# Anonymous Authentication Scheme for Intercommunication in the Internet of Things Environments

Authors: Youngseok Chung; Seokjin Choi; Dongho Won
Journal: International Journal of Distributed Sensor Networks
 (2015)

---

## Abstract

Authentication and privacy protection are important security mechanisms for keeping things safe in the Internet of Things environments. In particular, an anonymous authentication scheme is a privacy preserving authentication technique which provides both authentication and privacy preservation. An authentication scheme with anonymity in mobility networks was proposed recently. However, it was proven that it failed to provide anonymity against passive adversaries and malicious users and security against known session key attacks and side channel attacks. We propose an anonymous authentication scheme for intercommunication between the things in the Internet of Things environments. The proposed scheme provides not only anonymity and security, but also untraceability for the thing. Moreover, we only use low cost functions, such as hash functions and exclusive-OR operations in consideration of limited computing power of the thing.


---

## Body

## 1. Introduction

As the Internet of Things (IoT) market is expanding recently, the importance of trustworthy IoT products and services is increasing. Zhang et al. [1] discussed IoT security issues just in time. To preserve IoT security, authentication and privacy preservation are some of the major mechanisms and a few authentication schemes in IoT are proposed [2, 3]. And improvements and drawbacks of those schemes are presented [4–6]. Since a lot of systems and things in IoT environments are connected to the Internet for intercommunication, apparently they can be exposed to hacker’s attacks anytime and anywhere.Systems of IoT infrastructure, such as a computer, a gateway, and a server system, have high computing power, enough memory, and wide communication bandwidth. On the contrary, things like a tag, a sensor, and a device deployed at the end of IoT environments have limited computing capacity and resource. Therefore, the convergence of symmetric and asymmetric cryptosystems and lightweight cryptographic protocols is necessary to guarantee the whole IoT security. Various things interconnected in IoT environments produce a lot of transmitting data. These data may contain user’s behavior, taste, and preference as well as private information. Hence, an adversary can abuse user’s information or do some damage through tapping, leaking, modifying, and destroying them. It is clear that privacy protection is one of the most important issues of IoT security. Because only human beings can have privacy, privacy preservation is not originally applied to things. However, things also need to have security measures to prevent privacy invasion in case they deal with human beings’ information. For such a reason, anonymity and anonymous authentication are essential to preserve privacy and security of all objects in IoT environments.Many anonymous authentication schemes in wireless environments, proofs of weaknesses, and countermeasures have been proposed [7–14]. Particularly, Chang et al. [15] proposed an efficient authentication scheme with anonymity for roaming service in global mobility networks. Since their scheme only uses low cost functions, such as hash functions and exclusive-OR operations, it is suitable for battery-powered mobile devices. However, Youn et al. [16] showed that Chang et al.’s scheme does not provide anonymity and security in certain situations. In other words, it fails to preserve anonymity against passive adversaries and malicious users as well as security against known session key attacks and side channel attacks. Since then, to make up the security faults proven by Youn et al., a few enhanced schemes have been proposed [17–19]. Also, anonymous authentication schemes with unlinkability that guarantee not to link one user and his/her messages have been followed [20–22].In this paper, we suppose that IoT components are a thing, a gateway, and a registration server. The thing senses, handles, and transmits various information. All things need to be registered for the registration server before being deployed in IoT environments. The registration server keeps and manages the thing’s identity. Also, it maintains a trustworthy relationship with the gateway to response to gateway’s request for authenticating the thing. No one but the thing and the registration server can know the thing’s identity because the thing certainly knows its identity and the registration server takes the thing’s identity when the thing registers for it. The gateway authenticates the thing in relation to the registration server without knowing the thing’s identity. And it makes the thing be able to communicate with other things through a secure way. The thing accomplishes mutual authentication and key agreement with the gateway through an anonymous authentication method when it connects to the gateway for the first time. At this time, the gateway which does not know the thing’s identity can authenticate the thing with the aid of the registration server. Centering around one gateway, a number of things consist of their own domain. Things in the same domain can do anonymous authentication and session key sharing through the same gateway.We propose a novel authentication scheme that guarantees anonymity, security, and untraceability in IoT environments by remedying the defects of Chang et al.’s scheme which are shown by Youn et al. The proposed scheme makes the things in IoT environments communicate with each other safely. Also, it only uses low cost functions to reduce computing loads of the thing’s side as Chang et al.’s scheme does.The remainder of this paper is organized as follows. We review the related works in Section2 and present our scheme in Section 3. In Section 4, we analyze security of our scheme. Finally, a concluding remark is given in Section 5.


## 2. Related Works

In this section, we review Chang et al.’s scheme and Youn et al.’s analysis. Table1 denotes notations in Chang et al.’s scheme.Table 1
Notations in Chang et al.’s scheme.
Notations
Descriptions
MN
Mobile user
HA
Home agent of a mobile user
FA
Foreign agent of a foreign network
ID
X
Identity of an entityX
PW
X
Password of an entityX
SID
Shadow identity
SK
Session key
x
Private key of HA
K
X
Y
Common secret key shared between an entityX and an entity Y
h
(
)
Collision-free one-way hash function
∥
Concatenation
⊕
Exclusive-OR operation


### 2.1. Chang et al.’s Scheme

Chang et al.’s scheme consists of three phases: registration, authentication, and session key establishment. And three entities are involved: the mobile userMN, the foreign agent FA, and the home agent HA in each phase. Their assumption is that each FA and each HA share and store a long term session key using any secure method, such as the Diffie-Hellman key agreement protocol.


#### 2.1.1. Registration Phase

In the registration phase,MN submits his/her identity IDMN and the selected password PWMN to HA. HA uses its private key x to compute the secret value R as follows:(1)R=hIDMN∥x⊕PWMN.Then HA issues a smart card containing {IDMN,IDHA,R,hx,h(·)} and delivers it to MN in a secure way.


#### 2.1.2. Authentication Phase

It is assumed thatMN wants to take a roaming service from FA. Before providing services, FA tries to authenticate MN through HA. To achieve this, MN, FA, and HA perform the authentication phase as follows.(1)
MN inserts his/her smart card into the device and enters a password PWMN∗.(2)
Smart card generates a noncenMN randomly and computes the parameter C as shown in(2)C=R⊕PWMN∗⊕nMN.(3)
MN sends the login message m1={Login  request,nMN,IDHA} to FA. “Login  request” is the header of the message to establish a new secure session between MN and FA.(4)
Upon receivingm1, FA stores nMN and generates a random nonce nFA to send the authentication request message m2={Authenticaton  request,nFA,IDFA} to HA. The message header “Authenticaton  request” notifies HA to authenticate MN.(5)
After receivingm2, HA checks IDFA to see whether a trustworthy relationship between HA and FA is built or not. If IDFA is valid, HA generates a nonce nHA randomly and sends the message m3={nHA,IDHA} to FA.(6)
Upon receivingm3, FA sends the message m4={nHA,nFA,IDFA} to MN.After checking the identities and exchanging nonces betweenMN, FA, and HA, they accomplish the following steps for anonymous authentication.(7)
MN who receives m4 computes the shadow identity SID, the parameter V1, the session key SK, and the parameter V2 sequentially such that(3)SID=IDMN⊕hhx∥nHA,V1=hnHA∥C,SK=hhx∥IDMN∥IDFA∥nMN∥nFA,V2=SK⊕hnHA∥IDMN.(8)
MN computes the following hashing value S1 and sends the message m5={SID,V1,V2,nMN,S1,IDHA} to FA:(4)S1=hnFA∥SID∥V1∥V2∥nMN.(9)
Upon receivingm5, FA checks S1 and computes the following hashing value S2. And then it sends the message m6={SID,V1,V2,nMN,S2,IDFA} to HA:(5)S2=hKFH∥nHA∥SID∥V1∥V2∥nMN.(10)
After receivingm6, HA checks IDFA and S2 firstly. And it checks the format of MN’s identity after computing IDMN as follows:(6)IDMN=SID⊕hhx∥nHA.(11)
HA computes C∗ and V1∗ as demonstrated in (7) to check whether V1∗ is equal to V1. The equivalence between V1∗ and V1 implies that the selected PWMN in the registration phase is the same as the password PWMN∗ that MN enters in the authentication phase:(7)C∗=hIDMN∥x⊕nMN,V1∗=hnHA∥C∗.(12)
HA computes the parameter K1 after obtaining the session key SK from V2. And it computes the parameter V3 and the hashing value S3 to send the message m7={K1,V3,S3} to FA. SK, K1, V3, and S3 are calculated such that(8)SK=V2⊕hnHA∥IDMN,K1=SK⊕hKFH∥nFA,V3=hIDFA∥hx∥nMN,S3=hKFH∥nFA∥K1∥V3.


#### 2.1.3. Session Key Establishment Phase

After completing the authentication phase,MN and FA continue the following session key establishment phase.(1)
Upon receivingm7, FA obtains the following session key SK from K1 after checking S3:(9)SK=K1⊕hKFH∥nFA.And it computes the parameterK2 as follows to send the message m8={V3,K2} to MN: (10)K2=SK⊕hSK∥nMN.(2)
After receivingm8, MN computes the following V3∗ and checks whether V3∗ and V3 are equal or not:(11)V3∗=hIDFA∥hx∥nMN.The fact that two values are equal meansMN confirms FA as a valid foreign agent.(3)
MN computes SK∗ as follows: from K2 to check the equivalence between SK∗ and SK that MN computes in the authentication phase:(12)SK∗=K2⊕hSK∥nMN.According to the sameness of two values,MN confirms that he/she shares the authenticated session key with FA.(4)
Since then,MN and FA use SK when they want to communicate with one another through a secure channel.Figure1 describes the authentication and the session key establishment phases in Chang et al.’s scheme.Figure 1
Authentication and session key establishment phases in Chang et al.’s scheme.


