# Attacks and Solutions for a Two-Factor Authentication Protocol for Wireless Body Area Networks

Authors: Chien-Ming Chen; Zhen Li; Shehzad Ashraf Chaudhry; Long Li
Journal: Security and Communication Networks
 (2021)

---

## Abstract

As an extension of the 4G system, 5G is a new generation of broadband mobile communication with high speed, low latency, and large connection characteristics. It solves the problem of human-to-thing and thing-to-thing communication to meet the needs of intelligent medical devices, automotive networking, smart homes, industrial control, environmental monitoring, and other IoT application needs. This has resulted in new research topics related to wireless body area networks. However, such networks are still subject to significant security and privacy threats. Recently, Fotouhi et al. proposed a lightweight and secure two-factor authentication protocol for wireless body area networks in medical IoT. However, in this study, we demonstrate that their proposed protocol is still vulnerable to sensor-capture attacks and the lack of authentication between users and mobile devices. In addition, we propose a new protocol to overcome the limitations mentioned above. A detailed comparison shows that our proposed protocol is better than the previous protocols in terms of security and performance.


---

## Body

## 1. Introduction

Since the beginning of human civilization, the efficient and fast transmission of information has always been an unswerving pursuit for mankind. From writing to printing, from cell towers to radio, from telephones to mobile Internet, the speed of modern technology development has always depended on the speed of information dissemination, and new ways of information dissemination often bring about radical changes in society. 5G (fifth-generation mobile communication technology) is the current stage of progress in the latest wave of mobile communication [1]. 5G is a new generation of broadband mobile communication with high speed, low latency, and large connection characteristics. It is a network infrastructure that enables the interconnection of people, machines, and things. 5G has three major application scenarios: enhanced mobile broadband, ultra-high reliability and low-latency communications, and massive machine-like communications. Enhanced mobile broadband mainly responds to the explosive growth of Internet traffic, and it results in improved user experience for mobile Internet users. Low-latency communication is mainly for applications with high requirements for latency and reliability, such as telemedicine, autonomous driving, and virtual reality. Massive machine-like communication is mainly for applications that involve the sensing and collection of data, such as Internet of Things (IoT) [2–4], smart cities [5–7], smart homes, and environmental monitoring [8–10].In the long run, consumer demand for health will continue to rise, and the development potential of the medical and health fields is huge. Currently, 5G is particularly useful for the healthcare sector, especially for the Internet of Things in the medical field [11–13]. 5G will empower the existing smart healthcare service system, and it will improve the service capability and management efficiency of wireless body area networks, telemedicine, and emergency rescue. It will also give rise to the development and prosperity of smart healthcare.Owing to rapid advancements in life informatization, people’s requirements for medical monitoring are constantly improving. There is also a high demand for more convenient and effective telemedicine and health-sign monitoring. A wireless body area network (WBAN) [14, 15] is a network composed of different intelligent components, such as sensors, nodes, and actuators. The network is designed for collecting and monitoring data from the human body and its surrounding environment. Its typical architecture is shown in Figure 1. For the elderly, sensors/wearable devices on the elderly send the information collected to a gateway node. For the patient, the sensor acquires the patient’s body monitoring data, connects it to a bedside monitor or other receiver, and transmits it wirelessly to a doctor for monitoring or diagnosis. The gateway acts as a local server which analyzes, stores, and manages the data sent by the sensor or monitor. Users, who can be doctors, nurses, or other medical professionals, can communicate with the gateway and access the data they want to know via mobile devices or computer-based devices on a LAN with the gateway. For example, a nurse can specifically track and check a patient’s body data, so that if an abnormality is detected, the patient’s condition can be checked and dealt with in a timely manner.Figure 1
The typical architecture of a WBAN.Because data transmission over a WBAN takes place over a public channel, attackers can access highly sensitive health information of patients. To ensure the security of a WBAN, a secure authentication and key agreement (AKA) protocol should be implemented before communication. Numerous AKA protocols have been proposed [16–21]. However, many of these AKA protocols have proven to be insecure against many types of attacks. Recently, Fotouhi et al. [22] proposed a lightweight and secure two-factor AKA protocol for WBANs in the healthcare-based IoT. They claimed that their proposed protocol is secure against many attacks, such as key disclosure simulation attacks, special session temporary information attacks, and offline password guess attacks.In this study, we first demonstrate that Fotouhi et al.’s proposed protocol [22] is still vulnerable to sensor-capture attacks. Additionally, their proposed protocol fails to provide authentication between users and mobile devices. To overcome these security pitfalls, we propose a secure and efficient AKA protocol for WBANs. The security analysis shows that our proposed protocol is secure. We also provide a detailed comparison to demonstrate that our proposed protocol achieves improved efficiency and security.The remainder of this paper is organized as follows. In Section2, we briefly review the authentication protocol proposed by Fotouhi et al. In Section 3, we provide a reasonable cryptanalysis of Fotouhi et al.’s proposed protocol. In Section 4, we propose a new protocol for improving the flaws in the old protocol. In Section 5, we perform a security analysis, which includes both formal and informal analyses, to demonstrate the security and stability of our proposed protocol. In Section 6, we analyze the security and performance of our proposed protocol in terms of security, performance, and communication cost. Finally, we provide the conclusions to this study.


## 2. Review of Fotouhi et al.’s Protocol

In this section, we briefly review Fotouhi et al.’s authentication protocol. Their proposed protocol includes four phases: initialization, registration, authentication, and password modification. Here we describe only the first two phases. The detailed steps of their proposed protocol can be found in [22]. The notations used in this study are listed in Table 1.Table 1
Notations table.
SymbolDescriptionUi,IDi,PWii-th user, his/her identity, his/her passwordGWj,GIDj,Gjj-th gateway, its identity, its secret keySNk,SIDkk-th sensor, its identityNlNetwork identifier of the sensor setSGkShared key between sensor and gatewaySKuSession key generated by userSKgSession key generated by gatewaySKsSession key generated by userMii-th messageCIDi,QIDkTemporary pseudoidentity ofUi and SNkRs,R0,Ru,Rg,Rx,Ry,RzTemporary random numberGen⋅, Rep⋅Biometric extraction function, decryption functionBIOiBiometric information of thei-th userh(⋅)Hash function⊕Bitwise XOR operation∥Concatenate operation


### 2.1. Sensor Node Registration

In this phase, the corresponding gateway injects the necessary information into each sensor node. We assume that a gatewayGWj is the corresponding gateway of SNk. GWj generates two random numbers, Ry and Rz, after which it injects {SIDk,SGk,QIDk,GIDj,Ry,Rz} into the memory of SNk, where SGk=hSIDk‖Gj‖Nl. GWj also stores {SIDk,Nl,QIDk,Ry,hRz} in its database.


### 2.2. User Registration

Assuming that a user,Ui, desires to register to GWj, the following steps are performed:Step 1:Ui sends IDi and HPWi to GWj through a secure channel, where HPWi=hPWi‖R0.Step 2: ifUi is an unregistered user, GWj generates a pseudoidentity CIDi and a random number Rx, and it stores {IDi,HPWi,CIDi,Rx} in GWj’s database. GWj then calculates A1=hCIDi‖Rx‖GIDj‖GIDj⊕HPWi and A2=hIDi‖Gj⊕hIDi‖HPWi, after which it sends {CIDj,GIDj,A1,A2} to Ui through a secure channel.Step 3:Ui calculates A3=hIDi‖PWi⊕R0, after which it stores {CIDi,GIDj,A1,A2,A3} in the mobile device.


### 2.3. Authentication Phase

Assuming thatUi desires to communicate with SNk, the following steps are performed:Step 1:Ui generates a random number, Ru, after which it calculates R0=A3⊕hIDi‖PW, HPWi=hPWi‖R0, B1=A1⊕HPWi, B2=B1⊕HPWi⊕Ru, B3=SIDk⊕HIDi‖Ru, and B4=hCIDi⊕GIDj⊕SIDk⊕B1⊕IDi⊕Ru. Afterwards, Ui transmits M1 to GWj, where M1 = {CIDi,GIDj,B2,B3,B4}.Step 2:GWj obtains the corresponding IDi,Rx, and HPWi from its database. GWj then calculates B1=hCIDi‖Rx‖GIDj‖Gj and Ru=B2⊕B1⊕HPWi, after which it verifies the correctness of B4. GWj then generates two random numbers, Rg and Rz′, obtains SIDk with B3, obtains Ry from its database, and generates a new pseudonym QIDk′. GWj then calculates SGk=hSIDk‖Gj‖Nl, S=hSGk‖GIDj, B5=Ru⊕HPWi⊕S⊕Ry, B6=Rg⊕S⊕SIDi⊕Ry, B7=QIDk′⊕Rg⊕Ry, B8=hRg‖Ry‖S⊕Rz′, and B9=hQIDk‖B7‖B8‖SGk‖Ru⊕HPWi‖Rg. Afterwards, GWj transmits {QIDk,B5,B6,B7,B8,B9} to SNk.Step 3:SNk verifies the correctness of QIDk. If it is correct, SNk calculates S=hSGk‖GIDj, Ru⊕HPWiB5⊕S⊕Ry, and Rg=B6⊕S⊕SIDk⊕Ry. If B9 is correct, SNk generates a random number, Rs, and it calculates Rz′=hRg‖Ry‖S⊕B8, QIDk′=B7⊕Rg⊕Ry, and B10=Rg⊕S⊕Rz. SNk then stores QIDk′, Rz′, and Ry′=hRy, and it calculates SKs=hRu⊕HPWi‖Rg‖Rs. It then calculates B11=hSGk‖Rg⊕hRy⊕Rs and B12=hB10‖B11‖SKs‖SIDk‖GIDj‖Rs, after which it transmits {B10,B11,B12} to GWj.Step 4:GWj calculates Ry′=hRy and Rz′=Rg⊕S⊕B10. It then verifies whether hRz is equal to hRz′. If the verification is passed, it calculates Rs=B11⊕hSGk‖Rg⊕Ry′ and obtains the session key SKg=hRu⊕HPWi‖Rg‖Rs. It further verifies the correctness of B12, generates a new CIDi′ for Ui, stores QIDk′ and Rz′, and replaces Ry′ and hRx with Ry and Rx, respectively. It then calculates B13=hCIDi′‖hRx‖GIDj‖Gj⊕hRu‖HPWi, B14=hRu‖IDi⊕Rg, B15=hRu‖Rg‖HPWi⊕Rs, B16=hhIDi‖Gj‖Rs⊕CIDi′, and B17=hSKg‖IDi‖B13‖CIDi′. GWj then generates {B13,B14,B15,B16,B17} and transmits it to Ui.Step 5:Ui calculates Rg=B14⊕hRu‖IDi, Rs=B15⊕hRu‖Rg‖HPWi, and CIDi′=B16⊕hA2⊕hIDi‖HPWi‖Rs. Ui then calculates the session key SKu=hRu⊕HPWi‖Rg‖Rs and verifies B17. When the verification is passed, Ui calculates A1′=B13⊕hRu‖HPWi and stores CIDi′ and A1′.


