# A Provably Secure Anonymous Authenticated Key Exchange Protocol Based on ECC for Wireless Sensor Networks

Authors: Ke Zhang; Kai Xu; Fushan Wei
Journal: Wireless Communications and Mobile Computing
 (2018)

---

## Abstract

In wireless sensor networks, users sometimes need to retrieve real-time data directly from the sensor nodes. Many authentication protocols are proposed to address the security and privacy aspects of this scenario. However, these protocols still have security loopholes and fail to provide strong user anonymity. In order to overcome these shortcomings, we propose an anonymous authenticated key exchange protocol based on Elliptic Curves Cryptography (ECC). The novel protocol provides strong user anonymity such that even the gateway node and the sensor nodes do not know the real identity of the user. The security of the proposed protocol is conducted in a well-defined security model under the CDH assumption. Compared with other related protocols, our protocol is efficient in terms of communication and enjoys stronger security. The only disadvantage is that our protocol consumes more computation resources due to the usage of asymmetric cryptography mechanisms to realize strong anonymity. Consequently, our protocol is suitable for applications which require strong anonymity and high security in wireless sensor networks.


---

## Body

## 1. Introduction

### 1.1. Background

As an important part of Internet of things, wireless sensor networks (WSNs) draw more and more attentions from the industrial and the researchers. Typically, a WSN is composed of numerous tiny sensor nodes. These sensor nodes can be deployed in unattended or hostile environments to collect valuable data of interest. For example, a large amount of visual data such as images and videos can be collected by visual sensor nodes [1]. These nodes have the characteristics of easy deployment, low cost, and high mobility [2]. Due to these merits, WSNs are very useful in many application scenarios, such as natural disaster prevention, machine health monitoring, air temperature monitoring, health care monitoring, and battlefield surveillance.Usually, the data collected by the sensor nodes will be transmitted to and aggregated by a gateway node periodically. Whenever a user wants to get access to the aggregated data from the gateway node, he will authenticate himself to the gateway node. However, in some application scenarios such as health care monitoring and battlefield surveillance, users have great needs to access the data directly from the sensor nodes. Under such circumstances, the user first sends a request to the gateway node for accessing the real-time data. The gateway will authenticate whether the user is valid or not. If the user is valid, a common session key will be established between the user and the sensor node with the help of the gateway node. The session key can later be used to protect confidentiality and integrity of the data [3].


### 1.2. Related Work

In order to address the security aspects under the above-mentioned application scenario, many authentication protocols are proposed [4–7]. In 2009, Das [8] proposed a two-factor user authentication protocol, which is claimed to have strong authentication and session key establishment and achieves efficiency. Unfortunately, Khan et al. [9] soon found that Das’s protocol is vulnerable to the gateway node bypassing attack and the privileged-insider attack. Besides, Das’s protocol also fails to provide password update and mutual authentication. Khan et al. also presented an improved protocol to fix the susceptibilities of the original protocol. In 2011, Yeh et al. [10] pointed out several weaknesses of Das’s protocol. They also design an ECC-Based authentication protocol to meet the needs of applications with higher security requirements. In 2013, Xue et al. [11] proposed a temporal-credential-based mutual authentication scheme among the user, the gateway node, and the sensor node. A credential is issued by the gateway node to each user for authentication. Their protocol only involves lightweight operations such as XOR and hash and is suitable for resource-constrained WSNs. Nevertheless, He et al. [12] soon pointed out that Xue et al.’s protocol is vulnerable to the offline password guessing attack, the user impersonation attack, the sensor node impersonation attack, and the modification attack. They also proposed an improved temporal-credential-based protocol to remedy the weaknesses. Yuan et al. [13] proposed an authentication scheme for WSNs based on pubic key mechanism and biometric characteristics of the user to realize strong authentication. In 2014, Wang et al. [14] analyzed two authentication schemes for WSNs and demonstrated several loopholes. They also investigate the underlying rationale of the security failures and put forward three basic principles for designing secure authentication protocols in WSNs. In 2016, Shen et al. [15] proposed an efficient multilayer authentication protocol and a secure session key generation method for WSNs. They also designed a one-to-many group authentication protocol and a certificate-less authentication protocol, which is of independent interest.Recently, researchers begin to focus on user’s privacy protection in WSNs. Wu et al. [16] proposed an anonymous authentication scheme based on ECC for WSNs with formal security proof. Jiang et al. [17] designed an anonymous lightweight three-factor authentication scheme for WSNs. The security of their protocol is conducted using ProVerif. Wang et al. [20] put forward a new authentication which can resist all known attacks for WSNs. Moreover, they explore the design principle of authentication schemes. They also designed a biometric-based authentication scheme and proved its security using the Burrows-Abadi-Needham (BAN) logic [18]. Li et al. [19] proposed a three-factor anonymous authentication scheme for WSNs. They use fuzzy commitment to deal with the user’s biometric template.


### 1.3. Motivation and Contribution

Until now, there are many authentication protocols designed for protection of security and privacy when accessing real-time data in WSNs. However, there are still some problems which are not solved. Firstly, most of these protocols only have informal heuristic security arguments. It is quite common such that a protocol which is claimed to be secure is soon found to be vulnerable to several attacks. What is worse, the improved protocol still has many vulnerabilities. Secondly, the existing protocol pays little attention to user’s privacy. Only few protocols provide user anonymity and these protocols only achieve weak anonymity; i.e., the real identity is hidden to an adversary but is known to the gateway node and sometimes even the sensor node knows the real identity of the user. Last but not least, the existing protocols rely on efficient XOR, symmetric encryption, and hash operations to provide better efficiency. Although these protocols can meet the characteristics of constrained storage, computation, and communication capabilities of sensor nodes, they fail to provide strong security guarantee. For security-critical applications such as battlefield surveillance, security and privacy are more important than the computation and communication efficiency.In this paper, we investigate the design of anonymous and strongly secure authenticated key exchange protocol in WSNs. We propose an efficient authenticated key exchange protocol for the scenario in which the user wants to access the real-time data directly from the sensor node. The novel protocol has the following advantages. First of all, our protocol enjoys formal security proof in a well-defined security model. The security is conducted in the random oracle model under the CDH assumption. Second, our protocol provides the strongest anonymity in the sense the real identity of the user is only known to himself. Neither the gateway node nor the sensor node can obtain any information of the user’s identity, not to mention the adversary. Thirdly, our protocol achieves more security attributes than other related protocols. Consequently, it is more secure than other related protocol and is particularly suitable for security-critical applications in WSNs. The only disadvantage is that it needs more computation resources. However, security and privacy are more important than the computation efficiency in security-critic application. So our protocol is suitable for security-critical applications in WSNs.The rest of the paper is organized as follows. In Section2, we present the security model and some preliminaries. We describe the details of the proposed protocol in Section 3. The security proof is given in the random oracle model in Section 4. The performance comparison with other related protocols is summarized in Section 5. We conclude this paper in Section 6.


