# A Lattice-Based Authentication Scheme for Roaming Service in Ubiquitous Networks with Anonymity

Authors: Yousheng Zhou; Longan Wang
Journal: Security and Communication Networks
 (2020)

---

## Abstract

In the ubiquitous networks, mobile nodes can obtain roaming service that enables them to get access to the services extended by their home networks in the field of foreign network. To provide secure and anonymous communication for legal mobile users in roaming services, there should be a mutual authentication between mobile user and foreign agent with the help of home agent. There are many roaming authentication schemes which have been proposed; however, with the progress of quantum computation, quantum attack poses security threats to many traditional public key cryptography-based authentication schemes; thus, antiquantum attack roaming authentication schemes need to be investigated. On account of the limitation of computational resources for mobile nodes, a lightweight anonymous and antiquantum authentication schemes need to be developed to enable mobile nodes to roam across multiple service domains securely and seamlessly. In consideration of the advantages of lattice in antiquantum, an NTRU-based authentication scheme with provable security and conditional privacy preservation is proposed to remedy these security weaknesses. Compared with the existing scheme, the proposed scheme not only improves efficiency but also can resist the quantum attack.


---

## Body

## 1. Introduction

With the advance of the wireless Internet access technology [1] and the popularity of smart mobile devices, the ubiquitous network has been widely used in our daily life, providing people with a more convenient life. Ubiquitous network enables people to access network services, such as online shopping and mobile payment. However, the mobile device is prone to suffer from various security and privacy challenges in ubiquitous network environment due to its inherent openness and computation limitation. For instance, an attacker can intercept the transmission data, and then analyze or tamper these data, which would cause user data pollution and privacy leakage [2].Authentication is an essential security technique to prevent attacker in roaming service of ubiquitous network, and great efforts have been made in this field in the past years. However, most of the existing authentication schemes [3–23] are built using conventional cryptographic approaches. It is widely believed that such primitives cannot resist to quantum attack. For instance, discrete logarithm problems and factorization problems can be resolved using the polynomial time algorithm proposed by Shor [24]. In addition, the computation cost or communication cost of the existing authentication scheme are relatively high, which makes many of these schemes not practical for the wireless network since most of them are equipped with resource-constrained devices [25–29]. Therefore, it is of great significance to design efficient and antiquantum roaming authentication schemes. However, the openness of ubiquitous network and dynamic nature makes it extremely challenging to design a secure and effective roaming authentication protocol.


### 1.1. Related Work

In recent years, many roaming authentication protocols [5–23, 30–36] have been proposed to achieve secure information acquisition for mobile users with smart card in the ubiquitous network. In 2004, a roaming authentication protocol for the ubiquitous network was proposed by Zhu and Ma [5], which aims to preserve the privacy of mobile users. However, Lee et al. [6] proved that Zhu and Ma [5] fails to provide backward security and cannot resist forgery attack. To eliminate these defects, an improved roaming authentication protocol was proposed by Lee et al. [6]. Later, Wu et al. [7] pointed out that the anonymity of users cannot be preserved in the protocols of Zhu and Ma [5] and Lee et al. [6], while the latter also fails to guarantee backward security. In addition, to remedy the shortcomings the abovementioned, Wu et al. [7] proposed an improved scheme. In 2012, Mun et al. [8] demonstrated that the user anonymity and perfect forward security have not been achieved in Wu et al. [7], and then they proposed an enhanced authentication protocol to remedy these weaknesses. Unfortunately, Kim and Kwak [9] found that Mun et al. [8] is vulnerable to replay attacks and man-in-middle attacks. In addition, Zhao et al. [10] also pointed out that Mun et al. [8] is vulnerable to various attacks.In 2011, a lightweight anonymous authentication protocol was proposed by He et al. [11] for roaming service. However, in 2013, Jiang et al. [12] showed that He et al. [11] cannot resist various attacks such as offline password guessing and replay attacks. To address these problems, they proposed an enhanced anonymous authentication scheme. Wen et al. [13] subsequent study shows that Jiang et al. [12] is vulnerable to replay attacks and cannot provide forward security. In 2014, an authentication scheme based on elliptic curve was proposed by Kuo et al. [14] to achieve anonymity. However, Lu et al. [15] proved that the protocol of Kuo et al. [14] has many security problems, such as the vulnerability from internal attacks, and Zhang et al. [21] also found that Kuo et al. [14] may cause the leakage of the secret value of mobile terminal MU. Subsequently, Xu et al. [22] and Srinivas [23] pointed out that Zhang et al. [21] is vulnerable to offline guessing attacks and replay attacks and cannot guarantee the anonymity of users.In 2015, Farash et al. [16] pointed out that the scheme of Wen et al. [13] is vulnerable to offline guessing attack and forgery attack. And then, Farash et al. [16] and Gope and Hwang [17], respectively, proposed enhanced anonymous roaming authentication schemes to resist various attacks in ubiquitous networks. However, Wu et al. [18] showed that there are many security defects in Farash et al. [16] and Gope and Hwang [17], and the session keys of their schemes can be exposed to HA. In addition, Chaudhry et al. [19] also pointed out some security risks in Farash et al. [16], such as the inability to guarantee user anonymity and the leakage of mobile user session key. In 2017, Xie et al. [35] designed a first roaming authentication scheme which takes the advantage of the chaotic maps for key agreement in ubiquitous network. Subsequently, in 2019, Ostad-Sharif et al. [33] found that Xie et al. [35] cannot resist the known session-specific information attack. In 2018, Lee et al. [20] claimed that Chaudhry et al. [19] is vulnerable to many attacks such as user forgery attacks and device theft attacks [37–40]. Then, Lee et al. [20] proposed an improved biometric-based [40, 41] authentication scheme for roaming in ubiquitous networks. They claimed that their scheme is secure against the various known attacks with conditional anonymous [37, 39, 42–46] and is lightweight compared with the earlier scheme. In 2019, Lu et al. [34] found some weaknesses in Gope and Hwang [36] authentication scheme for roaming users and proposed a new roaming user authentication scheme using ECC and claimed that their proposal extends required security features and resists known attacks. Very recently, in 2020, Alzahrani et al. [31] show that the roaming scheme in Lu et al. [34] cannot protect the remote user against Stolen Verifier and Traceability attacks. Then, Alzahrani et al. [31] proposed an improved scheme based on ECC which is designed under the proposal of Lu et al. [34]. However, in the same year, Khatoon and Singh Thakur [32] found that Lee et al. [20] is vulnerable offline dictionary attack, replay attack, etc.Lattice is a promising tool to develop various postquantum cryptography schemes, which has been put forward for a long time. In 1997, the first lattice-based cryptosystem constructed by Ajtai and Dwork [47] appeared, followed by the NTRU cryptosystem constructed by Hoffstein [48] in 1998. In 2009, Gentry [49] constructed the first fully homomorphic cryptography scheme based on lattice cryptography. In 2015, the postquantum cryptography report [30] released by the national institute of standards and technology of the United States pointed out that, owing to the rapid development of quantum computing technology, the existing public key cryptography standard will no longer be safe under quantum computing. As early as 1997, Shor [24] proposed a quantum algorithm to solve the large number factorization problem in polynomial time; therefore, many conventional cryptosystems, for instance, those based on large integer factorization and discrete logarithm assumption, would face great security challenges with the advance of quantum computation.In recent years, many authentication protocols from lattices have been developed [28, 47–62]. Specially, many lattice-based key exchange protocols have been proposed [53–57] and some of them have been used by Microsoft and Google [62] as alternatives to the prequantum key agreements in the TLS handshake protocol, which means that lattice-based key exchange protocols can be practical in many contexts and offer credible alternatives to schemes such as ECDH.However, these existing lattice-based key exchange protocols [47, 63–66] are unsuitable to wireless environment with limited resources since they are built from LWE or RLWE. NTRU, first proposed by Hoffstein [48], is a lightweight public key encryption algorithm. When compared with other public key encryption mechanism, NTRU possesses more distinct advantages such as cheap memory and computation consumption, fast speed of encryption/decryption [48], and signature/verification [59]. NTRU has been widely used in wireless environment such as wireless sensor networks [28], cellular networks [60, 61], and opportunistic networks [58] due to its low computational cost. Therefore, it is a desirable tool to construct roaming authentication scheme for ubiquitous network.


### 1.2. Motivation and Contributions

Although many authentication schemes have been proposed, a promotion in security and performance remains a challenge to develop a practical authentication for roaming services in ubiquitous networks. Furthermore, the potential threat of quantum attack makes it necessary to develop efficient antiquantum attack roaming authentication protocols. Motivated by this, a novel roaming authentication scheme based on NTRU is proposed in this paper. Our contributions are as follows:(1)
We put forward an NTRU-based authentication scheme with conditional anonymity for mobile users to roaming securely in ubiquitous network, the most significant merit of which is antiquantum attack(2)
Formal and informal security analysis is conducted for the proposed scheme to demonstrate that it can meet all security requirements(3)
Furthermore, we perform the comparisons in terms of the computational and communication cost to show the feasibility and efficiency of the proposed scheme


### 1.3. Organization

The rest of this paper is organized as follows. Section2 introduces the basic knowledge of lattice and the NTRU public key encryption algorithm. Section 3 illustrates the scheme in detail. Section 4 presents the formal security proof for the proposed scheme. The comparison of performance and security characteristics of the proposed scheme are given in Section 5, and the paper is concluded in Section 6.


## 1.1. Related Work

In recent years, many roaming authentication protocols [5–23, 30–36] have been proposed to achieve secure information acquisition for mobile users with smart card in the ubiquitous network. In 2004, a roaming authentication protocol for the ubiquitous network was proposed by Zhu and Ma [5], which aims to preserve the privacy of mobile users. However, Lee et al. [6] proved that Zhu and Ma [5] fails to provide backward security and cannot resist forgery attack. To eliminate these defects, an improved roaming authentication protocol was proposed by Lee et al. [6]. Later, Wu et al. [7] pointed out that the anonymity of users cannot be preserved in the protocols of Zhu and Ma [5] and Lee et al. [6], while the latter also fails to guarantee backward security. In addition, to remedy the shortcomings the abovementioned, Wu et al. [7] proposed an improved scheme. In 2012, Mun et al. [8] demonstrated that the user anonymity and perfect forward security have not been achieved in Wu et al. [7], and then they proposed an enhanced authentication protocol to remedy these weaknesses. Unfortunately, Kim and Kwak [9] found that Mun et al. [8] is vulnerable to replay attacks and man-in-middle attacks. In addition, Zhao et al. [10] also pointed out that Mun et al. [8] is vulnerable to various attacks.In 2011, a lightweight anonymous authentication protocol was proposed by He et al. [11] for roaming service. However, in 2013, Jiang et al. [12] showed that He et al. [11] cannot resist various attacks such as offline password guessing and replay attacks. To address these problems, they proposed an enhanced anonymous authentication scheme. Wen et al. [13] subsequent study shows that Jiang et al. [12] is vulnerable to replay attacks and cannot provide forward security. In 2014, an authentication scheme based on elliptic curve was proposed by Kuo et al. [14] to achieve anonymity. However, Lu et al. [15] proved that the protocol of Kuo et al. [14] has many security problems, such as the vulnerability from internal attacks, and Zhang et al. [21] also found that Kuo et al. [14] may cause the leakage of the secret value of mobile terminal MU. Subsequently, Xu et al. [22] and Srinivas [23] pointed out that Zhang et al. [21] is vulnerable to offline guessing attacks and replay attacks and cannot guarantee the anonymity of users.In 2015, Farash et al. [16] pointed out that the scheme of Wen et al. [13] is vulnerable to offline guessing attack and forgery attack. And then, Farash et al. [16] and Gope and Hwang [17], respectively, proposed enhanced anonymous roaming authentication schemes to resist various attacks in ubiquitous networks. However, Wu et al. [18] showed that there are many security defects in Farash et al. [16] and Gope and Hwang [17], and the session keys of their schemes can be exposed to HA. In addition, Chaudhry et al. [19] also pointed out some security risks in Farash et al. [16], such as the inability to guarantee user anonymity and the leakage of mobile user session key. In 2017, Xie et al. [35] designed a first roaming authentication scheme which takes the advantage of the chaotic maps for key agreement in ubiquitous network. Subsequently, in 2019, Ostad-Sharif et al. [33] found that Xie et al. [35] cannot resist the known session-specific information attack. In 2018, Lee et al. [20] claimed that Chaudhry et al. [19] is vulnerable to many attacks such as user forgery attacks and device theft attacks [37–40]. Then, Lee et al. [20] proposed an improved biometric-based [40, 41] authentication scheme for roaming in ubiquitous networks. They claimed that their scheme is secure against the various known attacks with conditional anonymous [37, 39, 42–46] and is lightweight compared with the earlier scheme. In 2019, Lu et al. [34] found some weaknesses in Gope and Hwang [36] authentication scheme for roaming users and proposed a new roaming user authentication scheme using ECC and claimed that their proposal extends required security features and resists known attacks. Very recently, in 2020, Alzahrani et al. [31] show that the roaming scheme in Lu et al. [34] cannot protect the remote user against Stolen Verifier and Traceability attacks. Then, Alzahrani et al. [31] proposed an improved scheme based on ECC which is designed under the proposal of Lu et al. [34]. However, in the same year, Khatoon and Singh Thakur [32] found that Lee et al. [20] is vulnerable offline dictionary attack, replay attack, etc.Lattice is a promising tool to develop various postquantum cryptography schemes, which has been put forward for a long time. In 1997, the first lattice-based cryptosystem constructed by Ajtai and Dwork [47] appeared, followed by the NTRU cryptosystem constructed by Hoffstein [48] in 1998. In 2009, Gentry [49] constructed the first fully homomorphic cryptography scheme based on lattice cryptography. In 2015, the postquantum cryptography report [30] released by the national institute of standards and technology of the United States pointed out that, owing to the rapid development of quantum computing technology, the existing public key cryptography standard will no longer be safe under quantum computing. As early as 1997, Shor [24] proposed a quantum algorithm to solve the large number factorization problem in polynomial time; therefore, many conventional cryptosystems, for instance, those based on large integer factorization and discrete logarithm assumption, would face great security challenges with the advance of quantum computation.In recent years, many authentication protocols from lattices have been developed [28, 47–62]. Specially, many lattice-based key exchange protocols have been proposed [53–57] and some of them have been used by Microsoft and Google [62] as alternatives to the prequantum key agreements in the TLS handshake protocol, which means that lattice-based key exchange protocols can be practical in many contexts and offer credible alternatives to schemes such as ECDH.However, these existing lattice-based key exchange protocols [47, 63–66] are unsuitable to wireless environment with limited resources since they are built from LWE or RLWE. NTRU, first proposed by Hoffstein [48], is a lightweight public key encryption algorithm. When compared with other public key encryption mechanism, NTRU possesses more distinct advantages such as cheap memory and computation consumption, fast speed of encryption/decryption [48], and signature/verification [59]. NTRU has been widely used in wireless environment such as wireless sensor networks [28], cellular networks [60, 61], and opportunistic networks [58] due to its low computational cost. Therefore, it is a desirable tool to construct roaming authentication scheme for ubiquitous network.


## 1.2. Motivation and Contributions

Although many authentication schemes have been proposed, a promotion in security and performance remains a challenge to develop a practical authentication for roaming services in ubiquitous networks. Furthermore, the potential threat of quantum attack makes it necessary to develop efficient antiquantum attack roaming authentication protocols. Motivated by this, a novel roaming authentication scheme based on NTRU is proposed in this paper. Our contributions are as follows:(1)
We put forward an NTRU-based authentication scheme with conditional anonymity for mobile users to roaming securely in ubiquitous network, the most significant merit of which is antiquantum attack(2)
Formal and informal security analysis is conducted for the proposed scheme to demonstrate that it can meet all security requirements(3)
Furthermore, we perform the comparisons in terms of the computational and communication cost to show the feasibility and efficiency of the proposed scheme


## 1.3. Organization

The rest of this paper is organized as follows. Section2 introduces the basic knowledge of lattice and the NTRU public key encryption algorithm. Section 3 illustrates the scheme in detail. Section 4 presents the formal security proof for the proposed scheme. The comparison of performance and security characteristics of the proposed scheme are given in Section 5, and the paper is concluded in Section 6.