## 2.1. Sensor Node Registration

In this phase, the corresponding gateway injects the necessary information into each sensor node. We assume that a gatewayGWj is the corresponding gateway of SNk. GWj generates two random numbers, Ry and Rz, after which it injects {SIDk,SGk,QIDk,GIDj,Ry,Rz} into the memory of SNk, where SGk=hSIDk‖Gj‖Nl. GWj also stores {SIDk,Nl,QIDk,Ry,hRz} in its database.


## 2.2. User Registration

Assuming that a user,Ui, desires to register to GWj, the following steps are performed:Step 1:Ui sends IDi and HPWi to GWj through a secure channel, where HPWi=hPWi‖R0.Step 2: ifUi is an unregistered user, GWj generates a pseudoidentity CIDi and a random number Rx, and it stores {IDi,HPWi,CIDi,Rx} in GWj’s database. GWj then calculates A1=hCIDi‖Rx‖GIDj‖GIDj⊕HPWi and A2=hIDi‖Gj⊕hIDi‖HPWi, after which it sends {CIDj,GIDj,A1,A2} to Ui through a secure channel.Step 3:Ui calculates A3=hIDi‖PWi⊕R0, after which it stores {CIDi,GIDj,A1,A2,A3} in the mobile device.


## 2.3. Authentication Phase

Assuming thatUi desires to communicate with SNk, the following steps are performed:Step 1:Ui generates a random number, Ru, after which it calculates R0=A3⊕hIDi‖PW, HPWi=hPWi‖R0, B1=A1⊕HPWi, B2=B1⊕HPWi⊕Ru, B3=SIDk⊕HIDi‖Ru, and B4=hCIDi⊕GIDj⊕SIDk⊕B1⊕IDi⊕Ru. Afterwards, Ui transmits M1 to GWj, where M1 = {CIDi,GIDj,B2,B3,B4}.Step 2:GWj obtains the corresponding IDi,Rx, and HPWi from its database. GWj then calculates B1=hCIDi‖Rx‖GIDj‖Gj and Ru=B2⊕B1⊕HPWi, after which it verifies the correctness of B4. GWj then generates two random numbers, Rg and Rz′, obtains SIDk with B3, obtains Ry from its database, and generates a new pseudonym QIDk′. GWj then calculates SGk=hSIDk‖Gj‖Nl, S=hSGk‖GIDj, B5=Ru⊕HPWi⊕S⊕Ry, B6=Rg⊕S⊕SIDi⊕Ry, B7=QIDk′⊕Rg⊕Ry, B8=hRg‖Ry‖S⊕Rz′, and B9=hQIDk‖B7‖B8‖SGk‖Ru⊕HPWi‖Rg. Afterwards, GWj transmits {QIDk,B5,B6,B7,B8,B9} to SNk.Step 3:SNk verifies the correctness of QIDk. If it is correct, SNk calculates S=hSGk‖GIDj, Ru⊕HPWiB5⊕S⊕Ry, and Rg=B6⊕S⊕SIDk⊕Ry. If B9 is correct, SNk generates a random number, Rs, and it calculates Rz′=hRg‖Ry‖S⊕B8, QIDk′=B7⊕Rg⊕Ry, and B10=Rg⊕S⊕Rz. SNk then stores QIDk′, Rz′, and Ry′=hRy, and it calculates SKs=hRu⊕HPWi‖Rg‖Rs. It then calculates B11=hSGk‖Rg⊕hRy⊕Rs and B12=hB10‖B11‖SKs‖SIDk‖GIDj‖Rs, after which it transmits {B10,B11,B12} to GWj.Step 4:GWj calculates Ry′=hRy and Rz′=Rg⊕S⊕B10. It then verifies whether hRz is equal to hRz′. If the verification is passed, it calculates Rs=B11⊕hSGk‖Rg⊕Ry′ and obtains the session key SKg=hRu⊕HPWi‖Rg‖Rs. It further verifies the correctness of B12, generates a new CIDi′ for Ui, stores QIDk′ and Rz′, and replaces Ry′ and hRx with Ry and Rx, respectively. It then calculates B13=hCIDi′‖hRx‖GIDj‖Gj⊕hRu‖HPWi, B14=hRu‖IDi⊕Rg, B15=hRu‖Rg‖HPWi⊕Rs, B16=hhIDi‖Gj‖Rs⊕CIDi′, and B17=hSKg‖IDi‖B13‖CIDi′. GWj then generates {B13,B14,B15,B16,B17} and transmits it to Ui.Step 5:Ui calculates Rg=B14⊕hRu‖IDi, Rs=B15⊕hRu‖Rg‖HPWi, and CIDi′=B16⊕hA2⊕hIDi‖HPWi‖Rs. Ui then calculates the session key SKu=hRu⊕HPWi‖Rg‖Rs and verifies B17. When the verification is passed, Ui calculates A1′=B13⊕hRu‖HPWi and stores CIDi′ and A1′.


## 3. Cryptanalysis of Fotouhi et al.’s Protocol

This section shows that Fotouhi et al.’s protocol [22] is vulnerable to sensor-capture attacks and a lack of authentication between users and mobile devices.


### 3.1. Threat Model

The attacker model briefly describes the capabilities of an attacker. In this study, we use theD−Y model [23–25] and assume that the attacker is A. The detailed capabilities are as follows:(1)
A can eavesdrop and intercept information transmitted by public channels and can forge, delete, replay, and tamper with such information(2)
A can extract the information from the captured sensor nodes(3)
A can access the information stored in the gateway


### 3.2. Sensor-Capture Attack

Assuming thatA captures SNk and obtains {SIDk,SGk,GIDj,Ry,Rz,QIDk} in the memory of sensor SNk, A can calculate the session key SK through the following steps:Step 1: calculateS=hSGk‖GIDj, and then obtain Ru⊕HPWi by calculating B5⊕S⊕RyStep 2: obtainRg by calculating B6⊕S⊕SIDk⊕RyStep 3: obtainRs by calculating hSGk‖Rg⊕hRy⊕B11Therefore,A can calculate the correct session key SK=hRu⊕HPWi‖Rg‖Rs shared among Ui, GWj, and SNk.


### 3.3. Lack of Authentication between Users and Mobile Devices

Assuming that an attackerA captures Ui’s mobile device, A performs the following steps:Step 1: becauseA does not know PWi, A randomly generates PWi′ and then inputs IDi and PWi′ to the captured mobile device. The mobile device calculates and transmits M1 with the fake password PWi′ to GWj.Step 2:GWj verifies GIDj and CIDi, after which it calculates B1 and Ru. Afterwards, GWj attempts to verify the correctness of B4, and GWj realizes that M1 sent from Ui is not legal.Essentially,A does not need to capture a mobile device because the attacker can eavesdrop the M1 between any user and GWj and then send M1 to GWj.The scenario mentioned above illustrates two weaknesses in Fotouhi et al.’s proposed protocol. First, the mobile device does not verify the password that a user inputs. Regardless of whether the password or account number entered byUi is correct, the mobile device sends all the necessary messages to GWj. Second, GWj calculates B1 and Ru before verifying B4. Owing to the limited computing power of a gateway, if an attacker has been sending a large number of error messages to a gateway through multiple mobile devices, the gateway may be paralyzed and unable to respond to the requests of other users, which will result in immeasurable losses in medical Internet environments.


## 3.1. Threat Model

The attacker model briefly describes the capabilities of an attacker. In this study, we use theD−Y model [23–25] and assume that the attacker is A. The detailed capabilities are as follows:(1)
A can eavesdrop and intercept information transmitted by public channels and can forge, delete, replay, and tamper with such information(2)
A can extract the information from the captured sensor nodes(3)
A can access the information stored in the gateway


## 3.2. Sensor-Capture Attack

Assuming thatA captures SNk and obtains {SIDk,SGk,GIDj,Ry,Rz,QIDk} in the memory of sensor SNk, A can calculate the session key SK through the following steps:Step 1: calculateS=hSGk‖GIDj, and then obtain Ru⊕HPWi by calculating B5⊕S⊕RyStep 2: obtainRg by calculating B6⊕S⊕SIDk⊕RyStep 3: obtainRs by calculating hSGk‖Rg⊕hRy⊕B11Therefore,A can calculate the correct session key SK=hRu⊕HPWi‖Rg‖Rs shared among Ui, GWj, and SNk.


