# A Lightweight Three-Factor Authentication and Key Agreement Scheme for Multigateway WSNs in IoT

Authors: Lingyan Xue; Qinglong Huang; Shuaiqing Zhang; Haiping Huang; Wenming Wang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The Internet of Things (IoT) has built an information bridge between people and the objective world, wherein wireless sensor networks (WSNs) are an important driving force. For applications based on WSN, such as environment monitoring, smart healthcare, user legitimacy authentication, and data security, are always worth exploring. In recent years, many multifactor user authentication schemes for WSNs have been proposed using smart cards, passwords, as well as biometric features. Unfortunately, these schemes are revealed to various vulnerabilities (e.g., password guessing attack, impersonation attack, and replay attack) due to nonuniform security evaluation criteria. Wang et al. put forward 12 pieces of widely accepted evaluation criteria by investigating quantities of relevant literature. In this paper, we first propose a lightweight multifactor authentication protocol for multigateway WSNs using hash functions and XOR operations. Further, BAN logic and BPR model are employed to formally prove the correctness and security of the proposed scheme, and the informal analysis with Wang et al.’s criteria also indicates that it can resist well-known attacks. Finally, performance analysis of the compared schemes is given, and the evaluation results show that only the proposed scheme can satisfy all 12 evaluation criteria and keep efficient among these schemes.


---

## Body

## 1. Introduction

As the third revolution of the information technology industry, Internet of Things (IoT) has been developing for over 20 years. During this period, more and more physical objects embedded with sensors and terminal devices are constantly connected to IoT to exchange information. For an instance, in wireless sensor networks (WSNs), tens of thousands of different sensors are deployed everywhere (e.g., architectures, bridges, and intelligent terminals). These devices collect the real-time data from surrounding environment or target objects and, at fixed periods, forward the collected data directly to nearby gateway nodes for further analysis. Then, application systems access the data through the network, to further provide various personalized services. In heterogeneous WSNs, any insecure terminal nodes possibly threaten the whole network’s security as the flexible access mode; potential vulnerabilities continually come forth due to the complexity of heterogeneous networks [1]. Thus, it is necessary to design an authentication protocol to ensure that only legitimate users have access to the network [2]. Generally, as far as sensor nodes are resource-constrained in some aspects such as low energy, insufficient computing capabilities, and lack of memory space, many expensive cryptographic primitives are not suitable. As a whole, the designed proposal for WSNs should be balanced well in both security and efficiency.When it was 1981, Lamport [3] proposed the password-based authentication scheme, and in 1991, Chang and Wu [4] pioneered the smart card-based authentication scheme. Henceforth, achievements on single-factor identity authentication protocols for WSNs emerge in an endless stream. Until 2009, combining the smart card with password, Das [5] put forward a pioneering work on multifactor authentication protocols for WSNs. However, it was revealed to many weaknesses, i.e., destitution of mutual authentication, and vulnerabilities to password guessing attack, sensor node capture attack, and denial-of-service attack (DoS) [6–8]. Later, many multifactor authentication schemes that asserted high security and efficiency were proposed yet they were prone to various attacks [9, 10]. Xue et al. [11] presented a temporal-credential-based mutual authentication and key agreement scheme for WSNs. Soon afterwards, loopholes were pointed out in their scheme, i.e., vulnerabilities to offline password guessing attack, user tracing, impersonation attack, and stolen-verifier attack, as well as the lack of user anonymity [12–14]. In recent years, biological information of human bodies, such as fingerprint and iris, has been excavated for authentication. With its unforgeability, uniqueness, and stability, biometric authentication technology is inherently convenient, reliable, and promising [15]. Yuan [16] took human’s fingerprint as a third factor to achieve user authentication for WSNs, which was lightweight. Nevertheless, their scheme was pointed out that it did not withstand offline password guessing attack, privileged insider attack, and gateway impersonation attack. Then, Li et al. [17] introduced a three-factor authentication scheme for WSNs using biometric features. Subsequently, their scheme was illustrated that it could not resist to stolen smart card attack and support forward secrecy [18]. Additionally, in the practical applications of WSNs, multiple gateways are usually deployed to jointly manage multiple areas. As such, the user can access any sensor node for the real-time data in any area. Research on multigateway-based authentication protocols is also a deserving discussion. Amin et al. [19] proposed a two-factor multiple gateways’ authentication protocol using hash functions. Later, Wu et al. [20] believed that their scheme did not realize mutual authentication and resist impersonation attack; then, they put forward a new scheme. And, Srinivas et al. [21] also found many flaws in [19], i.e., stolen smart card attack and sensor node spoofing attack, and then, they presented a three-factor authentication scheme using hash functions. However, their scheme was also revealed to vulnerability to sensor node capture attack and nonsupport for user anonymity. In 2019, Guo et al. [22] found that the scheme designed by Wu et al. [20] could not resist to stolen smart card attack and session key reveal attack. In order to address these drawbacks, Guo et al. [22] presented a new scheme based on biometric features. Recently, Vinoth et al. [23] proposed a secure multifactor authentication key agreement scheme for industrial IoT, which was insecure as they claimed. It actually could not deal with such attacks such as sensor node capture attack, DoS attack, and replay attack.As all mentioned above, these schemes are exposed to various vulnerabilities constantly, which in fact are trapped into a “break-propose-break” cycle. Security properties of one scheme is determined by an evaluation standard system, thereby researchers always find new flaws under different systems. In 2018, on the basis of the previous research studies, Wang and Wang [24] summarized and put forward security criteria for two-factor authentication protocols, which are recognized by the industry at present. In these criteria, 12 pieces of independent and fundamental rules are contained that multifactor authentication protocols shall satisfy. Specific content of the criteria can be referred to [24]; we call it “12-Criteria” here for the sake of convenience.In terms of 12-Criteria, most existing multifactor authentication protocols cannot satisfy all. This paper will put forward a new lightweight three-factor authentication and key agreement scheme for multigateway WSNs, and main contributions are summed up as below:(1)
We first reanalyse Guo et al.’s protocol [22]. And, in accordance with 12-Criteria, we further point out some vulnerabilities and drawbacks that still exist in their scheme, including no repairability, improper treatment of biological factors, offline password guessing attack, and lack of forward secrecy.(2)
In the light of the 12-Criteria, we put forward a new lightweight three-factor authentication and key agreement scheme for the multigateway environment. In our scheme, biometric features, as an important factor, are extracted and validated by fuzzy extractor [25]. And, honey_list [24] is introduced to assist the effective smart card logout.(3)
Formal and informal security analyses are given amply to prove the correctness and security of the proposed scheme, and comparisons with similar research studies show that this new scheme achieves a superior balance between security and efficiency.The reminder of this paper is organized as follows. The relevant background is introduced in Section2. In Section 3, discussions of some security flaws in Guo et al.’s work [22] are given. The proposed protocol and the corresponding security analysis are presented in Sections 4 and 5, respectively. The performance of the proposed protocol is evaluated in Section 6, and finally, the whole paper is concluded in Section 7.


## 2. Preliminaries

This section briefly introduces some necessary notations, system model, and adversary model, as well as preknowledge about formal proofs.


### 2.1. Notations

The related notations used in this paper are described in Table1.Table 1
Notations.
NotationDescriptionUi,IDi,PWi,andBIOiThe identityIDi, password PWi, and biological factor BIOiof the user UiSjandSIDjThe identitySIDjof the sensor node SjHGWN,IDhg,andxhgThe identityIDhg and the private key xhgof home gateway node HGWNFGWN,IDfg,andxfgThe identityIDfg and the private key xfgof home gateway node FGWNSAThe system administratorSCThe smart cardΔTThe maximum permitted transmission delaySKu,SKs,SKfg, andSKhgThe negotiated session keyh⋅andH⋅The hash functionGen⋅and Rep⋅The biometric feature extraction function and verification function⊕The XOR operator∥The concatenation operatorA⟶BA sends messages to B over a public channelA⟹BA sends messages to B over a private channel


### 2.2. System Model

A multigateway system model is illustrated in Figure1, wherein three roles, i.e., users, gateway nodes (GWNs), and sensor nodes, are included. Considering the distance measure, the relatively close node is referred to the home gateway node (HGWN), while the opposite is the foreign gateway node (FGWN). The communication processes are summarized as follows.Figure 1
System model.While a legitimate user attempts to communicate with the sensor node, first he needs to login successfully and send a message to inform HGWN. After the reception of the message, HGWN first checks its database with the key information of the target sensor node as an index. Here, two cases would be taken into an account. Case 1 is presented in steps ➀–④, wherein if the target sensor node exists in the database, HGWN authenticates the user and sends a message to the sensor node. Then, the sensor node authenticates HGWN and returns a message. After the complete verification of the returned message, HGWN returns a message to the user. Similarly, once the message is verified correctly by the user, the three parties can derive a common session key for further communication. While Case 2 is shown in steps 1–8, that is, the target sensor node does not exist in the database, HGWN broadcasts the request message to other nodes. When FGWN receives that and finds that the wanted sensor node exists in its database, it sends a message to HGWN. Then, HGWN returns a message to the user. After a complete authentication process, the user, FGWN, and the sensor node can negotiate the very session key.


### 2.3. Notations and Formulas of Ban Logic

The Burrows-Abadi-Needham logic [26], BAN logic for short, plays a positive and effective role when proving that one scheme can support authentication and key agreement among communicating participants. Formally, it needs three steps including idealization of interaction messages in the protocol, initial assumptions according to specific situations, and achievements of expected goals by inference rules. We first present the basic notations of BAN logic in Table 2.Table 2
Notations of BAN logic.
NotationsDescriptionsP|≡XP believes X is trueP⊲XP sees X and is capable of reading and repeating itP|∼XP once said X; at some time, P has sent the message containing XP|⟹XP has control or jurisdiction over X#XX is fresh which means it was never sent before the current execution of the protocolP⟷KQBothP and Q can use the shared key K to communicate with each other, and K is an intact keyP⟺XQX is a secret only known to P and Q and possibly to principals trusted by themXYX combined with YThe basic formulas of BAN logic are described as follows.(i)
(R1) Message-meaning rule: ifP concludes that the secret K or Y is shared with Q and sees XYor XK, then P believes Q once said X:(1)P|≡P⟺YQ,P⊲XYP|≡Q|∼X.(ii)
(R2) Freshness rule: ifP believes X is fresh, then P believes (X, Y) is also fresh:(2)P|≡#XP|≡#X,Y.(iii)
(R3) Belief rule: ifP believes X and Y, then P believes the combination of X and Y:(3)P|≡X,P|≡YP|≡X,Y.(iv)
(R4) Nonce-verification rule: ifP believes that X is fresh and Q once said X, then P believes that Q believes X:(4)P|≡#X,P|≡Q|∼XP|≡Q|≡X.(v)
(R5) Jurisdiction rule: ifP believes Q has jurisdiction over X and Q believes X, then P believes X:(5)P|≡Q|⟹X,P|≡Q|≡XP|≡X.(vi)
(R6) Seeing rule: ifP once received a formula and knew the associated key, then P once saw the components of the formula:(6)P⊲X,YP⊲X,P⊲XYP⊲X.(vii)
(R7) Session key rule: ifP believes X is fresh and Q believes X, then P believes he shares the key K with Q:(7)P|≡#X,P|≡Q|≡XP|≡P↔KQ.


### 2.4. Adversary Model

Combing with the 12-Criteria, we list pieces of widely accepted valid assumptions to show the capabilities of an adversaryA, accordingly to analyse the security of the authentication and key agreement protocols.(i)
When entities in WSN communicate with each other over an insecure wireless channel,A can eavesdrop and intercept all messages transmitted over a public channel and is capable of tempering with and deleting the intercepted messages. In addition, A can participate in running the protocol as a legitimate entity.(ii)
In reality, users’ devices and sensors are usually equipped with the hardware to prevent reading and tempering with data illegally [27], but to adhere to the extreme-adversary principle [28], it is reasonable to assume that when the user’s device or the sensor is captured by A, A has the ability to obtain the data stored in the memory of the captured sensors through side channel attack [24].(iii)
A is capable of enumerating the Cartesian products of the user’s identity and password. Besides, in the n-factor authentication protocol, A can obtain n−1factors at most.(iv)
Only when evaluating the forward secrecy of the protocol,A can obtain the long-term private key of a gateway node or a sensor node.