## 2. Preliminaries

In Section2, we will briefly introduce the basic knowledge of lattice cryptography [50] and NTRU public key encryption algorithm [48].


### 2.1. Lattice

Definition 1.
Givenn linearly independent vectors b1,b2,…,bn∈Rm, the lattice generated by them is defined as follows:(1)ℒb1,b2,…,bn=∑xibixi∈ℤ.
We say that the rank of the lattice isn and its dimension is m and b1,b2,…,bn as a basis of the lattice. If we define B as m×n matrix whose columns are b1,b2,…,bn, then the lattice generated by B is(2)ℒB=∑Bxxi∈ℤn.(1)
In equation (2),Bx stands for ordinary matrix multiplication.(2)
Lattice is a discrete additive group ofRm, closed under addition operation, and there is space between points.Definition 2.
(the shortest vector problem (SVP)). Given a lattice basis B∈Zm×n, to find a nonzero lattice vector Bxx∈Zn0, so for all y∈Zn\0 such that Bx≤By.Definition 3.
(the closest vector problemCVP). Given a lattice basis B∈Zm×n and a target vector t∈Zm, to find a lattice vector Bx that close to the target vector t, so for all y∈Zn such that Bx−t≤By−t.
Both the CVP and the SVP are difficult computational problems; the two are interchangeable with the same difficulty, and there is no effective algorithm to solve these two problems.


### 2.2. NTRU

#### 2.2.1. Definition of Algorithm

Definition 4.
(polynomial ring). A polynomial with respect tox over a ring R has a form, a0+a1x+a2x2+⋯+aN−1xN−1, ai∈R. A ring formed by a set of these polynomials is called a polynomial ring, denoted as Rx, simply R for short.
The parameters of NTRU mainly include three integersN,p,q and four integer coefficient polynomial sets ℒf, ℒg, ℒr, and ℒm with n−1 dimension, p and q are not required as prime numbers, while they should satisfy the equation gcdp,q=1, and q is greater than p. Definite polynomial R=ZX/XN−1, if f∈R,f can be denoted as f=∑i=0N−1fixi=f0,f1,…,fN−1. Definite ⊙ is multiplication operation over polynomial ring; if f∈R, g∈R, and f⊙g=h, then(3)hk=∑i=0kfigk−i+∑i=k+1n−1fign+k−i=∑i+j≡kmodnfigj.Definition 5.
(truncated polynomial ring). The systemR,+,⊙ consists of the convolution operations defined above, and the addition operations in ordinary polynomial rings are called the truncated polynomial ring.
The polynomial ring used in NTRU is truncated polynomial ring, denoted asR, and Rq is polynomial ring of modular q. When performing the product result modq, we reduce all the polynomial coefficients by modq, so the result is in the ring ZX/q,XN−1.


#### 2.2.2. Key Creation

The two communication parties are Bob and Alice. To generate a key, Bob randomly chooses two polynomialsf∈ℒf and g∈ℒg; the polynomial f should have inverses modulo and modulo p, and we will write these inverses as fq−1 and fp−1:(4)fq−1⊙f≡1modq,Fp−1⊙f≡1modp.Then, Bob computes the public keyh≡pfq−1⊙gmodq, and the private key pair of Bob is f,fp−1.


#### 2.2.3. Encryption

Alice chooses her plaintextm from the set ℒm and a random polynomial r from ℒr; then, she uses Bob’s public key h to encrypt the message e≡r⊙h+mmodq and sends it to Bob. In addition, in order to strengthen the feasibility and security of the scheme, this scheme adopts the encryption security enhancement variant proposed by Hoffstein and Silverman [51].


#### 2.2.4. Decryption

Bob uses his private keyf to decrypt the encrypted message e from Alice. Firstly, Bob computes the intermediate polynomial a by(5)a=f⊙emodq,=f⊙r⊙h+f⊙mmodq,=pr⊙g+f⊙mmodq.The coefficients ofa are in the interval −q/2,q/2. Then, a is used for modulus p operation. Finally, Bob uses his private key fp−1 multiply polynomial to recover the plaintext:(6)m=fp−1⊙amodp.In order to reduce the decryption time and speed up the decryption operation [51, 52], we set f=1+pF. Then, Bob can decrypt plaintext m successfully after computing m = a mod p.


#### 2.2.5. Parameter Choices

Message spaceℒm is composed of polynomial of modular p, where m=m0+m1x+⋯+mN−1xN−1modp and(7)ℒm=m∈R:mi⊆−p−12,p−12.Similarly, other sample spaces can be described in the following way:(8)ℒd1,d2=f∈R:fhasd1coeffcients equal1,d2coefficients equal−1,the rest0.We choose three positive integersdf,dr,anddg and then we use these symbols to denote polynomial f,g,r: ℒf=ℒdf,df−1, ℒg=ℒdg,dg, and ℒr=ℒdr,drSincef is expected to be invertible, the number of −1 should not equal the number of 1.


## 2.1. Lattice

Definition 1.
Givenn linearly independent vectors b1,b2,…,bn∈Rm, the lattice generated by them is defined as follows:(1)ℒb1,b2,…,bn=∑xibixi∈ℤ.
We say that the rank of the lattice isn and its dimension is m and b1,b2,…,bn as a basis of the lattice. If we define B as m×n matrix whose columns are b1,b2,…,bn, then the lattice generated by B is(2)ℒB=∑Bxxi∈ℤn.(1)
In equation (2),Bx stands for ordinary matrix multiplication.(2)
Lattice is a discrete additive group ofRm, closed under addition operation, and there is space between points.Definition 2.
(the shortest vector problem (SVP)). Given a lattice basis B∈Zm×n, to find a nonzero lattice vector Bxx∈Zn0, so for all y∈Zn\0 such that Bx≤By.Definition 3.
(the closest vector problemCVP). Given a lattice basis B∈Zm×n and a target vector t∈Zm, to find a lattice vector Bx that close to the target vector t, so for all y∈Zn such that Bx−t≤By−t.
Both the CVP and the SVP are difficult computational problems; the two are interchangeable with the same difficulty, and there is no effective algorithm to solve these two problems.


## 2.2. NTRU

### 2.2.1. Definition of Algorithm

Definition 4.
(polynomial ring). A polynomial with respect tox over a ring R has a form, a0+a1x+a2x2+⋯+aN−1xN−1, ai∈R. A ring formed by a set of these polynomials is called a polynomial ring, denoted as Rx, simply R for short.
The parameters of NTRU mainly include three integersN,p,q and four integer coefficient polynomial sets ℒf, ℒg, ℒr, and ℒm with n−1 dimension, p and q are not required as prime numbers, while they should satisfy the equation gcdp,q=1, and q is greater than p. Definite polynomial R=ZX/XN−1, if f∈R,f can be denoted as f=∑i=0N−1fixi=f0,f1,…,fN−1. Definite ⊙ is multiplication operation over polynomial ring; if f∈R, g∈R, and f⊙g=h, then(3)hk=∑i=0kfigk−i+∑i=k+1n−1fign+k−i=∑i+j≡kmodnfigj.Definition 5.
(truncated polynomial ring). The systemR,+,⊙ consists of the convolution operations defined above, and the addition operations in ordinary polynomial rings are called the truncated polynomial ring.
The polynomial ring used in NTRU is truncated polynomial ring, denoted asR, and Rq is polynomial ring of modular q. When performing the product result modq, we reduce all the polynomial coefficients by modq, so the result is in the ring ZX/q,XN−1.


### 2.2.2. Key Creation

The two communication parties are Bob and Alice. To generate a key, Bob randomly chooses two polynomialsf∈ℒf and g∈ℒg; the polynomial f should have inverses modulo and modulo p, and we will write these inverses as fq−1 and fp−1:(4)fq−1⊙f≡1modq,Fp−1⊙f≡1modp.Then, Bob computes the public keyh≡pfq−1⊙gmodq, and the private key pair of Bob is f,fp−1.


### 2.2.3. Encryption

Alice chooses her plaintextm from the set ℒm and a random polynomial r from ℒr; then, she uses Bob’s public key h to encrypt the message e≡r⊙h+mmodq and sends it to Bob. In addition, in order to strengthen the feasibility and security of the scheme, this scheme adopts the encryption security enhancement variant proposed by Hoffstein and Silverman [51].


### 2.2.4. Decryption

Bob uses his private keyf to decrypt the encrypted message e from Alice. Firstly, Bob computes the intermediate polynomial a by(5)a=f⊙emodq,=f⊙r⊙h+f⊙mmodq,=pr⊙g+f⊙mmodq.The coefficients ofa are in the interval −q/2,q/2. Then, a is used for modulus p operation. Finally, Bob uses his private key fp−1 multiply polynomial to recover the plaintext:(6)m=fp−1⊙amodp.In order to reduce the decryption time and speed up the decryption operation [51, 52], we set f=1+pF. Then, Bob can decrypt plaintext m successfully after computing m = a mod p.


### 2.2.5. Parameter Choices

Message spaceℒm is composed of polynomial of modular p, where m=m0+m1x+⋯+mN−1xN−1modp and(7)ℒm=m∈R:mi⊆−p−12,p−12.Similarly, other sample spaces can be described in the following way:(8)ℒd1,d2=f∈R:fhasd1coeffcients equal1,d2coefficients equal−1,the rest0.We choose three positive integersdf,dr,anddg and then we use these symbols to denote polynomial f,g,r: ℒf=ℒdf,df−1, ℒg=ℒdg,dg, and ℒr=ℒdr,drSincef is expected to be invertible, the number of −1 should not equal the number of 1.


## 2.2.1. Definition of Algorithm

Definition 4.
(polynomial ring). A polynomial with respect tox over a ring R has a form, a0+a1x+a2x2+⋯+aN−1xN−1, ai∈R. A ring formed by a set of these polynomials is called a polynomial ring, denoted as Rx, simply R for short.
The parameters of NTRU mainly include three integersN,p,q and four integer coefficient polynomial sets ℒf, ℒg, ℒr, and ℒm with n−1 dimension, p and q are not required as prime numbers, while they should satisfy the equation gcdp,q=1, and q is greater than p. Definite polynomial R=ZX/XN−1, if f∈R,f can be denoted as f=∑i=0N−1fixi=f0,f1,…,fN−1. Definite ⊙ is multiplication operation over polynomial ring; if f∈R, g∈R, and f⊙g=h, then(3)hk=∑i=0kfigk−i+∑i=k+1n−1fign+k−i=∑i+j≡kmodnfigj.Definition 5.
(truncated polynomial ring). The systemR,+,⊙ consists of the convolution operations defined above, and the addition operations in ordinary polynomial rings are called the truncated polynomial ring.
The polynomial ring used in NTRU is truncated polynomial ring, denoted asR, and Rq is polynomial ring of modular q. When performing the product result modq, we reduce all the polynomial coefficients by modq, so the result is in the ring ZX/q,XN−1.


## 2.2.2. Key Creation

The two communication parties are Bob and Alice. To generate a key, Bob randomly chooses two polynomialsf∈ℒf and g∈ℒg; the polynomial f should have inverses modulo and modulo p, and we will write these inverses as fq−1 and fp−1:(4)fq−1⊙f≡1modq,Fp−1⊙f≡1modp.Then, Bob computes the public keyh≡pfq−1⊙gmodq, and the private key pair of Bob is f,fp−1.


## 2.2.3. Encryption

Alice chooses her plaintextm from the set ℒm and a random polynomial r from ℒr; then, she uses Bob’s public key h to encrypt the message e≡r⊙h+mmodq and sends it to Bob. In addition, in order to strengthen the feasibility and security of the scheme, this scheme adopts the encryption security enhancement variant proposed by Hoffstein and Silverman [51].


## 2.2.4. Decryption

Bob uses his private keyf to decrypt the encrypted message e from Alice. Firstly, Bob computes the intermediate polynomial a by(5)a=f⊙emodq,=f⊙r⊙h+f⊙mmodq,=pr⊙g+f⊙mmodq.The coefficients ofa are in the interval −q/2,q/2. Then, a is used for modulus p operation. Finally, Bob uses his private key fp−1 multiply polynomial to recover the plaintext:(6)m=fp−1⊙amodp.In order to reduce the decryption time and speed up the decryption operation [51, 52], we set f=1+pF. Then, Bob can decrypt plaintext m successfully after computing m = a mod p.


## 2.2.5. Parameter Choices

Message spaceℒm is composed of polynomial of modular p, where m=m0+m1x+⋯+mN−1xN−1modp and(7)ℒm=m∈R:mi⊆−p−12,p−12.Similarly, other sample spaces can be described in the following way:(8)ℒd1,d2=f∈R:fhasd1coeffcients equal1,d2coefficients equal−1,the rest0.We choose three positive integersdf,dr,anddg and then we use these symbols to denote polynomial f,g,r: ℒf=ℒdf,df−1, ℒg=ℒdg,dg, and ℒr=ℒdr,drSincef is expected to be invertible, the number of −1 should not equal the number of 1.


## 3. Concrete Construction

### 3.1. System Model

This section illustrates the concrete construction of the proposed authentication scheme for mobile user roaming in ubiquitous network. Ubiquitous network provides roaming services for mobile users, enabling them to obtain extended services of home agents whenever they enter into a foreign agent field, no matter where they are [8–10]. In the proposed scheme, there are three types of entities:(1)
MU (mobile user): uses mobile phone with smart card to get services in ubiquitous network(2)
FA (foreign agent): provides roaming services for mobile users(3)
HA (home agent): provides authentication for MU and FAWhen a mobile user (MU) enters the foreign agent area, MU should be authenticated under the collaboration between the home agent and the foreign agent. A general framework of roaming service is shown in Figure1. MU has to register itself during the initialization of the system. Afterwards, with the help of HA, MU and FA can perform mutual authentication when necessary. Only when MU and FA confirm each other’s identities can they communicate with each other. In order to ensure the identity legitimacy of the involved entities and the message validity, a mutual authentication mechanism is designed to achieve authorization when realizing roaming service, and the message security is satisfied through key agreement protocol [3, 4, 25].Figure 1
The scenario of roaming authentication in ubiquitous networks.We describe the proposed protocol in ubiquitous networks as follows. Please refer to Table1 for notation guide.Table 1
Notations and definition.
NotationDefinitionnDimensions of polynomial rings in NTRUpA small positive prime integer, usually 2 or 3qA positive integer used to reduce the coefficients of polynomialHı,ı∈1.2,3,4One-way hash functionIDiThe true identity of communication entityiSIDThe anonymous identity of MUIMThe identification of MUℒfSet of polynomialsf over ℤX/xn−1ℒgSet of polynomialsg over ℤX/xn−1ℒrSet of polynomialsz over ℤX/xn−1fi,q−1Inverse of polynomialfi,qfi,p−1Inverse of polynomialfi,phiThe public key of communication entityifi,qThe polynomial overℤX/q,xn−1fi,pThe polynomial overℤX/p,xn−1riThe random polynomial chosen fromℒrSKijThe session key of communication entityi and j


