# Provably Secure Client-Server Key Management Scheme in 5G Networks

Authors: Lei Yang; Yeh-Cheng Chen; Tsu-Yang Wu
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

The increasing demand for real-time data transmission in wireless mobile communication networks has promoted the maturity of mobile communication technology. Fifth-generation (5G) mobile communication technology is combined with cloud computing, high-frequency signal transmission, and other technologies and perfectly fits with the client-server architecture. 5G has been applied in many fields, such as the interconnection of smart devices, virtual reality, and cloud-based life. To provide the security and availability of the required services, we proposed a key management scheme based on the multiserver architecture of the client-server mode in 5G networks, which uses bilinear pairings and elliptic curve cryptography. Through informal security analysis and formal analysis (under the random oracle model and ProVerif tool), we demonstrated that the proposed scheme can complete mutual authentication and resist common network attacks. Furthermore, after the performance analysis of our scheme and other related schemes, it was found that this scheme has relatively low communication and computation costs and better security performance.


---

## Body

## 1. Introduction

The growth of mobile data has promoted the development of fifth-generation (5G) and sixth-generation (6G) mobile networks [1–4]. The data flow in mobile communication networks is soaring, and early mobile networks cannot meet the needs of users. The 5G network integrates 4G, WiFi, and other networks, providing richer communication modes and a better user experience. Specifically, in the 2G network era, users can only read words; in the 3G network era, users can view pictures; in the 4G network era, users can watch videos; in the 5G network era, users can engage in virtual reality interaction, cloud storage, and smart device interconnection. A content delivery network (CDN), as one of the key technologies of 5G networks, adds an intelligent virtual network based on the traditional network, which can build multiple proxy servers between the users and the source server. This requires the use of the benefits of the multiserver architecture and cloud computing technology to distribute information to users. As an extension of 5G, 6G can connect terrestrial wireless and satellite communications to achieve global coverage and the interconnection of everything. In other words, 5G/6G networks have a high transmission rate, low power consumption, low time delay, and other properties, allowing them to accommodate a large number of Internet of Things (IoT) devices and mobile users.The increase in the electromagnetic wave frequency in 5G/6G networks results in high transmission rates, but it also leads to a reduction in the coverage distance and the deployment of more base stations. Furthermore, the deployment of base stations is related to the scope of network management, in which network security management is the fundamental guarantee for users to use a good network. In addition, as an emerging mobile communication, 5G/6G networks will involve many fields, such as mobile phones, smart homes, automatic driving, and telemedicine. In applications involving IoT [5–9], security has always been a weak link in the network. The management of stored and transmitted information is important. Once the information is disclosed, tampered with, or forged, it will lead to serious consequences. In addition, the client-server-based multiserver architecture overcomes the shortage of resources and long response time of a single server and can provide powerful network data processing capability. Therefore, to solve the security difficulties in network communication and improve user experience, secure authentication schemes for key management and storage based on the multiserver architecture in mobile networks have been proposed. The client-server communication construction in 5G is shown in Figure 1.Figure 1
The client-server communication construction in 5G.In Figure1, every client and server must register with the registration center to obtain a legal identity to communicate in the network. Note that the clients include users and IoT devices. Owing to the powerful storage function of cloud computing technology, each proxy server will have the corresponding backup of the transmitted information. Therefore, in the authentication phase, a legitimate client directly authenticates and confirms the session key with a proxy server without the participation of the third-party source server.In recent years, 5G has gradually developed into the core of mobile communication systems, and its distributed service mechanism is consistent with the multiserver architecture of the client-server mode. Therefore, some researchers have started working on mutual authentication protocols based on multiserver 5G networks. In 2019, Ying and Nayak [10] introduced an anonymous multiserver authentication scheme (MSAS) using self-certified public key cryptography in 5G and declared that their scheme was secure. Unfortunately, Haq et al. [11] found that [10] did not provide untraceability and two-factor security and could not resist offline identity, password guessing attacks, or user impersonation attacks. They then proposed an enhanced MSAS in 5G networks.In this study, we introduced a key management scheme based on the multiserver architecture of the client-server mode in 5G networks. The scheme uses passwords, smart cards, and biometric authentication to provide users with more comprehensive security. Each IoT device has a unique media access control (MAC) address, which we enter as the biometric information of the user:(i)
The research shows that our scheme can guarantee anonymity, perfect forward security, and anti-impersonation attacks, and the smart card is a stolen attack in a multiserver architecture(ii)
In our scheme, users and servers can complete mutual authentication without passing the registration center to avoid the communication load caused by excessive user traffic(iii)
In the random oracle model, we proposed a hypothesis based on the elliptic curve discrete logarithm problem. This reveals that the proposed scheme has a secure mutual authentication process. The informal security analysis and ProVerif tool proof reveal that the proposed scheme can resist common network attacks and has a secure and complete process of generating the session key(iv)
Our protocol has better performance. In a series of related schemes, the proposed scheme has relatively low communication and computation costs. This scheme is more suitable for servers in 5G communication to provide services to usersSome abbreviations used in this paper are shown in Table1. The remainder of this paper is organized as follows. Section 2 introduces the related work. A detailed description of the proposed scheme is provided in Section 3. Section 4 provides a formal and informal security analysis of the proposed scheme. Performance analysis of the schemes is presented in Section 5, and the study is concluded in Section 6.Table 1
Abbreviations.
5GFifth-generationCDNContent delivery networkIoTInternet of ThingsMSASMultiserver authentication schemeMACMedia access controlRORReal-Oracle-Random


## 2. Related Work

The earliest MSAS [12] was aimed at neural networks. Because of the time consumption of training neural networks, numerous enhanced MSASs have been proposed. In the process of remote authentication, it is not realistic to use only passwords. Using a smart card is a particularly effective resolution for user authentication and key management [13–15]. Lin et al. [16] introduced a remote MSAS without a verification table in 2003. Cao and Zhong [17] pointed out that [16] is insecure and exposed to serious user impersonation attacks. In addition, in 2004, Juang [18] pointed out that each user in [16] needs to use a large memory to store relevant parameters, which is not suitable for applications using the smart card. Moreover, [12, 16] do not generate a session key; therefore, there is a certain security risk in the communication process. Therefore, they designed an MSAS using a smart card and password. In the same year, Chang and Lee [19] thought that Juang’s scheme [18] performed significant computation in smart cards; therefore, they proposed an efficient MSAS based on the smart card. In a multiserver environment, multiple servers are required to provide services to users, and providing strong anonymity is more secure for users. In 2009, Liao and Wang [20] introduced a scheme using dynamic identity and smart card authentication and concluded that their scheme met all requirements in an MS environment. However, Hsiang and Shih [21] discovered that [20] cannot resist insider attacks and spoofing attacks. To address the above security loopholes, they submitted an enhanced MSAS using smart cards and dynamic identity.Because passwords and smart cards may be forgotten or lost, human biometrics are added to the design of key management and authentication protocols [22], such as fingerprint, face, and iris. In 2010, Li and Hwang [23] introduced a remote MSAS based on biometrics and smart cards and declared that their scheme can resist masquerade attacks, replay attacks, and smart card stolen attacks and present mutual authentication and nonrepudiation. In 2011, Li et al. [24] found that [23] had some security flaws; that is, they did not provide correct authentication and could not resist man-in-the-middle attacks and impersonation attacks. Further, they submitted an advanced remote MSAS using smart cards and biometrics. To ensure perfect forward security and reduce the computation consumption of smart cards, Yoon and Yoo [25] proposed a distributed MSAS without a verification table based on biometrics and smart cards in 2013. Liao and Hsiao [26] introduced a remote MSAS based on pairing. However, Kim et al. [27] found that [25] could not resist offline password guessing attacks; therefore, an enhanced solution was proposed to overcome this vulnerability. Hsieh and Leu [28] pointed out that [26] would be subject to tracking attacks, and there was no preverification phase. Therefore, they improved the MSAS for mobile users using a self-certified public key. In 2014, Chuang and Chen [29] proposed a lightweight MSAS that guarantees anonymity and claimed that it can resist a variety of attacks. Mishra et al. [30] showed that [29] could not resist impersonation attacks, smart card stolen attacks, and denial of service attacks. They then submitted an enhanced MSAS based on [29]. However, Lu et al. [31] proved that [30] is vulnerable to server impersonation attacks and lacks perfect forward security in 2015. Therefore, they proposed an MSAS based on three factors. In 2016, He et al. [32] introduced an anonymous MSAS using self-certified public key encryption. Li et al. [33] pointed out that [32] would be subject to offline password guessing attacks and impersonation attacks in 2019. Furthermore, they designed a secure MSAS for key management in a cloud computing environment. It is worth noting that Chuang and Tseng [34] proposed a compatible cross-species authentication and key exchange protocol and realized independent authentication and member revocation. To solve the performance problem of low-power clients, Tseng et al. [35] proposed a lightweight identity-based mutual authentication and key exchange protocol for resource-constrained devices. Some important related works are summarized in Table 2.Table 2
Cryptographic techniques and limitations.
SchemeCryptographic techniquesLimitationsYing and Nayak [10](i) Utilized ECC(ii) Utilized a self-certified public key(iii) Based on the Diffie–Hellman problem(i) Does not provide untraceability(ii) Does not provide two-factor security(iii) Does not resist offline identity guessing attacks(iv) Does not resist offline password guessing attacks(v) Does not resist user impersonation attacksYoon and Yoo [25](i) Based on biometrics(ii) Utilized ECC(iii) Based on a smart card(i) Does not resist offline password guessing attacksLiao and Hsiao [26](i) Based on bilinear pairings(ii) Utilized a self-certified public key(iii) Based on the Diffie–Hellman problem(i) Does not resist tracking attacks(ii) Does not provide preverificationChuang and Chen [29](i) Utilized a one-way hash function(ii) Based on biometrics(iii) Based on a smart card(i) Does not resist impersonation attacks(ii) Does not resist smart card stolen attacks(iii) Does not resist denial of service attacksMishra et al. [30](i) Utilized a one-way hash function(ii) Based on biometrics(iii) Based on a smart card(i) Does not resist server impersonation attacks(ii) Does not provide perfect forward securityHe et al. [32](i) Based on bilinear pairings(ii) Utilized a self-certified public key(iii) Based on the Diffie–Hellman problem(i) Does not resist offline password guessing attacks(ii) Does not resist impersonation attacksLi et al. [33](i) Based on bilinear pairings(ii) Based on the Diffie–Hellman problem(iii) Utilized a one-way hash function—Chuang and Tseng [34](i) Based on bilinear pairings(ii) Based on the Diffie–Hellman problem(iii) Utilized a one-way hash function—Tseng et al. [35](i) Based on bilinear pairings(ii) Based on the Diffie–Hellman problem(iii) Utilized a one-way hash function—