### 2.5. Security Model

To formalize our proposed proposal later, the BPR model [29] can be introduced in this section, i.e., depictions of the random oracle model and definition of authentication and key-exchange (AKE) security.Participants. The authentication protocol P involves three communication participants, i.e., the user, HGWN/FGWN, and sensor node. Each participant has many diverse instances which are called oracles. For a specific session, the three entities are instanced into ΠUi, ΠHGWNk/ΠFGWNk, and ΠSj, respectively. Here, let ΠI∗ denote any instance.Queries. A can only interact with honest participants through oracle queries and attempt to collect the returned messages to break the protocol. Thus, the following queries simulate A’s abilities in practice.(i)
ExecuteΠUi,ΠHGWNk,ΠSj: it simulates the passive attack, through which A can obtain all messages among the three communicators during a normal interaction.(ii)
SendΠI∗,m: it represents the active attack, which allows A intercepts, forges the message, further sends it to ΠI∗, and obtains the corresponding response.(iii)
RevealΠI∗: it models abuse of the session key. Once ΠI∗accepts the current session and generates a session key SK, it will return SK to A; otherwise, return ⊥.(iv)
CorruptΠUi,a: it simulates that A can corrupt any two of the three factors of a legal user Ui, but not at the same time. (1) If a=1, A can obtain PWiand all parameters stored in SC; (2) if a=2, A can receive BIOiand all parameters stored in SC; (3) if a=3, A can get PWiand BIOi.(v)
TestΠI∗: it represents the semantic security of the session key. Flip a coin b at random; if b=1, it returns A the session key of ΠI∗; if b=0, returns a random number equal in length to the session key to A. If the session key of ΠI∗ does not exist, it returns ⊥. It is noted that it can only be invoked once at any time for fresh sessions.Partners. Let sid denote the session identifier; pid is the session identifier of partners. ΠUi and ΠSj are partners if and only if (1) they are both authenticated successfully; (2) they both have the same sid; (3) pid of ΠUi is ΠSj, while pid of ΠSj is ΠUi.Freshness. A fresh ΠI∗ satisfies that (1) ΠI∗ is accepted and owns its session key; (2) A does not query Reveal∗ to ΠI∗ or its partner; (3) since P runs, A queries Corrupt∗to ΠI∗ or its partner once at most.Definition 1.
(AKE security) GivenSuccA denotes an event, that is, A makes Test∗ queries to several new accepted instances and can guess the right b′ satisfying b=b′. Then, the advantage of A breaking the AKE security of P can be defined as AdvPAKEA=2PrSuccA−1=2Prb′=b−1. For any adversary capable of breaking P in probability polynomial time (PPT), AdvPAKEAis negligible; then, we say P achieves AKE security.


## 2.1. Notations

The related notations used in this paper are described in Table1.Table 1
Notations.
NotationDescriptionUi,IDi,PWi,andBIOiThe identityIDi, password PWi, and biological factor BIOiof the user UiSjandSIDjThe identitySIDjof the sensor node SjHGWN,IDhg,andxhgThe identityIDhg and the private key xhgof home gateway node HGWNFGWN,IDfg,andxfgThe identityIDfg and the private key xfgof home gateway node FGWNSAThe system administratorSCThe smart cardΔTThe maximum permitted transmission delaySKu,SKs,SKfg, andSKhgThe negotiated session keyh⋅andH⋅The hash functionGen⋅and Rep⋅The biometric feature extraction function and verification function⊕The XOR operator∥The concatenation operatorA⟶BA sends messages to B over a public channelA⟹BA sends messages to B over a private channel


## 2.2. System Model

A multigateway system model is illustrated in Figure1, wherein three roles, i.e., users, gateway nodes (GWNs), and sensor nodes, are included. Considering the distance measure, the relatively close node is referred to the home gateway node (HGWN), while the opposite is the foreign gateway node (FGWN). The communication processes are summarized as follows.Figure 1
System model.While a legitimate user attempts to communicate with the sensor node, first he needs to login successfully and send a message to inform HGWN. After the reception of the message, HGWN first checks its database with the key information of the target sensor node as an index. Here, two cases would be taken into an account. Case 1 is presented in steps ➀–④, wherein if the target sensor node exists in the database, HGWN authenticates the user and sends a message to the sensor node. Then, the sensor node authenticates HGWN and returns a message. After the complete verification of the returned message, HGWN returns a message to the user. Similarly, once the message is verified correctly by the user, the three parties can derive a common session key for further communication. While Case 2 is shown in steps 1–8, that is, the target sensor node does not exist in the database, HGWN broadcasts the request message to other nodes. When FGWN receives that and finds that the wanted sensor node exists in its database, it sends a message to HGWN. Then, HGWN returns a message to the user. After a complete authentication process, the user, FGWN, and the sensor node can negotiate the very session key.


## 2.3. Notations and Formulas of Ban Logic

The Burrows-Abadi-Needham logic [26], BAN logic for short, plays a positive and effective role when proving that one scheme can support authentication and key agreement among communicating participants. Formally, it needs three steps including idealization of interaction messages in the protocol, initial assumptions according to specific situations, and achievements of expected goals by inference rules. We first present the basic notations of BAN logic in Table 2.Table 2
Notations of BAN logic.
NotationsDescriptionsP|≡XP believes X is trueP⊲XP sees X and is capable of reading and repeating itP|∼XP once said X; at some time, P has sent the message containing XP|⟹XP has control or jurisdiction over X#XX is fresh which means it was never sent before the current execution of the protocolP⟷KQBothP and Q can use the shared key K to communicate with each other, and K is an intact keyP⟺XQX is a secret only known to P and Q and possibly to principals trusted by themXYX combined with YThe basic formulas of BAN logic are described as follows.(i)
(R1) Message-meaning rule: ifP concludes that the secret K or Y is shared with Q and sees XYor XK, then P believes Q once said X:(1)P|≡P⟺YQ,P⊲XYP|≡Q|∼X.(ii)
(R2) Freshness rule: ifP believes X is fresh, then P believes (X, Y) is also fresh:(2)P|≡#XP|≡#X,Y.(iii)
(R3) Belief rule: ifP believes X and Y, then P believes the combination of X and Y:(3)P|≡X,P|≡YP|≡X,Y.(iv)
(R4) Nonce-verification rule: ifP believes that X is fresh and Q once said X, then P believes that Q believes X:(4)P|≡#X,P|≡Q|∼XP|≡Q|≡X.(v)
(R5) Jurisdiction rule: ifP believes Q has jurisdiction over X and Q believes X, then P believes X:(5)P|≡Q|⟹X,P|≡Q|≡XP|≡X.(vi)
(R6) Seeing rule: ifP once received a formula and knew the associated key, then P once saw the components of the formula:(6)P⊲X,YP⊲X,P⊲XYP⊲X.(vii)
(R7) Session key rule: ifP believes X is fresh and Q believes X, then P believes he shares the key K with Q:(7)P|≡#X,P|≡Q|≡XP|≡P↔KQ.


## 2.4. Adversary Model

Combing with the 12-Criteria, we list pieces of widely accepted valid assumptions to show the capabilities of an adversaryA, accordingly to analyse the security of the authentication and key agreement protocols.(i)
When entities in WSN communicate with each other over an insecure wireless channel,A can eavesdrop and intercept all messages transmitted over a public channel and is capable of tempering with and deleting the intercepted messages. In addition, A can participate in running the protocol as a legitimate entity.(ii)
In reality, users’ devices and sensors are usually equipped with the hardware to prevent reading and tempering with data illegally [27], but to adhere to the extreme-adversary principle [28], it is reasonable to assume that when the user’s device or the sensor is captured by A, A has the ability to obtain the data stored in the memory of the captured sensors through side channel attack [24].(iii)
A is capable of enumerating the Cartesian products of the user’s identity and password. Besides, in the n-factor authentication protocol, A can obtain n−1factors at most.(iv)
Only when evaluating the forward secrecy of the protocol,A can obtain the long-term private key of a gateway node or a sensor node.


## 2.5. Security Model

To formalize our proposed proposal later, the BPR model [29] can be introduced in this section, i.e., depictions of the random oracle model and definition of authentication and key-exchange (AKE) security.Participants. The authentication protocol P involves three communication participants, i.e., the user, HGWN/FGWN, and sensor node. Each participant has many diverse instances which are called oracles. For a specific session, the three entities are instanced into ΠUi, ΠHGWNk/ΠFGWNk, and ΠSj, respectively. Here, let ΠI∗ denote any instance.Queries. A can only interact with honest participants through oracle queries and attempt to collect the returned messages to break the protocol. Thus, the following queries simulate A’s abilities in practice.(i)
ExecuteΠUi,ΠHGWNk,ΠSj: it simulates the passive attack, through which A can obtain all messages among the three communicators during a normal interaction.(ii)
SendΠI∗,m: it represents the active attack, which allows A intercepts, forges the message, further sends it to ΠI∗, and obtains the corresponding response.(iii)
RevealΠI∗: it models abuse of the session key. Once ΠI∗accepts the current session and generates a session key SK, it will return SK to A; otherwise, return ⊥.(iv)
CorruptΠUi,a: it simulates that A can corrupt any two of the three factors of a legal user Ui, but not at the same time. (1) If a=1, A can obtain PWiand all parameters stored in SC; (2) if a=2, A can receive BIOiand all parameters stored in SC; (3) if a=3, A can get PWiand BIOi.(v)
TestΠI∗: it represents the semantic security of the session key. Flip a coin b at random; if b=1, it returns A the session key of ΠI∗; if b=0, returns a random number equal in length to the session key to A. If the session key of ΠI∗ does not exist, it returns ⊥. It is noted that it can only be invoked once at any time for fresh sessions.Partners. Let sid denote the session identifier; pid is the session identifier of partners. ΠUi and ΠSj are partners if and only if (1) they are both authenticated successfully; (2) they both have the same sid; (3) pid of ΠUi is ΠSj, while pid of ΠSj is ΠUi.Freshness. A fresh ΠI∗ satisfies that (1) ΠI∗ is accepted and owns its session key; (2) A does not query Reveal∗ to ΠI∗ or its partner; (3) since P runs, A queries Corrupt∗to ΠI∗ or its partner once at most.Definition 1.
(AKE security) GivenSuccA denotes an event, that is, A makes Test∗ queries to several new accepted instances and can guess the right b′ satisfying b=b′. Then, the advantage of A breaking the AKE security of P can be defined as AdvPAKEA=2PrSuccA−1=2Prb′=b−1. For any adversary capable of breaking P in probability polynomial time (PPT), AdvPAKEAis negligible; then, we say P achieves AKE security.


## 3. Cryptanalysis of Guo et al.’s Scheme

The scheme designed by Guo et al. [22] is composed of five parts, including system setup, registration, login, authentication, and password change. Here, we have to leave out the review of their scheme due to space constraints, and readers can refer to [22]. Thus, on the basis of the aforementioned assumptions, security flaws in their scheme are analysed in this section later.No Sound Repairability. As a usual case, those discarded smart cards are not in the safe keeping of users. If unfortunate, his smart card is captured by an attacker A. A possibly launches the offline password guessing attack. Therefore, it is essential to provide a method to cancel the smart card of the user in multifactor authentication protocols.Improper Treatment of Biometric Factors. As described in this protocol, after the user enters his biometric factor BIOi, SC calculates Oi=HBIOi which is a key parameter to verify the true identity of the user. In practice, however, a certain error bit always occurs in the extraction of biometric features (e.g., fingerprint and iris) by reading devices, that is, biometric features extracted each time are not always identical. Therefore, Oi calculated by SC may not equal to that obtained during the user’s registration phase, which may result in the failed authentication even if the user has input the right password.Offline Password Guessing Attack. In the login phase, A is assumed to have the ability to obtain two of the three authentication factors. Given that A has accessed the user’s identity IDi and biometric factor BIOi, then he can launch offline password guessing attack as the following process.A guesses a possible password PWi∗, calculates Oi=HBIOi, ri∗=B1⊕hOi‖IDi‖PWi∗, and MPi∗=hri∗‖PWi∗, and checks whether the equation B2=hMPi∗‖IDi‖Oi‖ri∗ holds. A can repeat these operations until the calculated B2 equals to hMPi∗‖IDi‖Oi‖ri∗. Finally, A can succeed in obtaining the user’s correct PWi.Lack of Forward Secrecy. Given that the long-term secret key of the GWN is revealed, A can grab the private key of the sensor and further restore previous session keys.(i)
Case 1:(1)
A obtains xhg of HGWN and eavesdrops the message M1 to gain the identity SIDj of the user-pointed communication object Sj. Then, A computes fj=hSIDj∥xhg.(2)
A eavesdrops messages M2 and M3 and then calculates Yj=hfj∥T2, rhg=D3⊕Yj, ru=D4⊕hrhgfjT2, and rs=D6⊕hrhgfjT3. In this way, the session key can be derived by A as SK=hrsrhgru.(ii)
Case 2:(1)
A obtains xfg of FGWN and computes fj=hSIDj∥xfg after eavesdropping the message M1.(2)
A eavesdrops messages M6 and M7 and then calculates Yj=hfj∥T2, rfg=D10⊕Yj, ruu=D11⊕hrfgfjT2, and rs=D13⊕hrfgfjT3. Thus, A can figure out SK=hrsrfgru with ease.


## 4. The Proposed Scheme

In this section, we present a lightweight three-factor authentication and key agreement scheme for multigateway WSNs in IoT, which involves users, sensor nodes, HGWNs, and FGWNs. Our scheme includes 6 phases: system initialization, registration, login, authentication and key agreement, password update, and smart card logout.


### 4.1. System Initialization

SA assigns the identityIDhg and private key xhg to HGWN, similarly, IDfg and xfgto FGWN, and SIDj to the sensor Sj. Then, SA sets up a shared key Khf for the communication between HGWN and FGWN. Beyond that, HGWN and FGWN need to select three random numbers Rh, Rf, and Rfh, respectively.


### 4.2. Registration

As shown in Figure2, this phase involves two parts, sensor registration and user registration. Both sensor nodes and users need to register their essential information with the closest gateway, namely, HGWN.Figure 2
Registration phase.


#### 4.2.1. Sensor Registration

Step 1:Sj⟹HGWN:SIDj. Sjsends its identity SIDjto HGWN over a private channel, and HGWN stores SIDjto its database for checking whether or not Sjis registered.Step 2:HGWN⇒Sj:xj=hSIDj‖xhg⊕Rh. HGWN calculates xj=hSIDj‖xhg⊕Rh and sends xjto Sjvia a private channel. After the reception of xj, Sj saves it secretly.