### 3.2. Registration

Home agent (HA) mainly authenticates the real identity of roaming mobile user (MU) and the identity of foreign agent (FA) and then sends the authentication results to FA and MU, respectively. Therefore, a mobile phone user must register himself with his home agent before roaming. Figure2 shows the registration stage of the proposed scheme, and the main steps of registration are as follows:(1)
HA broadcasts public parametersp,q,n,hHA and then calculates and sends his public key to registered MU, where hHA is HA’s public key(2)
MU randomly selects a random numberλ and a legal login password PWMU; then, MU computes HMU=H1IDMUPWMUλ and fMU.q−1⋅gMU=hMU and then sends IDMU,HMU,hMU,λ to HA through a secure channel(3)
After receiving the registration request fromMU, HA verifies the user identityIDMUfirst; if the verification holds, then compute the identification of MU IM=H1HMUfHAtHA, tHA is the timestamp of MU registration, and no one except HA can forge or calculate IM. Then, HA stores parameters HMU,λ,IM,hMU,p,q,n,H⋅ into the smart card and assigns the smart card to MU.Figure 2
Registration stage.Assume that a symmetric key has been previously shared between the home agent and the foreign agent, and each home agent has a list of public keys corresponding to ID. Home agent (HA) has a list of public and private keys for relative roaming user (MU), see Table2. Home agent (HA) has a list of public and private keys for foreign agent (FA), see Table 3.Table 2
Information table of MU.
IDPublic keyIMIDMUhMUH1HMUfHAtHATable 3
Information table of FA.
IDPublic keySymmetric keyIDFAhFASKHF


### 3.3. Login and Authentication Phase

As shown in Figure3, when the mobile terminal completes the registration, it can perform the login and authentication process. In this process, the mobile terminal completes the negotiation of the session key and authentication with the foreign agent with the help of the local agent:(1)
MU⟶FA:m1=SID,h0,V1,V2,tMU,IDHAThe mobile user MU first enters its real identityIDMU and password PWMU into the smart card; then, the smart card computes and verifies HMU′＝H1IDMUPWMUλ; if the verification holds, then the ID of MU is valid; smart card allows user to login in; otherwise, the smart card denies the user login request. MU selects two random polynomials rMU and xMU, computes SID=H4IDMUxMUIMtMU, then encrypts IDMU and xMU, V1=p⋅hHA⋅rMU+IDMU, V2=V1⋅IDMU+xMU, and h0=H2IDMUIMtMUxMU, computes h0=H2IDMUIMtMUxMU, and then sends SID,h0,V1,V2,tMU,IDHA to FA.(2)
FA⟶HA:m2=m1,IDFA,MAC,tFAWhen FA receivesm1, it first verifies whether the timestamp is valid. If so, it saves SID first and retrieves the locally stored shared secret key SKFH with HA according to IDHA, then computes MAC=H2IDFAV1V2SKHF, and sends m2=m1,IDFA,MAC,tFA to HA.(3)
HA⟶FA:m3=h2,V3,V4,hMUFigure 3
Authentication phase.When HA receives the messagem2 from FA, HA verifies the timestamp first and then verifies the validity of IDFA and SID:(1)
HA calculates the message verification codeMAC′=H2IDFAV1V2KHFtFA?=MAC according to SKHF stored in HA and verifies if the equation holds or not; if it holds then HA believes IDFA is legal.(2)
HA uses his private key to decryptV1 and V2 to obtain xMU and IDMU, then uses IDMU to find IM stored in HA, and verifies h0′=H2IDMUIMtMUxMU?=h0 and SID′=H4IDMUxMUIMtMU; if all equation hold, then HA believes SID is valid.(3)
HA selects a random polynomialrHA∈ℒr, computes h1=H1IMxMUIDFA, V3=p⋅hFA⋅rHA+h1, V4=V3⋅h1+xMU, and then sends m3=h2=H2h1SIDhMUSKHF,V3,V4 to FA.(4)
FA⟶MU:m4=h3,V5,V6After receivingm3 from HA, FA decrypts V3 and V4 and computes h2,=H2h1SIDhMUSKHF?=h2 to verify whether the anonymous identity SID of MU received from HA is equal to SID received in step 1. If it holds, FA believes MU’s anonymous identity SID is legitimate. FA selects two random polynomials, then computes KFM=xFA⋅xMU, computes session key SKFM=H3SIDKFMIDFA, then encrypts h1 and xFA uses equation V5=p⋅hMU⋅rFA+h1, V6=h1⋅V5+xFA, and finally sends m4=h3=H2SIDh1SKFMxFA,V5,V6 to MU.(5)
After receivingm4 from FA, MU obtains h1 and xFA from decrypting V5 and V6 and verifies h1′=H1IMxMUIDFA?=h1; if it holds, MU trusts the legitimacy of FA. Then, computes KMF=xMU⋅xFA and the session key SKMF=H3SIDKMFIDFA. MU verifies h3′=H2 in the end; if the equation holds, then the session key negotiation is successful.To facilitate the understanding of the proposed protocol, the following three steps will describe the calculation process of public key generation, decryption, and key agreement in detail.(1)
Public key generation: according to the key generation algorithm in Definition 2, three entities generate their own public keys with the following way, respectively:(9)hHA=p⋅fHA,q−1⋅gHA,hMU=p⋅fMU,q−1⋅gMU,hFA=p⋅fFA,q−1⋅gFA.(2)
Decryption: with the encrypted message according to Definition3, the entities can decrypt the message according to Definition 4. Here, we take V1 and V2 as examples to explain the decryption process.①
When HA receivesV1, it first computes a temporary polynomial TV1=fHA⋅V1modq.②
Then, performs modularp operation on TV1 to obtain IDMU.③
Afterwards, it computesrMU=V1−IDMU/p⋅hHA−1 and xMU=V2−V1⋅IDMU to obtain rMU and xMU.(3)
Session key generation: with the help of HA, MU and FA trust each other; then, they will exchange secret parameters to compute the shared session key. BecauseKFM=xFA⋅xMU=KMF, no one can compute or obtain KFM and KMF except MU and HA. Therefore, only MU and FA can generate the shared session key:(10)SKFM=H3SIDKFMIDFA=H3SIDKMFIDFA=SKMF.


### 3.4. Password Update

In order to prevent password cracking, this scheme provides the operation of updating user password, and the password change phase is invoked by the mobile terminal, and the user performs the following steps on the smart card:(1)
Mobile user inputs hisIDMU and PWMU; smart card computes HMU′=H1IDMUPWMUλ and verifies whether HMU′=HMU; if the equation holds, user login in successful; otherwise, the smart card terminates the login process.(2)
The user sends the operation request of updating login password according to the system prompt, and the smart card will send the prompt of updating password to the user after receiving the request.(3)
User selects a new passwordPWMUNEW and new random number λNEW, then computes HMUNEW=H1IDMUPWMUNEWλNEW, and replaces HMU by HMUNEW.


### 3.5. Session Key Update

MU and FA need to renew session key for security reasons if user is always within the same FA. However, initializing a new session to execute key exchange protocol is time consuming. For the sake of security and efficiency, we provide the update operation of the session key. If the roaming mobile user needs to update the session key established with the foreign agent before, as shown in Figure4, the following steps should be performed.Figure 4
Session key update phase.MU randomly selects a polynomialrMU′ from ℒr, then MU computes and sends mi=ESKFMSIDtMUrMU′,SID,tMU,Ch to FA. SKFM is the session key established with foreign agent before, tMU is a timestamp. Ch is a flag for request of updating session key.When the foreign agent FA receives the messagemi from the roaming user MU, FA performs the following steps:(1)
VerifiesTi−tMU<ΔT, Ti is a timestamp(2)
If the equation above holds, usesSKFM to decrypt mi and then verifies the legitimacy of SID(3)
IfSID is valid, FA selects a random polynomial rFA′ from ℒr and then computes SKFM′=H3SKFMrFA′rMU′, SKFM′ is the new session key(4)
FA computes and sendsmi+1=ESKFMH1SKFM′SKFM,rFA′,tFA,IDFA,IDFA,tFA to MUWhen MU receives the messagemi+1, MU verifies tFA and IDFA, if they are valid then computes SKFM′=H3SKFMrFA′rMU′, and verifies H1′SKFM′SKFM?=H1SKFM′SKFM; if this equation holds, then the new session key is updated.


## 3.1. System Model

This section illustrates the concrete construction of the proposed authentication scheme for mobile user roaming in ubiquitous network. Ubiquitous network provides roaming services for mobile users, enabling them to obtain extended services of home agents whenever they enter into a foreign agent field, no matter where they are [8–10]. In the proposed scheme, there are three types of entities:(1)
MU (mobile user): uses mobile phone with smart card to get services in ubiquitous network(2)
FA (foreign agent): provides roaming services for mobile users(3)
HA (home agent): provides authentication for MU and FAWhen a mobile user (MU) enters the foreign agent area, MU should be authenticated under the collaboration between the home agent and the foreign agent. A general framework of roaming service is shown in Figure1. MU has to register itself during the initialization of the system. Afterwards, with the help of HA, MU and FA can perform mutual authentication when necessary. Only when MU and FA confirm each other’s identities can they communicate with each other. In order to ensure the identity legitimacy of the involved entities and the message validity, a mutual authentication mechanism is designed to achieve authorization when realizing roaming service, and the message security is satisfied through key agreement protocol [3, 4, 25].Figure 1
The scenario of roaming authentication in ubiquitous networks.We describe the proposed protocol in ubiquitous networks as follows. Please refer to Table1 for notation guide.Table 1
Notations and definition.
NotationDefinitionnDimensions of polynomial rings in NTRUpA small positive prime integer, usually 2 or 3qA positive integer used to reduce the coefficients of polynomialHı,ı∈1.2,3,4One-way hash functionIDiThe true identity of communication entityiSIDThe anonymous identity of MUIMThe identification of MUℒfSet of polynomialsf over ℤX/xn−1ℒgSet of polynomialsg over ℤX/xn−1ℒrSet of polynomialsz over ℤX/xn−1fi,q−1Inverse of polynomialfi,qfi,p−1Inverse of polynomialfi,phiThe public key of communication entityifi,qThe polynomial overℤX/q,xn−1fi,pThe polynomial overℤX/p,xn−1riThe random polynomial chosen fromℒrSKijThe session key of communication entityi and j


## 3.2. Registration

Home agent (HA) mainly authenticates the real identity of roaming mobile user (MU) and the identity of foreign agent (FA) and then sends the authentication results to FA and MU, respectively. Therefore, a mobile phone user must register himself with his home agent before roaming. Figure2 shows the registration stage of the proposed scheme, and the main steps of registration are as follows:(1)
HA broadcasts public parametersp,q,n,hHA and then calculates and sends his public key to registered MU, where hHA is HA’s public key(2)
MU randomly selects a random numberλ and a legal login password PWMU; then, MU computes HMU=H1IDMUPWMUλ and fMU.q−1⋅gMU=hMU and then sends IDMU,HMU,hMU,λ to HA through a secure channel(3)
After receiving the registration request fromMU, HA verifies the user identityIDMUfirst; if the verification holds, then compute the identification of MU IM=H1HMUfHAtHA, tHA is the timestamp of MU registration, and no one except HA can forge or calculate IM. Then, HA stores parameters HMU,λ,IM,hMU,p,q,n,H⋅ into the smart card and assigns the smart card to MU.Figure 2
Registration stage.Assume that a symmetric key has been previously shared between the home agent and the foreign agent, and each home agent has a list of public keys corresponding to ID. Home agent (HA) has a list of public and private keys for relative roaming user (MU), see Table2. Home agent (HA) has a list of public and private keys for foreign agent (FA), see Table 3.Table 2
Information table of MU.
IDPublic keyIMIDMUhMUH1HMUfHAtHATable 3
Information table of FA.
IDPublic keySymmetric keyIDFAhFASKHF


## 3.3. Login and Authentication Phase

As shown in Figure3, when the mobile terminal completes the registration, it can perform the login and authentication process. In this process, the mobile terminal completes the negotiation of the session key and authentication with the foreign agent with the help of the local agent:(1)
MU⟶FA:m1=SID,h0,V1,V2,tMU,IDHAThe mobile user MU first enters its real identityIDMU and password PWMU into the smart card; then, the smart card computes and verifies HMU′＝H1IDMUPWMUλ; if the verification holds, then the ID of MU is valid; smart card allows user to login in; otherwise, the smart card denies the user login request. MU selects two random polynomials rMU and xMU, computes SID=H4IDMUxMUIMtMU, then encrypts IDMU and xMU, V1=p⋅hHA⋅rMU+IDMU, V2=V1⋅IDMU+xMU, and h0=H2IDMUIMtMUxMU, computes h0=H2IDMUIMtMUxMU, and then sends SID,h0,V1,V2,tMU,IDHA to FA.(2)
FA⟶HA:m2=m1,IDFA,MAC,tFAWhen FA receivesm1, it first verifies whether the timestamp is valid. If so, it saves SID first and retrieves the locally stored shared secret key SKFH with HA according to IDHA, then computes MAC=H2IDFAV1V2SKHF, and sends m2=m1,IDFA,MAC,tFA to HA.(3)
HA⟶FA:m3=h2,V3,V4,hMUFigure 3
Authentication phase.When HA receives the messagem2 from FA, HA verifies the timestamp first and then verifies the validity of IDFA and SID:(1)
HA calculates the message verification codeMAC′=H2IDFAV1V2KHFtFA?=MAC according to SKHF stored in HA and verifies if the equation holds or not; if it holds then HA believes IDFA is legal.(2)
HA uses his private key to decryptV1 and V2 to obtain xMU and IDMU, then uses IDMU to find IM stored in HA, and verifies h0′=H2IDMUIMtMUxMU?=h0 and SID′=H4IDMUxMUIMtMU; if all equation hold, then HA believes SID is valid.(3)
HA selects a random polynomialrHA∈ℒr, computes h1=H1IMxMUIDFA, V3=p⋅hFA⋅rHA+h1, V4=V3⋅h1+xMU, and then sends m3=h2=H2h1SIDhMUSKHF,V3,V4 to FA.(4)
FA⟶MU:m4=h3,V5,V6After receivingm3 from HA, FA decrypts V3 and V4 and computes h2,=H2h1SIDhMUSKHF?=h2 to verify whether the anonymous identity SID of MU received from HA is equal to SID received in step 1. If it holds, FA believes MU’s anonymous identity SID is legitimate. FA selects two random polynomials, then computes KFM=xFA⋅xMU, computes session key SKFM=H3SIDKFMIDFA, then encrypts h1 and xFA uses equation V5=p⋅hMU⋅rFA+h1, V6=h1⋅V5+xFA, and finally sends m4=h3=H2SIDh1SKFMxFA,V5,V6 to MU.(5)
After receivingm4 from FA, MU obtains h1 and xFA from decrypting V5 and V6 and verifies h1′=H1IMxMUIDFA?=h1; if it holds, MU trusts the legitimacy of FA. Then, computes KMF=xMU⋅xFA and the session key SKMF=H3SIDKMFIDFA. MU verifies h3′=H2 in the end; if the equation holds, then the session key negotiation is successful.To facilitate the understanding of the proposed protocol, the following three steps will describe the calculation process of public key generation, decryption, and key agreement in detail.(1)
Public key generation: according to the key generation algorithm in Definition 2, three entities generate their own public keys with the following way, respectively:(9)hHA=p⋅fHA,q−1⋅gHA,hMU=p⋅fMU,q−1⋅gMU,hFA=p⋅fFA,q−1⋅gFA.(2)
Decryption: with the encrypted message according to Definition3, the entities can decrypt the message according to Definition 4. Here, we take V1 and V2 as examples to explain the decryption process.①
When HA receivesV1, it first computes a temporary polynomial TV1=fHA⋅V1modq.②
Then, performs modularp operation on TV1 to obtain IDMU.③
Afterwards, it computesrMU=V1−IDMU/p⋅hHA−1 and xMU=V2−V1⋅IDMU to obtain rMU and xMU.(3)
Session key generation: with the help of HA, MU and FA trust each other; then, they will exchange secret parameters to compute the shared session key. BecauseKFM=xFA⋅xMU=KMF, no one can compute or obtain KFM and KMF except MU and HA. Therefore, only MU and FA can generate the shared session key:(10)SKFM=H3SIDKFMIDFA=H3SIDKMFIDFA=SKMF.