## 3. Background and Scheme

### 3.1. Preliminaries

#### 3.1.1. Hash Function

In this section, we will introduce the basics of hash functions. The hash functionH· takes the variable-length data block M as the input to generate a fixed-length hash value h=HM and satisfies the following conditions:
(1)
One-Way. Given h, it is difficult to compute M such that h=HM.(2)
Weak Collision Resistance. Given M1, it is difficult to find M2≠M1 so that HM1=HM2.(3)
Strong Collision Resistance. It is difficult to find M1≠M2 so that HM1=HM2.


#### 3.1.2. Bilinear Pairing

SupposeFn∗ is a finite field on an elliptic curve and n is a large prime number. G1 is an additive cyclic subgroup with P as a generator on Fn∗, and G2 is a multiplication group with n as order. For points P,Q∈G1, the bilinear pairing [33–35] is a mapping, e:G1×G1⟶G2, which has the following properties:
(1)
Bilinear. eaP,bQ=eP,Qab, where a,b∈Fn∗.(2)
Nondegenerate. eP,Q≠1.(3)
Computability. There is an efficient algorithm to compute eP,Q.


### 3.2. Proposed Scheme

We describe a client-server key management scheme in which the client can be a user or an IoT device. The scheme is divided into four phases: initialization, registration phase, time key update phase, and key management phase. The symbols and descriptions of the scheme are listed in Table3.Table 3
Symbols and descriptions.
SymbolDescriptionUiUser and IoT deviceSjServerRCRegistration centerAAdversarySCSmart cardSKUiThe session key ofUiSKSjThe session key ofSjxThe private key of the RCdsjThe private key ofSjBIOUiThe biometrics ofUiGen·/Rep·Fuzzy generator/reproduction functionH·Hash functionHG·Map-to-point hash function∥Connect operation⊕Exclusive or operationΠUxThex-th communication of user UiΠSyThey-th communication of server SjΠRCzThez-th communication of registry RCqhashThe number of times to make theHash queryqsendThe number of times to make theSend queryGMmThem-th gameSuccAGMmξThe event thatA succeeds in the game GMmPrSuccAGMmξThe probability of the eventSuccAGMmξ


#### 3.2.1. Initialization

The RC sets up an elliptic curve and chooses the parameters. RC selects two elliptic curve groupsG1 and G2 with the same order q. Subsequently, RC defines a bilinear pairing e:G1×G1⟶G2 and computes g=eP,P, where P is a generator of G1. RC chooses a random number x as its private key, and Ppub=x·P is the corresponding public key. Finally, RC generates two hash functions, HG· and H·, and publicizes G1,G2,q,P,Ppub,g,HG·,H·.


#### 3.2.2. Registration Phase

To join the system, bothUi and Sj must register with the RC to verify their legality. This phase includes the Ui and Sj registration.(1) Server Registration Phase. The registration steps of Sj are shown as follows:
(1)
ServerSj chooses its identity SIDSj and a random number rsj and computes the public key Psj=grsj. Thereafter, Sj sends Psj,SIDSj to RC via a secure channel(2)
After receipt, RC computesdsj=x·HGSIDSjandPrsj=Psjx⊕dsj and then sends Prsj back to Sj(3)
Sj computes dsj=Prsj⊕Ppubrsj as its private key and then checks if edsj,P=?eHGSIDSj,Ppub. If not equal, Sj rejects messages. If equal, Sj accepts dsj and stores dsj,rsj(4)
RC stores all servers’ status and identitiesSIDSj in a table TabSj(2) User Registration Phase. The registration steps of Ui are shown as follows:
(1)
Ui selects identity IDUi, password PWUi, and biometric BIOUi. Note that the MAC address of an IoT device is the BIOUi. Thereafter, Ui generates a random number rui and computes GenBIOui=θui,σui, VIDui=HIDUi∥rui, FVIDui=VIDui⊕Ppubrui, VPWui=HPWUi∥VIDui∥rui, FVPWui=VPWui⊕Ppubrui, VBIui=Hσui∥rui, FVBIui=VBIui⊕Ppubrui, and Pui=grui and sends IDUi,FVIDui,Pui,FVPWui,FVBIui to RC(2)
Upon receiving, RC computesVPWui=FVPWui⊕Puix, VBIui=FVBIui⊕Puix, VIDui=FVIDui⊕Puix, dui=x·HGVIDui, Vui=HVPWui∥VBIui∥VIDui, and Rsj=edui,HGSIDSj⊕VBIui⊕VPWui. Further, RC creates table TabUi, which includes all servers’ SIDSj, Rsj, Psj, and Table TabSUi, which includes all users’ HIDUi, Pui, and status. Subsequently, RC injects TabUi,Vui to the smart card SC and sends it to Ui(3)
After receiving,Ui computes Eui=rui⊕Hσui. Finally, Ui stores Eui,θui,Pui into SC and deletes the other parametersIn other words, if a new client (including users and IoT devices) wants to join the client-server communication construction in 5G, they need to register with the RC according to the above steps in the user registration phase. After registration, the client can obtain the legal identity and corresponding information and communicate with the server.


#### 3.2.3. Time Key Update Phase

In this phase, the RC checks thestatus of users in TabSUi and dynamically distributes time keys to legitimate users. Communication in this phase occurs in public channels. The details are as follows:
(1)
RC queries thestatus of the user’s HIDUi in TabSUi. When status is “OK,” RC selects a random number bui and adds bui into TabSUi. Thereafter, RC chooses a time-valid period t and computes Bui=gbui, Cui=Puibui, and Tui=HBuiCuit. Further, RC sends Bui,Tui,t to Ui via a public channel(2)
After receiving,Ui inserts their SC, inputs IDUiandBIOUi, and computes σui=RepBIOUi,θui, rui=Eui⊕Hσui, and Cui=Buirui. Subsequently, Ui checks if Tui=?HBuiCuit. If the equation holds, Ui accepts the time key and stores Cui,t into SC


#### 3.2.4. Key Management Phase

Ui inserts SC to log into the system. Subsequently, Ui can authenticate and establish a session key using Sj. The detailed steps are as follows:
(1)
Ui inputs IDUi, PWUi, and BIOUi and inserts their SC. Ui then computes σui=RepBIOui,θui, rui=Eui⊕Hσui, VIDui=HIDUirui, VPWui=HPWUiVIDuirui, and VBIui=Hσuirui and checks if Vui=?HVPWuiVBIuiVIDui. The authorized user Ui logs into the system. Thereafter, the card reader queries TabUi and displays all the server identities SIDSj. Ui selects a server’s SIDSj and chooses a random number α. Further, Ui computes Yui=gα, Qui=Psjrui, Fui=VIDui⊕HYuiSIDSjQui, and V1=HFuiYuiPuiVIDuiCui and sends Fui,Yui,Pui,V1 to Sj(2)
Upon receiving, serverSj computes Qsj=Puirsj, Cui=Puibui, and VIDui′=Fui⊕HYuiSIDSjQsj and checks if V1=?HFuiYuiPuiVIDui′Cui. When the equation holds, Sj generates a random number β and computes esj=edsj,HGVIDui, Ysj=gβ, and V2=HesjYsjYuiVIDuiSIDSjQsj and sends V2,Ysj to Ui(3)
Upon receiving,Ui computes eui=Rsj⊕VPWui⊕VBIui. Subsequently, Ui checks if V2=?HesjYsjYuiVIDuiSIDSjQsj holds. When the equation holds, Ui computes keyui=Ysjα and establishes the session key SKUi=HkeyuiQuiVIDuiSIDSj. Further, Ui computes V3=HSKUiVIDuiSIDSj and sends it to Sj(4)
After receipt,Sj computes keysj=keyuiβ and session key SKSj=HkeysjQsjVIDuiSIDSj. Finally, Sj verifies whether V3=?HSKSjVIDuiSIDSj and accepts the session key when the equation holdsThe key management phase is shown in Figure2.Figure 2
Key management phase.


## 3.1. Preliminaries

### 3.1.1. Hash Function

In this section, we will introduce the basics of hash functions. The hash functionH· takes the variable-length data block M as the input to generate a fixed-length hash value h=HM and satisfies the following conditions:
(1)
One-Way. Given h, it is difficult to compute M such that h=HM.(2)
Weak Collision Resistance. Given M1, it is difficult to find M2≠M1 so that HM1=HM2.(3)
Strong Collision Resistance. It is difficult to find M1≠M2 so that HM1=HM2.


