# An Anonymous Access Authentication Scheme Based on Proxy Ring Signature for CPS-WMNs

Authors: Tianhan Gao; Quanqi Wang; Xiaojie Wang; Xiaoxue Gong
Journal: Mobile Information Systems
 (2017)

---

## Abstract

Access security and privacy have become a bottleneck for the popularization of future Cyber-Physical System (CPS) networks. Furthermore, users’ need for privacy-preserved access during movement procedure is more urgent. To address the anonymous access authentication issue for CPS Wireless Mesh Network (CPS-WMN), a novel anonymous access authentication scheme based on proxy ring signature is proposed. A hierarchical authentication architecture is presented first. The scheme is then achieved from the aspect of intergroup and intragroup anonymous mutual authentication through proxy ring signature mechanism and certificateless signature mechanism, respectively. We present a formal security proof of the proposed protocol with SVO logic. The simulation and performance analysis demonstrate that the proposed scheme owns higher efficiency and adaptability than the typical one.


---

## Body

## 1. Introduction

With the prosperous development of mobile communication and versatile mobile devices [1, 2] and the diversification of the network environment [3–5], the requirement of accessing ubiquitous network becomes more and more imperative for Cyber-Physical Systems (CPS) [6]. Owing to the advantages of low cost, expansible, self-healing, fine mobility support, and high efficiency, Wireless Mesh Network (WMN) is regarded as a critical accessing technology of the next generation CPS network [7, 8]. As for the open nature of transmission medium free users’ movement, as well as the multihop transmission method, WMN suffers from security issues in both wired and wireless environment. Efficient and secure access authentication technology forms the baseline of CPS-WMN’s security. Moreover, user’s privacy should also be preserved during the access authentication process. Thus, the security and privacy in CPS-WMNs become the research focus recently [9].In the past few years, a lot of researches have been carried out for WMN’s access authentication. The authors in [10] present an efficient identity-based authentication scheme for WMN using tickets, which avoids multihop wireless communications in order to minimize the authentication delay, while in a complex network environment, with the increasing number of MRs, handover authentication efficiency decreases. The authors of [11] propose an authentication scheme for WMN based on EAP-TLS, although the scheme offers mutual authentication and robustness against malicious attacks. But the asymmetric cryptography mechanisms result in high computation cost. The author [12] improves the access control function of IEEE 802.1X by the port operation so that user may acquire message through the dynamic channel under current or previous access point. However, the requirement of keeping the channel alive during the authentication procedure limits the adaptability of the scheme. Some distributed authentication schemes to reduce the authentication delay have been discussed in [13], while the scheme performs poorly when handling multiple mobile users. A symmetric key generation scheme based on hierarchical multivariable function for WMN is presented in [14], which achieves efficient mutual authentication and key generation for entities, whereas the scheme is not suitable for the scenario when the network users grow rapidly. The identity information of mobile users is divided into critical information and noncritical information that the critical information is only visible to the mobile user and his/her group manager in [15]. With the help of improved short ring signature mechanism and special binding policy, the scheme is able to provide anonymity during authentication. However, the key escrow problem is inevitable since the private key is generated by the group manager. In general, the literature WMN access authentication schemes suffer from security, privacy, efficiency, and adaptability issues. The needs of an efficient and anonymous authentication scheme for CPS-WMNs are impending.In terms of the security issues shown above, an anonymous authentication scheme based on proxy ring signature is proposed in this paper. The scheme utilizes a high-efficient proxy ring signature mechanism to achieve proxy-authorization and anonymous authentication which are able to preserve mobile users’ privacy. In addition, certificateless signature mechanism is incorporated into our intragroup authentication to obtain high handover efficiency. The formal security proof based on SVO logic and other security analyses show that the proposed scheme possesses such advantages as reliability, anonymity, unforgeability, and reliability. Through the simulation and performance analysis, we demonstrate the efficiency and adaptability of our scheme.The rest of this paper is organized as follows. Section2 briefly describes the related preliminaries. Section 3 elaborates the proposed anonymous mutual authentication scheme. Sections 4 and 5 present the security and performance analysis of the scheme, respectively. Finally, we make a conclusion of the scheme and discuss the future research work in Section 6.


## 2. Preliminaries

### 2.1. Bilinear Pairing

LetG be an additive group and let GT be a multiplicative group of the same prime order q and IGT is the generator of GT. Assume that the discrete logarithm problem is hard on both G and GT [16]. A mapping e: G×G→GT which satisfies the following properties is called bilinear pairing:(1)
Bilinearity: for allP,Q∈G and ,b∈Zq∗, e(aP,bQ)=e(bP,aQ)=e(P,Q)ab.(2)
Nondegeneracy: there existsP,Q∈G, so that e(P,Q)≠IGT.(3)
Computability: for allP,Q∈G, there is an efficient algorithm to compute e(P,Q)∈GT.


### 2.2. BB1 Encryption

BB1 [17], nonadaptive selective-ID encryption, was presented by Boneh and Franklin in 2003. The BB1 works as follows.(
1) BB1-Setup. Given a security parameter k∈Zq∗, the algorithm works as the following steps.Step 1.
RunG on input k to generate a prime q, two cycle groups (G1,+), (G2,×) of order q, and an admissible bilinear pairing e:G1×G1→G2. Choose a random generator ∈G1.Step 2.
Pick a randoms∈Zq∗ and set Ppub=sP.Step 3.
Choose a cryptographic hash functionH1:0,1∗→G1. Choose a cryptographic hash function H2:G2→0,1n for some n. The message space is M=0,1n. The ciphertext space is C=G1×0,1n. The system parameters are {H1,H2,G1,G2,q,e,P,Ppub}. The master key is s∈Zq∗.
(
2) BB1-Extract. For a given string ID∈0,1∗, compute QID=H1(ID)∈G1 and set the private key dID to be dID=sQID.
(
3) BB1-Encrypt. To encrypt m∈M under the public key ID, compute QID=H1(ID)∈G1, choose a random r∈Zq∗, and set the ciphertext to be C=〈rP,m⊕H2(gIDr)〉, where gID=e(QID,Ppub).(
4) BB1-Decrypt. Let c=〈U,V〉∈C be a ciphertext encrypted using the public key ID. To decrypt c using the private key dID∈G1, compute m=V⊕H2(e(dID,U)).


### 2.3. Certificateless Signature

Certificateless signature (CLS) [18] allows that users’ private key is comprised by the key issued by system and the secret generated by user. In addition, users’ public key is conducted by their own secret which avoids key escrow problem. The CLS scheme is mainly used in the Intra-WMN authentication in this paper. The algorithms of CLS [18] are shown as follows.(
1) CLS-Setup. Given security parameterl, prime q≥2l, (G1,+), and (G2,×) are cycle groups of order q. Three hash functions are as follows: H1:{0,1}∗→G1, H2:{0,1}∗×G1→G1, and H3:{0,1}∗×G1×G2→Zq∗. Private key generator (PKG) chooses s∈Zq∗ as private key and generates system public key P0 = sP, where P is the generator of G1. Let g=e(P,P); system public parameters Param = (G1,G2,e,q,P,P0,g,H1,H2,H3).(
2) CLS-Extract-sk. User A sends identity IDA∈{0,1}∗ to PKG. After authenticating IDA, PKG generates partial private key of A:DA=sH1(IDA).(
3) CLS-Gen-sk. A chooses xA∈Zq∗ as secret. A’s private key is (xA,DA).(
4) CLS-Gen-pk. A computes PA=xAP as A’s public key.(
5) CLS-Sign. A signs message m∈0,1∗, and outputs σ={U,δ} through following steps:(a)
Chooser∈Zq∗ and calculate U=gr.(b)
V=H2(IDA∥PA).(c)
h=H3(m∥U∥IDA∥PA).(d)
δ=rP-h(DA+xAV).(
6) CLS-Verify. Verifier B uses P0,PA,IDA to verify the signature σ={U,δ}.(a)
ComputeV=H2(IDA∥PA) and h=H3(m∥U∥IDA∥PA).(b)
Check if the equationU=e(δ,P)(e(H1(IDA),P0)e(PAV))h is hold. If yes, σ is valid; otherwise, σ is invalid.