## 1.1. Background

As an important part of Internet of things, wireless sensor networks (WSNs) draw more and more attentions from the industrial and the researchers. Typically, a WSN is composed of numerous tiny sensor nodes. These sensor nodes can be deployed in unattended or hostile environments to collect valuable data of interest. For example, a large amount of visual data such as images and videos can be collected by visual sensor nodes [1]. These nodes have the characteristics of easy deployment, low cost, and high mobility [2]. Due to these merits, WSNs are very useful in many application scenarios, such as natural disaster prevention, machine health monitoring, air temperature monitoring, health care monitoring, and battlefield surveillance.Usually, the data collected by the sensor nodes will be transmitted to and aggregated by a gateway node periodically. Whenever a user wants to get access to the aggregated data from the gateway node, he will authenticate himself to the gateway node. However, in some application scenarios such as health care monitoring and battlefield surveillance, users have great needs to access the data directly from the sensor nodes. Under such circumstances, the user first sends a request to the gateway node for accessing the real-time data. The gateway will authenticate whether the user is valid or not. If the user is valid, a common session key will be established between the user and the sensor node with the help of the gateway node. The session key can later be used to protect confidentiality and integrity of the data [3].


## 1.2. Related Work

In order to address the security aspects under the above-mentioned application scenario, many authentication protocols are proposed [4–7]. In 2009, Das [8] proposed a two-factor user authentication protocol, which is claimed to have strong authentication and session key establishment and achieves efficiency. Unfortunately, Khan et al. [9] soon found that Das’s protocol is vulnerable to the gateway node bypassing attack and the privileged-insider attack. Besides, Das’s protocol also fails to provide password update and mutual authentication. Khan et al. also presented an improved protocol to fix the susceptibilities of the original protocol. In 2011, Yeh et al. [10] pointed out several weaknesses of Das’s protocol. They also design an ECC-Based authentication protocol to meet the needs of applications with higher security requirements. In 2013, Xue et al. [11] proposed a temporal-credential-based mutual authentication scheme among the user, the gateway node, and the sensor node. A credential is issued by the gateway node to each user for authentication. Their protocol only involves lightweight operations such as XOR and hash and is suitable for resource-constrained WSNs. Nevertheless, He et al. [12] soon pointed out that Xue et al.’s protocol is vulnerable to the offline password guessing attack, the user impersonation attack, the sensor node impersonation attack, and the modification attack. They also proposed an improved temporal-credential-based protocol to remedy the weaknesses. Yuan et al. [13] proposed an authentication scheme for WSNs based on pubic key mechanism and biometric characteristics of the user to realize strong authentication. In 2014, Wang et al. [14] analyzed two authentication schemes for WSNs and demonstrated several loopholes. They also investigate the underlying rationale of the security failures and put forward three basic principles for designing secure authentication protocols in WSNs. In 2016, Shen et al. [15] proposed an efficient multilayer authentication protocol and a secure session key generation method for WSNs. They also designed a one-to-many group authentication protocol and a certificate-less authentication protocol, which is of independent interest.Recently, researchers begin to focus on user’s privacy protection in WSNs. Wu et al. [16] proposed an anonymous authentication scheme based on ECC for WSNs with formal security proof. Jiang et al. [17] designed an anonymous lightweight three-factor authentication scheme for WSNs. The security of their protocol is conducted using ProVerif. Wang et al. [20] put forward a new authentication which can resist all known attacks for WSNs. Moreover, they explore the design principle of authentication schemes. They also designed a biometric-based authentication scheme and proved its security using the Burrows-Abadi-Needham (BAN) logic [18]. Li et al. [19] proposed a three-factor anonymous authentication scheme for WSNs. They use fuzzy commitment to deal with the user’s biometric template.


## 1.3. Motivation and Contribution

Until now, there are many authentication protocols designed for protection of security and privacy when accessing real-time data in WSNs. However, there are still some problems which are not solved. Firstly, most of these protocols only have informal heuristic security arguments. It is quite common such that a protocol which is claimed to be secure is soon found to be vulnerable to several attacks. What is worse, the improved protocol still has many vulnerabilities. Secondly, the existing protocol pays little attention to user’s privacy. Only few protocols provide user anonymity and these protocols only achieve weak anonymity; i.e., the real identity is hidden to an adversary but is known to the gateway node and sometimes even the sensor node knows the real identity of the user. Last but not least, the existing protocols rely on efficient XOR, symmetric encryption, and hash operations to provide better efficiency. Although these protocols can meet the characteristics of constrained storage, computation, and communication capabilities of sensor nodes, they fail to provide strong security guarantee. For security-critical applications such as battlefield surveillance, security and privacy are more important than the computation and communication efficiency.In this paper, we investigate the design of anonymous and strongly secure authenticated key exchange protocol in WSNs. We propose an efficient authenticated key exchange protocol for the scenario in which the user wants to access the real-time data directly from the sensor node. The novel protocol has the following advantages. First of all, our protocol enjoys formal security proof in a well-defined security model. The security is conducted in the random oracle model under the CDH assumption. Second, our protocol provides the strongest anonymity in the sense the real identity of the user is only known to himself. Neither the gateway node nor the sensor node can obtain any information of the user’s identity, not to mention the adversary. Thirdly, our protocol achieves more security attributes than other related protocols. Consequently, it is more secure than other related protocol and is particularly suitable for security-critical applications in WSNs. The only disadvantage is that it needs more computation resources. However, security and privacy are more important than the computation efficiency in security-critic application. So our protocol is suitable for security-critical applications in WSNs.The rest of the paper is organized as follows. In Section2, we present the security model and some preliminaries. We describe the details of the proposed protocol in Section 3. The security proof is given in the random oracle model in Section 4. The performance comparison with other related protocols is summarized in Section 5. We conclude this paper in Section 6.


