# A Secure and Privacy-Preserving Three-Factor Anonymous Authentication Scheme for Wireless Sensor Networks in Internet of Things

Authors: Qi Xie; Zixuan Ding; Bin Hu
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The Internet of things is playing more and more important role in smart healthcare, smart grids, and smart transportation, and using wireless sensor network (WSN), we can easily obtain and transmit information. However, the data security and users’ privacy are the biggest challenges for WSN because sensor nodes have low computing power and low storage capacity and are easy to be captured, and wireless networks are vulnerable. In 2021, Shuai et al. proposed a lightweight three-factor anonymous authentication scheme for WSN. However, we found that their protocol is vulnerable to stolen-verifier attack, modification of messages’ attack, and no perfect forward secrecy. Then, a new three-factor anonymous authentication scheme using elliptic curve cryptography (ECC) is proposed. Through informal and formal security analyses, our scheme can resist various known attacks and maintains low computational complexity.


---

## Body

## 1. Introduction

In recent years, with the rapid development of Internet of things (IoT) technology, wireless sensor networks (WSN) are widely used in medical, military, agriculture, and other fields [1]. A large number of wireless sensor nodes are deployed in the target fields to collect the data in WSN, but sensor nodes have low computing power and low storage capacity and are easy to be captured; on the contrary, compared with the traditional wired network, messages are transmitted through wireless channels, and it may be easily attacked by means of eavesdropping, capture, replay, forgery, and so on. In order to protect the data security and users’ privacy, it is very important to design secure and privacy-preserving authentication and key agreement protocol for WSN in IoT.Many authentication protocols have been proposed in the past ten years; however, these protocols exist one or more security flaws [2]. In 2013, Li et al. proposed a communication scheme in IoT [3], which provides authentication, integrity, nonrepudiation, and confidentiality. However, this scheme is based on bilinear pairing, so it is hard to be deployed in WSN [4]. In 2014, Turkanović et al. [5] proposed a hash function-based authentication scheme for WSN. Farash et al. [6] pointed out that it suffers from impersonation attack, smart card loss attack, and session key disclosure attack; then, Farash et al. designed a new two-factor authentication (2FA) protocol. Amin and Biswas [7] also showed that Turkanović et al.’s scheme [5] suffers from offline password-guessing attacks and impersonation attacks, and Amin et al. proposed a 2FA protocol for multigateway WSN. Meanwhile, Amin et al. found that, in Farash et al.’s [6] scheme, there exists some security flaws, such as impersonation attack, smart card loss attack, and offline password-guessing attack.In order to improve the security of authentication protocol, Diffie–Hellman key agreement algorithm, Chebyshev chaotic map [8], and elliptic curve cryptography (ECC) are used to design secure user authentication and key agreement protocol [9, 10]. In 2009, Das [11] proposed an authentication protocol based on ECC for WSN, but their scheme suffers from privilege insider attacks and gateway bypass attacks [12]. Later, Kumar et al. [13] proposed an efficient authentication protocol for WSN. He et al. [14] showed that their scheme suffers from offline password-guessing attack and privilege insider attacks. To overcome these security flaws, they proposed an improved authentication scheme for WSN. Unfortunately, Li et al. [15], Wu et al. [16], and Mir et al. [17] pointed out that He et al.’s scheme is still insecure, and it may suffer from offline password-guessing attack and impersonation attack. Therefore, Li et al. [15] proposed a three-factor authentication (3FA) scheme to overcome these flaws because two-factor authentication (2FA) schemes usually suffer from offline password-guessing attacks [18]. Compared with 2FA schemes, 3FA schemes can improve the security because 3FA schemes use biometrics to avoid password-guessing attacks. Yeh et al. [19] and Chang and Hai [20] proposed 3FA schemes for WSN to resist various known attacks, but these schemes suffer from smart card loss attacks, impersonation attacks, and so on. So, Challa et al. [21] proposed the signature-based authentication scheme to achieve security, but the computation cost is high. In 2021, Tanveer et al. [22] proposed a lightweight user authentication and key exchange scheme for smart home, and Xie et al. [23] designed an ECC-based secure and privacy-protected authentication protocol for smart city. Shuai et al. [24] proposed a 3FA scheme for WSN, which uses a bio-hash function to enhance security.


### 1.1. Motivations and Contributions

In 2021, Shuai et al. [24] proposed a lightweight 3FA anonymous authentication scheme; however, we pointed out that Shuai et al.’s scheme is vulnerable to stolen-verifier attack, modification of messages attack, and no perfect forward security. To solve these problems, we propose a new 3FA scheme based on ECC and Fuzzy Extractor algorithm. We summarize our contributions as follows:(1)
We pointed out that Shuai et al.’s scheme suffers from the stolen-verifier attack, modification of messages attack, and no perfect forward security(2)
A new three-factor authentication scheme based on ECC and fuzzy extractor algorithm used for WSNs is proposed(3)
We use formal verification tool ProVerif [25] which is based on applied pi calculus to prove the security of the proposed scheme(4)
The informal security analysis shows that the proposed scheme can resist various known attacks(5)
We evaluate the computational cost of the proposed scheme with some related schemes; the result shows that the proposed scheme has better performance


### 1.2. Attack Model

Referring to the Dolev-Yao threat model [26], we present the abilities of an adversary as follows:(1)
UA has the ability to eavesdrop on all the messages which are transmitted via an open channel(2)
UA can modify, insert, replay, modify, and reroute the eavesdropped messages(3)
IfUA obtains the smart card of the user Ui, he/she can get all the data kept in the smart card(4)
UA can obtain all data stored in sensor node if UA captures a sensor node(5)
UA maybe an insider attackerThe rest of the paper is as follows. We review the scheme of Shuai et al. in Section2. Section 3 shows the security analysis of Shuai et al. ’s scheme. We propose the new scheme in Section 4. Sections 5 and 6 present the informal and formal security analyses of the proposed scheme. In Section 7, we exhibit the performance analysis between the proposed scheme and some related schemes. Finally, the paper concludes in Section 8.


