# Design and Analysis of a Provable Secure Two-Factor Authentication Protocol for Internet of Things

Authors: Chien-Ming Chen; Shuangshuang Liu; Xuanang Li; Saru Kumari; Long Li
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Because sensor nodes are deployed in public areas, these sensors are easy to capture by adversaries. Once a sensor is stolen, the sensitive information stored in it is likely to be exposed. Accordingly, designing a secure authentication protocol should consider this issue. Sadri et al. recently proposed a two-factor authentication protocol with anonymity for wireless sensor networks. Unfortunately, we found that their protocol had a design flaw in the user and sensor authentication phase. Besides, their protocol can not resist stolen smart card attacks, sensor capture attacks, and user impersonation attacks. In addition, their protocol does not provide perfect forward security. This paper proposes a provably secure authentication to overcome these weaknesses and flaws. By comparing the security and performance of the proposed protocol with other related protocols, we find that our work has reasonable computation overhead and better security.


---

## Body

## 1. Introduction

The Internet of things (IoT) [1, 2] is defined as a network formed by sharing data between devices. It is usually used to represent any device connected to the Internet. IoT devices can collect data in the environment, connect to the Internet, and send the data to the cloud. These collected data can be further analyzed by artificial intelligence or machine learning. Some devices can connect to gateways or other devices to share the data they collect, and some devices can even communicate with other related devices and take actions based on the data they obtain from each other. IoT provides many advantages, including enhancing the degree of automation to improve the efficiency of time and resources and making more intelligent decisions using collected data. Now IoT is widely operated in numerous applications and environments such as industry [3, 4], transportation [5, 6], smart cities [7], medical care [8], etc. There are many kinds of IoT devices, and sensors are the most common device of IoT.A wireless sensor network (WSN) [9, 10] is a network of vast numbers of sensors arbitrarily deployed in a particular environment. After being deployed, these sensors sense the environment and collect environmental data, such as temperature, humidity, light, pressure, chemical composition, etc. After that, sensors transmit the sensing data back to a gateway or a server through a wireless network. While submitting sensing data in WSN, it is essential to provide security. The security issue is supposed to be the most demanding mission in WSN as it is challenging to keep monitoring sensor nodes at any time. But it must be secured to prevent an intruder from eavesdropping on data transmission.Many authentication protocols for WSN have been presented [11, 12]. These protocols provide two essential security requirements, authentication of each role in WSN and the confidentiality of transmitted data. Very recently, Sadri and Asaar [13] described a two-factor authentication protocol with anonymity. This protocol allows users to modify their passwords locally. They declared that their protocol is secure against various kinds of attacks, including user impersonation attacks and stolen smart card attacks, and can provide perfect forward secrecy. However, in this paper, we indicate that Sadri et al.’s protocol still has the following security issues. First, this protocol is still weak to user impersonation attacks, stolen smart card attacks, and sensor capture attacks. Second, this protocol does not provide perfect forward secrecy. Third, this protocol cannot complete a sensor node authentication process because of a design flaw. We further analyze why Sadri et al.’s protocol [13] has these security issues. The reasons are categorized in three items. First, once an adversary captures a sensor and gets the sensitive information stored, he can calculate the session key successfully. Second, their protocol selects symmetric encryption algorithms to encrypt the data. The keys used for encryption/decryption are stored in users’ smart cards. If an adversary steals a user’s smart card and obtains parameters stored in it, he can calculate the session key. Third, a sensor cannot know the user’s identity communicating with it, so the sensor and gateway cannot complete a sensor node authentication process correctly.In this paper, to solve the drawbacks and flaws of Sadri and Asaar protocol [13], we offer a provable secure two-factor authentication protocol for IoT. Unlike their protocol [13], we decide to use asymmetric key encryption algorithms to design our protocol. It can prevent sensor capture attacks. In our design, an adversary cannot calculate a session key or impersonate a legitimate user if he has compromised a sensor or stolen a smart card. In order to demonstrate that the proposed protocol is provably secure, we utilize the Random Oracle (ROR) model for conducting a formal security investigation. Besides, we employ BAN logic to examine the security and logic of our design. Furthermore, we estimate the performance of the proposed protocol concerning the computation and communication costs. The experimental results reveal that our method has significant advantages in both security and performance.The remainder of this paper is arranged as follows. Section2 introduces the related works and Section 3 presents the system model, respectively. In Section 4, we briefly review Sadri and Assar protocol [13] and then cryptoanalyze it. The proposed protocol is represented in Section 6. Sections 7 and 8 deliver security and performance analyses and comparisons. Finally, Section 9 concludes the paper.


## 2. Related Work

Because of the increasing number of IoT devices and cyberattacks, there is various existing research on security issues for different applications and environments [14]. Chaudhry et al. [15] offered an anonymous device-to-device access control mechanism for the Internet of Medical Things. Huang et al. [1] designed a revocable storage attribute-based encryption algorithm in cloud-assisted IoT. Xue and Chen [16] utilized a compact evolutionary search scheme to match sensor ontologies. Chu et al. [17] presented an algorithm to identify correctness data in WSN. Reddy et al. [18] described a security approach for home surveillance systems using IoT. Li et al. [19] described a secure paradigm of message protection for RFID-based IoT. Hussain et al. [7] designed a secure mechanism for smart cities.As for research for authentication protocols in IoT, Turkanovic et al. [20] provided an authentication protocol that enhances user privacy in 2014, but Amin and Biswas [21] discovered that their protocol [20] is helpless to stolen smart card attacks and offline password guessing attacks. Then, Xu et al. [22] proposed a new authentication protocol and declared that it could resist various known attacks and have user anonymity. However, Alzahrani et al.’s [23] located that Xu et al.’s protocol [22] does not have user anonymity after performing offline identity guessing attacks. Besides, in 2020, Shin and Kwon [24] discovered that Adavoudi-Jolfae et al.’s protocol [25] cannot resist desynchronization attacks and user collusion attacks and then proposed a new privacy protection authentication protocol. In addition, Tewari and Gupta [26] proposed a novel protocol using bit-by-bit operations to reduce communication costs. After that, Jiang et al. [27] proposed another authentication protocol to provide confidentiality and integrity of transmitted messages. In 2020, Wu et al. [28] proposed a three-factor authentication protocol for WSN. Still, Sadri and Asaar [13] proved that it is vulnerable to sensor capture attacks, user tracking attacks, and desynchronization attacks, and they proposed a new protocol.


## 3. System Model

Here we define the network model and the adversary model used in this paper.


### 3.1. Network Model

The architecture of the protocol is illustrated in Figure1. All communications in this architecture are through a public channel. Three entities are involved.(1)
Sensor nodes: Various sensor nodes are deployed everywhere to sense the environment and gather data. After receiving the request from a user, a sensor node transmits data to the user through a gateway.(2)
Users: If a user desires to acquire the data from a specific sensor node, he transmits a request to a gateway. This gateway confirms whether the request is valid and then forwards it to that specific sensor node.(3)
Gateway: A gateway acts as a virtual bridge connecting users and sensor nodes wirelessly. More specifically, a gateway establishes an effective session process between users and sensors.Figure 1
Network model.


### 3.2. Adversary Model

To analyze the security of an authentication protocol, we need to define an adversary model first. Two well-known adversary models, Dolev-Yao (DY) adversary model [29] and Canetti-Krawczyk (CK) [30] adversary model, are widely used. DY model considers that an adversary can control messages transmitted through public channels and decrypt them with a known key. On the other hand, CK model can verify whether the protocol has some necessary security attributes. In this paper, we combine the characteristics of DY model and CK model and then define an adversary model suitable for this paper. We assume that the adversary A has the subsequent capabilities.(1)
A can extract messages stored in the smart card with power analysis after stealing it [31, 32].(2)
A can intercept, modify, and replay the messages transmitted through public channels.(3)
A can compromise a gateway and then obtain information stored in it [33, 34] and get the long-term key of gateway [35, 36].(4)
A can capture a sensor node and then obtain the sensitive information stored in it [37].


## 3.1. Network Model

The architecture of the protocol is illustrated in Figure1. All communications in this architecture are through a public channel. Three entities are involved.(1)
Sensor nodes: Various sensor nodes are deployed everywhere to sense the environment and gather data. After receiving the request from a user, a sensor node transmits data to the user through a gateway.(2)
Users: If a user desires to acquire the data from a specific sensor node, he transmits a request to a gateway. This gateway confirms whether the request is valid and then forwards it to that specific sensor node.(3)
Gateway: A gateway acts as a virtual bridge connecting users and sensor nodes wirelessly. More specifically, a gateway establishes an effective session process between users and sensors.Figure 1
Network model.


## 3.2. Adversary Model

To analyze the security of an authentication protocol, we need to define an adversary model first. Two well-known adversary models, Dolev-Yao (DY) adversary model [29] and Canetti-Krawczyk (CK) [30] adversary model, are widely used. DY model considers that an adversary can control messages transmitted through public channels and decrypt them with a known key. On the other hand, CK model can verify whether the protocol has some necessary security attributes. In this paper, we combine the characteristics of DY model and CK model and then define an adversary model suitable for this paper. We assume that the adversary A has the subsequent capabilities.(1)
A can extract messages stored in the smart card with power analysis after stealing it [31, 32].(2)
A can intercept, modify, and replay the messages transmitted through public channels.(3)
A can compromise a gateway and then obtain information stored in it [33, 34] and get the long-term key of gateway [35, 36].(4)
A can capture a sensor node and then obtain the sensitive information stored in it [37].