### 2.4. Proxy Ring Signature

Proxy ring signature (PRS) [19] allows an original signer delegate authorization to a group of signers in which every member in the group can represent the original signer to sign the message and is able to keep anonymous. In this paper, we incorporate proxy ring signature into the access authentication process of WMN, which not only achieves mutual authentication between mobile user and accessed network but also solves the problem of privacy preserving for mobile user. The algorithms of PRS are as follows.(
1) PRS-Setup. Given secure parameter K as system input and the output is (G1,G2,q,e,P). G1 is a cyclic additive group generated by the generator P, whose order is prime q, and G2 is a cyclic multiplicative group of the same prime order of q. e:G1×G1→G2 is a bilinear pairing map. In addition, there are two hash functions: H0:{0,1}∗×G1→Zq∗ and H1:{0,1}∗→G1.(
2) PRS-Generation. Original signer O chooses x0∈Zq∗ as the private key and calculates the public key Yo=xoP. ui belonging to proxy signer group U randomly chooses private key xi∈Zq∗ and calculates the public key Yi=xiP.(
3) PRS-Delegation. O generates a warrant mω which includes the descriptions of the relationship between O and proxy signer. O chooses a random number r∈Zq∗, calculates R=rp, s=r+xoHo(mω,R) mod q, and then sends (mω,R,s) to the group U={u1,…,un} of proxy signers.(
4) PRS-Verify-Auth. After receiving (mω,R,s), each proxy signer μi checks sP=?R+YoHo(mω,R) mod q. If the verification fails, the authorization will be rejected. Otherwise, ui calculates his own proxy signing key pski=s+xiHo(mω,R) mod q.(
5) PRS-Sign. The proxy signer us signs message m∈{0,1}∗ as follows:(a)
For alli∈{1,2,…,n} and i≠s, choose a random number ri∈Zq∗ and calculate δi=riP.(b)
Calculateδs=1/psks(H1(m∥mω)-∑i≠sri(R+Ho(mω,R)(Yo+Yi)).(c)
Sendδ=(δ1,δ2,…,δn,m,mω,R) to the verifier.(
6) PRS-Verify-Sign. After receiving δ from the proxy signer, the verifier checks if the following equation holds with the public key Y0,Y1,…,Yn:(1)∏i=1neR+H0mω,RYo+Yi,δi=?eP,H1m∥mω.If yes, δ is valid. Otherwise, δ is invalid.


## 2.1. Bilinear Pairing

LetG be an additive group and let GT be a multiplicative group of the same prime order q and IGT is the generator of GT. Assume that the discrete logarithm problem is hard on both G and GT [16]. A mapping e: G×G→GT which satisfies the following properties is called bilinear pairing:(1)
Bilinearity: for allP,Q∈G and ,b∈Zq∗, e(aP,bQ)=e(bP,aQ)=e(P,Q)ab.(2)
Nondegeneracy: there existsP,Q∈G, so that e(P,Q)≠IGT.(3)
Computability: for allP,Q∈G, there is an efficient algorithm to compute e(P,Q)∈GT.


## 2.2. BB1 Encryption

BB1 [17], nonadaptive selective-ID encryption, was presented by Boneh and Franklin in 2003. The BB1 works as follows.(
1) BB1-Setup. Given a security parameter k∈Zq∗, the algorithm works as the following steps.Step 1.
RunG on input k to generate a prime q, two cycle groups (G1,+), (G2,×) of order q, and an admissible bilinear pairing e:G1×G1→G2. Choose a random generator ∈G1.Step 2.
Pick a randoms∈Zq∗ and set Ppub=sP.Step 3.
Choose a cryptographic hash functionH1:0,1∗→G1. Choose a cryptographic hash function H2:G2→0,1n for some n. The message space is M=0,1n. The ciphertext space is C=G1×0,1n. The system parameters are {H1,H2,G1,G2,q,e,P,Ppub}. The master key is s∈Zq∗.
(
2) BB1-Extract. For a given string ID∈0,1∗, compute QID=H1(ID)∈G1 and set the private key dID to be dID=sQID.
(
3) BB1-Encrypt. To encrypt m∈M under the public key ID, compute QID=H1(ID)∈G1, choose a random r∈Zq∗, and set the ciphertext to be C=〈rP,m⊕H2(gIDr)〉, where gID=e(QID,Ppub).(
4) BB1-Decrypt. Let c=〈U,V〉∈C be a ciphertext encrypted using the public key ID. To decrypt c using the private key dID∈G1, compute m=V⊕H2(e(dID,U)).


## 2.3. Certificateless Signature

Certificateless signature (CLS) [18] allows that users’ private key is comprised by the key issued by system and the secret generated by user. In addition, users’ public key is conducted by their own secret which avoids key escrow problem. The CLS scheme is mainly used in the Intra-WMN authentication in this paper. The algorithms of CLS [18] are shown as follows.(
1) CLS-Setup. Given security parameterl, prime q≥2l, (G1,+), and (G2,×) are cycle groups of order q. Three hash functions are as follows: H1:{0,1}∗→G1, H2:{0,1}∗×G1→G1, and H3:{0,1}∗×G1×G2→Zq∗. Private key generator (PKG) chooses s∈Zq∗ as private key and generates system public key P0 = sP, where P is the generator of G1. Let g=e(P,P); system public parameters Param = (G1,G2,e,q,P,P0,g,H1,H2,H3).(
2) CLS-Extract-sk. User A sends identity IDA∈{0,1}∗ to PKG. After authenticating IDA, PKG generates partial private key of A:DA=sH1(IDA).(
3) CLS-Gen-sk. A chooses xA∈Zq∗ as secret. A’s private key is (xA,DA).(
4) CLS-Gen-pk. A computes PA=xAP as A’s public key.(
5) CLS-Sign. A signs message m∈0,1∗, and outputs σ={U,δ} through following steps:(a)
Chooser∈Zq∗ and calculate U=gr.(b)
V=H2(IDA∥PA).(c)
h=H3(m∥U∥IDA∥PA).(d)
δ=rP-h(DA+xAV).(
6) CLS-Verify. Verifier B uses P0,PA,IDA to verify the signature σ={U,δ}.(a)
ComputeV=H2(IDA∥PA) and h=H3(m∥U∥IDA∥PA).(b)
Check if the equationU=e(δ,P)(e(H1(IDA),P0)e(PAV))h is hold. If yes, σ is valid; otherwise, σ is invalid.


## 2.4. Proxy Ring Signature

Proxy ring signature (PRS) [19] allows an original signer delegate authorization to a group of signers in which every member in the group can represent the original signer to sign the message and is able to keep anonymous. In this paper, we incorporate proxy ring signature into the access authentication process of WMN, which not only achieves mutual authentication between mobile user and accessed network but also solves the problem of privacy preserving for mobile user. The algorithms of PRS are as follows.(
1) PRS-Setup. Given secure parameter K as system input and the output is (G1,G2,q,e,P). G1 is a cyclic additive group generated by the generator P, whose order is prime q, and G2 is a cyclic multiplicative group of the same prime order of q. e:G1×G1→G2 is a bilinear pairing map. In addition, there are two hash functions: H0:{0,1}∗×G1→Zq∗ and H1:{0,1}∗→G1.(
2) PRS-Generation. Original signer O chooses x0∈Zq∗ as the private key and calculates the public key Yo=xoP. ui belonging to proxy signer group U randomly chooses private key xi∈Zq∗ and calculates the public key Yi=xiP.(
3) PRS-Delegation. O generates a warrant mω which includes the descriptions of the relationship between O and proxy signer. O chooses a random number r∈Zq∗, calculates R=rp, s=r+xoHo(mω,R) mod q, and then sends (mω,R,s) to the group U={u1,…,un} of proxy signers.(
4) PRS-Verify-Auth. After receiving (mω,R,s), each proxy signer μi checks sP=?R+YoHo(mω,R) mod q. If the verification fails, the authorization will be rejected. Otherwise, ui calculates his own proxy signing key pski=s+xiHo(mω,R) mod q.(
5) PRS-Sign. The proxy signer us signs message m∈{0,1}∗ as follows:(a)
For alli∈{1,2,…,n} and i≠s, choose a random number ri∈Zq∗ and calculate δi=riP.(b)
Calculateδs=1/psks(H1(m∥mω)-∑i≠sri(R+Ho(mω,R)(Yo+Yi)).(c)
Sendδ=(δ1,δ2,…,δn,m,mω,R) to the verifier.(
6) PRS-Verify-Sign. After receiving δ from the proxy signer, the verifier checks if the following equation holds with the public key Y0,Y1,…,Yn:(1)∏i=1neR+H0mω,RYo+Yi,δi=?eP,H1m∥mω.If yes, δ is valid. Otherwise, δ is invalid.