### 3.1.2. Bilinear Pairing

SupposeFn∗ is a finite field on an elliptic curve and n is a large prime number. G1 is an additive cyclic subgroup with P as a generator on Fn∗, and G2 is a multiplication group with n as order. For points P,Q∈G1, the bilinear pairing [33–35] is a mapping, e:G1×G1⟶G2, which has the following properties:
(1)
Bilinear. eaP,bQ=eP,Qab, where a,b∈Fn∗.(2)
Nondegenerate. eP,Q≠1.(3)
Computability. There is an efficient algorithm to compute eP,Q.


## 3.1.1. Hash Function

In this section, we will introduce the basics of hash functions. The hash functionH· takes the variable-length data block M as the input to generate a fixed-length hash value h=HM and satisfies the following conditions:
(1)
One-Way. Given h, it is difficult to compute M such that h=HM.(2)
Weak Collision Resistance. Given M1, it is difficult to find M2≠M1 so that HM1=HM2.(3)
Strong Collision Resistance. It is difficult to find M1≠M2 so that HM1=HM2.


## 3.1.2. Bilinear Pairing

SupposeFn∗ is a finite field on an elliptic curve and n is a large prime number. G1 is an additive cyclic subgroup with P as a generator on Fn∗, and G2 is a multiplication group with n as order. For points P,Q∈G1, the bilinear pairing [33–35] is a mapping, e:G1×G1⟶G2, which has the following properties:
(1)
Bilinear. eaP,bQ=eP,Qab, where a,b∈Fn∗.(2)
Nondegenerate. eP,Q≠1.(3)
Computability. There is an efficient algorithm to compute eP,Q.


## 3.2. Proposed Scheme

We describe a client-server key management scheme in which the client can be a user or an IoT device. The scheme is divided into four phases: initialization, registration phase, time key update phase, and key management phase. The symbols and descriptions of the scheme are listed in Table3.Table 3
Symbols and descriptions.
SymbolDescriptionUiUser and IoT deviceSjServerRCRegistration centerAAdversarySCSmart cardSKUiThe session key ofUiSKSjThe session key ofSjxThe private key of the RCdsjThe private key ofSjBIOUiThe biometrics ofUiGen·/Rep·Fuzzy generator/reproduction functionH·Hash functionHG·Map-to-point hash function∥Connect operation⊕Exclusive or operationΠUxThex-th communication of user UiΠSyThey-th communication of server SjΠRCzThez-th communication of registry RCqhashThe number of times to make theHash queryqsendThe number of times to make theSend queryGMmThem-th gameSuccAGMmξThe event thatA succeeds in the game GMmPrSuccAGMmξThe probability of the eventSuccAGMmξ


### 3.2.1. Initialization

The RC sets up an elliptic curve and chooses the parameters. RC selects two elliptic curve groupsG1 and G2 with the same order q. Subsequently, RC defines a bilinear pairing e:G1×G1⟶G2 and computes g=eP,P, where P is a generator of G1. RC chooses a random number x as its private key, and Ppub=x·P is the corresponding public key. Finally, RC generates two hash functions, HG· and H·, and publicizes G1,G2,q,P,Ppub,g,HG·,H·.


### 3.2.2. Registration Phase

To join the system, bothUi and Sj must register with the RC to verify their legality. This phase includes the Ui and Sj registration.(1) Server Registration Phase. The registration steps of Sj are shown as follows:
(1)
ServerSj chooses its identity SIDSj and a random number rsj and computes the public key Psj=grsj. Thereafter, Sj sends Psj,SIDSj to RC via a secure channel(2)
After receipt, RC computesdsj=x·HGSIDSjandPrsj=Psjx⊕dsj and then sends Prsj back to Sj(3)
Sj computes dsj=Prsj⊕Ppubrsj as its private key and then checks if edsj,P=?eHGSIDSj,Ppub. If not equal, Sj rejects messages. If equal, Sj accepts dsj and stores dsj,rsj(4)
RC stores all servers’ status and identitiesSIDSj in a table TabSj(2) User Registration Phase. The registration steps of Ui are shown as follows:
(1)
Ui selects identity IDUi, password PWUi, and biometric BIOUi. Note that the MAC address of an IoT device is the BIOUi. Thereafter, Ui generates a random number rui and computes GenBIOui=θui,σui, VIDui=HIDUi∥rui, FVIDui=VIDui⊕Ppubrui, VPWui=HPWUi∥VIDui∥rui, FVPWui=VPWui⊕Ppubrui, VBIui=Hσui∥rui, FVBIui=VBIui⊕Ppubrui, and Pui=grui and sends IDUi,FVIDui,Pui,FVPWui,FVBIui to RC(2)
Upon receiving, RC computesVPWui=FVPWui⊕Puix, VBIui=FVBIui⊕Puix, VIDui=FVIDui⊕Puix, dui=x·HGVIDui, Vui=HVPWui∥VBIui∥VIDui, and Rsj=edui,HGSIDSj⊕VBIui⊕VPWui. Further, RC creates table TabUi, which includes all servers’ SIDSj, Rsj, Psj, and Table TabSUi, which includes all users’ HIDUi, Pui, and status. Subsequently, RC injects TabUi,Vui to the smart card SC and sends it to Ui(3)
After receiving,Ui computes Eui=rui⊕Hσui. Finally, Ui stores Eui,θui,Pui into SC and deletes the other parametersIn other words, if a new client (including users and IoT devices) wants to join the client-server communication construction in 5G, they need to register with the RC according to the above steps in the user registration phase. After registration, the client can obtain the legal identity and corresponding information and communicate with the server.


### 3.2.3. Time Key Update Phase

In this phase, the RC checks thestatus of users in TabSUi and dynamically distributes time keys to legitimate users. Communication in this phase occurs in public channels. The details are as follows:
(1)
RC queries thestatus of the user’s HIDUi in TabSUi. When status is “OK,” RC selects a random number bui and adds bui into TabSUi. Thereafter, RC chooses a time-valid period t and computes Bui=gbui, Cui=Puibui, and Tui=HBuiCuit. Further, RC sends Bui,Tui,t to Ui via a public channel(2)
After receiving,Ui inserts their SC, inputs IDUiandBIOUi, and computes σui=RepBIOUi,θui, rui=Eui⊕Hσui, and Cui=Buirui. Subsequently, Ui checks if Tui=?HBuiCuit. If the equation holds, Ui accepts the time key and stores Cui,t into SC


### 3.2.4. Key Management Phase

Ui inserts SC to log into the system. Subsequently, Ui can authenticate and establish a session key using Sj. The detailed steps are as follows:
(1)
Ui inputs IDUi, PWUi, and BIOUi and inserts their SC. Ui then computes σui=RepBIOui,θui, rui=Eui⊕Hσui, VIDui=HIDUirui, VPWui=HPWUiVIDuirui, and VBIui=Hσuirui and checks if Vui=?HVPWuiVBIuiVIDui. The authorized user Ui logs into the system. Thereafter, the card reader queries TabUi and displays all the server identities SIDSj. Ui selects a server’s SIDSj and chooses a random number α. Further, Ui computes Yui=gα, Qui=Psjrui, Fui=VIDui⊕HYuiSIDSjQui, and V1=HFuiYuiPuiVIDuiCui and sends Fui,Yui,Pui,V1 to Sj(2)
Upon receiving, serverSj computes Qsj=Puirsj, Cui=Puibui, and VIDui′=Fui⊕HYuiSIDSjQsj and checks if V1=?HFuiYuiPuiVIDui′Cui. When the equation holds, Sj generates a random number β and computes esj=edsj,HGVIDui, Ysj=gβ, and V2=HesjYsjYuiVIDuiSIDSjQsj and sends V2,Ysj to Ui(3)
Upon receiving,Ui computes eui=Rsj⊕VPWui⊕VBIui. Subsequently, Ui checks if V2=?HesjYsjYuiVIDuiSIDSjQsj holds. When the equation holds, Ui computes keyui=Ysjα and establishes the session key SKUi=HkeyuiQuiVIDuiSIDSj. Further, Ui computes V3=HSKUiVIDuiSIDSj and sends it to Sj(4)
After receipt,Sj computes keysj=keyuiβ and session key SKSj=HkeysjQsjVIDuiSIDSj. Finally, Sj verifies whether V3=?HSKSjVIDuiSIDSj and accepts the session key when the equation holdsThe key management phase is shown in Figure2.Figure 2
Key management phase.


## 3.2.1. Initialization

The RC sets up an elliptic curve and chooses the parameters. RC selects two elliptic curve groupsG1 and G2 with the same order q. Subsequently, RC defines a bilinear pairing e:G1×G1⟶G2 and computes g=eP,P, where P is a generator of G1. RC chooses a random number x as its private key, and Ppub=x·P is the corresponding public key. Finally, RC generates two hash functions, HG· and H·, and publicizes G1,G2,q,P,Ppub,g,HG·,H·.