## 4. Revisit Sadri Et Al.’s Protocol

The specific steps of Sadri et al.’s protocol [13] are as follows. Table 1 details the symbols used.Table 1
Notations and symbols definition.
NotationsDescriptionsUiThei th userSjThej th sensorIDi,PWiUi’s identity, passwordGWNThe gatewaySNjSj’s identityKguShared private keys between the user and gatewayPUGPublic key of GWNPRGGWN private keysX1,X2Private keys ofGWNNIDiNew temporary identity ofUih(⋅)Hash function⊕Bitwise XOR operation∥Concatenate operationsENC/DECSymmetric encryption/decryption⟶Public communication channelsAAdversarySKSession key


### 4.1. User Registration Phase

(1)
Ui first enters his own identity IDi and selects a random number Z1, calculates the Ui′s pseudo-identity HIDi=hIDi‖hZ1, and then transmits HIDi to GWN through a secure channel.(2)
GWN generates a temporary identity NIDi, calculates E1=hNIDi‖X1, and then stores NIDi,E1 in the smart card and NIDi in its own memory. Finally, GWN transmits the information NIDi,E1 to Ui.(3)
Ui enters his password PWi, calculates E2=hPWi‖HIDi⊕E1, E3=hhPWi‖IDi⊕hZ1, E4=hhPWi‖E1‖hZ1, and finally stores E2,E3,E4,NIDi in the smart card.


### 4.2. Sensor Registration Phase

First,GWN selects an identity SNj for Sj, calculates PKj =  hSNj‖X2 using GWN′s private key, stores SNj,PKj in memory, and transmits SNj,PKj to SNj via a secure channel. SNj stores SNj,PKj in memory.


### 4.3. Login and Mutual Authentication Phase

(1)
Ui enters his own IDi and PWi and then calculates hZ1=hhPWi‖IDi⊕E3, HIDi=hIDi‖hZ1, E1=hPWi‖HIDi⊕E2, E4∗=hhPWi‖E1‖hZ1. Next, Ui compares the calculated E4∗ with the E4 stored in the smart card. If they are equal, Ui further generates a random number Z2 and computes W1=ENCE1Z2‖SNj‖HIDi, W2=hZ2‖SNj‖HIDi‖E1, and then, Ui transmits W1,W2,NIDi to GWN through a public channel.(2)
GWN first calculates E1=hNIDi‖X1 and then calculates Z2‖SNj‖HIDi=DECE1W1 through W1 and E1 and then GWN queries in the database according to the calculated HIDi. Next, GWN calculates W2∗=hZ2‖SNj‖HIDi‖E1 and verifies whether the value of W2∗ is equal to W2. If it is equal, the verification passes, and, thereafter, GWN generates a random number Z3 and calculates PKj=hX2‖SNj, W3=hPKj‖SNj⊕Z2‖Z3, W4=hPKj‖SNj‖Z2‖Z3, and then GWN transmits W3,W4 to Sj.(3)
Sj first calculates Z2‖Z3=hPKj‖SNj⊕W3, then Sj calculates W4∗=hPKj‖SNj‖HIDi‖Z2‖Z3 and checks whether it is equal to the transmitted W4. Next, Sj generates a random number Z4 and then computes the session key SK=hSNj‖Z4‖Z3‖Z2, W5=hPKj‖Z3‖SNj⊕Z4, W6=hPKj‖Z3‖Z4‖SK, and then Sj transmits W5,W6 to GWN.(4)
GWN calculates Z4=hPKj‖Z3‖SNj⊕W5, obtains the session key SK=hSNj‖Z4‖Z3‖Z2, W6∗=hPKj‖Z3‖Z4‖SK, and compares the calculated W6∗ with the transmitted W6. Next, GWN generates a new gateway pseudo-identity NIDinew and updates E1new=hNIDinew‖X1, W7=ENCE1Z4‖Z3‖E1new‖NIDinew, W8=hE1new‖NIDinew‖SK‖Z3‖Z4‖E1, and then GWN transmits W7,W8 to Ui.(5)
Ui calculates Z3‖Z4‖E1new‖NIDinew=DECE1W7, SK=hSNj‖Z4‖Z3‖Z2 and then verifies whether the calculated W8∗=hE1new‖NIDinew‖SK‖Z3‖Z4‖E1 is equal to W8. If it is equal, Ui replaces E2,NIDi with E2new,NIDinew where E2new=hPWi‖HIDi⊕E1new.


## 4.1. User Registration Phase

(1)
Ui first enters his own identity IDi and selects a random number Z1, calculates the Ui′s pseudo-identity HIDi=hIDi‖hZ1, and then transmits HIDi to GWN through a secure channel.(2)
GWN generates a temporary identity NIDi, calculates E1=hNIDi‖X1, and then stores NIDi,E1 in the smart card and NIDi in its own memory. Finally, GWN transmits the information NIDi,E1 to Ui.(3)
Ui enters his password PWi, calculates E2=hPWi‖HIDi⊕E1, E3=hhPWi‖IDi⊕hZ1, E4=hhPWi‖E1‖hZ1, and finally stores E2,E3,E4,NIDi in the smart card.


## 4.2. Sensor Registration Phase

First,GWN selects an identity SNj for Sj, calculates PKj =  hSNj‖X2 using GWN′s private key, stores SNj,PKj in memory, and transmits SNj,PKj to SNj via a secure channel. SNj stores SNj,PKj in memory.


## 4.3. Login and Mutual Authentication Phase

(1)
Ui enters his own IDi and PWi and then calculates hZ1=hhPWi‖IDi⊕E3, HIDi=hIDi‖hZ1, E1=hPWi‖HIDi⊕E2, E4∗=hhPWi‖E1‖hZ1. Next, Ui compares the calculated E4∗ with the E4 stored in the smart card. If they are equal, Ui further generates a random number Z2 and computes W1=ENCE1Z2‖SNj‖HIDi, W2=hZ2‖SNj‖HIDi‖E1, and then, Ui transmits W1,W2,NIDi to GWN through a public channel.(2)
GWN first calculates E1=hNIDi‖X1 and then calculates Z2‖SNj‖HIDi=DECE1W1 through W1 and E1 and then GWN queries in the database according to the calculated HIDi. Next, GWN calculates W2∗=hZ2‖SNj‖HIDi‖E1 and verifies whether the value of W2∗ is equal to W2. If it is equal, the verification passes, and, thereafter, GWN generates a random number Z3 and calculates PKj=hX2‖SNj, W3=hPKj‖SNj⊕Z2‖Z3, W4=hPKj‖SNj‖Z2‖Z3, and then GWN transmits W3,W4 to Sj.(3)
Sj first calculates Z2‖Z3=hPKj‖SNj⊕W3, then Sj calculates W4∗=hPKj‖SNj‖HIDi‖Z2‖Z3 and checks whether it is equal to the transmitted W4. Next, Sj generates a random number Z4 and then computes the session key SK=hSNj‖Z4‖Z3‖Z2, W5=hPKj‖Z3‖SNj⊕Z4, W6=hPKj‖Z3‖Z4‖SK, and then Sj transmits W5,W6 to GWN.(4)
GWN calculates Z4=hPKj‖Z3‖SNj⊕W5, obtains the session key SK=hSNj‖Z4‖Z3‖Z2, W6∗=hPKj‖Z3‖Z4‖SK, and compares the calculated W6∗ with the transmitted W6. Next, GWN generates a new gateway pseudo-identity NIDinew and updates E1new=hNIDinew‖X1, W7=ENCE1Z4‖Z3‖E1new‖NIDinew, W8=hE1new‖NIDinew‖SK‖Z3‖Z4‖E1, and then GWN transmits W7,W8 to Ui.(5)
Ui calculates Z3‖Z4‖E1new‖NIDinew=DECE1W7, SK=hSNj‖Z4‖Z3‖Z2 and then verifies whether the calculated W8∗=hE1new‖NIDinew‖SK‖Z3‖Z4‖E1 is equal to W8. If it is equal, Ui replaces E2,NIDi with E2new,NIDinew where E2new=hPWi‖HIDi⊕E1new.


## 5. Cryptanalysis of Sadri Et Al.’s Protocol

Here we discovered that Sadri et al.’s protocol [13] has the following security issues. First, this protocol cannot complete a sensor node authentication process. Second, this protocol is still insecure against user impersonation attacks, stolen smart card attacks, and sensor capture attacks. Third, this protocol does not provide perfect forward secrecy.


### 5.1. Failure Sensor Node Authentication

In the login and authentication phase,GWN sends W3,W4 to Sj in Step 2. After that, Sj computes W4∗=hPKj‖SNj‖HIDi‖Z2‖Z3. However, Sj cannot understand the value of HIDi which is an pseudo-identity of Ui. For this reason, the procedure is now terminated.