## 1.1. Motivations and Contributions

In 2021, Shuai et al. [24] proposed a lightweight 3FA anonymous authentication scheme; however, we pointed out that Shuai et al.’s scheme is vulnerable to stolen-verifier attack, modification of messages attack, and no perfect forward security. To solve these problems, we propose a new 3FA scheme based on ECC and Fuzzy Extractor algorithm. We summarize our contributions as follows:(1)
We pointed out that Shuai et al.’s scheme suffers from the stolen-verifier attack, modification of messages attack, and no perfect forward security(2)
A new three-factor authentication scheme based on ECC and fuzzy extractor algorithm used for WSNs is proposed(3)
We use formal verification tool ProVerif [25] which is based on applied pi calculus to prove the security of the proposed scheme(4)
The informal security analysis shows that the proposed scheme can resist various known attacks(5)
We evaluate the computational cost of the proposed scheme with some related schemes; the result shows that the proposed scheme has better performance


## 1.2. Attack Model

Referring to the Dolev-Yao threat model [26], we present the abilities of an adversary as follows:(1)
UA has the ability to eavesdrop on all the messages which are transmitted via an open channel(2)
UA can modify, insert, replay, modify, and reroute the eavesdropped messages(3)
IfUA obtains the smart card of the user Ui, he/she can get all the data kept in the smart card(4)
UA can obtain all data stored in sensor node if UA captures a sensor node(5)
UA maybe an insider attackerThe rest of the paper is as follows. We review the scheme of Shuai et al. in Section2. Section 3 shows the security analysis of Shuai et al. ’s scheme. We propose the new scheme in Section 4. Sections 5 and 6 present the informal and formal security analyses of the proposed scheme. In Section 7, we exhibit the performance analysis between the proposed scheme and some related schemes. Finally, the paper concludes in Section 8.


## 2. Review the Shuai et al.’s Scheme

Shuai et al.’s scheme [24] consists of three phases: registration phase, login and authentication phase, and password change phase.


### 2.1. Registration Phase

The registration phase includes user (may be health professional) registration and medical sensor node registration. The user registration phase is as follows:Step UR1: the userUi chooses identity IDi and inputs password PWi and fingerprint fgi via the sensor device; the device generates a random number mi. After that, the device computes MBi=BHmi‖fgi and MPWi=hIDi‖PWi‖MBi‖mi and then sends IDi,MPWi and the personal credential to GWN via a private channel.Step UR2: once the message is received, GWN generates random numbersni, ri, and K1 and computes HIDi=IDi⊕ri, Xi=hIDi‖K1‖ni, Yi=Xi⊕MPWi, and Vi=hXi‖MPWi. GWN stores IDi,HIDi,ni,K1 and user’s credential in its memory and stores HIDi,Yi,Vi,K1,h.,BH. into a smart card; GWN issues the smart card to Ui via a private channel.Step UR3: once the smart card is received,Ui writes mi into the smart card. At the end of the user registration phase, the smart card contains HIDi,Yi,Vi,K1,h.,BH.,mi.The registration phase of sensor node is as follows.Step SR1: the medical sensor nodeSNj chooses identity SIDj and sends it to GWN via a private channel.Step SR2: on receivingSIDj, GWN first checks the uniqueness of the SIDj; if the SIDj is not unique, it refuses the registration request. Otherwise, GWN generates a random number K2 and stores SIDj,K2 in its memory. Then, GWN transmits K2 to SNj via a private channel.Step SR3: on receivingK2, SNj stores K2.


### 2.2. Login and Authentication Phase

Step LA1: the userUi inserts the smart card and enters identity IDi, password PWi, and fingerprint fgi. The smart card computes MBi∗=BHmi‖fgi, MPWi∗=hIDi‖PWi‖MBi∗‖mi, Xi∗=Yi⊕MPWi∗, and Vi∗=hXi∗‖MPWi∗ and checks if Vi∗ and Vi are equal. If not, it terminates the session. Otherwise, proceed to the next step.Step LA2: if the userUi is legal, the smart card generates a random number R and current timestamp T1; Ui selects an identity SIDj of sensor node SNj; the smart card computes UG=hHIDi‖Xi‖K1, M1=EUGR‖SIDj, and CK1=hIDi‖R‖Xi‖HIDi‖K1‖T1. Then, Ui sends message HIDi,M1,CK1,T1 to GWN via a public channel.Step LA3: on receiving the message fromUi, GWN checks the time stamp T1 first. GWN gets the current time T1∗ and compares with T1 if T1∗−T1>ΔT, where ΔT is the predefined threshold value, and GWN terminates the session. Otherwise, according to HIDi, GWN extracts identity IDi, random number ni, and K1 of user Ui from the storage table. Then, GWN computes Xi=hIDi‖K‖ni, UG=hHIDi‖Xi‖K1, R∗‖SIDj=DUGM1, and CK1∗=hIDi‖R∗‖Xi‖HIDi‖K1‖T1 and compares CK1∗ with CK1. If they are not equal, terminate the session. Otherwise, the user Ui is legal. In addition, GWN generates a timestamp T2 and session key SK and computes M2=SK‖IDi⊕hK2‖SIDj and CK2=hIDi‖SIDj‖SK‖K2‖T2. Finally, GWN sends the message M2,CK2,T2 to the sensor node SNj via an open channel.Step LA4: on receiving the messageM2,CK2,T2, SNj gets the current time T2∗ and compares with T2. If T2∗−T2>ΔT, terminate the session. Otherwise, SNj computes SK‖IDi=M2⊕hK2‖SIDj and CK2∗=hIDi‖SIDj‖SK‖K2‖T2. Then, SNj compares CK2∗ with CK2. If they are not equal, terminate the session. Otherwise, SNj generates a timestamp T3 and computes CK3=hSIDj‖IDi‖SK‖T3. Finally, SNj updates K2=hK2 and sends the message CK3,T3 to GWN via an open channel.Step LA5: on receiving the messageCK3,T3, GWN gets the current time T3∗; if T3∗−T3<ΔT, compute CK3∗=hSIDj‖IDj‖SK‖T3. Then, GWN compares CK3∗ with CK3. If they are not equal, terminate the session. Otherwise, GWN generates a random number ri∗ and T4 and computes HIDi∗=IDi⊕ri∗, GU=hR‖HIDi‖Xi‖K1, M3=EGUSK‖HIDi∗‖SIDj, and CK4=hIDi‖SK‖HIDi‖T4. Then, GWN updates K1, K2, and HIDi with K1=hK1, K2=hK2, and HIDi=HIDi∗. Finally, GWN sends the message M3,CK4,T4 to Ui via an open channel.Step LA6: on receiving the messageM3,CK4,T4, Ui gets the current time T4∗; if T4∗−T4<ΔT, compute GU=hR‖HIDi‖Xi‖K1, SK‖HIDi∗‖SIDj=DGUM3, and CK4∗=hIDi‖SK‖HIDi‖T4. Then, Ui compares CK4∗ with CK4. If they are equal, Ui updates K1 and HIDi with K1=hK1 and HIDi=HIDi∗ and completes the authentication.