### 2.2. Youn et al.’s Analysis

Youn et al. proved that Chang et al.’s scheme suffers from some specific attacks. Their assumptions are as follows. Anyone can eavesdrop transmitting messages betweenMN, FA, and HA. And it is easy to perform a brute-force search of a valid identity since it is short and has a certain format. In addition, there exists an adversary who can execute side channel attacks.


#### 2.2.1. Anonymity against Passive Adversaries

A passive adversary can obtainV2 and K2 by eavesdropping messages between MN, FA, and HA. The adversary chooses a candidate identity ID′ to compute SK′ and K2′ as follows:(13)SK′=V2⊕hnHA∥ID′,K2′=SK′⊕hSK′∥nMN.If K2′ and K2 are equal, the adversary can recognize that the candidate identity is the same as MN’s real identity. Therefore, the adversary can know MN’s identity.


#### 2.2.2. Anonymity against Malicious Mobile User

It is supposed thatMN′ is a malicious mobile user who has a valid smart card issued by HA. MN′ accomplishes the normal authentication phase with HA to get the nonce nHA′ generated by HA. And then he/she computes SID′ using his/her identity IDMN′ as follows:(14)SID′=IDMN′⊕hhx∥nHA′.MN′ replaces nHA included in the message m4={nHA,nFA,IDFA} between MN and FA with nHA′. Then MN who receives m4 computes the following SID to send it to FA:(15)SID=IDMN⊕hhx∥nHA′.MN′ eavesdrops SID once again to compute IDMN using SID and SID′. IDMN is calculated as follows:(16)IDMN=SID⊕SID′⊕IDMN′=IDMN⊕hhx∥nHA′⊕IDMN′⊕hhx∥nHA′⊕IDMN′.Thus, a legal but malicious user can obtain other’s identity.


#### 2.2.3. Security against Known Session Key Attacks

An adversary can get a user’s identity when a former session key shared betweenMN and FA is revealed. The adversary obtains V2 by eavesdropping and computes the verification value Flg using V2 and a revealed SK such that(17)Flg=V2⊕SK.The adversary also computes another verification value Flg′ after choosing a candidate identity ID′ in the following manner:(18)Flg′=hnHA∥ID′.If Flg equals Flg′, the adversary can ensure that the guessed identity and the MN’s real identity are consistent.


#### 2.2.4. Security against Side Channel Attacks

Let us suppose that an adversary who can execute side channel attacks obtains a valid smart card issued byHA. The adversary can acquire h(x) from the smart card and take SID and nHA from messages in the authentication phase. Then it is possible that the adversary discovers MN’s identity by computing as follows:(19)IDMN=SID⊕hhx∥nHA.Hence, Chang et al.’s scheme can be totally broken by side channel attacks.


## 2.1. Chang et al.’s Scheme

Chang et al.’s scheme consists of three phases: registration, authentication, and session key establishment. And three entities are involved: the mobile userMN, the foreign agent FA, and the home agent HA in each phase. Their assumption is that each FA and each HA share and store a long term session key using any secure method, such as the Diffie-Hellman key agreement protocol.


### 2.1.1. Registration Phase

In the registration phase,MN submits his/her identity IDMN and the selected password PWMN to HA. HA uses its private key x to compute the secret value R as follows:(1)R=hIDMN∥x⊕PWMN.Then HA issues a smart card containing {IDMN,IDHA,R,hx,h(·)} and delivers it to MN in a secure way.


### 2.1.2. Authentication Phase

It is assumed thatMN wants to take a roaming service from FA. Before providing services, FA tries to authenticate MN through HA. To achieve this, MN, FA, and HA perform the authentication phase as follows.(1)
MN inserts his/her smart card into the device and enters a password PWMN∗.(2)
Smart card generates a noncenMN randomly and computes the parameter C as shown in(2)C=R⊕PWMN∗⊕nMN.(3)
MN sends the login message m1={Login  request,nMN,IDHA} to FA. “Login  request” is the header of the message to establish a new secure session between MN and FA.(4)
Upon receivingm1, FA stores nMN and generates a random nonce nFA to send the authentication request message m2={Authenticaton  request,nFA,IDFA} to HA. The message header “Authenticaton  request” notifies HA to authenticate MN.(5)
After receivingm2, HA checks IDFA to see whether a trustworthy relationship between HA and FA is built or not. If IDFA is valid, HA generates a nonce nHA randomly and sends the message m3={nHA,IDHA} to FA.(6)
Upon receivingm3, FA sends the message m4={nHA,nFA,IDFA} to MN.After checking the identities and exchanging nonces betweenMN, FA, and HA, they accomplish the following steps for anonymous authentication.(7)
MN who receives m4 computes the shadow identity SID, the parameter V1, the session key SK, and the parameter V2 sequentially such that(3)SID=IDMN⊕hhx∥nHA,V1=hnHA∥C,SK=hhx∥IDMN∥IDFA∥nMN∥nFA,V2=SK⊕hnHA∥IDMN.(8)
MN computes the following hashing value S1 and sends the message m5={SID,V1,V2,nMN,S1,IDHA} to FA:(4)S1=hnFA∥SID∥V1∥V2∥nMN.(9)
Upon receivingm5, FA checks S1 and computes the following hashing value S2. And then it sends the message m6={SID,V1,V2,nMN,S2,IDFA} to HA:(5)S2=hKFH∥nHA∥SID∥V1∥V2∥nMN.(10)
After receivingm6, HA checks IDFA and S2 firstly. And it checks the format of MN’s identity after computing IDMN as follows:(6)IDMN=SID⊕hhx∥nHA.(11)
HA computes C∗ and V1∗ as demonstrated in (7) to check whether V1∗ is equal to V1. The equivalence between V1∗ and V1 implies that the selected PWMN in the registration phase is the same as the password PWMN∗ that MN enters in the authentication phase:(7)C∗=hIDMN∥x⊕nMN,V1∗=hnHA∥C∗.(12)
HA computes the parameter K1 after obtaining the session key SK from V2. And it computes the parameter V3 and the hashing value S3 to send the message m7={K1,V3,S3} to FA. SK, K1, V3, and S3 are calculated such that(8)SK=V2⊕hnHA∥IDMN,K1=SK⊕hKFH∥nFA,V3=hIDFA∥hx∥nMN,S3=hKFH∥nFA∥K1∥V3.


### 2.1.3. Session Key Establishment Phase

After completing the authentication phase,MN and FA continue the following session key establishment phase.(1)
Upon receivingm7, FA obtains the following session key SK from K1 after checking S3:(9)SK=K1⊕hKFH∥nFA.And it computes the parameterK2 as follows to send the message m8={V3,K2} to MN: (10)K2=SK⊕hSK∥nMN.(2)
After receivingm8, MN computes the following V3∗ and checks whether V3∗ and V3 are equal or not:(11)V3∗=hIDFA∥hx∥nMN.The fact that two values are equal meansMN confirms FA as a valid foreign agent.(3)
MN computes SK∗ as follows: from K2 to check the equivalence between SK∗ and SK that MN computes in the authentication phase:(12)SK∗=K2⊕hSK∥nMN.According to the sameness of two values,MN confirms that he/she shares the authenticated session key with FA.(4)
Since then,MN and FA use SK when they want to communicate with one another through a secure channel.Figure1 describes the authentication and the session key establishment phases in Chang et al.’s scheme.Figure 1
Authentication and session key establishment phases in Chang et al.’s scheme.


## 2.1.1. Registration Phase

In the registration phase,MN submits his/her identity IDMN and the selected password PWMN to HA. HA uses its private key x to compute the secret value R as follows:(1)R=hIDMN∥x⊕PWMN.Then HA issues a smart card containing {IDMN,IDHA,R,hx,h(·)} and delivers it to MN in a secure way.


## 2.1.2. Authentication Phase

It is assumed thatMN wants to take a roaming service from FA. Before providing services, FA tries to authenticate MN through HA. To achieve this, MN, FA, and HA perform the authentication phase as follows.(1)
MN inserts his/her smart card into the device and enters a password PWMN∗.(2)
Smart card generates a noncenMN randomly and computes the parameter C as shown in(2)C=R⊕PWMN∗⊕nMN.(3)
MN sends the login message m1={Login  request,nMN,IDHA} to FA. “Login  request” is the header of the message to establish a new secure session between MN and FA.(4)
Upon receivingm1, FA stores nMN and generates a random nonce nFA to send the authentication request message m2={Authenticaton  request,nFA,IDFA} to HA. The message header “Authenticaton  request” notifies HA to authenticate MN.(5)
After receivingm2, HA checks IDFA to see whether a trustworthy relationship between HA and FA is built or not. If IDFA is valid, HA generates a nonce nHA randomly and sends the message m3={nHA,IDHA} to FA.(6)
Upon receivingm3, FA sends the message m4={nHA,nFA,IDFA} to MN.After checking the identities and exchanging nonces betweenMN, FA, and HA, they accomplish the following steps for anonymous authentication.(7)
MN who receives m4 computes the shadow identity SID, the parameter V1, the session key SK, and the parameter V2 sequentially such that(3)SID=IDMN⊕hhx∥nHA,V1=hnHA∥C,SK=hhx∥IDMN∥IDFA∥nMN∥nFA,V2=SK⊕hnHA∥IDMN.(8)
MN computes the following hashing value S1 and sends the message m5={SID,V1,V2,nMN,S1,IDHA} to FA:(4)S1=hnFA∥SID∥V1∥V2∥nMN.(9)
Upon receivingm5, FA checks S1 and computes the following hashing value S2. And then it sends the message m6={SID,V1,V2,nMN,S2,IDFA} to HA:(5)S2=hKFH∥nHA∥SID∥V1∥V2∥nMN.(10)
After receivingm6, HA checks IDFA and S2 firstly. And it checks the format of MN’s identity after computing IDMN as follows:(6)IDMN=SID⊕hhx∥nHA.(11)
HA computes C∗ and V1∗ as demonstrated in (7) to check whether V1∗ is equal to V1. The equivalence between V1∗ and V1 implies that the selected PWMN in the registration phase is the same as the password PWMN∗ that MN enters in the authentication phase:(7)C∗=hIDMN∥x⊕nMN,V1∗=hnHA∥C∗.(12)
HA computes the parameter K1 after obtaining the session key SK from V2. And it computes the parameter V3 and the hashing value S3 to send the message m7={K1,V3,S3} to FA. SK, K1, V3, and S3 are calculated such that(8)SK=V2⊕hnHA∥IDMN,K1=SK⊕hKFH∥nFA,V3=hIDFA∥hx∥nMN,S3=hKFH∥nFA∥K1∥V3.