## 3.4. Password Update

In order to prevent password cracking, this scheme provides the operation of updating user password, and the password change phase is invoked by the mobile terminal, and the user performs the following steps on the smart card:(1)
Mobile user inputs hisIDMU and PWMU; smart card computes HMU′=H1IDMUPWMUλ and verifies whether HMU′=HMU; if the equation holds, user login in successful; otherwise, the smart card terminates the login process.(2)
The user sends the operation request of updating login password according to the system prompt, and the smart card will send the prompt of updating password to the user after receiving the request.(3)
User selects a new passwordPWMUNEW and new random number λNEW, then computes HMUNEW=H1IDMUPWMUNEWλNEW, and replaces HMU by HMUNEW.


## 3.5. Session Key Update

MU and FA need to renew session key for security reasons if user is always within the same FA. However, initializing a new session to execute key exchange protocol is time consuming. For the sake of security and efficiency, we provide the update operation of the session key. If the roaming mobile user needs to update the session key established with the foreign agent before, as shown in Figure4, the following steps should be performed.Figure 4
Session key update phase.MU randomly selects a polynomialrMU′ from ℒr, then MU computes and sends mi=ESKFMSIDtMUrMU′,SID,tMU,Ch to FA. SKFM is the session key established with foreign agent before, tMU is a timestamp. Ch is a flag for request of updating session key.When the foreign agent FA receives the messagemi from the roaming user MU, FA performs the following steps:(1)
VerifiesTi−tMU<ΔT, Ti is a timestamp(2)
If the equation above holds, usesSKFM to decrypt mi and then verifies the legitimacy of SID(3)
IfSID is valid, FA selects a random polynomial rFA′ from ℒr and then computes SKFM′=H3SKFMrFA′rMU′, SKFM′ is the new session key(4)
FA computes and sendsmi+1=ESKFMH1SKFM′SKFM,rFA′,tFA,IDFA,IDFA,tFA to MUWhen MU receives the messagemi+1, MU verifies tFA and IDFA, if they are valid then computes SKFM′=H3SKFMrFA′rMU′, and verifies H1′SKFM′SKFM?=H1SKFM′SKFM; if this equation holds, then the new session key is updated.


## 4. Analysis

### 4.1. Correctness

BAN logic model was first proposed by Burrows et al. [67] in 1990, which is a simple and powerful tool for analyzing the correctness of authentication schemes. In this section, we first describe the basic knowledge of the BAN logic model. Then, we will use the BAN logic model to analyze the correctness of the proposed protocol.


#### 4.1.1. Definition of BAN Logic Model

(1) Notations and Semantics. In the following, we briefly describe the BAN logic model from notations and semantics:(1)
P and Q denote the communication entity(2)
Kab denotes the shared session key of communication entity(3)
KaandKb denote the public key of communication entity(4)
Ka−1 and Kb−1 denote the secret key of communication entity(5)
X and Y denote the message passed in the protocol(6)
P≡X: P believes message X is true(7)
P⊲X: P once received a message containing X(8)
P∽X: P once sent a message including X(9)
P|⇒X: P controls X(10)
#X denotes that the message X is fresh(11)
P⟷KQ: P and Q use the shared symmetric K to communicate with each other(12)
XK represents the ciphertext obtained by encrypting message X with secret key K(13)
XY denotes the combination of X and Y, that is, Y is a secret value, whose presence represents the identity of the owner of XY(14)
X,Y denotes the connection between X and Y(15)
rule1/rule2 means that rule2 can be derived from rule1(2) Inference Rules. In order to use BAN logic for correctness analysis, we will describe some related inference rules of BAN logic model as follows: (1)
Message-meaning rule:(11)P≡Q⟷KP,P⊲XKP≡Q∼X.IfP believes the shared session key K between P and Q and P receives a message XK encrypted by K, then P believes that Q once sent the message X.(2)
Nonce verification rule:(12)P≡#X,P≡Q∼XP≡Q≡X.IfP believes the message X is fresh, also P believes Q has said message X, then P believes X.(3)
Jurisdiction rule:(13)P≡Q⟹X,P≡Q≡XP≡X.IfP believes Q has jurisdiction over X, and P believes that Q believes X, then P believes message.(4)
Freshness rule:(14)P≡#XP≡#X,Y.IfP believes X is fresh, then P believes X,Y is fresh.(5)
Belief rule:(15)P≡X,YP≡X,P≡X,P≡YP≡X,Y.IfP believes message X,Y collection of X and Y, then P believes in each individual message.(6)
Session key rule:(16)P≡#K,P≡Q≡XP≡P⟷KQ.IfP believes the shared key K is fresh, and P also believes that Q believes message X, then P believes P⟷KQ.(7)
Seeing rule:(17)P⊲X,YP⊲X,P≡P⟷KQ,P⊲XKP⊲X.IfP receives a message and P knows the related key about the message, then P receives component of the message.


#### 4.1.2. Correctness Analysis

The correctness of the scheme can be proved as follows:(1)
Idealized protocol model:(1)
MU⟶FA:m1=SID,h0=H2IDMUIMtMUxMU,IDMU,xMUKHA,tMU,IDHA(2)
FA⟶HA:m2=m1,IDFA,H2IDFAIDMU,xMUKHAFA⟷KHFHA,tFA(3)
HA⟶FA:m3=h2=H2h1SIDhMUHA⟷KHFFA,h1=H1IMxMUIDFA,xMUKFA,hMU(4)
FA⟶MU:m4=h3=H2SIDh1FA⟷KFMMUxFA,h1=H1IMxMUIDFA,xFAKMU(2)
Initial assumptions:There are three communication entities in the proposed scheme: MU (mobile user), HA (home agent), and FA (foreign agent). The three entities generate all the authentication messages of the proposed scheme, so we need to make initial assumptions through three aspects.(1)
MU:(18)A1:MU⊲IDMU,A2:MU≡SID,A3:MU≡IDHA,A4:MU≡xMU,A5:MU⊲hHA,A6:MU⊲IM.The above formula A1∼A6 means the following:A1: MU believes and own its own real identityA2: MU believes the anonymous its own identityA3: because MU registered to HA before authentication phase, so MU believes the real identity of HAA4: MU believes the random numberxMU it choosesA5: MU knows the public key of HAA6: MU owns its identity certificateIM because HA has computed and sent it to MU in the registration phase(2)
HA:(19)B1:HA⊲IDHA,B2:HA≡HA⟷KHFFA,B3:HA⊲IDMU,B4:HA⊲hMU,B5:HA⊲IM,B6:HA⊲IDFA.The above formula B1∼B8 means the following:B1: HA believes and owns its own real identityB2: HA believes the key shared with FAB3: because MU has sentIDMU to HA in the registration phase, so HA owns the real identity of MUB4: HA owns the public key of MU because MU once sent it to HA in the registration phaseB5: HA owns identity certificateIM of MU because HA has computed in the registration phaseB6: HA owns the real identity of FA(3)
FA:(20)C1:FA⊲IDFA,C2:FA⊲IDHA,C3:FA≡xFA,C4:FA≡FA⟷KHFHA.The above formula C1∼C6 means the following:C1: FA believes and owns its own real identityC2: FA owns the real identity of HAC3: FA believes the random numberxFA it choosesC4: FA believes the key shared with HA(3)
Goals to be achieved:(21)G1:HA≡IDFA,G2:HA≡SID,G3:FA≡HA≡SID,G4:MU≡HA≡IDFA,G5:MU≡MU⟷SKMFFA,G6:FA≡FA⟷SKFMMU.To provide secure and anonymous communication for legal mobile users in roaming services, there is a mutual authentication between the mobile user and foreign agent with the help of the home agent in the proposed protocol. Then, MU and FA generate a shared session key for the safety of subsequent communication. This means that the proposed scheme can achieve the goals listed above. In the following, we will give explanations for the goals listed above:G1: HA believes the real identity of FAG2: HA believes the anonymous identity of MUG3: FA believes that HA believes the anonymous identity of MUG4: MU believes that HA believes the real identity of FAG5: MU believes the shared session key between MU and FA, which means MU and FA generated the shared session key successfullyG6: FA believes the shared session key between FA and MU, which means FA and MU generated the shared session key successfully


## 4.1. Correctness

BAN logic model was first proposed by Burrows et al. [67] in 1990, which is a simple and powerful tool for analyzing the correctness of authentication schemes. In this section, we first describe the basic knowledge of the BAN logic model. Then, we will use the BAN logic model to analyze the correctness of the proposed protocol.


### 4.1.1. Definition of BAN Logic Model

(1) Notations and Semantics. In the following, we briefly describe the BAN logic model from notations and semantics:(1)
P and Q denote the communication entity(2)
Kab denotes the shared session key of communication entity(3)
KaandKb denote the public key of communication entity(4)
Ka−1 and Kb−1 denote the secret key of communication entity(5)
X and Y denote the message passed in the protocol(6)
P≡X: P believes message X is true(7)
P⊲X: P once received a message containing X(8)
P∽X: P once sent a message including X(9)
P|⇒X: P controls X(10)
#X denotes that the message X is fresh(11)
P⟷KQ: P and Q use the shared symmetric K to communicate with each other(12)
XK represents the ciphertext obtained by encrypting message X with secret key K(13)
XY denotes the combination of X and Y, that is, Y is a secret value, whose presence represents the identity of the owner of XY(14)
X,Y denotes the connection between X and Y(15)
rule1/rule2 means that rule2 can be derived from rule1(2) Inference Rules. In order to use BAN logic for correctness analysis, we will describe some related inference rules of BAN logic model as follows: (1)
Message-meaning rule:(11)P≡Q⟷KP,P⊲XKP≡Q∼X.IfP believes the shared session key K between P and Q and P receives a message XK encrypted by K, then P believes that Q once sent the message X.(2)
Nonce verification rule:(12)P≡#X,P≡Q∼XP≡Q≡X.IfP believes the message X is fresh, also P believes Q has said message X, then P believes X.(3)
Jurisdiction rule:(13)P≡Q⟹X,P≡Q≡XP≡X.IfP believes Q has jurisdiction over X, and P believes that Q believes X, then P believes message.(4)
Freshness rule:(14)P≡#XP≡#X,Y.IfP believes X is fresh, then P believes X,Y is fresh.(5)
Belief rule:(15)P≡X,YP≡X,P≡X,P≡YP≡X,Y.IfP believes message X,Y collection of X and Y, then P believes in each individual message.(6)
Session key rule:(16)P≡#K,P≡Q≡XP≡P⟷KQ.IfP believes the shared key K is fresh, and P also believes that Q believes message X, then P believes P⟷KQ.(7)
Seeing rule:(17)P⊲X,YP⊲X,P≡P⟷KQ,P⊲XKP⊲X.IfP receives a message and P knows the related key about the message, then P receives component of the message.


### 4.1.2. Correctness Analysis

The correctness of the scheme can be proved as follows:(1)
Idealized protocol model:(1)
MU⟶FA:m1=SID,h0=H2IDMUIMtMUxMU,IDMU,xMUKHA,tMU,IDHA(2)
FA⟶HA:m2=m1,IDFA,H2IDFAIDMU,xMUKHAFA⟷KHFHA,tFA(3)
HA⟶FA:m3=h2=H2h1SIDhMUHA⟷KHFFA,h1=H1IMxMUIDFA,xMUKFA,hMU(4)
FA⟶MU:m4=h3=H2SIDh1FA⟷KFMMUxFA,h1=H1IMxMUIDFA,xFAKMU(2)
Initial assumptions:There are three communication entities in the proposed scheme: MU (mobile user), HA (home agent), and FA (foreign agent). The three entities generate all the authentication messages of the proposed scheme, so we need to make initial assumptions through three aspects.(1)
MU:(18)A1:MU⊲IDMU,A2:MU≡SID,A3:MU≡IDHA,A4:MU≡xMU,A5:MU⊲hHA,A6:MU⊲IM.The above formula A1∼A6 means the following:A1: MU believes and own its own real identityA2: MU believes the anonymous its own identityA3: because MU registered to HA before authentication phase, so MU believes the real identity of HAA4: MU believes the random numberxMU it choosesA5: MU knows the public key of HAA6: MU owns its identity certificateIM because HA has computed and sent it to MU in the registration phase(2)
HA:(19)B1:HA⊲IDHA,B2:HA≡HA⟷KHFFA,B3:HA⊲IDMU,B4:HA⊲hMU,B5:HA⊲IM,B6:HA⊲IDFA.The above formula B1∼B8 means the following:B1: HA believes and owns its own real identityB2: HA believes the key shared with FAB3: because MU has sentIDMU to HA in the registration phase, so HA owns the real identity of MUB4: HA owns the public key of MU because MU once sent it to HA in the registration phaseB5: HA owns identity certificateIM of MU because HA has computed in the registration phaseB6: HA owns the real identity of FA(3)
FA:(20)C1:FA⊲IDFA,C2:FA⊲IDHA,C3:FA≡xFA,C4:FA≡FA⟷KHFHA.The above formula C1∼C6 means the following:C1: FA believes and owns its own real identityC2: FA owns the real identity of HAC3: FA believes the random numberxFA it choosesC4: FA believes the key shared with HA(3)
Goals to be achieved:(21)G1:HA≡IDFA,G2:HA≡SID,G3:FA≡HA≡SID,G4:MU≡HA≡IDFA,G5:MU≡MU⟷SKMFFA,G6:FA≡FA⟷SKFMMU.To provide secure and anonymous communication for legal mobile users in roaming services, there is a mutual authentication between the mobile user and foreign agent with the help of the home agent in the proposed protocol. Then, MU and FA generate a shared session key for the safety of subsequent communication. This means that the proposed scheme can achieve the goals listed above. In the following, we will give explanations for the goals listed above:G1: HA believes the real identity of FAG2: HA believes the anonymous identity of MUG3: FA believes that HA believes the anonymous identity of MUG4: MU believes that HA believes the real identity of FAG5: MU believes the shared session key between MU and FA, which means MU and FA generated the shared session key successfullyG6: FA believes the shared session key between FA and MU, which means FA and MU generated the shared session key successfully


## 4.1.1. Definition of BAN Logic Model

(1) Notations and Semantics. In the following, we briefly describe the BAN logic model from notations and semantics:(1)
P and Q denote the communication entity(2)
Kab denotes the shared session key of communication entity(3)
KaandKb denote the public key of communication entity(4)
Ka−1 and Kb−1 denote the secret key of communication entity(5)
X and Y denote the message passed in the protocol(6)
P≡X: P believes message X is true(7)
P⊲X: P once received a message containing X(8)
P∽X: P once sent a message including X(9)
P|⇒X: P controls X(10)
#X denotes that the message X is fresh(11)
P⟷KQ: P and Q use the shared symmetric K to communicate with each other(12)
XK represents the ciphertext obtained by encrypting message X with secret key K(13)
XY denotes the combination of X and Y, that is, Y is a secret value, whose presence represents the identity of the owner of XY(14)
X,Y denotes the connection between X and Y(15)
rule1/rule2 means that rule2 can be derived from rule1(2) Inference Rules. In order to use BAN logic for correctness analysis, we will describe some related inference rules of BAN logic model as follows: (1)
Message-meaning rule:(11)P≡Q⟷KP,P⊲XKP≡Q∼X.IfP believes the shared session key K between P and Q and P receives a message XK encrypted by K, then P believes that Q once sent the message X.(2)
Nonce verification rule:(12)P≡#X,P≡Q∼XP≡Q≡X.IfP believes the message X is fresh, also P believes Q has said message X, then P believes X.(3)
Jurisdiction rule:(13)P≡Q⟹X,P≡Q≡XP≡X.IfP believes Q has jurisdiction over X, and P believes that Q believes X, then P believes message.(4)
Freshness rule:(14)P≡#XP≡#X,Y.IfP believes X is fresh, then P believes X,Y is fresh.(5)
Belief rule:(15)P≡X,YP≡X,P≡X,P≡YP≡X,Y.IfP believes message X,Y collection of X and Y, then P believes in each individual message.(6)
Session key rule:(16)P≡#K,P≡Q≡XP≡P⟷KQ.IfP believes the shared key K is fresh, and P also believes that Q believes message X, then P believes P⟷KQ.(7)
Seeing rule:(17)P⊲X,YP⊲X,P≡P⟷KQ,P⊲XKP⊲X.IfP receives a message and P knows the related key about the message, then P receives component of the message.