#### 4.2.2. User Registration

Step 1:Ui⟹HGWN:IDi,HPWi,βi.Uiinputs his username IDi, the password PWi, and his biometric information BIOi. Next, he chooses a number ri∈Zp∗at random and then computes αi,βi=GenBIOi and HPWi=hPWi‖αi‖ri.Step 2:HGWN⟹Ui:SCTIDi,βi,ei,IDhg.HGWN selects a pseudoidentityTIDifor Ui and calculates xi=hTIDi‖xhg⊕Rh, Ki=hIDi‖βi, and ei=HPWi⊕Ki⊕xi. Then, HGWN stores IDi,Ki,honey_list=0 into its database and TIDi,βi,ei,IDhg to SC, where honey_listrecords the number of the user logon failures.Step 3:Ui computes B1=hαi‖IDi‖PWi⊕ri and B2=hHPWi‖αi‖IDi‖rimodn0, where n0∈24,28. Next, Ui stores B1,B2 into his SC.


### 4.3. Login

Step 1:Ui first inputs IDi, PWi, and BIOi; then, SC computes αi=RepBIOi,βi, ri=B1⊕hαi‖IDi‖PWi, and HPWi=hPWi‖αi‖ri and checks whether B2=hHPWi‖αi‖IDi‖rimodn0 holds. If so, turn to the next step; otherwise, return a logon failure message and terminate this session.Step 2:Ui⟶HGWN:M1=TIDi,IDhg,SIDj,D0,D1,D2,D3,T1. SC chooses a timestamp T1 and a random number ru∈Zp∗ and then calculates Ki=hIDi‖βi, xi=ei⊕Ki⊕HPWi, D0=βi⊕hxi‖ru, D1=ru⊕xi, D2=IDi⊕hru‖xi, and D3=hTIDi‖IDi‖SIDj‖ru‖xi‖Ki‖T1.


### 4.4. Authentication and Key Agreement

After the reception ofUi’s request to communicate with SIDj, HGWN first confirms whether the specified sensor Sjis located within its communication range. Specifically, if HGWN can query its local database for SIDj, then the authentication can be conducted as described in Case 1 (see Figure 3); otherwise, run as shown in Case 2 (see Figure 4).(i)
Case 1:Step 1: after receivingM1, HGWN records the current timestamp T2. If T2−T1≤ΔT is true, then M1is valid; otherwise, this session would be closed up. Next, HGWN computes xi=hTIDi‖xhg⊕Rh, ru=D1⊕xi, βi=D0⊕hxi‖ru, IDi=D2⊕hru‖xi, and Ki=hIDi‖βi and verifies whether the equation D3=hTIDi‖IDi‖SIDj‖ru‖xi‖Ki‖T1 is true; if so, it turns into the next step; otherwise, it sets honey_list=honey_list+1 and returns a logon failure message to Ui. Note that once honey_list≥10, Ui’s account would be frozen, and the session is also terminated.Step 2:HGWN⟶Sj:M2=D4,D5,D6,T2. HGWN selects rhg∈Zp∗ randomly and then computes xj=hSIDj‖xhg⊕Rh, D4=rhg⊕hxj‖T2, D5=ru⊕hrhg‖xj‖T2, and D6=hSIDj‖IDhg‖ru‖rhg‖xj‖T2.Step 3: After the reception ofM2, Sj records the timestamp T3 and checks the freshness of T2. Next, Sjcalculates rhg=D4⊕hxj‖T2 and ru=D5⊕hrhg‖xj‖T2 and checks whether the equation D6=hSIDj‖IDhg‖ru‖rhg‖xj‖T2; if so, it turns to the next step; otherwise, it terminates the current session.Step 4:Sj⟶HGWN:M3=D7,D8,T3. Sjchooses a random number rs∈Zp∗ and computes SKs=hru‖rhg‖rs‖IDhg, D7=rs⊕hxj‖rhg‖T4, and D8=hIDhg‖SIDj‖xj‖SKs‖rs‖T3.Step 5: when receivingM3from Sj, HGWN records the present timestamp T4 and verifies the freshness of T3. Next, HGWN calculates rs=D7⊕hxj‖rhg‖T4 and SKhg=hru‖rhg‖rs‖IDhg and checks whether D8=hIDhg‖SIDj‖xj‖SKs‖rs‖T3 holds; if so, it turns to the next step; otherwise, it aborts this session.Step 6:HGWN⟶Ui:M4=D9,D10,D11,D12,D13,T4. HGWN chooses a new pseudonym TIDi′ for Uiand continues to compute D9=rs⊕hxi‖ru, D10=rhg⊕hru‖xi, xi′=hTIDi′‖xhg⊕Rh, D11=TIDi′⊕hxi‖IDi‖ru, D12=xi′⊕hTIDi′xi, and D13=hSKhg‖xi′‖TIDi′‖Ki‖T4.Step 7: after the reception ofM4, Ui takes down the current timestamp T5 and checks the validity of T4. Next, Uicomputes rs=D9⊕hxi‖ru, rhg=D10⊕hru‖xi, SKu=hru‖rhg‖rs‖IDhg, TIDi′=D11⊕hxi‖IDi‖ru, and xi′=D12⊕hTIDi′‖xiand verifies whether the equation D13=hSKhg‖xi′‖TIDi′‖Ki‖T4matches; if so, then it turns to the next step; otherwise, it discontinues the session.Step 8:SC calculates ei′=HPWi⊕Ki⊕xi′ and substitutes TIDi′,ei′for TIDi,ei.(ii)
Case 2:Step 1: similarly, after the reception ofM1, HGWN takes down the current timestamp T2. If T2−T1≤ΔT, then M1is valid; otherwise, the session is discontinued. Next, HGWN computes xi=hTIDi‖xhg⊕Rh, ru=D1⊕xi, βi=D0⊕hxi‖ru, IDi=D2⊕hru‖xi, and Ki=hIDi‖βi and verifies D3=hTIDi‖IDi‖SIDj‖ru‖xi‖Ki‖T1. If the equation holds, HGWN runs the next step; otherwise, it sets honey_list=honey_list+1, returns a logon failure message to Ui, and aborts the session.Step 2: HGWN broadcastsM2=SIDj,TIDi,IDhg,T2 to other gateway nodes.Step 3:FGWN⟶HGWN:M3=D4,IDfh,T3. FGWN finds SIDjin its database, then records the present timestamp T3, and computes xg=hTIDi‖xfg⊕Rfand D4=xg⊕hxfh‖Rfh.Step 4:HGWN⟶Ui:M4=IDfg,D5,D6,D7,D8,T4. When receiving M3 from FGWN, HGWN takes down the timestamp T4 and verifies the freshness of T3. HGWN selects a new pseudonym TIDi′and calculates xg=D4⊕hKfh‖Rfh, xi′=hTIDi′‖xhg‖rh, D5=TIDi′⊕hxi‖IDi‖ru, D6=xi′⊕hTIDi′‖xi, D7=xg⊕hxi‖ru, and D8=hSIDj‖IDhg‖IDfg‖TIDi′‖xg‖xi‖T4.Step 5: after receivingM4, Ui records the time stamp T5 and checks the validity of T4. Then, Uicomputes xg=D7⊕hxi‖ru, TIDi′=D5⊕hxi‖IDi‖ru, and xi′=D6⊕hTIDi′‖xi and checks D8=hSIDj‖IDhg‖IDfg‖TIDi′‖xg‖xi‖T4. If the equation holds, Uicontinues the next step; otherwise, it terminates the session.Step 6:Ui⟶FGWN:M5=TIDi,D9,D10,T5. Uiselects a random number ru′∈Zp∗and computes D10=hTIDi‖SIDj‖IDfg‖ru′‖xg‖T5.Step 7: after the reception ofM5, FGWN records T6 and verifies the freshness of T5. Next, FGWN computes ru′=D9⊕xgand further checks whether D10=hTIDi‖SIDj‖IDfg‖ru′‖xg‖T5matches. If so, FGWN continues the next step; otherwise, it discontinues the session.Step 8:FGWN⟶Sj:M6=D11,D12,D13,T6. FGWN selects rfgat random and computes xj=hSIDj‖xfg⊕Rh, D11=rfg⊕hxj‖T6, D12=ru′⊕hrfg‖xj‖T6, and D13=hSIDj‖IDfg‖ru′‖rfg‖xj‖T6.Step 9: after the reception ofM6, Sj takes down the timestamp T7 and verifies the freshness of T6. Next, Sjcalculates rfg=D11⊕hxj‖T6and ru′=D12⊕hrfg‖xj‖T6 and checks the equation D13=hSIDj‖IDfg‖ru′‖rfg‖xj‖T6. If the equation holds, Sjturns to the next step; otherwise, it terminates the session.Step 10:Sj⟶FGWN:M7=D14,D15,T7. Sjselects rs at random and computes SKs=hru′‖rhg‖rs‖IDfg, D14=rs⊕hxj‖rfg‖T7, and D15=hIDfg‖SIDj‖xj‖SKs‖rs‖T7.Step 11: once receivingM7, FGWN takes down T8 and verifies the freshness of T7. Further, FGWN computes rs=D14⊕hxj‖rfg‖T7and SKfg=hru′‖rfg‖rs‖IDfgand checks whether the equation D15=hIDfg‖SIDj‖xj‖SKfg‖rs‖T7is true; if so, it continues the next step; otherwise, it terminates the session.Step 12:FGWN⟶Ui:M8=D16,D17,D18,T8. FGWN computes D16=rs⊕hxg‖ru′, D17=rfg⊕hru′‖xg, and D18=hIDfg‖TIDi‖SIDj‖xg‖SKfg‖rfg‖rs‖T8.Step 13: after receivingM8, Uithereupon records the timestamp T9 and checks the validity of T8. Further, Ui computes rs=D16⊕hxg‖ru′, rfg=D17⊕hru′‖xg, and SKu=hru′‖rfg‖rs‖IDfgand checks whether the equation D18=hIDfg‖TIDi‖SIDj‖xg‖SKu‖rfg‖rs‖T8 holds; if so, it continues the next step; otherwise, it discontinues the session.Step 14:SC computes ei′=HPWi⊕Ki⊕xi′ and replaces TIDi,eiwith TIDi′,ei′.Figure 3
Case 1 of theauthentication and key agreement phase.Figure 4
Case 2 of the authentication and key agreement phase.


### 4.5. Password Update

Step 1:Uifirst inputs his IDi, PWi, and BIOi. SC computes αi=RepBIOi,βi, ri=B1⊕hαi‖IDi‖PWi, and HPWi=hPWi‖αi‖riand checks the equation B2=hHPWi‖αi‖IDi‖rimodn0. If the equation holds, the next step can be run; otherwise, a logon failure message would be returned and the login request also would be terminated.Step 2:Uiinputs a new password PWi′, and SC computes Ki=hIDi‖βi, HPWi′=hPWi′‖αi‖ri, ei′=HPWi′⊕ei⊕HPWi, B1′=hαi‖IDi‖PWi′⊕ri, and B2′=hHPWi′‖αi‖IDi‖rimodn0 and then replaces B1,B2,eiwith B1′,B2′,ei′.


### 4.6. Smart Card Logout

Step 1:Uiinserts his smart card SC and inputs IDi, PWias well as BIOi. Further, SC computes αi=RepBIOi,βi, ri=B1⊕hαi‖IDi‖PWi, and HPWi=hPWi‖αi‖ri and checks whether B2=hHPWi‖αi‖IDi‖rimodn0 matches; if so, it turns to Step 2; otherwise, it returns a logon failure message and terminates this session.Step 2:Ui⟶HGWN:M0=TIDi,βi,R0,T1. Uiselects the current timestamp T1, thereupon computes Ki=hIDi‖βi, xi=ei⊕Ki⊕HPWi, and R0=Ki⊕xi‖T1.Step 3: after the reception ofM0, HGWN records the timestamp T2. If T2−T1≤ΔTis true, then M0is fresh. Then, HGWN computes xi=hTIDi‖xhg⊕Rhand Ki′=R0⊕xi‖T1and continues to check whether Ki′=Ki=hIDi‖βi. If the equation holds, it runs the next step; otherwise, it aborts the session.Step 4: HGWN deletes all local recordsIDi,Ki,honey_listof Ui.


## 4.1. System Initialization

SA assigns the identityIDhg and private key xhg to HGWN, similarly, IDfg and xfgto FGWN, and SIDj to the sensor Sj. Then, SA sets up a shared key Khf for the communication between HGWN and FGWN. Beyond that, HGWN and FGWN need to select three random numbers Rh, Rf, and Rfh, respectively.


## 4.2. Registration

As shown in Figure2, this phase involves two parts, sensor registration and user registration. Both sensor nodes and users need to register their essential information with the closest gateway, namely, HGWN.Figure 2
Registration phase.


### 4.2.1. Sensor Registration

Step 1:Sj⟹HGWN:SIDj. Sjsends its identity SIDjto HGWN over a private channel, and HGWN stores SIDjto its database for checking whether or not Sjis registered.Step 2:HGWN⇒Sj:xj=hSIDj‖xhg⊕Rh. HGWN calculates xj=hSIDj‖xhg⊕Rh and sends xjto Sjvia a private channel. After the reception of xj, Sj saves it secretly.