## 2.1.3. Session Key Establishment Phase

After completing the authentication phase,MN and FA continue the following session key establishment phase.(1)
Upon receivingm7, FA obtains the following session key SK from K1 after checking S3:(9)SK=K1⊕hKFH∥nFA.And it computes the parameterK2 as follows to send the message m8={V3,K2} to MN: (10)K2=SK⊕hSK∥nMN.(2)
After receivingm8, MN computes the following V3∗ and checks whether V3∗ and V3 are equal or not:(11)V3∗=hIDFA∥hx∥nMN.The fact that two values are equal meansMN confirms FA as a valid foreign agent.(3)
MN computes SK∗ as follows: from K2 to check the equivalence between SK∗ and SK that MN computes in the authentication phase:(12)SK∗=K2⊕hSK∥nMN.According to the sameness of two values,MN confirms that he/she shares the authenticated session key with FA.(4)
Since then,MN and FA use SK when they want to communicate with one another through a secure channel.Figure1 describes the authentication and the session key establishment phases in Chang et al.’s scheme.Figure 1
Authentication and session key establishment phases in Chang et al.’s scheme.


## 2.2. Youn et al.’s Analysis

Youn et al. proved that Chang et al.’s scheme suffers from some specific attacks. Their assumptions are as follows. Anyone can eavesdrop transmitting messages betweenMN, FA, and HA. And it is easy to perform a brute-force search of a valid identity since it is short and has a certain format. In addition, there exists an adversary who can execute side channel attacks.


### 2.2.1. Anonymity against Passive Adversaries

A passive adversary can obtainV2 and K2 by eavesdropping messages between MN, FA, and HA. The adversary chooses a candidate identity ID′ to compute SK′ and K2′ as follows:(13)SK′=V2⊕hnHA∥ID′,K2′=SK′⊕hSK′∥nMN.If K2′ and K2 are equal, the adversary can recognize that the candidate identity is the same as MN’s real identity. Therefore, the adversary can know MN’s identity.


### 2.2.2. Anonymity against Malicious Mobile User

It is supposed thatMN′ is a malicious mobile user who has a valid smart card issued by HA. MN′ accomplishes the normal authentication phase with HA to get the nonce nHA′ generated by HA. And then he/she computes SID′ using his/her identity IDMN′ as follows:(14)SID′=IDMN′⊕hhx∥nHA′.MN′ replaces nHA included in the message m4={nHA,nFA,IDFA} between MN and FA with nHA′. Then MN who receives m4 computes the following SID to send it to FA:(15)SID=IDMN⊕hhx∥nHA′.MN′ eavesdrops SID once again to compute IDMN using SID and SID′. IDMN is calculated as follows:(16)IDMN=SID⊕SID′⊕IDMN′=IDMN⊕hhx∥nHA′⊕IDMN′⊕hhx∥nHA′⊕IDMN′.Thus, a legal but malicious user can obtain other’s identity.


### 2.2.3. Security against Known Session Key Attacks

An adversary can get a user’s identity when a former session key shared betweenMN and FA is revealed. The adversary obtains V2 by eavesdropping and computes the verification value Flg using V2 and a revealed SK such that(17)Flg=V2⊕SK.The adversary also computes another verification value Flg′ after choosing a candidate identity ID′ in the following manner:(18)Flg′=hnHA∥ID′.If Flg equals Flg′, the adversary can ensure that the guessed identity and the MN’s real identity are consistent.


### 2.2.4. Security against Side Channel Attacks

Let us suppose that an adversary who can execute side channel attacks obtains a valid smart card issued byHA. The adversary can acquire h(x) from the smart card and take SID and nHA from messages in the authentication phase. Then it is possible that the adversary discovers MN’s identity by computing as follows:(19)IDMN=SID⊕hhx∥nHA.Hence, Chang et al.’s scheme can be totally broken by side channel attacks.


## 2.2.1. Anonymity against Passive Adversaries

A passive adversary can obtainV2 and K2 by eavesdropping messages between MN, FA, and HA. The adversary chooses a candidate identity ID′ to compute SK′ and K2′ as follows:(13)SK′=V2⊕hnHA∥ID′,K2′=SK′⊕hSK′∥nMN.If K2′ and K2 are equal, the adversary can recognize that the candidate identity is the same as MN’s real identity. Therefore, the adversary can know MN’s identity.


## 2.2.2. Anonymity against Malicious Mobile User

It is supposed thatMN′ is a malicious mobile user who has a valid smart card issued by HA. MN′ accomplishes the normal authentication phase with HA to get the nonce nHA′ generated by HA. And then he/she computes SID′ using his/her identity IDMN′ as follows:(14)SID′=IDMN′⊕hhx∥nHA′.MN′ replaces nHA included in the message m4={nHA,nFA,IDFA} between MN and FA with nHA′. Then MN who receives m4 computes the following SID to send it to FA:(15)SID=IDMN⊕hhx∥nHA′.MN′ eavesdrops SID once again to compute IDMN using SID and SID′. IDMN is calculated as follows:(16)IDMN=SID⊕SID′⊕IDMN′=IDMN⊕hhx∥nHA′⊕IDMN′⊕hhx∥nHA′⊕IDMN′.Thus, a legal but malicious user can obtain other’s identity.


## 2.2.3. Security against Known Session Key Attacks

An adversary can get a user’s identity when a former session key shared betweenMN and FA is revealed. The adversary obtains V2 by eavesdropping and computes the verification value Flg using V2 and a revealed SK such that(17)Flg=V2⊕SK.The adversary also computes another verification value Flg′ after choosing a candidate identity ID′ in the following manner:(18)Flg′=hnHA∥ID′.If Flg equals Flg′, the adversary can ensure that the guessed identity and the MN’s real identity are consistent.


## 2.2.4. Security against Side Channel Attacks

Let us suppose that an adversary who can execute side channel attacks obtains a valid smart card issued byHA. The adversary can acquire h(x) from the smart card and take SID and nHA from messages in the authentication phase. Then it is possible that the adversary discovers MN’s identity by computing as follows:(19)IDMN=SID⊕hhx∥nHA.Hence, Chang et al.’s scheme can be totally broken by side channel attacks.


## 3. Proposed Scheme

To provide anonymity and security, the proposed scheme that improves Chang et al.’s scheme makes up for the weak points shown by Youn et al. Also, it guarantees untraceability for things by using different anonymized identities all the time. Since it minimizes the number of transmitting messages and computations, it is suitable for IoT environments. Figure2 presents IoT network environments applied to our scheme. A registration server and a gateway accomplish mutual communication through the Internet while they preserve a trustworthy relationship. The registration server maintains secret information of things. The gateway forms its own domain to combine the things that existed in its permissible range. And it makes the things link up with their registration server. The things collect and produce various information and exchange data one another if necessary. Depending on the number of things in a domain, several base stations are required to provide stable communication channel. Base stations do not participate in the join phase directly. They just act as mediators between the things and the gateway. If the stability of communications channel is guaranteed, a lot of things can work in one domain. It is because the thing only computes low cost functions, while relatively high cost computations are up to the gateway. In other words, a domain can be expanded regardless of the number of things.Figure 2
IoT network environments in the proposed scheme.The proposed scheme consists of three phases: registration, join, and communication. In each phase, the thingT, the gateway G, and the registration server R are involved. We assume R and G share a common secret key using a secure method, such as the Diffie-Hellman key agreement protocol in advance. And let us suppose that a time synchronization is established between T, G, and R.In the registration phase,T registers for R in a safe way. T registered for R normally joins G’s domain in the join phase. In that phase, G can authenticate T through R. The things that successfully joined G’s domain cannot trust each other yet, whereas they already build a trustworthy relationship with G through sharing of a common secret key. When the things want to communicate with each other safely, they carry out authentication and session key establishment processes through G. Table 2 indicates additional notations used in our scheme. We use notations in both Tables 1 and 2.Table 2
Additional notations in the proposed scheme.
Notations
Descriptions
T
Thing
R
Registration server
G
Gateway of a domain
SID
X
Shadow identity of an entityX
VID
X
Virtual identity of an entityX
x
X
Private key of an entityX
t
X
Timestamp generated by an entityX


### 3.1. Registration Phase

Firstly,T registers for R and R issues T’s virtual identity. T receives secret information from R and stores them safely. Figure 3 shows the registration phase between T and R.Figure 3
Registration phase in the proposed scheme.(1)
T submits its identity IDT to R.
(2)
R generates T’s private key xT and an initial timestamp tI. And it computes T’s virtual identity VIDT as follows:(20)VIDT=hIDT∥xT∥tI.Due to the private key, the virtual identity hides the real identity perfectly. The registration server is supposed to use the virtual identity to verify the thing’s real identity. The virtual identity is essential element to make the proposed scheme provide anonymity.
(3)
R stores T’s secret information [IDT,VIDT,xT,tI] in its database secretly. It computes the hashing values hxT of T’s private key xT and hxR of its private key xR. And it sends the secret information {IDT,VIDT,xT,hxT,hxR,IDR} to T.
(4)
T stores the secret information [IDT,VIDT,xT,hxT,hxR,IDR] safely.