### 5.2. Sensor Capture Attack

Assuming thatA captures Sj and obtains the data PKj,SNj stored in Sj, A also eavesdrops on W3 and W5 transmitted over a public channel, and then A can calculate SK through the following steps.(1)
ObtainZ2, Z3 by calculating hPKj‖SNj⊕W3=Z2‖Z3.(2)
ObtainZ4 by calculating hPKj‖Z3‖SNj⊕W5.(3)
After havingSNj, Z4, Z2, and Z3, A can calculate SK where SK=hSNj‖Z4‖Z3‖Z2.


### 5.3. Stolen Smart Card Attack

Assuming thatA thieves the smart card of Ui in some manner and then obtains NIDi,E1,E2,E3,E4 stored in this smart card, A also eavesdrops on W1 and W7 transmitted over a public channel. Now A can calculate SK through the following steps.(1)
ObtainZ2 and SNj by calculating DECE1W1=Z2‖SNj‖HIDi.(2)
ObtainZ4 and Z3 by calculating DECE1W7 = Z4‖Z3‖E1new‖NIDinew.(3)
A can now calculate SK=hSNj‖Z4‖Z3‖Z2.


### 5.4. User Impersonation Attack

SupposeA obtains the private key of GWNX1; then A obtains some parameters based on the obtained key to pretend to be a legitimate user and successfully authenticate each other with Sj. The specific steps are as follows:A calculates E1=hNIDi‖X1 with obtained X1 and then Z2‖SNj‖HIDi by decrypting DECE1W1 with E1. With Z2, SNj, HIDi, and E1, now A can act as legitimate user to authenticate GWN. GWN verifies that W2 is equal to hZ2‖SNj‖HIDi‖E1, and thus Ui and Sj are successfully mutually authenticated. Next, GWN sends a message W3,W4 to Sj, and Sj verifies that W4 is equal to hPKj‖SNj‖HIDi‖Z2‖Z3, because PKj and SNj are stored in Sj’s memory, HIDi, Z2, Z3 can be obtained by Z2‖Z3=hPKj‖SNj⊕W3, and hence GWN and Sj are successfully authenticated. Similarly, in the process of sending information from Sj to GWN and the message from GWN to Ui, GWN and Ui can be successfully authenticated according to the above operations, and thus A can complete a complete mutual authentication operation after obtaining the key of GWN.


### 5.5. Perfect Forward Security

Assuming thatA obtains X1 in GWN and eavesdrops on NIDi, W1, and W7 through a public channel, then A can obtain SK through the following steps:(1)
ObtainE1 by calculating E1=hNIDi‖X1.(2)
ObtainZ2, SNj, and HIDi by calculating DECE1W1=Z2‖SNj‖HIDi.(3)
ObtainZ3 and Z4 by calculating DECE1W7 = Z4‖Z3‖E1new‖NIDinew.(4)
NowA can compute SK where hSNj‖Z4‖Z3‖Z2.


## 5.1. Failure Sensor Node Authentication

In the login and authentication phase,GWN sends W3,W4 to Sj in Step 2. After that, Sj computes W4∗=hPKj‖SNj‖HIDi‖Z2‖Z3. However, Sj cannot understand the value of HIDi which is an pseudo-identity of Ui. For this reason, the procedure is now terminated.


## 5.2. Sensor Capture Attack

Assuming thatA captures Sj and obtains the data PKj,SNj stored in Sj, A also eavesdrops on W3 and W5 transmitted over a public channel, and then A can calculate SK through the following steps.(1)
ObtainZ2, Z3 by calculating hPKj‖SNj⊕W3=Z2‖Z3.(2)
ObtainZ4 by calculating hPKj‖Z3‖SNj⊕W5.(3)
After havingSNj, Z4, Z2, and Z3, A can calculate SK where SK=hSNj‖Z4‖Z3‖Z2.


## 5.3. Stolen Smart Card Attack

Assuming thatA thieves the smart card of Ui in some manner and then obtains NIDi,E1,E2,E3,E4 stored in this smart card, A also eavesdrops on W1 and W7 transmitted over a public channel. Now A can calculate SK through the following steps.(1)
ObtainZ2 and SNj by calculating DECE1W1=Z2‖SNj‖HIDi.(2)
ObtainZ4 and Z3 by calculating DECE1W7 = Z4‖Z3‖E1new‖NIDinew.(3)
A can now calculate SK=hSNj‖Z4‖Z3‖Z2.


## 5.4. User Impersonation Attack

SupposeA obtains the private key of GWNX1; then A obtains some parameters based on the obtained key to pretend to be a legitimate user and successfully authenticate each other with Sj. The specific steps are as follows:A calculates E1=hNIDi‖X1 with obtained X1 and then Z2‖SNj‖HIDi by decrypting DECE1W1 with E1. With Z2, SNj, HIDi, and E1, now A can act as legitimate user to authenticate GWN. GWN verifies that W2 is equal to hZ2‖SNj‖HIDi‖E1, and thus Ui and Sj are successfully mutually authenticated. Next, GWN sends a message W3,W4 to Sj, and Sj verifies that W4 is equal to hPKj‖SNj‖HIDi‖Z2‖Z3, because PKj and SNj are stored in Sj’s memory, HIDi, Z2, Z3 can be obtained by Z2‖Z3=hPKj‖SNj⊕W3, and hence GWN and Sj are successfully authenticated. Similarly, in the process of sending information from Sj to GWN and the message from GWN to Ui, GWN and Ui can be successfully authenticated according to the above operations, and thus A can complete a complete mutual authentication operation after obtaining the key of GWN.


## 5.5. Perfect Forward Security

Assuming thatA obtains X1 in GWN and eavesdrops on NIDi, W1, and W7 through a public channel, then A can obtain SK through the following steps:(1)
ObtainE1 by calculating E1=hNIDi‖X1.(2)
ObtainZ2, SNj, and HIDi by calculating DECE1W1=Z2‖SNj‖HIDi.(3)
ObtainZ3 and Z4 by calculating DECE1W7 = Z4‖Z3‖E1new‖NIDinew.(4)
NowA can compute SK where hSNj‖Z4‖Z3‖Z2.


## 6. Proposed Protocol

The protocol consists of four phases. The first phase is the predeployment phase, through which parameters required in the communication process can be deployed in advance. The second is the user registration phase, through whichUi can become a legal user through some operations to communicate with Sj. The third is the sensor registration phase, through which Sj can set the parameters required for communication with Ui in advance and then store them in memory. The fourth phase is the login and authentication phase, which can complete the key establishment process of Ui and Sj. The specific protocol steps are as follows.


### 6.1. Predeployment Phase

In this phase, each user needs to negotiate a key withGWN. Assume that a user Ui wants to join this system and has negotiated a key Ggu with GWN. In our design, we assume that this key cannot be obtained by adversaries.


### 6.2. User Registration Phase

Assume that a userUi wishes to register to GWN. Figure 2 displays the user registration phase. Messages transmitted in this phase are via a secure channel.(1)
Ui selects an identity IDi for himself, generates a random number r1, calculates the user’s pseudo-identity RIDi=hIDi∥hr1, and then sends RIDi to GWN.(2)
GWN first checks whether RIDi has been registered before and then generates a temporary identity TIDi for Ui and calculates A1=hTIDi∥X1∥Kgu. After that, GWN stores TIDi,A1 in a smart card and stores Ui’s pseudo-identity RIDi in its own memory. Finally, GWN transmits this smart card to Ui.(3)
Ui enters his password PWi, and then Ui protects his password PWi from being obtained by A by calculating A2=hPWi‖RIDi. Next, Ui calculates A3=hhPWi‖IDi⊕hr1, A4=hPWi‖r1, A5=hA1‖Kgu‖RIDi, and finally Ui stores A2,A3,A4,TIDi,Kgu in the smart card.Figure 2
User registration phase.


### 6.3. Sensor Registration Phase

Assume that a sensor nodeSj wishes to register with GWN; Sj performs the following steps. Figure 3 illustrates the sensor registration phase. Note that all messages transmitted in this phase are via a secure channel.Figure 3
Sensor registration phase.GWN first selects an identity SNj for Sj and then uses the GWN’s private key X1 to protect the identity of Sj to obtain the pseudo-identity of Sj, which is U=hSNj‖X2. Finally, GWN transmits U,SNj,RIDi to Sj. After receiving these messages, Sj stores the information U,SNj,RIDi in its own memory.