### 4.2.2. User Registration

Step 1:Ui⟹HGWN:IDi,HPWi,βi.Uiinputs his username IDi, the password PWi, and his biometric information BIOi. Next, he chooses a number ri∈Zp∗at random and then computes αi,βi=GenBIOi and HPWi=hPWi‖αi‖ri.Step 2:HGWN⟹Ui:SCTIDi,βi,ei,IDhg.HGWN selects a pseudoidentityTIDifor Ui and calculates xi=hTIDi‖xhg⊕Rh, Ki=hIDi‖βi, and ei=HPWi⊕Ki⊕xi. Then, HGWN stores IDi,Ki,honey_list=0 into its database and TIDi,βi,ei,IDhg to SC, where honey_listrecords the number of the user logon failures.Step 3:Ui computes B1=hαi‖IDi‖PWi⊕ri and B2=hHPWi‖αi‖IDi‖rimodn0, where n0∈24,28. Next, Ui stores B1,B2 into his SC.


## 4.2.1. Sensor Registration

Step 1:Sj⟹HGWN:SIDj. Sjsends its identity SIDjto HGWN over a private channel, and HGWN stores SIDjto its database for checking whether or not Sjis registered.Step 2:HGWN⇒Sj:xj=hSIDj‖xhg⊕Rh. HGWN calculates xj=hSIDj‖xhg⊕Rh and sends xjto Sjvia a private channel. After the reception of xj, Sj saves it secretly.


## 4.2.2. User Registration

Step 1:Ui⟹HGWN:IDi,HPWi,βi.Uiinputs his username IDi, the password PWi, and his biometric information BIOi. Next, he chooses a number ri∈Zp∗at random and then computes αi,βi=GenBIOi and HPWi=hPWi‖αi‖ri.Step 2:HGWN⟹Ui:SCTIDi,βi,ei,IDhg.HGWN selects a pseudoidentityTIDifor Ui and calculates xi=hTIDi‖xhg⊕Rh, Ki=hIDi‖βi, and ei=HPWi⊕Ki⊕xi. Then, HGWN stores IDi,Ki,honey_list=0 into its database and TIDi,βi,ei,IDhg to SC, where honey_listrecords the number of the user logon failures.Step 3:Ui computes B1=hαi‖IDi‖PWi⊕ri and B2=hHPWi‖αi‖IDi‖rimodn0, where n0∈24,28. Next, Ui stores B1,B2 into his SC.


## 4.3. Login

Step 1:Ui first inputs IDi, PWi, and BIOi; then, SC computes αi=RepBIOi,βi, ri=B1⊕hαi‖IDi‖PWi, and HPWi=hPWi‖αi‖ri and checks whether B2=hHPWi‖αi‖IDi‖rimodn0 holds. If so, turn to the next step; otherwise, return a logon failure message and terminate this session.Step 2:Ui⟶HGWN:M1=TIDi,IDhg,SIDj,D0,D1,D2,D3,T1. SC chooses a timestamp T1 and a random number ru∈Zp∗ and then calculates Ki=hIDi‖βi, xi=ei⊕Ki⊕HPWi, D0=βi⊕hxi‖ru, D1=ru⊕xi, D2=IDi⊕hru‖xi, and D3=hTIDi‖IDi‖SIDj‖ru‖xi‖Ki‖T1.


## 4.4. Authentication and Key Agreement

After the reception ofUi’s request to communicate with SIDj, HGWN first confirms whether the specified sensor Sjis located within its communication range. Specifically, if HGWN can query its local database for SIDj, then the authentication can be conducted as described in Case 1 (see Figure 3); otherwise, run as shown in Case 2 (see Figure 4).(i)
Case 1:Step 1: after receivingM1, HGWN records the current timestamp T2. If T2−T1≤ΔT is true, then M1is valid; otherwise, this session would be closed up. Next, HGWN computes xi=hTIDi‖xhg⊕Rh, ru=D1⊕xi, βi=D0⊕hxi‖ru, IDi=D2⊕hru‖xi, and Ki=hIDi‖βi and verifies whether the equation D3=hTIDi‖IDi‖SIDj‖ru‖xi‖Ki‖T1 is true; if so, it turns into the next step; otherwise, it sets honey_list=honey_list+1 and returns a logon failure message to Ui. Note that once honey_list≥10, Ui’s account would be frozen, and the session is also terminated.Step 2:HGWN⟶Sj:M2=D4,D5,D6,T2. HGWN selects rhg∈Zp∗ randomly and then computes xj=hSIDj‖xhg⊕Rh, D4=rhg⊕hxj‖T2, D5=ru⊕hrhg‖xj‖T2, and D6=hSIDj‖IDhg‖ru‖rhg‖xj‖T2.Step 3: After the reception ofM2, Sj records the timestamp T3 and checks the freshness of T2. Next, Sjcalculates rhg=D4⊕hxj‖T2 and ru=D5⊕hrhg‖xj‖T2 and checks whether the equation D6=hSIDj‖IDhg‖ru‖rhg‖xj‖T2; if so, it turns to the next step; otherwise, it terminates the current session.Step 4:Sj⟶HGWN:M3=D7,D8,T3. Sjchooses a random number rs∈Zp∗ and computes SKs=hru‖rhg‖rs‖IDhg, D7=rs⊕hxj‖rhg‖T4, and D8=hIDhg‖SIDj‖xj‖SKs‖rs‖T3.Step 5: when receivingM3from Sj, HGWN records the present timestamp T4 and verifies the freshness of T3. Next, HGWN calculates rs=D7⊕hxj‖rhg‖T4 and SKhg=hru‖rhg‖rs‖IDhg and checks whether D8=hIDhg‖SIDj‖xj‖SKs‖rs‖T3 holds; if so, it turns to the next step; otherwise, it aborts this session.Step 6:HGWN⟶Ui:M4=D9,D10,D11,D12,D13,T4. HGWN chooses a new pseudonym TIDi′ for Uiand continues to compute D9=rs⊕hxi‖ru, D10=rhg⊕hru‖xi, xi′=hTIDi′‖xhg⊕Rh, D11=TIDi′⊕hxi‖IDi‖ru, D12=xi′⊕hTIDi′xi, and D13=hSKhg‖xi′‖TIDi′‖Ki‖T4.Step 7: after the reception ofM4, Ui takes down the current timestamp T5 and checks the validity of T4. Next, Uicomputes rs=D9⊕hxi‖ru, rhg=D10⊕hru‖xi, SKu=hru‖rhg‖rs‖IDhg, TIDi′=D11⊕hxi‖IDi‖ru, and xi′=D12⊕hTIDi′‖xiand verifies whether the equation D13=hSKhg‖xi′‖TIDi′‖Ki‖T4matches; if so, then it turns to the next step; otherwise, it discontinues the session.Step 8:SC calculates ei′=HPWi⊕Ki⊕xi′ and substitutes TIDi′,ei′for TIDi,ei.(ii)
Case 2:Step 1: similarly, after the reception ofM1, HGWN takes down the current timestamp T2. If T2−T1≤ΔT, then M1is valid; otherwise, the session is discontinued. Next, HGWN computes xi=hTIDi‖xhg⊕Rh, ru=D1⊕xi, βi=D0⊕hxi‖ru, IDi=D2⊕hru‖xi, and Ki=hIDi‖βi and verifies D3=hTIDi‖IDi‖SIDj‖ru‖xi‖Ki‖T1. If the equation holds, HGWN runs the next step; otherwise, it sets honey_list=honey_list+1, returns a logon failure message to Ui, and aborts the session.Step 2: HGWN broadcastsM2=SIDj,TIDi,IDhg,T2 to other gateway nodes.Step 3:FGWN⟶HGWN:M3=D4,IDfh,T3. FGWN finds SIDjin its database, then records the present timestamp T3, and computes xg=hTIDi‖xfg⊕Rfand D4=xg⊕hxfh‖Rfh.Step 4:HGWN⟶Ui:M4=IDfg,D5,D6,D7,D8,T4. When receiving M3 from FGWN, HGWN takes down the timestamp T4 and verifies the freshness of T3. HGWN selects a new pseudonym TIDi′and calculates xg=D4⊕hKfh‖Rfh, xi′=hTIDi′‖xhg‖rh, D5=TIDi′⊕hxi‖IDi‖ru, D6=xi′⊕hTIDi′‖xi, D7=xg⊕hxi‖ru, and D8=hSIDj‖IDhg‖IDfg‖TIDi′‖xg‖xi‖T4.Step 5: after receivingM4, Ui records the time stamp T5 and checks the validity of T4. Then, Uicomputes xg=D7⊕hxi‖ru, TIDi′=D5⊕hxi‖IDi‖ru, and xi′=D6⊕hTIDi′‖xi and checks D8=hSIDj‖IDhg‖IDfg‖TIDi′‖xg‖xi‖T4. If the equation holds, Uicontinues the next step; otherwise, it terminates the session.Step 6:Ui⟶FGWN:M5=TIDi,D9,D10,T5. Uiselects a random number ru′∈Zp∗and computes D10=hTIDi‖SIDj‖IDfg‖ru′‖xg‖T5.Step 7: after the reception ofM5, FGWN records T6 and verifies the freshness of T5. Next, FGWN computes ru′=D9⊕xgand further checks whether D10=hTIDi‖SIDj‖IDfg‖ru′‖xg‖T5matches. If so, FGWN continues the next step; otherwise, it discontinues the session.Step 8:FGWN⟶Sj:M6=D11,D12,D13,T6. FGWN selects rfgat random and computes xj=hSIDj‖xfg⊕Rh, D11=rfg⊕hxj‖T6, D12=ru′⊕hrfg‖xj‖T6, and D13=hSIDj‖IDfg‖ru′‖rfg‖xj‖T6.Step 9: after the reception ofM6, Sj takes down the timestamp T7 and verifies the freshness of T6. Next, Sjcalculates rfg=D11⊕hxj‖T6and ru′=D12⊕hrfg‖xj‖T6 and checks the equation D13=hSIDj‖IDfg‖ru′‖rfg‖xj‖T6. If the equation holds, Sjturns to the next step; otherwise, it terminates the session.Step 10:Sj⟶FGWN:M7=D14,D15,T7. Sjselects rs at random and computes SKs=hru′‖rhg‖rs‖IDfg, D14=rs⊕hxj‖rfg‖T7, and D15=hIDfg‖SIDj‖xj‖SKs‖rs‖T7.Step 11: once receivingM7, FGWN takes down T8 and verifies the freshness of T7. Further, FGWN computes rs=D14⊕hxj‖rfg‖T7and SKfg=hru′‖rfg‖rs‖IDfgand checks whether the equation D15=hIDfg‖SIDj‖xj‖SKfg‖rs‖T7is true; if so, it continues the next step; otherwise, it terminates the session.Step 12:FGWN⟶Ui:M8=D16,D17,D18,T8. FGWN computes D16=rs⊕hxg‖ru′, D17=rfg⊕hru′‖xg, and D18=hIDfg‖TIDi‖SIDj‖xg‖SKfg‖rfg‖rs‖T8.Step 13: after receivingM8, Uithereupon records the timestamp T9 and checks the validity of T8. Further, Ui computes rs=D16⊕hxg‖ru′, rfg=D17⊕hru′‖xg, and SKu=hru′‖rfg‖rs‖IDfgand checks whether the equation D18=hIDfg‖TIDi‖SIDj‖xg‖SKu‖rfg‖rs‖T8 holds; if so, it continues the next step; otherwise, it discontinues the session.Step 14:SC computes ei′=HPWi⊕Ki⊕xi′ and replaces TIDi,eiwith TIDi′,ei′.Figure 3
Case 1 of theauthentication and key agreement phase.Figure 4
Case 2 of the authentication and key agreement phase.


## 4.5. Password Update

Step 1:Uifirst inputs his IDi, PWi, and BIOi. SC computes αi=RepBIOi,βi, ri=B1⊕hαi‖IDi‖PWi, and HPWi=hPWi‖αi‖riand checks the equation B2=hHPWi‖αi‖IDi‖rimodn0. If the equation holds, the next step can be run; otherwise, a logon failure message would be returned and the login request also would be terminated.Step 2:Uiinputs a new password PWi′, and SC computes Ki=hIDi‖βi, HPWi′=hPWi′‖αi‖ri, ei′=HPWi′⊕ei⊕HPWi, B1′=hαi‖IDi‖PWi′⊕ri, and B2′=hHPWi′‖αi‖IDi‖rimodn0 and then replaces B1,B2,eiwith B1′,B2′,ei′.


## 4.6. Smart Card Logout

Step 1:Uiinserts his smart card SC and inputs IDi, PWias well as BIOi. Further, SC computes αi=RepBIOi,βi, ri=B1⊕hαi‖IDi‖PWi, and HPWi=hPWi‖αi‖ri and checks whether B2=hHPWi‖αi‖IDi‖rimodn0 matches; if so, it turns to Step 2; otherwise, it returns a logon failure message and terminates this session.Step 2:Ui⟶HGWN:M0=TIDi,βi,R0,T1. Uiselects the current timestamp T1, thereupon computes Ki=hIDi‖βi, xi=ei⊕Ki⊕HPWi, and R0=Ki⊕xi‖T1.Step 3: after the reception ofM0, HGWN records the timestamp T2. If T2−T1≤ΔTis true, then M0is fresh. Then, HGWN computes xi=hTIDi‖xhg⊕Rhand Ki′=R0⊕xi‖T1and continues to check whether Ki′=Ki=hIDi‖βi. If the equation holds, it runs the next step; otherwise, it aborts the session.Step 4: HGWN deletes all local recordsIDi,Ki,honey_listof Ui.


