# A Lightweight and Secure Anonymous User Authentication Protocol for Wireless Body Area Networks

Authors: Junsong Zhang; Qikun Zhang; Zhigang Li; Xianling Lu; Yong Gan
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The recent development of wireless body area network (WBAN) technology plays a significant role in the modern healthcare system for patient health monitoring. However, owing to the open nature of the wireless channel and the sensitivity of the transmitted messages, the data security and privacy threats in WBAN have been widely discussed and must be solved. In recent years, many authentication protocols had been proposed to provide security and privacy protection in WBANs. However, many of these schemes are not computationally efficient in the authentication process. Inspired by these studies, a lightweight and secure anonymous authentication protocol is presented to provide data security and privacy for WBANs. The proposed scheme adopts a random value and hash function to provide user anonymity. Besides, the proposed protocol can provide user authentication without a trusted third party, which makes the proposed scheme have no computational bottleneck in terms of architecture. Finally, the security and performance analyses demonstrate that the proposed scheme can meet security requirements with low computational and communication costs.


---

## Body

## 1. Introduction

In recent years, along with the quick development of communications and microelectronics technologies, a new network paradigm for detecting human body data, named wireless body area networks (WBANs) [1], has emerged. A typical architecture of WBAN for the healthcare system is depicted in Figure 1. There are three main participants in the WBAN: a dynamic set of M patients with monitoring sensors, denoted as PAT=Pj|j=1,2,…,M, a set of N doctors as DCTDi|i=1,2,…,N, and a registration center (RC) as a trusted third party [2]. The sensors are mainly embedded or worn on the patient. Their main function is to collect various physical parameters of the patient, such as blood pressure (BP), electrocardiogram (ECG), and temperature, and then transmit these data to the personal terminal. Next, the personal terminal uses a wireless communication technology (such as Wi-Fi and 4G/5G/CDMA) to forward all collected information to the appropriate doctor or the medical server. Therefore, the personal terminal acts as a bridge between the doctors and WBAN. These sensory data collected from the patient will play an important role in the doctor’s medical diagnosis. In addition, this new technology not only helps to monitor and improve the health of patients but is also more suitable for health monitoring and care for the elderly and the disabled. However, due to the openness of the wireless channel, the data transmitted in WBAN can easily be eavesdropped or tampered with by unauthorized users. Since these sensitive patient data are the basis of clinical diagnosis, any data leakage or modification may put the patient’s life at risk [3–5]. Consequently, it is necessary and important to provide a safe and reliable authentication protocol in the WBAN to ensure that only legitimate users can obtain the patient’s sensitive information.Figure 1
A typical system model of the WBAN.Since the collected information is vital to the patient’s life, it is very confidential and vulnerable to various attacks by an adversary. If these sensitive data are obtained and misused by an adversary, it may threaten the lives of patients. Therefore, it is important to provide data security and privacy protection to the WBAN [6]. In other words, strong security solutions and authentication protocols are necessary for the success and large-scale deployment of the WBANs. Motivated by these shortcomings, we proposed a lightweight and secure anonymous user authentication protocol for the WBAN. The contributions of the paper are summarized as follows:(1)
To guarantee the privacy of doctors and patients in the WBAN, an efficient ECC-based privacy-preserving authentication is proposed. Moreover, the proposed authentication protocol can verify the legitimacy of the patients and doctors.(2)
In the proposed authentication protocol, under the premise of anonymous authentication of users, no trusted third party is required to participate in the authentication process. In this way, the proposed authentication protocol has no computational bottleneck in terms of architecture. Besides, the proposed scheme can provide a low computation burden on the client side, which makes the proposed authentication protocol more efficient.(3)
The proposed authentication protocol provides a method for RC to track the doctor’s actual identity. At the same time, it also ensures that the doctor’s identity information is not obtained by unrelated parties. This makes it possible to prevent doctors from making a wrong diagnosis or to pursue accountability afterward.(4)
A detailed security analysis and performance analysis show that the proposed authentication protocol can meet the security and performance requirements of the WBAN application.The rest of the paper is organized as follows. Section2 discusses the existing secure authentication schemes. Section 3 describes the attacker models and preliminaries. Section 4 presents the proposed mutual authentication scheme. Security and performance analyses of the proposed protocol are provided in Sections 5 and 6, respectively. Finally, Section 7 gives the conclusion of this paper.