## 3.2.2. Registration Phase

To join the system, bothUi and Sj must register with the RC to verify their legality. This phase includes the Ui and Sj registration.(1) Server Registration Phase. The registration steps of Sj are shown as follows:
(1)
ServerSj chooses its identity SIDSj and a random number rsj and computes the public key Psj=grsj. Thereafter, Sj sends Psj,SIDSj to RC via a secure channel(2)
After receipt, RC computesdsj=x·HGSIDSjandPrsj=Psjx⊕dsj and then sends Prsj back to Sj(3)
Sj computes dsj=Prsj⊕Ppubrsj as its private key and then checks if edsj,P=?eHGSIDSj,Ppub. If not equal, Sj rejects messages. If equal, Sj accepts dsj and stores dsj,rsj(4)
RC stores all servers’ status and identitiesSIDSj in a table TabSj(2) User Registration Phase. The registration steps of Ui are shown as follows:
(1)
Ui selects identity IDUi, password PWUi, and biometric BIOUi. Note that the MAC address of an IoT device is the BIOUi. Thereafter, Ui generates a random number rui and computes GenBIOui=θui,σui, VIDui=HIDUi∥rui, FVIDui=VIDui⊕Ppubrui, VPWui=HPWUi∥VIDui∥rui, FVPWui=VPWui⊕Ppubrui, VBIui=Hσui∥rui, FVBIui=VBIui⊕Ppubrui, and Pui=grui and sends IDUi,FVIDui,Pui,FVPWui,FVBIui to RC(2)
Upon receiving, RC computesVPWui=FVPWui⊕Puix, VBIui=FVBIui⊕Puix, VIDui=FVIDui⊕Puix, dui=x·HGVIDui, Vui=HVPWui∥VBIui∥VIDui, and Rsj=edui,HGSIDSj⊕VBIui⊕VPWui. Further, RC creates table TabUi, which includes all servers’ SIDSj, Rsj, Psj, and Table TabSUi, which includes all users’ HIDUi, Pui, and status. Subsequently, RC injects TabUi,Vui to the smart card SC and sends it to Ui(3)
After receiving,Ui computes Eui=rui⊕Hσui. Finally, Ui stores Eui,θui,Pui into SC and deletes the other parametersIn other words, if a new client (including users and IoT devices) wants to join the client-server communication construction in 5G, they need to register with the RC according to the above steps in the user registration phase. After registration, the client can obtain the legal identity and corresponding information and communicate with the server.


## 3.2.3. Time Key Update Phase

In this phase, the RC checks thestatus of users in TabSUi and dynamically distributes time keys to legitimate users. Communication in this phase occurs in public channels. The details are as follows:
(1)
RC queries thestatus of the user’s HIDUi in TabSUi. When status is “OK,” RC selects a random number bui and adds bui into TabSUi. Thereafter, RC chooses a time-valid period t and computes Bui=gbui, Cui=Puibui, and Tui=HBuiCuit. Further, RC sends Bui,Tui,t to Ui via a public channel(2)
After receiving,Ui inserts their SC, inputs IDUiandBIOUi, and computes σui=RepBIOUi,θui, rui=Eui⊕Hσui, and Cui=Buirui. Subsequently, Ui checks if Tui=?HBuiCuit. If the equation holds, Ui accepts the time key and stores Cui,t into SC


## 3.2.4. Key Management Phase

Ui inserts SC to log into the system. Subsequently, Ui can authenticate and establish a session key using Sj. The detailed steps are as follows:
(1)
Ui inputs IDUi, PWUi, and BIOUi and inserts their SC. Ui then computes σui=RepBIOui,θui, rui=Eui⊕Hσui, VIDui=HIDUirui, VPWui=HPWUiVIDuirui, and VBIui=Hσuirui and checks if Vui=?HVPWuiVBIuiVIDui. The authorized user Ui logs into the system. Thereafter, the card reader queries TabUi and displays all the server identities SIDSj. Ui selects a server’s SIDSj and chooses a random number α. Further, Ui computes Yui=gα, Qui=Psjrui, Fui=VIDui⊕HYuiSIDSjQui, and V1=HFuiYuiPuiVIDuiCui and sends Fui,Yui,Pui,V1 to Sj(2)
Upon receiving, serverSj computes Qsj=Puirsj, Cui=Puibui, and VIDui′=Fui⊕HYuiSIDSjQsj and checks if V1=?HFuiYuiPuiVIDui′Cui. When the equation holds, Sj generates a random number β and computes esj=edsj,HGVIDui, Ysj=gβ, and V2=HesjYsjYuiVIDuiSIDSjQsj and sends V2,Ysj to Ui(3)
Upon receiving,Ui computes eui=Rsj⊕VPWui⊕VBIui. Subsequently, Ui checks if V2=?HesjYsjYuiVIDuiSIDSjQsj holds. When the equation holds, Ui computes keyui=Ysjα and establishes the session key SKUi=HkeyuiQuiVIDuiSIDSj. Further, Ui computes V3=HSKUiVIDuiSIDSj and sends it to Sj(4)
After receipt,Sj computes keysj=keyuiβ and session key SKSj=HkeysjQsjVIDuiSIDSj. Finally, Sj verifies whether V3=?HSKSjVIDuiSIDSj and accepts the session key when the equation holdsThe key management phase is shown in Figure2.Figure 2
Key management phase.


## 4. Security Analysis

### 4.1. Formal Security Analysis Based on Real-Oracle-Random

We conducted a formal security analysis of the scheme under the Real-Oracle-Random (ROR) model [30, 32, 33, 36, 37]. The ROR model is used to simulate ideal hash functions. We assume that ideal hash functions are random and uniformly distributed. Suppose ΠUx, ΠSy, and ΠRCz represent the x-th communication of user Ui, the y-th communication of server Sj, and the z-th communication of registry RC, respectively. The ΠUx, ΠSy, and ΠRCz act to simulate the real communications of Ui, Sj, and RC. Note that O=ΠUx,ΠSy,ΠRCz.


#### 4.1.1. Queries

Subsequently, adversaryA verifies the security of the protocol with the following query:
(1)
ExecuteO. Starting the query, A obtains message records of transmission in the public channel. The execution of this query is a passive attack.(2)
Hashstring. Starting the query, A can enter a string and then obtain the corresponding hash value.(3)
SendO,M. Starting the query, A sends M to O and receives a response from O.(4)
CorruptO. Starting the query, A obtains one of the private values from O.(5)
TestO. Starting the query, A flips coin C and attempts to determine the correctness of the session key. There are only two results for flipping C:C=1 or C=0. The former means that A receives the session key, and the latter means that A receives a random string.


#### 4.1.2. Definitions

The proposed scheme involves the discrete logarithm problem on an elliptic curve (ECDLP) over a finite fieldFn∗, which is defined by the following. On the elliptic curve E, given the points H and Q of order n, and H=aQ, where H and Q belong to E and a to Fn∗, in the polynomial time ξ, the probability that A obtains a that satisfies H=aQ is AdvAECDLPξ=PrAQ,aQ=a:a∈Fn∗,Q∈E. Furthermore, for a sufficiently small η, we have the following results: AdvAECDLPξ<η.


#### 4.1.3. Theorem

IfA queries in polynomial time ξ, the advantage of breaking scheme S is AdvASξ≤2maxC′·qsends′,qsend/2l+2qhashAdvAECDLPξ+qhash2/2l+qsend+qhash/2l−1, where qhash is the number of times to achieve the Hash query, qsend is the number of times to achieve the Send query, l is the length of the password, and C′ and s′ are constants.Proof.
We define the game sequenceGMmm=0,1,2,3,4,5,6 to prove the theorem. SuccAGMmξ is the event that A succeeds in the game GMm.(1)GM0. GM0 means starting the game without queries. At this time, the advantage of A breaking S is
(1)AdvASξ=2PrSuccAGM0ξ−1.(2)GM1. GM1 starts executing the Execute query. Because the Execute query can only receive messages Bui,Tui,t, Fui,Yui,Pui,V1, V2,Ysj, and V3 transmitted through the public channel,
(2)PrSuccAGM1ξ=PrSuccAGM0ξ.(3)GM2. GM2 begins to achieve the Send query. Based on Zipf’s law [38], we obtain
(3)PrSuccAGM2ξ−PrSuccAGM1ξ≤qsend2l.(4)GM3. GM3 begins to achieve the Hash query. Based on the birthday paradox, we obtain
(4)PrSuccAGM3ξ−PrSuccAGM2ξ≤qhash22l+1.(5)GM4. GM4 starts to judge the security of the session key, mainly based on the following two attacks:
(i)
Perfect Forward Security. A uses ΠRCz to obtain x of RC and verify whether protocol S can provide perfect forward security.(ii)
Known Session-Specific Temporary Information Attacks. A uses ΠUx or ΠSy or ΠRCz to obtain temporary information and verify whether protocol S can resist the attack.In the above two cases, the ECDLP must be solved to calculateSKUi=SKSj. For SKUi=HkeyuiQuiVIDuiSIDSj, in the first case, suppose A can calculate dsj=x·HGSIDSj through x, but keyui=YsjαandQui=Psjrui is unknown, which needs to solve ECDLP twice; in the second case, suppose A obtains the random number α of Ui and further calculates keyui=Ysjα, but Qui and rui are still unknown. The above analysis is also true for SKSj=HkeysjQsjVIDuiSIDSj. Therefore,
(5)PrSuccAGM4ξ−PrSuccAGM3ξ≤qhashAdvAECDLPξ.(6)GM5. GM5 uses ΠUx to obtain the information TabUi,Vui,Eui,θui,Pui,Cui,t stored in SC. Subsequently, A uses the information to launch offline password guessing attacks or stolen smart card attacks. A calculates Vui=HVPWuiVBIuiVIDui, where VIDui=HIDUirui, VPWui=HPWUiVIDuirui, and VBIui=Hσuirui. However, σui, rui, IDUi, PWUi, and BIOUi are confidential. The probability that A can successfully guess the biological information of l-bit is 1/2l [39], which is an extremely small value. Based on Zipf’s law [38], we have
(6)PrSuccAGM5ξ−PrSuccAGM4ξ≤maxC′·qsends′,qsend2l,where C′ and s′ are constants.(7)GM6. GM6 starts to execute query HkeyuiQuiVIDuiSIDSj or HkeysjQsjVIDuiSIDSj to verify whether protocol S can resist the key compromise impersonation attacks. At this time, the advantage of A breaking S is
(7)PrSuccAGM6ξ−PrSuccAGM5ξ≤qhash2l.Because the probability of success and failure ofGM6 is equal,
(8)PrSuccAGM6ξ=12.According to formulas (1)–(8), we have
(9)12AdvASξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤∑m=05PrSuccAGMm+1ξ−PrSuccAGMmξ=maxC′·qsends′,qsend2l+qhashAdvAECDLPξ+qhash22l+1+qsend+qhash2l.Further, we haveAdvASξ≤2maxC′·qsends′,qsend/2l+2qhashAdvAECDLPξ+qhash2/2l+qsend+qhash/2l−1.