## 5. Security Analysis

This section provides a rigorous security analysis for the proposed authentication scheme. On the basis of 12-Criteria, informal analysis first discusses how the proposed scheme resists against some well-known attacks. Second, the well-popular BAN logic is utilized to validate the correctness of the proposed scheme as well as the feasibility for authentication and key negotiation. Finally, the BPR model-based formal security proof demonstrates the security of the proposed scheme well.


### 5.1. Informal Analysis

Resistance to Insider Attack. In multifactor authentication schemes, the user’s password, as a second factor, is of vital for the server/gateway to authenticate the user. The server/gateway in its usual sense is worth trusting, while it is facing a real possibility that insiders may disclose users’ sensitive information. At the registration phase, Ui’s password PWiis masked by HPWi=hPWi‖αi‖rito transmit to HGWN. Though A has the ability to obtain HPWi, he cannot guess the correct PWi. That is because riis a random number, only known to Ui, and αiand derived information from Ui’s biometric factors are also secret. Additionally, the two parameters never appear in any communication channel, and Adoes not possess the ability to crack hash functions. As a consequence, the proposed scheme can resist insider attack.Resistance to Password Guessing Attack. Assuming that A has generated the Cartesian products IDi,PWiof Ui and maliciously obtained the biometric factors BIOiand SC through the reading device, then A can calculate αi=RepBIOi,βi, ri=B1⊕hαi‖IDi‖PWi, and HPWi=hPWi‖αi‖riand further check whether the equation B2=hHPWi‖αi‖IDi‖rimodn0holds to find out a correct password. It is noted that there are 232[24] passwords satisfying the equation, the attempts of which are enormous, thus the offline password guessing attack bounds to fail. Furthermore, honey_listrecords the number of user logon failure when HGWN verifies the identity of Ui, which makes it extremely unlikely that Acan guess the right password through online password guessing within finite attempts. Clearly, the proposed scheme can resist diverse password guessing attacks.Resistance to Replay Attack. It is known that Ahas the ability to eavesdrop and intercept messages over the public channel. So, Amay retransmit the eavesdropped or intercepted messages in a new round of the protocol implementation, to make the other party believe that “he” is legitimate to communicate with him. In the proposed protocol, however, the timestamp is employed to demonstrate the freshness of each message, so as to filter out old messages intercepted by A. For an instance, A has intercepted M1=TIDi,IDhg,SIDj,D0,D1,D2,D3,Ki,T1, where D3=hTIDi‖IDi‖SIDj‖ru‖xi‖Ki‖T1, and at time T1′, he attempts to resend M1′=TIDi,IDhg,SIDj,D0,D1,D2,D3,Ki,T1′to HGWN for login. However, A can only change the timestamp in the message but not that in D3, thus the launched replay attack bounds to fail. This instance illustrates that the proposed scheme can withstand replay attack.User Anonymity. In terms of user anonymity, it is required that A cannot find out the true identities of users or trace their communication trajectories. In this scheme, each user Uiis assigned a pseudonym TIDi, and after a round of key negotiation, his pseudonym will be updated with a new pseudonym TIDi′. Moreover, the calculation of TIDi′depends on Ui’s private key xiand identity IDi, neither of which is exposed to the open channel. Therefore, A cannot trace the communication trajectory of the user via the pseudonym. As analysed above, user anonymity is effective.Forward Secrecy. According to the proposed protocol, Ui’s and Sj’s private keys are both calculated by a random number and the gateway node’s long-term key. It helps that even if the long-term key of the gateway node is leaked for some reason, A cannot figure out Ui’s or Sj’s private key due to no idea of the random number. As the session key SK=SKu=SKs=SKhg=hru‖rhg‖rs‖IDhgdepends on ru, rhg, as well as rs, three of which are severally masked by private keys of three parties, A cannot compute the right SK at all. Consequently, the presented scheme supports forward secrecy.Effective Smart Card Logout. For those smart cards not used any more, improper handling may pose a huge safety hazard. On the basis of the smart card logout method described in this protocol, Uimust enter his right IDi, PWi, and BIOisimultaneously while cancelling his SC, so as to prevent A from launching malicious cancellation after the smart card is lost. In addition, A cannot achieve password guessing attack and obtain three authentication factors at the same time, so there is no way for A to masquerade as a legitimate user to cancel the smart card. Hence, the smart card logout method presented in this protocol is effective and secure.


### 5.2. Formal Analysis Based on BAN Logic

In the light of BAN logic, a detailed analysis in this section will illustrate that the interacting parties (Ui, HGWN, and Sj) can achieve mutual authentication and negotiate a common session key properly and securely. The analytic procedures for two cases in the proposed scheme are described as follows.


#### 5.2.1. Security Analysis for Case 1

(i)
Goals:G1:Ui|≡HGWN⟷SKUiG2:Ui|≡HGWN|≡HGWN⟷SKUiG3:HGWN|≡Ui⟷SKHGWNG4:HGWN|≡Ui|≡Ui⟷SKHGWNG5:HGWN|≡Sj⟷SKHGWNG6:HGWN|≡Sj|≡Sj⟷SKHGWNG7:Sj|≡HGWN⟷SKSjG8:Sj|≡HGWN|≡HGWN⟷SKSj(ii)
Idealized forms:M1:Ui⟶HGWN:TIDi,IDhg,SIDj,D0,ruxi,D2,Ui⟺KiHWGN,ruxiM2:HGWN⟶Sj:D4,D5,ru,rhgxjM3:Sj⟶HGWN:D7,Sj↔SKHGWN,rsxjM4:HGWN⟶Ui:D9,D10,D11,D12,HGWN⟷SKUi,xi′,TIDi′Ki(iii)
Assumptions:A1:Ui|≡#ru,rhg,rsA2:HGWN|≡#ru,rhg,rsA3:Sj|≡#ru,rhg,rsA4:Ui|≡Ui⟺xiHGWNA5:HGWN|≡HGWN⟺xjSjA6:Sj|≡Sj⟺xjHGWNA7:HGWN|≡HGWN⟺xiUiA8:Ui|≡Ui⟺KiHGWNA9:HGWN|≡HGWN⟺KiUiA10:HGWN|≡Ui|⟹ruA11:Sj|≡HGWN|⟹rhgA12:HGWN|≡Sj|⟹rsA13:Ui|≡HGWN|⟹rhgA14:Ui|≡HGWN|⟹HGWN↔SKUiA15:HGWN|≡Sj|⟹Sj↔SKHGWN(iv)
Main proofs:FromM1 and R6, we can know S1:HGWN⊲〈ru〉xi.FromS1, A4, and R1, we can get S2:HGWN|≡Ui|∼ru.FromS2, A2, R2, and R4, we can get S3:HGWN|≡Ui|≡ru.FromS3, A10, and R5, we can get S4:HGWN|≡ru.FromA2, R2, and SK=hru‖rhg‖rs‖IDhg, we can get S5:HGWN|≡#SK.FromS3, S5, and R7, we can get S6:HGWN|≡Ui↔SKHGWN.Here, we have achievedG3.FromS6, A2, and R4, we can get S7:HGWN|≡Ui|≡Ui↔SKHGWN.Then,G4 has been also achieved.FromM2 and R6, we can know S8:Sj⊲〈ru,rhg〉xi.FromS8, A6, and R1, we can gain S9:Sj|≡HGWN|∼ru,rhg.FromS9, A3, R2, and R4, we can gain S10:Sj|≡HGWN|≡ru,rhg.FromS10 and R3, we can gain S11:Sj|≡HGWN|≡rhg.FromS11, A11, and R5, we can gain S12:Sj|≡rhg.FromA3, R2, and SK=hru‖rhg‖rs‖IDhg, we can gain S13:Sj|≡#SK.FromS11, S13, and R7, we can gain S14:Sj|≡HGWN↔SKSj. Here, G7 has been proved.FromS14, A3, and R4, we can gain S15:Sj|≡HGWN|≡HGWN↔SKSj.So,G8 has been also gained.FromM3and R6, we can get S16:HGWN⊲〈Sj↔SKHGWN,rs〉xi.FromS16, A5, and R1, we can get S17:HGWN|≡Sj|∼Sj↔SKHGWN,rs.FromS17, A2, R2, and R4, we can get S18:HGWN|≡Sj|≡Sj↔SKHGWN,rs.FromS18 and R3, we can get S19:HGWN|≡Sj|≡Sj↔SKHGWN.Here, we have achievedG6.FromS19, A15, and R5, we can get S20:HGWN|≡Sj↔SKHGWN.So,G5 has been also gained.FromM4and R6, we can gain S21:Ui⊲〈HGWN↔SKUi,xi′,TIDiKi′〉Ki.FromS21, A8, and R1, we can obtain S22:Ui|≡HGWN|∼HGWN↔SKUi,xi′,TIDi′.FromS22, A1, R2, and R4, we can obtain S23:Ui|≡HGWN|≡HGWN↔SKUi,xi′,TIDi′.FromS23 and R3, we can obtain S24:Ui|≡HGWN|≡HGWN↔SKUi.So, we have achievedG2.FromS24, A14, and R5, we can obtain S25:Ui|≡HGWN↔SKUi.Finally, we have gainedG1.


#### 5.2.2. Security Analysis for Case 2

(i)
Goals:G1:Ui|≡FGWN↔SKUiG2:Ui|≡FGWN|≡FGWN↔SKUiG3:FGWN|≡Ui↔SKFGWNG4:FGWN|≡Ui|≡Ui↔SKFGWNG5:FGWN|≡Sj↔SKFGWNG6:FGWN|≡Sj|≡Sj↔SKFGWNG7:Sj|≡FGWN↔SKSjG8:Sj|≡FGWN|≡FGWN↔SKSj(ii)
Idealized forms:M5:Ui⟶FGWN:TIDi,D9,ru′xgM6:FGWN⟶Sj:D11,D12,ru′,rfgxjM7:Sj⟶FGWN:D14,FGWN↔SKSj,rsxjM8:FGWN⟶Ui:D16,D17,FGWN↔SKUi,rfg,rsxg(iii)
Assumptions:A1:Ui|≡#ru′,rfg,rsA2:FGWN|≡#ru′,rfg,rsA3:Sj|≡#ru′,rfg,rsA4:Ui|≡Ui⟺xgFGWNA5:FGWN|≡FGWN⟺xjSjA6:Sj|≡Sj⟺xjFGWNA7:FGWN|≡FGWN⟺xgUiA8:FGWN|≡Ui|⇒ru′A9:Sj|≡FGWN|⇒rfgA10:FGWN|≡Sj|⇒rsA11:Ui|≡FGWN|⇒rfgA12:Ui|≡FGWN|⇒FGWN↔SKUiA13:FGWN|≡Sj|⇒Sj↔SKFGWN(iv)
Main proofs:FromM5 and R6, we obtain S26:FGWN⊲〈ru′〉xg.FromS26, A7, and R1, we obtain S27:FGWN|≡Ui|∼ru′.FromS27, A2, R2, and R4, we obtain S28:FGWN|≡Ui|≡ru′.FromS28, A8, and R5, we obtain S29:FGWN|≡ru′.FromA2, R2, and SK=hru′‖rfg‖rs‖IDfg, we obtain S30:FGWN|≡#SK.FromS28, S30, and R7, we obtain S31:FGWN|≡Ui↔SKFGWN.So,G3 has been achieved.FromS31, A2, and R4, we obtain S32:FGWN|≡Ui|≡Ui↔SKFGWN.Here,G4 has been also obtained.FromM6and R6, we getS33:Sj⊲〈ru′,rfg〉xj.FromS33, A6, and R1, we get S34:Sj|≡FGWN|∼ru′,rfg.FromS34, A3, R2, and R4, we get S35:Sj|≡FGWN|≡ru′,rfg.FromS35 and R3, we get S36:Sj|≡FGWN|≡rfg.FromS36, A9, and R5, we get S37:Sj|≡rfg.FromA3, R2, and SK=hru′‖rfg‖rs‖IDfg, we get S38:Sj|≡#SK.FromS36, S38, and R7, we get S39:Sj|≡FGWN↔SKSj. Here, we have proved G7.FromS39, A3, and R4, we get S40:Sj|≡FGWN|≡FGWN↔SKSj.Here, we have achievedG8.FromM7and R6, we gainS41:FGWN⊲〈FGWN↔SKSj,rs〉xj.FromS41, A5, and R1, we gain S42:FGWN|≡Sj|∼FGWN↔SKSj,rs.FromS42 and R3, we gain S43:FGWN|≡Sj|∼FGWN↔SKSj.FromA2, R2, and SK=hru′‖rfg‖rs‖IDfg, we gain S44:FGWN|≡#SK.FromS43, S44, R2, and R4, we gain S45:FGWN|≡Sj|≡FGWN↔SKSj.Here, we have achievedG6.FromA13, S45, and R5, we gain S46:FGWN|≡FGWN↔SKSj.So, we have also achievedG5.FromM8and R6, we know S47:Ui⊲FGWN↔SKUi,rfg,rsxg.FromS47, A4, and R1, we get S48:Ui|≡FGWN|∼FGWN↔SKUi,rfg,rs.FromS48 and R3, we get S49:Ui|≡FGWN|∼FGWN↔SKUi.FromA1, R2, and SK=hru′‖rfg‖rs‖IDfg, we get S50:Ui|≡#SK.FromS49, S50, R2, and R4, we get S51:Ui|≡FGWN|≡FGWN↔SKUi.So,G2 has been gained.FromS51, A12, and R5, we get S52:Ui|≡FGWN↔SKUi. So, G1 has been also obtained.Consequently, all security goals are amply demonstrated, both in Case 1 and in Case 2. In the meantime, it also confirms that the communication participants (Ui, HGWN/FGWN, and Sj), can authenticate mutually and negotiate a common key successfully.