## 2. Related Work

Security, privacy, and identity authentication are the most critical and challenging issues in the WBAN. During the last few years, so many authentication protocols have been proposed to solve the security and privacy protection problem for wireless-based healthcare applications [7–10]. Some research activities use public key cryptography (PKC) to build authentication schemes [7, 8]. Since the traditional PKC requires a large amount of computation overhead, these existing PKC-based methods are not suitable for the resource-constrained WBAN. In 2014, Chatterjee et al. [9] presented an ECC-based user authentication for WBAN. Liu et al. [10] proposed a lightweight certificateless authentication scheme that uses ECC and bilinear pairings. Unfortunately, their method was found to be unable to resist tracking attack and impersonation attack [11].In 2015, Das et al. [12] suggested a biometric-based authentication protocol for WBAN. Their proposed protocol combines biometric information and a password to verify the legitimacy of the user. Later, Wang and Zhang [13] found that Das et al.’s scheme is not able to provide user anonymity. In order to avoid this defect, they proposed a new bilinear pairing-based authentication protocol in the WBAN environment. In the same year, Debiao et al. [14] presented a bilinear pairing-based anonymous authentication scheme for WBAN. Liu et al. [15] proposed an anonymous 1-round authentication protocol for WBANs. They claimed that their authentication scheme was efficient and secure. However, Li et al. [16] demonstrated that Liu et al.’s scheme is unable to resist impersonation attack, DoS attack, and session key guessing attack. To avoid these flaws, they proposed an improved 1-round authentication protocol for WBANs. Later, Shen et al. [17] presented a lightweight nonpairing certificateless authentication protocol for WBANs. Unfortunately, their proposed scheme was found to be unable to resist the impersonation attack. To remove the flaws, Liu et al. [18] proposed an improved authentication to remedy the flaws in Shen et al.'s scheme. Wazid et al. [19] proposed a novel authentication and key management scheme for the cloud-assisted WBAN.Later, Qiu et al. [20] proposed a secure mutual authentication protocol based on ECC for wireless medical sensor networks. In this paper, the BAN logic is used to prove the security of the proposed scheme. However, according to [21], it is still suffering from insider attack. Shen et al. [21] presented a cloud-aided certificateless and privacy-preserving authentication scheme for the WBAN. In [21], the authors use public key cryptography and the message authentication code (MAC) to achieve user authentication. Shuai et al. [22] presented a bilinear pairing-based mutual authentication scheme for WBAN. Fotouhi et al. [23] propose a new lightweight hash chain-based and forward secure authentication scheme for WBAN. Kumar et al. [24] presented an ECC-based authentication scheme for wearable devices environment. Jegadeesan et al. [25] proposed an efficient privacy-preserving anonymous authentication for WBAN. However, their scheme is also not able to resist the impersonation attack.To enhance the security of WBAN, a novel lightweight and secure anonymous user authentication protocol was designed. Compared with other existing schemes, the scheme proposed in this paper has two distinct characteristics. First, the proposed scheme does not require a trusted third party to verify the legitimacy of users anonymously. Second, the proposed authentication protocol provides a method for RC to track the doctor’s actual identity, which can reduce the doctor’s misbehaving.


## 3. Preliminaries

### 3.1. Threat Model

An adversary model is a valid abstraction of an arbitrary adversary which is able to lunch a successful attack. Due to the open nature of WBAN, the wireless communication channel is vulnerable to various attacks. In the proposed authentication protocol, the two widely used models, named Dolev–Yao model and CK-adversary model, are used. In the Dolev–Yao model, the communication between different entities can be intercepted by an adversary. Besides, the adversary is also able to modify/delete/fake/inject into the transmitting information [26, 27]. In the CK-adversary model, the adversary can control all the communication between the entities. Moreover, the adversary is assumed to be able to extract the secret parameters stored in the entity’s memory and the temporary data used to establish session keys [6]. Furthermore, the adversary can use oracle queries to interact with the entities. As far as we know, these two adversary models are widely adopted in the authenticated key exchange protocols [28].


### 3.2. Security Requirements for the WBAN

The communication of the WBAN is mainly divided into two types: the communication between the sensor and the personal terminal and the communication between the personal terminal and the back-end server. Our work focuses on the security of communication between the personal terminal and the back-end server. In this section, we discuss the security and privacy requirements for the WBAN environment [29].


#### 3.2.1. Mutual Authentication

As we all know, the messages transmitted in the WBAN are easily eavesdropped and modified. Hence, once a message is received, the most important thing for the receiver is to determine whether the message is sent by a legitimate user and whether the message has been modified. Therefore, there should be a mechanism to verify the legitimacy of the message and the sender of the message.


#### 3.2.2. Data Integrity

To ensure the integrity of the transmitted message in the WBAN, an anonymous signature mechanism is attached to the transmitted message.


#### 3.2.3. Confidentiality

Since the messages transmitted in the WBAN contain the patient’s sensitive information, and this sensitive information is very important privacy for patients. Therefore, the proposed protocol needs to ensure that the unauthorized entities cannot obtain the content of the transmitted message.


#### 3.2.4. Identity Privacy-Preserving

To protect the identity privacy of users (especially the patients), the actual identity of the patients cannot directly appear in the transmitted messages. Besides, the proposed protocol also needs to ensure that the adversary cannot decipher/calculate the patient’s actual identity through the message.


#### 3.2.5. Conditional Traceability

In WBAN, for the manager, the doctor’s identity should be traceable. Especially when a doctor makes any dispute or misbehavior, the manager needs to have the ability to get the doctor’s actual identity. This provides a basis for subsequent accountability and can also reduce the loss of WBAN.


#### 3.2.6. Attack Resistance

To ensure secure communication in WBANs, the proposed protocol should be able to withstand various common attacks, such as replay attack, impersonation attack, and man-in-the-middle attack.