## 2. Security Model

In this section, we briefly recall the security model presented in [21, 22]. The security of our protocol will be conducted in this formal security model.Protocol Participants. The participants of an authentication and key exchange protocol for real-time data retrieval in WSNs involves users U, a gateway node G
N, and a sensor node S
i. Each user U registers with the gateway node and each sensor node S
i shares a common secret key with the gateway node.Protocol Execution. All the participants are modeled as a PPT Turing machine. The i-th instance of a participant P is denoted by P
i. All the communication channels are managed by a probabilistic polynomial time adversary A. The adversary A can intercept, delay, modify, and even forge a message at will. The capabilities of the adversary are captured through oracle queries. The adversary can make the following oracle queries:(i)
E
x
e
c
u
t
e
(
U
x
,
G
N
y
,
S
i
z
): the execution query captures the passive eavesdrop ability of A. In reply to this oracle query, A will get all the transcripts of the authentication instance executed among a user instance U
x, a gateway node instance G
N
y, and a sensor node instance S
i
z.
(ii)
S
e
n
d
(
P
i
,
m
): the send query captures the active attack ability of A. Through the S
e
n
d
(
P
i
,
m
) query, A sends a modified or forged message m to instance P
i in the name of another participant instance. A will get the message generated by the participant instance P
i upon receiving the message m according to the description of the protocol. The participant P can be a user, a gateway node, or a sensor node.
(iii)
C
o
r
r
u
p
t
(
U
,
P
W
): this query captures the compromise of the user’s password. The adversary A only gets the password of the victim user; it can neither control nor compromise the credential of the user.
(iv)
C
o
r
r
u
p
t
(
U
,
c
r
e
d
): this query captures the compromise of the user’s terminal. The adversary A can extract the credential issued by the gateway node and control the victim user’s terminal. However, the password of the user is still unknown to A.
(v)
C
o
r
r
u
p
t
(
S
i
): this query captures the compromise of a sensor node S
i. The adversary A will get the secret key and control the sensor node through this query.
(vi)
R
e
v
e
a
l
(
P
i
): this query can only be asked to a user instance or a sensor node instance. If the instance P
i accepts the session and generates a session key, A will get the session key. Otherwise, A will get the symbol ⊥ which means the instance P
i does not hold a session key.
(vii)
T
e
s
t
(
P
i
): this query does not capture any real attack ability of A but is used to measure the security of the session key held by instance P
i. Upon receiving this query, the simulator will flip a coin b. If the result is 1, then it returns the real session key to A. If the result is 0, the simulator will send a random session key of the same length with the real session key to A. A has to distinguish if the key is real or random. In other words, A has to guess the coin flip result.The session identification (sid) is defined as the transcripts shared between a user instance and a sensor node instance. The partner identification (pid) of an instance is defined to be the participant with whom the instance wants to establish a common session key. We say a user instanceU
x and a sensor node instance S
i
z are partners if the following conditions are satisfied: (
1
) these two instances both accept and generate the same session key; (
2
) these two instances share the same sid; (
3
) the pid of U
x is S
i and the pid of S
i
z is U; and (
4
) no other instances accept the same sid with U
x and S
i
z.If the adversaryA asks both C
o
r
r
u
p
t
(
U
,
c
r
e
d
) and C
o
r
r
u
p
t
(
U
,
P
W
), the user M
U is said to be fully corrupted. When defining the AKE security of the session key, we do not consider the corruption of the gateway node. This is because once the gateway node is corrupted; there is nothing we can do to guarantee the security of the protocol. A user instance or a sensor node instance P
i is said to be fresh if (
1
)
A does not send R
e
v
e
a
l queries to the instance or its partner; and (
2
) the user or the sensor node is not fully corrupted by A.AKE Security. The security of the session keys is captured by the AKE security. The adversary A is restricted to ask T
e
s
t queries to fresh instances only; otherwise the adversary A can trivially win the attack game. The adversary A is given access to all the oracle queries; the only restriction is that A only can ask one T
e
s
t query to a fresh instance. The adversary A needs to guess the hidden bit b used by the simulator when answering the T
e
s
t query. If A correctly guesses the random bit, then we say A wins the AKE security game. We denote this event by S
u
c
c. With respect to the distribution of the passwords, we use the Zipf’s law put forward by Wang et al. [21] instead of assuming a uniform distribution. The adversary A’s advantage in attacking the AKE security of a protocol P, when passwords are chosen according to the Zipf’s law of a dictionary D, is defined as follows:(1)
A
d
v
P
,
D
a
k
e
A
=
2
·
P
r
S
u
c
c
-
1An authentication and key exchange protocolP is said to be AKE secure if for all PPT adversary A, the advantage A
d
v
P
,
D
a
k
e
(
A
) is only negligible larger than C
′
·
q
s
e
n
d
s
′, where C
′ and s
′ are Zipf parameters and q
s
e
n
d is the number of active attack sessions. Moreover, C
′ and s
′ are constants depending on the password data set and can be calculated by linear regression.


## 3. Description of the Protocol

In this section, we describe the proposed anonymous authenticated key exchange protocol based on ECC for WSNs. The most important benefit of ECC is that it provides the same level of security with a smaller key size compared to other cryptography mechanisms such as RSA. So it suits the needs of the resource-constrained nature of the WSN. Our protocol has three phases: the setup phase, the registration phase, the authentication, and key exchange phase. The detailed steps of each phase are described in the following. The symbols used in this paper are summarized in Table1.Table 1
Notations.
notation
meaning
notation
meaning
I
D
G
W
identity of the gateway node
I
D
U
identity of the userU
I
D
S
i
identity of the sensor nodeS
i
p
,
n
large prime numbers
F
p
a finite field
E
an elliptic curve defined onF
p
E
(
F
p
)
the set of rational points inE
s
G
N
secret key of the gateway node
P
W
U
the password of the userU
⊕
exclusive OR
∥
concatenation
h
(
m
)
cryptographic hash of messagem
s
i
g
n
s
G
N
(
m
)
signature ofm singed by s
G
N
T
G
N
/
S
i
timestamp ofG
N
/
S
i