## 3. Anonymous Mutual Authentication Scheme

### 3.1. Hierarchical Mobile Network Architecture

As shown in Figure1, a hierarchical mobile network architecture is designed for CPS-WMNs. In the first level, Trusted Root (TR), as original signer who can delegate signing right to proxy signers, is creditable to all of the network entities. In the second level, there are many WMNs that each one can be regarded as a group of proxy signers including Gateway (GW), Mesh Routers (MRs), and mobile Mesh Clients (MCs). MC is able to handover across different WMNs or between different MRs in the same WMN. To achieve mutual authentication between MC and visiting network based on PRS, we build the group of proxy rings for network entities in terms of the hierarchical mobile network architecture shown above. Assuming that a group of the proxy ring (abbreviated as a ring) is composed of GW, MRs (connected with the GW), and MCs (connected with the MRs). We denote ring ID as RIDi in Figure 1 (RID1 means ring 1 and RID2 means ring 2). GW takes the role of a manager of the ring and is responsible for managing and maintaining the members in the ring.Figure 1
Hierarchical mobile network architecture for CPS-WMNs.The symbols used sections are shown in Table1.Table 1
Symbols and descriptions.
Symbols
Descriptions
R
I
D
i
Ringi’s identification
P
K
X
/
S
K
X
The public/private key of entityX
Param
System parameters
W
r
i
The warrant for the members in ringi
A
u
t
h
X
The authorization of proxy signature forX
K
X
-
Y
The session key betweenX and Y
E
n
c
_
K
{
M
}
Using symmetric keyK to encrypt message M
E
N
C
R
_
A
L
G
_
P
K
X
{
M
}
Using algorithm ALG andXs public key PKX to encrypt message M
S
I
G
N
_
A
L
G
_
S
K
X
{
M
}
Using algorithm ALG to sign messageM with X’s signing key SKX
T
S
i
The current timestamp
M
1
∥
M
2
Concatenation of messagesM1 and M2


### 3.2. Trust Model

As shown in Figure2, the trust model is presented according to the mobile network architecture. TR is trusted by all the entities. GW in different CPS-WMNs does not trust each other. Moreover, different MR belonging to the same GW does not own trust relationship, the same as the MRs in different CPS-WMNs. In addition, we assume that GW is trusted by the MR which is connected to itself. MC only trusts the MR in its home CPS-WMN. The main objective of our proposed scheme is to set up the trust relationship between MC and the accessed MR during MC’s roaming.Figure 2
Trust model.


### 3.3. System Initialization

As the trusted root, TR generates Param and broadcasts it to all entities. Param ={G1,G2, e:G1×G1→G2, P∈G1, PKTR=sP, H1:0,1∗→G1, H2:0,1∗×G1→Zq∗, g=(P,P)}, where q is the order of G1 and G2 and s is the master key of TR. All entities’ public key in the ring should be delivered to TR. In addition, GW generates the ring’s public and private keys through random choosing of SK_Ri∈Zq∗ as the private key; the corresponding public key is PK_Ri=SK_Ri·P.PK_Ri is shared by all the members in the ring, while SK_Ri is only allocated to the legitimate members who are authenticated by TR in system initialization phrase.


### 3.4. Inter-WMN Authentication Protocol

When MC wants to leave the WMN it belonged to and accesses another WMN, the MC needs to achieve mutual Inter-WMN authentication with the visiting WMN. As shown in Figure1, when the MC in WMN1 wants to access WMN2 and connect to MR2, MC triggers mutual authentication with MR2. The mutual authentication details are shown in Figure 3.Figure 3
The workflow of Inter-WMN authentication protocol.(
1)
M
R
2
→
M
C
:
P
K
G
W
2
,
P
K
M
R
2. MR2 broadcasts PKMR2 and PKGW2 to MC. MC executes PRS-Verify-auth to verify PKGW2.(
2)
M
C
→
M
R
2
:
δ
1
,
c
2
,
T
S
1
,
R
I
D
1. MC calculates c1=ENCR_BB1_PKGW2{ga}, c2=ENCR_BB1_PKMR2{c1}, and δ1=SIGN_PRS_SKMC{TS1}, where ga∈G1 is the parameter for session key negotiation and TS1 is the current timestamp. MC sends δ1, c2, TS1, and RID1 to MR2.(
3)
M
R
2
→
G
W
2
:
c
1
,
P
K
M
R
2
,
R
I
D
1. After receiving (2) from MC, MR2 checks the freshness of TS1. If fresh, MR2 decrypts c2 to obtain c1. MR2 then sends c1, RID1, and PKMR2 to GW2. Meanwhile, MR2 utilizes PRS-Verify-sign to verify δ1 through requesting the ring members public key from TR in terms of RID1. If δ1 is valid, MC is regarded as a legal user.(
4)
G
W
2
→
M
R
2
:
c
3
,
A
u
t
h
M
R
2
,
g
b. After receiving (3) from MR2, GW2 decrypts c1 to obtain ga, choose gb∈G1 and generate the warrant Wr2=skGW2H1(IDr2), where skGW2 is GW2’s private key. GW2 computes AUTHMR2=skGW2H1(PKMR2), session key KGW2-MC=gab, and c3=Enc_KGW2-MC{Wr2}. GW2 then sends c3,AuthMR2, and gb to MR2. Finally, GW2 stores KGW2-MC.(
5)
M
R
2
→
M
C
:
c
3
,
A
u
t
h
M
R
2
,
g
b. MR2 relays c3, AuthMR2, and gb to MC when getting (4) from GW2.After receiving (5) from MR2, MC calculates session key KMC-GW2=gab to decrypt c3 for obtaining Wr2. MC checks eP,AuthMR2=?e(PKGW2,H1(PKMR2)), if equal, MC makes sure to access a legal WMN. MC then calculates U=gr and V=H2(RID2∥PK_R2), where r∈Zq∗. MC stores U, V, and KMC-GW2.


### 3.5. Intra-WMN Authentication Protocol

After finishing Inter-WMN authentication, MC will obtainWr2 issued by GW. When MC moves from one MR to another in the same WMN, we use CLS [14] to achieve efficient Intra-WMN authentication. As shown in Figure 1, assuming that MC and MR2 finished Inter-WMN authentication, when MC wants to move from MR2 to MR3, the Intra-WMN authentication protocol is triggered as shown in Figure 4.Figure 4
The workflow of Intra-WMN authentication protocol.(
1)
M
R
3
→
M
C
:
P
K
M
R
3
,
P
K
G
W
3. MR3 broadcasts PKMR3 and PKGW2 to MC.(
2)
M
C
→
M
R
3
:
δ
2
,
P
K
_
R
2
,
T
S
2
,
R
I
D
2. MC calculates h=H2(TS2∥U∥RID2∥PK_R2) and δ2=rP-h(Wr2+SK_R2V), where U and V are generated and stored in the process of Inter-WMN authentication. TS2 is the current timestamp. MC sends TS2, δ2, PK_R2, and RID2 to MR3.(
3)
M
R
3
→
G
W
2
:
I
D
M
R
3. After receiving (2) from MC, MR3 checks the freshness of TS2. If fresh, MR3 adopts CLS-Verify to verify δ2. If δ2 is valid, MC is regarded as a legal user. MR3 then sends IDMR3 to GW2.(
4)
G
W
2
→
M
R
3
:
C
4. After receiving IDMR3, GW2 uses the previously saved key KGW2-MC to encrypt IDMR3 to produce the ciphertext C4. Then, GW2 sends C4 to MR3.(
5)
M
R
3
→
M
C
:
C
4. MR3 relays C4 to MC after getting (4) from GW2.MC uses the previously saved keyKGW2-MC to decrypt C4. If the decryption is successful, MC makes sure to access a legal MR.