### 3.2. Join Phase

Let us supposeT wants to join G’s domain in order to take services from G. Then G tries to authenticate T through R to provide services. We define KRG as the common secret key shared between R and G in advance. T, G, and R perform the following authentication and key establishment steps. Figure 4 presents the join phase.Figure 4
Join phase in the proposed scheme.(1)
T generates a timestamp tT to compute the following shadow identity SIDT using VIDT and h(xR):(21)SIDT=VIDT⊕hhxR∥tT.
The virtual identity already concealed the thing’s real identity in the registration. In this step, the shadow identity hides the virtual identity again. While the shadow identity of Chang et al.’s scheme hides the real identity directly, our shadow identity contains the virtual identity instead of the real identity. It means the proposed scheme provides anonymity, even if the shadow identity is revealed.
(2)
T sends the join request message m1={JoinReq.,SIDT,IDR,tT} to G, where the message header JoinReq. means T requests R to authenticate G and to provide a common secret key for joining G.
(3)
After receivingm1, G checks tT and generates a timestamp tG. And it computes the hashing value H1 using the preshared common secret KRG as follows:(22)H1=hKRG∥SIDT∥tT∥tG.
And it sends the authentication request messagem2={AuthReq.,SIDT,IDG,H1,tT,tG} to R. The message header AuthReq. indicates G requests R to authenticate T.
(4)
Upon receivingm2, R checks IDG to determine whether it is an ally or not and checks tG to verify the validity of time period. And it computes the following H1∗ to check whether it is equal to H1:(23)H1∗=hKRG∥SIDT∥tT∥tG.
If results are all valid,R generates a timestamp tR.
(5)
R computes VIDT∗ using received information and h(xR) as follows:(24)VIDT∗=SIDT⊕hhxR∥tT.
And it retrieves the secret information [IDT,VIDT,xT,tI] from its database using VIDT∗ as a keyword. If it is impossible to get VIDT same as VIDT∗, then R rejects G’s request for authentication and stops communication with G.
(6)
R computes T’s new virtual identity VIDT′ as shown in (25) and stores it safely to substitute the existing virtual identity VIDT:(25)VIDT′=hIDT∥xT∥tR.
This step makes every virtual identity supposed to be used only once. In other words, it guarantees the freshness of all virtual identities and it finally provides unlinkability of the proposed scheme.
(7)
After the renewal of the virtual identity,R computes the common secret key supposed to be shared between G and T using T’s private key xT. Also, it computes the verification values V1, V2, and V3 for T and the verification value V4 for G as follows:(26)KGT=hhxT∥IDT∥IDG∥tT∥tG,V1=hhxT∥IDG∥tT,V2=hKGT∥IDR∥tT,V3=hVIDT′∥IDR∥tT,V4=KGT⊕hKRG∥tG.
Since the common secret keyKGT is derived from a secret hashing value hxT and changing timestamps, the secrecy and the freshness of the common secret key are always guaranteed.
(8)
R computes the following hashing value H2 and sends the message m3={IDR,V1,V2,V3,V4,H2,tR} to G:(27)H2=hKRG∥V1∥V2∥V3∥V4∥tR.
(9)
After receivingm3, G checks tR and H2. If they are all valid, G computes the verification value V5 after computing the common secret key KGT. And it sends the message m4={IDG,V1,V2,V3,V5,tG,tR} to T. KGT and V5 are as shown in the following formulas:(28)KGT=V4⊕hKRG∥tG,V5=KGT⊕hKGT∥tT.
(10)
Upon receivingm4, T computes the following V1∗ after checking tG:(29)V1∗=hhxT∥IDG∥tT.
The fact thatV1∗ is the same as V1 implies that T recognizes the fact that R checked IDG.
(11)
T computes KGT∗ and V2∗ such that(30)KGT∗=hhxT∥IDT∥IDG∥tT∥tG,V2∗=hKGT∗∥IDR∥tT,
to check the equivalence betweenV2∗ and V2. The sameness of two values means that R trusted by T computes the common secret key which is supposed to be shared between G and T.
(12)
T computes the virtual identity VIDT′ and the verification value V3∗ as follows:(31)VIDT′=hIDT∥xT∥tR,V3∗=hVIDT′∥IDR∥tT.
And it checks whetherV3∗ is equal to V3. The equality indicates R computes T’s new virtual identity VIDT′ normally. And then T stores its new virtual identity VIDT′ securely. As a result, the virtual identity is renewed by replacing the existing VIDT with the new VIDT′.
(13)
T checks the equivalence between V5∗ and V5 after computing V5∗ as shown in(32)V5∗=KGT∗⊕hKGT∗∥tT.
The valid verification ofV5∗ implies that T and G share the common secret key successfully.


### 3.3. Communication Phase

The things located inG’s domain authenticate each other and share session keys to communicate in a secure way. We assume that T1 and T2 already shared common secret keys called KGT1 and KGT2, respectively, with G in the join phase. T1 performs the following communication phase to share a session key with T2. The communication phase is presented in Figure 5.Figure 5
Communication phase in the proposed scheme.(1)
T
1 generates a timestamp tT1 and computes the new shadow identity SIDT1′ as shown in(33)SIDT1′=VIDT1⊕hhxR∥tT1
to substitute the existing shadow identitySIDT1.
(2)
T
1 computes the verification value V6 and the hashing value H3 as follows:(34)V6=SIDT1′⊕hKGT1∥tT1,H3=hKGT1∥SIDT1∥V6∥tT1.
And it sends the communication request messagem5={CommReq.,SIDT1,IDG,V6,H3,tT1} to T2. The message header CommReq. stands for T1’s request for communicating with T2.
(3)
Upon receivingm5, T2 generates a timestamp tT2 after checking tT1 and computes its new shadow identity SIDT2′, the verification value V7, and the hashing value H4 such that(35)SIDT2′=VIDT2⊕hhxR∥tT2,V7=SIDT2′⊕hKGT2∥tT2,H4=hKGT2∥V6∥V7∥H3∥SIDT1∥SIDT2∥tT1∥tT2.
And it sends the authentication request messagem6={AuthReq.,SIDT1,SIDT2,V6,V7,H3,H4,tT1,tT2} to G. The message header AuthReq. means that T2 requests G to authenticate T1.
(4)
After receivingm6, G firstly checks tT2, SIDT1, and SIDT2 to confirm that T1 and T2 were authenticated by itself in the join phase. And then it checks that H3∗ is equal to H3 and H4∗ is equal to H4 after computing the following H3∗, H4∗:(36)H3∗=hKGT1∥SIDT1∥V6∥tT1,H4∗=hKGT2∥V6∥V7∥H3∥SIDT1∥SIDT2∥tT1∥tT2.
(5)
If all the hashing values are verified successfully,G computes the new shadow identities of T1 and T2 using V6, V7, KGT1, and KGT2. The new shadow identities SIDT1′ and SIDT2′ are calculated from(37)SIDT1′=V6⊕hKGT1∥tT1,SIDT2′=V7⊕hKGT2∥tT2.
And it replaces the existing shadow identitiesSIDT1 and SIDT2 with SIDT1′ and SIDT2′. It stores SIDT1′ and SIDT2′ securely in its database. According to this step, the freshness of all shadow identities is guaranteed. As a result, it preserves unlinkability of the proposed scheme.
(6)
G generates a timestamp tG12 and computes the session key SK and the parameters K1 and K2 using KGT1 and KGT2 as follows:(38)SK=hKGT1∥KGT2∥SIDT1∥SIDT2∥tT1∥tT2,K1=SK⊕hKGT1∥SIDT2∥tT1,K2=SK⊕hKGT2∥SIDT1∥tT2.
(7)
G computes the verification and the hashing values, such as V8, V9, H5, and H6 as shown in(39)V8=hSK∥IDG∥tT1,V9=hSK∥IDG∥tT2,H5=hKGT1∥K1∥V8∥tG12,H6=hKGT2∥K2∥V9∥tG12.
And then it sends the messagesm7={IDG,K2,V9,H6,tG12} to T2 and m8=IDG,K1,V8,H5,tG12 to T1.
(8)
Upon receivingm7, T2 checks tG12 and H6 and computes the following session key SK∗ shared with T1 using the common secret key KGT2 and the received K2:(40)SK∗=K2⊕hKGT2∥SIDT1∥tT2.
After that, it checks the equivalence between the computedV9∗ and the received V9, where V9∗ is calculated by the following equation:(41)V9∗=hSK∗∥IDG∥tT2.
If the result is valid,T2 recognizes the fact that G computed the session key SK.
(9)
Meanwhile, after receivingm8, T1 also checks the validities of tG12 and H5 at first. Then it computes the session key SK∗ using KGT1 and K1 and the verification value V8∗ using SK∗ as follows:(42)SK∗=K1⊕hSKGT1∥SIDT2∥tT1,V8∗=hSK∗∥IDG∥tT1.
T
1 confirms the sameness of V8∗ and V8 to check the session key SK computed by G. Finally, T1 shares the session key SK with T2 successfully.


## 3.1. Registration Phase

Firstly,T registers for R and R issues T’s virtual identity. T receives secret information from R and stores them safely. Figure 3 shows the registration phase between T and R.Figure 3
Registration phase in the proposed scheme.(1)
T submits its identity IDT to R.
(2)
R generates T’s private key xT and an initial timestamp tI. And it computes T’s virtual identity VIDT as follows:(20)VIDT=hIDT∥xT∥tI.Due to the private key, the virtual identity hides the real identity perfectly. The registration server is supposed to use the virtual identity to verify the thing’s real identity. The virtual identity is essential element to make the proposed scheme provide anonymity.
(3)
R stores T’s secret information [IDT,VIDT,xT,tI] in its database secretly. It computes the hashing values hxT of T’s private key xT and hxR of its private key xR. And it sends the secret information {IDT,VIDT,xT,hxT,hxR,IDR} to T.
(4)
T stores the secret information [IDT,VIDT,xT,hxT,hxR,IDR] safely.