### 3.1. The Setup Phase

Letp be a large prime and F
p be a finite field of prime order p. Let E be an elliptic curve cryptosystem satisfying the equation y
2
=
(
x
3
+
a
x
+
b
)
m
o
d
p such that a
,
b
∈
F
p and 4
a
3
+
27
b
2
m
o
d
p
≠
0. The set of rational points in E over finite field F
p is denoted by E
(
F
p
). More precisely, E
(
F
p
)
=
{
x
;
y
:
x
,
y
∈
F
p
s
u
c
h
t
h
a
t
y
2
=
x
3
+
a
x
+
b
m
o
d
p
}
∪
{
O
}, where O is the point at infinity. Let G be a cyclic group generated by P, where P
∈
E
(
F
p
) has a large prime order n. These parameters (
F
p
,
E
,
E
(
F
p
)
,
G
,
P
) are the system parameters and can be chosen by a trusted third party or the gateway node. The gateway node (G
N) chooses a random number s
G
N
∈
Z
n
∗ as his private key and computes the corresponding public key Q
G
N
=
s
G
N
P. The public key Q
G
N is published in the whole network. Define six hash functions such that H
1
:
{
0,1
}
∗
→
Z
n
∗, H
2
:
{
0,1
}
∗
→
G
∗, H
0
,
H
3
,
H
4
,
H
5
:
{
0,1
}
∗
→
{
0,1
}
κ, where κ is the security parameter. All these parameters (
F
p
,
E
,
E
(
F
p
)
,
G
,
P
,
Q
G
N
,
H
i
(
i
=
0,1
,
…
,
5
)
) are available to all the entities in the WSN.


### 3.2. The Registration Phase

If a userU wants to access the data collected by the sensor nodes in the WSN, U has to register himself to the gateway node. For a pictorial illustration of the user registration, please refer to Figure 1. The detailed steps are described in the following.Figure 1
Registration phase of mobile user.Step 1.
The userU randomly chooses his identity I
D
U and his password P
W
U from the password dictionary. U sends his identity I
D
U to the gateway node G
N through a secure channel.Step 2.
When the gateway nodeG
N receives the registration request from the user, G
N verifies the validity of the U
′
s identity I
D
U. If it is valid and there is no other user in its database registers using the same identity, G
N first computes the credential σ
=
1
/
s
G
N
+
H
1
(
I
D
U
)
P. Then G
N chooses a random number r
∈
Z
n
∗ and computes c
=
H
1
(
P
,
Q
G
N
,
H
1
(
I
D
U
)
,
σ
,
R
1
,
R
2
) and s
=
(
r
+
c
s
G
N
)
m
o
d
n, where R
1
=
r
σ, R
2
=
r
P. At last, G
N sends the registration message (
σ
,
c
,
s
) to the user U through a secure channel.Step 3.
When the userU receives the registration message (
σ
,
c
,
s
) from G
N, U will verify the validity of the message. U computes R
1
∗
=
(
s
+
c
H
1
(
I
D
U
)
)
σ
-
c
P, R
2
∗
=
s
P
-
c
Q
G
N, and c
∗
=
H
1
(
g
,
Q
G
N
,
H
1
(
I
D
U
)
,
σ
,
R
1
∗
,
R
2
∗
). U verifies whether c
∗ is equal to c or not. If the verification is successful, U will accept σ as a valid credential. Finally, U computes c
r
e
d
=
σ
+
H
2
(
P
W
U
) and then stores his password-protected credential c
r
e
d in his terminal.The registration of the sensor node is rather simple compared with the user registration. The sensor nodeS
i sends the registration request to the gateway node G
N through a secure channel. Upon receiving the request, the gateway node G
N will compute a symmetric key K
(
G
N
,
S
i
)
=
H
3
(
G
N
,
S
i
,
s
G
N
) and send the symmetric key K
(
G
N
,
S
i
) to S
i through a secure channel.


### 3.3. The Authentication and Key Exchange Phase

Suppose a userU wants to get the real-time data from the sensor node S
i, U has to execute the authentication and key exchange phase with the gateway node G
N and the sensor node S
i. During this phase, the user U, the gateway node G
N, and the sensor node S
i will authenticate each other. At the end of this phase, a session key will be established between U and S
i to protect the upcoming data transmission. The detailed steps of the authentication and key exchange phase are described as follows. For a pictorial illustration, please refer to Figure 2.Figure 2
Authentication and key exchange phase.Step 1.
The userU types his password P
W
U to his terminal. The terminal will compute H
2
(
P
W
U
) and recovers the credential σ from the stored c
r
e
d. U then chooses a random number x
∈
Z
n
∗ and computes X
=
x
P. U defines the label of this session as l
a
b
e
l
=
(
I
D
G
N
,
I
D
S
i
). U chooses three random numbers a
,
r
m
,
r
a
∈
Z
n
∗ and computes T
=
a
σ, R
3
=
r
a
P
-
r
m
T, c
1
=
H
1
(
P
,
T
,
R
3
,
X
,
l
a
b
e
l
), s
m
=
r
m
+
c
1
H
1
(
I
D
U
)
m
o
d
n, and s
a
=
r
a
+
c
1
a
m
o
d
n. Finally, U sends the message (
l
a
b
e
l
,
X
,
T
,
c
1
,
s
m
,
s
a
) to the gateway node G
N.Step 2.
Upon receiving the message(
l
a
b
e
l
,
X
,
T
,
c
1
,
s
m
,
s
a
) from the user, G
N needs to authenticate the user U. G
N computes V
=
s
G
N
T, R
3
∗
=
s
a
P
-
c
1
V
-
s
m
T, and c
1
∗
=
H
1
(
P
,
T
,
R
3
∗
,
X
,
l
a
b
e
l
). G
N checks whether c
1
∗ is equal to c
1 or not. If the verification is successful, G
N authenticates the user U and believes the user U is a valid user. G
N then computes the shared key with the sensor node K
(
G
N
,
S
i
)
=
H
3
(
G
N
,
S
i
,
s
G
N
) and the authenticator A
u
t
h
G
N
=
H
4
(
K
(
G
N
,
S
i
)
,
X
,
l
a
b
l
e
,
T
G
N
), where T
G
N is the current timestamp of G
N. Finally, G
N send the message (
l
a
b
e
l
,
X
,
T
G
N
,
A
u
t
h
G
N
) to the sensor node S
i.Step 3.
Upon receiving the message(
l
a
b
e
l
,
X
,
T
G
N
,
A
u
t
h
G
N
) from G
N at time T
G
N
∗, the sensor node S
i first checks whether T
G
N
∗
-
T
G
N
≤
△
T, where △
T is the expected time interval for the transmission delay. If this is true, S
i then verifies the validity of the authenticator A
u
t
h
G
N using its private key K
(
G
N
,
S
i
). If the authenticator is valid, S
i chooses a random number y
∈
Z
n
∗ and computes Y
=
y
P. S
i then computes the authenticator A
u
t
h
S
i
=
H
5
(
K
(
G
N
,
S
i
)
,
X
,
Y
,
T
G
N
,
T
S
i
,
l
a
b
e
l
), where T
S
i is the current timestamp of S
i. S
i computes the Diffie-Hellman key K
=
y
X and the session key s
k
=
H
0
(
l
a
b
e
l
,
X
,
Y
,
K
). Finally, S
i sends the message (
S
i
,
Y
,
T
S
i
,
A
u
t
h
S
i
) to the gateway node G
N.Step 4.
Upon receiving the message(
S
i
,
Y
,
T
S
i
,
A
u
t
h
S
i
) from S
i at time T
S
i
∗, G
N first checks whether T
S
i
∗
-
T
S
i
≤
△
T, where △
T is the expected time interval for the transmission delay. If this is true, G
N then computes the shared key with the sensor node K
(
G
N
,
S
i
)
=
H
3
(
G
N
,
S
i
,
s
G
N
) and verifies the validity of the authenticator A
u
t
h
S
i. If the verification is successful, G
N computes r
G
N
=
H
1
(
l
a
b
e
l
,
X
,
T
,
c
1
,
s
m
,
s
a
,
Y
) and signs the random number r
G
N using his private key s
G
N; the signature is denoted by σ
G
N. Finally, G
N sends the message (
Y
,
σ
G
N
) to the user U.Step 5.
Upon receiving the message(
Y
,
σ
G
N
) from G
N, U first verifies the validity of the signature σ
G
N. U computes the random number r
G
N
∗
=
H
1
(
l
a
b
e
l
,
X
,
T
,
c
1
,
s
m
,
s
a
,
Y
) and checks if σ
G
N is a valid signature for r
G
N
∗ singed by G
N. If the verification is successful, U computes the Diffie-Hellman key K
=
x
Y and the session key s
k
=
H
0
(
l
a
b
e
l
,
X
,
Y
,
K
). U will accept the session and wait for the upcoming communication.