### 6.4. Login and Authentication Phase

Here we describe this phase betweenUi and Sj with GWN. The following steps are performed. Note that all transmissions in this phase are through a public channel. Figure 4 illustrates the architecture of this phase.(1)
Ui first enters his IDi and PWi to log in and calculates hr1=hhPWi‖IDi⊕A3, and Ui then calculates Ui’s pseudo-identity RIDi=hIDi‖hr1 from the calculated hr1 and then verifies whether hPWi‖hr1 is equal to the A4 stored in the smart card. If they are equal, it proves that the legitimate user has successfully logged in. Next, Ui generates a random number r2, calculates Y1=ENCA5r2‖SNj‖RIDi, Y2=hr2‖SNj‖RIDi‖A1, and then transmits Y1,Y2,TIDi to GWN.(2)
GWN first calculates A1=hTIDi‖X1‖Kgu and then obtains r2‖SNj‖RIDi=DECA5Y1 through a symmetric decryption operation. GWN searches the database according to the obtained pseudo-identity of Ui and then verifies whether hr2‖SNj‖RIDi‖A1 is the same as the received Y2. After that, GWN generates r3 and computes U=hX2‖SNj, Y3=hU‖SNj⊕r2‖r3‖RIDi, and Y4=hU‖SNj‖r2‖r3‖RIDi. Finally, GWN transmits Y3,Y4 to Sj.(3)
Sj first calculates r2‖r3‖RIDi=hU‖SNj⊕Y3 to obtain r2, r3, and RIDi and then checks the legitimacy of GWN by verifying whether hU‖SNj‖r2‖r3‖RIDi is equal to Y4. After that, Sj generates r4 and then computes SK=hSNj‖r2‖r3‖r4. Sj generates another random number L and calculates WL=ENCPUGL and then calculates Y5=hU∥r3∥SNj∥L⊕r4, Y6=hU‖r3‖r4‖SK. Now Sj transmits Y5,Y6,WL to GWN.(4)
GWN first calculates L=DECPRGWL and computes the random number r4=Y5⊕hU‖r3‖SNj‖L. Then GWN calculates the session key SK=hSNj‖r2‖r3‖r4 and verifies whether Y6 is equal to hU‖r3‖r4‖SK. If they are equal, GWN starts to update Ui’s temporary identity. GWN generates a new temporary identity TIDinew, calculates A1new=hTIDinew‖X1‖Kgu, Y7=ENCA5r4‖r3‖A1new‖TIDinew, Y8=hA1new‖TIDinew‖SK‖r3‖r4‖A1, and transmits Y7,Y8 to Ui.(5)
Ui first decrypts Y7 with A5 to obtain r3‖r4‖A1new‖TIDinew and then generates the session key SK=hSNj‖r2‖r3‖r4. Ui then verifies whether Y8 is equal to hA1new‖TIDinew‖SK‖r3‖r4‖A1. Finally, Ui updates A2 to obtain A2new=hPWi‖RIDi⊕A1new and replaces A2,TIDi with A2new,TIDinew.Figure 4
Login and authentication phase.


## 6.1. Predeployment Phase

In this phase, each user needs to negotiate a key withGWN. Assume that a user Ui wants to join this system and has negotiated a key Ggu with GWN. In our design, we assume that this key cannot be obtained by adversaries.


## 6.2. User Registration Phase

Assume that a userUi wishes to register to GWN. Figure 2 displays the user registration phase. Messages transmitted in this phase are via a secure channel.(1)
Ui selects an identity IDi for himself, generates a random number r1, calculates the user’s pseudo-identity RIDi=hIDi∥hr1, and then sends RIDi to GWN.(2)
GWN first checks whether RIDi has been registered before and then generates a temporary identity TIDi for Ui and calculates A1=hTIDi∥X1∥Kgu. After that, GWN stores TIDi,A1 in a smart card and stores Ui’s pseudo-identity RIDi in its own memory. Finally, GWN transmits this smart card to Ui.(3)
Ui enters his password PWi, and then Ui protects his password PWi from being obtained by A by calculating A2=hPWi‖RIDi. Next, Ui calculates A3=hhPWi‖IDi⊕hr1, A4=hPWi‖r1, A5=hA1‖Kgu‖RIDi, and finally Ui stores A2,A3,A4,TIDi,Kgu in the smart card.Figure 2
User registration phase.


## 6.3. Sensor Registration Phase

Assume that a sensor nodeSj wishes to register with GWN; Sj performs the following steps. Figure 3 illustrates the sensor registration phase. Note that all messages transmitted in this phase are via a secure channel.Figure 3
Sensor registration phase.GWN first selects an identity SNj for Sj and then uses the GWN’s private key X1 to protect the identity of Sj to obtain the pseudo-identity of Sj, which is U=hSNj‖X2. Finally, GWN transmits U,SNj,RIDi to Sj. After receiving these messages, Sj stores the information U,SNj,RIDi in its own memory.


## 6.4. Login and Authentication Phase

Here we describe this phase betweenUi and Sj with GWN. The following steps are performed. Note that all transmissions in this phase are through a public channel. Figure 4 illustrates the architecture of this phase.(1)
Ui first enters his IDi and PWi to log in and calculates hr1=hhPWi‖IDi⊕A3, and Ui then calculates Ui’s pseudo-identity RIDi=hIDi‖hr1 from the calculated hr1 and then verifies whether hPWi‖hr1 is equal to the A4 stored in the smart card. If they are equal, it proves that the legitimate user has successfully logged in. Next, Ui generates a random number r2, calculates Y1=ENCA5r2‖SNj‖RIDi, Y2=hr2‖SNj‖RIDi‖A1, and then transmits Y1,Y2,TIDi to GWN.(2)
GWN first calculates A1=hTIDi‖X1‖Kgu and then obtains r2‖SNj‖RIDi=DECA5Y1 through a symmetric decryption operation. GWN searches the database according to the obtained pseudo-identity of Ui and then verifies whether hr2‖SNj‖RIDi‖A1 is the same as the received Y2. After that, GWN generates r3 and computes U=hX2‖SNj, Y3=hU‖SNj⊕r2‖r3‖RIDi, and Y4=hU‖SNj‖r2‖r3‖RIDi. Finally, GWN transmits Y3,Y4 to Sj.(3)
Sj first calculates r2‖r3‖RIDi=hU‖SNj⊕Y3 to obtain r2, r3, and RIDi and then checks the legitimacy of GWN by verifying whether hU‖SNj‖r2‖r3‖RIDi is equal to Y4. After that, Sj generates r4 and then computes SK=hSNj‖r2‖r3‖r4. Sj generates another random number L and calculates WL=ENCPUGL and then calculates Y5=hU∥r3∥SNj∥L⊕r4, Y6=hU‖r3‖r4‖SK. Now Sj transmits Y5,Y6,WL to GWN.(4)
GWN first calculates L=DECPRGWL and computes the random number r4=Y5⊕hU‖r3‖SNj‖L. Then GWN calculates the session key SK=hSNj‖r2‖r3‖r4 and verifies whether Y6 is equal to hU‖r3‖r4‖SK. If they are equal, GWN starts to update Ui’s temporary identity. GWN generates a new temporary identity TIDinew, calculates A1new=hTIDinew‖X1‖Kgu, Y7=ENCA5r4‖r3‖A1new‖TIDinew, Y8=hA1new‖TIDinew‖SK‖r3‖r4‖A1, and transmits Y7,Y8 to Ui.(5)
Ui first decrypts Y7 with A5 to obtain r3‖r4‖A1new‖TIDinew and then generates the session key SK=hSNj‖r2‖r3‖r4. Ui then verifies whether Y8 is equal to hA1new‖TIDinew‖SK‖r3‖r4‖A1. Finally, Ui updates A2 to obtain A2new=hPWi‖RIDi⊕A1new and replaces A2,TIDi with A2new,TIDinew.Figure 4
Login and authentication phase.


## 7. Security Analysis

Here we utilize ROR model and BAN logic to demonstrate our protocol is provably secure. We also indicate that our work is secure against various attacks.


### 7.1. ROR Security Analysis

#### 7.1.1. ROR Model

Random Oracle (ROR) model [38] is widely utilized to achieve a formal security analysis of an authentication protocol. Theorem 1 proves the security of the session key in our protocol.In our design, we defined three entities:Ui, GWN, and Sj. In the proof process, we assume that Ua, Gb, and Sc are the a-th user, b-th gateway, and c-th sensor node, and P=Ua,Gb,Sc. Because A can completely control a public channel, A can intercept, modify, and delete messages transmitted through a public channel. In addition, A can execute the following queries:ExecuteP: A can destroy messages shared between various entities.SendP,M: A can transmit information M to P.Hashstring: By doing this, after entering a series of strings, A can obtain a fixed value.CorruptSmartCardUa): By executing this query, A can easily steal Ui’s smart card and extract the parameters stored in it.CorruptSensorGb: By executing this query, all the information stored in Sj is exposed to A.TestT: This operation is performed to verify the security of the shared secret key between Ui and Sj. Toss a coin before experimenting. If the result is 1, the correct session key is returned, and a random number is returned if the result is 0.