## 3.3. Lack of Authentication between Users and Mobile Devices

Assuming that an attackerA captures Ui’s mobile device, A performs the following steps:Step 1: becauseA does not know PWi, A randomly generates PWi′ and then inputs IDi and PWi′ to the captured mobile device. The mobile device calculates and transmits M1 with the fake password PWi′ to GWj.Step 2:GWj verifies GIDj and CIDi, after which it calculates B1 and Ru. Afterwards, GWj attempts to verify the correctness of B4, and GWj realizes that M1 sent from Ui is not legal.Essentially,A does not need to capture a mobile device because the attacker can eavesdrop the M1 between any user and GWj and then send M1 to GWj.The scenario mentioned above illustrates two weaknesses in Fotouhi et al.’s proposed protocol. First, the mobile device does not verify the password that a user inputs. Regardless of whether the password or account number entered byUi is correct, the mobile device sends all the necessary messages to GWj. Second, GWj calculates B1 and Ru before verifying B4. Owing to the limited computing power of a gateway, if an attacker has been sending a large number of error messages to a gateway through multiple mobile devices, the gateway may be paralyzed and unable to respond to the requests of other users, which will result in immeasurable losses in medical Internet environments.


## 4. The Improved Protocol

In this section, we present an enhanced lightweight and secure two-factor authentication protocolAELSA for medical IoT and WBANs to address and enhance the outstanding vulnerabilities and fragile shortcomings of Fotouhi et al.’s protocol. AELSA also applies to the WBAN architecture and includes three main participants: (a) the physician or nurse as the user, (b) the gateway node as the server, and (c) as the sensor. The sensors can include the dynamic collection of patient data for real-time data. On the other hand, the gateway represents a server, which acts as an authentication and data-delivery center for ensuring mutual authentication between the physician and the sensor. The physician or nurse, as the user, can access the information from the sensor, which is delivered using the gateway through a device, such as a mobile device or a computer that can log into the system. AELSA comprises four main phases: a initialization, b registration, c login, and d mutual authentication and key exchange phases. The registration phase includes the user registration and sensor registration phases. The symbols used are also listed in Table 1.


### 4.1. Initialization Phase

We assume that all the gateways are considered trusted parts, the gateways are identified throughGIDj when transmitting messages, and the gateways generate Gj as their private key during initialization. In this phase, important parameters and functions of the system are generated and published, such as initializing the stored information within the gateway.


### 4.2. Registration Phase

This phase comprises a sensor node enrollment phase and a user enrollment phase with the following steps.


#### 4.2.1. Sensor Node Enrollment

In the sensor registration phase ofAELSA, if a new sensor SNk wants to join the WBAN, it must interact with the data and submit registration information to the gateway GWj. First, SNk sends its SIDk and Nl to GWj over a secure channel. After GWj receives the message, it determines whether SIDk is a new identity and generates a new pseudoidentity QIDk for SNk if it is a new identity. Next, it computes SGk as a shared key for SNk and GWj, where SGk=hSIDk‖Gj⊕Nl, and it stores {QIDk,Nl} into the memory. Afterwards, GWj securely sends {SGk,QIDk} to SNk. Once SNk receives the message, it encrypts SGk using its SIDk, RSGk=SGk⊕SIDk, and it stores {RSGk,QIDk}.


#### 4.2.2. User Enrollment

In this stage, the user completes the registration inGWj based on the generation function of the bioinformation embedded in the mobile device as well as other information. The user enters their identity IDi, password PWi, and bioinformation BIOi on the mobile device. The mobile device then generates σi and τi using the generation function Gen. It uses σi to mask and protect PWi, calculates HPWi=hPWi‖σi, and sends {IDi,HPWi} to GWj on the anti-interference channel. Upon receiving {IDi,GWj} determines whether the identity is new. A new identity represents an unregistered identity. If it is new, it then calculates CIDi=hIDi and stores CIDi,HPWi. It then selects a secret random number R0 and computes A1=hCIDi‖GIDj‖R0⊕Gj⊕Hpwi and A2=hGIDj‖HPWi⊕R0⊕Gj, which, in turn, store A1 into memory. It then transmits the secure message {A2,GIDj} to Ui over the private channel. After Ui receives the secure message, it computes A3=hIDi‖HPWi and stores {A2,A3,GIDj,Gen.,Rep.,andτi}, where Rep can decrypt σi using the biological information BIOi and τi.


### 4.3. Login Phase

Compared to the protocol proposed by Fotouhi et al.,AELSA adds a login phase in which the mobile device verifies the legitimacy of Ui’s identity and effectively prevents the consumption of redundant functions resulting from the nonuse of authentication. It is assumed that when Ui logs into the mobile device, Ui enters IDi∗ and PWi∗ and enters biological information BIOi∗, such as the fingerprint and iris. The mobile device calculates RepBIOi∗,τiσi∗, HPWi∗=hPWi∗‖σi∗, and A3∗=hIDi∗‖HPWi. It then verifies A3 by comparison. If A3=A3∗, the mobile device allows Ui to log in. Otherwise, it denies Ui to log into the system and sends an alert. Figure 2 shows the detailed process of the user login phase.Figure 2
Login phase.


### 4.4. Mutual Authentication and Key Exchange Phase

In the key exchange phase, the user, gateway, and sensor negotiate to create a three-way trusted key for ensuring the correctness and security of future messages. This phase comprises five steps, as described below. Among other things, Figure3 shows the stages of mutual authentication and key exchange.Step 1: userUi selects the SIDk of the sensor to be accessed, generates a random number Ru, and creates a timestamp T1. Ui computes R0⊕Gj=A2⊕hGIDj‖HPWi, B1=SIDk⊕hGIDj‖HPWi, B2=Ru⊕hGIDj‖HPWi⊕SIDk, and B3=R0⊕GjhGIDj‖Ru, after which Ui transmits the message M1 {CIDi,GIDj,B1,B2,B3,T1} to the gateway GWj.Step 2: after receiving the messageM1, GWj verifies the legitimacy of T1 by determining whether it matches T1−TCΔT. GWj searches and obtains the corresponding HPWi and QIDk in the memory based on CIDi in M1. Afterwards, GWj computes SIDk=B1⊕hGIDj‖HPWi, Ru=B2⊕hGIDj‖HPWi⊕SIDk, R0⊕Gj=B3⊕hGIDj‖Ru, and A1∗=hCIDi‖GIDj‖R0⊕Gj⊕HPWi, and it verifies A1=?A1∗. If the verification fails, GWj aborts the conversation. Otherwise, GWj confirms the legitimacy of the identity of Ui, after which it generates a random number Rg and a new timestamp T2, and it computes SGk=hSIDk‖Gj⊕Nl, B4=Ru⊕HPWi⊕SGk , B5=Rg⊕hSGk‖SIDk, and B6=hQIDk‖B4‖B5‖SGk‖Ru⊕HPWi‖Rg. Finally, GWj sends M2{QIDk,B4,B5,B6,T2} to the sensor node SNk.Step 3: onceM2 is received, SNk verifies that T2−TC≦ΔT, and if this is true, then the message M2 is fresh. Afterwards, SNk obtains the corresponding RSGk in storage based on QIDk. It computes SGk=RSGk⊕SIDk, Ru⊕HPWi=B4⊕SGk, Rg=B5⊕hSGk‖SIDk, and B6∗=hQIDk‖B4‖B5‖SGk‖Ru⊕HPWi‖Rg, and it verifies whether B6∗=?B6. If the verification is successful, SNk creates a random number Rs and a timestamp T3, after which it computes the keys SKs=hRu⊕HPWi‖Rg‖Rs, B7=hSGk‖Rg⊕Rs, and B8=hRg‖Rs‖SGk‖T3. SNk then sends M3{B7,B8,T3} to GWj over the public channel.Step 4: after receiving messageM3, GWj verifies the freshness of timestamp T3 using T3−TC≦ΔT. After verifying that it passes, GWj generates timestamp T4 and computes Rs=hSGk‖Rg⊕B7 and B8∗=hRg‖Rs‖SGk‖T3, after which it verifies the legitimacy of B8. If B8 qualifies, the key SKg=hRu⊕HPWi‖Rg‖Rs, B9=hRu⊕GIDj‖HPWi⊕Rg‖Rs, and B10=hR0⊕Gj‖SKg‖Ru. Finally, GWj generates M4 {B9,B10,T4} and passes M4 back to Ui.Step 5: in the final step, after receiving the messageM4, Ui verifies whether T4−TC≦ΔT, and if this is correct, it computes Rg‖Rs=B9⊕hRu⊕GIDj‖HPWi, SKu=hRu⊕HPWi‖Rg‖Rs, and B10∗=hR0⊕Gj‖SKu‖Ru. Finally, Ui verifies whether B10∗=?B10, and if this is true, the verification and key exchange phase is complete.Figure 3
Mutual authentication and key agreement phase.


## 4.1. Initialization Phase

We assume that all the gateways are considered trusted parts, the gateways are identified throughGIDj when transmitting messages, and the gateways generate Gj as their private key during initialization. In this phase, important parameters and functions of the system are generated and published, such as initializing the stored information within the gateway.


## 4.2. Registration Phase

This phase comprises a sensor node enrollment phase and a user enrollment phase with the following steps.