### 4.2. Formal Security Analysis Based on ProVerif

ProVerif, which is mainly used for the automatic verification of cryptographic-related security protocols, is a formal analysis tool based on the Dolev-Yao model [40] and computational model proposed by Abadi et al. and Blanchet et al. [41, 42]. The ProVerif tool [43] is based on the equivalence theory of function reduction, definition of terms and processes, structural equivalence between extended processes, and others and is applied to the security analysis of the real environment. Furthermore, the analysis and verification with ProVerif have security properties, such as confidentiality, authentication, and logic. Our proposed protocol was analyzed using ProVerif, as follows.Some constants and functions were defined as shown in Figure3. Among them, hash, concatenation, and xor are common operations; Bilinearmap is a bilinear pairing operation; expbitstring,bitstring are exponential operations, with the first bitstring as the base and the last bitstring as the exponent. The anonymity and consistency of the protocol were analyzed using events and queries. As shown in Figure 4, the events UserStarted, UserAuthed, and UserAcServer, respectively, indicate that the user starts authentication, completes login, and successfully authenticates the server; events ServerAcUser and ServerAcSK, respectively, indicate that the server successfully authenticates the user and completes the authentication of the session key.Figure 3
Definitions.Figure 4
Queries and events.Figures5(a) and 5(b) show the specific operations of each entity and describe the authentication process between the user and the server. The results of the query using ProVerif are shown in Figure 6. The first and second results confirm that the session key is secure, and our scheme can resist key compromise impersonation attacks. The third and fourth results reveal that the proposed scheme can guarantee anonymity and resist offline password guessing attacks. The inj−eventUserAuthed=⇒inj−eventUserStarted indicates that the user logs in after authentication. The inj−eventUserAcServer=⇒inj−eventServerAcUser indicates that user authentication is performed after the server completes authentication. The inj−eventServerAcSK=⇒inj−eventUserAcServer indicates that the server verifies the session key after the user completes authentication. In other words, the proposed scheme maintains consistency.Figure 5
Processes.
(a)
Process(b)
ProcessFigure 6
Results.


### 4.3. Informal Analysis

#### 4.3.1. Insider Attacks

In the proposed scheme,IDUi,FVIDui,Pui,FVPWui,FVBIui are sent to RC when Ui is registered, where FVIDui=VIDui⊕Ppubrui, Pui=grui, FVPWui=VPWui⊕Ppubrui, and FVBIui=VBIui⊕Ppubrui. In this process, Ui does not directly transmit passwords or biometrics. Insiders in RC cannot compute real PWui and BIOui. Therefore, the proposed scheme can resist insider attacks.


#### 4.3.2. User Impersonation Attacks

Malicious adversaryA attempts to impersonate legitimate users in communicating with Sj. (1) A intercepts Fui,Yui,Pui,V1, selects α′, and computes Yui′=gα′, Qui=Psjrui, Fui′=VIDui⊕HYui′SIDSjQui, and V1=HFui′Yui′PuiVIDuiCui, where VIDui=HIDUirui and Cui=Buirui. However, IDUi and rui are confidential to A. Therefore, when Sj verifies V1, it will reject A. (2) If A intercepts V2,Ysj and forges V3, it attempts to pass Sj’s validation for SKUi. However, SKUi=HkeyuiQuiVIDuiSIDSj, where keyui, Qui, and VIDui are all confidential to A. Therefore, Sj declines to generate a session key with A. The above analysis indicates that the proposed scheme can resist user impersonation attacks.


#### 4.3.3. Server Impersonation Attacks

Malicious adversaryA attempts to impersonate Sj to communicate with legitimate users. A intercepts Fui,Yui,Pui,V1 and V2,Ysj, selects β′, and computes Ysj′=gβ′andV2′=HesjYsj′YuiVIDuiSIDSjQsj, where esj=edsj,HGVIDui, VIDui=HIDUirui, and Qsj=Puirsj are unknown to A. Therefore, A cannot be forged as the Sj to communicate with Ui. In other words, our scheme can resist server impersonation attacks.


#### 4.3.4. Replay Attacks

In our scheme, wheneverUi starts a new session with Sj, new α and β will participate in the session. Yui=gα, Ysj=gβ, keyui=Ysjα, and keysj=keyuiβ are updated in each round, where Yui and Ysj are used for validation and keyui and keysj constitute the session key. Therefore, the proposed scheme can resist replay attacks.


#### 4.3.5. User Anonymity

In the key management phase, the user passes the virtual identityVIDui=HIDUirui to the server, and each round of session is protected by a new random number α. Accordingly, the server verifies the user’s pseudonym VIDui′=Fui⊕HYuiSIDSjQsj. Therefore, A cannot extract the real identity IDUi of the user. The proposed scheme achieves user anonymity.


## 4.1. Formal Security Analysis Based on Real-Oracle-Random

We conducted a formal security analysis of the scheme under the Real-Oracle-Random (ROR) model [30, 32, 33, 36, 37]. The ROR model is used to simulate ideal hash functions. We assume that ideal hash functions are random and uniformly distributed. Suppose ΠUx, ΠSy, and ΠRCz represent the x-th communication of user Ui, the y-th communication of server Sj, and the z-th communication of registry RC, respectively. The ΠUx, ΠSy, and ΠRCz act to simulate the real communications of Ui, Sj, and RC. Note that O=ΠUx,ΠSy,ΠRCz.


### 4.1.1. Queries

Subsequently, adversaryA verifies the security of the protocol with the following query:
(1)
ExecuteO. Starting the query, A obtains message records of transmission in the public channel. The execution of this query is a passive attack.(2)
Hashstring. Starting the query, A can enter a string and then obtain the corresponding hash value.(3)
SendO,M. Starting the query, A sends M to O and receives a response from O.(4)
CorruptO. Starting the query, A obtains one of the private values from O.(5)
TestO. Starting the query, A flips coin C and attempts to determine the correctness of the session key. There are only two results for flipping C:C=1 or C=0. The former means that A receives the session key, and the latter means that A receives a random string.


### 4.1.2. Definitions

The proposed scheme involves the discrete logarithm problem on an elliptic curve (ECDLP) over a finite fieldFn∗, which is defined by the following. On the elliptic curve E, given the points H and Q of order n, and H=aQ, where H and Q belong to E and a to Fn∗, in the polynomial time ξ, the probability that A obtains a that satisfies H=aQ is AdvAECDLPξ=PrAQ,aQ=a:a∈Fn∗,Q∈E. Furthermore, for a sufficiently small η, we have the following results: AdvAECDLPξ<η.


### 4.1.3. Theorem

IfA queries in polynomial time ξ, the advantage of breaking scheme S is AdvASξ≤2maxC′·qsends′,qsend/2l+2qhashAdvAECDLPξ+qhash2/2l+qsend+qhash/2l−1, where qhash is the number of times to achieve the Hash query, qsend is the number of times to achieve the Send query, l is the length of the password, and C′ and s′ are constants.Proof.
We define the game sequenceGMmm=0,1,2,3,4,5,6 to prove the theorem. SuccAGMmξ is the event that A succeeds in the game GMm.(1)GM0. GM0 means starting the game without queries. At this time, the advantage of A breaking S is
(1)AdvASξ=2PrSuccAGM0ξ−1.(2)GM1. GM1 starts executing the Execute query. Because the Execute query can only receive messages Bui,Tui,t, Fui,Yui,Pui,V1, V2,Ysj, and V3 transmitted through the public channel,
(2)PrSuccAGM1ξ=PrSuccAGM0ξ.(3)GM2. GM2 begins to achieve the Send query. Based on Zipf’s law [38], we obtain
(3)PrSuccAGM2ξ−PrSuccAGM1ξ≤qsend2l.(4)GM3. GM3 begins to achieve the Hash query. Based on the birthday paradox, we obtain
(4)PrSuccAGM3ξ−PrSuccAGM2ξ≤qhash22l+1.(5)GM4. GM4 starts to judge the security of the session key, mainly based on the following two attacks:
(i)
Perfect Forward Security. A uses ΠRCz to obtain x of RC and verify whether protocol S can provide perfect forward security.(ii)
Known Session-Specific Temporary Information Attacks. A uses ΠUx or ΠSy or ΠRCz to obtain temporary information and verify whether protocol S can resist the attack.In the above two cases, the ECDLP must be solved to calculateSKUi=SKSj. For SKUi=HkeyuiQuiVIDuiSIDSj, in the first case, suppose A can calculate dsj=x·HGSIDSj through x, but keyui=YsjαandQui=Psjrui is unknown, which needs to solve ECDLP twice; in the second case, suppose A obtains the random number α of Ui and further calculates keyui=Ysjα, but Qui and rui are still unknown. The above analysis is also true for SKSj=HkeysjQsjVIDuiSIDSj. Therefore,
(5)PrSuccAGM4ξ−PrSuccAGM3ξ≤qhashAdvAECDLPξ.(6)GM5. GM5 uses ΠUx to obtain the information TabUi,Vui,Eui,θui,Pui,Cui,t stored in SC. Subsequently, A uses the information to launch offline password guessing attacks or stolen smart card attacks. A calculates Vui=HVPWuiVBIuiVIDui, where VIDui=HIDUirui, VPWui=HPWUiVIDuirui, and VBIui=Hσuirui. However, σui, rui, IDUi, PWUi, and BIOUi are confidential. The probability that A can successfully guess the biological information of l-bit is 1/2l [39], which is an extremely small value. Based on Zipf’s law [38], we have
(6)PrSuccAGM5ξ−PrSuccAGM4ξ≤maxC′·qsends′,qsend2l,where C′ and s′ are constants.(7)GM6. GM6 starts to execute query HkeyuiQuiVIDuiSIDSj or HkeysjQsjVIDuiSIDSj to verify whether protocol S can resist the key compromise impersonation attacks. At this time, the advantage of A breaking S is
(7)PrSuccAGM6ξ−PrSuccAGM5ξ≤qhash2l.Because the probability of success and failure ofGM6 is equal,
(8)PrSuccAGM6ξ=12.According to formulas (1)–(8), we have
(9)12AdvASξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤∑m=05PrSuccAGMm+1ξ−PrSuccAGMmξ=maxC′·qsends′,qsend2l+qhashAdvAECDLPξ+qhash22l+1+qsend+qhash2l.Further, we haveAdvASξ≤2maxC′·qsends′,qsend/2l+2qhashAdvAECDLPξ+qhash2/2l+qsend+qhash/2l−1.