#### 7.1.2. Security Proof

Theorem 1.
SupposeA is an attacker running in polynomial t time to counter the protocol we proposed under the ROR model. Here, C is a unified dictionary and f is the number of digits of the key in the biometric information of Ui. The advantage of A’s ability to destroy our new protocol is as follows:
AdvAP≤qh2/H+2qs/Cqh, qs, H, and C represent the Hash query, Send query, the spatial range of the hash function, and the size of the unified dictionary, respectively.To prove the security of the session key, we defined four games:GMi (i = 0, 1, 2, 3); SUCCG represents A’s victory in the game. We start from GM0 to the end of GM3. The detailed procedure is as follows:GM0: In the initial game, A does not need to perform any query operations and only needs to select bits; hence we obtain(1)AdvAPt=2PrSuccAPt−1.GM1: In this game, we simulated an eavesdropping attack. A executes the ExecuteP query and then verifies whether SK is a random number or a real key by executing a TestP query. The session key SK=hSNj‖r2‖r3‖r4 in the protocol; we assume that A intercepts messages M1, M2, M3, M4, and M5 sent by Ui and Sj, but only calculated SK based on the intercepted information is impossible; hence we obtain(2)PrSuccAGM1=PrSuccAGM0.GM2: The third game adds the SendP query operation and Hashstring operation to the second game. In this game, A can use SendP query operations and Hashstring operations to obtain some parameter information, and A can fabricate some entity messages. To create authentic and credible messages M1, M2, M3, M4, and M5, A must know the secret parameters r2, r3, r4, and SNj, but these secret parameters are hidden in the hash function to prevent A from stealing. Based on the birthday paradox, we can draw the following conclusions:(3)PrSuccAGM1−PrSuccAGM2≤qh2H.GM3: On the basis of the previous game, the operations of performing the CorruptSmartCardUa and CorruptSensorGb are added. A can extract the information A1,A2,A3,A4,TIDi,Kgu in the smart card and guess the password of Ui based on the unified dictionary. Without knowing the password of Ui, it is extremely difficult for A to obtain SK; hence we arrive at(4)PrSuccAGM2−PrSuccAGM3≤qsC.Because the session keySK is generated for mutual authentication between Ui and Sj, we obtain(5)PrSuccAGM3=12.After we sort the above equations, we obtain(6)12AdvAP=PrSuccAGM0−12=PrSuccAGM0−PrSuccAGM3=PrSuccAGM1−PrSuccAGM3≤∑i=13PrSuccAGMi−PrSuccAGMi+1=qh22H+qsC.So we can draw the final conclusion:(7)AdvAP≤qh2H+2qsC.Based on the conclusions drawn above, it can be proved that our protocol can be secure against stolen smart card attacks and sensor capture attacks. Moreover, it has perfect forward security.


### 7.2. BAN Security Analysis

Burrows-Abadi-Needham (BAN) logic [39] is a method suitable for analyzing an authentication protocol. It mainly studies the security of the protocol and the logic of the structure. BAN logic has been applied to the security analysis of many protocols and achieved good results.


#### 7.2.1. Rules for BAN Logic

Message-meaning rule (R1)U|≡U⇌KV,U⊲XK/U|≡V|∼X.Nonce-verification rule (R2)U|≡♯X,U|≡V|∼X/U|≡V|≡X.Jurisdiction rule (R3)U|≡V|⇒X,U|≡V|≡X/U|≡X.Freshness rule (R4)U|≡♯X/U|≡♯X,Y.Belief rule (R5)U|≡X,U|≡Y/U|≡X,Y.Session key rule (R6)U|≡♯X,U|≡V|≡X/U|≡U↔KV.


#### 7.2.2. Goals

G1U|≡U↔SKG.G2G|≡U↔SKG.G3U|≡G|≡U↔SKG.G4G|≡U|≡U↔SKG.G5S|≡S↔SKG.G6G|≡S↔SKG.G7S|≡G|≡S↔SKG.G8G|≡S|≡S↔SKG.


#### 7.2.3. Idealizing Communication

Mess1U⟶G: Y1,Y2,TIDi.Mess2G⟶S: Y3,Y4.Mess3S⟶G: Y5,Y6,WL.Mess4G⟶U: Y7,Y8.


#### 7.2.4. Initial State Assumptions

A1G|≡U⇌A5G.A2G|≡♯r2,SNj.A3G|≡U|⇒r2,SNj.A4G|≡♯r3,r4.A5U|≡U⇌A5G.A6U|≡♯r3,r4.A7U|≡♯r2,SNj.A8U|≡G|⇒r3,r4.A9S|≡S⇌UG.A10G|≡S⇌UG.A11S|≡♯r2,r3.A12S|≡G|⇒r2,r3.A13G|≡S|⇒r4.


#### 7.2.5. Detailed Steps

By considering the message Mess1, we getS1:G⊲r2,SNjA5,Y2,TIDi.Using S1, R1, and A1, we getS2:G|≡U|∼r2,SNj.Under the assumption of A2, using S2, R2 can be used to obtainS3:G|≡U|≡r2,SNj.With conclusion S3, using A3 and R3, the following can be obtained:S4:G|≡r2,SNj.Becauser4=Y5⊕hU‖r3‖SNj‖L, L=DECPRGWL, we can getS5:G|≡r4.And becauser3 is generated by G,S6:G|≡r3.BecauseSK=hSNj‖r2‖r3‖r4, using S4, S5, and S9, we obtainS7:G|≡U↔SKG (G2).With A3, A4, S7, and R4, we can getS8:G|≡U|≡U↔SKG (G4).By considering the message Mess4, we obtainS9:U⊲r2,r4A5,Y8.By using S9, A5, and R1 we obtainS10:U|≡G|∼r3,r4.With S10, using A6 and applying R2, we getS11:U|≡G|≡r3,r4.Applying A8, S11, and R3, we haveS12:U|≡r3,r4.BecauseSK=hSNj‖r2‖r3‖r4, using S11 and S13, we obtainS13:U|≡G↔SKU (G1).With conclusion S13, using A6, A7, and R4, we can obtainS14:U|≡G|≡U↔SKG (G3).By considering the message Mess2, we obtainS15:S⊲r2,r3U,Y4.By using S15, A9, and R1, we obtainS16:S|≡G|∼r2,r3.With S16, using A11 and applying R2, we haveS17:S|≡G|≡r2,r3.Applying A12, S17, and R3, we obtainS18:S|≡r2,r3.BecauseSK=hSNj‖r2‖r3‖r4, and SNj and r4 are generated by S, we can getS19:S|≡SNj,r4.Using S18 and S19, we obtainS20:S|≡G↔SKS (G5).With S19, using A11 and R4 we can getS14:S|≡G|≡S↔SKG (G7).By considering the message Mess3, we obtainS22:G⊲r4U,Y6,LPUG.By using S22, A10, and R1 we obtainS23:G|≡S|∼r4.With S23, using A4 and applying R2 we haveS24:G|≡S|≡r4.Applying A13, S24, and R3 we obtainS25:G|≡r4.BecauseSK=hSNj‖r2‖r3‖r4, using S25, S4, and S6, we obtainS26:G|≡G↔SKS (G6).With conclusion S26, using A2, A4, and R4 we can obtainS27:G|≡S|≡S↔SKG (G8).


### 7.3. Potential Attacks

#### 7.3.1. Withstands Stolen Smart Card Attack

We assume thatA obtains Ui’s smart card and the parameters A1,A2,A3,A4,TIDi,Kgu in the smart card through power analysis. Although A obtains these parameters, A cannot obtain A5 because calculating A5 also requires RIDi. Therefore, A cannot further decrypt Y1 and Y7 to obtain SNj, r2, r3, and r4. It means that A cannot calculate SK. Now we can say that our protocol can resist stolen smart card attacks.


#### 7.3.2. Withstands Sensor Capture Attack

Assuming thatA captures the sensor and extracts the message U,SNj,RIDi stored in Sj, now A can obtain r2 and r3 with Y3 and the messages extracted from the sensor. However, A cannot further obtain L and r4 because A does not have X2. For this reason, A cannot calculate SK through sensor capture attacks.


#### 7.3.3. Withstands User Impersonation Attack

SupposeA obtains GWN key X1, but the shared key Kgu between GWN and Ui cannot be obtained; therefore, parameter A1 cannot be obtained. Without A1, A cannot obtain A5. Also, without A5, A cannot decrypt Y1 to get SNj and r2. It is obvious that our design can resist user impersonation attacks.


#### 7.3.4. Perfect Forward Security

AssumingA obtains the long-term key X1 of GWN, A cannot obtain Kgu. However, A cannot obtain A1, A5 and further calculate SK. Now we can say the proposed protocol provides the perfect forward security.


#### 7.3.5. Withstands Offline Password Guessing Attack

In the login and authentication phase, we assume thatA tries to guess pwi. A uses the guessed password pwi′ to login. Since A does not know IDi and A3, A cannot verify if pwi′ is correct. Thus, our protocol can effectively resist offline password guessing attacks.


### 7.4. Security Comparisons

Table2 shows the security comparison between the proposed protocol and other related protocols. The outcomes reveal that other related protocols [13, 28, 40, 41] have various flaws in security, but our protocol can withstand different kinds of attacks.Table 2
Comparisons of security.
ProtocolsAmin et al. [40]Chen et al. [41]Wu et al. [28]Sadri and Asaar [13]Our protocolReply attackYYYYYStolen smart card attackNYYNYStolen verifier attackNYYNYOffline password guessing attackYNYYYSensor capture attackYYNNYProvide perfect forward securityYYNNY


## 7.1. ROR Security Analysis

### 7.1.1. ROR Model

Random Oracle (ROR) model [38] is widely utilized to achieve a formal security analysis of an authentication protocol. Theorem 1 proves the security of the session key in our protocol.In our design, we defined three entities:Ui, GWN, and Sj. In the proof process, we assume that Ua, Gb, and Sc are the a-th user, b-th gateway, and c-th sensor node, and P=Ua,Gb,Sc. Because A can completely control a public channel, A can intercept, modify, and delete messages transmitted through a public channel. In addition, A can execute the following queries:ExecuteP: A can destroy messages shared between various entities.SendP,M: A can transmit information M to P.Hashstring: By doing this, after entering a series of strings, A can obtain a fixed value.CorruptSmartCardUa): By executing this query, A can easily steal Ui’s smart card and extract the parameters stored in it.CorruptSensorGb: By executing this query, all the information stored in Sj is exposed to A.TestT: This operation is performed to verify the security of the shared secret key between Ui and Sj. Toss a coin before experimenting. If the result is 1, the correct session key is returned, and a random number is returned if the result is 0.


