/D6H + 3E/D + 2MM019H + 6E/D + 2MM = 0.0412 s[8]Case 1: 13HCase 2: 18HCase 1: 6HCase 2: 6HCase 1: 17HCase 2: 10HCase 1: 0HCase 2: 14HCase 1: 36H = 0.0115 sCase 2: 48H = 0.0153 s[49]Case 1: 12H + 3EMCase 2: 12H + 4EMCase 1: 5HCase 2: 5HCase 1: 6H + 3 EMCase 2: 0Case 1: 0Case 2: 8H + 3EMCase 1: 23H + 6EM = 0.1099 sCase 2: 25H + 6EM = 0.111 s[50]Case 1: 7H + 2EMCase 2: 7H + 2EMCase 1: 4H + 2EMCase 2: 4H + 2EMCase 1: 11HCase 2: 9H + 1EMCase 1: 0HCase 2: 8H + 1EMCase 1: 22H + 4EM = 0.0754 sCase 2: 28H + 6EM = 0.1116 sOursCase 1: 12HCase 2: 16HCase 1: 5HCase 2: 7HCase 1: 12HCase 2: 6HCase 1: 0HCase 2: 14HCase 1: 27H = 0.00864 sCase 2: 43H = 0.0137 s


### 6.3. Communication Cost Comparison

The communication cost comparison result is revealed in Table3. In order to make a unified and thorough communication cost comparison, we make the following assumptions that the identity of user is 160 bits, the identity of gateway node or base station is 160 bits, the identity of sensor node is 32 bits, the stochastic digit is 128 bits, the result of symmetric encryption/decryption is 128 bits, the time stamp size is 32 bits, the result of hash function is 160 bits, and the result of ECC point multiplication operation is 160 bits.Table 3
Communication cost comparison.
User (bits)Sensor node (bits)Home gateway/base station (bits)Foreign gateway/base station (bits)Total cost (bits)[45]6083524487362144[9]983352134402679[46]864051201376[25]64048096002080[47]928416131202656[48]512160144002112[8]Case 1: 864Case 2: 512Case 1: 352Case 2: 352Case 1: 1344Case 2: 1184Case 1: 0Case 2: 1376Case 1: 2560Case 2: 3424[49]Case 1: 1024Case 2: 1024Case 1: 352Case 2: 352Case 1: 800Case 2: 544Case 1: 0Case 2: 800Case 1: 2176Case 2: 2720[50]Case 1: 864Case 2: 864Case 1: 1728Case 2: 1728Case 1: 640Case 2: 832Case 1: 0Case 2: 1504Case 1: 3232Case 2: 4928OursCase 1: 704Case 2: 512Case 1: 352Case 2: 352Case 1: 1472Case 2: 480Case 1: 0Case 2: 1920Case 1: 2528Case 2: 3264In case 1, the communication cost of the informationSCG1,SCG2,SCG4,Tsc,UIDi,IDSNj delivered from Ui to GWNH is 160 bits + 160 bits + 160 bits + 32 bits + 160 bits + 32 bits = 704 bits; the communication cost of the information HSN1,HSN2,HSN3,HSN4,Tgwnh transmitted from GWNH to SNj is 160 bits + 160 bits + 128 bits + 160 bits + 32 bits = 640 bits; the communication cost of the information SHN1,SHN2,Tsnj dispatched from SNj to GWNH is 160 bits + 160 bits + 32 bits = 352 bits; and the communication cost of the information HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1 transmitted from GWNH to Ui is 160 bits + 160 bits + 160bits + 160 bits + 160 bits + 32 bits = 832 bits.In case 2, the communication cost of the informationFHN1,FHN2,FHN3,FHN4 transmitted from GWNF to GWNH is 160 bits + 160 bits + 128 bits + 160 bits = 608 bits; the communication cost of the information FHN2,GSC6,GSC7 transmitted from GWNH to Ui is 160 + 160 + 160 = 480 bits; the communication cost of the information SCF5,SCF6,SCF7,Tui delivered from Ui to GWNF is 160 bits + 160 bits + 160 bits + 32 bits = 512 bits; the communication cost of the information FSN1,FSN2,FSN3,FSN4,Tgwnf transmitted from GWNF to SNj is 160 bits + 160 bits + 160 bits + 160 bits + 32 bits = 672 bits; the communication cost of the information SFN2,SFN3,Tsnj dispatched from SNj to GWNF is 160 bits + 160 bits + 32 bits = 352 bits; and the communication cost of the information FSC1,FSC2,FSC3,FSC4,Tgwnf1 transmitted from GWNF to Ui is 128 bits + 160 bits + 160 bits + 160 bits + 32 bits = 640 bits.Compared with the other authentication protocols, the total communication cost in our protocol is a bit higher than those in the other protocols [25, 45, 46, 48, 49]. During the authentication process, the number of information exchanges in the protocols in [46, 48, 49] is less than ours and the sensor nodes require more communication cost than the gateway node in the protocol in [50]. Because the sensor nodes are resource-constrained, the communication costs of the sensor nodes shall be reduced. The sensor nodes’ communication costs in our protocol are lower than those in the other comparison protocols. The communication cost is acceptable as our designed authentication protocol achieves additional security features and has lower computation time.