### 5.3. Formal Analysis Based on BPR Model

Theorem 1.
For the protocolP, assuming that, in a polynomial time t, Amakes up to qsSendΠI∗,mqueries, qeExcuteΠUi,ΠHGWNk,ΠSjqueries, and qhoracle queries. Let D represent the password space subject to Zipf distribution, wherein C′and s′are Zipf parameters; let l denote the output length of hash functions. Now, we can get(8)AdvPAKEA≤2C′qss′+qs2l−1+qh22l+qs+qe2p−1.Proof.
Five gamesGii=0,1,2,3,and4are considered to demonstrate Theorem 1, and simulation process of each game is analysed as below, wherein Siindicates an event that A outputs the right random bit b in Gi, where i=0,1,2,3,and4.G0: it simulates a true attack under the random oracle model. A has the ability to access all oracles; so according Definition 1, we have(9)AdvPAKEA=2PrS0−1.G1: it maintains two lists, LHand LM, respectively, recording oracle queries and communications during the execution of P. Besides, all other queries are run as the actual protocol. In G1, A launches the passive attack to intercept all messages Mjj=1,2,3,4through Excute∗query and then guesses the output result of TestΠI∗query. Due to the impossibility of figuring out SK=hru‖rhg‖rs‖IDhg, the advantage of a successful attack does not increase for A, so we can get(10)PrS1=PrS0.G2: here, A can make SendΠI∗,mqueries and ℋqueries to convince the true communicator of forged messages. Only when A happens to find some collisions and succeeds in constructing credible messages, the simulation terminates. In G2, two kinds of collisions may be contained: output collisions of hash functions and collisions of random numbers selected in P. According to Birthday Paradox [30], the probabilities of their occurrence are qh2/2l+1 and qs+qe2/2p−1, respectively. Therefore, we obtain(11)PrS2−PrS1≤qh22l+1+qs+qe22p−1.G3: this game differs from the above games in the case that when A can guess the correct authentication factors D3, D6, D8, and D13without ℋ queries, the simulation terminates. It is indistinguishable from the previous games except that some instance refuses the right authentication. Thus, we have(12)PrS3−PrS2≤qs2l.G4: in this game, A has abilities to reach more information through CorruptΠUi,a query.(i)
A queries CorruptΠUi,1, which means he has got the user’s password and parameters stored in SC. Then, in qsSendΠI∗,m queries, A succeeds in guessing αiwith the length lα, the possibility of which is qs/2lα.(ii)
A queries CorruptΠUi,2, that is, A has accessed the user’s biometric factors and parameters stored in SC. Then, in qsSendΠI∗,mqueries, A succeeds in guessing the victim’s password, the possibility of which is C′qss′.(iii)
A queries CorruptΠUi,3; similarly, A has the user’s password and biometric factors. Then, the possibility of A guessing the right xi is qs/2l.
G4 and G3 are indistinguishable unless the above attack is successful. So, we have(13)PrS4−PrS3≤maxqs2lα,C′qss′,qs2l=C′qss′.
WhenA has no efficient input to make queries to ℋ, there is no advantage to distinguish the real SK from a random number with the same size through TestΠI∗. Therefore,(14)PrS4=12.
From (2)–(7), we can draw conclusion (1) or (8); this is(15)AdvPAKEA=2|PrS4−PrS0|≤2C′qss′+qs2l−1+qh22l+qs+qe2p−1.


## 5.1. Informal Analysis

Resistance to Insider Attack. In multifactor authentication schemes, the user’s password, as a second factor, is of vital for the server/gateway to authenticate the user. The server/gateway in its usual sense is worth trusting, while it is facing a real possibility that insiders may disclose users’ sensitive information. At the registration phase, Ui’s password PWiis masked by HPWi=hPWi‖αi‖rito transmit to HGWN. Though A has the ability to obtain HPWi, he cannot guess the correct PWi. That is because riis a random number, only known to Ui, and αiand derived information from Ui’s biometric factors are also secret. Additionally, the two parameters never appear in any communication channel, and Adoes not possess the ability to crack hash functions. As a consequence, the proposed scheme can resist insider attack.Resistance to Password Guessing Attack. Assuming that A has generated the Cartesian products IDi,PWiof Ui and maliciously obtained the biometric factors BIOiand SC through the reading device, then A can calculate αi=RepBIOi,βi, ri=B1⊕hαi‖IDi‖PWi, and HPWi=hPWi‖αi‖riand further check whether the equation B2=hHPWi‖αi‖IDi‖rimodn0holds to find out a correct password. It is noted that there are 232[24] passwords satisfying the equation, the attempts of which are enormous, thus the offline password guessing attack bounds to fail. Furthermore, honey_listrecords the number of user logon failure when HGWN verifies the identity of Ui, which makes it extremely unlikely that Acan guess the right password through online password guessing within finite attempts. Clearly, the proposed scheme can resist diverse password guessing attacks.Resistance to Replay Attack. It is known that Ahas the ability to eavesdrop and intercept messages over the public channel. So, Amay retransmit the eavesdropped or intercepted messages in a new round of the protocol implementation, to make the other party believe that “he” is legitimate to communicate with him. In the proposed protocol, however, the timestamp is employed to demonstrate the freshness of each message, so as to filter out old messages intercepted by A. For an instance, A has intercepted M1=TIDi,IDhg,SIDj,D0,D1,D2,D3,Ki,T1, where D3=hTIDi‖IDi‖SIDj‖ru‖xi‖Ki‖T1, and at time T1′, he attempts to resend M1′=TIDi,IDhg,SIDj,D0,D1,D2,D3,Ki,T1′to HGWN for login. However, A can only change the timestamp in the message but not that in D3, thus the launched replay attack bounds to fail. This instance illustrates that the proposed scheme can withstand replay attack.User Anonymity. In terms of user anonymity, it is required that A cannot find out the true identities of users or trace their communication trajectories. In this scheme, each user Uiis assigned a pseudonym TIDi, and after a round of key negotiation, his pseudonym will be updated with a new pseudonym TIDi′. Moreover, the calculation of TIDi′depends on Ui’s private key xiand identity IDi, neither of which is exposed to the open channel. Therefore, A cannot trace the communication trajectory of the user via the pseudonym. As analysed above, user anonymity is effective.Forward Secrecy. According to the proposed protocol, Ui’s and Sj’s private keys are both calculated by a random number and the gateway node’s long-term key. It helps that even if the long-term key of the gateway node is leaked for some reason, A cannot figure out Ui’s or Sj’s private key due to no idea of the random number. As the session key SK=SKu=SKs=SKhg=hru‖rhg‖rs‖IDhgdepends on ru, rhg, as well as rs, three of which are severally masked by private keys of three parties, A cannot compute the right SK at all. Consequently, the presented scheme supports forward secrecy.Effective Smart Card Logout. For those smart cards not used any more, improper handling may pose a huge safety hazard. On the basis of the smart card logout method described in this protocol, Uimust enter his right IDi, PWi, and BIOisimultaneously while cancelling his SC, so as to prevent A from launching malicious cancellation after the smart card is lost. In addition, A cannot achieve password guessing attack and obtain three authentication factors at the same time, so there is no way for A to masquerade as a legitimate user to cancel the smart card. Hence, the smart card logout method presented in this protocol is effective and secure.


## 5.2. Formal Analysis Based on BAN Logic

In the light of BAN logic, a detailed analysis in this section will illustrate that the interacting parties (Ui, HGWN, and Sj) can achieve mutual authentication and negotiate a common session key properly and securely. The analytic procedures for two cases in the proposed scheme are described as follows.


### 5.2.1. Security Analysis for Case 1

(i)
Goals:G1:Ui|≡HGWN⟷SKUiG2:Ui|≡HGWN|≡HGWN⟷SKUiG3:HGWN|≡Ui⟷SKHGWNG4:HGWN|≡Ui|≡Ui⟷SKHGWNG5:HGWN|≡Sj⟷SKHGWNG6:HGWN|≡Sj|≡Sj⟷SKHGWNG7:Sj|≡HGWN⟷SKSjG8:Sj|≡HGWN|≡HGWN⟷SKSj(ii)
Idealized forms:M1:Ui⟶HGWN:TIDi,IDhg,SIDj,D0,ruxi,D2,Ui⟺KiHWGN,ruxiM2:HGWN⟶Sj:D4,D5,ru,rhgxjM3:Sj⟶HGWN:D7,Sj↔SKHGWN,rsxjM4:HGWN⟶Ui:D9,D10,D11,D12,HGWN⟷SKUi,xi′,TIDi′Ki(iii)
Assumptions:A1:Ui|≡#ru,rhg,rsA2:HGWN|≡#ru,rhg,rsA3:Sj|≡#ru,rhg,rsA4:Ui|≡Ui⟺xiHGWNA5:HGWN|≡HGWN⟺xjSjA6:Sj|≡Sj⟺xjHGWNA7:HGWN|≡HGWN⟺xiUiA8:Ui|≡Ui⟺KiHGWNA9:HGWN|≡HGWN⟺KiUiA10:HGWN|≡Ui|⟹ruA11:Sj|≡HGWN|⟹rhgA12:HGWN|≡Sj|⟹rsA13:Ui|≡HGWN|⟹rhgA14:Ui|≡HGWN|⟹HGWN↔SKUiA15:HGWN|≡Sj|⟹Sj↔SKHGWN(iv)
Main proofs:FromM1 and R6, we can know S1:HGWN⊲〈ru〉xi.FromS1, A4, and R1, we can get S2:HGWN|≡Ui|∼ru.FromS2, A2, R2, and R4, we can get S3:HGWN|≡Ui|≡ru.FromS3, A10, and R5, we can get S4:HGWN|≡ru.FromA2, R2, and SK=hru‖rhg‖rs‖IDhg, we can get S5:HGWN|≡#SK.FromS3, S5, and R7, we can get S6:HGWN|≡Ui↔SKHGWN.Here, we have achievedG3.FromS6, A2, and R4, we can get S7:HGWN|≡Ui|≡Ui↔SKHGWN.Then,G4 has been also achieved.FromM2 and R6, we can know S8:Sj⊲〈ru,rhg〉xi.FromS8, A6, and R1, we can gain S9:Sj|≡HGWN|∼ru,rhg.FromS9, A3, R2, and R4, we can gain S10:Sj|≡HGWN|≡ru,rhg.FromS10 and R3, we can gain S11:Sj|≡HGWN|≡rhg.FromS11, A11, and R5, we can gain S12:Sj|≡rhg.FromA3, R2, and SK=hru‖rhg‖rs‖IDhg, we can gain S13:Sj|≡#SK.FromS11, S13, and R7, we can gain S14:Sj|≡HGWN↔SKSj. Here, G7 has been proved.FromS14, A3, and R4, we can gain S15:Sj|≡HGWN|≡HGWN↔SKSj.So,G8 has been also gained.FromM3and R6, we can get S16:HGWN⊲〈Sj↔SKHGWN,rs〉xi.FromS16, A5, and R1, we can get S17:HGWN|≡Sj|∼Sj↔SKHGWN,rs.FromS17, A2, R2, and R4, we can get S18:HGWN|≡Sj|≡Sj↔SKHGWN,rs.FromS18 and R3, we can get S19:HGWN|≡Sj|≡Sj↔SKHGWN.Here, we have achievedG6.FromS19, A15, and R5, we can get S20:HGWN|≡Sj↔SKHGWN.So,G5 has been also gained.FromM4and R6, we can gain S21:Ui⊲〈HGWN↔SKUi,xi′,TIDiKi′〉Ki.FromS21, A8, and R1, we can obtain S22:Ui|≡HGWN|∼HGWN↔SKUi,xi′,TIDi′.FromS22, A1, R2, and R4, we can obtain S23:Ui|≡HGWN|≡HGWN↔SKUi,xi′,TIDi′.FromS23 and R3, we can obtain S24:Ui|≡HGWN|≡HGWN↔SKUi.So, we have achievedG2.FromS24, A14, and R5, we can obtain S25:Ui|≡HGWN↔SKUi.Finally, we have gainedG1.