## 3.1. The Setup Phase

Letp be a large prime and F
p be a finite field of prime order p. Let E be an elliptic curve cryptosystem satisfying the equation y
2
=
(
x
3
+
a
x
+
b
)
m
o
d
p such that a
,
b
∈
F
p and 4
a
3
+
27
b
2
m
o
d
p
≠
0. The set of rational points in E over finite field F
p is denoted by E
(
F
p
). More precisely, E
(
F
p
)
=
{
x
;
y
:
x
,
y
∈
F
p
s
u
c
h
t
h
a
t
y
2
=
x
3
+
a
x
+
b
m
o
d
p
}
∪
{
O
}, where O is the point at infinity. Let G be a cyclic group generated by P, where P
∈
E
(
F
p
) has a large prime order n. These parameters (
F
p
,
E
,
E
(
F
p
)
,
G
,
P
) are the system parameters and can be chosen by a trusted third party or the gateway node. The gateway node (G
N) chooses a random number s
G
N
∈
Z
n
∗ as his private key and computes the corresponding public key Q
G
N
=
s
G
N
P. The public key Q
G
N is published in the whole network. Define six hash functions such that H
1
:
{
0,1
}
∗
→
Z
n
∗, H
2
:
{
0,1
}
∗
→
G
∗, H
0
,
H
3
,
H
4
,
H
5
:
{
0,1
}
∗
→
{
0,1
}
κ, where κ is the security parameter. All these parameters (
F
p
,
E
,
E
(
F
p
)
,
G
,
P
,
Q
G
N
,
H
i
(
i
=
0,1
,
…
,
5
)
) are available to all the entities in the WSN.


## 3.2. The Registration Phase

If a userU wants to access the data collected by the sensor nodes in the WSN, U has to register himself to the gateway node. For a pictorial illustration of the user registration, please refer to Figure 1. The detailed steps are described in the following.Figure 1
Registration phase of mobile user.Step 1.
The userU randomly chooses his identity I
D
U and his password P
W
U from the password dictionary. U sends his identity I
D
U to the gateway node G
N through a secure channel.Step 2.
When the gateway nodeG
N receives the registration request from the user, G
N verifies the validity of the U
′
s identity I
D
U. If it is valid and there is no other user in its database registers using the same identity, G
N first computes the credential σ
=
1
/
s
G
N
+
H
1
(
I
D
U
)
P. Then G
N chooses a random number r
∈
Z
n
∗ and computes c
=
H
1
(
P
,
Q
G
N
,
H
1
(
I
D
U
)
,
σ
,
R
1
,
R
2
) and s
=
(
r
+
c
s
G
N
)
m
o
d
n, where R
1
=
r
σ, R
2
=
r
P. At last, G
N sends the registration message (
σ
,
c
,
s
) to the user U through a secure channel.Step 3.
When the userU receives the registration message (
σ
,
c
,
s
) from G
N, U will verify the validity of the message. U computes R
1
∗
=
(
s
+
c
H
1
(
I
D
U
)
)
σ
-
c
P, R
2
∗
=
s
P
-
c
Q
G
N, and c
∗
=
H
1
(
g
,
Q
G
N
,
H
1
(
I
D
U
)
,
σ
,
R
1
∗
,
R
2
∗
). U verifies whether c
∗ is equal to c or not. If the verification is successful, U will accept σ as a valid credential. Finally, U computes c
r
e
d
=
σ
+
H
2
(
P
W
U
) and then stores his password-protected credential c
r
e
d in his terminal.The registration of the sensor node is rather simple compared with the user registration. The sensor nodeS
i sends the registration request to the gateway node G
N through a secure channel. Upon receiving the request, the gateway node G
N will compute a symmetric key K
(
G
N
,
S
i
)
=
H
3
(
G
N
,
S
i
,
s
G
N
) and send the symmetric key K
(
G
N
,
S
i
) to S
i through a secure channel.