### 7.1.2. Security Proof

Theorem 1.
SupposeA is an attacker running in polynomial t time to counter the protocol we proposed under the ROR model. Here, C is a unified dictionary and f is the number of digits of the key in the biometric information of Ui. The advantage of A’s ability to destroy our new protocol is as follows:
AdvAP≤qh2/H+2qs/Cqh, qs, H, and C represent the Hash query, Send query, the spatial range of the hash function, and the size of the unified dictionary, respectively.To prove the security of the session key, we defined four games:GMi (i = 0, 1, 2, 3); SUCCG represents A’s victory in the game. We start from GM0 to the end of GM3. The detailed procedure is as follows:GM0: In the initial game, A does not need to perform any query operations and only needs to select bits; hence we obtain(1)AdvAPt=2PrSuccAPt−1.GM1: In this game, we simulated an eavesdropping attack. A executes the ExecuteP query and then verifies whether SK is a random number or a real key by executing a TestP query. The session key SK=hSNj‖r2‖r3‖r4 in the protocol; we assume that A intercepts messages M1, M2, M3, M4, and M5 sent by Ui and Sj, but only calculated SK based on the intercepted information is impossible; hence we obtain(2)PrSuccAGM1=PrSuccAGM0.GM2: The third game adds the SendP query operation and Hashstring operation to the second game. In this game, A can use SendP query operations and Hashstring operations to obtain some parameter information, and A can fabricate some entity messages. To create authentic and credible messages M1, M2, M3, M4, and M5, A must know the secret parameters r2, r3, r4, and SNj, but these secret parameters are hidden in the hash function to prevent A from stealing. Based on the birthday paradox, we can draw the following conclusions:(3)PrSuccAGM1−PrSuccAGM2≤qh2H.GM3: On the basis of the previous game, the operations of performing the CorruptSmartCardUa and CorruptSensorGb are added. A can extract the information A1,A2,A3,A4,TIDi,Kgu in the smart card and guess the password of Ui based on the unified dictionary. Without knowing the password of Ui, it is extremely difficult for A to obtain SK; hence we arrive at(4)PrSuccAGM2−PrSuccAGM3≤qsC.Because the session keySK is generated for mutual authentication between Ui and Sj, we obtain(5)PrSuccAGM3=12.After we sort the above equations, we obtain(6)12AdvAP=PrSuccAGM0−12=PrSuccAGM0−PrSuccAGM3=PrSuccAGM1−PrSuccAGM3≤∑i=13PrSuccAGMi−PrSuccAGMi+1=qh22H+qsC.So we can draw the final conclusion:(7)AdvAP≤qh2H+2qsC.Based on the conclusions drawn above, it can be proved that our protocol can be secure against stolen smart card attacks and sensor capture attacks. Moreover, it has perfect forward security.


## 7.1.1. ROR Model

Random Oracle (ROR) model [38] is widely utilized to achieve a formal security analysis of an authentication protocol. Theorem 1 proves the security of the session key in our protocol.In our design, we defined three entities:Ui, GWN, and Sj. In the proof process, we assume that Ua, Gb, and Sc are the a-th user, b-th gateway, and c-th sensor node, and P=Ua,Gb,Sc. Because A can completely control a public channel, A can intercept, modify, and delete messages transmitted through a public channel. In addition, A can execute the following queries:ExecuteP: A can destroy messages shared between various entities.SendP,M: A can transmit information M to P.Hashstring: By doing this, after entering a series of strings, A can obtain a fixed value.CorruptSmartCardUa): By executing this query, A can easily steal Ui’s smart card and extract the parameters stored in it.CorruptSensorGb: By executing this query, all the information stored in Sj is exposed to A.TestT: This operation is performed to verify the security of the shared secret key between Ui and Sj. Toss a coin before experimenting. If the result is 1, the correct session key is returned, and a random number is returned if the result is 0.


## 7.1.2. Security Proof

Theorem 1.
SupposeA is an attacker running in polynomial t time to counter the protocol we proposed under the ROR model. Here, C is a unified dictionary and f is the number of digits of the key in the biometric information of Ui. The advantage of A’s ability to destroy our new protocol is as follows:
AdvAP≤qh2/H+2qs/Cqh, qs, H, and C represent the Hash query, Send query, the spatial range of the hash function, and the size of the unified dictionary, respectively.To prove the security of the session key, we defined four games:GMi (i = 0, 1, 2, 3); SUCCG represents A’s victory in the game. We start from GM0 to the end of GM3. The detailed procedure is as follows:GM0: In the initial game, A does not need to perform any query operations and only needs to select bits; hence we obtain(1)AdvAPt=2PrSuccAPt−1.GM1: In this game, we simulated an eavesdropping attack. A executes the ExecuteP query and then verifies whether SK is a random number or a real key by executing a TestP query. The session key SK=hSNj‖r2‖r3‖r4 in the protocol; we assume that A intercepts messages M1, M2, M3, M4, and M5 sent by Ui and Sj, but only calculated SK based on the intercepted information is impossible; hence we obtain(2)PrSuccAGM1=PrSuccAGM0.GM2: The third game adds the SendP query operation and Hashstring operation to the second game. In this game, A can use SendP query operations and Hashstring operations to obtain some parameter information, and A can fabricate some entity messages. To create authentic and credible messages M1, M2, M3, M4, and M5, A must know the secret parameters r2, r3, r4, and SNj, but these secret parameters are hidden in the hash function to prevent A from stealing. Based on the birthday paradox, we can draw the following conclusions:(3)PrSuccAGM1−PrSuccAGM2≤qh2H.GM3: On the basis of the previous game, the operations of performing the CorruptSmartCardUa and CorruptSensorGb are added. A can extract the information A1,A2,A3,A4,TIDi,Kgu in the smart card and guess the password of Ui based on the unified dictionary. Without knowing the password of Ui, it is extremely difficult for A to obtain SK; hence we arrive at(4)PrSuccAGM2−PrSuccAGM3≤qsC.Because the session keySK is generated for mutual authentication between Ui and Sj, we obtain(5)PrSuccAGM3=12.After we sort the above equations, we obtain(6)12AdvAP=PrSuccAGM0−12=PrSuccAGM0−PrSuccAGM3=PrSuccAGM1−PrSuccAGM3≤∑i=13PrSuccAGMi−PrSuccAGMi+1=qh22H+qsC.So we can draw the final conclusion:(7)AdvAP≤qh2H+2qsC.Based on the conclusions drawn above, it can be proved that our protocol can be secure against stolen smart card attacks and sensor capture attacks. Moreover, it has perfect forward security.


## 7.2. BAN Security Analysis

Burrows-Abadi-Needham (BAN) logic [39] is a method suitable for analyzing an authentication protocol. It mainly studies the security of the protocol and the logic of the structure. BAN logic has been applied to the security analysis of many protocols and achieved good results.


### 7.2.1. Rules for BAN Logic

Message-meaning rule (R1)U|≡U⇌KV,U⊲XK/U|≡V|∼X.Nonce-verification rule (R2)U|≡♯X,U|≡V|∼X/U|≡V|≡X.Jurisdiction rule (R3)U|≡V|⇒X,U|≡V|≡X/U|≡X.Freshness rule (R4)U|≡♯X/U|≡♯X,Y.Belief rule (R5)U|≡X,U|≡Y/U|≡X,Y.Session key rule (R6)U|≡♯X,U|≡V|≡X/U|≡U↔KV.


### 7.2.2. Goals

G1U|≡U↔SKG.G2G|≡U↔SKG.G3U|≡G|≡U↔SKG.G4G|≡U|≡U↔SKG.G5S|≡S↔SKG.G6G|≡S↔SKG.G7S|≡G|≡S↔SKG.G8G|≡S|≡S↔SKG.


### 7.2.3. Idealizing Communication

Mess1U⟶G: Y1,Y2,TIDi.Mess2G⟶S: Y3,Y4.Mess3S⟶G: Y5,Y6,WL.Mess4G⟶U: Y7,Y8.


### 7.2.4. Initial State Assumptions

A1G|≡U⇌A5G.A2G|≡♯r2,SNj.A3G|≡U|⇒r2,SNj.A4G|≡♯r3,r4.A5U|≡U⇌A5G.A6U|≡♯r3,r4.A7U|≡♯r2,SNj.A8U|≡G|⇒r3,r4.A9S|≡S⇌UG.A10G|≡S⇌UG.A11S|≡♯r2,r3.A12S|≡G|⇒r2,r3.A13G|≡S|⇒r4.