### 5.2.2. Security Analysis for Case 2

(i)
Goals:G1:Ui|≡FGWN↔SKUiG2:Ui|≡FGWN|≡FGWN↔SKUiG3:FGWN|≡Ui↔SKFGWNG4:FGWN|≡Ui|≡Ui↔SKFGWNG5:FGWN|≡Sj↔SKFGWNG6:FGWN|≡Sj|≡Sj↔SKFGWNG7:Sj|≡FGWN↔SKSjG8:Sj|≡FGWN|≡FGWN↔SKSj(ii)
Idealized forms:M5:Ui⟶FGWN:TIDi,D9,ru′xgM6:FGWN⟶Sj:D11,D12,ru′,rfgxjM7:Sj⟶FGWN:D14,FGWN↔SKSj,rsxjM8:FGWN⟶Ui:D16,D17,FGWN↔SKUi,rfg,rsxg(iii)
Assumptions:A1:Ui|≡#ru′,rfg,rsA2:FGWN|≡#ru′,rfg,rsA3:Sj|≡#ru′,rfg,rsA4:Ui|≡Ui⟺xgFGWNA5:FGWN|≡FGWN⟺xjSjA6:Sj|≡Sj⟺xjFGWNA7:FGWN|≡FGWN⟺xgUiA8:FGWN|≡Ui|⇒ru′A9:Sj|≡FGWN|⇒rfgA10:FGWN|≡Sj|⇒rsA11:Ui|≡FGWN|⇒rfgA12:Ui|≡FGWN|⇒FGWN↔SKUiA13:FGWN|≡Sj|⇒Sj↔SKFGWN(iv)
Main proofs:FromM5 and R6, we obtain S26:FGWN⊲〈ru′〉xg.FromS26, A7, and R1, we obtain S27:FGWN|≡Ui|∼ru′.FromS27, A2, R2, and R4, we obtain S28:FGWN|≡Ui|≡ru′.FromS28, A8, and R5, we obtain S29:FGWN|≡ru′.FromA2, R2, and SK=hru′‖rfg‖rs‖IDfg, we obtain S30:FGWN|≡#SK.FromS28, S30, and R7, we obtain S31:FGWN|≡Ui↔SKFGWN.So,G3 has been achieved.FromS31, A2, and R4, we obtain S32:FGWN|≡Ui|≡Ui↔SKFGWN.Here,G4 has been also obtained.FromM6and R6, we getS33:Sj⊲〈ru′,rfg〉xj.FromS33, A6, and R1, we get S34:Sj|≡FGWN|∼ru′,rfg.FromS34, A3, R2, and R4, we get S35:Sj|≡FGWN|≡ru′,rfg.FromS35 and R3, we get S36:Sj|≡FGWN|≡rfg.FromS36, A9, and R5, we get S37:Sj|≡rfg.FromA3, R2, and SK=hru′‖rfg‖rs‖IDfg, we get S38:Sj|≡#SK.FromS36, S38, and R7, we get S39:Sj|≡FGWN↔SKSj. Here, we have proved G7.FromS39, A3, and R4, we get S40:Sj|≡FGWN|≡FGWN↔SKSj.Here, we have achievedG8.FromM7and R6, we gainS41:FGWN⊲〈FGWN↔SKSj,rs〉xj.FromS41, A5, and R1, we gain S42:FGWN|≡Sj|∼FGWN↔SKSj,rs.FromS42 and R3, we gain S43:FGWN|≡Sj|∼FGWN↔SKSj.FromA2, R2, and SK=hru′‖rfg‖rs‖IDfg, we gain S44:FGWN|≡#SK.FromS43, S44, R2, and R4, we gain S45:FGWN|≡Sj|≡FGWN↔SKSj.Here, we have achievedG6.FromA13, S45, and R5, we gain S46:FGWN|≡FGWN↔SKSj.So, we have also achievedG5.FromM8and R6, we know S47:Ui⊲FGWN↔SKUi,rfg,rsxg.FromS47, A4, and R1, we get S48:Ui|≡FGWN|∼FGWN↔SKUi,rfg,rs.FromS48 and R3, we get S49:Ui|≡FGWN|∼FGWN↔SKUi.FromA1, R2, and SK=hru′‖rfg‖rs‖IDfg, we get S50:Ui|≡#SK.FromS49, S50, R2, and R4, we get S51:Ui|≡FGWN|≡FGWN↔SKUi.So,G2 has been gained.FromS51, A12, and R5, we get S52:Ui|≡FGWN↔SKUi. So, G1 has been also obtained.Consequently, all security goals are amply demonstrated, both in Case 1 and in Case 2. In the meantime, it also confirms that the communication participants (Ui, HGWN/FGWN, and Sj), can authenticate mutually and negotiate a common key successfully.


## 5.2.1. Security Analysis for Case 1

(i)
Goals:G1:Ui|≡HGWN⟷SKUiG2:Ui|≡HGWN|≡HGWN⟷SKUiG3:HGWN|≡Ui⟷SKHGWNG4:HGWN|≡Ui|≡Ui⟷SKHGWNG5:HGWN|≡Sj⟷SKHGWNG6:HGWN|≡Sj|≡Sj⟷SKHGWNG7:Sj|≡HGWN⟷SKSjG8:Sj|≡HGWN|≡HGWN⟷SKSj(ii)
Idealized forms:M1:Ui⟶HGWN:TIDi,IDhg,SIDj,D0,ruxi,D2,Ui⟺KiHWGN,ruxiM2:HGWN⟶Sj:D4,D5,ru,rhgxjM3:Sj⟶HGWN:D7,Sj↔SKHGWN,rsxjM4:HGWN⟶Ui:D9,D10,D11,D12,HGWN⟷SKUi,xi′,TIDi′Ki(iii)
Assumptions:A1:Ui|≡#ru,rhg,rsA2:HGWN|≡#ru,rhg,rsA3:Sj|≡#ru,rhg,rsA4:Ui|≡Ui⟺xiHGWNA5:HGWN|≡HGWN⟺xjSjA6:Sj|≡Sj⟺xjHGWNA7:HGWN|≡HGWN⟺xiUiA8:Ui|≡Ui⟺KiHGWNA9:HGWN|≡HGWN⟺KiUiA10:HGWN|≡Ui|⟹ruA11:Sj|≡HGWN|⟹rhgA12:HGWN|≡Sj|⟹rsA13:Ui|≡HGWN|⟹rhgA14:Ui|≡HGWN|⟹HGWN↔SKUiA15:HGWN|≡Sj|⟹Sj↔SKHGWN(iv)
Main proofs:FromM1 and R6, we can know S1:HGWN⊲〈ru〉xi.FromS1, A4, and R1, we can get S2:HGWN|≡Ui|∼ru.FromS2, A2, R2, and R4, we can get S3:HGWN|≡Ui|≡ru.FromS3, A10, and R5, we can get S4:HGWN|≡ru.FromA2, R2, and SK=hru‖rhg‖rs‖IDhg, we can get S5:HGWN|≡#SK.FromS3, S5, and R7, we can get S6:HGWN|≡Ui↔SKHGWN.Here, we have achievedG3.FromS6, A2, and R4, we can get S7:HGWN|≡Ui|≡Ui↔SKHGWN.Then,G4 has been also achieved.FromM2 and R6, we can know S8:Sj⊲〈ru,rhg〉xi.FromS8, A6, and R1, we can gain S9:Sj|≡HGWN|∼ru,rhg.FromS9, A3, R2, and R4, we can gain S10:Sj|≡HGWN|≡ru,rhg.FromS10 and R3, we can gain S11:Sj|≡HGWN|≡rhg.FromS11, A11, and R5, we can gain S12:Sj|≡rhg.FromA3, R2, and SK=hru‖rhg‖rs‖IDhg, we can gain S13:Sj|≡#SK.FromS11, S13, and R7, we can gain S14:Sj|≡HGWN↔SKSj. Here, G7 has been proved.FromS14, A3, and R4, we can gain S15:Sj|≡HGWN|≡HGWN↔SKSj.So,G8 has been also gained.FromM3and R6, we can get S16:HGWN⊲〈Sj↔SKHGWN,rs〉xi.FromS16, A5, and R1, we can get S17:HGWN|≡Sj|∼Sj↔SKHGWN,rs.FromS17, A2, R2, and R4, we can get S18:HGWN|≡Sj|≡Sj↔SKHGWN,rs.FromS18 and R3, we can get S19:HGWN|≡Sj|≡Sj↔SKHGWN.Here, we have achievedG6.FromS19, A15, and R5, we can get S20:HGWN|≡Sj↔SKHGWN.So,G5 has been also gained.FromM4and R6, we can gain S21:Ui⊲〈HGWN↔SKUi,xi′,TIDiKi′〉Ki.FromS21, A8, and R1, we can obtain S22:Ui|≡HGWN|∼HGWN↔SKUi,xi′,TIDi′.FromS22, A1, R2, and R4, we can obtain S23:Ui|≡HGWN|≡HGWN↔SKUi,xi′,TIDi′.FromS23 and R3, we can obtain S24:Ui|≡HGWN|≡HGWN↔SKUi.So, we have achievedG2.FromS24, A14, and R5, we can obtain S25:Ui|≡HGWN↔SKUi.Finally, we have gainedG1.


## 5.2.2. Security Analysis for Case 2

(i)
Goals:G1:Ui|≡FGWN↔SKUiG2:Ui|≡FGWN|≡FGWN↔SKUiG3:FGWN|≡Ui↔SKFGWNG4:FGWN|≡Ui|≡Ui↔SKFGWNG5:FGWN|≡Sj↔SKFGWNG6:FGWN|≡Sj|≡Sj↔SKFGWNG7:Sj|≡FGWN↔SKSjG8:Sj|≡FGWN|≡FGWN↔SKSj(ii)
Idealized forms:M5:Ui⟶FGWN:TIDi,D9,ru′xgM6:FGWN⟶Sj:D11,D12,ru′,rfgxjM7:Sj⟶FGWN:D14,FGWN↔SKSj,rsxjM8:FGWN⟶Ui:D16,D17,FGWN↔SKUi,rfg,rsxg(iii)
Assumptions:A1:Ui|≡#ru′,rfg,rsA2:FGWN|≡#ru′,rfg,rsA3:Sj|≡#ru′,rfg,rsA4:Ui|≡Ui⟺xgFGWNA5:FGWN|≡FGWN⟺xjSjA6:Sj|≡Sj⟺xjFGWNA7:FGWN|≡FGWN⟺xgUiA8:FGWN|≡Ui|⇒ru′A9:Sj|≡FGWN|⇒rfgA10:FGWN|≡Sj|⇒rsA11:Ui|≡FGWN|⇒rfgA12:Ui|≡FGWN|⇒FGWN↔SKUiA13:FGWN|≡Sj|⇒Sj↔SKFGWN(iv)
Main proofs:FromM5 and R6, we obtain S26:FGWN⊲〈ru′〉xg.FromS26, A7, and R1, we obtain S27:FGWN|≡Ui|∼ru′.FromS27, A2, R2, and R4, we obtain S28:FGWN|≡Ui|≡ru′.FromS28, A8, and R5, we obtain S29:FGWN|≡ru′.FromA2, R2, and SK=hru′‖rfg‖rs‖IDfg, we obtain S30:FGWN|≡#SK.FromS28, S30, and R7, we obtain S31:FGWN|≡Ui↔SKFGWN.So,G3 has been achieved.FromS31, A2, and R4, we obtain S32:FGWN|≡Ui|≡Ui↔SKFGWN.Here,G4 has been also obtained.FromM6and R6, we getS33:Sj⊲〈ru′,rfg〉xj.FromS33, A6, and R1, we get S34:Sj|≡FGWN|∼ru′,rfg.FromS34, A3, R2, and R4, we get S35:Sj|≡FGWN|≡ru′,rfg.FromS35 and R3, we get S36:Sj|≡FGWN|≡rfg.FromS36, A9, and R5, we get S37:Sj|≡rfg.FromA3, R2, and SK=hru′‖rfg‖rs‖IDfg, we get S38:Sj|≡#SK.FromS36, S38, and R7, we get S39:Sj|≡FGWN↔SKSj. Here, we have proved G7.FromS39, A3, and R4, we get S40:Sj|≡FGWN|≡FGWN↔SKSj.Here, we have achievedG8.FromM7and R6, we gainS41:FGWN⊲〈FGWN↔SKSj,rs〉xj.FromS41, A5, and R1, we gain S42:FGWN|≡Sj|∼FGWN↔SKSj,rs.FromS42 and R3, we gain S43:FGWN|≡Sj|∼FGWN↔SKSj.FromA2, R2, and SK=hru′‖rfg‖rs‖IDfg, we gain S44:FGWN|≡#SK.FromS43, S44, R2, and R4, we gain S45:FGWN|≡Sj|≡FGWN↔SKSj.Here, we have achievedG6.FromA13, S45, and R5, we gain S46:FGWN|≡FGWN↔SKSj.So, we have also achievedG5.FromM8and R6, we know S47:Ui⊲FGWN↔SKUi,rfg,rsxg.FromS47, A4, and R1, we get S48:Ui|≡FGWN|∼FGWN↔SKUi,rfg,rs.FromS48 and R3, we get S49:Ui|≡FGWN|∼FGWN↔SKUi.FromA1, R2, and SK=hru′‖rfg‖rs‖IDfg, we get S50:Ui|≡#SK.FromS49, S50, R2, and R4, we get S51:Ui|≡FGWN|≡FGWN↔SKUi.So,G2 has been gained.FromS51, A12, and R5, we get S52:Ui|≡FGWN↔SKUi. So, G1 has been also obtained.Consequently, all security goals are amply demonstrated, both in Case 1 and in Case 2. In the meantime, it also confirms that the communication participants (Ui, HGWN/FGWN, and Sj), can authenticate mutually and negotiate a common key successfully.