### 4.2.1. Sensor Node Enrollment

In the sensor registration phase ofAELSA, if a new sensor SNk wants to join the WBAN, it must interact with the data and submit registration information to the gateway GWj. First, SNk sends its SIDk and Nl to GWj over a secure channel. After GWj receives the message, it determines whether SIDk is a new identity and generates a new pseudoidentity QIDk for SNk if it is a new identity. Next, it computes SGk as a shared key for SNk and GWj, where SGk=hSIDk‖Gj⊕Nl, and it stores {QIDk,Nl} into the memory. Afterwards, GWj securely sends {SGk,QIDk} to SNk. Once SNk receives the message, it encrypts SGk using its SIDk, RSGk=SGk⊕SIDk, and it stores {RSGk,QIDk}.


### 4.2.2. User Enrollment

In this stage, the user completes the registration inGWj based on the generation function of the bioinformation embedded in the mobile device as well as other information. The user enters their identity IDi, password PWi, and bioinformation BIOi on the mobile device. The mobile device then generates σi and τi using the generation function Gen. It uses σi to mask and protect PWi, calculates HPWi=hPWi‖σi, and sends {IDi,HPWi} to GWj on the anti-interference channel. Upon receiving {IDi,GWj} determines whether the identity is new. A new identity represents an unregistered identity. If it is new, it then calculates CIDi=hIDi and stores CIDi,HPWi. It then selects a secret random number R0 and computes A1=hCIDi‖GIDj‖R0⊕Gj⊕Hpwi and A2=hGIDj‖HPWi⊕R0⊕Gj, which, in turn, store A1 into memory. It then transmits the secure message {A2,GIDj} to Ui over the private channel. After Ui receives the secure message, it computes A3=hIDi‖HPWi and stores {A2,A3,GIDj,Gen.,Rep.,andτi}, where Rep can decrypt σi using the biological information BIOi and τi.


## 4.2.1. Sensor Node Enrollment

In the sensor registration phase ofAELSA, if a new sensor SNk wants to join the WBAN, it must interact with the data and submit registration information to the gateway GWj. First, SNk sends its SIDk and Nl to GWj over a secure channel. After GWj receives the message, it determines whether SIDk is a new identity and generates a new pseudoidentity QIDk for SNk if it is a new identity. Next, it computes SGk as a shared key for SNk and GWj, where SGk=hSIDk‖Gj⊕Nl, and it stores {QIDk,Nl} into the memory. Afterwards, GWj securely sends {SGk,QIDk} to SNk. Once SNk receives the message, it encrypts SGk using its SIDk, RSGk=SGk⊕SIDk, and it stores {RSGk,QIDk}.


## 4.2.2. User Enrollment

In this stage, the user completes the registration inGWj based on the generation function of the bioinformation embedded in the mobile device as well as other information. The user enters their identity IDi, password PWi, and bioinformation BIOi on the mobile device. The mobile device then generates σi and τi using the generation function Gen. It uses σi to mask and protect PWi, calculates HPWi=hPWi‖σi, and sends {IDi,HPWi} to GWj on the anti-interference channel. Upon receiving {IDi,GWj} determines whether the identity is new. A new identity represents an unregistered identity. If it is new, it then calculates CIDi=hIDi and stores CIDi,HPWi. It then selects a secret random number R0 and computes A1=hCIDi‖GIDj‖R0⊕Gj⊕Hpwi and A2=hGIDj‖HPWi⊕R0⊕Gj, which, in turn, store A1 into memory. It then transmits the secure message {A2,GIDj} to Ui over the private channel. After Ui receives the secure message, it computes A3=hIDi‖HPWi and stores {A2,A3,GIDj,Gen.,Rep.,andτi}, where Rep can decrypt σi using the biological information BIOi and τi.


## 4.3. Login Phase

Compared to the protocol proposed by Fotouhi et al.,AELSA adds a login phase in which the mobile device verifies the legitimacy of Ui’s identity and effectively prevents the consumption of redundant functions resulting from the nonuse of authentication. It is assumed that when Ui logs into the mobile device, Ui enters IDi∗ and PWi∗ and enters biological information BIOi∗, such as the fingerprint and iris. The mobile device calculates RepBIOi∗,τiσi∗, HPWi∗=hPWi∗‖σi∗, and A3∗=hIDi∗‖HPWi. It then verifies A3 by comparison. If A3=A3∗, the mobile device allows Ui to log in. Otherwise, it denies Ui to log into the system and sends an alert. Figure 2 shows the detailed process of the user login phase.Figure 2
Login phase.


## 4.4. Mutual Authentication and Key Exchange Phase

In the key exchange phase, the user, gateway, and sensor negotiate to create a three-way trusted key for ensuring the correctness and security of future messages. This phase comprises five steps, as described below. Among other things, Figure3 shows the stages of mutual authentication and key exchange.Step 1: userUi selects the SIDk of the sensor to be accessed, generates a random number Ru, and creates a timestamp T1. Ui computes R0⊕Gj=A2⊕hGIDj‖HPWi, B1=SIDk⊕hGIDj‖HPWi, B2=Ru⊕hGIDj‖HPWi⊕SIDk, and B3=R0⊕GjhGIDj‖Ru, after which Ui transmits the message M1 {CIDi,GIDj,B1,B2,B3,T1} to the gateway GWj.Step 2: after receiving the messageM1, GWj verifies the legitimacy of T1 by determining whether it matches T1−TCΔT. GWj searches and obtains the corresponding HPWi and QIDk in the memory based on CIDi in M1. Afterwards, GWj computes SIDk=B1⊕hGIDj‖HPWi, Ru=B2⊕hGIDj‖HPWi⊕SIDk, R0⊕Gj=B3⊕hGIDj‖Ru, and A1∗=hCIDi‖GIDj‖R0⊕Gj⊕HPWi, and it verifies A1=?A1∗. If the verification fails, GWj aborts the conversation. Otherwise, GWj confirms the legitimacy of the identity of Ui, after which it generates a random number Rg and a new timestamp T2, and it computes SGk=hSIDk‖Gj⊕Nl, B4=Ru⊕HPWi⊕SGk , B5=Rg⊕hSGk‖SIDk, and B6=hQIDk‖B4‖B5‖SGk‖Ru⊕HPWi‖Rg. Finally, GWj sends M2{QIDk,B4,B5,B6,T2} to the sensor node SNk.Step 3: onceM2 is received, SNk verifies that T2−TC≦ΔT, and if this is true, then the message M2 is fresh. Afterwards, SNk obtains the corresponding RSGk in storage based on QIDk. It computes SGk=RSGk⊕SIDk, Ru⊕HPWi=B4⊕SGk, Rg=B5⊕hSGk‖SIDk, and B6∗=hQIDk‖B4‖B5‖SGk‖Ru⊕HPWi‖Rg, and it verifies whether B6∗=?B6. If the verification is successful, SNk creates a random number Rs and a timestamp T3, after which it computes the keys SKs=hRu⊕HPWi‖Rg‖Rs, B7=hSGk‖Rg⊕Rs, and B8=hRg‖Rs‖SGk‖T3. SNk then sends M3{B7,B8,T3} to GWj over the public channel.Step 4: after receiving messageM3, GWj verifies the freshness of timestamp T3 using T3−TC≦ΔT. After verifying that it passes, GWj generates timestamp T4 and computes Rs=hSGk‖Rg⊕B7 and B8∗=hRg‖Rs‖SGk‖T3, after which it verifies the legitimacy of B8. If B8 qualifies, the key SKg=hRu⊕HPWi‖Rg‖Rs, B9=hRu⊕GIDj‖HPWi⊕Rg‖Rs, and B10=hR0⊕Gj‖SKg‖Ru. Finally, GWj generates M4 {B9,B10,T4} and passes M4 back to Ui.Step 5: in the final step, after receiving the messageM4, Ui verifies whether T4−TC≦ΔT, and if this is correct, it computes Rg‖Rs=B9⊕hRu⊕GIDj‖HPWi, SKu=hRu⊕HPWi‖Rg‖Rs, and B10∗=hR0⊕Gj‖SKu‖Ru. Finally, Ui verifies whether B10∗=?B10, and if this is true, the verification and key exchange phase is complete.Figure 3
Mutual authentication and key agreement phase.


## 5. Security Analysis

In this section, we use the random oracle model (ROR) to conduct a rigorous formal security analysis of the improved protocol. In addition, an informal security analysis is carried out to logically analyze the protocol. Through the following security analysis, it is easy to prove the security and robustness of the improved protocol.


### 5.1. Formal Security Analysis

In this section, theROR model is mainly used to prove the security and feasibility of our proposed protocol, and we successfully demonstrated that users and sensor nodes can securely establish session keys through the gateway. In the proof process, U represents a user, G represents a gateway, and S represents a sensor node. The detailed proof of the procedure is presented as follows.