### 2.3. Password Change Phase

Step PC1: the userUi inserts the smart card and enters identity IDi, password PWi, and fingerprint fgi. The smart card computes MBi=BHmi‖fgi, MPWi=hIDi‖PWi‖MBi‖mi, Xi=Yi⊕MPWi, and Vi∗=hXi‖MPWi and compares Vi∗ with Vi, which is stored in the smart card. If the values are equal, the smart card allows Ui to enter a new password PWi∗. Otherwise, it rejects the request for password change.Step PC2: the smart card computesMPWi∗=hIDi‖PWi∗‖MBi‖mi, Yi∗=Xi⊕MPWi∗=Yi⊕MPWi⊕MPWi∗, and Vi∗=hXi‖MPWi∗.Step PC3: finally, the smart card deletesYi and Vi and stores Yi∗ and Vi∗.


## 2.1. Registration Phase

The registration phase includes user (may be health professional) registration and medical sensor node registration. The user registration phase is as follows:Step UR1: the userUi chooses identity IDi and inputs password PWi and fingerprint fgi via the sensor device; the device generates a random number mi. After that, the device computes MBi=BHmi‖fgi and MPWi=hIDi‖PWi‖MBi‖mi and then sends IDi,MPWi and the personal credential to GWN via a private channel.Step UR2: once the message is received, GWN generates random numbersni, ri, and K1 and computes HIDi=IDi⊕ri, Xi=hIDi‖K1‖ni, Yi=Xi⊕MPWi, and Vi=hXi‖MPWi. GWN stores IDi,HIDi,ni,K1 and user’s credential in its memory and stores HIDi,Yi,Vi,K1,h.,BH. into a smart card; GWN issues the smart card to Ui via a private channel.Step UR3: once the smart card is received,Ui writes mi into the smart card. At the end of the user registration phase, the smart card contains HIDi,Yi,Vi,K1,h.,BH.,mi.The registration phase of sensor node is as follows.Step SR1: the medical sensor nodeSNj chooses identity SIDj and sends it to GWN via a private channel.Step SR2: on receivingSIDj, GWN first checks the uniqueness of the SIDj; if the SIDj is not unique, it refuses the registration request. Otherwise, GWN generates a random number K2 and stores SIDj,K2 in its memory. Then, GWN transmits K2 to SNj via a private channel.Step SR3: on receivingK2, SNj stores K2.


## 2.2. Login and Authentication Phase

Step LA1: the userUi inserts the smart card and enters identity IDi, password PWi, and fingerprint fgi. The smart card computes MBi∗=BHmi‖fgi, MPWi∗=hIDi‖PWi‖MBi∗‖mi, Xi∗=Yi⊕MPWi∗, and Vi∗=hXi∗‖MPWi∗ and checks if Vi∗ and Vi are equal. If not, it terminates the session. Otherwise, proceed to the next step.Step LA2: if the userUi is legal, the smart card generates a random number R and current timestamp T1; Ui selects an identity SIDj of sensor node SNj; the smart card computes UG=hHIDi‖Xi‖K1, M1=EUGR‖SIDj, and CK1=hIDi‖R‖Xi‖HIDi‖K1‖T1. Then, Ui sends message HIDi,M1,CK1,T1 to GWN via a public channel.Step LA3: on receiving the message fromUi, GWN checks the time stamp T1 first. GWN gets the current time T1∗ and compares with T1 if T1∗−T1>ΔT, where ΔT is the predefined threshold value, and GWN terminates the session. Otherwise, according to HIDi, GWN extracts identity IDi, random number ni, and K1 of user Ui from the storage table. Then, GWN computes Xi=hIDi‖K‖ni, UG=hHIDi‖Xi‖K1, R∗‖SIDj=DUGM1, and CK1∗=hIDi‖R∗‖Xi‖HIDi‖K1‖T1 and compares CK1∗ with CK1. If they are not equal, terminate the session. Otherwise, the user Ui is legal. In addition, GWN generates a timestamp T2 and session key SK and computes M2=SK‖IDi⊕hK2‖SIDj and CK2=hIDi‖SIDj‖SK‖K2‖T2. Finally, GWN sends the message M2,CK2,T2 to the sensor node SNj via an open channel.Step LA4: on receiving the messageM2,CK2,T2, SNj gets the current time T2∗ and compares with T2. If T2∗−T2>ΔT, terminate the session. Otherwise, SNj computes SK‖IDi=M2⊕hK2‖SIDj and CK2∗=hIDi‖SIDj‖SK‖K2‖T2. Then, SNj compares CK2∗ with CK2. If they are not equal, terminate the session. Otherwise, SNj generates a timestamp T3 and computes CK3=hSIDj‖IDi‖SK‖T3. Finally, SNj updates K2=hK2 and sends the message CK3,T3 to GWN via an open channel.Step LA5: on receiving the messageCK3,T3, GWN gets the current time T3∗; if T3∗−T3<ΔT, compute CK3∗=hSIDj‖IDj‖SK‖T3. Then, GWN compares CK3∗ with CK3. If they are not equal, terminate the session. Otherwise, GWN generates a random number ri∗ and T4 and computes HIDi∗=IDi⊕ri∗, GU=hR‖HIDi‖Xi‖K1, M3=EGUSK‖HIDi∗‖SIDj, and CK4=hIDi‖SK‖HIDi‖T4. Then, GWN updates K1, K2, and HIDi with K1=hK1, K2=hK2, and HIDi=HIDi∗. Finally, GWN sends the message M3,CK4,T4 to Ui via an open channel.Step LA6: on receiving the messageM3,CK4,T4, Ui gets the current time T4∗; if T4∗−T4<ΔT, compute GU=hR‖HIDi‖Xi‖K1, SK‖HIDi∗‖SIDj=DGUM3, and CK4∗=hIDi‖SK‖HIDi‖T4. Then, Ui compares CK4∗ with CK4. If they are equal, Ui updates K1 and HIDi with K1=hK1 and HIDi=HIDi∗ and completes the authentication.