### 3.3. Elliptic Curve Cryptography

Elliptic curve cryptography (ECC) is one of the most widely used public key asymmetric cryptographies [30]. Its security comes from the discrete logarithm problem (DLP) in a group defined by points on elliptic curve. An elliptic curve E over GF (p), where p is a large prime, is defined by an equation of the following form:(1)y2=x3+ax+b,where a, b ∈ GF (p) and satisfies 4a3+27b2≠0modp. There are two basic operations on ECC: point addition and scalar multiplication. The scalar multiplication over E can be computed by repeated addition as(2)k·P=P+P+⋯+Pktimes.The hardness of the elliptic curve discrete logarithm problem is essential for the security of all elliptic curve cryptographic schemes. Here, we present two important mathematical problems on elliptic curves as follows [31]:Elliptic curve discrete logarithm problem (ECDLP): given an elliptic curveE defined over a finite field GF (p), and two points Q, P ∈ E of order q, it is hard to find an integer k ∈ Z∗q such that Q = k·PElliptic curve Diffie–Hellman problem (ECDHP): given an elliptic curveE defined over a finite field GF (p), a point P∈ E of order n, A = aP, B = bP, and find the point C = abP


## 3.1. Threat Model

An adversary model is a valid abstraction of an arbitrary adversary which is able to lunch a successful attack. Due to the open nature of WBAN, the wireless communication channel is vulnerable to various attacks. In the proposed authentication protocol, the two widely used models, named Dolev–Yao model and CK-adversary model, are used. In the Dolev–Yao model, the communication between different entities can be intercepted by an adversary. Besides, the adversary is also able to modify/delete/fake/inject into the transmitting information [26, 27]. In the CK-adversary model, the adversary can control all the communication between the entities. Moreover, the adversary is assumed to be able to extract the secret parameters stored in the entity’s memory and the temporary data used to establish session keys [6]. Furthermore, the adversary can use oracle queries to interact with the entities. As far as we know, these two adversary models are widely adopted in the authenticated key exchange protocols [28].


## 3.2. Security Requirements for the WBAN

The communication of the WBAN is mainly divided into two types: the communication between the sensor and the personal terminal and the communication between the personal terminal and the back-end server. Our work focuses on the security of communication between the personal terminal and the back-end server. In this section, we discuss the security and privacy requirements for the WBAN environment [29].


### 3.2.1. Mutual Authentication

As we all know, the messages transmitted in the WBAN are easily eavesdropped and modified. Hence, once a message is received, the most important thing for the receiver is to determine whether the message is sent by a legitimate user and whether the message has been modified. Therefore, there should be a mechanism to verify the legitimacy of the message and the sender of the message.


### 3.2.2. Data Integrity

To ensure the integrity of the transmitted message in the WBAN, an anonymous signature mechanism is attached to the transmitted message.


### 3.2.3. Confidentiality

Since the messages transmitted in the WBAN contain the patient’s sensitive information, and this sensitive information is very important privacy for patients. Therefore, the proposed protocol needs to ensure that the unauthorized entities cannot obtain the content of the transmitted message.


### 3.2.4. Identity Privacy-Preserving

To protect the identity privacy of users (especially the patients), the actual identity of the patients cannot directly appear in the transmitted messages. Besides, the proposed protocol also needs to ensure that the adversary cannot decipher/calculate the patient’s actual identity through the message.


### 3.2.5. Conditional Traceability

In WBAN, for the manager, the doctor’s identity should be traceable. Especially when a doctor makes any dispute or misbehavior, the manager needs to have the ability to get the doctor’s actual identity. This provides a basis for subsequent accountability and can also reduce the loss of WBAN.


### 3.2.6. Attack Resistance

To ensure secure communication in WBANs, the proposed protocol should be able to withstand various common attacks, such as replay attack, impersonation attack, and man-in-the-middle attack.


## 3.2.1. Mutual Authentication

As we all know, the messages transmitted in the WBAN are easily eavesdropped and modified. Hence, once a message is received, the most important thing for the receiver is to determine whether the message is sent by a legitimate user and whether the message has been modified. Therefore, there should be a mechanism to verify the legitimacy of the message and the sender of the message.


## 3.2.2. Data Integrity

To ensure the integrity of the transmitted message in the WBAN, an anonymous signature mechanism is attached to the transmitted message.


## 3.2.3. Confidentiality

Since the messages transmitted in the WBAN contain the patient’s sensitive information, and this sensitive information is very important privacy for patients. Therefore, the proposed protocol needs to ensure that the unauthorized entities cannot obtain the content of the transmitted message.


## 3.2.4. Identity Privacy-Preserving

To protect the identity privacy of users (especially the patients), the actual identity of the patients cannot directly appear in the transmitted messages. Besides, the proposed protocol also needs to ensure that the adversary cannot decipher/calculate the patient’s actual identity through the message.


## 3.2.5. Conditional Traceability

In WBAN, for the manager, the doctor’s identity should be traceable. Especially when a doctor makes any dispute or misbehavior, the manager needs to have the ability to get the doctor’s actual identity. This provides a basis for subsequent accountability and can also reduce the loss of WBAN.


## 3.2.6. Attack Resistance

To ensure secure communication in WBANs, the proposed protocol should be able to withstand various common attacks, such as replay attack, impersonation attack, and man-in-the-middle attack.