#### 5.1.1. ROR Model

In this section, we will use theROR model to prove the security and reliability of our proposed new scheme, where A represents the attacker. There are three participants which are user U, gateway G, and sensor S. Suppose ΠUx represents the x-th communication of the user, ΠU∗i represents the i-th instance of the user, ΠGj represents the j-th instance of the gateway, and ΠSk represents the k-th instance of the sensor. The attacker has special capabilities and can initiate the following queries:ExecuteΠU∗x,ΠGj,ΠSk: by executing this query, A can intercept and obtain the messages transmitted between the various participant instances on the public channel. Passive attacks can be executed by this querySendΠUx,M: in this query, A can get the corresponding response by sending message M to ΠUx. A can perform man-in-the-middle attacks and impersonation attacks.HashΠUx,string: in this query, the hash value of the input string can be obtained by A.CorruptΠUx: through this query, A can send this query to the instance ΠUx and ΠUx returns the secret value of U: long-term private key, password, and secret parameters stored in the smart card (based on the smart card). A can simulate the execution of forward secrecy, privilege insider (internal) attacks, and stolen smart card attacks.RevealΠUx: A can send this query to the instance ΠUx and ΠUx returns the current session key SK generated by its partner to A. A can simulate the execution of known session key attacks.TestΠUx: A can perform this query by flipping a coin C. If C results in 1, the attacker will get the correct session key; otherwise, the attacker will receive a random string.Theorem 1.
In the aboveROR model, we redefine the A’s capabilities and allow the attacker to execute the above query, so the probability P of our proposed new protocol being broken is expressed as AdvAvξ≤qsend/2l−2+3qhash2/2l−1+2maxC′,qsends′,qsend/2l, where qhash represents the number of hash queries performed and qsend represents the number of queries performed. The number of bits of biological information is expressed by l, C′ and s′ are Zipf′s law [26].Proof.
We defineGM0 to GM5 to mimic and verify the behavior that may be performed by A. SuccAGMiξ is used to denote the probability of success of A’s attack on the protocol in GMi. The specific process is as follows:GM0: in GM0, A does not initiate any queries. Therefore, in GM0, the probability P that the protocol is broken in this query round is(1)AdvAvξ=2PrSuccAGM0ξ−1.GM1: GM1 adds Execute query, and the others have no difference with GM0. We can obtain(2)PrSuccAGM1ξ=PrSuccAGM0ξ.GM2: GM2 adds Send query, and there is no difference with GM1. Therefore, we can get(3)PrSuccAGM2ξ−PrSuccAGM1ξ≤qsend2l.GM3: GM3 and GM2 are indistinguishable except that it adds the Hash query and deletes the Send query. We can obtain(4)PrSuccAGM3ξ−PrSuccAGM2ξ≤qhash22l+1.GM4: in GM4, whether a session key is secure or not can be seen in the following two cases. The first case is whether the protocol can ensure perfect forward secrecy security when A obtains the long-term private key. The second is whether the protocol can resist the temporary information leakage attack when the temporary information is compromised.(1)
Perfect forward secrecy: usingΠGj, A tries to obtain the long-term key SGk between the gateway and the sensor, or A uses ΠU∗x or ΠSk to try to get a certain secret value in the registration phase(2)
Known session-specific temporary information attacks:A uses one of ΠGj or ΠU∗i or ΠSk to try to obtain temporary information from one entityIn both cases,A only needs to use Send and Hash queries to compute SKu=hRu⊕HPWi‖Rg‖Rs. For the first case, assuming that A obtains the long-term key SGk, although Ru⊕HPWi can be computed by intercepting B4, A has no access to SIDk and thus cannot compute Rg and Rs and thus even less likely to compute SK. For the second case, assuming that A obtains the temporary information Ru, A has no access to the other random numbers Rg and Rs and thus cannot crack this protocol. Therefore, we get(5)PrSuccAGM4ξ−PrSuccAGM3ξ≤qsend2l+qhash22l+1.GM5: in GM5, A can execute smart card stolen attacks. A uses CorruptΠUx to get the information stored in SCA2,A3,GIDj,Gen.,Rep.,τi. The mobile user uses password PWi and biological information BIOi to register. If A tries to guess A3∗=hIDi∗‖HPWi, since HPWi is encrypted with biological information, the probability of A guessing the biometric σi is 1/2l [27]. A can also guess low-entropy passwords; using Zipf′s law [26], we can get(6)PrSuccAGM5ξ−PrSuccAGM4ξ≤maxC′,qsends′,qsend2l.GM6: GM6 is used to verify whether the proposed protocol is resistant to impersonation attacks. In GM6, if A issues a hRu⊕HPWi‖Rg‖Rs query, the game is terminated. So we can obtain(7)PrSuccAGM6ξ−PrSuccAGM5ξ≤qhash22l+1.SinceGM6 has half the probability of success and failure, (8)PrSuccAGM6ξ=12.To sum up, we can obtain the following conclusions:(9)12AdvAVξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤∑i=05PrSuccAGMi+1ξ−PrSuccAGMiξ=qsend2l−1+3qhash22l−1+maxC′,qsends′,qsend2l.Finally, we can get(10)AdvAvξ≤=qsend2l−1+3qhash22l−1+2maxC′,qsends′,qsend2l.
Therefore, we can use theROR model to demonstrate that our proposed new protocol can provide perfect forward security against common attacks such as smart card theft attacks, man-in-the-middle attacks, and other more common attacks.


### 5.2. Informal Security Analysis

In this section, we prove that our proposed protocol is secure against common attacks. The security of our proposed protocol and the reasons it can withstand attacks are analyzed.


#### 5.2.1. Resisting Sensor Node Capture Attacks

If an attacker captures a sensor node and obtains its memory information, although the attacker already knows the parametersRSGk and QIDk, to obtain SK, the attacker must also know SIDk and the long-term key SGk between the gateway and the sensor node, which is obtained from RSGk and SIDk through heterodyning. However, SIDk is not stored in the memory of the sensor node. Therefore, our proposed protocol is improved to effectively prevent sensor node capture attacks.


#### 5.2.2. Ensuring Authentication between Users and Mobile Devices

An attacker can replay eavesdropped messages and obtain valuable information through replay and feedback. For example, an attacker can replay messageM1 by imitating the user. However, our improved protocol does not provide this opportunity to the attacker. This is because we add a timestamp T to verify the freshness of the message, and we set a reasonable timestamp threshold. Moreover, we add biometric authentication to ensure accurate authentication between users and mobile devices, thereby preventing attackers from attacking the gateway using large amounts of useless information resulting from the lack of authentication between users and devices.


#### 5.2.3. Perfect Forward Secrecy

If an attacker cannot obtain the previous session key when the private long-term key is destroyed, the authentication protocol has perfect forward confidentiality [28, 29]. Assuming that an attacker has obtained the long-term key SGk between the gateway and the sensor, although it can be obtained through the message B4 of the common channel Ru⊕HPWi, Rg and Rs are protected by the long-term key SGk in addition to SIDk. Therefore, an attacker cannot obtain SIDk while obtaining the long-term key. As such, it can be inferred that the attacker cannot crack the long-term key in the case of obtaining the past session key. Thus, our proposed protocol demonstrates perfect forward security.


#### 5.2.4. Resisting Session-Specific Temporary Information Attacks

If short-term secret information, such as random numbers, is cracked and obtained by an attacker, the attacker cannot calculate the keySK. Because the improved protocol uses a three-way random number and the encrypted value of the user’s password information composition, an attacker cannot obtain the user’s password information through the knowledge of the random number. Therefore, our proposed protocol can resist temporary information leakage attacks.


#### 5.2.5. Resisting Offline Password-Guessing Attacks

In the authentication stage, we use the pseudo-passwordHPWi as a substitute for the user password to ensure the security and privacy of the password. Because the user password is obtained through the user’s biological information and password encryption, assuming that the attacker obtains HPWi, the user password cannot be calculated. In the login phase, assuming that the attacker obtains A3 and IDi, the attacker cannot calculate PWi from these data. Therefore, our proposed protocol can resist offline password-guessing attacks.


#### 5.2.6. Resisting Privileged Insider Attacks

Assuming that an attacker is an insider of the gateway and has access to the gateway’s memory information [30], the attacker can obtain CIDi, HPWi, and QIDi. After obtaining this internal information, the attacker cannot compute any valuable information, and thus, the exact protocol is completely resistant to privileged insider attacks.


#### 5.2.7. Resisting Relay Attacks

In the general three-party authentication protocol, the general steps involve authenticating communications between the user and the server. The server then communicates with the sensor or other devices for authentication, after which the sensor and other devices pass the information to the user through the server, and the information finally reaches the user, server, sensors, and other devices involved in the three-party authentication process. However, the transmission process is prone to relay attacks [30, 31], where information can easily be intercepted by the attacker using disguised devices to obtain the correct information sent by the official server or the user, so that they can disguise themselves as legitimate servers and send instructions to the user or disguise themselves as legitimate users to obtain valuable information. However, in our proposed protocol, the server GWj properly verifies the legitimacy of user Ui and sensor SNk by comparing A1 and B8. Additionally, the sensors and users verify the legitimacy of the server, and they employ a timestamp to verify the freshness of the message. Thus, our proposed protocol is resistant to relay attacks.


#### 5.2.8. Resisting Stolen-Verifier Attacks

In a stolen authentication attack, we assume that the user authentication value stored on the server side is stolen by an attacker, and the attacker can directly use the authentication value to disguise themselves as a user and log into the system. Further, we assume that the secret information stored on the server side is also stolen, and the attacker can use this information to obtain the public key. Assuming that an attacker obtains the stored information inside the gatewayGWj, which is CIDi,HPWi,A1,QIDk,Nl, the key to determining SK involves obtaining SGk and obtaining Ru using SGk. However, SGk cannot be obtained using the information in the memory of GWj. Therefore, our proposed protocol can resist stolen authentication attacks.


## 5.1. Formal Security Analysis

In this section, theROR model is mainly used to prove the security and feasibility of our proposed protocol, and we successfully demonstrated that users and sensor nodes can securely establish session keys through the gateway. In the proof process, U represents a user, G represents a gateway, and S represents a sensor node. The detailed proof of the procedure is presented as follows.