## 2.3. Password Change Phase

Step PC1: the userUi inserts the smart card and enters identity IDi, password PWi, and fingerprint fgi. The smart card computes MBi=BHmi‖fgi, MPWi=hIDi‖PWi‖MBi‖mi, Xi=Yi⊕MPWi, and Vi∗=hXi‖MPWi and compares Vi∗ with Vi, which is stored in the smart card. If the values are equal, the smart card allows Ui to enter a new password PWi∗. Otherwise, it rejects the request for password change.Step PC2: the smart card computesMPWi∗=hIDi‖PWi∗‖MBi‖mi, Yi∗=Xi⊕MPWi∗=Yi⊕MPWi⊕MPWi∗, and Vi∗=hXi‖MPWi∗.Step PC3: finally, the smart card deletesYi and Vi and stores Yi∗ and Vi∗.


## 3. Analysis of the Shuai et al.’s Scheme

In this section, we will show that Shuai et al.’s protocol has some security flaws.


### 3.1. Modification of Messages/Desynchronization Attack

In Shuai et al.’s scheme,SNj updates K2=hK2 and sends the message CK3,T3 to GWN via an open channel in Step LA5. On receiving the message CK3,T3, GWN gets the current time T3∗; if T3∗−T3<ΔT, compute CK3∗=hSIDj‖IDj‖SK‖T3. If CK3∗=CK3, GWN updates K2=hK2. Suppose an attacker UA intercepts or changes information CK3,T3, GWN will not update K2=hK2 before the session terminated. Therefore, SNj and GWN store different K2. The sensor node SNj is paralyzed.The same attack method can be used betweenGWN and the user Ui. If an attacker UA intercepts or changes information M3,CK4,T4 between Step LA5 and Step LA6, Ui will not update the value of K1. However, GWN has updated K1 already. Later on, Ui cannot pass the authentication of GWN.


### 3.2. Stolen-Verifier Attack

In their scheme,GWN stores SIDj,K2. SIDj is the identity of sensor node SNj; the random number K2 is generated by GWN for the sensor node SNj.Assuming thatSIDj and K2 of each node is known by the attacker UA, UA can eavesdrop on M2,CK2,T2 via an open channel. By computing SK‖IDi=M2⊕hK2‖SIDj, the attacker UA gets session key SK and user’s identity IDi.If attackerUA knows SIDj,K2, he/she can intercept all messages and impersonate any sensor node. After knowing SIDj,K2, UA can forge M2,CK2,T2 and send the message to the sensor node SNj, where M2=SK‖IDi⊕hK2‖SIDj and CK2=hIDi‖SIDj‖SK‖K2‖T2. SK, IDi, and T2 can be randomly generated by the attacker UA. The sensor node verifies the message by computing SK‖IDi=M2⊕hK2‖SIDj and CK2∗=hIDi‖SIDj‖SK‖K2‖T2 and checks if CK2∗=CK2. There is no doubt that they are equal. Then, the sensor node updates K2=hK2 and cannot respond to the legitimate request. Finally, the sensor node is paralyzed.So, if an attackerUA can get access to the database, he/she can obtain session key SK, impersonate sensor nodes, or paralyze sensor nodes.


### 3.3. No Perfect Forward Security

In Shuai et al.’s scheme, if an attackerUA obtains the secret random number K2 stored in the sensor node SNj, he/she can get the current session key SK by computing SK‖IDi=M2⊕hK2‖SIDj, where SIDj is the identity of SNj and M2 is transmitted via an open channel and can be eavesdropped on by the attacker UA. The next long-term key K2∗ is updated by K2∗=hK2. It is easy for the attacker UA to eavesdrop next M2∗ via an open channel; then, the next session key SK∗ can be computed by SK∗‖IDi=M2∗⊕hK2∗‖SIDj. Therefore, the scheme of Shuai et al. cannot provide perfect forward/backward security.


## 3.1. Modification of Messages/Desynchronization Attack

In Shuai et al.’s scheme,SNj updates K2=hK2 and sends the message CK3,T3 to GWN via an open channel in Step LA5. On receiving the message CK3,T3, GWN gets the current time T3∗; if T3∗−T3<ΔT, compute CK3∗=hSIDj‖IDj‖SK‖T3. If CK3∗=CK3, GWN updates K2=hK2. Suppose an attacker UA intercepts or changes information CK3,T3, GWN will not update K2=hK2 before the session terminated. Therefore, SNj and GWN store different K2. The sensor node SNj is paralyzed.The same attack method can be used betweenGWN and the user Ui. If an attacker UA intercepts or changes information M3,CK4,T4 between Step LA5 and Step LA6, Ui will not update the value of K1. However, GWN has updated K1 already. Later on, Ui cannot pass the authentication of GWN.


## 3.2. Stolen-Verifier Attack

In their scheme,GWN stores SIDj,K2. SIDj is the identity of sensor node SNj; the random number K2 is generated by GWN for the sensor node SNj.Assuming thatSIDj and K2 of each node is known by the attacker UA, UA can eavesdrop on M2,CK2,T2 via an open channel. By computing SK‖IDi=M2⊕hK2‖SIDj, the attacker UA gets session key SK and user’s identity IDi.If attackerUA knows SIDj,K2, he/she can intercept all messages and impersonate any sensor node. After knowing SIDj,K2, UA can forge M2,CK2,T2 and send the message to the sensor node SNj, where M2=SK‖IDi⊕hK2‖SIDj and CK2=hIDi‖SIDj‖SK‖K2‖T2. SK, IDi, and T2 can be randomly generated by the attacker UA. The sensor node verifies the message by computing SK‖IDi=M2⊕hK2‖SIDj and CK2∗=hIDi‖SIDj‖SK‖K2‖T2 and checks if CK2∗=CK2. There is no doubt that they are equal. Then, the sensor node updates K2=hK2 and cannot respond to the legitimate request. Finally, the sensor node is paralyzed.So, if an attackerUA can get access to the database, he/she can obtain session key SK, impersonate sensor nodes, or paralyze sensor nodes.