## 4.1.2. Correctness Analysis

The correctness of the scheme can be proved as follows:(1)
Idealized protocol model:(1)
MU⟶FA:m1=SID,h0=H2IDMUIMtMUxMU,IDMU,xMUKHA,tMU,IDHA(2)
FA⟶HA:m2=m1,IDFA,H2IDFAIDMU,xMUKHAFA⟷KHFHA,tFA(3)
HA⟶FA:m3=h2=H2h1SIDhMUHA⟷KHFFA,h1=H1IMxMUIDFA,xMUKFA,hMU(4)
FA⟶MU:m4=h3=H2SIDh1FA⟷KFMMUxFA,h1=H1IMxMUIDFA,xFAKMU(2)
Initial assumptions:There are three communication entities in the proposed scheme: MU (mobile user), HA (home agent), and FA (foreign agent). The three entities generate all the authentication messages of the proposed scheme, so we need to make initial assumptions through three aspects.(1)
MU:(18)A1:MU⊲IDMU,A2:MU≡SID,A3:MU≡IDHA,A4:MU≡xMU,A5:MU⊲hHA,A6:MU⊲IM.The above formula A1∼A6 means the following:A1: MU believes and own its own real identityA2: MU believes the anonymous its own identityA3: because MU registered to HA before authentication phase, so MU believes the real identity of HAA4: MU believes the random numberxMU it choosesA5: MU knows the public key of HAA6: MU owns its identity certificateIM because HA has computed and sent it to MU in the registration phase(2)
HA:(19)B1:HA⊲IDHA,B2:HA≡HA⟷KHFFA,B3:HA⊲IDMU,B4:HA⊲hMU,B5:HA⊲IM,B6:HA⊲IDFA.The above formula B1∼B8 means the following:B1: HA believes and owns its own real identityB2: HA believes the key shared with FAB3: because MU has sentIDMU to HA in the registration phase, so HA owns the real identity of MUB4: HA owns the public key of MU because MU once sent it to HA in the registration phaseB5: HA owns identity certificateIM of MU because HA has computed in the registration phaseB6: HA owns the real identity of FA(3)
FA:(20)C1:FA⊲IDFA,C2:FA⊲IDHA,C3:FA≡xFA,C4:FA≡FA⟷KHFHA.The above formula C1∼C6 means the following:C1: FA believes and owns its own real identityC2: FA owns the real identity of HAC3: FA believes the random numberxFA it choosesC4: FA believes the key shared with HA(3)
Goals to be achieved:(21)G1:HA≡IDFA,G2:HA≡SID,G3:FA≡HA≡SID,G4:MU≡HA≡IDFA,G5:MU≡MU⟷SKMFFA,G6:FA≡FA⟷SKFMMU.To provide secure and anonymous communication for legal mobile users in roaming services, there is a mutual authentication between the mobile user and foreign agent with the help of the home agent in the proposed protocol. Then, MU and FA generate a shared session key for the safety of subsequent communication. This means that the proposed scheme can achieve the goals listed above. In the following, we will give explanations for the goals listed above:G1: HA believes the real identity of FAG2: HA believes the anonymous identity of MUG3: FA believes that HA believes the anonymous identity of MUG4: MU believes that HA believes the real identity of FAG5: MU believes the shared session key between MU and FA, which means MU and FA generated the shared session key successfullyG6: FA believes the shared session key between FA and MU, which means FA and MU generated the shared session key successfully


## 5. Correctness Verification

In this section, we analyze the proposed protocol using the BAN logic model to validate the security and correctness claim of the proposed protocol. The following are the detailed steps to prove that the proposed protocol can reach the goals shown above.From the messagem2, on verifying the timestamp of FA and applying Seeing rule P⊲X,Y/P⊲X, we obtain the following:(22)V1:HA⊲m1,V2:HA⊲MAC,V3:HA≡#m2,V4:HA≡#tFA.From V2 and B2, on applying Message-meaning ruleP≡Q⟷KP,P⊲XK/P≡Q∼X, we obtain(23)V5:HA≡FA∼MAC.From V4, on applying Freshness ruleP≡#X/P≡#X,Y, we obtain(24)V6:HA≡#MAC.From V5 and V6, on applying Nonce verification ruleP≡#X,P≡Q∼X/P≡Q≡X, we obtain(25)V7:HA≡FA≡MAC.From V7, on applying Belief ruleP≡X,Y/P≡X, we obtain(26)V8:HA≡IDFA.From V1, on verifying the timestamp of MU and applying Seeing ruleP⊲X,Y/P⊲X, we obtain(27)V9:HA⊲SID,V10:HA≡#tMU,V11:HA⊲V1,V12:HA⊲V2,V13:HA⊲h0.From B3, V11, V12, and V13, on verifyingh0′=H2IDMUIMtMUxMU?=h0 and applying Seeing rule P≡P⟷KQ,P⊲XK/P⊲X, we can say(28)V14:HA≡IDMU,V15:HA≡xMU,V16:HA≡h0,V17:HA≡IM.From V14, V15, and V17 Belief ruleP≡X,P≡Y/P≡X,Y, we obtain(29)V18:HA≡SID.From messagem1, on verifying the timestamp of MU applying Seeing rule P⊲X,Y/P⊲X, we obtain(30)V19:FA⊲SID,V20:FA≡#tMU.From messagem3, on applying Seeing rule P⊲X,Y/P⊲X and P≡P⟷KQ,P⊲XK/P⊲X, we obtain(31)V21:FA⊲hMU,V22:FA⊲h1,V23:FA⊲xMU,V24:FA⊲h2.From C4, V19, and V24, on verifyingh2′=H2h1SIDhMUSKHF?=h2 and applying Message-meaning rule P≡Q⟷KP,P⊲XK/P≡Q∼X, we obtain(32)V25:FA≡HA∼SID,V26:FA≡h2,V27:FA≡h1,V28:FA≡xMU.From V20, on applying Freshness ruleP≡#X/P≡#X,Y, we obtain(33)V29:FA≡#SID.From V25 and V29, on applying Nonce verification ruleP≡#X,P≡Q|∼X/P≡Q≡X, we obtain(34)V30:FA≡HA≡SID.From messagem4, on applying Seeing rule P⊲X,Y/P⊲X and P≡P⟷KQ,P⊲XK/P⊲X, we obtain(35)V31:MU⊲h1,V32:MU⊲h3,V33:MU⊲xFA,V34:MU⊲IDFA.From A4 and A6, MU verifiesh1′=H2IMxMUIDFA?=h1, and on applying Belief rule P≡Q≡X,Y/P≡Q≡X, we can obtain(36)V35:MU≡IDFA,V36:MU≡HA≡IDFA.BecausetMU is a random timestamp selected by MU, so we can say(37)V37:MU≡#tMU.From V37, on applying Freshness ruleP≡#X/P≡#X,Y, we obtain(38)V38:MU≡#SID,V39:MU≡#SKMF.From V31, V32, and V33, on verifyingh3′=H2SIDSKMFh1′xFA?=h3 and applying Belief rule P≡Q≡X,Y/P≡Q≡X, we can conclude(39)V40:MU≡FA≡KMF,V41:MU≡xFA.From V39 and V40, on applying Session key ruleP≡#K,P≡Q≡X/P≡P⟷KQ, we obtain(40)V42:MU≡MU⟷SKMFFA.From V29, on applying Freshness ruleP≡#X/P≡#X,Y, we obtain(41)V42:FA≡#SKMF.From V28 and both FA, computeKFM=xFA⋅xMU in the same way:(42)V43:FA≡MU≡KMF.From V42 and V43, on applying Session key ruleP≡#K,P≡Q≡X/P≡P⟷KQ, we obtain(43)V44:FA≡FA⟷SKFMMU.Thus, the proposed can reach the goals G1∼G6 through the analysis of the above steps, and it can be concluded that the proposed protocol provides mutual authentication and session key establishment.


### 5.1. Security

#### 5.1.1. Formal Security Proof

(1) Security Model. This section defines the security model of lattice-based authentication protocol, which is based on the security model proposed by Bellare et al. [63–65]. The attack capability of the adversary A is defined by a series of oracle queries and security assumptions. A proceeds an interaction experiment by performing a series of oracle queries with any participant instances in the protocol ∏Ui. In the course of interaction, A is given the ability to attack protocols. The security of the key exchange means that any adversary A cannot distinguish between session keys and random strings generated by honest protocol participant polynomial time random prediction queries. An honest protocol participant U has different instances ∏Ui, and it can execute the protocol concurrently. The adversary A can use the following predictors to interact with different instances of honest players: (i)
Hashm: A queries the random oracle for the hash result. The random oracle returns the result which is existing in the list; else, it chooses a random number r, records (m,r) in a hash table and then returns r.(ii)
Execute∏Ui: this query models the adversary’s ability to eavesdrop passively on the protocol, A can eavesdrop on the honest protocol execution process. The output consists of messages exchanged during protocol execution.(iii)
Send∏Ui,m: this query models the adversary’s ability to actively attack a protocol, A can intercept a message and change it, or simply forward it to a target instance. The input is the message m sent by the adversary to Pi, and the output is the corresponding message generated by Pi based on the message m.(iv)
Corrupt∏Ui: this query models the ability of adversary A to corrupt the protocol participant U and returns the user’s password.(v)
Reveal∏Ui: A obtains the session key possessed by ∏Ui. This query models a session key leak.(vi)
Test∏Ui: this query relates to the semantic security of the session key SK. This query was made after many other queries had been made by A. The random oracle selects a random bit b∈0,1. If b=0, the oracle returns a random value of the same length as the session key, and if b=1, the oracle returns the real session key held by ∏Ui.Semantic security: consideringA executes the key exchange protocol P, A interacts with Execute, Send, Reveal, and Test oracles, and finally outputs the bit value b, as a guess of b. If b=b,, the adversary is considered successful. Let Succ denote the event that the adversary is successful. Then, the advantage of the adversary successfully breaking the protocol P is defined as follows:(44)AdvPAKEA=PrSuccPAKEA−12.This authenticated key exchange protocol is considered secure ifAdvPAKEA is negligible.(2) Security Proof.Theorem 1.
An adversaryA makes qse, qexe, qre, and qco queries of type Send, Execute, Reval, and Curropt in time t, respectively, and qro queries to the random oracles:(45)AdvPAKEA=qH12+qse+qex2pn+qH22+qH42+2qse+qex2qk+qH32+qse+qex2qn+qseD.Proof.
We use seven experimentsGame0, Game1,…, Game5, Game6 to prove the security of the protocol, which has AdvGame0akeA≤AdvGame1akeA+negln≤⋯≤AdvGame6akeA+negln, and negln is negligible values in n.Game0. This experiment represents an original protocol execution.Game1. In this experiment, we simulated Send, Reveal, Test, and Execute queries as Tables 4 and 5 show, and H1, H2, H3, and H4 are also simulated by maintaining hash list ∧H1, ∧H2, ∧H3, and ∧H4:(46)AdvGame0akeA≤AdvGame1akeA+negln.Table 4
Simulation ofReveal, Test, and Execute query.
Reveal∏Ui: return the session key of MUiandFAiTest∏Ui: on a query TestMUi/FAi, oracle selects a random bit b∈0,1; if b=1, return a session key; if b=0, return a random value with the same lengthExecute∏Ui: on a query ExecuteMUi,FAi,HAi, return the protocol message exchanged between three entities m1,m2,m3,m4Table 5
Simulation ofSend query.
(1) On a querySendMUi,start, which denotes the start of protocol, assuming MUi runs correctly, then MUiperforms the first step operation of the authentication process; then, the query is answered with m1=SID,h0,V1,V2,tMU,IDHA(2) On a querySendFAi,m1, assuming MUi runs correctly, then FAi performs the second step operation of the authentication process; then, the query is answered with m2=m1,IDFA,MAC,tFA(3) On a querySendHAi,m2, assuming HAi runs correctly, then HAi performs the third step operation of the authentication process; then, the query is answered with m3=h1,h2,V3,V4,V5,hMU(4) On a querySendFAi,m3, assuming FAi runs correctly, then FAi performs the fourth step operation of the authentication process; then, the query is answered with m4=h3,h1,V5,V6(5) On a querySendMUi,m4, assuming MUi runs correctly, then MUi executes the fifth step operation of the authentication process; then, the query is answered with m5=H2SKMFhFAKMFProof.
In the proposed protocol,H1, H2, H3, and H4 act as random oracles, so A cannot distinguish random values and the output of hash function:H1m: if there is a record m,r in the list ∧H1, returns r. If not, choose a random string r∈Rp, add m,r to the list ∧H1, and then return r.H2m: if there is a record m,r in the list ∧H2, returns r. If not, choose a random string r∈zq∗, add m,r to the list ∧H2, and then return r.H3m: if there is a record m,r in the list ∧H3, return r. If not, choose a random string r∈Rq, add m,r to the list ∧H3, and then return r.H4m: if there is a record m,r in the list ∧H4, return r. If not, choose a random string r∈zq∗, add m,r to the list ∧H4, and then return.Game2. This game simulates all oracles as Game1 expects the cancelation of the game when A guesses the password correctly. This modification increases the adversary’s chances at breaking the game, but the adversary’s advantage is still negligible:(47)AdvGame1akeA≤AdvGame2akeA+negln.Proof.
(1)
SinceIDMU is invisible to the adversary A, the adversary can only log in by guessing IDMU, and this probability is qse/pn(2)
A needs to query random oracles to distinguish Game2 from Game1, and this probability is qro/pn
If event.1 and event.2 do not happen, andGame2 and Game1 are indistinguishable, so(48)PrGame1akeA≤PrGame2akeA+qse+qropn.Game3.Game2 is almost identical to Game3, but once honest parties choose random SID seen previously in the execution, this game will be forcefully ceased:(49)AdvGame2akeA≤AdvGame3akeA+qse+qex+qroqse+qexqk.Proof.
SID is a string of lengthk generated by H4, which cardinal is qk. SID is generated after Send,ro, and Execute queries. The probability of generating this value in previous Send, Execute, or random oracle query is qse+qex+qro/qk; therefore, the probability of SID being not unique is qse+qex+qroqse+qex/qk.Game4. making the following changes to the Send queries, replace xMU,xFA with random values xMU∗,xFA∗ to compute KMF. For the messages that contain xMU,xFA, use random values xMU∗,xFA∗ computes then responds to A. Since the two values are randomly selected in the polynomial space and the secret values are transmitted through encryption and are invisible to the A, this modification does not increase the probability of the A in violating protocol:(50)AdvGame3akeA≤AdvGame4akeA+negln.Proof.
xMU,xFA is encrypted and decrypted by NTRU algorithm. The related information about plaintext cannot be obtained by adversary who only holds public key and ciphertext without private key. Construct an algorithm ℳ to run adversary A to break the encryption scheme.
A sends xMU∗,xFA∗ and xMU,xFA to algorithm ℳ.ℳ selects one of them to execute encryption and then sends ciphertext to adversary. A guesses the encryption result and outputs a bit b. If parameters are selected properly, the advantage of the adversary is negligible.Game5. In order to increase the adversary’s chances at winning the game, we simulate all oracles nearly identical to Game4 except that there are collision events happen on the transcript m1,m2,m3,m4 in the output of hash queries during the execution of protocol. The adversary perform a polynomial number queries of H1, H2, H3, and H4 to catch collision:(51)AdvGame0akeA≤AdvGame1akeA+qH12+qse+qex2pn+qH42+qH22+qse+qex2qk+qH32+qse+qex2qn.Proof.
Since authentication messages are generated with random numbers, so authentication messages are different at every authentication phase. If the are collision events happen, the adversary succeeds. According to Gardy et al. [66] birthday attack, Game4 and Game5 are distinguishable when collisions occur, and the probability of collisions happened is qH12+qse+qex2/2H1+qH22+qse+qex2/2H2+qH32+qse+qex2/2H3+qH42+qse+qex2/2H4. Η1, H2, H3, and H4 are the size of the dictionary space corresponding to the hash function show above, and H1=pn, H2=qk, H3=qn, and H4=qk.Game6. All passwords in the protocol are saved by an internal password oracle, and it accepts queries to test the given password for MU is correct or not. The internal password oracle is invisible to the adversary and generates all passwords during initialization:(52)AdvGame5akeA≤AdvGame6akeA+negln.Proof.
The adversary cannot obtain their corresponding private keys by attacking the public keys of MU and FA, so the private key of MU and FA are invisible to the adversary, and in previous games,KMF is calculated with randomly selected values. The session key is a random value at this time, and the information held by the adversary is irrelevant to the session key, so the can only attack the protocol by guessing the bit b or attack the protocol by attacking the user’s password online. We denote the event that adversary succeeding in Game6 by SUCCGame6akeA; EGuss represents the event that adversary attack protocol by guessing the password. We can easily bound the probability of success in Game6 created by adversary A as the following equation:(53)PrSUCCGame6akeA≤PrGussEGuss+PrSUCCGame6akeA|¬EGussPr¬EGuss.
Note thatPrEGuss≤qse/D, if these passwords are chosen randomly from a dictionary of D and the event EGuss does not happen, and the only way for adversary to succeed is to guess bit b through Test query. Therefore, PrSUCCGame6akeA|¬Guss=1/2.(54)PrSUCCGame6akeA≤PrGuss+PrSUCCGame6akeA¬GussPr¬Guss≤PrGuss+PrSUCCGame6akeA¬Guss1−PrGuss≤qseD+121−qseD≤12+qse2D.
By the above calculation, we conclude that(55)AdvGame6akeA=2PrSUCCGame6akeA−1≤qseD.
Finally, it can be computed that the advantage of the adversary is ignorable by analyzingGame0, Game1, …, Game5, Game6. Hereby, Theorem 1 is concluded.