## 3.1. Hierarchical Mobile Network Architecture

As shown in Figure1, a hierarchical mobile network architecture is designed for CPS-WMNs. In the first level, Trusted Root (TR), as original signer who can delegate signing right to proxy signers, is creditable to all of the network entities. In the second level, there are many WMNs that each one can be regarded as a group of proxy signers including Gateway (GW), Mesh Routers (MRs), and mobile Mesh Clients (MCs). MC is able to handover across different WMNs or between different MRs in the same WMN. To achieve mutual authentication between MC and visiting network based on PRS, we build the group of proxy rings for network entities in terms of the hierarchical mobile network architecture shown above. Assuming that a group of the proxy ring (abbreviated as a ring) is composed of GW, MRs (connected with the GW), and MCs (connected with the MRs). We denote ring ID as RIDi in Figure 1 (RID1 means ring 1 and RID2 means ring 2). GW takes the role of a manager of the ring and is responsible for managing and maintaining the members in the ring.Figure 1
Hierarchical mobile network architecture for CPS-WMNs.The symbols used sections are shown in Table1.Table 1
Symbols and descriptions.
Symbols
Descriptions
R
I
D
i
Ringi’s identification
P
K
X
/
S
K
X
The public/private key of entityX
Param
System parameters
W
r
i
The warrant for the members in ringi
A
u
t
h
X
The authorization of proxy signature forX
K
X
-
Y
The session key betweenX and Y
E
n
c
_
K
{
M
}
Using symmetric keyK to encrypt message M
E
N
C
R
_
A
L
G
_
P
K
X
{
M
}
Using algorithm ALG andXs public key PKX to encrypt message M
S
I
G
N
_
A
L
G
_
S
K
X
{
M
}
Using algorithm ALG to sign messageM with X’s signing key SKX
T
S
i
The current timestamp
M
1
∥
M
2
Concatenation of messagesM1 and M2


## 3.2. Trust Model

As shown in Figure2, the trust model is presented according to the mobile network architecture. TR is trusted by all the entities. GW in different CPS-WMNs does not trust each other. Moreover, different MR belonging to the same GW does not own trust relationship, the same as the MRs in different CPS-WMNs. In addition, we assume that GW is trusted by the MR which is connected to itself. MC only trusts the MR in its home CPS-WMN. The main objective of our proposed scheme is to set up the trust relationship between MC and the accessed MR during MC’s roaming.Figure 2
Trust model.


## 3.3. System Initialization

As the trusted root, TR generates Param and broadcasts it to all entities. Param ={G1,G2, e:G1×G1→G2, P∈G1, PKTR=sP, H1:0,1∗→G1, H2:0,1∗×G1→Zq∗, g=(P,P)}, where q is the order of G1 and G2 and s is the master key of TR. All entities’ public key in the ring should be delivered to TR. In addition, GW generates the ring’s public and private keys through random choosing of SK_Ri∈Zq∗ as the private key; the corresponding public key is PK_Ri=SK_Ri·P.PK_Ri is shared by all the members in the ring, while SK_Ri is only allocated to the legitimate members who are authenticated by TR in system initialization phrase.


## 3.4. Inter-WMN Authentication Protocol

When MC wants to leave the WMN it belonged to and accesses another WMN, the MC needs to achieve mutual Inter-WMN authentication with the visiting WMN. As shown in Figure1, when the MC in WMN1 wants to access WMN2 and connect to MR2, MC triggers mutual authentication with MR2. The mutual authentication details are shown in Figure 3.Figure 3
The workflow of Inter-WMN authentication protocol.(
1)
M
R
2
→
M
C
:
P
K
G
W
2
,
P
K
M
R
2. MR2 broadcasts PKMR2 and PKGW2 to MC. MC executes PRS-Verify-auth to verify PKGW2.(
2)
M
C
→
M
R
2
:
δ
1
,
c
2
,
T
S
1
,
R
I
D
1. MC calculates c1=ENCR_BB1_PKGW2{ga}, c2=ENCR_BB1_PKMR2{c1}, and δ1=SIGN_PRS_SKMC{TS1}, where ga∈G1 is the parameter for session key negotiation and TS1 is the current timestamp. MC sends δ1, c2, TS1, and RID1 to MR2.(
3)
M
R
2
→
G
W
2
:
c
1
,
P
K
M
R
2
,
R
I
D
1. After receiving (2) from MC, MR2 checks the freshness of TS1. If fresh, MR2 decrypts c2 to obtain c1. MR2 then sends c1, RID1, and PKMR2 to GW2. Meanwhile, MR2 utilizes PRS-Verify-sign to verify δ1 through requesting the ring members public key from TR in terms of RID1. If δ1 is valid, MC is regarded as a legal user.(
4)
G
W
2
→
M
R
2
:
c
3
,
A
u
t
h
M
R
2
,
g
b. After receiving (3) from MR2, GW2 decrypts c1 to obtain ga, choose gb∈G1 and generate the warrant Wr2=skGW2H1(IDr2), where skGW2 is GW2’s private key. GW2 computes AUTHMR2=skGW2H1(PKMR2), session key KGW2-MC=gab, and c3=Enc_KGW2-MC{Wr2}. GW2 then sends c3,AuthMR2, and gb to MR2. Finally, GW2 stores KGW2-MC.(
5)
M
R
2
→
M
C
:
c
3
,
A
u
t
h
M
R
2
,
g
b. MR2 relays c3, AuthMR2, and gb to MC when getting (4) from GW2.After receiving (5) from MR2, MC calculates session key KMC-GW2=gab to decrypt c3 for obtaining Wr2. MC checks eP,AuthMR2=?e(PKGW2,H1(PKMR2)), if equal, MC makes sure to access a legal WMN. MC then calculates U=gr and V=H2(RID2∥PK_R2), where r∈Zq∗. MC stores U, V, and KMC-GW2.


## 3.5. Intra-WMN Authentication Protocol

After finishing Inter-WMN authentication, MC will obtainWr2 issued by GW. When MC moves from one MR to another in the same WMN, we use CLS [14] to achieve efficient Intra-WMN authentication. As shown in Figure 1, assuming that MC and MR2 finished Inter-WMN authentication, when MC wants to move from MR2 to MR3, the Intra-WMN authentication protocol is triggered as shown in Figure 4.Figure 4
The workflow of Intra-WMN authentication protocol.(
1)
M
R
3
→
M
C
:
P
K
M
R
3
,
P
K
G
W
3. MR3 broadcasts PKMR3 and PKGW2 to MC.(
2)
M
C
→
M
R
3
:
δ
2
,
P
K
_
R
2
,
T
S
2
,
R
I
D
2. MC calculates h=H2(TS2∥U∥RID2∥PK_R2) and δ2=rP-h(Wr2+SK_R2V), where U and V are generated and stored in the process of Inter-WMN authentication. TS2 is the current timestamp. MC sends TS2, δ2, PK_R2, and RID2 to MR3.(
3)
M
R
3
→
G
W
2
:
I
D
M
R
3. After receiving (2) from MC, MR3 checks the freshness of TS2. If fresh, MR3 adopts CLS-Verify to verify δ2. If δ2 is valid, MC is regarded as a legal user. MR3 then sends IDMR3 to GW2.(
4)
G
W
2
→
M
R
3
:
C
4. After receiving IDMR3, GW2 uses the previously saved key KGW2-MC to encrypt IDMR3 to produce the ciphertext C4. Then, GW2 sends C4 to MR3.(
5)
M
R
3
→
M
C
:
C
4. MR3 relays C4 to MC after getting (4) from GW2.MC uses the previously saved keyKGW2-MC to decrypt C4. If the decryption is successful, MC makes sure to access a legal MR.