## 4.1.1. Queries

Subsequently, adversaryA verifies the security of the protocol with the following query:
(1)
ExecuteO. Starting the query, A obtains message records of transmission in the public channel. The execution of this query is a passive attack.(2)
Hashstring. Starting the query, A can enter a string and then obtain the corresponding hash value.(3)
SendO,M. Starting the query, A sends M to O and receives a response from O.(4)
CorruptO. Starting the query, A obtains one of the private values from O.(5)
TestO. Starting the query, A flips coin C and attempts to determine the correctness of the session key. There are only two results for flipping C:C=1 or C=0. The former means that A receives the session key, and the latter means that A receives a random string.


## 4.1.2. Definitions

The proposed scheme involves the discrete logarithm problem on an elliptic curve (ECDLP) over a finite fieldFn∗, which is defined by the following. On the elliptic curve E, given the points H and Q of order n, and H=aQ, where H and Q belong to E and a to Fn∗, in the polynomial time ξ, the probability that A obtains a that satisfies H=aQ is AdvAECDLPξ=PrAQ,aQ=a:a∈Fn∗,Q∈E. Furthermore, for a sufficiently small η, we have the following results: AdvAECDLPξ<η.


## 4.1.3. Theorem

IfA queries in polynomial time ξ, the advantage of breaking scheme S is AdvASξ≤2maxC′·qsends′,qsend/2l+2qhashAdvAECDLPξ+qhash2/2l+qsend+qhash/2l−1, where qhash is the number of times to achieve the Hash query, qsend is the number of times to achieve the Send query, l is the length of the password, and C′ and s′ are constants.Proof.
We define the game sequenceGMmm=0,1,2,3,4,5,6 to prove the theorem. SuccAGMmξ is the event that A succeeds in the game GMm.(1)GM0. GM0 means starting the game without queries. At this time, the advantage of A breaking S is
(1)AdvASξ=2PrSuccAGM0ξ−1.(2)GM1. GM1 starts executing the Execute query. Because the Execute query can only receive messages Bui,Tui,t, Fui,Yui,Pui,V1, V2,Ysj, and V3 transmitted through the public channel,
(2)PrSuccAGM1ξ=PrSuccAGM0ξ.(3)GM2. GM2 begins to achieve the Send query. Based on Zipf’s law [38], we obtain
(3)PrSuccAGM2ξ−PrSuccAGM1ξ≤qsend2l.(4)GM3. GM3 begins to achieve the Hash query. Based on the birthday paradox, we obtain
(4)PrSuccAGM3ξ−PrSuccAGM2ξ≤qhash22l+1.(5)GM4. GM4 starts to judge the security of the session key, mainly based on the following two attacks:
(i)
Perfect Forward Security. A uses ΠRCz to obtain x of RC and verify whether protocol S can provide perfect forward security.(ii)
Known Session-Specific Temporary Information Attacks. A uses ΠUx or ΠSy or ΠRCz to obtain temporary information and verify whether protocol S can resist the attack.In the above two cases, the ECDLP must be solved to calculateSKUi=SKSj. For SKUi=HkeyuiQuiVIDuiSIDSj, in the first case, suppose A can calculate dsj=x·HGSIDSj through x, but keyui=YsjαandQui=Psjrui is unknown, which needs to solve ECDLP twice; in the second case, suppose A obtains the random number α of Ui and further calculates keyui=Ysjα, but Qui and rui are still unknown. The above analysis is also true for SKSj=HkeysjQsjVIDuiSIDSj. Therefore,
(5)PrSuccAGM4ξ−PrSuccAGM3ξ≤qhashAdvAECDLPξ.(6)GM5. GM5 uses ΠUx to obtain the information TabUi,Vui,Eui,θui,Pui,Cui,t stored in SC. Subsequently, A uses the information to launch offline password guessing attacks or stolen smart card attacks. A calculates Vui=HVPWuiVBIuiVIDui, where VIDui=HIDUirui, VPWui=HPWUiVIDuirui, and VBIui=Hσuirui. However, σui, rui, IDUi, PWUi, and BIOUi are confidential. The probability that A can successfully guess the biological information of l-bit is 1/2l [39], which is an extremely small value. Based on Zipf’s law [38], we have
(6)PrSuccAGM5ξ−PrSuccAGM4ξ≤maxC′·qsends′,qsend2l,where C′ and s′ are constants.(7)GM6. GM6 starts to execute query HkeyuiQuiVIDuiSIDSj or HkeysjQsjVIDuiSIDSj to verify whether protocol S can resist the key compromise impersonation attacks. At this time, the advantage of A breaking S is
(7)PrSuccAGM6ξ−PrSuccAGM5ξ≤qhash2l.Because the probability of success and failure ofGM6 is equal,
(8)PrSuccAGM6ξ=12.According to formulas (1)–(8), we have
(9)12AdvASξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤∑m=05PrSuccAGMm+1ξ−PrSuccAGMmξ=maxC′·qsends′,qsend2l+qhashAdvAECDLPξ+qhash22l+1+qsend+qhash2l.Further, we haveAdvASξ≤2maxC′·qsends′,qsend/2l+2qhashAdvAECDLPξ+qhash2/2l+qsend+qhash/2l−1.


## 4.2. Formal Security Analysis Based on ProVerif

ProVerif, which is mainly used for the automatic verification of cryptographic-related security protocols, is a formal analysis tool based on the Dolev-Yao model [40] and computational model proposed by Abadi et al. and Blanchet et al. [41, 42]. The ProVerif tool [43] is based on the equivalence theory of function reduction, definition of terms and processes, structural equivalence between extended processes, and others and is applied to the security analysis of the real environment. Furthermore, the analysis and verification with ProVerif have security properties, such as confidentiality, authentication, and logic. Our proposed protocol was analyzed using ProVerif, as follows.Some constants and functions were defined as shown in Figure3. Among them, hash, concatenation, and xor are common operations; Bilinearmap is a bilinear pairing operation; expbitstring,bitstring are exponential operations, with the first bitstring as the base and the last bitstring as the exponent. The anonymity and consistency of the protocol were analyzed using events and queries. As shown in Figure 4, the events UserStarted, UserAuthed, and UserAcServer, respectively, indicate that the user starts authentication, completes login, and successfully authenticates the server; events ServerAcUser and ServerAcSK, respectively, indicate that the server successfully authenticates the user and completes the authentication of the session key.Figure 3
Definitions.Figure 4
Queries and events.Figures5(a) and 5(b) show the specific operations of each entity and describe the authentication process between the user and the server. The results of the query using ProVerif are shown in Figure 6. The first and second results confirm that the session key is secure, and our scheme can resist key compromise impersonation attacks. The third and fourth results reveal that the proposed scheme can guarantee anonymity and resist offline password guessing attacks. The inj−eventUserAuthed=⇒inj−eventUserStarted indicates that the user logs in after authentication. The inj−eventUserAcServer=⇒inj−eventServerAcUser indicates that user authentication is performed after the server completes authentication. The inj−eventServerAcSK=⇒inj−eventUserAcServer indicates that the server verifies the session key after the user completes authentication. In other words, the proposed scheme maintains consistency.Figure 5
Processes.
(a)
Process(b)
ProcessFigure 6
Results.


## 4.3. Informal Analysis

### 4.3.1. Insider Attacks

In the proposed scheme,IDUi,FVIDui,Pui,FVPWui,FVBIui are sent to RC when Ui is registered, where FVIDui=VIDui⊕Ppubrui, Pui=grui, FVPWui=VPWui⊕Ppubrui, and FVBIui=VBIui⊕Ppubrui. In this process, Ui does not directly transmit passwords or biometrics. Insiders in RC cannot compute real PWui and BIOui. Therefore, the proposed scheme can resist insider attacks.