#### 5.1.2. Informal Security Analysis

Security analysis:(i)
Conditional anonymity: the identity information of the roaming terminal MU is invisible to the foreign agent FA. MU only communicates with the field agent FA through the pseudorandomSID, and SID will vary every one authenticated process. Therefore, the roaming terminal MU is strongly anonymous to the foreign agent FA. If there is a malicious roaming terminal MU in the system, it is necessary to find out its real identity information in time. Since each authentication process requires participation of the home agent HA, and the home agent HA establishes the association between SID and IDMU before. Hence, HA can reveal the user’s real identity IDMU through SID.(ii)
Forward security: forward security means that even though an attacker obtains the private keys of roaming mobile user MU and home agent FA through some means, he cannot calculate the previous session key successfully negotiated between MU and FA. SinceSKFM=H3SIDKFMIDFA, where SID is related to randomly selected rMU. SID value is different in each authentication process.(iii)
Untraceability: even if the adversary can intercept all the information exchanged between protocol participants, it cannot track the behavior information of the roaming terminal MU. All exchanged messages andSID generated by the roaming terminal MU during each interaction are all random values, so untraceable properties are satisfied in the proposed scheme.(iv)
Mutual authentication: in this scheme, the adversary cannot participate in the generation and response of protocol authentication messages. The scheme participants are the roaming terminal MU, the foreign agent FA, and the home agent HA, respectively, where the authentication messages generated by MU and FA can only be decrypted by the legitimate home agent HA. Then, the legitimate home agent HA helps them perform the authentication process and generate the session key correctly only if the three parties trust each other.(v)
User login authentication: in order to improve the security of scheme, the smart card should verify the validity of user when login. In the proposed scheme, the user enters the identityIDMU and password IDMU when logging in. The smart card SC calculates HMU′=H1IDMUPWMUλ and verifies its validity. If the equation holds, the identity of MU IDMU is valid and SC allow user to login in; otherwise, SC denies the login request.(vi)
Resistance to replay attacks: in the proposed scheme, the messages for authentication that are sent by mobile user MU and foreign agent contain timestamps; when FA and HA execute authentication process, each entity firstly verifies the validity of timestamp contained in messages, and then proceeds subsequent operations. Furthermore, the random numbersrMU ensures that the authentication information is varies in every authentication process so that the adversary cannot perform the replay attacks with the exchanged messages sent before.(vii)
Resistance to man-in-the-middle attack: in the proposed scheme, suppose that an attacker exists in a communication channel who attempts to execute man-in-the-middle attack by intercepting and tampering with communication messages. If he or she tries to tamper with the messagem1, he or she must first tamper with the encrypted messages V1 and V2, which are encrypted by NTRU encryption mechanism. Due to SVP and CVP, the attacker cannot get the private key to decrypt the message, so the adversary cannot tamper with the message m1 successfully. While other messages contain information generated by One-way Hash functions, the attacker needs to solve the anticollision problem of Hash functions to tamper with the message, so the attacker will also fail.(viii)
Resistance to device-stealing attacks: even if adversaries get user’s mobile device, he cannot recover user’s password and identity information from the user’s smart card, and he can only log in the device by guessing the user’s password and identity, so our scheme can resist device-stealing attacks.(ix)
Resistance to privileged-inside attack: in the registration stage, MU sends HA the registration informationIDMU,HMU,λ. HA cannot extract MU’s password information from the registration information. In addition, MU can also update passwords on smart card without the participation of HA. Finally, the session key negotiated by MU and FA is not visible to HA, so this scheme is resistant to privileged-inside attacks.(x)
Secure user password change: mobile user executes password change phase when the mobile user wants to change the password for the purpose of security. After passing the authentication of smart card, the old password will be replaced by a new password selected by user only in password change phase, FA and HA will not participate in this phase. Therefore, our password change phase is reasonable and security.Based on the analysis of the security of the proposed scheme, we conduct security comparison with related scheme as in Table6. The results show that only the proposed scheme provides all the required features and resists known attacks, whereas competing schemes lack either some features or ensuring against some known attack. In addition, the proposed scheme can also resist to quantum attack, while the related schemes lack this feature.Table 6
Security comparison of the scheme.
S1S2S3S4S5S6S7S8S9S10SecurityWu et al. [18]√√√√√√×√×√8Grope and Hwang [17]××√√√√√×√√7Wen et al. [13]××√××√√××√4Jiang et al. [12]×√√√×√×√×√6Farash et al. [16]××√×××√×××2Alzahrani et al. [31]√√√√√√√√√×9Lu et al. [34]×√×√√√√√×√7Lee et al. [20]√√×√×√√√×√8Ostad-Sharif et al. [33]√√√√√√×√√√9Khatoon and Singh Thakur [32]√√√√√√√×√√9Ours√√√√√√√√√√10S1: conditional anonymity, S2: forward security, S3: untraceability, S4: mutual authentication, S5: resistance to replay attacks, S6: resistance to man-in-the-middle attack, S7: user login authentication, S8: resistance to device-stealing attacks, S9: resistance to privileged-inside attack, S10: secure user password change.


### 5.2. Performance

In this section, the proposed scheme of this paper is compared with the presented authentication schemes in related studies [12, 13, 16–18, 20, 31–34] in terms of both communication cost and computational complexity. Since the related schemes are the most recent or influential works in this field that improved either the security or efficiency of their previous schemes, therefore, we will compare our scheme with them.Due to the external impact on message transmission time, this section only considers the message processing time of the client and server in the authentication phase. The proposed scheme includes four operations: hash operation, NTRU encryption and decryption operation, polynomial modulus, and multiplication operation, which are represented byTH, TNE, TND, and TNM, respectively. Based on the hardware and software shown in Table 7, these four operations running time of proposed scheme are evaluated. We recorded the operation time of NTRU and the single operation time of elliptic curve obtained by analyzing the related scheme [10, 20, 23, 30–34] in Table 7.Table 7
Running time of single operation.
NotationDefinition≈TimemsTHExecution time for one-way hash function0.004TNEExecution time for NTRU encryption0.13TNDExecution time for NTRU decryption0.086TNMExecution time for NTRU modulus multiplication0.0138TSExecution time for symmetrical encryption/decryption0.075TEExecution time for ECC-based encryption/decryption3.85TMExecution time for modular exponent operation3.85TPExecution time for elliptic curve point multiplication2.226TAExecution time for elliptic curve point addition0.025TCExecution time for Chebyshev polynomial computation2.226Configuration of experiment CPU: i7-6700, 4 core 8 threads, 3.4GHZ, OS: Windows10, Software: IntelliJ IDEA2019 library: libntruhttps://github.com/tbuktu/ntruTable8 shows the authentication time comparison of the proposed scheme with the related scheme. Due to the high performance of NTRU encryption mechanism, the computation time of three entities in proposed scheme is relatively low. As shown in Figure 5, schemes [16, 20] have better execution time; however, they are susceptible to several known attacks and cannot provide the perfect forward secrecy and untraceability respectively. Consequently, for the ubiquitous network environment, our proposed scheme is more practical.Table 8
Computational cost of the client and server.
MUFAHATimes (ms)Wu et al. [18]8TH+2TE4TH+TS+2TE8TH+3TS8.08Grope and Hwang [17]4TH+TM4TH4TH+TM7.748Wen et al. [13]4TH+TM4TH+TM5TH+2TM11.602Jiang et al. [12]3TH+TM4TH5TH+TM7.748Farash et al. [16]6THTH+2TS5TH+2TS0.348Alzahrani et al. [31]9TH + 5TP + 2TA6TH + 4TP + 2TA8TH + 5TP + 3TA31.431Lu et al. [34]10TH + 5TP + 3TA + 2TS6TH + 4TP + 2TA9TH + 6TP + 5TA + TS33.965Lee et al. [20]7TH4TH9TH + 2TS0.23Ostad-Sharif et al. [33]9TH + 2TC3TH + 2TC9TH8.988Khatoon et al. [32]9TH + 3TP5TH + 2TP6TH + TP13.436Ours5TH+TNE+TND+TNM4TH+TNE+TND+TNM5TH + TNE+TND0.7276Figure 5
Computational cost of schemes.Table9 and Figure 6 provide comparison of communication overhead between the proposed scheme and related scheme during the authentication phase. The total communication cost of our protocol is 3903 bits, only lower than that of Wu et al. [18]. However, the communication cost of MU is only 974 bits which is lower than that of Grope and Hwang [17], Wen et al. [13], Jiang et al. [12], Alzahrani et al. [31], and Lu et al. [34]. Therefore, the proposed scheme is more friendly to mobile devices with limited resources. With comprehensive consideration from the performance (computational cost and communication cost) and security attributes, the proposed scheme makes a better tradeoff and makes it more suitable to ubiquitous networks.Table 9
Comparison of communication overhead.
MUFAHAOverhead (bits)Wu et al. [18]86423367363936Grope and Hwang [17]115216003203072Wen et al. [13]115216003203072Jiang et al. [12]115217283203200Farash et al. [16]6088322561696Alzahrani et al. [31]102412169923232Lu et al. [34]108812169923296Lee et al. [20]70416965762976Ostad-Sharif et al. [33]96015684803008Khatoon and Singh Thakur [32]86413124803264Ours97419809493903Figure 6
Comparison of computational cost.