## 3.3. Elliptic Curve Cryptography

Elliptic curve cryptography (ECC) is one of the most widely used public key asymmetric cryptographies [30]. Its security comes from the discrete logarithm problem (DLP) in a group defined by points on elliptic curve. An elliptic curve E over GF (p), where p is a large prime, is defined by an equation of the following form:(1)y2=x3+ax+b,where a, b ∈ GF (p) and satisfies 4a3+27b2≠0modp. There are two basic operations on ECC: point addition and scalar multiplication. The scalar multiplication over E can be computed by repeated addition as(2)k·P=P+P+⋯+Pktimes.The hardness of the elliptic curve discrete logarithm problem is essential for the security of all elliptic curve cryptographic schemes. Here, we present two important mathematical problems on elliptic curves as follows [31]:Elliptic curve discrete logarithm problem (ECDLP): given an elliptic curveE defined over a finite field GF (p), and two points Q, P ∈ E of order q, it is hard to find an integer k ∈ Z∗q such that Q = k·PElliptic curve Diffie–Hellman problem (ECDHP): given an elliptic curveE defined over a finite field GF (p), a point P∈ E of order n, A = aP, B = bP, and find the point C = abP


## 4. The Proposed Authentication Protocol

In this section, we present our proposed authentication protocol for WBAN. The proposed protocol consists of three phases: system initialization, registration, and anonymous mutual authentication. All the notations used in this paper are presented in Table1. The detailed descriptions of these phases are explained as follows.Table 1
Notation and its description.
NotationDescriptionDiTheith doctorDIDiThe identity of theith doctorPKDiTheith doctor’s public keyRCThe registration centerPKRCThe public key of RCPjThejth patientPIDjThe identity of thejth patienth (·)A secure hash function, whereh:0,1∗⇒Zq∗H (·)A hash function, whereH:Epa,b⇒0,1l, in which l is the length of the stringê (·, ·)A bilinear mape^:G1×G1⟶G2||String concatenation operation⊕The bitwise XOR operation


### 4.1. System Initialization

In the proposed authentication protocol, as mentioned earlier, RC is considered as a trusted third party. It is responsible for the registration of all patients and doctors in the WBAN. At the same time, it must also set relevant security parameters for the authentication protocol.Step I-1: RC selects an appropriate elliptic curveE over the finite field GF (p). Then, RC chooses a bilinear mapping e^:G1×G1⟶G2 and the generator P0 ∈ G1 with the order q over elliptic curve E, where q is a big prime number.Step I-2: RC chooses two secure hash functionh and H, where h:{0, 1}∗ ⟶ Z∗q, H: {P ∈ E} ⟶ {0, 1}l, in which l is the length of the string. Next, RC selects two random number u,v ∈ Z∗q as secret values and keeps them properly.Step I-3: RC chooses a random numbersRC as its master key and computes the corresponding public key PKRC = sRC·P. Then, RC publishes the public system parameters to the users: param = {E, G1, GT, PKRC, h, H, ê}.


### 4.2. Registration

This phase consists of the doctor registration and the patient registration. The process of registration is explained as follows:Doctor registration: when a doctorDi wants to login to the system to get the patient’s information, he/she must first register at RC through the following steps:Step DR-1: the doctorDi chooses his/her own identification DIDi and password DPWi and a random number ri and then computes h(ri ⊕ DPWi). Then, Di sends the message {DIDi, h(ri ⊕ DPWi)} to RC via a secure channel.Step DR-2: upon receiving the message {DIDi, h(ri ⊕ DPWi)}, RC computes Ai = hDIDi|v, Bi = h(Ai), Vi = Ai ⊕ h(DIDi || h(ri ⊕ DPWi)). Then, RC regards the parameter sDi = h(ri ⊕ DPWi) as the doctor Di’s master key and then computes the corresponding public key PKDi = sDi·u·P.Step DR-3: RC provides a license to the doctorDi: LDi = sDi⋅v⋅P, then RC maintains <DIDi, LDi> in the checklist. This checklist is used to check the actual identity of the doctor when the doctor makes any dispute or misbehavior.Step DR-4: the RC issues a smart card to the doctorDi, the card contains the values {Bi, Vi, PKDi, LDi, ri}. After receiving the smart card, the doctor Di inserts the value ri into the smart card. Then, the smart card contains {Bi, Vi, PKDi, LDi, ri}.Patient registration: when the patientPj is ready to go to the hospital for treatment, RC will register his/her handheld terminal and assign relevant medical sensors to him/her to monitor the physical parameters.Step PR-1: RC chooses a random numbersPj ∈ Z∗p as the patient Pj’s master key. And then RC computes the corresponding public key PKPj = sPj·u·P. Next, RC sends the message {sPj, PKPj} to the patient Pj through a secure channel.