## 4. Security Analysis of the Proposed Scheme

In order to prove the security of our scheme, we first take a fundamental security analysis. Then we choose SVO logic [20] to analyze the proposed protocols. SVO logic was presented by Syverson and van Oorshot in 1994 based on BAN logic, GNY logic, AT logic, and VO logic [21]. SVO holds the features of complete semantics, expansibility, and practicality.


### 4.1. Fundamental Security Analysis

According to the mobile network architecture shown in Figure1, we will first present fundamental security analysis of the proposed scheme in the following aspects: anonymity, unforgeability, and reliability.Anonymity. During Inter-WMN authentication, the accessed network checks the legality of MC through verifying the signature σ1=SIGN_PRS_SKMC{TS1} offered by MC. The accessed network is able to know the ring where MC comes from but cannot tell the real identity of MC since it is hidden in the ring. So the anonymity of MC is guaranteed. In addition, when handover occurred, accessed network verifies the certificateless signature σi=rP-h(Wri+SK_RiV) to authenticate MC. In this paper, the proposed scheme adopts enhanced certificateless signature mechanism: V=H2(RIDi∥PK_Ri), h=H2(TS2∥U∥RIDi∥PK_Ri), and σi=rP-h(Wri+SK_RiV). Thus, with the help of the ring, the identity of MC is also kept private to achieve anonymity.Unforgeability. Firstly, only TR can calculate the authority for the proxy group. If the adversary does not know TR’s private key, he fails to compute the legal authority. Secondly, the only legal proxy signer can generate legal proxy ring signature. If the adversary cannot obtain the authority, he cannot generate the legal signature. Thus, the proxy ring signature is unforgeable. Finally, only trusted GW can issue Wri to foreign MC, if the adversary does not know GW’s private key for certificateless signature, the legal cannot be computed. Moreover, if the adversary cannot obtain the other part of the private key SK_Ri, the legal certificateless signature also cannot be computed. Consequently, certificateless signature is unforgeable based on the security of related entity’s private key.Reliability. In Inter-WMN authentication, if adversary does not know the BB1 secret key of GW2, then c1=ENCR_BB1_PKGW2{ga} cannot be decrypted. The adversary thus cannot negotiate the correct key with MC. So GW2 is legal. Likewise, if adversary does not know MR2BB1_SK, he fails to decrypt c2=ENCR_BB1_PKMR2{c1} to obtain c1, thus MR2 is legal. Furthermore, the legal proxy ring signature cannot be generated since adversary does not know MCPRS_SK, so the Inter-WMN authentication protocol is reliable. In addition, during Intra-WMN authentication, adversary fails to generate legal signature σ2, if he cannot obtain Wr2, then MC is thus legal.


### 4.2. Security Proof of the Proposed Protocols under SVO

SVO logic is not only semantic sound, but also convenient. In terms of our scheme, SVO owns advantages over other logic analysis methods in the following aspects: (1) The axioms in SVO can be adjusted or expanded easily to meet the security proof needs rather than BAN or other logical approaches. (2) SVO is detailed and legible which helps to accurately express the actual meaning of the protocol and thus avoid the misunderstandings. (3) SVO is rigorous and reliable, and the semantics is clear. We first give the grammatical components of SVO logic as follows.P believes X: indicating that P believes that proposition is right.P received X: indicating that P received the message including X.P says X: indicating that P sends a message including X.P controls X: indicating that P is a trusted authority on X.P sees X: indicating that P possesses message X.fresh(X): indicating that X is random number generated in running scheme.P↔KQ: indicating that K is a key shared exclusively by P and Q.{X}K: indicating that the ciphertext is output by encrypting X through key.[X]K: indicating that the message is generated by signing X through key.PKσ(A,K): indicating that K is the public signature verification key associated with principal A.PKδ(A,K): indicating that K is the key agreement key associated with principal A.PKψ(A,K): indicating that K is the public encryption key associated with principal A.SV(X,K,Y): indicating that given signed message X, applying K to it as a signature verification key verifies Y as the message signed with the corresponding private key.SVO logic includes two initial rules and twenty axioms, part of which are regular axioms and others are axiom templates that include formula variables. We only present part of the axioms used in the following security proof. All the axioms can be found in [20].Two inference rules are as follows:(1)
Modus ponens MP:φ and φ⊃ψ infer ψ(2)
Necessitation Nec:⊢φ infer ⊢P believes φφ and ψ are metalinguistic symbols used to refer to arbitrary formula. ⊢ is a metalinguistic symbol. ⊢φ means that φ is a theorem.There are twenty SVO axioms. We list only several axioms associated with this article. For any principalP, Q and formula φ, ψ:(A1)
P believes φ and P believes (φ⊃ψ)⊃P believes ψ(A2)
PKσ(Q,K) and R received X∧SV(X,K,Y)⊃Q says Y(A3)
P received (X1,…,Xn)⊃p received Xi(A4)
P received {X}K and P sees K-1⊃PreceivedXIn SVO, some generic goals should be satisfied. This does not mean a definitive list of the goals that our protocol should meet. In our paper, we should achieve the mutual authentication between MC and MR. For this purpose, we just need that MR and MC could make sure of the legality for each other. So on the basis of the generic goals, we make the appropriate modifications. The goals of Inter-WMN authentication protocol could be described as follows.(G1′)
MR believesTS1Ks-1(G2′)
MC believesHPKMRKGW-1SVO Logic Initial Assumptions
(P1)
MC believesPKσ(S,Ks)
(P2)
MC believes SV(TS1Ks-1,Ks,TS1)
(P3)
MC believes fresh(TS1)
(P4)
MR believes (MC says(TS1,RIDi)⊃TS1)
(P5)
MR believes MC saysTS1⊃MC says TS1
(P6)
MR believes MR received∗1KGWKMR,∗2,RIDi,∗3∗4
(P7)
MR believes MR received∗1KGWKMR,∗2,RIDi,[∗3]∗4⊃MR received ∗1KGWKMR, TS1, RIDi, TS1Ks-1
(P8)
GW believesPKσ(GW,KGW)
(P9)
GW believesSV([H(PKMR)]KGW-1,KGW,H(PKMR))
(P10)
MC believes (GW says(H(PKMR))⊃H(PKPKMR))
(P11)
MC believes GW saysH(PKMR)⊃GW says H(PKMR)
(P12)
MC believes MC received{∗5KGW-1}KGW-MC,∗6,[∗7]∗8
(P13)
MC believes MC received{[∗5]KGW-1}KGW-MC,∗6,[∗7]∗8⊃MC received {[∗5]KGW-1}KGW-MC,gb,[H(PKMR)]KGW-1WhereKs is the public key for proxy signer and TS1 is the current timestamp, ∗i means the part that subject cannot understand. The proof is as follows.From (P6), (A1), (A3), and Nec, we have(2)MR  believes  MR  received∗3∗4.From (2), (P7), (A1), (A3), and Nec, we have(3)MR  believes  MR  receivedTS1Ks-1.From (P5), (P1), (P2), (3), (A1), (A2), and Nec, we have(4)MR  believes  MC  saysTS1Ks-1.From (4), (P4), and (A1), we have the following.MR believesTS1Ks-1;(G1′) is then proved. In the same way as above, we can get(5)GW  believesTS1Ks-1.From (P12), (A1), (A3), and Nec, we have(6)MC  believes  MC  received∗7∗8.From (6), (P13), (A1), (A3), and Nec, we have(7)MC  believes  MC  receivedHPKMRKGW-1.From (P11), (P8), (P9), (7), (A1), (A2), and Nec we have(8)MC  believes  GW  saysHPKMRKGW-1.From (8), (P10), and (A1), we have the following.MC believesHPKMRKGW-1;(G2′) is thus proved.Similar to Inter-WMN authentication protocol, the goal of Intra-WMN authentication is also mutual authentication between MR and MC. The difference is that the MR is in MC’s accessed WMN. The security proof of Intra-WMN authentication protocol is described as follows:(G3′)
MR believesTS2KMC-1(G4′)
MC believesHPKMRKGW-1SVO Logic Initial Assumptions
(P14)
MC believesPKσ(MC,KMC)
(P15)
MC believes SV(TS2Ks-1,Ks,TS2)
(P16)
MC believes fresh(TS2)
(P17)
MR believes (MC says(TS2,RIDi)⊃TS2)
(P18)
MR believes MC saysTS2⊃MC says TS2
(P19)
MR believes MR receivedPKσ(Wri,KWri),∗1,RIDi,∗2KMC-1
(P20)
MR believes MR received MR receivedPKσ(Wri,KWri),∗1,RIDi,∗2KMC-1⊃MR received PKσ(Wri,KWri),TS2,RIDi,TS2KMC-1
(P21)
GW believesPKσ(GW,KGW)
(P22)
GW believes SV([H(PKMR)]KGW-1,KGW,H(PKMR))
(P23)
MC believes (GW says(H(PKMR))⊃H(PKPKMR))
(P24)
MC believes GW saysH(PKMR)⊃GW says HPKMR
(P25)
MC believes MC received{[∗3]∗4}
(P26)
MC believes MC received{∗3∗4⊃MC received HPKMRKGW-1}WhereTS2 is the current timestamp, ∗i means the part that subject cannot understand. The proving process is shown as follows.From (P19), (A1), (A3), and Nec, we have(9)MR  believes  MR  received∗2KMC-1.From (9), (P20), (A1), (A3), and Nec, we have(10)MR  believes  MR  receivedTS2KMC-1.From (P18), (P14), (P15), (10), (A1), (A2), and Nec, we have(11)MR  believes  MC  saysTS2KMC-1.From (11), (P17), and (A1), we have the following.GR believesTS2KMC-1;(G3′) is proved.From (P25), (A1), (A3), and Nec, we have(12)MC  believes  MC  received∗3∗4.From (12), (P26), (A1), (A3), and Nec, we have(13)MC  believes  MC  receivedHPKMRKGW-1.From (P24), (P21), (P22), (13), (A1), (A2), and Nec, we have(14)MC  believes  GW  saysHPKMRKGW-1.From (14), (P23), and (A1), we have the following.MC believesHPKMRKGW-1;(G4′) is thus proved.