### 4.3.2. User Impersonation Attacks

Malicious adversaryA attempts to impersonate legitimate users in communicating with Sj. (1) A intercepts Fui,Yui,Pui,V1, selects α′, and computes Yui′=gα′, Qui=Psjrui, Fui′=VIDui⊕HYui′SIDSjQui, and V1=HFui′Yui′PuiVIDuiCui, where VIDui=HIDUirui and Cui=Buirui. However, IDUi and rui are confidential to A. Therefore, when Sj verifies V1, it will reject A. (2) If A intercepts V2,Ysj and forges V3, it attempts to pass Sj’s validation for SKUi. However, SKUi=HkeyuiQuiVIDuiSIDSj, where keyui, Qui, and VIDui are all confidential to A. Therefore, Sj declines to generate a session key with A. The above analysis indicates that the proposed scheme can resist user impersonation attacks.


### 4.3.3. Server Impersonation Attacks

Malicious adversaryA attempts to impersonate Sj to communicate with legitimate users. A intercepts Fui,Yui,Pui,V1 and V2,Ysj, selects β′, and computes Ysj′=gβ′andV2′=HesjYsj′YuiVIDuiSIDSjQsj, where esj=edsj,HGVIDui, VIDui=HIDUirui, and Qsj=Puirsj are unknown to A. Therefore, A cannot be forged as the Sj to communicate with Ui. In other words, our scheme can resist server impersonation attacks.


### 4.3.4. Replay Attacks

In our scheme, wheneverUi starts a new session with Sj, new α and β will participate in the session. Yui=gα, Ysj=gβ, keyui=Ysjα, and keysj=keyuiβ are updated in each round, where Yui and Ysj are used for validation and keyui and keysj constitute the session key. Therefore, the proposed scheme can resist replay attacks.


### 4.3.5. User Anonymity

In the key management phase, the user passes the virtual identityVIDui=HIDUirui to the server, and each round of session is protected by a new random number α. Accordingly, the server verifies the user’s pseudonym VIDui′=Fui⊕HYuiSIDSjQsj. Therefore, A cannot extract the real identity IDUi of the user. The proposed scheme achieves user anonymity.


## 4.3.1. Insider Attacks

In the proposed scheme,IDUi,FVIDui,Pui,FVPWui,FVBIui are sent to RC when Ui is registered, where FVIDui=VIDui⊕Ppubrui, Pui=grui, FVPWui=VPWui⊕Ppubrui, and FVBIui=VBIui⊕Ppubrui. In this process, Ui does not directly transmit passwords or biometrics. Insiders in RC cannot compute real PWui and BIOui. Therefore, the proposed scheme can resist insider attacks.


## 4.3.2. User Impersonation Attacks

Malicious adversaryA attempts to impersonate legitimate users in communicating with Sj. (1) A intercepts Fui,Yui,Pui,V1, selects α′, and computes Yui′=gα′, Qui=Psjrui, Fui′=VIDui⊕HYui′SIDSjQui, and V1=HFui′Yui′PuiVIDuiCui, where VIDui=HIDUirui and Cui=Buirui. However, IDUi and rui are confidential to A. Therefore, when Sj verifies V1, it will reject A. (2) If A intercepts V2,Ysj and forges V3, it attempts to pass Sj’s validation for SKUi. However, SKUi=HkeyuiQuiVIDuiSIDSj, where keyui, Qui, and VIDui are all confidential to A. Therefore, Sj declines to generate a session key with A. The above analysis indicates that the proposed scheme can resist user impersonation attacks.


## 4.3.3. Server Impersonation Attacks

Malicious adversaryA attempts to impersonate Sj to communicate with legitimate users. A intercepts Fui,Yui,Pui,V1 and V2,Ysj, selects β′, and computes Ysj′=gβ′andV2′=HesjYsj′YuiVIDuiSIDSjQsj, where esj=edsj,HGVIDui, VIDui=HIDUirui, and Qsj=Puirsj are unknown to A. Therefore, A cannot be forged as the Sj to communicate with Ui. In other words, our scheme can resist server impersonation attacks.


## 4.3.4. Replay Attacks

In our scheme, wheneverUi starts a new session with Sj, new α and β will participate in the session. Yui=gα, Ysj=gβ, keyui=Ysjα, and keysj=keyuiβ are updated in each round, where Yui and Ysj are used for validation and keyui and keysj constitute the session key. Therefore, the proposed scheme can resist replay attacks.


## 4.3.5. User Anonymity

In the key management phase, the user passes the virtual identityVIDui=HIDUirui to the server, and each round of session is protected by a new random number α. Accordingly, the server verifies the user’s pseudonym VIDui′=Fui⊕HYuiSIDSjQsj. Therefore, A cannot extract the real identity IDUi of the user. The proposed scheme achieves user anonymity.


## 5. Performance Analysis

The proposed scheme is evaluated with those of [32–35] in terms of security, computation cost, communication cost, and storage cost. These five protocols all use bilinear pairing operations. Considering the practical application value, we analyzed the consumption of the login and authentication phase for computation cost and communication cost and the consumption of the registration phase for storage cost.


### 5.1. Security Comparison

In Table4, we conducted a security evaluation. Let K1, K2, K3, K4, K5, K6, K7, and K8 represent user anonymity, perfect forward security, session key agreement, offline password guessing attacks, insider attacks, preverification, server impersonation attacks, and user impersonation attacks, respectively. Note that preverification means that the user needs to pass the verification of the smart card before communicating with the server. Session key agreement means that the session key needs to be established by two participants. “√” indicates that the protocol can resist attacks. “χ” symbolizes that the protocol cannot resist the attack. Table 4 shows that the scheme in [32] is subject to server impersonation attacks and user impersonation attacks, which is a significant security hazard for the entire protocol. In addition, [32] cannot provide user anonymity and cannot resist offline password guessing attacks. The schemes in [33–35] and our scheme have strong security.Table 4
Security comparison.
[32][33][34][35]OursK1χ [33]√√√√K2√√√√√K3√√√√√K4χ [33]√√√√K5√√√√√K6√√√√√K7χ [33]√√√√K8χ [33]√√√√


### 5.2. Computation Cost Comparison

In Table5, we counted and compared the number of operations and computation time in the schemes of [32–35] and ours. Tmap denotes the time of bilinear pairing operation, Tmtp denotes the time of hash operation from the map to point, Tex represents the time consumption of exponential operation, Tf represents the time consumption of fuzzy extraction function, Tm represents the time consumption of scalar multiplication in G1, Ta represents the time of point addition in G1, Tmg represents the time of multiplication in G2, and Th represents the time consumption of general hash operation. The XOR and join operations were ignored. According to [32], the approximate time consumptions of Tmap, Tmtp, Tex, Tm, Ta, Tmg, and Th are 32.713ms, 33.582ms, 2.249ms, 13.405ms, 0.081ms, 0.008ms, and 0.056ms for the end-user, respectively. Note that we assume Tf=Tm. On the server-side, the approximate time consumptions of Tmap, Tmtp, Tex, Tm, Ta, Tmg, and Th were 5.427ms, 5.493ms, 0.339ms, 2.165ms, 0.013ms, 0.001ms, and 0.007ms, respectively. The consumption of the proposed scheme on the user-side was slightly higher than that of [33], but on the server-side, it is lower than that of their scheme. In addition, the total computation cost of the proposed scheme was slightly higher than that of [33]. In practical applications, it can cause almost the same online experience for the user. Figure 7 more intuitively shows the comparison of computation cost between our scheme and [32–35].Table 5
Computation cost comparison.
[32][33][34][35]OursUser2Tm+Ta+Tex+8Th≈31.837msTf+2Tex+10Th≈18.463ms2Tmap+2Tmtp+3Tm+4Th≈173.029msTmap+Tmtp+2Tm+5Th≈93.385msTf+3Tex+10Th≈20.712msServer2Tmap+4Tex+2Tm+5Th≈16.575msTmap+Tmtp+4Tex+Tm+6Th≈14.483msTmap+Tmtp+2Tm+5Th≈15.285ms5Tmap+8Tex+6Tm+2Th≈42.851msTmap+Tmtp+4Tex+5Th≈12.311msTotal48.412ms32.946ms188.314ms136.236ms33.023msFigure 7
Computation cost comparison.