### 4.3. Anonymous Authentication

#### 4.3.1. Patient to Doctor Anonymous Authentication

When the patientPj wants to send the data collected by himself to the doctor Di to facilitate the doctor’s diagnosis or detection, this step is required. Since the data transmitted by the patient to the doctor contain very sensitive health information, in order to preserve the privacy of these data, the patient needs to use encryption and authentication methods to process the data. The detailed steps are as follows:Step PA-1: the patientPj first chooses a random value k ∈ Z∗p and calculates(3)a1=k·P,a2=k·PKDi,a3=hdatak·sPj·PKRC,a4=k·PKPj,w1=dataa3a4Tj,c1=w1⊕Ha2,where data are the physical parameters of the patientPj and Tj is the timestamp. Then, the patient Pj sends the message {a1, c1, Tj} to the doctor Di via common channel.Step PA-2: upon receiving the message {a1, c1, Tj}, the doctor Di computes w∗1 = c1 ⊕ H(sDi·a1) and extracts the data, a3, a4 and the timestamp Tj from w∗1. Then, the doctor Di verifies whether the timestamp Tj is fresh. If it is not fresh, the doctor Di discards the message directly and terminates the authentication process. Otherwise, go to the next step.Step PA-3: the doctorDi checks if e^a3,PKDi?=e^PKRC,hdata⋅sDi⋅a4 holds. If the above equation is true, the doctor Di considers that the patient Pj is legitimate and the health information data have not been destroyed. Otherwise, the patient Pj is considered to be an illegal user and refuses to accept the health information data.Figure2 summarizes the process of patient to doctor authentication phase.Figure 2
The patient to doctor authentication phase.Proof of Correctness. The challenger equation e^a3,PKDi?=e^PKRC,hdata⋅sDi⋅a4 calculated by the doctor Di should be held by using the values a3 and a4 sent from the patient Pj.(4)e^a3,PKDi=e^hdata⋅k⋅sPj⋅PKRC,PKDi=e^k⋅sPj⋅PKRC,hdata⋅sDi⋅P=e^PKRC,hdata⋅k⋅sPj⋅sDi⋅P=e^PKRC,hdata⋅sDi⋅k⋅PKPj=e^PKRC,hdatasDi⋅a4.


#### 4.3.2. Doctor to Patient Anonymous Authentication

When the doctorDi wants to get the relevant health data of the patient Pj, he first generates the query information demand and completes the message authentication through the following steps:Step DA-1: the doctorDi first inserts his/her smart card to a terminal and then inputs his/her identity DIDi and password DPWi. Then, the smart card computes as follows:Ai∗=hDIDihri⊕DPWi⊕Vi, Bi∗=hAi∗, and checks whether Bi∗=Bi. If not, the smart card rejects this request and prompts the doctor to enter the correct identity and password. Otherwise, go to the next step.Step DA-2: the doctorDi chooses a random number r ∈ Z∗p and computes(5)b1=r·P,b2=r·PKPj,b3=hdemandr·sDi·PKRC,b4=r·PKDi,b5=hTi·sDi·P,Certi=LDiTi⊕HhTi·sDi·PKRC,w2=demandb3b4CertiTi,c2=w2⊕Hb2,where demand is the query request information of the doctor andTi is the timestamp. Then, the doctor Di sends the message {b1, b5, c2, Certi, Ti} to the patient Pj via a common channel.Step DA-3: upon receiving the message {b1, b5, c2, Certi, Ti}, the patient Pj verifies whether the time stamp Ti is fresh. If not, the authentication process is terminated. Otherwise, Pj uses his/her private key to compute b2∗=sPj⋅b1, w2∗=c2⊕Hb2∗. And then, Pj extracts variables demand, b3, b4, Certi and the timestamp Ti from w∗2.Step DA-4:Pj verifies whether the equation e^b3,PKPj?=e^PKRC,hdemand⋅sPj⋅b4 holds. If the above equation is true, the patient Pj considers the doctor to be a legitimate doctor, and he will provide the relevant health data according to the doctor’s requirements. Otherwise, he believes that the doctor Di is an illegal doctor and refuses to accept his request.Figure3 summarizes the process of login and the doctor to patient authentication phase.Proof of correctness:(6)e^b3,PKPj=e^hdemand⋅r⋅sDi⋅PKRC,sPj⋅P=e^PKRC,hdemand⋅r⋅sDi⋅sPj⋅P=e^PKRC,hdemand⋅sPj⋅r⋅sDi⋅P=e^PKRC,hdemand⋅sPj⋅b4.Step DA-5 (identity tracking): if the request message demand is suspected of having a problem or illegal operation, RC is able to track the actual identity of the doctor using the certificate Certi in the message. The process is as follows:Then, RC finds the corresponding record <DIDi, LDi> in the checklist and gets the actual identity of the doctor DIDi.Figure 3
The login process and doctor to patient authentication phase.(7)Certi⊕HsRC·b5=LDiTi⊕HhTi·sDi·PKRC⊕HsRC·b5=LDiTi⊕HhTi·sDi·PKRC⊕HsRC·hTi·sDi·P=LDiTi.


## 4.1. System Initialization

In the proposed authentication protocol, as mentioned earlier, RC is considered as a trusted third party. It is responsible for the registration of all patients and doctors in the WBAN. At the same time, it must also set relevant security parameters for the authentication protocol.Step I-1: RC selects an appropriate elliptic curveE over the finite field GF (p). Then, RC chooses a bilinear mapping e^:G1×G1⟶G2 and the generator P0 ∈ G1 with the order q over elliptic curve E, where q is a big prime number.Step I-2: RC chooses two secure hash functionh and H, where h:{0, 1}∗ ⟶ Z∗q, H: {P ∈ E} ⟶ {0, 1}l, in which l is the length of the string. Next, RC selects two random number u,v ∈ Z∗q as secret values and keeps them properly.Step I-3: RC chooses a random numbersRC as its master key and computes the corresponding public key PKRC = sRC·P. Then, RC publishes the public system parameters to the users: param = {E, G1, GT, PKRC, h, H, ê}.