## 3.3. No Perfect Forward Security

In Shuai et al.’s scheme, if an attackerUA obtains the secret random number K2 stored in the sensor node SNj, he/she can get the current session key SK by computing SK‖IDi=M2⊕hK2‖SIDj, where SIDj is the identity of SNj and M2 is transmitted via an open channel and can be eavesdropped on by the attacker UA. The next long-term key K2∗ is updated by K2∗=hK2. It is easy for the attacker UA to eavesdrop next M2∗ via an open channel; then, the next session key SK∗ can be computed by SK∗‖IDi=M2∗⊕hK2∗‖SIDj. Therefore, the scheme of Shuai et al. cannot provide perfect forward/backward security.


## 4. Our Proposed Scheme

In this section, we propose a new three-factor anonymous authentication scheme using ECC and fuzzy extractor algorithm. Table1 shows the notations and intuitive abbreviations mentioned in the proposed scheme.Table 1
Notations.
NotationsDescriptionUiith UserUAAdversarySNjjth sensor nodeGWNGateway nodeIDiUnique identity ofUiPWiPassword ofUifngiBiometric information ofUiSIDjUnique identity ofSNjSKSession keyKGWNGWN’s secret parameterT1, T2, T3, T4Timestamph.Hash function∥Concatenation⊕XOR operationPThe generator point on the curveRep., Gen⋅Fuzzy extractor algorithm for reproduction and generationτiReproduction parameter of fuzzy extractor algorithmσiBiometric key of fuzzy extractor algorithmΔTThe transmission delay time


### 4.1. System Setup Phase

GWN chooses an elliptic curve EGFq defined over GFq, where GFq is a finite field defined over a large prime number q. P is a generator point on the curve. GWN chooses a secret parameter KGWN. GWN computes public key as PKG=KGWN⋅P and publishes Rep., Gen., h., and PKG, where Rep. and Gen. are reproduction and generation algorithm of fuzzy extractor algorithm, respectively. h. is a hash function.


### 4.2. User Registration Phase

Step UR1:Ui chooses its IDi and sends IDi to GWN via a private channel.Step UR2:GWN verifies the effectiveness and legitimacy of IDi; if not, GWN requests Ui to choose a new IDi. Otherwise, GWN computes ai=hIDi‖KGWN. GWN stores the information ai,PKG,P into a smart card (SC) and transmits it to Ui.Step UR3:Ui inserts the SC into a card reader and enters its IDi, PWi, and fingerprint fngi; the device computes(1)σi,τi=Genfngi,MPWi=hIDi‖PWi‖σi,Fi=ai⊕hIDi‖σi‖PWi.Then,Ui updates ai with Fi. Finally, MPWi,τi,Fi,PKG,P are stored in SC.Figure 1
Mutual authentication and key agreement phase.


### 4.3. Sensor Node Registration Phase

Step SR1:GWN chooses a unique identity SIDj for sensor node SNj and computes bj=hSIDj‖KGWN. Then, GWN sends bj,SIDj,P to SNj via a private channel.Step SR2: upon receivingbj,SIDj,P, SNj stores them into its memory.


### 4.4. Login and Authentication Phases

Step LA1:Ui inserts the smart card into the device and inputs the identity IDi∗ and the password PWi∗ and enters the fingerprint fngi∗. Then, the device calculates(2)σi∗=Repfngi∗,τi,MPWi∗=hIDi∗‖PWi∗‖σi∗.IfMPWi∗≠MPWi, SC refuses the login request of Ui. Otherwise, go on.Step LA2:Ui creates a random number mi and computes(3)ai∗=Fi⊕hIDi∗‖σi∗‖PWi∗,M1=mi⋅P,M2=IDi∗‖SIDj⊕hmi⋅PKG‖T1,M3=hai∗‖M1‖M2‖T1,wherePKG is the public key of GWN, T1 is the current timestamp, And Ui sends the message MES1=M1,M2,M3,T1 to GWN via a public channel.Step LA3: on receivingMES1, GWN first checks the timestamp. GWN creates the current time T1∗; if T1∗−T1>ΔT, terminate the session. Otherwise, GWN computes(4)IDi′,SIDj′=M2⊕hM1⋅kG‖T1,ai′=hIDi′‖KGWN,M3′=hai′‖M1‖M2‖T1.IfM3′≠M3, GWN declines the request. Otherwise, GWN generates the current time T2 and calculates(5)Si=hai′‖SIDj′‖T2,bj′=hSIDj′‖KGWN,N1=Si‖IDi′⊕hbj′‖SIDj′‖T2,N2=hM1‖IDi′‖Si‖SIDj′‖T2.GWN transmits the message MES2=M1,N1,N2,T2 to SNj via an open channel.Step LA4: after obtaining the messageMES2=M1,N1,N2,T2, SNj checks whether T2∗−T2≤ΔT, where T2∗ is the current timestamp. If not, SNj rejects the session. Otherwise, SNj computes(6)Si′‖IDi″=N1⊕hbj‖SIDj‖T2,N2′=hM1‖IDi″‖Si′‖SIDj‖T2.IfN2′≠N2, terminate the session. Otherwise, SNj generates a random number cj and the current time T3 and computes(7)N3=cj⋅P,SKj=hcj⋅M1‖SIDj‖IDi″‖Si′,N4=hSi′‖SKj‖N3‖IDi″‖T3.SNj sends the message MES3=N3,N4,T2,T3 to Ui via an open channel.Step LA5: upon receiving the messageMES3=N3,N4,T2,T3, Ui generates the current timestamp T3∗ and ensures that T3∗−T3≤ΔT; if it is not, reject the session; otherwise, Ui computes(8)Si∗=hai∗‖SIDj‖T2,SKu=hmi⋅N3‖SIDj‖IDi∗‖Si∗,N4′=hSi∗‖SKu‖N3‖IDi∗‖T3.IfN4′≠N4, terminate the session. Otherwise, the authentication is completed. Figure 1 demonstrates the steps of the mutual authentication and the key agreement phase.