### 5.3. Communication and Storage Cost Comparison

We choseq=160 bits and n=512 bits. The output length in G1 and G2 is 1024 bits, and the output length for general hash operation and identity is 160 bits. The specific analysis is as follows.In He et al.’s scheme [32], the transmitted messages are RUi, y,αSj, and CUi, where RUi,y belong to G1 and αSj,CUi belong to Fn∗. The communication cost was 2368 bits. The stored messages are gUi,ψUi,vUi,bUi and DSj, where gUi,bUi,DSj belong to G1 and ψUi,vUi belong to Fn∗. The storage cost was 3392 bits.In Li et al.’s scheme [33], the transmitted messages are Fui,kui,Bui,dtui,t, Dsj,ksj, and DUi, where kui,Bui,ksj belong to G1and Fui,dtui,t,Dsj,DUi belong to Fn∗. The communication cost is 3872 bits. The stored messages are Tui,Gui,Vui,h1,θui,Wui,Hii=00,01,1,⋯,7,gpub and Bui,dtui,t, where Hii=00,01,gpub,Bui,dtui belong to G1 and Tui,Gui,Vui,h1,θui,Wui,Hii=1,⋯,7,t belong to Fn∗. The storage cost was 7360 bits.In Chuang and Tseng’s scheme [34], the transmitted messages are AID,Ni,ACAKE, NB,vB, and vi, where AID,Ni,ACAKE,NB belong to G1 and vB,vi belong to Fn∗. The communication cost is 4416 bits. The stored messages are IDi,t,Qi,MPKt,HLPi, IDj,t,Qj,MPKt, and IDl,t,Ql,MPKt,HLPl, where Qi,MPKt,Qj,MPKt,Ql,MPKt belong to G1 and IDi,t,HLPi,IDj,t,IDl,t,HLPl belong to Fn∗. The storage cost was 7424 bits.In Tseng et al.’s scheme [35], the transmitted messages are IDc,QTc,QUc,X,nc,Sigc, Y1,Y2,Auths,ns, and Authc, where X,nc,Sigc,Y1,Y2,ns belong to G1 and IDc,QTc,QUc,AuthsAuthc belong to Fn∗. The communication cost is 3872 bits. The stored messages are SUc,0,1,SUc,0,2, XUc,0,1,XUc,0,2, SUs,0,1,SUs,0,2, and XUs,0,1,XUs,0,2, where SUc,0,1,SUc,0,2,XUc,0,1,XUc,0,2,SUs,0,1,SUs,0,2,XUs,0,1,XUs,0,2 belong to G1. The storage cost was 8192 bits.In the proposed scheme, the transmitted messages areFui,Yui,Pui,V1, V2,Ysj, and V2, where Yui,Pui,Ysj belong to G1 and Fui,V1,V2,V3 belong to Fn∗. The communication cost is 3712 bits. The stored messages are TabUi,Vui,Eui,θui,Pui and Cui,t, where TabUi,Vui,Eui,θui,t belong to G1 and Pui,Cui belong to Fn∗. The storage cost was 2848 bits.Table6 summarizes the communication and storage costs of the five schemes. It can be noticed that the communication cost of the proposed scheme is lower than that of [33–35] but slightly higher than that of [32]. However, [32] is subject to offline identity guessing and impersonation attacks. Furthermore, our scheme has the lowest storage cost. Figure 8 more intuitively shows the comparison of communication and storage costs between our scheme and [32–35].Table 6
Communication and storage cost comparison.
RoundsCommunication cost (bits)Storage cost (bits)[32]323683392[33]338727360[34]344167424[35]369448192Our337122848Figure 8
Communication and storage cost comparison.


## 5.1. Security Comparison

In Table4, we conducted a security evaluation. Let K1, K2, K3, K4, K5, K6, K7, and K8 represent user anonymity, perfect forward security, session key agreement, offline password guessing attacks, insider attacks, preverification, server impersonation attacks, and user impersonation attacks, respectively. Note that preverification means that the user needs to pass the verification of the smart card before communicating with the server. Session key agreement means that the session key needs to be established by two participants. “√” indicates that the protocol can resist attacks. “χ” symbolizes that the protocol cannot resist the attack. Table 4 shows that the scheme in [32] is subject to server impersonation attacks and user impersonation attacks, which is a significant security hazard for the entire protocol. In addition, [32] cannot provide user anonymity and cannot resist offline password guessing attacks. The schemes in [33–35] and our scheme have strong security.Table 4
Security comparison.
[32][33][34][35]OursK1χ [33]√√√√K2√√√√√K3√√√√√K4χ [33]√√√√K5√√√√√K6√√√√√K7χ [33]√√√√K8χ [33]√√√√


## 5.2. Computation Cost Comparison

In Table5, we counted and compared the number of operations and computation time in the schemes of [32–35] and ours. Tmap denotes the time of bilinear pairing operation, Tmtp denotes the time of hash operation from the map to point, Tex represents the time consumption of exponential operation, Tf represents the time consumption of fuzzy extraction function, Tm represents the time consumption of scalar multiplication in G1, Ta represents the time of point addition in G1, Tmg represents the time of multiplication in G2, and Th represents the time consumption of general hash operation. The XOR and join operations were ignored. According to [32], the approximate time consumptions of Tmap, Tmtp, Tex, Tm, Ta, Tmg, and Th are 32.713ms, 33.582ms, 2.249ms, 13.405ms, 0.081ms, 0.008ms, and 0.056ms for the end-user, respectively. Note that we assume Tf=Tm. On the server-side, the approximate time consumptions of Tmap, Tmtp, Tex, Tm, Ta, Tmg, and Th were 5.427ms, 5.493ms, 0.339ms, 2.165ms, 0.013ms, 0.001ms, and 0.007ms, respectively. The consumption of the proposed scheme on the user-side was slightly higher than that of [33], but on the server-side, it is lower than that of their scheme. In addition, the total computation cost of the proposed scheme was slightly higher than that of [33]. In practical applications, it can cause almost the same online experience for the user. Figure 7 more intuitively shows the comparison of computation cost between our scheme and [32–35].Table 5
Computation cost comparison.
[32][33][34][35]OursUser2Tm+Ta+Tex+8Th≈31.837msTf+2Tex+10Th≈18.463ms2Tmap+2Tmtp+3Tm+4Th≈173.029msTmap+Tmtp+2Tm+5Th≈93.385msTf+3Tex+10Th≈20.712msServer2Tmap+4Tex+2Tm+5Th≈16.575msTmap+Tmtp+4Tex+Tm+6Th≈14.483msTmap+Tmtp+2Tm+5Th≈15.285ms5Tmap+8Tex+6Tm+2Th≈42.851msTmap+Tmtp+4Tex+5Th≈12.311msTotal48.412ms32.946ms188.314ms136.236ms33.023msFigure 7
Computation cost comparison.


## 5.3. Communication and Storage Cost Comparison

We choseq=160 bits and n=512 bits. The output length in G1 and G2 is 1024 bits, and the output length for general hash operation and identity is 160 bits. The specific analysis is as follows.In He et al.’s scheme [32], the transmitted messages are RUi, y,αSj, and CUi, where RUi,y belong to G1 and αSj,CUi belong to Fn∗. The communication cost was 2368 bits. The stored messages are gUi,ψUi,vUi,bUi and DSj, where gUi,bUi,DSj belong to G1 and ψUi,vUi belong to Fn∗. The storage cost was 3392 bits.In Li et al.’s scheme [33], the transmitted messages are Fui,kui,Bui,dtui,t, Dsj,ksj, and DUi, where kui,Bui,ksj belong to G1and Fui,dtui,t,Dsj,DUi belong to Fn∗. The communication cost is 3872 bits. The stored messages are Tui,Gui,Vui,h1,θui,Wui,Hii=00,01,1,⋯,7,gpub and Bui,dtui,t, where Hii=00,01,gpub,Bui,dtui belong to G1 and Tui,Gui,Vui,h1,θui,Wui,Hii=1,⋯,7,t belong to Fn∗. The storage cost was 7360 bits.In Chuang and Tseng’s scheme [34], the transmitted messages are AID,Ni,ACAKE, NB,vB, and vi, where AID,Ni,ACAKE,NB belong to G1 and vB,vi belong to Fn∗. The communication cost is 4416 bits. The stored messages are IDi,t,Qi,MPKt,HLPi, IDj,t,Qj,MPKt, and IDl,t,Ql,MPKt,HLPl, where Qi,MPKt,Qj,MPKt,Ql,MPKt belong to G1 and IDi,t,HLPi,IDj,t,IDl,t,HLPl belong to Fn∗. The storage cost was 7424 bits.In Tseng et al.’s scheme [35], the transmitted messages are IDc,QTc,QUc,X,nc,Sigc, Y1,Y2,Auths,ns, and Authc, where X,nc,Sigc,Y1,Y2,ns belong to G1 and IDc,QTc,QUc,AuthsAuthc belong to Fn∗. The communication cost is 3872 bits. The stored messages are SUc,0,1,SUc,0,2, XUc,0,1,XUc,0,2, SUs,0,1,SUs,0,2, and XUs,0,1,XUs,0,2, where SUc,0,1,SUc,0,2,XUc,0,1,XUc,0,2,SUs,0,1,SUs,0,2,XUs,0,1,XUs,0,2 belong to G1. The storage cost was 8192 bits.In the proposed scheme, the transmitted messages areFui,Yui,Pui,V1, V2,Ysj, and V2, where Yui,Pui,Ysj belong to G1 and Fui,V1,V2,V3 belong to Fn∗. The communication cost is 3712 bits. The stored messages are TabUi,Vui,Eui,θui,Pui and Cui,t, where TabUi,Vui,Eui,θui,t belong to G1 and Pui,Cui belong to Fn∗. The storage cost was 2848 bits.Table6 summarizes the communication and storage costs of the five schemes. It can be noticed that the communication cost of the proposed scheme is lower than that of [33–35] but slightly higher than that of [32]. However, [32] is subject to offline identity guessing and impersonation attacks. Furthermore, our scheme has the lowest storage cost. Figure 8 more intuitively shows the comparison of communication and storage costs between our scheme and [32–35].Table 6
Communication and storage cost comparison.
RoundsCommunication cost (bits)Storage cost (bits)[32]323683392[33]338727360[34]344167424[35]369448192Our337122848Figure 8
Communication and storage cost comparison.


## 6. Conclusion

Many researchers have proposed solutions for authentication in the multiserver architecture of the client-server mode, but most of them have some security vulnerabilities. In addition, the development of 5G technology has gradually matured, which can bring users a superfast online experience. Therefore, we proposed a secure key management protocol to protect user anonymity based on the multiserver architecture of the client-server mode in 5G. Through formal and informal analyses, we proved that our scheme has better security. Furthermore, the performance estimate confirms that the proposed scheme has higher advantages than similar schemes. Therefore, the proposed scheme is more suitable for the client-server mode of the multiserver in 5G.



---

*Source: 4083199-2021-10-22.xml*