## 4.1. Fundamental Security Analysis

According to the mobile network architecture shown in Figure1, we will first present fundamental security analysis of the proposed scheme in the following aspects: anonymity, unforgeability, and reliability.Anonymity. During Inter-WMN authentication, the accessed network checks the legality of MC through verifying the signature σ1=SIGN_PRS_SKMC{TS1} offered by MC. The accessed network is able to know the ring where MC comes from but cannot tell the real identity of MC since it is hidden in the ring. So the anonymity of MC is guaranteed. In addition, when handover occurred, accessed network verifies the certificateless signature σi=rP-h(Wri+SK_RiV) to authenticate MC. In this paper, the proposed scheme adopts enhanced certificateless signature mechanism: V=H2(RIDi∥PK_Ri), h=H2(TS2∥U∥RIDi∥PK_Ri), and σi=rP-h(Wri+SK_RiV). Thus, with the help of the ring, the identity of MC is also kept private to achieve anonymity.Unforgeability. Firstly, only TR can calculate the authority for the proxy group. If the adversary does not know TR’s private key, he fails to compute the legal authority. Secondly, the only legal proxy signer can generate legal proxy ring signature. If the adversary cannot obtain the authority, he cannot generate the legal signature. Thus, the proxy ring signature is unforgeable. Finally, only trusted GW can issue Wri to foreign MC, if the adversary does not know GW’s private key for certificateless signature, the legal cannot be computed. Moreover, if the adversary cannot obtain the other part of the private key SK_Ri, the legal certificateless signature also cannot be computed. Consequently, certificateless signature is unforgeable based on the security of related entity’s private key.Reliability. In Inter-WMN authentication, if adversary does not know the BB1 secret key of GW2, then c1=ENCR_BB1_PKGW2{ga} cannot be decrypted. The adversary thus cannot negotiate the correct key with MC. So GW2 is legal. Likewise, if adversary does not know MR2BB1_SK, he fails to decrypt c2=ENCR_BB1_PKMR2{c1} to obtain c1, thus MR2 is legal. Furthermore, the legal proxy ring signature cannot be generated since adversary does not know MCPRS_SK, so the Inter-WMN authentication protocol is reliable. In addition, during Intra-WMN authentication, adversary fails to generate legal signature σ2, if he cannot obtain Wr2, then MC is thus legal.