## 5.1. Security

### 5.1.1. Formal Security Proof

(1) Security Model. This section defines the security model of lattice-based authentication protocol, which is based on the security model proposed by Bellare et al. [63–65]. The attack capability of the adversary A is defined by a series of oracle queries and security assumptions. A proceeds an interaction experiment by performing a series of oracle queries with any participant instances in the protocol ∏Ui. In the course of interaction, A is given the ability to attack protocols. The security of the key exchange means that any adversary A cannot distinguish between session keys and random strings generated by honest protocol participant polynomial time random prediction queries. An honest protocol participant U has different instances ∏Ui, and it can execute the protocol concurrently. The adversary A can use the following predictors to interact with different instances of honest players: (i)
Hashm: A queries the random oracle for the hash result. The random oracle returns the result which is existing in the list; else, it chooses a random number r, records (m,r) in a hash table and then returns r.(ii)
Execute∏Ui: this query models the adversary’s ability to eavesdrop passively on the protocol, A can eavesdrop on the honest protocol execution process. The output consists of messages exchanged during protocol execution.(iii)
Send∏Ui,m: this query models the adversary’s ability to actively attack a protocol, A can intercept a message and change it, or simply forward it to a target instance. The input is the message m sent by the adversary to Pi, and the output is the corresponding message generated by Pi based on the message m.(iv)
Corrupt∏Ui: this query models the ability of adversary A to corrupt the protocol participant U and returns the user’s password.(v)
Reveal∏Ui: A obtains the session key possessed by ∏Ui. This query models a session key leak.(vi)
Test∏Ui: this query relates to the semantic security of the session key SK. This query was made after many other queries had been made by A. The random oracle selects a random bit b∈0,1. If b=0, the oracle returns a random value of the same length as the session key, and if b=1, the oracle returns the real session key held by ∏Ui.Semantic security: consideringA executes the key exchange protocol P, A interacts with Execute, Send, Reveal, and Test oracles, and finally outputs the bit value b, as a guess of b. If b=b,, the adversary is considered successful. Let Succ denote the event that the adversary is successful. Then, the advantage of the adversary successfully breaking the protocol P is defined as follows:(44)AdvPAKEA=PrSuccPAKEA−12.This authenticated key exchange protocol is considered secure ifAdvPAKEA is negligible.(2) Security Proof.Theorem 1.
An adversaryA makes qse, qexe, qre, and qco queries of type Send, Execute, Reval, and Curropt in time t, respectively, and qro queries to the random oracles:(45)AdvPAKEA=qH12+qse+qex2pn+qH22+qH42+2qse+qex2qk+qH32+qse+qex2qn+qseD.Proof.
We use seven experimentsGame0, Game1,…, Game5, Game6 to prove the security of the protocol, which has AdvGame0akeA≤AdvGame1akeA+negln≤⋯≤AdvGame6akeA+negln, and negln is negligible values in n.Game0. This experiment represents an original protocol execution.Game1. In this experiment, we simulated Send, Reveal, Test, and Execute queries as Tables 4 and 5 show, and H1, H2, H3, and H4 are also simulated by maintaining hash list ∧H1, ∧H2, ∧H3, and ∧H4:(46)AdvGame0akeA≤AdvGame1akeA+negln.Table 4
Simulation ofReveal, Test, and Execute query.
Reveal∏Ui: return the session key of MUiandFAiTest∏Ui: on a query TestMUi/FAi, oracle selects a random bit b∈0,1; if b=1, return a session key; if b=0, return a random value with the same lengthExecute∏Ui: on a query ExecuteMUi,FAi,HAi, return the protocol message exchanged between three entities m1,m2,m3,m4Table 5
Simulation ofSend query.
(1) On a querySendMUi,start, which denotes the start of protocol, assuming MUi runs correctly, then MUiperforms the first step operation of the authentication process; then, the query is answered with m1=SID,h0,V1,V2,tMU,IDHA(2) On a querySendFAi,m1, assuming MUi runs correctly, then FAi performs the second step operation of the authentication process; then, the query is answered with m2=m1,IDFA,MAC,tFA(3) On a querySendHAi,m2, assuming HAi runs correctly, then HAi performs the third step operation of the authentication process; then, the query is answered with m3=h1,h2,V3,V4,V5,hMU(4) On a querySendFAi,m3, assuming FAi runs correctly, then FAi performs the fourth step operation of the authentication process; then, the query is answered with m4=h3,h1,V5,V6(5) On a querySendMUi,m4, assuming MUi runs correctly, then MUi executes the fifth step operation of the authentication process; then, the query is answered with m5=H2SKMFhFAKMFProof.
In the proposed protocol,H1, H2, H3, and H4 act as random oracles, so A cannot distinguish random values and the output of hash function:H1m: if there is a record m,r in the list ∧H1, returns r. If not, choose a random string r∈Rp, add m,r to the list ∧H1, and then return r.H2m: if there is a record m,r in the list ∧H2, returns r. If not, choose a random string r∈zq∗, add m,r to the list ∧H2, and then return r.H3m: if there is a record m,r in the list ∧H3, return r. If not, choose a random string r∈Rq, add m,r to the list ∧H3, and then return r.H4m: if there is a record m,r in the list ∧H4, return r. If not, choose a random string r∈zq∗, add m,r to the list ∧H4, and then return.Game2. This game simulates all oracles as Game1 expects the cancelation of the game when A guesses the password correctly. This modification increases the adversary’s chances at breaking the game, but the adversary’s advantage is still negligible:(47)AdvGame1akeA≤AdvGame2akeA+negln.Proof.
(1)
SinceIDMU is invisible to the adversary A, the adversary can only log in by guessing IDMU, and this probability is qse/pn(2)
A needs to query random oracles to distinguish Game2 from Game1, and this probability is qro/pn
If event.1 and event.2 do not happen, andGame2 and Game1 are indistinguishable, so(48)PrGame1akeA≤PrGame2akeA+qse+qropn.Game3.Game2 is almost identical to Game3, but once honest parties choose random SID seen previously in the execution, this game will be forcefully ceased:(49)AdvGame2akeA≤AdvGame3akeA+qse+qex+qroqse+qexqk.Proof.
SID is a string of lengthk generated by H4, which cardinal is qk. SID is generated after Send,ro, and Execute queries. The probability of generating this value in previous Send, Execute, or random oracle query is qse+qex+qro/qk; therefore, the probability of SID being not unique is qse+qex+qroqse+qex/qk.Game4. making the following changes to the Send queries, replace xMU,xFA with random values xMU∗,xFA∗ to compute KMF. For the messages that contain xMU,xFA, use random values xMU∗,xFA∗ computes then responds to A. Since the two values are randomly selected in the polynomial space and the secret values are transmitted through encryption and are invisible to the A, this modification does not increase the probability of the A in violating protocol:(50)AdvGame3akeA≤AdvGame4akeA+negln.Proof.
xMU,xFA is encrypted and decrypted by NTRU algorithm. The related information about plaintext cannot be obtained by adversary who only holds public key and ciphertext without private key. Construct an algorithm ℳ to run adversary A to break the encryption scheme.
A sends xMU∗,xFA∗ and xMU,xFA to algorithm ℳ.ℳ selects one of them to execute encryption and then sends ciphertext to adversary. A guesses the encryption result and outputs a bit b. If parameters are selected properly, the advantage of the adversary is negligible.Game5. In order to increase the adversary’s chances at winning the game, we simulate all oracles nearly identical to Game4 except that there are collision events happen on the transcript m1,m2,m3,m4 in the output of hash queries during the execution of protocol. The adversary perform a polynomial number queries of H1, H2, H3, and H4 to catch collision:(51)AdvGame0akeA≤AdvGame1akeA+qH12+qse+qex2pn+qH42+qH22+qse+qex2qk+qH32+qse+qex2qn.Proof.
Since authentication messages are generated with random numbers, so authentication messages are different at every authentication phase. If the are collision events happen, the adversary succeeds. According to Gardy et al. [66] birthday attack, Game4 and Game5 are distinguishable when collisions occur, and the probability of collisions happened is qH12+qse+qex2/2H1+qH22+qse+qex2/2H2+qH32+qse+qex2/2H3+qH42+qse+qex2/2H4. Η1, H2, H3, and H4 are the size of the dictionary space corresponding to the hash function show above, and H1=pn, H2=qk, H3=qn, and H4=qk.Game6. All passwords in the protocol are saved by an internal password oracle, and it accepts queries to test the given password for MU is correct or not. The internal password oracle is invisible to the adversary and generates all passwords during initialization:(52)AdvGame5akeA≤AdvGame6akeA+negln.Proof.
The adversary cannot obtain their corresponding private keys by attacking the public keys of MU and FA, so the private key of MU and FA are invisible to the adversary, and in previous games,KMF is calculated with randomly selected values. The session key is a random value at this time, and the information held by the adversary is irrelevant to the session key, so the can only attack the protocol by guessing the bit b or attack the protocol by attacking the user’s password online. We denote the event that adversary succeeding in Game6 by SUCCGame6akeA; EGuss represents the event that adversary attack protocol by guessing the password. We can easily bound the probability of success in Game6 created by adversary A as the following equation:(53)PrSUCCGame6akeA≤PrGussEGuss+PrSUCCGame6akeA|¬EGussPr¬EGuss.
Note thatPrEGuss≤qse/D, if these passwords are chosen randomly from a dictionary of D and the event EGuss does not happen, and the only way for adversary to succeed is to guess bit b through Test query. Therefore, PrSUCCGame6akeA|¬Guss=1/2.(54)PrSUCCGame6akeA≤PrGuss+PrSUCCGame6akeA¬GussPr¬Guss≤PrGuss+PrSUCCGame6akeA¬Guss1−PrGuss≤qseD+121−qseD≤12+qse2D.
By the above calculation, we conclude that(55)AdvGame6akeA=2PrSUCCGame6akeA−1≤qseD.
Finally, it can be computed that the advantage of the adversary is ignorable by analyzingGame0, Game1, …, Game5, Game6. Hereby, Theorem 1 is concluded.


### 5.1.2. Informal Security Analysis

Security analysis:(i)
Conditional anonymity: the identity information of the roaming terminal MU is invisible to the foreign agent FA. MU only communicates with the field agent FA through the pseudorandomSID, and SID will vary every one authenticated process. Therefore, the roaming terminal MU is strongly anonymous to the foreign agent FA. If there is a malicious roaming terminal MU in the system, it is necessary to find out its real identity information in time. Since each authentication process requires participation of the home agent HA, and the home agent HA establishes the association between SID and IDMU before. Hence, HA can reveal the user’s real identity IDMU through SID.(ii)
Forward security: forward security means that even though an attacker obtains the private keys of roaming mobile user MU and home agent FA through some means, he cannot calculate the previous session key successfully negotiated between MU and FA. SinceSKFM=H3SIDKFMIDFA, where SID is related to randomly selected rMU. SID value is different in each authentication process.(iii)
Untraceability: even if the adversary can intercept all the information exchanged between protocol participants, it cannot track the behavior information of the roaming terminal MU. All exchanged messages andSID generated by the roaming terminal MU during each interaction are all random values, so untraceable properties are satisfied in the proposed scheme.(iv)
Mutual authentication: in this scheme, the adversary cannot participate in the generation and response of protocol authentication messages. The scheme participants are the roaming terminal MU, the foreign agent FA, and the home agent HA, respectively, where the authentication messages generated by MU and FA can only be decrypted by the legitimate home agent HA. Then, the legitimate home agent HA helps them perform the authentication process and generate the session key correctly only if the three parties trust each other.(v)
User login authentication: in order to improve the security of scheme, the smart card should verify the validity of user when login. In the proposed scheme, the user enters the identityIDMU and password IDMU when logging in. The smart card SC calculates HMU′=H1IDMUPWMUλ and verifies its validity. If the equation holds, the identity of MU IDMU is valid and SC allow user to login in; otherwise, SC denies the login request.(vi)
Resistance to replay attacks: in the proposed scheme, the messages for authentication that are sent by mobile user MU and foreign agent contain timestamps; when FA and HA execute authentication process, each entity firstly verifies the validity of timestamp contained in messages, and then proceeds subsequent operations. Furthermore, the random numbersrMU ensures that the authentication information is varies in every authentication process so that the adversary cannot perform the replay attacks with the exchanged messages sent before.(vii)
Resistance to man-in-the-middle attack: in the proposed scheme, suppose that an attacker exists in a communication channel who attempts to execute man-in-the-middle attack by intercepting and tampering with communication messages. If he or she tries to tamper with the messagem1, he or she must first tamper with the encrypted messages V1 and V2, which are encrypted by NTRU encryption mechanism. Due to SVP and CVP, the attacker cannot get the private key to decrypt the message, so the adversary cannot tamper with the message m1 successfully. While other messages contain information generated by One-way Hash functions, the attacker needs to solve the anticollision problem of Hash functions to tamper with the message, so the attacker will also fail.(viii)
Resistance to device-stealing attacks: even if adversaries get user’s mobile device, he cannot recover user’s password and identity information from the user’s smart card, and he can only log in the device by guessing the user’s password and identity, so our scheme can resist device-stealing attacks.(ix)
Resistance to privileged-inside attack: in the registration stage, MU sends HA the registration informationIDMU,HMU,λ. HA cannot extract MU’s password information from the registration information. In addition, MU can also update passwords on smart card without the participation of HA. Finally, the session key negotiated by MU and FA is not visible to HA, so this scheme is resistant to privileged-inside attacks.(x)
Secure user password change: mobile user executes password change phase when the mobile user wants to change the password for the purpose of security. After passing the authentication of smart card, the old password will be replaced by a new password selected by user only in password change phase, FA and HA will not participate in this phase. Therefore, our password change phase is reasonable and security.Based on the analysis of the security of the proposed scheme, we conduct security comparison with related scheme as in Table6. The results show that only the proposed scheme provides all the required features and resists known attacks, whereas competing schemes lack either some features or ensuring against some known attack. In addition, the proposed scheme can also resist to quantum attack, while the related schemes lack this feature.Table 6
Security comparison of the scheme.
S1S2S3S4S5S6S7S8S9S10SecurityWu et al. [18]√√√√√√×√×√8Grope and Hwang [17]××√√√√√×√√7Wen et al. [13]××√××√√××√4Jiang et al. [12]×√√√×√×√×√6Farash et al. [16]××√×××√×××2Alzahrani et al. [31]√√√√√√√√√×9Lu et al. [34]×√×√√√√√×√7Lee et al. [20]√√×√×√√√×√8Ostad-Sharif et al. [33]√√√√√√×√√√9Khatoon and Singh Thakur [32]√√√√√√√×√√9Ours√√√√√√√√√√10S1: conditional anonymity, S2: forward security, S3: untraceability, S4: mutual authentication, S5: resistance to replay attacks, S6: resistance to man-in-the-middle attack, S7: user login authentication, S8: resistance to device-stealing attacks, S9: resistance to privileged-inside attack, S10: secure user password change.


## 5.1.1. Formal Security Proof

(1) Security Model. This section defines the security model of lattice-based authentication protocol, which is based on the security model proposed by Bellare et al. [63–65]. The attack capability of the adversary A is defined by a series of oracle queries and security assumptions. A proceeds an interaction experiment by performing a series of oracle queries with any participant instances in the protocol ∏Ui. In the course of interaction, A is given the ability to attack protocols. The security of the key exchange means that any adversary A cannot distinguish between session keys and random strings generated by honest protocol participant polynomial time random prediction queries. An honest protocol participant U has different instances ∏Ui, and it can execute the protocol concurrently. The adversary A can use the following predictors to interact with different instances of honest players: (i)
Hashm: A queries the random oracle for the hash result. The random oracle returns the result which is existing in the list; else, it chooses a random number r, records (m,r) in a hash table and then returns r.(ii)
Execute∏Ui: this query models the adversary’s ability to eavesdrop passively on the protocol, A can eavesdrop on the honest protocol execution process. The output consists of messages exchanged during protocol execution.(iii)
Send∏Ui,m: this query models the adversary’s ability to actively attack a protocol, A can intercept a message and change it, or simply forward it to a target instance. The input is the message m sent by the adversary to Pi, and the output is the corresponding message generated by Pi based on the message m.(iv)
Corrupt∏Ui: this query models the ability of adversary A to corrupt the protocol participant U and returns the user’s password.(v)
Reveal∏Ui: A obtains the session key possessed by ∏Ui. This query models a session key leak.(vi)
Test∏Ui: this query relates to the semantic security of the session key SK. This query was made after many other queries had been made by A. The random oracle selects a random bit b∈0,1. If b=0, the oracle returns a random value of the same length as the session key, and if b=1, the oracle returns the real session key held by ∏Ui.Semantic security: consideringA executes the key exchange protocol P, A interacts with Execute, Send, Reveal, and Test oracles, and finally outputs the bit value b, as a guess of b. If b=b,, the adversary is considered successful. Let Succ denote the event that the adversary is successful. Then, the advantage of the adversary successfully breaking the protocol P is defined as follows:(44)AdvPAKEA=PrSuccPAKEA−12.This authenticated key exchange protocol is considered secure ifAdvPAKEA is negligible.(2) Security Proof.Theorem 1.
An adversaryA makes qse, qexe, qre, and qco queries of type Send, Execute, Reval, and Curropt in time t, respectively, and qro queries to the random oracles:(45)AdvPAKEA=qH12+qse+qex2pn+qH22+qH42+2qse+qex2qk+qH32+qse+qex2qn+qseD.Proof.
We use seven experimentsGame0, Game1,…, Game5, Game6 to prove the security of the protocol, which has AdvGame0akeA≤AdvGame1akeA+negln≤⋯≤AdvGame6akeA+negln, and negln is negligible values in n.Game0. This experiment represents an original protocol execution.Game1. In this experiment, we simulated Send, Reveal, Test, and Execute queries as Tables 4 and 5 show, and H1, H2, H3, and H4 are also simulated by maintaining hash list ∧H1, ∧H2, ∧H3, and ∧H4:(46)AdvGame0akeA≤AdvGame1akeA+negln.Table 4
Simulation ofReveal, Test, and Execute query.
Reveal∏Ui: return the session key of MUiandFAiTest∏Ui: on a query TestMUi/FAi, oracle selects a random bit b∈0,1; if b=1, return a session key; if b=0, return a random value with the same lengthExecute∏Ui: on a query ExecuteMUi,FAi,HAi, return the protocol message exchanged between three entities m1,m2,m3,m4Table 5
Simulation ofSend query.
(1) On a querySendMUi,start, which denotes the start of protocol, assuming MUi runs correctly, then MUiperforms the first step operation of the authentication process; then, the query is answered with m1=SID,h0,V1,V2,tMU,IDHA(2) On a querySendFAi,m1, assuming MUi runs correctly, then FAi performs the second step operation of the authentication process; then, the query is answered with m2=m1,IDFA,MAC,tFA(3) On a querySendHAi,m2, assuming HAi runs correctly, then HAi performs the third step operation of the authentication process; then, the query is answered with m3=h1,h2,V3,V4,V5,hMU(4) On a querySendFAi,m3, assuming FAi runs correctly, then FAi performs the fourth step operation of the authentication process; then, the query is answered with m4=h3,h1,V5,V6(5) On a querySendMUi,m4, assuming MUi runs correctly, then MUi executes the fifth step operation of the authentication process; then, the query is answered with m5=H2SKMFhFAKMFProof.
In the proposed protocol,H1, H2, H3, and H4 act as random oracles, so A cannot distinguish random values and the output of hash function:H1m: if there is a record m,r in the list ∧H1, returns r. If not, choose a random string r∈Rp, add m,r to the list ∧H1, and then return r.H2m: if there is a record m,r in the list ∧H2, returns r. If not, choose a random string r∈zq∗, add m,r to the list ∧H2, and then return r.H3m: if there is a record m,r in the list ∧H3, return r. If not, choose a random string r∈Rq, add m,r to the list ∧H3, and then return r.H4m: if there is a record m,r in the list ∧H4, return r. If not, choose a random string r∈zq∗, add m,r to the list ∧H4, and then return.Game2. This game simulates all oracles as Game1 expects the cancelation of the game when A guesses the password correctly. This modification increases the adversary’s chances at breaking the game, but the adversary’s advantage is still negligible:(47)AdvGame1akeA≤AdvGame2akeA+negln.Proof.
(1)
SinceIDMU is invisible to the adversary A, the adversary can only log in by guessing IDMU, and this probability is qse/pn(2)
A needs to query random oracles to distinguish Game2 from Game1, and this probability is qro/pn
If event.1 and event.2 do not happen, andGame2 and Game1 are indistinguishable, so(48)PrGame1akeA≤PrGame2akeA+qse+qropn.Game3.Game2 is almost identical to Game3, but once honest parties choose random SID seen previously in the execution, this game will be forcefully ceased:(49)AdvGame2akeA≤AdvGame3akeA+qse+qex+qroqse+qexqk.Proof.
SID is a string of lengthk generated by H4, which cardinal is qk. SID is generated after Send,ro, and Execute queries. The probability of generating this value in previous Send, Execute, or random oracle query is qse+qex+qro/qk; therefore, the probability of SID being not unique is qse+qex+qroqse+qex/qk.Game4. making the following changes to the Send queries, replace xMU,xFA with random values xMU∗,xFA∗ to compute KMF. For the messages that contain xMU,xFA, use random values xMU∗,xFA∗ computes then responds to A. Since the two values are randomly selected in the polynomial space and the secret values are transmitted through encryption and are invisible to the A, this modification does not increase the probability of the A in violating protocol:(50)AdvGame3akeA≤AdvGame4akeA+negln.Proof.
xMU,xFA is encrypted and decrypted by NTRU algorithm. The related information about plaintext cannot be obtained by adversary who only holds public key and ciphertext without private key. Construct an algorithm ℳ to run adversary A to break the encryption scheme.
A sends xMU∗,xFA∗ and xMU,xFA to algorithm ℳ.ℳ selects one of them to execute encryption and then sends ciphertext to adversary. A guesses the encryption result and outputs a bit b. If parameters are selected properly, the advantage of the adversary is negligible.Game5. In order to increase the adversary’s chances at winning the game, we simulate all oracles nearly identical to Game4 except that there are collision events happen on the transcript m1,m2,m3,m4 in the output of hash queries during the execution of protocol. The adversary perform a polynomial number queries of H1, H2, H3, and H4 to catch collision:(51)AdvGame0akeA≤AdvGame1akeA+qH12+qse+qex2pn+qH42+qH22+qse+qex2qk+qH32+qse+qex2qn.Proof.
Since authentication messages are generated with random numbers, so authentication messages are different at every authentication phase. If the are collision events happen, the adversary succeeds. According to Gardy et al. [66] birthday attack, Game4 and Game5 are distinguishable when collisions occur, and the probability of collisions happened is qH12+qse+qex2/2H1+qH22+qse+qex2/2H2+qH32+qse+qex2/2H3+qH42+qse+qex2/2H4. Η1, H2, H3, and H4 are the size of the dictionary space corresponding to the hash function show above, and H1=pn, H2=qk, H3=qn, and H4=qk.Game6. All passwords in the protocol are saved by an internal password oracle, and it accepts queries to test the given password for MU is correct or not. The internal password oracle is invisible to the adversary and generates all passwords during initialization:(52)AdvGame5akeA≤AdvGame6akeA+negln.Proof.
The adversary cannot obtain their corresponding private keys by attacking the public keys of MU and FA, so the private key of MU and FA are invisible to the adversary, and in previous games,KMF is calculated with randomly selected values. The session key is a random value at this time, and the information held by the adversary is irrelevant to the session key, so the can only attack the protocol by guessing the bit b or attack the protocol by attacking the user’s password online. We denote the event that adversary succeeding in Game6 by SUCCGame6akeA; EGuss represents the event that adversary attack protocol by guessing the password. We can easily bound the probability of success in Game6 created by adversary A as the following equation:(53)PrSUCCGame6akeA≤PrGussEGuss+PrSUCCGame6akeA|¬EGussPr¬EGuss.
Note thatPrEGuss≤qse/D, if these passwords are chosen randomly from a dictionary of D and the event EGuss does not happen, and the only way for adversary to succeed is to guess bit b through Test query. Therefore, PrSUCCGame6akeA|¬Guss=1/2.(54)PrSUCCGame6akeA≤PrGuss+PrSUCCGame6akeA¬GussPr¬Guss≤PrGuss+PrSUCCGame6akeA¬Guss1−PrGuss≤qseD+121−qseD≤12+qse2D.
By the above calculation, we conclude that(55)AdvGame6akeA=2PrSUCCGame6akeA−1≤qseD.
Finally, it can be computed that the advantage of the adversary is ignorable by analyzingGame0, Game1, …, Game5, Game6. Hereby, Theorem 1 is concluded.