## 3.2. Join Phase

Let us supposeT wants to join G’s domain in order to take services from G. Then G tries to authenticate T through R to provide services. We define KRG as the common secret key shared between R and G in advance. T, G, and R perform the following authentication and key establishment steps. Figure 4 presents the join phase.Figure 4
Join phase in the proposed scheme.(1)
T generates a timestamp tT to compute the following shadow identity SIDT using VIDT and h(xR):(21)SIDT=VIDT⊕hhxR∥tT.
The virtual identity already concealed the thing’s real identity in the registration. In this step, the shadow identity hides the virtual identity again. While the shadow identity of Chang et al.’s scheme hides the real identity directly, our shadow identity contains the virtual identity instead of the real identity. It means the proposed scheme provides anonymity, even if the shadow identity is revealed.
(2)
T sends the join request message m1={JoinReq.,SIDT,IDR,tT} to G, where the message header JoinReq. means T requests R to authenticate G and to provide a common secret key for joining G.
(3)
After receivingm1, G checks tT and generates a timestamp tG. And it computes the hashing value H1 using the preshared common secret KRG as follows:(22)H1=hKRG∥SIDT∥tT∥tG.
And it sends the authentication request messagem2={AuthReq.,SIDT,IDG,H1,tT,tG} to R. The message header AuthReq. indicates G requests R to authenticate T.
(4)
Upon receivingm2, R checks IDG to determine whether it is an ally or not and checks tG to verify the validity of time period. And it computes the following H1∗ to check whether it is equal to H1:(23)H1∗=hKRG∥SIDT∥tT∥tG.
If results are all valid,R generates a timestamp tR.
(5)
R computes VIDT∗ using received information and h(xR) as follows:(24)VIDT∗=SIDT⊕hhxR∥tT.
And it retrieves the secret information [IDT,VIDT,xT,tI] from its database using VIDT∗ as a keyword. If it is impossible to get VIDT same as VIDT∗, then R rejects G’s request for authentication and stops communication with G.
(6)
R computes T’s new virtual identity VIDT′ as shown in (25) and stores it safely to substitute the existing virtual identity VIDT:(25)VIDT′=hIDT∥xT∥tR.
This step makes every virtual identity supposed to be used only once. In other words, it guarantees the freshness of all virtual identities and it finally provides unlinkability of the proposed scheme.
(7)
After the renewal of the virtual identity,R computes the common secret key supposed to be shared between G and T using T’s private key xT. Also, it computes the verification values V1, V2, and V3 for T and the verification value V4 for G as follows:(26)KGT=hhxT∥IDT∥IDG∥tT∥tG,V1=hhxT∥IDG∥tT,V2=hKGT∥IDR∥tT,V3=hVIDT′∥IDR∥tT,V4=KGT⊕hKRG∥tG.
Since the common secret keyKGT is derived from a secret hashing value hxT and changing timestamps, the secrecy and the freshness of the common secret key are always guaranteed.
(8)
R computes the following hashing value H2 and sends the message m3={IDR,V1,V2,V3,V4,H2,tR} to G:(27)H2=hKRG∥V1∥V2∥V3∥V4∥tR.
(9)
After receivingm3, G checks tR and H2. If they are all valid, G computes the verification value V5 after computing the common secret key KGT. And it sends the message m4={IDG,V1,V2,V3,V5,tG,tR} to T. KGT and V5 are as shown in the following formulas:(28)KGT=V4⊕hKRG∥tG,V5=KGT⊕hKGT∥tT.
(10)
Upon receivingm4, T computes the following V1∗ after checking tG:(29)V1∗=hhxT∥IDG∥tT.
The fact thatV1∗ is the same as V1 implies that T recognizes the fact that R checked IDG.
(11)
T computes KGT∗ and V2∗ such that(30)KGT∗=hhxT∥IDT∥IDG∥tT∥tG,V2∗=hKGT∗∥IDR∥tT,
to check the equivalence betweenV2∗ and V2. The sameness of two values means that R trusted by T computes the common secret key which is supposed to be shared between G and T.
(12)
T computes the virtual identity VIDT′ and the verification value V3∗ as follows:(31)VIDT′=hIDT∥xT∥tR,V3∗=hVIDT′∥IDR∥tT.
And it checks whetherV3∗ is equal to V3. The equality indicates R computes T’s new virtual identity VIDT′ normally. And then T stores its new virtual identity VIDT′ securely. As a result, the virtual identity is renewed by replacing the existing VIDT with the new VIDT′.
(13)
T checks the equivalence between V5∗ and V5 after computing V5∗ as shown in(32)V5∗=KGT∗⊕hKGT∗∥tT.
The valid verification ofV5∗ implies that T and G share the common secret key successfully.


## 3.3. Communication Phase

The things located inG’s domain authenticate each other and share session keys to communicate in a secure way. We assume that T1 and T2 already shared common secret keys called KGT1 and KGT2, respectively, with G in the join phase. T1 performs the following communication phase to share a session key with T2. The communication phase is presented in Figure 5.Figure 5
Communication phase in the proposed scheme.(1)
T
1 generates a timestamp tT1 and computes the new shadow identity SIDT1′ as shown in(33)SIDT1′=VIDT1⊕hhxR∥tT1
to substitute the existing shadow identitySIDT1.
(2)
T
1 computes the verification value V6 and the hashing value H3 as follows:(34)V6=SIDT1′⊕hKGT1∥tT1,H3=hKGT1∥SIDT1∥V6∥tT1.
And it sends the communication request messagem5={CommReq.,SIDT1,IDG,V6,H3,tT1} to T2. The message header CommReq. stands for T1’s request for communicating with T2.
(3)
Upon receivingm5, T2 generates a timestamp tT2 after checking tT1 and computes its new shadow identity SIDT2′, the verification value V7, and the hashing value H4 such that(35)SIDT2′=VIDT2⊕hhxR∥tT2,V7=SIDT2′⊕hKGT2∥tT2,H4=hKGT2∥V6∥V7∥H3∥SIDT1∥SIDT2∥tT1∥tT2.
And it sends the authentication request messagem6={AuthReq.,SIDT1,SIDT2,V6,V7,H3,H4,tT1,tT2} to G. The message header AuthReq. means that T2 requests G to authenticate T1.
(4)
After receivingm6, G firstly checks tT2, SIDT1, and SIDT2 to confirm that T1 and T2 were authenticated by itself in the join phase. And then it checks that H3∗ is equal to H3 and H4∗ is equal to H4 after computing the following H3∗, H4∗:(36)H3∗=hKGT1∥SIDT1∥V6∥tT1,H4∗=hKGT2∥V6∥V7∥H3∥SIDT1∥SIDT2∥tT1∥tT2.
(5)
If all the hashing values are verified successfully,G computes the new shadow identities of T1 and T2 using V6, V7, KGT1, and KGT2. The new shadow identities SIDT1′ and SIDT2′ are calculated from(37)SIDT1′=V6⊕hKGT1∥tT1,SIDT2′=V7⊕hKGT2∥tT2.
And it replaces the existing shadow identitiesSIDT1 and SIDT2 with SIDT1′ and SIDT2′. It stores SIDT1′ and SIDT2′ securely in its database. According to this step, the freshness of all shadow identities is guaranteed. As a result, it preserves unlinkability of the proposed scheme.
(6)
G generates a timestamp tG12 and computes the session key SK and the parameters K1 and K2 using KGT1 and KGT2 as follows:(38)SK=hKGT1∥KGT2∥SIDT1∥SIDT2∥tT1∥tT2,K1=SK⊕hKGT1∥SIDT2∥tT1,K2=SK⊕hKGT2∥SIDT1∥tT2.
(7)
G computes the verification and the hashing values, such as V8, V9, H5, and H6 as shown in(39)V8=hSK∥IDG∥tT1,V9=hSK∥IDG∥tT2,H5=hKGT1∥K1∥V8∥tG12,H6=hKGT2∥K2∥V9∥tG12.
And then it sends the messagesm7={IDG,K2,V9,H6,tG12} to T2 and m8=IDG,K1,V8,H5,tG12 to T1.
(8)
Upon receivingm7, T2 checks tG12 and H6 and computes the following session key SK∗ shared with T1 using the common secret key KGT2 and the received K2:(40)SK∗=K2⊕hKGT2∥SIDT1∥tT2.
After that, it checks the equivalence between the computedV9∗ and the received V9, where V9∗ is calculated by the following equation:(41)V9∗=hSK∗∥IDG∥tT2.
If the result is valid,T2 recognizes the fact that G computed the session key SK.
(9)
Meanwhile, after receivingm8, T1 also checks the validities of tG12 and H5 at first. Then it computes the session key SK∗ using KGT1 and K1 and the verification value V8∗ using SK∗ as follows:(42)SK∗=K1⊕hSKGT1∥SIDT2∥tT1,V8∗=hSK∗∥IDG∥tT1.
T
1 confirms the sameness of V8∗ and V8 to check the session key SK computed by G. Finally, T1 shares the session key SK with T2 successfully.


## 4. Security Analysis

In this section, we prove the proposed scheme is secure against particular attacks. The assumptions are as follows: an adversary can eavesdrop any messages transmitted betweenT, G, and R and he/she can obtain a legitimate thing normally registered for R.


### 4.1. Anonymity

Our scheme provides anonymity against an adversary who acquires a valid thing.


#### 4.1.1. Anonymity in Join Phase

An adversary can eavesdropT’s shadow identity SIDT and the timestamp tT from the message m1 in the join phase. If the adversary obtains a valid thing T′ registered for R, he/she can have a knowledge of the secret information [IDT′,VIDT′,xT′,hxR,IDR] stored in T′. Thus, the adversary can get T’s virtual identity VIDT by computing VIDT=SIDT⊕h(h(xR)∥tT) using SIDT and tT from m1 and hxR from T′. To acquire T’s real identity IDT from VIDT(=h(IDT∥xT∥tI)), the adversary guesses a candidate identity IDT′ firstly, and then he/she tries to check the equivalence between IDT′ and IDT. Since an identity is short and has a certain format, it is guessable. However, the adversary cannot check whether VIDT=h(IDT′∥xT∥tI) is satisfied or not without knowing T’s private key xT and the timestamp tI. Therefore, it is impossible for the adversary to check whether the real identity is equal to the candidate identity or not.