## 4.2. Security Proof of the Proposed Protocols under SVO

SVO logic is not only semantic sound, but also convenient. In terms of our scheme, SVO owns advantages over other logic analysis methods in the following aspects: (1) The axioms in SVO can be adjusted or expanded easily to meet the security proof needs rather than BAN or other logical approaches. (2) SVO is detailed and legible which helps to accurately express the actual meaning of the protocol and thus avoid the misunderstandings. (3) SVO is rigorous and reliable, and the semantics is clear. We first give the grammatical components of SVO logic as follows.P believes X: indicating that P believes that proposition is right.P received X: indicating that P received the message including X.P says X: indicating that P sends a message including X.P controls X: indicating that P is a trusted authority on X.P sees X: indicating that P possesses message X.fresh(X): indicating that X is random number generated in running scheme.P↔KQ: indicating that K is a key shared exclusively by P and Q.{X}K: indicating that the ciphertext is output by encrypting X through key.[X]K: indicating that the message is generated by signing X through key.PKσ(A,K): indicating that K is the public signature verification key associated with principal A.PKδ(A,K): indicating that K is the key agreement key associated with principal A.PKψ(A,K): indicating that K is the public encryption key associated with principal A.SV(X,K,Y): indicating that given signed message X, applying K to it as a signature verification key verifies Y as the message signed with the corresponding private key.SVO logic includes two initial rules and twenty axioms, part of which are regular axioms and others are axiom templates that include formula variables. We only present part of the axioms used in the following security proof. All the axioms can be found in [20].Two inference rules are as follows:(1)
Modus ponens MP:φ and φ⊃ψ infer ψ(2)
Necessitation Nec:⊢φ infer ⊢P believes φφ and ψ are metalinguistic symbols used to refer to arbitrary formula. ⊢ is a metalinguistic symbol. ⊢φ means that φ is a theorem.There are twenty SVO axioms. We list only several axioms associated with this article. For any principalP, Q and formula φ, ψ:(A1)
P believes φ and P believes (φ⊃ψ)⊃P believes ψ(A2)
PKσ(Q,K) and R received X∧SV(X,K,Y)⊃Q says Y(A3)
P received (X1,…,Xn)⊃p received Xi(A4)
P received {X}K and P sees K-1⊃PreceivedXIn SVO, some generic goals should be satisfied. This does not mean a definitive list of the goals that our protocol should meet. In our paper, we should achieve the mutual authentication between MC and MR. For this purpose, we just need that MR and MC could make sure of the legality for each other. So on the basis of the generic goals, we make the appropriate modifications. The goals of Inter-WMN authentication protocol could be described as follows.(G1′)
MR believesTS1Ks-1(G2′)
MC believesHPKMRKGW-1SVO Logic Initial Assumptions
(P1)
MC believesPKσ(S,Ks)
(P2)
MC believes SV(TS1Ks-1,Ks,TS1)
(P3)
MC believes fresh(TS1)
(P4)
MR believes (MC says(TS1,RIDi)⊃TS1)
(P5)
MR believes MC saysTS1⊃MC says TS1
(P6)
MR believes MR received∗1KGWKMR,∗2,RIDi,∗3∗4
(P7)
MR believes MR received∗1KGWKMR,∗2,RIDi,[∗3]∗4⊃MR received ∗1KGWKMR, TS1, RIDi, TS1Ks-1
(P8)
GW believesPKσ(GW,KGW)
(P9)
GW believesSV([H(PKMR)]KGW-1,KGW,H(PKMR))
(P10)
MC believes (GW says(H(PKMR))⊃H(PKPKMR))
(P11)
MC believes GW saysH(PKMR)⊃GW says H(PKMR)
(P12)
MC believes MC received{∗5KGW-1}KGW-MC,∗6,[∗7]∗8
(P13)
MC believes MC received{[∗5]KGW-1}KGW-MC,∗6,[∗7]∗8⊃MC received {[∗5]KGW-1}KGW-MC,gb,[H(PKMR)]KGW-1WhereKs is the public key for proxy signer and TS1 is the current timestamp, ∗i means the part that subject cannot understand. The proof is as follows.From (P6), (A1), (A3), and Nec, we have(2)MR  believes  MR  received∗3∗4.From (2), (P7), (A1), (A3), and Nec, we have(3)MR  believes  MR  receivedTS1Ks-1.From (P5), (P1), (P2), (3), (A1), (A2), and Nec, we have(4)MR  believes  MC  saysTS1Ks-1.From (4), (P4), and (A1), we have the following.MR believesTS1Ks-1;(G1′) is then proved. In the same way as above, we can get(5)GW  believesTS1Ks-1.From (P12), (A1), (A3), and Nec, we have(6)MC  believes  MC  received∗7∗8.From (6), (P13), (A1), (A3), and Nec, we have(7)MC  believes  MC  receivedHPKMRKGW-1.From (P11), (P8), (P9), (7), (A1), (A2), and Nec we have(8)MC  believes  GW  saysHPKMRKGW-1.From (8), (P10), and (A1), we have the following.MC believesHPKMRKGW-1;(G2′) is thus proved.Similar to Inter-WMN authentication protocol, the goal of Intra-WMN authentication is also mutual authentication between MR and MC. The difference is that the MR is in MC’s accessed WMN. The security proof of Intra-WMN authentication protocol is described as follows:(G3′)
MR believesTS2KMC-1(G4′)
MC believesHPKMRKGW-1SVO Logic Initial Assumptions
(P14)
MC believesPKσ(MC,KMC)
(P15)
MC believes SV(TS2Ks-1,Ks,TS2)
(P16)
MC believes fresh(TS2)
(P17)
MR believes (MC says(TS2,RIDi)⊃TS2)
(P18)
MR believes MC saysTS2⊃MC says TS2
(P19)
MR believes MR receivedPKσ(Wri,KWri),∗1,RIDi,∗2KMC-1
(P20)
MR believes MR received MR receivedPKσ(Wri,KWri),∗1,RIDi,∗2KMC-1⊃MR received PKσ(Wri,KWri),TS2,RIDi,TS2KMC-1
(P21)
GW believesPKσ(GW,KGW)
(P22)
GW believes SV([H(PKMR)]KGW-1,KGW,H(PKMR))
(P23)
MC believes (GW says(H(PKMR))⊃H(PKPKMR))
(P24)
MC believes GW saysH(PKMR)⊃GW says HPKMR
(P25)
MC believes MC received{[∗3]∗4}
(P26)
MC believes MC received{∗3∗4⊃MC received HPKMRKGW-1}WhereTS2 is the current timestamp, ∗i means the part that subject cannot understand. The proving process is shown as follows.From (P19), (A1), (A3), and Nec, we have(9)MR  believes  MR  received∗2KMC-1.From (9), (P20), (A1), (A3), and Nec, we have(10)MR  believes  MR  receivedTS2KMC-1.From (P18), (P14), (P15), (10), (A1), (A2), and Nec, we have(11)MR  believes  MC  saysTS2KMC-1.From (11), (P17), and (A1), we have the following.GR believesTS2KMC-1;(G3′) is proved.From (P25), (A1), (A3), and Nec, we have(12)MC  believes  MC  received∗3∗4.From (12), (P26), (A1), (A3), and Nec, we have(13)MC  believes  MC  receivedHPKMRKGW-1.From (P24), (P21), (P22), (13), (A1), (A2), and Nec, we have(14)MC  believes  GW  saysHPKMRKGW-1.From (14), (P23), and (A1), we have the following.MC believesHPKMRKGW-1;(G4′) is thus proved.


## 5. Simulation and Performance Analysis

CPS-WMN has limited resource in the computation ability of nodes and operating bandwidth, so the performance of authentication scheme plays an important role in the practicability of CPS-WMNs. The simulation and performance analysis focus on the efficiency of system initialization and the handover process. In addition, in order to demonstrate the high efficiency of our scheme, we give a comparison analysis between our scheme and PEACE [15].


### 5.1. Simulation Environment

We do simulations for PRS and PEACE using OMNET++ (4.4) simulation platform to get average results based on 20-time experiments. In the process of bilinear group instantiation, we use Tate pairing in the MNT curve [22].As shown in Figure5, the initial topological structure of simulation environment is composed of one TR, two GWs, three APs, and one host. These nodes are arranged in a 420 m 300 m simulation space according to the hierarchical network architecture. The TR generates initial parameters for the system. The wireless covering radius is 100 m. AP represents MR, whose covering radius is 45 m. TR, GW, and AP are fixed nodes. Host represents MC, which will take a movement from coordinate (10,250) to coordinate (400,250) by speed 1 m/s. During this process, host firstly accesses the coverage of AP1 and triggers the Inter-WMN authentication. Then, host leaves AP1 to AP2 and the Inter-WMN authentication takes place again. When host moves on from AP2 to AP3, the Intra-WMN authentication protocol should be executed. The details of the parameters and values are shown in Table 2.(1)
The internal structure of the network node shown in Figure6.(2)
Wlan and eth module: implementation of ethernet and 802.11 capabilities.(3)
NetworkLayer: to achieve network-level functions and as the interface of upper and lower layer.(4)
TCPapp: template for TCP applications.(5)
RoutingTable: the table of routing status.(6)
InterfaceTable: the table of network interfaces.(7)
NotificationBoard: notification about “events” such as wireless handovers.Table 2
Parameters and values.
Parameters
Values
Scenario area
420 m × 300 m
Number of nodes
7
Routing protocol
AODV
MAC protocol
IEEE 802.11
Channel
Wireless channel
Simulation time
480 S
Packet length
512 bytes
Node energy
1 JFigure 5
Simulation network topology.Figure 6
Node internal structure.


### 5.2. Performance Analysis of System Initialization

The delay of system initialization is the period from the simulation start to the first movement of the host. The relationship between the number of nodes and system initialization delay is shown in Figure7, where the number of nodes could be adjusted as needed. The system initialization includes authorization from original signer to proxy signers, the public key registration for ring members, and the generation of public and private keys for the ring members. Figure 6 shows that the delay of system initialization would increase with the increasing network scale.Figure 7
Relationship between system initialization delay and the number of nodes.