## 4.1. System Setup Phase

GWN chooses an elliptic curve EGFq defined over GFq, where GFq is a finite field defined over a large prime number q. P is a generator point on the curve. GWN chooses a secret parameter KGWN. GWN computes public key as PKG=KGWN⋅P and publishes Rep., Gen., h., and PKG, where Rep. and Gen. are reproduction and generation algorithm of fuzzy extractor algorithm, respectively. h. is a hash function.


## 4.2. User Registration Phase

Step UR1:Ui chooses its IDi and sends IDi to GWN via a private channel.Step UR2:GWN verifies the effectiveness and legitimacy of IDi; if not, GWN requests Ui to choose a new IDi. Otherwise, GWN computes ai=hIDi‖KGWN. GWN stores the information ai,PKG,P into a smart card (SC) and transmits it to Ui.Step UR3:Ui inserts the SC into a card reader and enters its IDi, PWi, and fingerprint fngi; the device computes(1)σi,τi=Genfngi,MPWi=hIDi‖PWi‖σi,Fi=ai⊕hIDi‖σi‖PWi.Then,Ui updates ai with Fi. Finally, MPWi,τi,Fi,PKG,P are stored in SC.Figure 1
Mutual authentication and key agreement phase.


## 4.3. Sensor Node Registration Phase

Step SR1:GWN chooses a unique identity SIDj for sensor node SNj and computes bj=hSIDj‖KGWN. Then, GWN sends bj,SIDj,P to SNj via a private channel.Step SR2: upon receivingbj,SIDj,P, SNj stores them into its memory.


## 4.4. Login and Authentication Phases

Step LA1:Ui inserts the smart card into the device and inputs the identity IDi∗ and the password PWi∗ and enters the fingerprint fngi∗. Then, the device calculates(2)σi∗=Repfngi∗,τi,MPWi∗=hIDi∗‖PWi∗‖σi∗.IfMPWi∗≠MPWi, SC refuses the login request of Ui. Otherwise, go on.Step LA2:Ui creates a random number mi and computes(3)ai∗=Fi⊕hIDi∗‖σi∗‖PWi∗,M1=mi⋅P,M2=IDi∗‖SIDj⊕hmi⋅PKG‖T1,M3=hai∗‖M1‖M2‖T1,wherePKG is the public key of GWN, T1 is the current timestamp, And Ui sends the message MES1=M1,M2,M3,T1 to GWN via a public channel.Step LA3: on receivingMES1, GWN first checks the timestamp. GWN creates the current time T1∗; if T1∗−T1>ΔT, terminate the session. Otherwise, GWN computes(4)IDi′,SIDj′=M2⊕hM1⋅kG‖T1,ai′=hIDi′‖KGWN,M3′=hai′‖M1‖M2‖T1.IfM3′≠M3, GWN declines the request. Otherwise, GWN generates the current time T2 and calculates(5)Si=hai′‖SIDj′‖T2,bj′=hSIDj′‖KGWN,N1=Si‖IDi′⊕hbj′‖SIDj′‖T2,N2=hM1‖IDi′‖Si‖SIDj′‖T2.GWN transmits the message MES2=M1,N1,N2,T2 to SNj via an open channel.Step LA4: after obtaining the messageMES2=M1,N1,N2,T2, SNj checks whether T2∗−T2≤ΔT, where T2∗ is the current timestamp. If not, SNj rejects the session. Otherwise, SNj computes(6)Si′‖IDi″=N1⊕hbj‖SIDj‖T2,N2′=hM1‖IDi″‖Si′‖SIDj‖T2.IfN2′≠N2, terminate the session. Otherwise, SNj generates a random number cj and the current time T3 and computes(7)N3=cj⋅P,SKj=hcj⋅M1‖SIDj‖IDi″‖Si′,N4=hSi′‖SKj‖N3‖IDi″‖T3.SNj sends the message MES3=N3,N4,T2,T3 to Ui via an open channel.Step LA5: upon receiving the messageMES3=N3,N4,T2,T3, Ui generates the current timestamp T3∗ and ensures that T3∗−T3≤ΔT; if it is not, reject the session; otherwise, Ui computes(8)Si∗=hai∗‖SIDj‖T2,SKu=hmi⋅N3‖SIDj‖IDi∗‖Si∗,N4′=hSi∗‖SKu‖N3‖IDi∗‖T3.IfN4′≠N4, terminate the session. Otherwise, the authentication is completed. Figure 1 demonstrates the steps of the mutual authentication and the key agreement phase.


## 5. Informal Security Analysis

In this section, we discuss the possible attacks on the proposed scheme.


### 5.1. Stolen and Hyphen: Verifier Attack

In our proposed scheme,GWN does not store information related to the verification table. Therefore, there is no stolen-verifier attack against our proposed scheme.


### 5.2. Offline Password Guessing Attack

In our proposed scheme,MES1, MES2, MES3, and MES4 are transmitted via an open channel; even if an attacker eavesdrops on the communication and obtains these messages, he/she cannot guess the password. Because the password and fingerprint are used in login verification and not transmitted openly. Though an attacker obtains the message MPWi,τi,Fi,PKG,P stored in smart card, where MPWi=hIDi‖PWi‖σi and Fi=ai⊕hIDi‖σi‖PWi, he/she cannot verify whether the guessed password is correct without knowing the biometric key σi.


### 5.3. Replay Attack

Suppose that an adversaryUA impersonates user Ui and intercepts and replays MES1=M1,M2,M3,T1. The replayed MES1 cannot pass the GWN‘s verification process if the timestamp is invalid. Even if a replay of MES1 worked, and UA gets MES3; however, the session key SKu=hmi⋅N3‖SIDj‖IDi∗‖Si∗, where Si∗=hai∗‖SIDj‖T2 and mi is a random number created by Ui. UA cannot obtain ai∗ or mi. Therefore, it is useless to replay MES1.Suppose thatUA replays GWN’s messages or sensor nodes’ messages. First, the replayed messages cannot pass the validity verification of the timestamp. In addition, Ui, GWN, and SNj generate new random numbers in a new session, which are used in the verification and generation of the session key. Therefore, our scheme is resistant to replay attacks.