### 5.1.1. ROR Model

In this section, we will use theROR model to prove the security and reliability of our proposed new scheme, where A represents the attacker. There are three participants which are user U, gateway G, and sensor S. Suppose ΠUx represents the x-th communication of the user, ΠU∗i represents the i-th instance of the user, ΠGj represents the j-th instance of the gateway, and ΠSk represents the k-th instance of the sensor. The attacker has special capabilities and can initiate the following queries:ExecuteΠU∗x,ΠGj,ΠSk: by executing this query, A can intercept and obtain the messages transmitted between the various participant instances on the public channel. Passive attacks can be executed by this querySendΠUx,M: in this query, A can get the corresponding response by sending message M to ΠUx. A can perform man-in-the-middle attacks and impersonation attacks.HashΠUx,string: in this query, the hash value of the input string can be obtained by A.CorruptΠUx: through this query, A can send this query to the instance ΠUx and ΠUx returns the secret value of U: long-term private key, password, and secret parameters stored in the smart card (based on the smart card). A can simulate the execution of forward secrecy, privilege insider (internal) attacks, and stolen smart card attacks.RevealΠUx: A can send this query to the instance ΠUx and ΠUx returns the current session key SK generated by its partner to A. A can simulate the execution of known session key attacks.TestΠUx: A can perform this query by flipping a coin C. If C results in 1, the attacker will get the correct session key; otherwise, the attacker will receive a random string.Theorem 1.
In the aboveROR model, we redefine the A’s capabilities and allow the attacker to execute the above query, so the probability P of our proposed new protocol being broken is expressed as AdvAvξ≤qsend/2l−2+3qhash2/2l−1+2maxC′,qsends′,qsend/2l, where qhash represents the number of hash queries performed and qsend represents the number of queries performed. The number of bits of biological information is expressed by l, C′ and s′ are Zipf′s law [26].Proof.
We defineGM0 to GM5 to mimic and verify the behavior that may be performed by A. SuccAGMiξ is used to denote the probability of success of A’s attack on the protocol in GMi. The specific process is as follows:GM0: in GM0, A does not initiate any queries. Therefore, in GM0, the probability P that the protocol is broken in this query round is(1)AdvAvξ=2PrSuccAGM0ξ−1.GM1: GM1 adds Execute query, and the others have no difference with GM0. We can obtain(2)PrSuccAGM1ξ=PrSuccAGM0ξ.GM2: GM2 adds Send query, and there is no difference with GM1. Therefore, we can get(3)PrSuccAGM2ξ−PrSuccAGM1ξ≤qsend2l.GM3: GM3 and GM2 are indistinguishable except that it adds the Hash query and deletes the Send query. We can obtain(4)PrSuccAGM3ξ−PrSuccAGM2ξ≤qhash22l+1.GM4: in GM4, whether a session key is secure or not can be seen in the following two cases. The first case is whether the protocol can ensure perfect forward secrecy security when A obtains the long-term private key. The second is whether the protocol can resist the temporary information leakage attack when the temporary information is compromised.(1)
Perfect forward secrecy: usingΠGj, A tries to obtain the long-term key SGk between the gateway and the sensor, or A uses ΠU∗x or ΠSk to try to get a certain secret value in the registration phase(2)
Known session-specific temporary information attacks:A uses one of ΠGj or ΠU∗i or ΠSk to try to obtain temporary information from one entityIn both cases,A only needs to use Send and Hash queries to compute SKu=hRu⊕HPWi‖Rg‖Rs. For the first case, assuming that A obtains the long-term key SGk, although Ru⊕HPWi can be computed by intercepting B4, A has no access to SIDk and thus cannot compute Rg and Rs and thus even less likely to compute SK. For the second case, assuming that A obtains the temporary information Ru, A has no access to the other random numbers Rg and Rs and thus cannot crack this protocol. Therefore, we get(5)PrSuccAGM4ξ−PrSuccAGM3ξ≤qsend2l+qhash22l+1.GM5: in GM5, A can execute smart card stolen attacks. A uses CorruptΠUx to get the information stored in SCA2,A3,GIDj,Gen.,Rep.,τi. The mobile user uses password PWi and biological information BIOi to register. If A tries to guess A3∗=hIDi∗‖HPWi, since HPWi is encrypted with biological information, the probability of A guessing the biometric σi is 1/2l [27]. A can also guess low-entropy passwords; using Zipf′s law [26], we can get(6)PrSuccAGM5ξ−PrSuccAGM4ξ≤maxC′,qsends′,qsend2l.GM6: GM6 is used to verify whether the proposed protocol is resistant to impersonation attacks. In GM6, if A issues a hRu⊕HPWi‖Rg‖Rs query, the game is terminated. So we can obtain(7)PrSuccAGM6ξ−PrSuccAGM5ξ≤qhash22l+1.SinceGM6 has half the probability of success and failure, (8)PrSuccAGM6ξ=12.To sum up, we can obtain the following conclusions:(9)12AdvAVξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤∑i=05PrSuccAGMi+1ξ−PrSuccAGMiξ=qsend2l−1+3qhash22l−1+maxC′,qsends′,qsend2l.Finally, we can get(10)AdvAvξ≤=qsend2l−1+3qhash22l−1+2maxC′,qsends′,qsend2l.
Therefore, we can use theROR model to demonstrate that our proposed new protocol can provide perfect forward security against common attacks such as smart card theft attacks, man-in-the-middle attacks, and other more common attacks.


## 5.1.1. ROR Model

In this section, we will use theROR model to prove the security and reliability of our proposed new scheme, where A represents the attacker. There are three participants which are user U, gateway G, and sensor S. Suppose ΠUx represents the x-th communication of the user, ΠU∗i represents the i-th instance of the user, ΠGj represents the j-th instance of the gateway, and ΠSk represents the k-th instance of the sensor. The attacker has special capabilities and can initiate the following queries:ExecuteΠU∗x,ΠGj,ΠSk: by executing this query, A can intercept and obtain the messages transmitted between the various participant instances on the public channel. Passive attacks can be executed by this querySendΠUx,M: in this query, A can get the corresponding response by sending message M to ΠUx. A can perform man-in-the-middle attacks and impersonation attacks.HashΠUx,string: in this query, the hash value of the input string can be obtained by A.CorruptΠUx: through this query, A can send this query to the instance ΠUx and ΠUx returns the secret value of U: long-term private key, password, and secret parameters stored in the smart card (based on the smart card). A can simulate the execution of forward secrecy, privilege insider (internal) attacks, and stolen smart card attacks.RevealΠUx: A can send this query to the instance ΠUx and ΠUx returns the current session key SK generated by its partner to A. A can simulate the execution of known session key attacks.TestΠUx: A can perform this query by flipping a coin C. If C results in 1, the attacker will get the correct session key; otherwise, the attacker will receive a random string.Theorem 1.
In the aboveROR model, we redefine the A’s capabilities and allow the attacker to execute the above query, so the probability P of our proposed new protocol being broken is expressed as AdvAvξ≤qsend/2l−2+3qhash2/2l−1+2maxC′,qsends′,qsend/2l, where qhash represents the number of hash queries performed and qsend represents the number of queries performed. The number of bits of biological information is expressed by l, C′ and s′ are Zipf′s law [26].Proof.
We defineGM0 to GM5 to mimic and verify the behavior that may be performed by A. SuccAGMiξ is used to denote the probability of success of A’s attack on the protocol in GMi. The specific process is as follows:GM0: in GM0, A does not initiate any queries. Therefore, in GM0, the probability P that the protocol is broken in this query round is(1)AdvAvξ=2PrSuccAGM0ξ−1.GM1: GM1 adds Execute query, and the others have no difference with GM0. We can obtain(2)PrSuccAGM1ξ=PrSuccAGM0ξ.GM2: GM2 adds Send query, and there is no difference with GM1. Therefore, we can get(3)PrSuccAGM2ξ−PrSuccAGM1ξ≤qsend2l.GM3: GM3 and GM2 are indistinguishable except that it adds the Hash query and deletes the Send query. We can obtain(4)PrSuccAGM3ξ−PrSuccAGM2ξ≤qhash22l+1.GM4: in GM4, whether a session key is secure or not can be seen in the following two cases. The first case is whether the protocol can ensure perfect forward secrecy security when A obtains the long-term private key. The second is whether the protocol can resist the temporary information leakage attack when the temporary information is compromised.(1)
Perfect forward secrecy: usingΠGj, A tries to obtain the long-term key SGk between the gateway and the sensor, or A uses ΠU∗x or ΠSk to try to get a certain secret value in the registration phase(2)
Known session-specific temporary information attacks:A uses one of ΠGj or ΠU∗i or ΠSk to try to obtain temporary information from one entityIn both cases,A only needs to use Send and Hash queries to compute SKu=hRu⊕HPWi‖Rg‖Rs. For the first case, assuming that A obtains the long-term key SGk, although Ru⊕HPWi can be computed by intercepting B4, A has no access to SIDk and thus cannot compute Rg and Rs and thus even less likely to compute SK. For the second case, assuming that A obtains the temporary information Ru, A has no access to the other random numbers Rg and Rs and thus cannot crack this protocol. Therefore, we get(5)PrSuccAGM4ξ−PrSuccAGM3ξ≤qsend2l+qhash22l+1.GM5: in GM5, A can execute smart card stolen attacks. A uses CorruptΠUx to get the information stored in SCA2,A3,GIDj,Gen.,Rep.,τi. The mobile user uses password PWi and biological information BIOi to register. If A tries to guess A3∗=hIDi∗‖HPWi, since HPWi is encrypted with biological information, the probability of A guessing the biometric σi is 1/2l [27]. A can also guess low-entropy passwords; using Zipf′s law [26], we can get(6)PrSuccAGM5ξ−PrSuccAGM4ξ≤maxC′,qsends′,qsend2l.GM6: GM6 is used to verify whether the proposed protocol is resistant to impersonation attacks. In GM6, if A issues a hRu⊕HPWi‖Rg‖Rs query, the game is terminated. So we can obtain(7)PrSuccAGM6ξ−PrSuccAGM5ξ≤qhash22l+1.SinceGM6 has half the probability of success and failure, (8)PrSuccAGM6ξ=12.To sum up, we can obtain the following conclusions:(9)12AdvAVξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤∑i=05PrSuccAGMi+1ξ−PrSuccAGMiξ=qsend2l−1+3qhash22l−1+maxC′,qsends′,qsend2l.Finally, we can get(10)AdvAvξ≤=qsend2l−1+3qhash22l−1+2maxC′,qsends′,qsend2l.
Therefore, we can use theROR model to demonstrate that our proposed new protocol can provide perfect forward security against common attacks such as smart card theft attacks, man-in-the-middle attacks, and other more common attacks.