## 3.3. The Authentication and Key Exchange Phase

Suppose a userU wants to get the real-time data from the sensor node S
i, U has to execute the authentication and key exchange phase with the gateway node G
N and the sensor node S
i. During this phase, the user U, the gateway node G
N, and the sensor node S
i will authenticate each other. At the end of this phase, a session key will be established between U and S
i to protect the upcoming data transmission. The detailed steps of the authentication and key exchange phase are described as follows. For a pictorial illustration, please refer to Figure 2.Figure 2
Authentication and key exchange phase.Step 1.
The userU types his password P
W
U to his terminal. The terminal will compute H
2
(
P
W
U
) and recovers the credential σ from the stored c
r
e
d. U then chooses a random number x
∈
Z
n
∗ and computes X
=
x
P. U defines the label of this session as l
a
b
e
l
=
(
I
D
G
N
,
I
D
S
i
). U chooses three random numbers a
,
r
m
,
r
a
∈
Z
n
∗ and computes T
=
a
σ, R
3
=
r
a
P
-
r
m
T, c
1
=
H
1
(
P
,
T
,
R
3
,
X
,
l
a
b
e
l
), s
m
=
r
m
+
c
1
H
1
(
I
D
U
)
m
o
d
n, and s
a
=
r
a
+
c
1
a
m
o
d
n. Finally, U sends the message (
l
a
b
e
l
,
X
,
T
,
c
1
,
s
m
,
s
a
) to the gateway node G
N.Step 2.
Upon receiving the message(
l
a
b
e
l
,
X
,
T
,
c
1
,
s
m
,
s
a
) from the user, G
N needs to authenticate the user U. G
N computes V
=
s
G
N
T, R
3
∗
=
s
a
P
-
c
1
V
-
s
m
T, and c
1
∗
=
H
1
(
P
,
T
,
R
3
∗
,
X
,
l
a
b
e
l
). G
N checks whether c
1
∗ is equal to c
1 or not. If the verification is successful, G
N authenticates the user U and believes the user U is a valid user. G
N then computes the shared key with the sensor node K
(
G
N
,
S
i
)
=
H
3
(
G
N
,
S
i
,
s
G
N
) and the authenticator A
u
t
h
G
N
=
H
4
(
K
(
G
N
,
S
i
)
,
X
,
l
a
b
l
e
,
T
G
N
), where T
G
N is the current timestamp of G
N. Finally, G
N send the message (
l
a
b
e
l
,
X
,
T
G
N
,
A
u
t
h
G
N
) to the sensor node S
i.Step 3.
Upon receiving the message(
l
a
b
e
l
,
X
,
T
G
N
,
A
u
t
h
G
N
) from G
N at time T
G
N
∗, the sensor node S
i first checks whether T
G
N
∗
-
T
G
N
≤
△
T, where △
T is the expected time interval for the transmission delay. If this is true, S
i then verifies the validity of the authenticator A
u
t
h
G
N using its private key K
(
G
N
,
S
i
). If the authenticator is valid, S
i chooses a random number y
∈
Z
n
∗ and computes Y
=
y
P. S
i then computes the authenticator A
u
t
h
S
i
=
H
5
(
K
(
G
N
,
S
i
)
,
X
,
Y
,
T
G
N
,
T
S
i
,
l
a
b
e
l
), where T
S
i is the current timestamp of S
i. S
i computes the Diffie-Hellman key K
=
y
X and the session key s
k
=
H
0
(
l
a
b
e
l
,
X
,
Y
,
K
). Finally, S
i sends the message (
S
i
,
Y
,
T
S
i
,
A
u
t
h
S
i
) to the gateway node G
N.Step 4.
Upon receiving the message(
S
i
,
Y
,
T
S
i
,
A
u
t
h
S
i
) from S
i at time T
S
i
∗, G
N first checks whether T
S
i
∗
-
T
S
i
≤
△
T, where △
T is the expected time interval for the transmission delay. If this is true, G
N then computes the shared key with the sensor node K
(
G
N
,
S
i
)
=
H
3
(
G
N
,
S
i
,
s
G
N
) and verifies the validity of the authenticator A
u
t
h
S
i. If the verification is successful, G
N computes r
G
N
=
H
1
(
l
a
b
e
l
,
X
,
T
,
c
1
,
s
m
,
s
a
,
Y
) and signs the random number r
G
N using his private key s
G
N; the signature is denoted by σ
G
N. Finally, G
N sends the message (
Y
,
σ
G
N
) to the user U.Step 5.
Upon receiving the message(
Y
,
σ
G
N
) from G
N, U first verifies the validity of the signature σ
G
N. U computes the random number r
G
N
∗
=
H
1
(
l
a
b
e
l
,
X
,
T
,
c
1
,
s
m
,
s
a
,
Y
) and checks if σ
G
N is a valid signature for r
G
N
∗ singed by G
N. If the verification is successful, U computes the Diffie-Hellman key K
=
x
Y and the session key s
k
=
H
0
(
l
a
b
e
l
,
X
,
Y
,
K
). U will accept the session and wait for the upcoming communication.