### 5.4. Forger Attack and Impersonation Attack

Suppose an attacker impersonates the userUi and sends MES1=M1,M2,M3,T1 to GWN, where M3=hai∗‖M1‖M2‖T1 and ai∗=Fi⊕hIDi∗‖σi∗‖PWi∗; if the attacker does not have IDi∗, PWi∗, and fngi∗, he/she cannot forge M3. In other words, the attacker cannot impersonate a user.If the attacker tries to impersonateGWN and forge MES2=M1,N1,N2,T2, where N2=hM1‖Si‖IDi′‖SIDj′‖T2 and bj′=hSIDj′‖KGWN, the attacker does not know KGWN, so the forged N2 cannot pass the verification of SNj.If the attacker impersonates the sensor node, he/she cannot forge validN4=hSi′‖SKj‖N3‖IDi″‖T3 without knowing SIDj and bj.


### 5.5. Smart Card Loss Attack

Suppose the smart card stolen by an attackerUA; UA can get MPWi,τi,Fi,PKG,P, where MPWi=hIDi‖PWi‖σi, τi is the reproduction parameter of the fuzzy extractor algorithm, Fi=ai⊕hIDi‖σi‖PWi, PKG is the public key of GWN, and P is the base point of the elliptic curve. MPWi and Fi are protected by the user’s biometric information and password. Therefore, an attacker cannot get any plaintext information or pass through the verification without knowing IDi, PWi, and fngi.


### 5.6. Sensor Node Capture Attack

In the proposed scheme, each sensor nodeSNj stores bj,SIDj,P, where bj=hSIDj‖KGWN, SIDj is the identity of the sensor, and P is the base point on the curve. An attacker cannot get KGWN even if he/she captures the sensor. In other words, capturing a sensor node cannot influence other sensor nodes. Therefore, the proposed scheme resists sensor capture attacks.


### 5.7. Known‐Key Attack

The session keySKj=hcj⋅M1‖SIDj‖IDi″‖Si′=SKu=hmi⋅N3‖SIDj‖IDi∗‖Si∗, where cj and mi are random numbers generated in every session, and the CDH problem is intractable. Therefore, even if an attacker gets session keys, he/she cannot solve the CDH problem.


### 5.8. Anonymity and Unlinkability

In the authentication phase of the proposed scheme, the user’s identity is contained in the messageMES1=M1,M2,M3,T1, where M1=mi⋅P, M2=IDi∗‖SIDj⊕hmi⋅PKG‖T1, and M3=hai∗‖M1‖M2‖T1. The user’s identity IDi∗ is protected by hmi⋅PKG‖T1; only the gateway can obtain the user’s real identity. So, our scheme meets the requirement of anonymity. At the same time, because the random number mi and the timestamp T1 are contained in M2, which is changed in each session, therefore, our scheme is also unlinkability.


### 5.9. Perfect Forward Secrecy

In the proposed scheme, the session keySK=hcj⋅mi⋅P‖SIDj‖IDi‖Si′. Even if an adversary can know the user’s all secret information and the secret key of GWN, cjP, and miP, but he/she still cannot compute cj⋅mi⋅P because of the intractability of the computational Diffie–Hellman (CDH) problem. So, the proposed scheme can achieve perfect forward secrecy.


## 5.1. Stolen and Hyphen: Verifier Attack

In our proposed scheme,GWN does not store information related to the verification table. Therefore, there is no stolen-verifier attack against our proposed scheme.


## 5.2. Offline Password Guessing Attack

In our proposed scheme,MES1, MES2, MES3, and MES4 are transmitted via an open channel; even if an attacker eavesdrops on the communication and obtains these messages, he/she cannot guess the password. Because the password and fingerprint are used in login verification and not transmitted openly. Though an attacker obtains the message MPWi,τi,Fi,PKG,P stored in smart card, where MPWi=hIDi‖PWi‖σi and Fi=ai⊕hIDi‖σi‖PWi, he/she cannot verify whether the guessed password is correct without knowing the biometric key σi.


## 5.3. Replay Attack

Suppose that an adversaryUA impersonates user Ui and intercepts and replays MES1=M1,M2,M3,T1. The replayed MES1 cannot pass the GWN‘s verification process if the timestamp is invalid. Even if a replay of MES1 worked, and UA gets MES3; however, the session key SKu=hmi⋅N3‖SIDj‖IDi∗‖Si∗, where Si∗=hai∗‖SIDj‖T2 and mi is a random number created by Ui. UA cannot obtain ai∗ or mi. Therefore, it is useless to replay MES1.Suppose thatUA replays GWN’s messages or sensor nodes’ messages. First, the replayed messages cannot pass the validity verification of the timestamp. In addition, Ui, GWN, and SNj generate new random numbers in a new session, which are used in the verification and generation of the session key. Therefore, our scheme is resistant to replay attacks.


## 5.4. Forger Attack and Impersonation Attack

Suppose an attacker impersonates the userUi and sends MES1=M1,M2,M3,T1 to GWN, where M3=hai∗‖M1‖M2‖T1 and ai∗=Fi⊕hIDi∗‖σi∗‖PWi∗; if the attacker does not have IDi∗, PWi∗, and fngi∗, he/she cannot forge M3. In other words, the attacker cannot impersonate a user.If the attacker tries to impersonateGWN and forge MES2=M1,N1,N2,T2, where N2=hM1‖Si‖IDi′‖SIDj′‖T2 and bj′=hSIDj′‖KGWN, the attacker does not know KGWN, so the forged N2 cannot pass the verification of SNj.If the attacker impersonates the sensor node, he/she cannot forge validN4=hSi′‖SKj‖N3‖IDi″‖T3 without knowing SIDj and bj.


## 5.5. Smart Card Loss Attack

Suppose the smart card stolen by an attackerUA; UA can get MPWi,τi,Fi,PKG,P, where MPWi=hIDi‖PWi‖σi, τi is the reproduction parameter of the fuzzy extractor algorithm, Fi=ai⊕hIDi‖σi‖PWi, PKG is the public key of GWN, and P is the base point of the elliptic curve. MPWi and Fi are protected by the user’s biometric information and password. Therefore, an attacker cannot get any plaintext information or pass through the verification without knowing IDi, PWi, and fngi.