## 6.1. Security Comparison

The security comparison result is shown in Table1. From [1], we know that [25] cannot resist offline and online password-guessing attack. As shown in [25], the authors’ security analysis does not mention or refer to IF5, IF7, IF10, and IF13. As shown in [46], the authors’ security analysis does not mention or refer to IF2, IF4, and IF11. From [1], we know that [45] and [9] cannot resist IF5 and cannot achieve IF16 and IF3. As shown in [50], the authors’ security analysis does not mention or refer to IF2, IF4, IF11, IF12, and IF14. As shown in [8], the authors’ security analysis does not mention or refer to IF3, IF5, IF7, and IF14. From [47], we know that [48] cannot resist reply and sensor node capture attacks. As shown in [47], the authors’ security analysis does not mention or refer to IF2, IF11, and IF12. As shown in [49], the authors’ security analysis does not mention or refer to IF2, IF13, IF14, and IF15.Table 1
Security comparison.
[45][9][46][25][47][48][8][49][50]OursIF1YYYYYYYYYYIF2YYNYNYYNNYIF3NNYYYYNYYYIF4YYNYYNYYNYIF5NNYNYYNYYYIF6YYYYYYYYYYIF7YYYNYYNYYYIF8YYYYYYYYYYIF9YYYYYNYYYYIF10YYYNYYYYYYIF11YYNNNYYYNYIF12YYYNNYYYNYIF13YYYNYYYNYYIF14YYYYYYNNNYIF15YYYYYYYNYYIF16NNYYYYYYYYIF1: session key security; IF2: three-factor security; IF3: perfect forward and backward security; IF4: resist sensor node capture attack; IF5: resist stolen smart card attack; IF6: resist user impersonation attack; IF7: resist gateway impersonation attack; IF8: resist sensor node impersonation attack; IF9: resist reply attack; IF10: resist privileged insider attack; IF11: resist online password-guessing attack; IF12: resist offline password-guessing attack; IF13: resist user tracking attack; IF14: biometric template protection; IF15: mutual authentication; IF16: user anonymity; Y: yes; N: no or not mentioned.


## 6.2. Computation Time Comparison

The computation time comparison result is presented in Table2. We directly obtain the communication costs in the corresponding references as shown in Table 2. We can see that some references [47–49] add fingerprint operations to communication cost, while some references [8, 9, 25, 45] do not. In order to make a unified communication cost comparison, we will not add the fingerprint operations to communication cost. In this comparison, we specify that H represents the time of hash function operation, E/D represents the time of encryption and decryption operation, MM represents the time of modular multiplication operation, and EM represents the time of ECC point multiplication operation. We apply the experimental results of EM = 0.0171 s [46], H = 0.00032 s [7], E/D = 0.0056 s [7], and MM = 0.0002586 s [47] to compute computation cost. The total communication time in our designed protocol is 27H = 0.00864 s in case 1 and 43H = 0.0137 s in case 2. Although the communication cost is higher than the communication time in [7], our designed protocol has higher level of security. Compared with other authentication protocols, no matter in case 1 or in case 2, our designed protocol has higher level of computation cost and is more suitable for the resource-constrained wireless sensor networks.Table 2
Computation time comparison.
UserSensor nodeHome gateway/base stationForeign gateway/base stationTotal time[45]6H + 2E/D5H + 1E/D8H + 3E/D5H + 2E/D24H + 8E/D = 0.0524 s[9]14H4H17H035H = 0.0112 s[46]8H + 3EM07H + 3EM015H + 6EM = 0.107 s[25]8H + 3EM4H + 2EM8H + EM020H + 6EM = 0.109 s[47]9H+ 2EM5H10H + 1EM024H + 3EM = 0.0589 s[48]9H + 1E/D4H + 2E/D6H + 3E/D + 2MM019H + 6E/D + 2MM = 0.0412 s[8]Case 1: 13HCase 2: 18HCase 1: 6HCase 2: 6HCase 1: 17HCase 2: 10HCase 1: 0HCase 2: 14HCase 1: 36H = 0.0115 sCase 2: 48H = 0.0153 s[49]Case 1: 12H + 3EMCase 2: 12H + 4EMCase 1: 5HCase 2: 5HCase 1: 6H + 3 EMCase 2: 0Case 1: 0Case 2: 8H + 3EMCase 1: 23H + 6EM = 0.1099 sCase 2: 25H + 6EM = 0.111 s[50]Case 1: 7H + 2EMCase 2: 7H + 2EMCase 1: 4H + 2EMCase 2: 4H + 2EMCase 1: 11HCase 2: 9H + 1EMCase 1: 0HCase 2: 8H + 1EMCase 1: 22H + 4EM = 0.0754 sCase 2: 28H + 6EM = 0.1116 sOursCase 1: 12HCase 2: 16HCase 1: 5HCase 2: 7HCase 1: 12HCase 2: 6HCase 1: 0HCase 2: 14HCase 1: 27H = 0.00864 sCase 2: 43H = 0.0137 s