## 5.3. Formal Analysis Based on BPR Model

Theorem 1.
For the protocolP, assuming that, in a polynomial time t, Amakes up to qsSendΠI∗,mqueries, qeExcuteΠUi,ΠHGWNk,ΠSjqueries, and qhoracle queries. Let D represent the password space subject to Zipf distribution, wherein C′and s′are Zipf parameters; let l denote the output length of hash functions. Now, we can get(8)AdvPAKEA≤2C′qss′+qs2l−1+qh22l+qs+qe2p−1.Proof.
Five gamesGii=0,1,2,3,and4are considered to demonstrate Theorem 1, and simulation process of each game is analysed as below, wherein Siindicates an event that A outputs the right random bit b in Gi, where i=0,1,2,3,and4.G0: it simulates a true attack under the random oracle model. A has the ability to access all oracles; so according Definition 1, we have(9)AdvPAKEA=2PrS0−1.G1: it maintains two lists, LHand LM, respectively, recording oracle queries and communications during the execution of P. Besides, all other queries are run as the actual protocol. In G1, A launches the passive attack to intercept all messages Mjj=1,2,3,4through Excute∗query and then guesses the output result of TestΠI∗query. Due to the impossibility of figuring out SK=hru‖rhg‖rs‖IDhg, the advantage of a successful attack does not increase for A, so we can get(10)PrS1=PrS0.G2: here, A can make SendΠI∗,mqueries and ℋqueries to convince the true communicator of forged messages. Only when A happens to find some collisions and succeeds in constructing credible messages, the simulation terminates. In G2, two kinds of collisions may be contained: output collisions of hash functions and collisions of random numbers selected in P. According to Birthday Paradox [30], the probabilities of their occurrence are qh2/2l+1 and qs+qe2/2p−1, respectively. Therefore, we obtain(11)PrS2−PrS1≤qh22l+1+qs+qe22p−1.G3: this game differs from the above games in the case that when A can guess the correct authentication factors D3, D6, D8, and D13without ℋ queries, the simulation terminates. It is indistinguishable from the previous games except that some instance refuses the right authentication. Thus, we have(12)PrS3−PrS2≤qs2l.G4: in this game, A has abilities to reach more information through CorruptΠUi,a query.(i)
A queries CorruptΠUi,1, which means he has got the user’s password and parameters stored in SC. Then, in qsSendΠI∗,m queries, A succeeds in guessing αiwith the length lα, the possibility of which is qs/2lα.(ii)
A queries CorruptΠUi,2, that is, A has accessed the user’s biometric factors and parameters stored in SC. Then, in qsSendΠI∗,mqueries, A succeeds in guessing the victim’s password, the possibility of which is C′qss′.(iii)
A queries CorruptΠUi,3; similarly, A has the user’s password and biometric factors. Then, the possibility of A guessing the right xi is qs/2l.
G4 and G3 are indistinguishable unless the above attack is successful. So, we have(13)PrS4−PrS3≤maxqs2lα,C′qss′,qs2l=C′qss′.
WhenA has no efficient input to make queries to ℋ, there is no advantage to distinguish the real SK from a random number with the same size through TestΠI∗. Therefore,(14)PrS4=12.
From (2)–(7), we can draw conclusion (1) or (8); this is(15)AdvPAKEA=2|PrS4−PrS0|≤2C′qss′+qs2l−1+qh22l+qs+qe2p−1.


## 6. Performance Comparison

In this section, the proposed protocol is compared with several existing multifactor authentication protocols in terms of performance, involving security features, computation overhead, and storage costs. Specific comparison results and analysis are described as follows.


### 6.1. Security Features

On the basis of the security 12-Criteria, Table3 presents the comparison results of these diverse authentication protocols, i.e., Guo et al. [22], Wu et al. [20], Srinivas et al. [21], Amin [19], and our proposed protocol. Definitely, the proposed protocol can satisfy all 12 evaluation criteria whereas others can meet 8 pieces at most. In particular, the new protocol in this paper exclusively provides the repairability and forward security, as well as resistance against stolen smart card attack. The protocol presented by Guo et al. [22] has weaknesses in no repairability, improper treatment of biometric features, and offline password guessing attack; the protocol of Wu et al. [20] cannot resist insider attack, stolen smart card attack, and offline password guessing attack; the protocol proposed by Srinivas et al. [21] does not protect against insider attack and offline password guessing attack and ensure that the user will be not traced; Amin’s protocol [19] does not provide resistance to insider attack and guarantee of untraceability of the user. Furthermore, none of these protocols, except the proposed one, implements forward secrecy.Table 3
Comparison of security features.
C1C2C3C4C5C6C7C8C9C10C11C12Guo et al. [22]✓✓✓✓××✓✓×✓✓×Wu et al. [20]✓✓××××✓××✓✓×Srinivas et al. [21]✓✓××✓×✓××✓××Amin [19]✓✓××××✓××✓××Ours✓✓✓✓✓✓✓✓✓✓✓✓“✓” means the protocol satisfies this property; “×,” the opposite.It should be noted that, the 12 security evaluation criteria was proposed by Wang and Wang [24]: C1 for no password verifier-table; C2 for password-friendly; C3 for no password exposure; C4 for no smart card loss attack; C5 for resistance to known attacks; C6 for sound repairability; C7 for provision of key agreement; C8 for no clock synchronization; C9 for timely typo detection; C10 for mutual authentication; C11 for user anonymity; C12 for forward secrecy.


### 6.2. Computation Overhead

In this section, we compare the computation overhead among the above relevant schemes. In reality, login and authentication are much more frequent than registration, thus the performance of authentication and key-agreement protocols depends primarily on the computational costs of login and authentication phases. As depicted in Table4, the proposed scheme is more computationally expensive than other schemes at the user side. This happens unsurprisingly because that fuzzy extractor is employed in this paper to extract and verify the biometric features, which is more applicable for high security systems. As for the gateways and resource-constrained sensor nodes, the computational costs are nearly the same. At any side, the schemes proposed by Wu et al. [20] and Amin [19] have the least computational overhead as they trade low safety features for high efficiency. In summary, despite other schemes outperforming in computational complexity, the proposed scheme can protect against all security threats faced by other schemes, which is more feasible in the real world.Table 4
Comparison of computation overhead.
Guo et al. [22]Wu et al. [20]Srinivas et al. [21]Amin [19]OursUiCase 113Th9Th10Th7Th13Th+TfeCase 218Th11Th14Th8Th15Th+TfeHGWNCase 117Th11Th14Th8Th18ThCase 210Th7Th6Th1Th11ThFGWNCase 100000Case 214Th7Th17Th7Th12ThSjCase 16Th4Th7Th5Th6ThCase 26Th4Th6Th5Th6ThTotalCase 136Th24Th31Th20Th37Th+TfeCase 248Th29Th43Th21Th44Th+Tfe


### 6.3. Storage Costs

Comparison of storage costs among the proposed scheme and other relevant schemes is stated in this section, see Table5and Figure 5. Primarily, it is recommended that 32 bits for the (pseudo-) identity, 160 bits for the hash output, 128 bits for the fuzzy extractor public data, and 128 bits for a random number, as well as 32 bits for a timestamp are agreed, and these parameters are denoted separately as LID, Lh, Lfe, Lr, and LT. As shown in Figure 5, storage overhead on the user and sensor nodes sides is nearly the same, but that on the gateway nodes is higher as in the proposed scheme; smart card logout is achieved with the assistance of honey_list saving in gateway nodes’ memories. However, in terms of storage capacity, gateway nodes are much better than smart cards and sensor nodes, thus the overhead is acceptable.Table 5
Comparison of storage costs.
Guo et al. [22]Wu et al. [20]Srinivas et al. [21]Amin [19]OursSCLID+3Lh+LrLID+3Lh+LrLID+4Lh2LID+3Lh+Lr2LID+3Lh+LfeHGWN/FGWN3LID+2Lr3LID+2Lr4LID+Lr+LT4LID+Lr+Lh3LID+4Lr+LhSj2LID+Lh2LID+LhLID+Lh+LTLID+LhLID+LhFigure 5
Comparison of storage costs.


## 6.1. Security Features

On the basis of the security 12-Criteria, Table3 presents the comparison results of these diverse authentication protocols, i.e., Guo et al. [22], Wu et al. [20], Srinivas et al. [21], Amin [19], and our proposed protocol. Definitely, the proposed protocol can satisfy all 12 evaluation criteria whereas others can meet 8 pieces at most. In particular, the new protocol in this paper exclusively provides the repairability and forward security, as well as resistance against stolen smart card attack. The protocol presented by Guo et al. [22] has weaknesses in no repairability, improper treatment of biometric features, and offline password guessing attack; the protocol of Wu et al. [20] cannot resist insider attack, stolen smart card attack, and offline password guessing attack; the protocol proposed by Srinivas et al. [21] does not protect against insider attack and offline password guessing attack and ensure that the user will be not traced; Amin’s protocol [19] does not provide resistance to insider attack and guarantee of untraceability of the user. Furthermore, none of these protocols, except the proposed one, implements forward secrecy.Table 3
Comparison of security features.
C1C2C3C4C5C6C7C8C9C10C11C12Guo et al. [22]✓✓✓✓××✓✓×✓✓×Wu et al. [20]✓✓××××✓××✓✓×Srinivas et al. [21]✓✓××✓×✓××✓××Amin [19]✓✓××××✓××✓××Ours✓✓✓✓✓✓✓✓✓✓✓✓“✓” means the protocol satisfies this property; “×,” the opposite.It should be noted that, the 12 security evaluation criteria was proposed by Wang and Wang [24]: C1 for no password verifier-table; C2 for password-friendly; C3 for no password exposure; C4 for no smart card loss attack; C5 for resistance to known attacks; C6 for sound repairability; C7 for provision of key agreement; C8 for no clock synchronization; C9 for timely typo detection; C10 for mutual authentication; C11 for user anonymity; C12 for forward secrecy.


## 6.2. Computation Overhead

In this section, we compare the computation overhead among the above relevant schemes. In reality, login and authentication are much more frequent than registration, thus the performance of authentication and key-agreement protocols depends primarily on the computational costs of login and authentication phases. As depicted in Table4, the proposed scheme is more computationally expensive than other schemes at the user side. This happens unsurprisingly because that fuzzy extractor is employed in this paper to extract and verify the biometric features, which is more applicable for high security systems. As for the gateways and resource-constrained sensor nodes, the computational costs are nearly the same. At any side, the schemes proposed by Wu et al. [20] and Amin [19] have the least computational overhead as they trade low safety features for high efficiency. In summary, despite other schemes outperforming in computational complexity, the proposed scheme can protect against all security threats faced by other schemes, which is more feasible in the real world.Table 4
Comparison of computation overhead.
Guo et al. [22]Wu et al. [20]Srinivas et al. [21]Amin [19]OursUiCase 113Th9Th10Th7Th13Th+TfeCase 218Th11Th14Th8Th15Th+TfeHGWNCase 117Th11Th14Th8Th18ThCase 210Th7Th6Th1Th11ThFGWNCase 100000Case 214Th7Th17Th7Th12ThSjCase 16Th4Th7Th5Th6ThCase 26Th4Th6Th5Th6ThTotalCase 136Th24Th31Th20Th37Th+TfeCase 248Th29Th43Th21Th44Th+Tfe


## 6.3. Storage Costs

Comparison of storage costs among the proposed scheme and other relevant schemes is stated in this section, see Table5and Figure 5. Primarily, it is recommended that 32 bits for the (pseudo-) identity, 160 bits for the hash output, 128 bits for the fuzzy extractor public data, and 128 bits for a random number, as well as 32 bits for a timestamp are agreed, and these parameters are denoted separately as LID, Lh, Lfe, Lr, and LT. As shown in Figure 5, storage overhead on the user and sensor nodes sides is nearly the same, but that on the gateway nodes is higher as in the proposed scheme; smart card logout is achieved with the assistance of honey_list saving in gateway nodes’ memories. However, in terms of storage capacity, gateway nodes are much better than smart cards and sensor nodes, thus the overhead is acceptable.Table 5
Comparison of storage costs.
Guo et al. [22]Wu et al. [20]Srinivas et al. [21]Amin [19]OursSCLID+3Lh+LrLID+3Lh+LrLID+4Lh2LID+3Lh+Lr2LID+3Lh+LfeHGWN/FGWN3LID+2Lr3LID+2Lr4LID+Lr+LT4LID+Lr+Lh3LID+4Lr+LhSj2LID+Lh2LID+LhLID+Lh+LTLID+LhLID+LhFigure 5
Comparison of storage costs.


## 7. Conclusion

WSNs are becoming increasingly vital in IoT applications. Inevitably, multifactor and multigateway authentication protocols have become a focus. In this paper, through analysing weaknesses in the existing schemes, we introduced the widely accepted criteria for evaluating security protocols. In line with the criteria, we revisited Guo et al.’s scheme and found some security flaws, i.e., no repairability, improper treatment of biometric factors, offline password guessing, and no forward secrecy. Then, we proposed a new three-factor authentication protocol for multiple gateways using fuzzy extractor and honey_list technique. Following that, we proved the correctness and security of the proposed scheme by BAN logic and BPR model. As a whole, our proposed scheme outperformed other relevant schemes for keeping efficient in performance, meanwhile satisfying the security criteria.



---

*Source: 3300769-2021-06-22.xml*