## 4.2. Registration

This phase consists of the doctor registration and the patient registration. The process of registration is explained as follows:Doctor registration: when a doctorDi wants to login to the system to get the patient’s information, he/she must first register at RC through the following steps:Step DR-1: the doctorDi chooses his/her own identification DIDi and password DPWi and a random number ri and then computes h(ri ⊕ DPWi). Then, Di sends the message {DIDi, h(ri ⊕ DPWi)} to RC via a secure channel.Step DR-2: upon receiving the message {DIDi, h(ri ⊕ DPWi)}, RC computes Ai = hDIDi|v, Bi = h(Ai), Vi = Ai ⊕ h(DIDi || h(ri ⊕ DPWi)). Then, RC regards the parameter sDi = h(ri ⊕ DPWi) as the doctor Di’s master key and then computes the corresponding public key PKDi = sDi·u·P.Step DR-3: RC provides a license to the doctorDi: LDi = sDi⋅v⋅P, then RC maintains <DIDi, LDi> in the checklist. This checklist is used to check the actual identity of the doctor when the doctor makes any dispute or misbehavior.Step DR-4: the RC issues a smart card to the doctorDi, the card contains the values {Bi, Vi, PKDi, LDi, ri}. After receiving the smart card, the doctor Di inserts the value ri into the smart card. Then, the smart card contains {Bi, Vi, PKDi, LDi, ri}.Patient registration: when the patientPj is ready to go to the hospital for treatment, RC will register his/her handheld terminal and assign relevant medical sensors to him/her to monitor the physical parameters.Step PR-1: RC chooses a random numbersPj ∈ Z∗p as the patient Pj’s master key. And then RC computes the corresponding public key PKPj = sPj·u·P. Next, RC sends the message {sPj, PKPj} to the patient Pj through a secure channel.


## 4.3. Anonymous Authentication

### 4.3.1. Patient to Doctor Anonymous Authentication

When the patientPj wants to send the data collected by himself to the doctor Di to facilitate the doctor’s diagnosis or detection, this step is required. Since the data transmitted by the patient to the doctor contain very sensitive health information, in order to preserve the privacy of these data, the patient needs to use encryption and authentication methods to process the data. The detailed steps are as follows:Step PA-1: the patientPj first chooses a random value k ∈ Z∗p and calculates(3)a1=k·P,a2=k·PKDi,a3=hdatak·sPj·PKRC,a4=k·PKPj,w1=dataa3a4Tj,c1=w1⊕Ha2,where data are the physical parameters of the patientPj and Tj is the timestamp. Then, the patient Pj sends the message {a1, c1, Tj} to the doctor Di via common channel.Step PA-2: upon receiving the message {a1, c1, Tj}, the doctor Di computes w∗1 = c1 ⊕ H(sDi·a1) and extracts the data, a3, a4 and the timestamp Tj from w∗1. Then, the doctor Di verifies whether the timestamp Tj is fresh. If it is not fresh, the doctor Di discards the message directly and terminates the authentication process. Otherwise, go to the next step.Step PA-3: the doctorDi checks if e^a3,PKDi?=e^PKRC,hdata⋅sDi⋅a4 holds. If the above equation is true, the doctor Di considers that the patient Pj is legitimate and the health information data have not been destroyed. Otherwise, the patient Pj is considered to be an illegal user and refuses to accept the health information data.Figure2 summarizes the process of patient to doctor authentication phase.Figure 2
The patient to doctor authentication phase.Proof of Correctness. The challenger equation e^a3,PKDi?=e^PKRC,hdata⋅sDi⋅a4 calculated by the doctor Di should be held by using the values a3 and a4 sent from the patient Pj.(4)e^a3,PKDi=e^hdata⋅k⋅sPj⋅PKRC,PKDi=e^k⋅sPj⋅PKRC,hdata⋅sDi⋅P=e^PKRC,hdata⋅k⋅sPj⋅sDi⋅P=e^PKRC,hdata⋅sDi⋅k⋅PKPj=e^PKRC,hdatasDi⋅a4.