## 5.6. Sensor Node Capture Attack

In the proposed scheme, each sensor nodeSNj stores bj,SIDj,P, where bj=hSIDj‖KGWN, SIDj is the identity of the sensor, and P is the base point on the curve. An attacker cannot get KGWN even if he/she captures the sensor. In other words, capturing a sensor node cannot influence other sensor nodes. Therefore, the proposed scheme resists sensor capture attacks.


## 5.7. Known‐Key Attack

The session keySKj=hcj⋅M1‖SIDj‖IDi″‖Si′=SKu=hmi⋅N3‖SIDj‖IDi∗‖Si∗, where cj and mi are random numbers generated in every session, and the CDH problem is intractable. Therefore, even if an attacker gets session keys, he/she cannot solve the CDH problem.


## 5.8. Anonymity and Unlinkability

In the authentication phase of the proposed scheme, the user’s identity is contained in the messageMES1=M1,M2,M3,T1, where M1=mi⋅P, M2=IDi∗‖SIDj⊕hmi⋅PKG‖T1, and M3=hai∗‖M1‖M2‖T1. The user’s identity IDi∗ is protected by hmi⋅PKG‖T1; only the gateway can obtain the user’s real identity. So, our scheme meets the requirement of anonymity. At the same time, because the random number mi and the timestamp T1 are contained in M2, which is changed in each session, therefore, our scheme is also unlinkability.


## 5.9. Perfect Forward Secrecy

In the proposed scheme, the session keySK=hcj⋅mi⋅P‖SIDj‖IDi‖Si′. Even if an adversary can know the user’s all secret information and the secret key of GWN, cjP, and miP, but he/she still cannot compute cj⋅mi⋅P because of the intractability of the computational Diffie–Hellman (CDH) problem. So, the proposed scheme can achieve perfect forward secrecy.


## 6. Formal Security Analysis Using ProVerif

ProVerif is a formalized cryptographic protocol verification tool based on the Dolev–Yao model, which can describe various cryptographic primitives. When using the ProVerif tool to validate a cryptographic protocol, the tool will present a corresponding sequence of attacks if the protocol is vulnerable.As shown in Figure2, we defined channels, basic types, and functions. The proposed scheme involves 5 events, namely, ULoginPhase(), UAuthenticationPhase(), UserSessionKey(), SNSessionKey(), and GWNAuthentication(). ULoginPhase() indicates the login phase of the user, UAuthenticationPhase() indicates the user sends authentication request, GWNAuthentication() indicates the gateway pass the authentication of the user, SNSessionKey() indicates sensor node agrees on the session key, and UserSessionKey() indicates the user agrees the session key. Figure 3 shows the above events and queries.Figure 2
Definitions.Figure 3
Events and queries.The operations of the user,GWN, and sensor node are shown in Figure 4, Figure 5, and Figure 6, respectively. Figure 7 exhibits the main process. According to the result in Figure 8, the proposed scheme can provide security of the session key, the password of the user, and the secret parameter of GWN. Meanwhile, the process of mutual authentication is executed in sequence.Figure 4
Process of the user.Figure 5
Process of GWN.Figure 6
Process of sensor node.Figure 7
Main process.Figure 8
Results.


## 7. Performance Comparison

In this section, we analyze the security and performance comparison between our schemes with some related schemes. Table2 shows the comparison of attacks/properties of the schemes. Compared with Shuai et al.’s scheme, our scheme is more secure to various known attacks and has some good properties. As shown in Table 3, we can see the comparison of computational cost between the proposed scheme and the related schemes [19–21, 23, 24], where TH represents hash operation time, TSE is the time of the symmetric encryption/decryption operation, and TECC denotes the time cost of ECC operation. In the environment [18] of Windows 10 64 bit laptop, Intel (R) Core (TM) i5-6300HQ CPU @ 2.30 GHz, 12 GB RAM, we get TH=0.068ms (millisecond), TECC=2.501ms, and TSE=0.56ms. It can be seen from Table 3 that our scheme takes less time than related schemes. Compared with Shuai et al.’s scheme, our scheme overcomes the problem of Shuai et al.’s scheme, the computation cost is a little more than Shuai et al.’s scheme to achieve the perfect forward secrecy.Table 2
Comparison of our scheme and related schemes in attack/properties.
Attacks/properties[19][20][21][23][24]OursPrivileged-insider attack✓✗✓✓✓✓Offline password guessing attack✓✗✓✓✓✓Denial-of-service attack✓✓✓✓✗✓Forger and impersonation attack✗✗✓✓✓✓Replay attack✓✓✓✓✓✓Man-in-middle attack✓✓✓✓✓✓Smart card loss attack✗✗✓✓✓✓Sensor node capture attack✗✓✓✓✓✓Stolen‐verifier attack✓✓✓✓✗✓Desynchronization attack✓✓✓✓✗✓Perfect forward secrecy✓✓✓✓✗✓Identity anonymity✗✓✓✓✓✓Mutual authentication✗✓✓✓✓✓Untraceability✗✗✓✓✓✓✓, resist (attacks)/possess (properties); ✗, suffer (attacks)/no (properties).Table 3
The computational cost comparison.
SchemesUi(user)SNj(sensor)GWNTotal[19]TH+2TECC3TH+2TECC4TH+4TECC8TH+8TECC20.552ms[20]7TH+2TECC5TH+2TECC9TH21TH+4TECC11.432ms[21]5TH+5TECC3TH+4TECC5TH+4TECC13TH+13TECC33.397ms[23]8TH+3TECC+TSE5TH+2TECC+TSE7TH+TECC+2TSE20TH+6TECC+4TSE18.606ms[24]7TH+2TSE10TH+2TSE4TH21TH+4TSE3.668msOurs7TH+3TECC7TH+TECC4TH+2TECC18TH+6TECC16.230ms


## 8. Conclusion

In this paper, we first pointed out Shuai et al.’s scheme is vulnerable to desynchronization attack, stolen-verifier attack, and no perfect forward security. In addition, we propose a new three-factor authentication using ECC and fuzzy extractor algorithm, which not only defends against the above attacks but also defends other attacks as shown in informal security analysis. We also simulate the proposed scheme for its formal security verification using the ProVerif tool to prove the security. Its performance analysis shows that it has less communication cost than the related schemes, and it can be applied to WSN in IoT. In the future, we will design block chain-based anonymous authentication scheme for WSN in IoT.



---

*Source: 4799223-2021-09-29.xml*