## 5.1.2. Informal Security Analysis

Security analysis:(i)
Conditional anonymity: the identity information of the roaming terminal MU is invisible to the foreign agent FA. MU only communicates with the field agent FA through the pseudorandomSID, and SID will vary every one authenticated process. Therefore, the roaming terminal MU is strongly anonymous to the foreign agent FA. If there is a malicious roaming terminal MU in the system, it is necessary to find out its real identity information in time. Since each authentication process requires participation of the home agent HA, and the home agent HA establishes the association between SID and IDMU before. Hence, HA can reveal the user’s real identity IDMU through SID.(ii)
Forward security: forward security means that even though an attacker obtains the private keys of roaming mobile user MU and home agent FA through some means, he cannot calculate the previous session key successfully negotiated between MU and FA. SinceSKFM=H3SIDKFMIDFA, where SID is related to randomly selected rMU. SID value is different in each authentication process.(iii)
Untraceability: even if the adversary can intercept all the information exchanged between protocol participants, it cannot track the behavior information of the roaming terminal MU. All exchanged messages andSID generated by the roaming terminal MU during each interaction are all random values, so untraceable properties are satisfied in the proposed scheme.(iv)
Mutual authentication: in this scheme, the adversary cannot participate in the generation and response of protocol authentication messages. The scheme participants are the roaming terminal MU, the foreign agent FA, and the home agent HA, respectively, where the authentication messages generated by MU and FA can only be decrypted by the legitimate home agent HA. Then, the legitimate home agent HA helps them perform the authentication process and generate the session key correctly only if the three parties trust each other.(v)
User login authentication: in order to improve the security of scheme, the smart card should verify the validity of user when login. In the proposed scheme, the user enters the identityIDMU and password IDMU when logging in. The smart card SC calculates HMU′=H1IDMUPWMUλ and verifies its validity. If the equation holds, the identity of MU IDMU is valid and SC allow user to login in; otherwise, SC denies the login request.(vi)
Resistance to replay attacks: in the proposed scheme, the messages for authentication that are sent by mobile user MU and foreign agent contain timestamps; when FA and HA execute authentication process, each entity firstly verifies the validity of timestamp contained in messages, and then proceeds subsequent operations. Furthermore, the random numbersrMU ensures that the authentication information is varies in every authentication process so that the adversary cannot perform the replay attacks with the exchanged messages sent before.(vii)
Resistance to man-in-the-middle attack: in the proposed scheme, suppose that an attacker exists in a communication channel who attempts to execute man-in-the-middle attack by intercepting and tampering with communication messages. If he or she tries to tamper with the messagem1, he or she must first tamper with the encrypted messages V1 and V2, which are encrypted by NTRU encryption mechanism. Due to SVP and CVP, the attacker cannot get the private key to decrypt the message, so the adversary cannot tamper with the message m1 successfully. While other messages contain information generated by One-way Hash functions, the attacker needs to solve the anticollision problem of Hash functions to tamper with the message, so the attacker will also fail.(viii)
Resistance to device-stealing attacks: even if adversaries get user’s mobile device, he cannot recover user’s password and identity information from the user’s smart card, and he can only log in the device by guessing the user’s password and identity, so our scheme can resist device-stealing attacks.(ix)
Resistance to privileged-inside attack: in the registration stage, MU sends HA the registration informationIDMU,HMU,λ. HA cannot extract MU’s password information from the registration information. In addition, MU can also update passwords on smart card without the participation of HA. Finally, the session key negotiated by MU and FA is not visible to HA, so this scheme is resistant to privileged-inside attacks.(x)
Secure user password change: mobile user executes password change phase when the mobile user wants to change the password for the purpose of security. After passing the authentication of smart card, the old password will be replaced by a new password selected by user only in password change phase, FA and HA will not participate in this phase. Therefore, our password change phase is reasonable and security.Based on the analysis of the security of the proposed scheme, we conduct security comparison with related scheme as in Table6. The results show that only the proposed scheme provides all the required features and resists known attacks, whereas competing schemes lack either some features or ensuring against some known attack. In addition, the proposed scheme can also resist to quantum attack, while the related schemes lack this feature.Table 6
Security comparison of the scheme.
S1S2S3S4S5S6S7S8S9S10SecurityWu et al. [18]√√√√√√×√×√8Grope and Hwang [17]××√√√√√×√√7Wen et al. [13]××√××√√××√4Jiang et al. [12]×√√√×√×√×√6Farash et al. [16]××√×××√×××2Alzahrani et al. [31]√√√√√√√√√×9Lu et al. [34]×√×√√√√√×√7Lee et al. [20]√√×√×√√√×√8Ostad-Sharif et al. [33]√√√√√√×√√√9Khatoon and Singh Thakur [32]√√√√√√√×√√9Ours√√√√√√√√√√10S1: conditional anonymity, S2: forward security, S3: untraceability, S4: mutual authentication, S5: resistance to replay attacks, S6: resistance to man-in-the-middle attack, S7: user login authentication, S8: resistance to device-stealing attacks, S9: resistance to privileged-inside attack, S10: secure user password change.


## 5.2. Performance

In this section, the proposed scheme of this paper is compared with the presented authentication schemes in related studies [12, 13, 16–18, 20, 31–34] in terms of both communication cost and computational complexity. Since the related schemes are the most recent or influential works in this field that improved either the security or efficiency of their previous schemes, therefore, we will compare our scheme with them.Due to the external impact on message transmission time, this section only considers the message processing time of the client and server in the authentication phase. The proposed scheme includes four operations: hash operation, NTRU encryption and decryption operation, polynomial modulus, and multiplication operation, which are represented byTH, TNE, TND, and TNM, respectively. Based on the hardware and software shown in Table 7, these four operations running time of proposed scheme are evaluated. We recorded the operation time of NTRU and the single operation time of elliptic curve obtained by analyzing the related scheme [10, 20, 23, 30–34] in Table 7.Table 7
Running time of single operation.
NotationDefinition≈TimemsTHExecution time for one-way hash function0.004TNEExecution time for NTRU encryption0.13TNDExecution time for NTRU decryption0.086TNMExecution time for NTRU modulus multiplication0.0138TSExecution time for symmetrical encryption/decryption0.075TEExecution time for ECC-based encryption/decryption3.85TMExecution time for modular exponent operation3.85TPExecution time for elliptic curve point multiplication2.226TAExecution time for elliptic curve point addition0.025TCExecution time for Chebyshev polynomial computation2.226Configuration of experiment CPU: i7-6700, 4 core 8 threads, 3.4GHZ, OS: Windows10, Software: IntelliJ IDEA2019 library: libntruhttps://github.com/tbuktu/ntruTable8 shows the authentication time comparison of the proposed scheme with the related scheme. Due to the high performance of NTRU encryption mechanism, the computation time of three entities in proposed scheme is relatively low. As shown in Figure 5, schemes [16, 20] have better execution time; however, they are susceptible to several known attacks and cannot provide the perfect forward secrecy and untraceability respectively. Consequently, for the ubiquitous network environment, our proposed scheme is more practical.Table 8
Computational cost of the client and server.
MUFAHATimes (ms)Wu et al. [18]8TH+2TE4TH+TS+2TE8TH+3TS8.08Grope and Hwang [17]4TH+TM4TH4TH+TM7.748Wen et al. [13]4TH+TM4TH+TM5TH+2TM11.602Jiang et al. [12]3TH+TM4TH5TH+TM7.748Farash et al. [16]6THTH+2TS5TH+2TS0.348Alzahrani et al. [31]9TH + 5TP + 2TA6TH + 4TP + 2TA8TH + 5TP + 3TA31.431Lu et al. [34]10TH + 5TP + 3TA + 2TS6TH + 4TP + 2TA9TH + 6TP + 5TA + TS33.965Lee et al. [20]7TH4TH9TH + 2TS0.23Ostad-Sharif et al. [33]9TH + 2TC3TH + 2TC9TH8.988Khatoon et al. [32]9TH + 3TP5TH + 2TP6TH + TP13.436Ours5TH+TNE+TND+TNM4TH+TNE+TND+TNM5TH + TNE+TND0.7276Figure 5
Computational cost of schemes.Table9 and Figure 6 provide comparison of communication overhead between the proposed scheme and related scheme during the authentication phase. The total communication cost of our protocol is 3903 bits, only lower than that of Wu et al. [18]. However, the communication cost of MU is only 974 bits which is lower than that of Grope and Hwang [17], Wen et al. [13], Jiang et al. [12], Alzahrani et al. [31], and Lu et al. [34]. Therefore, the proposed scheme is more friendly to mobile devices with limited resources. With comprehensive consideration from the performance (computational cost and communication cost) and security attributes, the proposed scheme makes a better tradeoff and makes it more suitable to ubiquitous networks.Table 9
Comparison of communication overhead.
MUFAHAOverhead (bits)Wu et al. [18]86423367363936Grope and Hwang [17]115216003203072Wen et al. [13]115216003203072Jiang et al. [12]115217283203200Farash et al. [16]6088322561696Alzahrani et al. [31]102412169923232Lu et al. [34]108812169923296Lee et al. [20]70416965762976Ostad-Sharif et al. [33]96015684803008Khatoon and Singh Thakur [32]86413124803264Ours97419809493903Figure 6
Comparison of computational cost.


## 6. Conclusion

We put forward a lattice-based roaming authentication scheme. We use formal security proofs and informal analysis to prove the security of our scheme. In addition, BAN logic analysis demonstrates that the proposed scheme is correct and mutual authentication is achieved. Through rigorous theoretical analysis and simulation experiments, we prove that the proposed scheme has better performance and feasibility, which can meet the security requirements of the roaming authentication scheme. We concluded that our lattice-based roaming authentication provides fully secured mutual authentication and conditional anonymity, which can also resist different security attacks such as tractability, replay attack, privileged-inside attack, and especially quantum attack. Security and performance results show that the proposed scheme outperforms the existing authentication schemes, but there are still some limitations on the proposed scheme.The public key encryption algorithm involved in this paper is NTRU encryption algorithm. The designer of NTRU mainly chooses reasonable parameters to avoid decryption errors and does not carry out quantitative theoretical analysis on the decryption errors. This limits the range of parameter selection and affects the wide use of NTRU algorithm.


### 6.1. Future Work

In our future work, proposing a revised NTRU algorithm would be learned to solve the inherent decryption failure problem of NTRU algorithm. Then, we can extend the proposed authentication schemes in other scenarios based on revised NTRU algorithm, such as opportunistic networks and wireless sensor networks. And simultaneously, lattice-based multifactor authentication schemes for ubiquitous network would be investigated to accommodate to advanced communication and computation technology, for example, 5G and edge computing.


## 6.1. Future Work

In our future work, proposing a revised NTRU algorithm would be learned to solve the inherent decryption failure problem of NTRU algorithm. Then, we can extend the proposed authentication schemes in other scenarios based on revised NTRU algorithm, such as opportunistic networks and wireless sensor networks. And simultaneously, lattice-based multifactor authentication schemes for ubiquitous network would be investigated to accommodate to advanced communication and computation technology, for example, 5G and edge computing.



---

*Source: 2637916-2020-06-28.xml*