### 7.2.5. Detailed Steps

By considering the message Mess1, we getS1:G⊲r2,SNjA5,Y2,TIDi.Using S1, R1, and A1, we getS2:G|≡U|∼r2,SNj.Under the assumption of A2, using S2, R2 can be used to obtainS3:G|≡U|≡r2,SNj.With conclusion S3, using A3 and R3, the following can be obtained:S4:G|≡r2,SNj.Becauser4=Y5⊕hU‖r3‖SNj‖L, L=DECPRGWL, we can getS5:G|≡r4.And becauser3 is generated by G,S6:G|≡r3.BecauseSK=hSNj‖r2‖r3‖r4, using S4, S5, and S9, we obtainS7:G|≡U↔SKG (G2).With A3, A4, S7, and R4, we can getS8:G|≡U|≡U↔SKG (G4).By considering the message Mess4, we obtainS9:U⊲r2,r4A5,Y8.By using S9, A5, and R1 we obtainS10:U|≡G|∼r3,r4.With S10, using A6 and applying R2, we getS11:U|≡G|≡r3,r4.Applying A8, S11, and R3, we haveS12:U|≡r3,r4.BecauseSK=hSNj‖r2‖r3‖r4, using S11 and S13, we obtainS13:U|≡G↔SKU (G1).With conclusion S13, using A6, A7, and R4, we can obtainS14:U|≡G|≡U↔SKG (G3).By considering the message Mess2, we obtainS15:S⊲r2,r3U,Y4.By using S15, A9, and R1, we obtainS16:S|≡G|∼r2,r3.With S16, using A11 and applying R2, we haveS17:S|≡G|≡r2,r3.Applying A12, S17, and R3, we obtainS18:S|≡r2,r3.BecauseSK=hSNj‖r2‖r3‖r4, and SNj and r4 are generated by S, we can getS19:S|≡SNj,r4.Using S18 and S19, we obtainS20:S|≡G↔SKS (G5).With S19, using A11 and R4 we can getS14:S|≡G|≡S↔SKG (G7).By considering the message Mess3, we obtainS22:G⊲r4U,Y6,LPUG.By using S22, A10, and R1 we obtainS23:G|≡S|∼r4.With S23, using A4 and applying R2 we haveS24:G|≡S|≡r4.Applying A13, S24, and R3 we obtainS25:G|≡r4.BecauseSK=hSNj‖r2‖r3‖r4, using S25, S4, and S6, we obtainS26:G|≡G↔SKS (G6).With conclusion S26, using A2, A4, and R4 we can obtainS27:G|≡S|≡S↔SKG (G8).


## 7.2.1. Rules for BAN Logic

Message-meaning rule (R1)U|≡U⇌KV,U⊲XK/U|≡V|∼X.Nonce-verification rule (R2)U|≡♯X,U|≡V|∼X/U|≡V|≡X.Jurisdiction rule (R3)U|≡V|⇒X,U|≡V|≡X/U|≡X.Freshness rule (R4)U|≡♯X/U|≡♯X,Y.Belief rule (R5)U|≡X,U|≡Y/U|≡X,Y.Session key rule (R6)U|≡♯X,U|≡V|≡X/U|≡U↔KV.


## 7.2.2. Goals

G1U|≡U↔SKG.G2G|≡U↔SKG.G3U|≡G|≡U↔SKG.G4G|≡U|≡U↔SKG.G5S|≡S↔SKG.G6G|≡S↔SKG.G7S|≡G|≡S↔SKG.G8G|≡S|≡S↔SKG.


## 7.2.3. Idealizing Communication

Mess1U⟶G: Y1,Y2,TIDi.Mess2G⟶S: Y3,Y4.Mess3S⟶G: Y5,Y6,WL.Mess4G⟶U: Y7,Y8.


## 7.2.4. Initial State Assumptions

A1G|≡U⇌A5G.A2G|≡♯r2,SNj.A3G|≡U|⇒r2,SNj.A4G|≡♯r3,r4.A5U|≡U⇌A5G.A6U|≡♯r3,r4.A7U|≡♯r2,SNj.A8U|≡G|⇒r3,r4.A9S|≡S⇌UG.A10G|≡S⇌UG.A11S|≡♯r2,r3.A12S|≡G|⇒r2,r3.A13G|≡S|⇒r4.


## 7.2.5. Detailed Steps

By considering the message Mess1, we getS1:G⊲r2,SNjA5,Y2,TIDi.Using S1, R1, and A1, we getS2:G|≡U|∼r2,SNj.Under the assumption of A2, using S2, R2 can be used to obtainS3:G|≡U|≡r2,SNj.With conclusion S3, using A3 and R3, the following can be obtained:S4:G|≡r2,SNj.Becauser4=Y5⊕hU‖r3‖SNj‖L, L=DECPRGWL, we can getS5:G|≡r4.And becauser3 is generated by G,S6:G|≡r3.BecauseSK=hSNj‖r2‖r3‖r4, using S4, S5, and S9, we obtainS7:G|≡U↔SKG (G2).With A3, A4, S7, and R4, we can getS8:G|≡U|≡U↔SKG (G4).By considering the message Mess4, we obtainS9:U⊲r2,r4A5,Y8.By using S9, A5, and R1 we obtainS10:U|≡G|∼r3,r4.With S10, using A6 and applying R2, we getS11:U|≡G|≡r3,r4.Applying A8, S11, and R3, we haveS12:U|≡r3,r4.BecauseSK=hSNj‖r2‖r3‖r4, using S11 and S13, we obtainS13:U|≡G↔SKU (G1).With conclusion S13, using A6, A7, and R4, we can obtainS14:U|≡G|≡U↔SKG (G3).By considering the message Mess2, we obtainS15:S⊲r2,r3U,Y4.By using S15, A9, and R1, we obtainS16:S|≡G|∼r2,r3.With S16, using A11 and applying R2, we haveS17:S|≡G|≡r2,r3.Applying A12, S17, and R3, we obtainS18:S|≡r2,r3.BecauseSK=hSNj‖r2‖r3‖r4, and SNj and r4 are generated by S, we can getS19:S|≡SNj,r4.Using S18 and S19, we obtainS20:S|≡G↔SKS (G5).With S19, using A11 and R4 we can getS14:S|≡G|≡S↔SKG (G7).By considering the message Mess3, we obtainS22:G⊲r4U,Y6,LPUG.By using S22, A10, and R1 we obtainS23:G|≡S|∼r4.With S23, using A4 and applying R2 we haveS24:G|≡S|≡r4.Applying A13, S24, and R3 we obtainS25:G|≡r4.BecauseSK=hSNj‖r2‖r3‖r4, using S25, S4, and S6, we obtainS26:G|≡G↔SKS (G6).With conclusion S26, using A2, A4, and R4 we can obtainS27:G|≡S|≡S↔SKG (G8).


## 7.3. Potential Attacks

### 7.3.1. Withstands Stolen Smart Card Attack

We assume thatA obtains Ui’s smart card and the parameters A1,A2,A3,A4,TIDi,Kgu in the smart card through power analysis. Although A obtains these parameters, A cannot obtain A5 because calculating A5 also requires RIDi. Therefore, A cannot further decrypt Y1 and Y7 to obtain SNj, r2, r3, and r4. It means that A cannot calculate SK. Now we can say that our protocol can resist stolen smart card attacks.


### 7.3.2. Withstands Sensor Capture Attack

Assuming thatA captures the sensor and extracts the message U,SNj,RIDi stored in Sj, now A can obtain r2 and r3 with Y3 and the messages extracted from the sensor. However, A cannot further obtain L and r4 because A does not have X2. For this reason, A cannot calculate SK through sensor capture attacks.


### 7.3.3. Withstands User Impersonation Attack

SupposeA obtains GWN key X1, but the shared key Kgu between GWN and Ui cannot be obtained; therefore, parameter A1 cannot be obtained. Without A1, A cannot obtain A5. Also, without A5, A cannot decrypt Y1 to get SNj and r2. It is obvious that our design can resist user impersonation attacks.


### 7.3.4. Perfect Forward Security

AssumingA obtains the long-term key X1 of GWN, A cannot obtain Kgu. However, A cannot obtain A1, A5 and further calculate SK. Now we can say the proposed protocol provides the perfect forward security.


### 7.3.5. Withstands Offline Password Guessing Attack

In the login and authentication phase, we assume thatA tries to guess pwi. A uses the guessed password pwi′ to login. Since A does not know IDi and A3, A cannot verify if pwi′ is correct. Thus, our protocol can effectively resist offline password guessing attacks.


## 7.3.1. Withstands Stolen Smart Card Attack

We assume thatA obtains Ui’s smart card and the parameters A1,A2,A3,A4,TIDi,Kgu in the smart card through power analysis. Although A obtains these parameters, A cannot obtain A5 because calculating A5 also requires RIDi. Therefore, A cannot further decrypt Y1 and Y7 to obtain SNj, r2, r3, and r4. It means that A cannot calculate SK. Now we can say that our protocol can resist stolen smart card attacks.


## 7.3.2. Withstands Sensor Capture Attack

Assuming thatA captures the sensor and extracts the message U,SNj,RIDi stored in Sj, now A can obtain r2 and r3 with Y3 and the messages extracted from the sensor. However, A cannot further obtain L and r4 because A does not have X2. For this reason, A cannot calculate SK through sensor capture attacks.