## 4. Security Proof

In this section, we present the security proof of our protocol. The security proof is conducted in the security model presented in Section2.Theorem 1.
SupposeP is the anonymous authentication and key exchange protocol for WSN described in the previous section and A is a PPT time adversary against the AKE security of P who runs in time t and makes at most Q
s
e
n
d queries of Send oracle to different instances. If the signature scheme used in our protocol is existential unforgeable against adaptive chosen message attacks, the hash functions H
i
(
·
)
(
i
=
0,2
,
…
,
5
) are all modeled as random oracles; then under the CDH assumption, the advantage of the adversary A in violating the AKE security of the protocol P is at most(2)
A
d
v
P
,
D
a
k
e
A
≤
C
′
·
Q
s
e
n
d
s
′
+
n
e
g
l
κ
.Proof.
We use the hybrid experiments technique to prove Theorem1. These hybrid experiments start with the real attack scenario. We gradually change the simulation rules in each experiment. In the last experiment, the advantage of the adversary in distinguishing the session key is negligible. We also estimate the advantage difference of the adversary between two hybrid experiments and the advantage of the adversary in breaking the AKE security can be calculated. We denote the adversary’s advantage in hybrid E
x
p
i using A
d
v
i
(
A
).Experiment
E
x
p
0. This is the real attack scenario defined in the security model. In this experiment, the adversary has access to all the oracles. According to the definition of A’s advantage, we have the following result:(3)
A
d
v
P
,
D
a
k
e
A
=
A
d
v
0
A
.Experiment
E
x
p
1. In this experiment, we simulate all the hash function H
i
(
·
)
(
i
=
0,1
,
…
,
5
) by maintaining hash lists Λ
H
i
(
i
=
0,1
,
…
,
5
) using the following rules:(i)
On a queryH
i
(
m
), if a record (
i
,
m
,
r
) exists in Λ
H
i, then return r. Otherwise, the output r is chosen according to the following rule: R
u
l
e
H
i.
ifi
=
1, choose a random element r from z
n
∗. Then add the record (
1
,
m
,
r
) to Λ
H
i.
ifi
=
2, choose a random element r from G. Then add the record (
2
,
m
,
r
) to Λ
H
2.
ifi
=
0,3
,
4,5, choose a random element r from {
0,1
}
κ. Then add record (
i
,
m
,
r
) to Λ
H
i.In addition to these lists, we also simulate six private hash oraclesH
i
′
(
i
=
0,1
,
…
,
5
) by maintaining hash lists ∧
H
i
′
(
i
=
0,1
,
…
,
5
). We will use these private hash functions in the following hybrid experiments. It is well known that a hash function can be simulated perfectly in PPT time using the above rules; thus, we have(4)
A
d
v
1
A
-
A
d
v
0
A
≤
n
e
g
l
κ
.Experiment
E
x
p
2
. In this experiment, we cancel the sessions if some unlikely collisions occur in these sessions. To be more specific, if some collisions occur in the simulation of the hash functions or on the transcripts of (
(
X
,
Y
,
T
,
c
1
,
s
m
,
s
a
,
σ
G
N
)
), we will terminate the session and let the adversary win. Based on the birthday paradox, we have the following result:(5)
A
d
v
2
A
-
A
d
v
1
A
≤
n
e
g
l
κ
.Experiment
E
x
p
3
. In this experiment, we modify the simulation rules of sessions by E
x
e
c
u
t
e queries. Whenever we need to compute the session key in a passive session, we use the private hash oracle H
0
′ instead of H
0. Moreover, the Diffie-Hellman key K is not used as an input. In other words, the session key of a passive session is computed as s
k
=
H
0
′
(
l
a
b
e
l
,
X
,
Y
). The adversary can distinguish the experiment E
x
p
3 and the previous experiment E
x
p
2 if and only if the adversary sends a hash query (
l
a
b
e
l
,
X
,
Y
,
K
) to the hash oracle H
0 in which X
,
Y is generated in a passive session and K
=
C
D
H
(
X
,
Y
). However, if the adversary can issue such a query, we can use the ability of the adversary to solve the CDH problem.Given a CDH instance(
U
,
V
), we can embed the instance to all the passive session using the self-reducibility of the CDH problem. In order to do so, we choose four random numbers a
0
,
b
0
,
a
1
,
b
1
∈
Z
n
∗ for each passive session. In simulation the transcripts, we simply set X
=
a
0
U
+
b
0
P and Y
=
a
1
V
+
b
1
P. All other transcripts are simulated as usual until the computation of the session key. The session key is computed as s
k
=
H
0
′
(
l
a
b
e
l
,
X
,
Y
). If an adversary can distinguish between this experiment and the previous one, then a query (
l
a
b
e
l
,
X
,
Y
,
K
) must be issued to the hash oracle H
0. We can compute the Diffie-Hellman value of (
U
,
V
) by selecting a random record (
0
,
(
l
a
b
e
l
,
X
,
Y
,
K
)
,
r
) in ∧
H
0 and computing (
K
-
a
0
b
1
U
-
a
1
b
0
V
-
b
0
b
1
P
)
/
a
0
a
1.Under the intractability assumption of the CDH problem, we have(6)
A
d
v
3
A
-
A
d
v
2
A
≤
n
e
g
l
κ
.Experiment
E
x
p
4
.In this experiment, we begin to deal with the active sessions. For a S
e
n
d
(
U
,
(
Y
,
σ
G
N
)
) query, if the signature σ
G
N is a valid signature for this active session, we simply terminate the simulation and let the adversary win. Since the user U is honest in this session, the message (
X
,
T
,
c
1
,
s
m
,
s
a
) is generated by the user U. Besides, we cancel the experiment in which the collision occurs in the output of the hash functions and the transcripts in E
x
p
2, so the signature σ
G
N is valid if it is a signature for the random number r
G
N. The adversary wins the game in this experiment if and only if a new signature is forged. The signature scheme used in our protocol is existential unforgeable against the chosen message attacks, so the advantage of the adversary A in forging a signature for a new random number is negligible. It is obvious that(7)
A
d
v
4
A
-
A
d
v
3
A
≤
n
e
g
l
κ
.Experiment
E
x
p
5. In this experiment, we continue to deal with the active sessions. For a S
e
n
d
(
G
N
,
(
S
i
,
Y
,
T
S
i
,
A
u
t
h
S
i
)
) query, if the sensor node S
i is uncorrupted, the timestamp T
S
i is within the transmission delay and A
u
t
h
S
i is a valid authenticator; then we simply terminate the simulation and let the adversary win the attack game. Since the sensor node S
i is uncorrupted, the symmetric key K
(
G
N
,
S
i
) is unknown to the adversary. Moreover, the timestamp T
S
i makes the replay attack impossible. The adversary can only produce a valid authenticator A
u
t
h
S
i by issuing a query (
K
(
G
N
,
S
i
)
,
X
,
Y
,
T
G
N
,
T
S
i
,
l
a
b
e
l
) to the hash oracle H
5 or the adversary correctly guesses the output of the hash function H
5 without asking the corresponding message. K
(
G
N
,
S
i
) and A
u
t
h
S
i are two random values chosen from {
0,1
}
κ; the success probability of the adversary is negligible. Consequently we have the following equation:(8)
A
d
v
5
A
-
A
d
v
4
A
≤
n
e
g
l
κ
.Experiment
E
x
p
6. In this experiment, we deal with the active sessions once again. For a S
e
n
d
(
S
i
,
(
l
a
b
e
l
,
X
,
T
G
N
,
A
u
t
h
G
N
)
) query, if the timestamp T
G
N is within the transmission delay and A
u
t
h
G
N is a valid authenticator, then we simply terminate the simulation and let the adversary win the attack game. Since the gateway node is not allowed to be corrupted, the symmetric key K
(
G
N
,
S
i
) is unknown to the adversary and the timestamp T
G
N ensures the adversary cannot replay an old authenticator. The adversary can only produce a valid authenticator A
u
t
h
G
N by issuing a query (
K
(
G
N
,
S
i
)
,
X
,
l
a
b
l
e
,
T
G
N
) to the hash oracle H
4 or the adversary correctly guesses the output of the hash function H
4 without asking the corresponding message. K
(
G
N
,
S
i
) and A
u
t
h
S
i are two random values chosen from {
0,1
}
κ; the success probability of the adversary is negligible. Similarly with the previous experiment, we have(9)
A
d
v
6
A
-
A
d
v
5
A
≤
n
e
g
l
κ
.Experiment
E
x
p
7
. In this experiment, we change the simulation rule of S
e
n
d queries for the last time. For a S
e
n
d
(
G
N
,
(
l
a
b
e
l
,
X
,
T
,
c
1
,
s
m
,
s
a
)
) query, the gateway node will first check the validity of the credential proof. If the credential proof is valid and the message is forged by the adversary, we then terminate the simulation and the adversary is claimed successful. However, the success probability of the adversary in producing a fake proof is bounded by the presentation of an algebraic MAC. With a similar analysis with [23], we get the following result:(10)
A
d
v
7
A
-
A
d
v
6
A
≤
n
e
g
l
κ
.In the last experiment, we can see that all the session keys of passive sessions are chosen randomly from the domain and all the active sessions are terminated without accepting. The only way for the adversary to succeed is to steal the terminal of the user and recover the credential by guessing the password. The adversary has to verify the correctness of the recovered credential by executing the protocol. Consequently, we have(11)
A
d
v
7
A
≤
C
′
·
Q
s
e
n
d
s
′
.