### 4.3.2. Doctor to Patient Anonymous Authentication

When the doctorDi wants to get the relevant health data of the patient Pj, he first generates the query information demand and completes the message authentication through the following steps:Step DA-1: the doctorDi first inserts his/her smart card to a terminal and then inputs his/her identity DIDi and password DPWi. Then, the smart card computes as follows:Ai∗=hDIDihri⊕DPWi⊕Vi, Bi∗=hAi∗, and checks whether Bi∗=Bi. If not, the smart card rejects this request and prompts the doctor to enter the correct identity and password. Otherwise, go to the next step.Step DA-2: the doctorDi chooses a random number r ∈ Z∗p and computes(5)b1=r·P,b2=r·PKPj,b3=hdemandr·sDi·PKRC,b4=r·PKDi,b5=hTi·sDi·P,Certi=LDiTi⊕HhTi·sDi·PKRC,w2=demandb3b4CertiTi,c2=w2⊕Hb2,where demand is the query request information of the doctor andTi is the timestamp. Then, the doctor Di sends the message {b1, b5, c2, Certi, Ti} to the patient Pj via a common channel.Step DA-3: upon receiving the message {b1, b5, c2, Certi, Ti}, the patient Pj verifies whether the time stamp Ti is fresh. If not, the authentication process is terminated. Otherwise, Pj uses his/her private key to compute b2∗=sPj⋅b1, w2∗=c2⊕Hb2∗. And then, Pj extracts variables demand, b3, b4, Certi and the timestamp Ti from w∗2.Step DA-4:Pj verifies whether the equation e^b3,PKPj?=e^PKRC,hdemand⋅sPj⋅b4 holds. If the above equation is true, the patient Pj considers the doctor to be a legitimate doctor, and he will provide the relevant health data according to the doctor’s requirements. Otherwise, he believes that the doctor Di is an illegal doctor and refuses to accept his request.Figure3 summarizes the process of login and the doctor to patient authentication phase.Proof of correctness:(6)e^b3,PKPj=e^hdemand⋅r⋅sDi⋅PKRC,sPj⋅P=e^PKRC,hdemand⋅r⋅sDi⋅sPj⋅P=e^PKRC,hdemand⋅sPj⋅r⋅sDi⋅P=e^PKRC,hdemand⋅sPj⋅b4.Step DA-5 (identity tracking): if the request message demand is suspected of having a problem or illegal operation, RC is able to track the actual identity of the doctor using the certificate Certi in the message. The process is as follows:Then, RC finds the corresponding record <DIDi, LDi> in the checklist and gets the actual identity of the doctor DIDi.Figure 3
The login process and doctor to patient authentication phase.(7)Certi⊕HsRC·b5=LDiTi⊕HhTi·sDi·PKRC⊕HsRC·b5=LDiTi⊕HhTi·sDi·PKRC⊕HsRC·hTi·sDi·P=LDiTi.


## 4.3.1. Patient to Doctor Anonymous Authentication

When the patientPj wants to send the data collected by himself to the doctor Di to facilitate the doctor’s diagnosis or detection, this step is required. Since the data transmitted by the patient to the doctor contain very sensitive health information, in order to preserve the privacy of these data, the patient needs to use encryption and authentication methods to process the data. The detailed steps are as follows:Step PA-1: the patientPj first chooses a random value k ∈ Z∗p and calculates(3)a1=k·P,a2=k·PKDi,a3=hdatak·sPj·PKRC,a4=k·PKPj,w1=dataa3a4Tj,c1=w1⊕Ha2,where data are the physical parameters of the patientPj and Tj is the timestamp. Then, the patient Pj sends the message {a1, c1, Tj} to the doctor Di via common channel.Step PA-2: upon receiving the message {a1, c1, Tj}, the doctor Di computes w∗1 = c1 ⊕ H(sDi·a1) and extracts the data, a3, a4 and the timestamp Tj from w∗1. Then, the doctor Di verifies whether the timestamp Tj is fresh. If it is not fresh, the doctor Di discards the message directly and terminates the authentication process. Otherwise, go to the next step.Step PA-3: the doctorDi checks if e^a3,PKDi?=e^PKRC,hdata⋅sDi⋅a4 holds. If the above equation is true, the doctor Di considers that the patient Pj is legitimate and the health information data have not been destroyed. Otherwise, the patient Pj is considered to be an illegal user and refuses to accept the health information data.Figure2 summarizes the process of patient to doctor authentication phase.Figure 2
The patient to doctor authentication phase.Proof of Correctness. The challenger equation e^a3,PKDi?=e^PKRC,hdata⋅sDi⋅a4 calculated by the doctor Di should be held by using the values a3 and a4 sent from the patient Pj.(4)e^a3,PKDi=e^hdata⋅k⋅sPj⋅PKRC,PKDi=e^k⋅sPj⋅PKRC,hdata⋅sDi⋅P=e^PKRC,hdata⋅k⋅sPj⋅sDi⋅P=e^PKRC,hdata⋅sDi⋅k⋅PKPj=e^PKRC,hdatasDi⋅a4.