#### 4.1.2. Anonymity in Communication Phase

In the communication phase, an adversary can getT1’s shadow identity SIDT1 and its timestamp tT1 from the message m5 or m6 and hxR from a legitimate thing T′. By using them, the adversary can gain T1’s virtual identity VIDT1(=SIDT1⊕h(h(xR)∥tT1)) as he/she does in the join phase. Then the adversary tries to confirm whether VIDT1=h(IDT1′∥xT1∥tI1) is satisfied or not by guessing a candidate identity IDT1′. Unfortunately, the adversary cannot check the equivalence between the real identity and the candidate identity without knowing xT1 and tI1. For that reason, the adversary gets no information related to T1’s identity.


### 4.2. Untraceability

The proposed scheme provides untraceability for a thing. Because all transmitting messages always include the unique shadow and virtual identities in the join and the communication phases, an adversary cannot know the fact that all messages are originated from the same thing.


#### 4.2.1. Untraceability in Join Phase

If a common secret key shared betweenT and G is renewed periodically or T tries to join many different Gs, an adversary can collect all shadow identities from T’s join request messages in every session by eavesdropping. Besides, the adversary who has a valid thing can obtain T’s virtual identity VIDT by computing VIDT=SIDT⊕h(h(xR)∥tT) because he/she can know SIDT, h(xR), and tT. Meanwhile, if the shadow identity or the virtual identity always has a same value in every session, the adversary can recognize that one thing sends the join request message repeatedly while he/she cannot know that thing’s real identity. In other words, the adversary can trace the fact that a certain thing requests to join continuously. However, the whole shadow identities are all different, since they include a unique timestamp. And the registration server always issues the new virtual identity to renew the old one in every session. Therefore, the join request message sent by the thing includes the different shadow identity all the time. It means the proposed scheme guarantees untraceability for the thing.


#### 4.2.2. Untraceability in Communication Phase

The shadow identity in the communication phase also includes a unique timestamp. And everything always computes the new shadow identity and sends it to the gateway when they request to communicate. The gateway stores this new shadow identity to use it in the next session only if it checks that the old shadow identity is valid. Thus, shadow identities in every session have a uniqueness. Due to this, an adversary cannot trace the action of the thing in the communication phase.


### 4.3. Replay Attacks

Although an adversary resends past transmitting messages after collecting them in a certain session, participants involved in the join and the communication phases can detect a retransmission and stop to communicate with each other.


#### 4.3.1. Replay Attacks in Join Phase

In the join phase, an adversary can gather the messagesm1, m2, m3, and m4 between T, G, and R. When the adversary resends the old message m1={JoinReq.,SIDT,IDR,tT} to G, G checks a time interval between a current time and tT. And it rejects the join request if the time interval exceeds a predefined value. In addition, R can also recognize the old message m2={AuthReq.,SIDT,IDG,H1,tT,tG} sent by the adversary by checking the time period between a current time and tG. In this case, R absolutely breaks a connection.


#### 4.3.2. Replay Attacks in Communication Phase

An adversary who collects the messagesm5, m6, m7, and m8 in the communication phase sends m5 to T2 and m6 to G. After receiving the message, T2 and G can know whether the message is resent or not by checking a timestamp and a current time. As a result, resending old messages is always detectable.


### 4.4. Forgery Attacks

In our scheme, an adversary cannot forge messages to perform the valid join and communication phases.


#### 4.4.1. Forgery Attacks in Join Phase

When the messagem1′={JoinReq.,SIDT′,IDR,tT} forged from m1 by an adversary is sent to G in the join phase, G makes m2′={AuthReq.,SIDT′,IDG,H1′,tT,tG} and sends it to R. Then R computes VIDT∗=SIDT′⊕h(h(xR)∥tT) using h(xR) that is the hashing value of its private key xR and tries to search T’s secret information using VIDT∗ as a keyword. Since there is no matched virtual identity in R’s database, R stops to communicate with G after recognizing that m2′ is originated from the forged message.


#### 4.4.2. Forgery Attacks in Communication Phase

An adversary sends the messagem5′={CommReq.,SIDT1′,IDG,V6′,H3′,tT1} to T2 after forging T1’s message m5 in the communication phase. Upon receiving m5′, T2 sends m6′={AuthReq.,SIDT1′,SIDT2,V6′,V7,H3′,H4,tT1,tT2} to G. Then G can easily know that no shadow identity equals to SIDT1′ in its database. Finally, G rejects T2’s request.


### 4.5. Impersonation Attacks

The proposed scheme is secure against attacks that an adversary who obtains a shadow identity of the thing impersonates that thing.


#### 4.5.1. Impersonation Attacks in Join Phase

An adversary who tries to impersonate the valid thingT easily obtains T’s shadow identity SIDT from the message m1 in the join phase. The adversary makes the message m1′={JoinReq.,SIDT,IDR,tT′} using the obtained SIDT and a timestamp tT′ generated by him/her in a new session. And he/she sends m1′ to G. After receiving m1′, G decides m1′ is a valid request message because tT′ and H1′ are verified successfully. And then G sends the message m2′={AuthReq.,SIDT,IDG,H1′,tT′,tG′} to R. Checking tG′, IDG, and H1′ by R is also successful. R computes VIDT∗ from the received SIDT by computing the equation VIDT∗=SIDT⊕h(h(xR)∥tT′)=VIDT⊕h(h(xR)∥tT)⊕h(h(xR)∥tT′). There is no equivalent virtual identity to VIDT∗ in its database. Surely, R recognizes it is an abnormal case and rejects G’s request.


#### 4.5.2. Impersonation Attacks in Communication Phase

An adversary getsSIDT1 from m5 in the communication phase. To impersonate T1, the adversary generates a new timestamp tt1′, makes the message m5′={CommReq.,SIDT1,IDG,V6′,H3′,tT1′}, and sends m5′ to T2 in a new session. Here, the adversary cannot compute the valid V6′ and H3′ because he/she does not know T1’s common secret key KGT1. After receiving m5′, T2 makes the message m6′={AuthReq.,SIDT1,SIDT2,V6′,V7′,H3′,H4′,tT1′,tT2′} and sends it to G. G verifies that all tt2′, SIDT1, SIDT2, and H4′ are valid but it detects that H3′∗(=h(KGT1∥SIDT1∥V6′∥tT1′)) and the received H3′ are not equal. As a result, G recognizes T1 is an invalid thing and refuses T2’s request.


### 4.6. Known Session Key Attacks

Disclosure of a common secret key in the join phase or a session key in the communication phase does not affect revelations about the thing’s identity, other common secret keys, and other session keys.


#### 4.6.1. Known Session Key Attacks in Join Phase

A common secret key shared betweenT and G is computed using a timestamp in the join phase. Because a timestamp always has a different value, every common secret key is unique. Although an adversary knows KGT(=hhxT∥IDT∥IDG∥tT∥tG), he/she cannot obtain the thing’s identity and the common secret key in other sessions. The reasons are as follows. Firstly, the adversary still cannot get thing’s identity IDT from KGT without knowing T’s secret information hxT. Moreover, let us suppose the adversary tries to get other common secret keys KGT′ in the next session after computing h(KRG∥tG)=V4⊕KGT using V4 and KGT. In that next session, the adversary eavesdrops V4′(=KGT′⊕h(KRG∥tG′))and computes KGT′⊕h(KRG∥tG′)⊕h(KRG∥tG)=V4′⊕h(KRG∥tG) using V4′ and h(KRG∥tG). Due to the difference of tG and tG′, h(KRG∥tG′)⊕h(KRG∥tG) is not eliminated in the above equation and the adversary cannot get KGT′. As a result, it is impossible to calculate the new session key even though the former is revealed.


#### 4.6.2. Known Session Key Attacks in Communication Phase

All session keys in the communication phase are independent since all of them include their own unique timestamps. If the session keySK shared between T1 and T2 is revealed to an adversary in a certain session, he/she can compute h(KGT1∥SIDT2∥tT1)=K1⊕SK using K1 and the revealed SK. In the next session, the adversary eavesdrops K1′(=SK′⊕h(KGT1∥SIDT2∥tT1′)) and tries to compute SK′⊕h(KGT1∥SIDT2∥tT1′)⊕h(KGT1∥SIDT2∥tT1)=K1′⊕h(KGT1∥SIDT2∥tT1) using K1′ and (KGT1∥SIDT2∥tT1). Since tT1 is not equal to tT1′, h(KGT1∥SIDT2∥tT1′) and h(KGT1∥SIDT2∥tT1) are not erased. Therefore, there is no way to obtain the new session key SK′ from the old session key SK.


## 4.1. Anonymity

Our scheme provides anonymity against an adversary who acquires a valid thing.


### 4.1.1. Anonymity in Join Phase

An adversary can eavesdropT’s shadow identity SIDT and the timestamp tT from the message m1 in the join phase. If the adversary obtains a valid thing T′ registered for R, he/she can have a knowledge of the secret information [IDT′,VIDT′,xT′,hxR,IDR] stored in T′. Thus, the adversary can get T’s virtual identity VIDT by computing VIDT=SIDT⊕h(h(xR)∥tT) using SIDT and tT from m1 and hxR from T′. To acquire T’s real identity IDT from VIDT(=h(IDT∥xT∥tI)), the adversary guesses a candidate identity IDT′ firstly, and then he/she tries to check the equivalence between IDT′ and IDT. Since an identity is short and has a certain format, it is guessable. However, the adversary cannot check whether VIDT=h(IDT′∥xT∥tI) is satisfied or not without knowing T’s private key xT and the timestamp tI. Therefore, it is impossible for the adversary to check whether the real identity is equal to the candidate identity or not.