### 5.3. Performance Analysis of Authentication Protocols

In this section, we focus on the delay of Inter-WMN authentication and Intra-WMN authentication. The delay of Inter-WMN authentication means the period from AP receiving an access requirement of a new host to the end of Inter-WMN authentication. The delay of Intra-WMN authentication is the period from AP receiving a handover requirement of a host to the end of Intra-WMN authentication.Figure8 shows the relationship between the number of ring members and the delay of access authentication scheme. From the result we can see that the efficiency of Intra-WMN authentication is higher than that of Inter-WMN authentication with the increasing number of ring members. During Inter-WMN authentication, the main cost is from verifying the proxy ring signature. For the use of high-efficient ring setup policy, the verifier could acquire all ring members’ public keys from TR at once, which help to reduce the delay of communication. In addition, in the process of Intra-WMN authentication, the utilization of certificateless signature makes the scheme independent of the number of ring members that would not lead to obvious delay.Figure 8
Relationship between authentication delay and the number of ring members.


### 5.4. The Efficiency Analysis of Intra-WMN Authentication Protocol

As shown in Figure9, we make the comparison analysis of Intra-WMN authentication delay between PRS and PEACE [15]. The delay of PRS is obviously lower than PEACE since PEACE adopts multiple bilinear pairing operations and exponential operations which lead to high computation cost. In the Intra-WMN authentication, we use more efficient certificateless signature which only includes two scalar multiplications in group and one hash operation. Moreover, we just need one bilinear pairing operation, two exponential operations, and one hash operation during the verification process. Thus, the computation cost is obviously reduced in PRS.Figure 9
Comparison of the Intra-WMN authentication delay between PRS and PEACE.In short, the main cost of PRS is from the process of system initialization, while the access authentication delay is obviously dropped down. In addition, the delay of access authentication will not elevate much with the increasing number of nodes in the ring. Although the delay of system initialization increases with the increasing number of ring members, the result of simulation shows that the delay would be controlled in a reasonable range. Comparing to the typical scheme (PEACE), our proposed scheme performs more efficiently, especially during the Intra-WMN authentication.We further compared the computational overhead of PRS scheme and PEACE scheme during the signing and verifying phases. In Table3, BP represents a bilinear mapping operation, SM represents scalar multiplication in G1, E represents exponentiation in G1, and |URL| represents the time of searching revocation list. From the result we can see that PRS performs more efficiently than PEACE in terms of computational overhead.Table 3
Comparison of the computational overhead between PRS and PEACE.
Scheme
Signing algorithm
Verifying algorithm
PEACE
2BP + 8SM
(3 + 2URL) BP + 6SM
Our scheme
1SM + 2E
3BP +E


## 5.1. Simulation Environment

We do simulations for PRS and PEACE using OMNET++ (4.4) simulation platform to get average results based on 20-time experiments. In the process of bilinear group instantiation, we use Tate pairing in the MNT curve [22].As shown in Figure5, the initial topological structure of simulation environment is composed of one TR, two GWs, three APs, and one host. These nodes are arranged in a 420 m 300 m simulation space according to the hierarchical network architecture. The TR generates initial parameters for the system. The wireless covering radius is 100 m. AP represents MR, whose covering radius is 45 m. TR, GW, and AP are fixed nodes. Host represents MC, which will take a movement from coordinate (10,250) to coordinate (400,250) by speed 1 m/s. During this process, host firstly accesses the coverage of AP1 and triggers the Inter-WMN authentication. Then, host leaves AP1 to AP2 and the Inter-WMN authentication takes place again. When host moves on from AP2 to AP3, the Intra-WMN authentication protocol should be executed. The details of the parameters and values are shown in Table 2.(1)
The internal structure of the network node shown in Figure6.(2)
Wlan and eth module: implementation of ethernet and 802.11 capabilities.(3)
NetworkLayer: to achieve network-level functions and as the interface of upper and lower layer.(4)
TCPapp: template for TCP applications.(5)
RoutingTable: the table of routing status.(6)
InterfaceTable: the table of network interfaces.(7)
NotificationBoard: notification about “events” such as wireless handovers.Table 2
Parameters and values.
Parameters
Values
Scenario area
420 m × 300 m
Number of nodes
7
Routing protocol
AODV
MAC protocol
IEEE 802.11
Channel
Wireless channel
Simulation time
480 S
Packet length
512 bytes
Node energy
1 JFigure 5
Simulation network topology.Figure 6
Node internal structure.


## 5.2. Performance Analysis of System Initialization

The delay of system initialization is the period from the simulation start to the first movement of the host. The relationship between the number of nodes and system initialization delay is shown in Figure7, where the number of nodes could be adjusted as needed. The system initialization includes authorization from original signer to proxy signers, the public key registration for ring members, and the generation of public and private keys for the ring members. Figure 6 shows that the delay of system initialization would increase with the increasing network scale.Figure 7
Relationship between system initialization delay and the number of nodes.


## 5.3. Performance Analysis of Authentication Protocols

In this section, we focus on the delay of Inter-WMN authentication and Intra-WMN authentication. The delay of Inter-WMN authentication means the period from AP receiving an access requirement of a new host to the end of Inter-WMN authentication. The delay of Intra-WMN authentication is the period from AP receiving a handover requirement of a host to the end of Intra-WMN authentication.Figure8 shows the relationship between the number of ring members and the delay of access authentication scheme. From the result we can see that the efficiency of Intra-WMN authentication is higher than that of Inter-WMN authentication with the increasing number of ring members. During Inter-WMN authentication, the main cost is from verifying the proxy ring signature. For the use of high-efficient ring setup policy, the verifier could acquire all ring members’ public keys from TR at once, which help to reduce the delay of communication. In addition, in the process of Intra-WMN authentication, the utilization of certificateless signature makes the scheme independent of the number of ring members that would not lead to obvious delay.Figure 8
Relationship between authentication delay and the number of ring members.


## 5.4. The Efficiency Analysis of Intra-WMN Authentication Protocol

As shown in Figure9, we make the comparison analysis of Intra-WMN authentication delay between PRS and PEACE [15]. The delay of PRS is obviously lower than PEACE since PEACE adopts multiple bilinear pairing operations and exponential operations which lead to high computation cost. In the Intra-WMN authentication, we use more efficient certificateless signature which only includes two scalar multiplications in group and one hash operation. Moreover, we just need one bilinear pairing operation, two exponential operations, and one hash operation during the verification process. Thus, the computation cost is obviously reduced in PRS.Figure 9
Comparison of the Intra-WMN authentication delay between PRS and PEACE.In short, the main cost of PRS is from the process of system initialization, while the access authentication delay is obviously dropped down. In addition, the delay of access authentication will not elevate much with the increasing number of nodes in the ring. Although the delay of system initialization increases with the increasing number of ring members, the result of simulation shows that the delay would be controlled in a reasonable range. Comparing to the typical scheme (PEACE), our proposed scheme performs more efficiently, especially during the Intra-WMN authentication.We further compared the computational overhead of PRS scheme and PEACE scheme during the signing and verifying phases. In Table3, BP represents a bilinear mapping operation, SM represents scalar multiplication in G1, E represents exponentiation in G1, and |URL| represents the time of searching revocation list. From the result we can see that PRS performs more efficiently than PEACE in terms of computational overhead.Table 3
Comparison of the computational overhead between PRS and PEACE.
Scheme
Signing algorithm
Verifying algorithm
PEACE
2BP + 8SM
(3 + 2URL) BP + 6SM
Our scheme
1SM + 2E
3BP +E


## 6. Conclusions

Anonymous access authentication is an essential approach to address the security issue of CPS-WMNs. In this paper, we propose a novel anonymous access authentication scheme based on proxy ring signature for CPS-WMNs. The scheme is elaborated with the hierarchical mobile network architecture and the corresponding mutual authentication protocols, which achieve high-efficient mutual authentication and satisfy the privacy requirements. The fundamental security and the security proof of the authentication protocols under SVO logic demonstrate the robustness of our scheme. Moreover, the simulation and performance analysis show that the proposed scheme owns higher efficiency and adaptability than the typical.In our future research, some novel and robust encryption and signature mechanisms will be introduced to make our scheme more resilient. Moreover, how to secure the routing procedure of WMNs under the proposed hierarchical architecture forms another future task.



---

*Source: 4078521-2017-06-04.xml*