## 5.2. Informal Security Analysis

In this section, we prove that our proposed protocol is secure against common attacks. The security of our proposed protocol and the reasons it can withstand attacks are analyzed.


### 5.2.1. Resisting Sensor Node Capture Attacks

If an attacker captures a sensor node and obtains its memory information, although the attacker already knows the parametersRSGk and QIDk, to obtain SK, the attacker must also know SIDk and the long-term key SGk between the gateway and the sensor node, which is obtained from RSGk and SIDk through heterodyning. However, SIDk is not stored in the memory of the sensor node. Therefore, our proposed protocol is improved to effectively prevent sensor node capture attacks.


### 5.2.2. Ensuring Authentication between Users and Mobile Devices

An attacker can replay eavesdropped messages and obtain valuable information through replay and feedback. For example, an attacker can replay messageM1 by imitating the user. However, our improved protocol does not provide this opportunity to the attacker. This is because we add a timestamp T to verify the freshness of the message, and we set a reasonable timestamp threshold. Moreover, we add biometric authentication to ensure accurate authentication between users and mobile devices, thereby preventing attackers from attacking the gateway using large amounts of useless information resulting from the lack of authentication between users and devices.


### 5.2.3. Perfect Forward Secrecy

If an attacker cannot obtain the previous session key when the private long-term key is destroyed, the authentication protocol has perfect forward confidentiality [28, 29]. Assuming that an attacker has obtained the long-term key SGk between the gateway and the sensor, although it can be obtained through the message B4 of the common channel Ru⊕HPWi, Rg and Rs are protected by the long-term key SGk in addition to SIDk. Therefore, an attacker cannot obtain SIDk while obtaining the long-term key. As such, it can be inferred that the attacker cannot crack the long-term key in the case of obtaining the past session key. Thus, our proposed protocol demonstrates perfect forward security.


### 5.2.4. Resisting Session-Specific Temporary Information Attacks

If short-term secret information, such as random numbers, is cracked and obtained by an attacker, the attacker cannot calculate the keySK. Because the improved protocol uses a three-way random number and the encrypted value of the user’s password information composition, an attacker cannot obtain the user’s password information through the knowledge of the random number. Therefore, our proposed protocol can resist temporary information leakage attacks.


### 5.2.5. Resisting Offline Password-Guessing Attacks

In the authentication stage, we use the pseudo-passwordHPWi as a substitute for the user password to ensure the security and privacy of the password. Because the user password is obtained through the user’s biological information and password encryption, assuming that the attacker obtains HPWi, the user password cannot be calculated. In the login phase, assuming that the attacker obtains A3 and IDi, the attacker cannot calculate PWi from these data. Therefore, our proposed protocol can resist offline password-guessing attacks.


### 5.2.6. Resisting Privileged Insider Attacks

Assuming that an attacker is an insider of the gateway and has access to the gateway’s memory information [30], the attacker can obtain CIDi, HPWi, and QIDi. After obtaining this internal information, the attacker cannot compute any valuable information, and thus, the exact protocol is completely resistant to privileged insider attacks.


### 5.2.7. Resisting Relay Attacks

In the general three-party authentication protocol, the general steps involve authenticating communications between the user and the server. The server then communicates with the sensor or other devices for authentication, after which the sensor and other devices pass the information to the user through the server, and the information finally reaches the user, server, sensors, and other devices involved in the three-party authentication process. However, the transmission process is prone to relay attacks [30, 31], where information can easily be intercepted by the attacker using disguised devices to obtain the correct information sent by the official server or the user, so that they can disguise themselves as legitimate servers and send instructions to the user or disguise themselves as legitimate users to obtain valuable information. However, in our proposed protocol, the server GWj properly verifies the legitimacy of user Ui and sensor SNk by comparing A1 and B8. Additionally, the sensors and users verify the legitimacy of the server, and they employ a timestamp to verify the freshness of the message. Thus, our proposed protocol is resistant to relay attacks.


### 5.2.8. Resisting Stolen-Verifier Attacks

In a stolen authentication attack, we assume that the user authentication value stored on the server side is stolen by an attacker, and the attacker can directly use the authentication value to disguise themselves as a user and log into the system. Further, we assume that the secret information stored on the server side is also stolen, and the attacker can use this information to obtain the public key. Assuming that an attacker obtains the stored information inside the gatewayGWj, which is CIDi,HPWi,A1,QIDk,Nl, the key to determining SK involves obtaining SGk and obtaining Ru using SGk. However, SGk cannot be obtained using the information in the memory of GWj. Therefore, our proposed protocol can resist stolen authentication attacks.


## 5.2.1. Resisting Sensor Node Capture Attacks

If an attacker captures a sensor node and obtains its memory information, although the attacker already knows the parametersRSGk and QIDk, to obtain SK, the attacker must also know SIDk and the long-term key SGk between the gateway and the sensor node, which is obtained from RSGk and SIDk through heterodyning. However, SIDk is not stored in the memory of the sensor node. Therefore, our proposed protocol is improved to effectively prevent sensor node capture attacks.


## 5.2.2. Ensuring Authentication between Users and Mobile Devices

An attacker can replay eavesdropped messages and obtain valuable information through replay and feedback. For example, an attacker can replay messageM1 by imitating the user. However, our improved protocol does not provide this opportunity to the attacker. This is because we add a timestamp T to verify the freshness of the message, and we set a reasonable timestamp threshold. Moreover, we add biometric authentication to ensure accurate authentication between users and mobile devices, thereby preventing attackers from attacking the gateway using large amounts of useless information resulting from the lack of authentication between users and devices.


## 5.2.3. Perfect Forward Secrecy

If an attacker cannot obtain the previous session key when the private long-term key is destroyed, the authentication protocol has perfect forward confidentiality [28, 29]. Assuming that an attacker has obtained the long-term key SGk between the gateway and the sensor, although it can be obtained through the message B4 of the common channel Ru⊕HPWi, Rg and Rs are protected by the long-term key SGk in addition to SIDk. Therefore, an attacker cannot obtain SIDk while obtaining the long-term key. As such, it can be inferred that the attacker cannot crack the long-term key in the case of obtaining the past session key. Thus, our proposed protocol demonstrates perfect forward security.


## 5.2.4. Resisting Session-Specific Temporary Information Attacks

If short-term secret information, such as random numbers, is cracked and obtained by an attacker, the attacker cannot calculate the keySK. Because the improved protocol uses a three-way random number and the encrypted value of the user’s password information composition, an attacker cannot obtain the user’s password information through the knowledge of the random number. Therefore, our proposed protocol can resist temporary information leakage attacks.


## 5.2.5. Resisting Offline Password-Guessing Attacks

In the authentication stage, we use the pseudo-passwordHPWi as a substitute for the user password to ensure the security and privacy of the password. Because the user password is obtained through the user’s biological information and password encryption, assuming that the attacker obtains HPWi, the user password cannot be calculated. In the login phase, assuming that the attacker obtains A3 and IDi, the attacker cannot calculate PWi from these data. Therefore, our proposed protocol can resist offline password-guessing attacks.


## 5.2.6. Resisting Privileged Insider Attacks

Assuming that an attacker is an insider of the gateway and has access to the gateway’s memory information [30], the attacker can obtain CIDi, HPWi, and QIDi. After obtaining this internal information, the attacker cannot compute any valuable information, and thus, the exact protocol is completely resistant to privileged insider attacks.


## 5.2.7. Resisting Relay Attacks

In the general three-party authentication protocol, the general steps involve authenticating communications between the user and the server. The server then communicates with the sensor or other devices for authentication, after which the sensor and other devices pass the information to the user through the server, and the information finally reaches the user, server, sensors, and other devices involved in the three-party authentication process. However, the transmission process is prone to relay attacks [30, 31], where information can easily be intercepted by the attacker using disguised devices to obtain the correct information sent by the official server or the user, so that they can disguise themselves as legitimate servers and send instructions to the user or disguise themselves as legitimate users to obtain valuable information. However, in our proposed protocol, the server GWj properly verifies the legitimacy of user Ui and sensor SNk by comparing A1 and B8. Additionally, the sensors and users verify the legitimacy of the server, and they employ a timestamp to verify the freshness of the message. Thus, our proposed protocol is resistant to relay attacks.


## 5.2.8. Resisting Stolen-Verifier Attacks

In a stolen authentication attack, we assume that the user authentication value stored on the server side is stolen by an attacker, and the attacker can directly use the authentication value to disguise themselves as a user and log into the system. Further, we assume that the secret information stored on the server side is also stolen, and the attacker can use this information to obtain the public key. Assuming that an attacker obtains the stored information inside the gatewayGWj, which is CIDi,HPWi,A1,QIDk,Nl, the key to determining SK involves obtaining SGk and obtaining Ru using SGk. However, SGk cannot be obtained using the information in the memory of GWj. Therefore, our proposed protocol can resist stolen authentication attacks.