### 4.1.2. Anonymity in Communication Phase

In the communication phase, an adversary can getT1’s shadow identity SIDT1 and its timestamp tT1 from the message m5 or m6 and hxR from a legitimate thing T′. By using them, the adversary can gain T1’s virtual identity VIDT1(=SIDT1⊕h(h(xR)∥tT1)) as he/she does in the join phase. Then the adversary tries to confirm whether VIDT1=h(IDT1′∥xT1∥tI1) is satisfied or not by guessing a candidate identity IDT1′. Unfortunately, the adversary cannot check the equivalence between the real identity and the candidate identity without knowing xT1 and tI1. For that reason, the adversary gets no information related to T1’s identity.


## 4.1.1. Anonymity in Join Phase

An adversary can eavesdropT’s shadow identity SIDT and the timestamp tT from the message m1 in the join phase. If the adversary obtains a valid thing T′ registered for R, he/she can have a knowledge of the secret information [IDT′,VIDT′,xT′,hxR,IDR] stored in T′. Thus, the adversary can get T’s virtual identity VIDT by computing VIDT=SIDT⊕h(h(xR)∥tT) using SIDT and tT from m1 and hxR from T′. To acquire T’s real identity IDT from VIDT(=h(IDT∥xT∥tI)), the adversary guesses a candidate identity IDT′ firstly, and then he/she tries to check the equivalence between IDT′ and IDT. Since an identity is short and has a certain format, it is guessable. However, the adversary cannot check whether VIDT=h(IDT′∥xT∥tI) is satisfied or not without knowing T’s private key xT and the timestamp tI. Therefore, it is impossible for the adversary to check whether the real identity is equal to the candidate identity or not.


## 4.1.2. Anonymity in Communication Phase

In the communication phase, an adversary can getT1’s shadow identity SIDT1 and its timestamp tT1 from the message m5 or m6 and hxR from a legitimate thing T′. By using them, the adversary can gain T1’s virtual identity VIDT1(=SIDT1⊕h(h(xR)∥tT1)) as he/she does in the join phase. Then the adversary tries to confirm whether VIDT1=h(IDT1′∥xT1∥tI1) is satisfied or not by guessing a candidate identity IDT1′. Unfortunately, the adversary cannot check the equivalence between the real identity and the candidate identity without knowing xT1 and tI1. For that reason, the adversary gets no information related to T1’s identity.


## 4.2. Untraceability

The proposed scheme provides untraceability for a thing. Because all transmitting messages always include the unique shadow and virtual identities in the join and the communication phases, an adversary cannot know the fact that all messages are originated from the same thing.


### 4.2.1. Untraceability in Join Phase

If a common secret key shared betweenT and G is renewed periodically or T tries to join many different Gs, an adversary can collect all shadow identities from T’s join request messages in every session by eavesdropping. Besides, the adversary who has a valid thing can obtain T’s virtual identity VIDT by computing VIDT=SIDT⊕h(h(xR)∥tT) because he/she can know SIDT, h(xR), and tT. Meanwhile, if the shadow identity or the virtual identity always has a same value in every session, the adversary can recognize that one thing sends the join request message repeatedly while he/she cannot know that thing’s real identity. In other words, the adversary can trace the fact that a certain thing requests to join continuously. However, the whole shadow identities are all different, since they include a unique timestamp. And the registration server always issues the new virtual identity to renew the old one in every session. Therefore, the join request message sent by the thing includes the different shadow identity all the time. It means the proposed scheme guarantees untraceability for the thing.


### 4.2.2. Untraceability in Communication Phase

The shadow identity in the communication phase also includes a unique timestamp. And everything always computes the new shadow identity and sends it to the gateway when they request to communicate. The gateway stores this new shadow identity to use it in the next session only if it checks that the old shadow identity is valid. Thus, shadow identities in every session have a uniqueness. Due to this, an adversary cannot trace the action of the thing in the communication phase.


## 4.2.1. Untraceability in Join Phase

If a common secret key shared betweenT and G is renewed periodically or T tries to join many different Gs, an adversary can collect all shadow identities from T’s join request messages in every session by eavesdropping. Besides, the adversary who has a valid thing can obtain T’s virtual identity VIDT by computing VIDT=SIDT⊕h(h(xR)∥tT) because he/she can know SIDT, h(xR), and tT. Meanwhile, if the shadow identity or the virtual identity always has a same value in every session, the adversary can recognize that one thing sends the join request message repeatedly while he/she cannot know that thing’s real identity. In other words, the adversary can trace the fact that a certain thing requests to join continuously. However, the whole shadow identities are all different, since they include a unique timestamp. And the registration server always issues the new virtual identity to renew the old one in every session. Therefore, the join request message sent by the thing includes the different shadow identity all the time. It means the proposed scheme guarantees untraceability for the thing.


## 4.2.2. Untraceability in Communication Phase

The shadow identity in the communication phase also includes a unique timestamp. And everything always computes the new shadow identity and sends it to the gateway when they request to communicate. The gateway stores this new shadow identity to use it in the next session only if it checks that the old shadow identity is valid. Thus, shadow identities in every session have a uniqueness. Due to this, an adversary cannot trace the action of the thing in the communication phase.


## 4.3. Replay Attacks

Although an adversary resends past transmitting messages after collecting them in a certain session, participants involved in the join and the communication phases can detect a retransmission and stop to communicate with each other.


### 4.3.1. Replay Attacks in Join Phase

In the join phase, an adversary can gather the messagesm1, m2, m3, and m4 between T, G, and R. When the adversary resends the old message m1={JoinReq.,SIDT,IDR,tT} to G, G checks a time interval between a current time and tT. And it rejects the join request if the time interval exceeds a predefined value. In addition, R can also recognize the old message m2={AuthReq.,SIDT,IDG,H1,tT,tG} sent by the adversary by checking the time period between a current time and tG. In this case, R absolutely breaks a connection.


### 4.3.2. Replay Attacks in Communication Phase

An adversary who collects the messagesm5, m6, m7, and m8 in the communication phase sends m5 to T2 and m6 to G. After receiving the message, T2 and G can know whether the message is resent or not by checking a timestamp and a current time. As a result, resending old messages is always detectable.


## 4.3.1. Replay Attacks in Join Phase

In the join phase, an adversary can gather the messagesm1, m2, m3, and m4 between T, G, and R. When the adversary resends the old message m1={JoinReq.,SIDT,IDR,tT} to G, G checks a time interval between a current time and tT. And it rejects the join request if the time interval exceeds a predefined value. In addition, R can also recognize the old message m2={AuthReq.,SIDT,IDG,H1,tT,tG} sent by the adversary by checking the time period between a current time and tG. In this case, R absolutely breaks a connection.


## 4.3.2. Replay Attacks in Communication Phase

An adversary who collects the messagesm5, m6, m7, and m8 in the communication phase sends m5 to T2 and m6 to G. After receiving the message, T2 and G can know whether the message is resent or not by checking a timestamp and a current time. As a result, resending old messages is always detectable.


## 4.4. Forgery Attacks

In our scheme, an adversary cannot forge messages to perform the valid join and communication phases.


### 4.4.1. Forgery Attacks in Join Phase

When the messagem1′={JoinReq.,SIDT′,IDR,tT} forged from m1 by an adversary is sent to G in the join phase, G makes m2′={AuthReq.,SIDT′,IDG,H1′,tT,tG} and sends it to R. Then R computes VIDT∗=SIDT′⊕h(h(xR)∥tT) using h(xR) that is the hashing value of its private key xR and tries to search T’s secret information using VIDT∗ as a keyword. Since there is no matched virtual identity in R’s database, R stops to communicate with G after recognizing that m2′ is originated from the forged message.


### 4.4.2. Forgery Attacks in Communication Phase

An adversary sends the messagem5′={CommReq.,SIDT1′,IDG,V6′,H3′,tT1} to T2 after forging T1’s message m5 in the communication phase. Upon receiving m5′, T2 sends m6′={AuthReq.,SIDT1′,SIDT2,V6′,V7,H3′,H4,tT1,tT2} to G. Then G can easily know that no shadow identity equals to SIDT1′ in its database. Finally, G rejects T2’s request.


## 4.4.1. Forgery Attacks in Join Phase

When the messagem1′={JoinReq.,SIDT′,IDR,tT} forged from m1 by an adversary is sent to G in the join phase, G makes m2′={AuthReq.,SIDT′,IDG,H1′,tT,tG} and sends it to R. Then R computes VIDT∗=SIDT′⊕h(h(xR)∥tT) using h(xR) that is the hashing value of its private key xR and tries to search T’s secret information using VIDT∗ as a keyword. Since there is no matched virtual identity in R’s database, R stops to communicate with G after recognizing that m2′ is originated from the forged message.


## 4.4.2. Forgery Attacks in Communication Phase

An adversary sends the messagem5′={CommReq.,SIDT1′,IDG,V6′,H3′,tT1} to T2 after forging T1’s message m5 in the communication phase. Upon receiving m5′, T2 sends m6′={AuthReq.,SIDT1′,SIDT2,V6′,V7,H3′,H4,tT1,tT2} to G. Then G can easily know that no shadow identity equals to SIDT1′ in its database. Finally, G rejects T2’s request.


## 4.5. Impersonation Attacks

The proposed scheme is secure against attacks that an adversary who obtains a shadow identity of the thing impersonates that thing.


### 4.5.1. Impersonation Attacks in Join Phase

An adversary who tries to impersonate the valid thingT easily obtains T’s shadow identity SIDT from the message m1 in the join phase. The adversary makes the message m1′={JoinReq.,SIDT,IDR,tT′} using the obtained SIDT and a timestamp tT′ generated by him/her in a new session. And he/she sends m1′ to G. After receiving m1′, G decides m1′ is a valid request message because tT′ and H1′ are verified successfully. And then G sends the message m2′={AuthReq.,SIDT,IDG,H1′,tT′,tG′} to R. Checking tG′, IDG, and H1′ by R is also successful. R computes VIDT∗ from the received SIDT by computing the equation VIDT∗=SIDT⊕h(h(xR)∥tT′)=VIDT⊕h(h(xR)∥tT)⊕h(h(xR)∥tT′). There is no equivalent virtual identity to VIDT∗ in its database. Surely, R recognizes it is an abnormal case and rejects G’s request.