## 5. Performance Analysis

In this section, we evaluate the computation and communication costs and the security attributes of our protocol with other related protocols with user anonymity [16–19]. In terms of computation, let “T
M” denote the time of one modular exponentiation computation, “T
P
M” denote the time cost of one point multiplication computation on elliptic curve, ‘T
H” denote the time of one hash function computation, and “T
S” denote the time of one symmetric encryption/decryption operation. According to [24], T
M
≈
1.169
m
s, T
P
M
≈
0.508
m
s, T
H
≈
0.069
m
s, and T
S
≈
0.069
m
s. Moreover, we only evaluate the computation cost of the authentication and key exchange phase because the registration phase is a one-time job. In terms of communication cost, we assume the length of the identity is 32 bits, the secure parameter κ is 160 bits, the length of the timestamp is 64 bits, an element of cyclic group of ECC can be represented with 320 bits, and an element of cyclic group of RSA can be presented with 1024 bits. We also instantiate the signature scheme using the famous ECDSA signature scheme [25]. The performance of communication and computation is summarized in Table 2. We can see from Table 2 that our protocol is inefficient in terms of computation. However, the communication performance of the compared protocols is more or less the same. The computation cost of our protocols mainly arises from the strong user anonymity; i.e., no one except the user knows his real identity in our protocol, while the gateway node knows the user’s real identity in other protocols.Table 2
Comparisons of computation and communication costs.
Protocols
Wu et al.’s [16]
Jiang et al.’s [17]
Wang et al.’s [18]
Li et al.’s [19]
Our protocol
Computation time of user (ms)
2
T
P
M
+
T
S
+
11
T
H
≈
1.04
T
P
M
+
8
T
H
≈
1.18
2
T
P
M
+
8
T
H
≈
1.04
2
T
P
M
+
8
T
H
≈
1.05
4
T
P
M
+
4
T
H
≈
2.03
Computation time of gateway (ms)
2
T
S
+
11
T
H
≈
1.04
T
P
M
+
12
T
H
≈
1.19
2
T
P
M
+
T
S
+
11
T
H
≈
1.05
T
P
M
+
9
T
H
≈
0.52
4
T
P
M
+
5
T
H
≈
2.03
Computation time of sensor (ms)
2
T
P
M
+
T
S
+
4
T
H
≈
1.05
5
T
H
≈
0.04
2
T
P
M
+
T
S
+
11
T
H
≈
1.06
4
T
H
≈
0.03
2
T
P
M
+
3
T
H
≈
1.02
Rounds
4
4
4
4
4
Bandwidth
3168bits
2689bits
3968bits
2912bits
2976bitsTable3 summarizes security properties of the proposed protocol with related protocols. It can be seen from Table 3 that our protocol provides all the security features. Moreover, our protocol is the only one which provides strong user anonymity and formal security proof. Considering the computation cost, communication cost, and security attributes as a whole, our protocol outperforms to other protocols. Consequently, the proposed protocol is more suitable for security and privacy critic applications scenarios in WSNs.Table 3
Comparisons of security features.
Protocols
Wu et al.’s [16]
Jiang et al.’s [17]
Wang et al.’s [18]
Li et al.’s [19]
Our protocol
The replay attack
secure
secure
secure
secure
secure
The privileged insider attack
secure
secure
secure
secure
secure
The GW-node impersonation attack
secure
secure
secure
secure
secure
The stolen verifier attack
secure
secure
secure
secure
secure
The off-line dictionary attack
secure
secure
secure
secure
secure
The compromised sensor node attack
secure
secure
secure
secure
secure
Mutual authentication
yes
yes
yes
yes
yes
Session key establishment
yes
yes
yes
yes
yes
Key privacy
yes
no
yes
no
yes
User anonymity
weak
weak
weak
weak
strong
Formal security proof
yes
yes
yes
yes
yes


## 6. Conclusions

In this paper, we propose an anonymous authentication and key exchange protocol for WSNs. The most attractive property of our protocol is its strong user anonymity such that no one except the user knows the real identity of himself. Besides this, our protocol also enjoys formal security proof in the random oracle model and efficient communication complexity. The only disadvantage is that it consumes more computation resources. In wireless communication networks, establishing a channel usually consumes more energy than computation does. As a result, the heavy computation cost is not a serious problem. Due to its high security and strong anonymity, our protocol is very suitable for security and privacy critic application scenarios in WSNs.



---

*Source: 2484268-2018-07-16.xml*