## 6. Security and Performance Comparisons

In this section, we discuss the typical costs of the authentication protocols from three aspects: protocol security, computing cost, and storage consumption [22, 32–34].


### 6.1. Security Comparisons

As shown in Table2, we compared the security analysis of the mentioned protocols and used ✓ and ✕ to signify whether the protocol meets the security requirements involved. The security of the protocol proposed by Kumari et al. [32] was disproved by Li et al. [35] in that it cannot resist sensor node capture attacks, session-specific temporary information attacks, sensor node impersonation attacks, and man-in-the-middle attacks. Therefore, Li et al. designed a mutual authentication and key agreement protocol for wireless sensor networks. However, it was later proved to be unsafe. The protocol proposed by Srinivas et al. [33] cannot resist offline password-guessing attacks. The security of the protocol proposed by Gope and Hwang [34] was disproved by Adavoudi-Jolfaei et al. [36] in that the adversary can obtain the session key between the user and the sensor using the dy model. Compared to the protocols mentioned above, our proposed protocol can resist such attacks and meet the security requirements.Table 2
Comparisons of security.
Security propertiesFotouhi et al. [22]Kumari et al. [32]Srinivas et al. [33]Gope and Hwang [34]OursPerfect forward secrecy✓✓✓✓✓Resists impersonation attacks✓✓✓✓✓Resists offline password-guessing attacks✓✕✕✕✓User anonymity security✓✓✓✓✓Mutual authentication✓✓✓✓✓Resists replay attacks✕✓✓✓✓Resists sensor-capture attacks✕✕✓✓✓Resists known session temporary information attacks✓×✓✓✓Resists relay attacks✓✓✓✓✓Resists man-in-the-middle attacks✓✕✓✓✓Provable security✕✕✕✕✓


### 6.2. Performance Comparisons

We performed a performance comparison between the new authentication protocol and the other four authentication protocols listed in Table4. Additionally, we made the following calculations in terms of the time consumption of cryptographic operations, as shown in Table 3, including hash functions, symmetric key encryption/decryption, chaotic mapping functions, and fuzzy extraction functions, as the most important operations [22]. The meanings of symbols in Table 4 are as follows: Th denotes the time of the regular hash operation, Tfe denotes the operation time of the fuzzy function, Ts denotes the operation time of symmetric encryption and decryption, and Tc denotes the operation time of the chaotic map function.Table 3
The computational cost of complex operations.
OperationsHost node(s)Hash function0.00032Fuzzy function0.0171Chaotic map function0.0171Encryption and decryption0.0056Table 4
Calculation cost comparison.
ProtocolUserGatewaySensorTotal (ms)Fotouhi et al.’s [22]10Th17Th7Th37Th = 10.88Kumari et al.’s [32]8Th + 2Ts4Th + Ts4Th + 2Ts16Th + 5Ts = 33.12Srinivas et al.’s [33]4Th + 2Tc + 2Ts6Th + 2Ts3Th + 2Tc4Tc + 4Ts + 13Th = 94.96Gope et al.’s [34]7Th9Th3Th19Th = 6.08Ours9Th + 1Tfe10Th4Th23Th + 1Tfe = 24.46In the login and mutual authentication phase, we compared the computation times of the user, gateway, and sensor node sides along with other protocols to design our proposed protocol. As shown in Table4, the newly designed protocols guarantee security and time appropriateness. Although our new protocol takes slightly more time than the protocols proposed in Fotouhi et al.’s [22] and Gope and Hwang’s [34], it ensures improved security. This is because the extra time spent is mainly in the user login phase, where the user biometric information needs to be compared, a very important and indispensable step that amounts to a partial performance sacrifice to improve the security of the protocol. As a result, the new protocol is more secure than the two protocols and ensures that the user’s legitimacy is verified. Compared to Kumari et al.’s [32] and Srinivas et al.’s [33] proposed protocols, it is evident that our proposed protocol significantly reduces the computational cost. In addition, we compared the communication costs, as shown in Figure 4. Considering the computational cost and communication in terms of cost and security for the new protocol, it is evident that our proposed protocol can be better adapted to the wireless human medical environment regional network, thereby providing improved service experience for hospital staff and individual patients.Figure 4
Communication cost.


## 6.1. Security Comparisons

As shown in Table2, we compared the security analysis of the mentioned protocols and used ✓ and ✕ to signify whether the protocol meets the security requirements involved. The security of the protocol proposed by Kumari et al. [32] was disproved by Li et al. [35] in that it cannot resist sensor node capture attacks, session-specific temporary information attacks, sensor node impersonation attacks, and man-in-the-middle attacks. Therefore, Li et al. designed a mutual authentication and key agreement protocol for wireless sensor networks. However, it was later proved to be unsafe. The protocol proposed by Srinivas et al. [33] cannot resist offline password-guessing attacks. The security of the protocol proposed by Gope and Hwang [34] was disproved by Adavoudi-Jolfaei et al. [36] in that the adversary can obtain the session key between the user and the sensor using the dy model. Compared to the protocols mentioned above, our proposed protocol can resist such attacks and meet the security requirements.Table 2
Comparisons of security.
Security propertiesFotouhi et al. [22]Kumari et al. [32]Srinivas et al. [33]Gope and Hwang [34]OursPerfect forward secrecy✓✓✓✓✓Resists impersonation attacks✓✓✓✓✓Resists offline password-guessing attacks✓✕✕✕✓User anonymity security✓✓✓✓✓Mutual authentication✓✓✓✓✓Resists replay attacks✕✓✓✓✓Resists sensor-capture attacks✕✕✓✓✓Resists known session temporary information attacks✓×✓✓✓Resists relay attacks✓✓✓✓✓Resists man-in-the-middle attacks✓✕✓✓✓Provable security✕✕✕✕✓


## 6.2. Performance Comparisons

We performed a performance comparison between the new authentication protocol and the other four authentication protocols listed in Table4. Additionally, we made the following calculations in terms of the time consumption of cryptographic operations, as shown in Table 3, including hash functions, symmetric key encryption/decryption, chaotic mapping functions, and fuzzy extraction functions, as the most important operations [22]. The meanings of symbols in Table 4 are as follows: Th denotes the time of the regular hash operation, Tfe denotes the operation time of the fuzzy function, Ts denotes the operation time of symmetric encryption and decryption, and Tc denotes the operation time of the chaotic map function.Table 3
The computational cost of complex operations.
OperationsHost node(s)Hash function0.00032Fuzzy function0.0171Chaotic map function0.0171Encryption and decryption0.0056Table 4
Calculation cost comparison.
ProtocolUserGatewaySensorTotal (ms)Fotouhi et al.’s [22]10Th17Th7Th37Th = 10.88Kumari et al.’s [32]8Th + 2Ts4Th + Ts4Th + 2Ts16Th + 5Ts = 33.12Srinivas et al.’s [33]4Th + 2Tc + 2Ts6Th + 2Ts3Th + 2Tc4Tc + 4Ts + 13Th = 94.96Gope et al.’s [34]7Th9Th3Th19Th = 6.08Ours9Th + 1Tfe10Th4Th23Th + 1Tfe = 24.46In the login and mutual authentication phase, we compared the computation times of the user, gateway, and sensor node sides along with other protocols to design our proposed protocol. As shown in Table4, the newly designed protocols guarantee security and time appropriateness. Although our new protocol takes slightly more time than the protocols proposed in Fotouhi et al.’s [22] and Gope and Hwang’s [34], it ensures improved security. This is because the extra time spent is mainly in the user login phase, where the user biometric information needs to be compared, a very important and indispensable step that amounts to a partial performance sacrifice to improve the security of the protocol. As a result, the new protocol is more secure than the two protocols and ensures that the user’s legitimacy is verified. Compared to Kumari et al.’s [32] and Srinivas et al.’s [33] proposed protocols, it is evident that our proposed protocol significantly reduces the computational cost. In addition, we compared the communication costs, as shown in Figure 4. Considering the computational cost and communication in terms of cost and security for the new protocol, it is evident that our proposed protocol can be better adapted to the wireless human medical environment regional network, thereby providing improved service experience for hospital staff and individual patients.Figure 4
Communication cost.


## 7. Conclusion

In this study, we improve on the WBAN-based authentication protocol proposed by Fotouhi et al. in medical IoT. The improved protocol compensates for the defects in the original protocol, and it can resist attacks that cannot be resisted by the original protocol. It also improves the authentication speed of the protocol, thereby reducing computational expenditure. Moreover, it is advantageous in that it is lightweight compared to the original protocol. The improved protocol adds biometric authentication and login authentication to significantly increase the security of the user login process, and it also makes extensive use of single hash, heterogeneous, and joint operations to reduce computational cost. Our proposed protocol is highly secure against a range of attacks, such as sensor node capture attacks, replay attacks, and internal privilege attacks. It demonstrates excellent performance in terms of security and efficiency. Therefore, it can be considered more suitable for the WBAN-based medical IoT. For every new technology development there are bound to be technical implementation and realization challenges, and the Internet of Healthcare is facing some problems in terms of adoption for the time being. Most of the problems exist because there is no all-in-one healthcare IoT solution; all solutions are tailored to specific challenges and therefore can be too expensive for any organization. The second is the lack of a set of standards for the healthcare industry to protect extremely sensitive healthcare data from security risks and threats. It is hoped that this paper will provide a reference for addressing the security aspects of healthcare data.



---

*Source: 3116593-2021-10-21.xml*