## 6.3. Communication Cost Comparison

The communication cost comparison result is revealed in Table3. In order to make a unified and thorough communication cost comparison, we make the following assumptions that the identity of user is 160 bits, the identity of gateway node or base station is 160 bits, the identity of sensor node is 32 bits, the stochastic digit is 128 bits, the result of symmetric encryption/decryption is 128 bits, the time stamp size is 32 bits, the result of hash function is 160 bits, and the result of ECC point multiplication operation is 160 bits.Table 3
Communication cost comparison.
User (bits)Sensor node (bits)Home gateway/base station (bits)Foreign gateway/base station (bits)Total cost (bits)[45]6083524487362144[9]983352134402679[46]864051201376[25]64048096002080[47]928416131202656[48]512160144002112[8]Case 1: 864Case 2: 512Case 1: 352Case 2: 352Case 1: 1344Case 2: 1184Case 1: 0Case 2: 1376Case 1: 2560Case 2: 3424[49]Case 1: 1024Case 2: 1024Case 1: 352Case 2: 352Case 1: 800Case 2: 544Case 1: 0Case 2: 800Case 1: 2176Case 2: 2720[50]Case 1: 864Case 2: 864Case 1: 1728Case 2: 1728Case 1: 640Case 2: 832Case 1: 0Case 2: 1504Case 1: 3232Case 2: 4928OursCase 1: 704Case 2: 512Case 1: 352Case 2: 352Case 1: 1472Case 2: 480Case 1: 0Case 2: 1920Case 1: 2528Case 2: 3264In case 1, the communication cost of the informationSCG1,SCG2,SCG4,Tsc,UIDi,IDSNj delivered from Ui to GWNH is 160 bits + 160 bits + 160 bits + 32 bits + 160 bits + 32 bits = 704 bits; the communication cost of the information HSN1,HSN2,HSN3,HSN4,Tgwnh transmitted from GWNH to SNj is 160 bits + 160 bits + 128 bits + 160 bits + 32 bits = 640 bits; the communication cost of the information SHN1,SHN2,Tsnj dispatched from SNj to GWNH is 160 bits + 160 bits + 32 bits = 352 bits; and the communication cost of the information HSN3,GSC1,GSC2,GSC3,GSC4,Thgwn1 transmitted from GWNH to Ui is 160 bits + 160 bits + 160bits + 160 bits + 160 bits + 32 bits = 832 bits.In case 2, the communication cost of the informationFHN1,FHN2,FHN3,FHN4 transmitted from GWNF to GWNH is 160 bits + 160 bits + 128 bits + 160 bits = 608 bits; the communication cost of the information FHN2,GSC6,GSC7 transmitted from GWNH to Ui is 160 + 160 + 160 = 480 bits; the communication cost of the information SCF5,SCF6,SCF7,Tui delivered from Ui to GWNF is 160 bits + 160 bits + 160 bits + 32 bits = 512 bits; the communication cost of the information FSN1,FSN2,FSN3,FSN4,Tgwnf transmitted from GWNF to SNj is 160 bits + 160 bits + 160 bits + 160 bits + 32 bits = 672 bits; the communication cost of the information SFN2,SFN3,Tsnj dispatched from SNj to GWNF is 160 bits + 160 bits + 32 bits = 352 bits; and the communication cost of the information FSC1,FSC2,FSC3,FSC4,Tgwnf1 transmitted from GWNF to Ui is 128 bits + 160 bits + 160 bits + 160 bits + 32 bits = 640 bits.Compared with the other authentication protocols, the total communication cost in our protocol is a bit higher than those in the other protocols [25, 45, 46, 48, 49]. During the authentication process, the number of information exchanges in the protocols in [46, 48, 49] is less than ours and the sensor nodes require more communication cost than the gateway node in the protocol in [50]. Because the sensor nodes are resource-constrained, the communication costs of the sensor nodes shall be reduced. The sensor nodes’ communication costs in our protocol are lower than those in the other comparison protocols. The communication cost is acceptable as our designed authentication protocol achieves additional security features and has lower computation time.


## 7. Conclusion

To overcome the problems that the sensor nodes need to execute heavy calculation and communication consumption during the authentication process and cannot resist node capture attack and that the protocols also cannot provide perfect forward and backward security and cannot resist replay attack, we put forward a novel multifactor user authentication and key agreement scheme for multigateway wireless sensor networks in this paper. In our authentication protocol, we apply the lightweight hash function and given biometric information to achieve a higher level of security and efficiency, as well as a larger communication coverage area. Our authentication protocol meets sixteen evaluation criteria. We separately apply BAN logic, random oracle model, and AVISPA tool to validate the security of our authentication protocol. Our authentication protocol is able to achieve higher security and is more efficient in communication and computation costs as compared with the related authentication protocols.



---

*Source: 2037188-2021-08-04.xml*