### 4.5.2. Impersonation Attacks in Communication Phase

An adversary getsSIDT1 from m5 in the communication phase. To impersonate T1, the adversary generates a new timestamp tt1′, makes the message m5′={CommReq.,SIDT1,IDG,V6′,H3′,tT1′}, and sends m5′ to T2 in a new session. Here, the adversary cannot compute the valid V6′ and H3′ because he/she does not know T1’s common secret key KGT1. After receiving m5′, T2 makes the message m6′={AuthReq.,SIDT1,SIDT2,V6′,V7′,H3′,H4′,tT1′,tT2′} and sends it to G. G verifies that all tt2′, SIDT1, SIDT2, and H4′ are valid but it detects that H3′∗(=h(KGT1∥SIDT1∥V6′∥tT1′)) and the received H3′ are not equal. As a result, G recognizes T1 is an invalid thing and refuses T2’s request.


## 4.5.1. Impersonation Attacks in Join Phase

An adversary who tries to impersonate the valid thingT easily obtains T’s shadow identity SIDT from the message m1 in the join phase. The adversary makes the message m1′={JoinReq.,SIDT,IDR,tT′} using the obtained SIDT and a timestamp tT′ generated by him/her in a new session. And he/she sends m1′ to G. After receiving m1′, G decides m1′ is a valid request message because tT′ and H1′ are verified successfully. And then G sends the message m2′={AuthReq.,SIDT,IDG,H1′,tT′,tG′} to R. Checking tG′, IDG, and H1′ by R is also successful. R computes VIDT∗ from the received SIDT by computing the equation VIDT∗=SIDT⊕h(h(xR)∥tT′)=VIDT⊕h(h(xR)∥tT)⊕h(h(xR)∥tT′). There is no equivalent virtual identity to VIDT∗ in its database. Surely, R recognizes it is an abnormal case and rejects G’s request.


## 4.5.2. Impersonation Attacks in Communication Phase

An adversary getsSIDT1 from m5 in the communication phase. To impersonate T1, the adversary generates a new timestamp tt1′, makes the message m5′={CommReq.,SIDT1,IDG,V6′,H3′,tT1′}, and sends m5′ to T2 in a new session. Here, the adversary cannot compute the valid V6′ and H3′ because he/she does not know T1’s common secret key KGT1. After receiving m5′, T2 makes the message m6′={AuthReq.,SIDT1,SIDT2,V6′,V7′,H3′,H4′,tT1′,tT2′} and sends it to G. G verifies that all tt2′, SIDT1, SIDT2, and H4′ are valid but it detects that H3′∗(=h(KGT1∥SIDT1∥V6′∥tT1′)) and the received H3′ are not equal. As a result, G recognizes T1 is an invalid thing and refuses T2’s request.


## 4.6. Known Session Key Attacks

Disclosure of a common secret key in the join phase or a session key in the communication phase does not affect revelations about the thing’s identity, other common secret keys, and other session keys.


### 4.6.1. Known Session Key Attacks in Join Phase

A common secret key shared betweenT and G is computed using a timestamp in the join phase. Because a timestamp always has a different value, every common secret key is unique. Although an adversary knows KGT(=hhxT∥IDT∥IDG∥tT∥tG), he/she cannot obtain the thing’s identity and the common secret key in other sessions. The reasons are as follows. Firstly, the adversary still cannot get thing’s identity IDT from KGT without knowing T’s secret information hxT. Moreover, let us suppose the adversary tries to get other common secret keys KGT′ in the next session after computing h(KRG∥tG)=V4⊕KGT using V4 and KGT. In that next session, the adversary eavesdrops V4′(=KGT′⊕h(KRG∥tG′))and computes KGT′⊕h(KRG∥tG′)⊕h(KRG∥tG)=V4′⊕h(KRG∥tG) using V4′ and h(KRG∥tG). Due to the difference of tG and tG′, h(KRG∥tG′)⊕h(KRG∥tG) is not eliminated in the above equation and the adversary cannot get KGT′. As a result, it is impossible to calculate the new session key even though the former is revealed.


### 4.6.2. Known Session Key Attacks in Communication Phase

All session keys in the communication phase are independent since all of them include their own unique timestamps. If the session keySK shared between T1 and T2 is revealed to an adversary in a certain session, he/she can compute h(KGT1∥SIDT2∥tT1)=K1⊕SK using K1 and the revealed SK. In the next session, the adversary eavesdrops K1′(=SK′⊕h(KGT1∥SIDT2∥tT1′)) and tries to compute SK′⊕h(KGT1∥SIDT2∥tT1′)⊕h(KGT1∥SIDT2∥tT1)=K1′⊕h(KGT1∥SIDT2∥tT1) using K1′ and (KGT1∥SIDT2∥tT1). Since tT1 is not equal to tT1′, h(KGT1∥SIDT2∥tT1′) and h(KGT1∥SIDT2∥tT1) are not erased. Therefore, there is no way to obtain the new session key SK′ from the old session key SK.


## 4.6.1. Known Session Key Attacks in Join Phase

A common secret key shared betweenT and G is computed using a timestamp in the join phase. Because a timestamp always has a different value, every common secret key is unique. Although an adversary knows KGT(=hhxT∥IDT∥IDG∥tT∥tG), he/she cannot obtain the thing’s identity and the common secret key in other sessions. The reasons are as follows. Firstly, the adversary still cannot get thing’s identity IDT from KGT without knowing T’s secret information hxT. Moreover, let us suppose the adversary tries to get other common secret keys KGT′ in the next session after computing h(KRG∥tG)=V4⊕KGT using V4 and KGT. In that next session, the adversary eavesdrops V4′(=KGT′⊕h(KRG∥tG′))and computes KGT′⊕h(KRG∥tG′)⊕h(KRG∥tG)=V4′⊕h(KRG∥tG) using V4′ and h(KRG∥tG). Due to the difference of tG and tG′, h(KRG∥tG′)⊕h(KRG∥tG) is not eliminated in the above equation and the adversary cannot get KGT′. As a result, it is impossible to calculate the new session key even though the former is revealed.


## 4.6.2. Known Session Key Attacks in Communication Phase

All session keys in the communication phase are independent since all of them include their own unique timestamps. If the session keySK shared between T1 and T2 is revealed to an adversary in a certain session, he/she can compute h(KGT1∥SIDT2∥tT1)=K1⊕SK using K1 and the revealed SK. In the next session, the adversary eavesdrops K1′(=SK′⊕h(KGT1∥SIDT2∥tT1′)) and tries to compute SK′⊕h(KGT1∥SIDT2∥tT1′)⊕h(KGT1∥SIDT2∥tT1)=K1′⊕h(KGT1∥SIDT2∥tT1) using K1′ and (KGT1∥SIDT2∥tT1). Since tT1 is not equal to tT1′, h(KGT1∥SIDT2∥tT1′) and h(KGT1∥SIDT2∥tT1) are not erased. Therefore, there is no way to obtain the new session key SK′ from the old session key SK.


## 5. Performance Analysis

This section partially compares the performance of our scheme with those of Chang et al.’s and Lee’s [22] schemes. Since the environment, the component, and the composition of ours and others’ are all different, we firstly select similar factors in all schemes and evaluate them. Table 3 shows the performance comparison results. In Table 3, Hash denotes a hash operation, XOR denotes an exclusive-OR operation, and rounds denote communication rounds. We evaluate the number of hash and exclusive-OR operations. We compare the join phase of our scheme and the authentication and session key establishment phases of other schemes, because each phase has similar purpose and procedure. In addition, we only focus on the operations on the part of the limited computing power devices, such as a thing and a mobile user. Since the performance of the whole scheme depends on the capability of those devices, we do not compare the whole operations.Table 3
Performance comparisons.
Scheme
Ours
Chang et al.’s
Lee’s
Join phase
Hash
7
7
7
XOR
2
5
2
Rounds
4
8
7
Communication phase
Hash
5
N/A
N/A
XOR
3
N/A
N/A
Rounds
3
N/A
N/AAs Table3 shows, our scheme requires less or the same exclusive-OR operations in the join phase. Namely, the computation complexity of ours is a little better than others’. Our communication rounds in the join phase are reduced by half in comparison with Chang et al.’s and less than that in Lee’s. Considering the wireless environments, reducing the communication cost is meaningful. Meanwhile, there is no corresponding phases of Chang et al.’s and Lee’s schemes to the communication phase of our scheme. So we only show the number of operations and communication rounds of our scheme in Table 3. Definitely, hash operations and communication rounds in the communication phase are less than those in the join phase. The thing accomplishes the communication phase more often than the join phase, so the less number of operations and communication rounds in the communication phase is remarkable. As a result, our scheme provides advantages of the communication complexity as well as the computation complexity.


## 6. Conclusions

In this paper, we propose a novel anonymous authentication scheme that ensures the things in IoT environments can communicate with one another safely. The proposed scheme uses the virtual identity of the thing to make it be anonymized and authenticated at the same time. To provide untraceability, we keep the uniqueness of all shadow and virtual identities. Namely, duplicated shadow and virtual identities are never used in every session through the renewal process. Even if the valid virtual identity issued by the registration server is revealed, an adversary cannot obtain the real identity from that virtual identity. It is impossible for an adversary to perform replay, forgery, and impersonation attacks. Moreover, he/she cannot know the valid common secret key shared between the registration server, the gateway, and the thing, even though a specific common secret key is exposed. The valid session key shared between two things is also safe when a particular session key is disclosed to an adversary. We only use low cost functions, such as hash functions and exclusive-OR operations in consideration of fast computation and low energy consumption of the thing. In conclusion, our scheme is suitable for IoT environments as a secure and efficient authentication mechanism.



---

*Source: 305785-2015-11-01.xml*