## 7.3.3. Withstands User Impersonation Attack

SupposeA obtains GWN key X1, but the shared key Kgu between GWN and Ui cannot be obtained; therefore, parameter A1 cannot be obtained. Without A1, A cannot obtain A5. Also, without A5, A cannot decrypt Y1 to get SNj and r2. It is obvious that our design can resist user impersonation attacks.


## 7.3.4. Perfect Forward Security

AssumingA obtains the long-term key X1 of GWN, A cannot obtain Kgu. However, A cannot obtain A1, A5 and further calculate SK. Now we can say the proposed protocol provides the perfect forward security.


## 7.3.5. Withstands Offline Password Guessing Attack

In the login and authentication phase, we assume thatA tries to guess pwi. A uses the guessed password pwi′ to login. Since A does not know IDi and A3, A cannot verify if pwi′ is correct. Thus, our protocol can effectively resist offline password guessing attacks.


## 7.4. Security Comparisons

Table2 shows the security comparison between the proposed protocol and other related protocols. The outcomes reveal that other related protocols [13, 28, 40, 41] have various flaws in security, but our protocol can withstand different kinds of attacks.Table 2
Comparisons of security.
ProtocolsAmin et al. [40]Chen et al. [41]Wu et al. [28]Sadri and Asaar [13]Our protocolReply attackYYYYYStolen smart card attackNYYNYStolen verifier attackNYYNYOffline password guessing attackYNYYYSensor capture attackYYNNYProvide perfect forward securityYYNNY


## 8. Performance Comparisons

### 8.1. Experimental Setting

To investigate the performance of our work, we use a mobile phone (Honor 30S, CPU: HUAWEI Kirin 820, 8 GB), a notebook computer (MSI-GP63, CPU: Intel Core i7 8750H, 8 GB), and a desktop computer (Lenovo-M715E, CPU: Intel Pentium Dual-Core E5500, 2 GB) to simulate a user, a gateway, and a sensor, respectively. We use these devices to calculate the execution time of hash functions, symmetric encryption systems, and point addition functions. Each operation was executed 10 times, and the average running times were calculated. Table3 lists our experimental results. Here, we do not evaluate the impact of the XOR operation since its running time is not worth mentioning compared with other functions.Table 3
Time consumed by different phases.
PhaseDeviceHashThEncryptionTS/decryption TDPoint additionTPUserHonor 30s0.0049 ms17.213 ms0.4894 msGatewayMSI-GP630.0025 ms8.094 ms0.0527 msSensorLenovo-M715E0.0044 ms11.477 ms0.1723 ms


### 8.2. Performance Comparisons

First, the computation cost of our work was compared with related protocols [13, 28, 40, 41]. We emphasize the login and authentication phase since this phase is frequently performed. Table 4 shows the running times of these five protocols. Th, TS, TD, and Tp denote the running times of hash functions, symmetric encryption, symmetric decryption, and point addition function individually.Table 4
Calculation cost comparison.
ProtocolUser (ms)Gateway (ms)Sensor (ms)Total (ms)Communication cost (bits)Amin et al. [40]12Th≈ 0.088218Th≈ 0.0456Th≈ 0.02640.15969216Chen et al. [41]8Th + Ts≈ 17.25523Th + 2 Ts≈ 16.19555Th + Ts≈ 11.49944.94974608Wu et al. [28]13Th≈ 0.06373Th + 2 Ts≈ 16.19555Th + Ts≈ 11.49927.75828192Sadri and Asaar [13]6Th + Ts + TD≈ 34.455410Th + Ts + TD≈ 16.2135Th≈ 0.02250.69045888Our protocol8Th + Ts≈ 17.252210Th + Ts + TD≈ 16.2135Th≈ 0.02233.48726400As depicted in Table4, in our protocol, the running time for a user is 17.2522 ms, which is higher than Amin et al.’s protocol [40] and Wu et al.’s protocol [28]. Besides, the running time for a gateway in our design is 16.213 ms, which is slightly higher than Wu et al.’s protocol [28] and Chen et al.’s [41]. However, the running time for a sensor in our design is 0.022 ms which is obviously lower than Wu et al.’s protocol [28] and Chen et al.’s [41]. Overall, the total time consumed by the proposed protocol is 33.4872 ms, which is lower than Chen et al.’s protocol [41] and Sadri et al.’s protocol [13]. The running time of the proposed protocol is slightly higher than Amin et al.’s protocol [40] and Wu et al.’s protocol [28].Furthermore, we consider the communication overhead. Assume that the output of a hash function is 256 bits, a random number is 160 bits, the identity is 160 bits, the symmetric encryption parameter is 128 bits, and a timestamp is 64 bits. As shown in Table4, the communication cost of the proposed protocol is 6400 bits, which is higher than Chen et al.’s protocol [41] and Sadri et al.’s protocol [13].We can observe that the proposed protocol does not have the best performance, but our design delivers better security than other protocols. We can say that our work has more practical significance for developing the IoT in the future. Figure5 and Figure 6 show a comparison more intuitively.Figure 5
Running time.Figure 6
Communication cost.


## 8.1. Experimental Setting

To investigate the performance of our work, we use a mobile phone (Honor 30S, CPU: HUAWEI Kirin 820, 8 GB), a notebook computer (MSI-GP63, CPU: Intel Core i7 8750H, 8 GB), and a desktop computer (Lenovo-M715E, CPU: Intel Pentium Dual-Core E5500, 2 GB) to simulate a user, a gateway, and a sensor, respectively. We use these devices to calculate the execution time of hash functions, symmetric encryption systems, and point addition functions. Each operation was executed 10 times, and the average running times were calculated. Table3 lists our experimental results. Here, we do not evaluate the impact of the XOR operation since its running time is not worth mentioning compared with other functions.Table 3
Time consumed by different phases.
PhaseDeviceHashThEncryptionTS/decryption TDPoint additionTPUserHonor 30s0.0049 ms17.213 ms0.4894 msGatewayMSI-GP630.0025 ms8.094 ms0.0527 msSensorLenovo-M715E0.0044 ms11.477 ms0.1723 ms


## 8.2. Performance Comparisons

First, the computation cost of our work was compared with related protocols [13, 28, 40, 41]. We emphasize the login and authentication phase since this phase is frequently performed. Table 4 shows the running times of these five protocols. Th, TS, TD, and Tp denote the running times of hash functions, symmetric encryption, symmetric decryption, and point addition function individually.Table 4
Calculation cost comparison.
ProtocolUser (ms)Gateway (ms)Sensor (ms)Total (ms)Communication cost (bits)Amin et al. [40]12Th≈ 0.088218Th≈ 0.0456Th≈ 0.02640.15969216Chen et al. [41]8Th + Ts≈ 17.25523Th + 2 Ts≈ 16.19555Th + Ts≈ 11.49944.94974608Wu et al. [28]13Th≈ 0.06373Th + 2 Ts≈ 16.19555Th + Ts≈ 11.49927.75828192Sadri and Asaar [13]6Th + Ts + TD≈ 34.455410Th + Ts + TD≈ 16.2135Th≈ 0.02250.69045888Our protocol8Th + Ts≈ 17.252210Th + Ts + TD≈ 16.2135Th≈ 0.02233.48726400As depicted in Table4, in our protocol, the running time for a user is 17.2522 ms, which is higher than Amin et al.’s protocol [40] and Wu et al.’s protocol [28]. Besides, the running time for a gateway in our design is 16.213 ms, which is slightly higher than Wu et al.’s protocol [28] and Chen et al.’s [41]. However, the running time for a sensor in our design is 0.022 ms which is obviously lower than Wu et al.’s protocol [28] and Chen et al.’s [41]. Overall, the total time consumed by the proposed protocol is 33.4872 ms, which is lower than Chen et al.’s protocol [41] and Sadri et al.’s protocol [13]. The running time of the proposed protocol is slightly higher than Amin et al.’s protocol [40] and Wu et al.’s protocol [28].Furthermore, we consider the communication overhead. Assume that the output of a hash function is 256 bits, a random number is 160 bits, the identity is 160 bits, the symmetric encryption parameter is 128 bits, and a timestamp is 64 bits. As shown in Table4, the communication cost of the proposed protocol is 6400 bits, which is higher than Chen et al.’s protocol [41] and Sadri et al.’s protocol [13].We can observe that the proposed protocol does not have the best performance, but our design delivers better security than other protocols. We can say that our work has more practical significance for developing the IoT in the future. Figure5 and Figure 6 show a comparison more intuitively.Figure 5
Running time.Figure 6
Communication cost.


## 9. Conclusions

IoT technology is constantly improving and updating. Protecting the security and privacy of data in IoT is an essential task. This paper demonstrated that Sadri’s protocol has some security issues. To solve these issues, we proposed a new protocol. We prove that our work is provably secure through BAN logic and ROR model, which can better ensure data security in the transmission process. Performance evaluation indicates that the proposed protocol has reasonable computation and communication overhead and thus has more practical significance for developing the IoT in the future.



---

*Source: 4468301-2022-06-08.xml*