## 4.3.2. Doctor to Patient Anonymous Authentication

When the doctorDi wants to get the relevant health data of the patient Pj, he first generates the query information demand and completes the message authentication through the following steps:Step DA-1: the doctorDi first inserts his/her smart card to a terminal and then inputs his/her identity DIDi and password DPWi. Then, the smart card computes as follows:Ai∗=hDIDihri⊕DPWi⊕Vi, Bi∗=hAi∗, and checks whether Bi∗=Bi. If not, the smart card rejects this request and prompts the doctor to enter the correct identity and password. Otherwise, go to the next step.Step DA-2: the doctorDi chooses a random number r ∈ Z∗p and computes(5)b1=r·P,b2=r·PKPj,b3=hdemandr·sDi·PKRC,b4=r·PKDi,b5=hTi·sDi·P,Certi=LDiTi⊕HhTi·sDi·PKRC,w2=demandb3b4CertiTi,c2=w2⊕Hb2,where demand is the query request information of the doctor andTi is the timestamp. Then, the doctor Di sends the message {b1, b5, c2, Certi, Ti} to the patient Pj via a common channel.Step DA-3: upon receiving the message {b1, b5, c2, Certi, Ti}, the patient Pj verifies whether the time stamp Ti is fresh. If not, the authentication process is terminated. Otherwise, Pj uses his/her private key to compute b2∗=sPj⋅b1, w2∗=c2⊕Hb2∗. And then, Pj extracts variables demand, b3, b4, Certi and the timestamp Ti from w∗2.Step DA-4:Pj verifies whether the equation e^b3,PKPj?=e^PKRC,hdemand⋅sPj⋅b4 holds. If the above equation is true, the patient Pj considers the doctor to be a legitimate doctor, and he will provide the relevant health data according to the doctor’s requirements. Otherwise, he believes that the doctor Di is an illegal doctor and refuses to accept his request.Figure3 summarizes the process of login and the doctor to patient authentication phase.Proof of correctness:(6)e^b3,PKPj=e^hdemand⋅r⋅sDi⋅PKRC,sPj⋅P=e^PKRC,hdemand⋅r⋅sDi⋅sPj⋅P=e^PKRC,hdemand⋅sPj⋅r⋅sDi⋅P=e^PKRC,hdemand⋅sPj⋅b4.Step DA-5 (identity tracking): if the request message demand is suspected of having a problem or illegal operation, RC is able to track the actual identity of the doctor using the certificate Certi in the message. The process is as follows:Then, RC finds the corresponding record <DIDi, LDi> in the checklist and gets the actual identity of the doctor DIDi.Figure 3
The login process and doctor to patient authentication phase.(7)Certi⊕HsRC·b5=LDiTi⊕HhTi·sDi·PKRC⊕HsRC·b5=LDiTi⊕HhTi·sDi·PKRC⊕HsRC·hTi·sDi·P=LDiTi.


## 5. Security Analysis

In this section, we first prove that the proposed anonymous user authentication protocol is provably secure under the BAN logic [32, 33]. Next, the security and functional features of the proposed authentication protocol are discussed.


### 5.1. BAN Logic-Based Formal Security Analysis

We use BAN logic to analyze the security and correctness of our proposed authentication protocol. Table2 summarizes the notations and rules of the BAN logic.Table 2
The notations and rules of the BAN logic.
NotationsDescriptionP, QA principalP ◁ XP sees XP|∼XP said X, X was send by PP|⇒XP has jurisdiction over X⟶kPk is P’s public keyP↔kQk is only known to P and Q.#(X)X is fresh<X>kFormulaeX is combined with the formulae k{X}kX is encrypted by the key kP|≡XP has faith in the truth of XRule 1: message meaning ruleP|≡P↔kQ,P⊲Xk/P|≡Q|∼X or P|≡⟶kQ,P⊲Xk/P|≡Q|∼XRule 2: nonce verification ruleP|≡#X,P|≡Q|∼X/P|≡Q|≡XRule 3: jurisdiction ruleP|≡Q⇒X,P|≡Q|≡X/P|≡XRule 4: decomposition ruleP|≡Q|≡X,Y/P|≡Q|≡XGoals. According to the analytic procedures of the BAN logic, the proposed authentication protocol must satisfy the following security goals:Goal1: Pj|≡Di|≡Pj↔c1DiGoal2: Di|≡Pj|≡Di↔c2PjThe initial status forms of the proposed authentication protocol are formally described as follows:A1: Di|≡#Ti,rA2: Pj|≡#Tj,kA3: Di⊲a3,dataHa2A4: Pj⊲demand,TiHb2The idealized transformed message of the proposed authentication protocol is described as follows:Msg1: Pj⟶Di:a1,c1,TjMsg2: Di⟶Pj:b1,b5,c2,Certi,TiThe main analysis steps of the proposed authentication protocol based on the BAN logic are described as follows:ByA2, A3, and the message meaning rule, it is easy to getS1: Di|≡Pj|∼a3,dataHa2By S1, A3, Msg1, and the nonce verification rule in which k is the necessary part of H(a2), it is easy to get S2: Pj|≡Di|≡Pj↔Ha2DiByS2, Msg1, and the nonce verification rule in which Tj is the part of c1, it is easy to get S3: Pj|≡Di|≡Pj↔c1Di (Goal1)ByA1, A4, and the message meaning rule, it is easy to get S4: Pj|≡Di|∼b5,c2,TiHb2ByS4, A4, Msg1, and the nonce verification rule in which r is the necessary part of H(b2), it is easy to get S5: Di|≡Pj|≡Di↔Hb2PjBy S5, Msg2 and the nonce verification rule in which Ti is the part of c2, it is easy to get S6: Di|≡Pj|≡Di↔c2Pj (Goal2)


### 5.2. Informal Security Analysis

In this section, the security and functional features of the proposed authentication protocol are discussed. Through the detailed analysis, it has been proven that the proposed protocol can withstand various common attacks.


#### 5.2.1. Privileged Insider Attack

In the proposed protocol, RC does not store any patient-related information. Therefore, the privileged insider cannot obtain any critical information about the patient. In another, although RC stores the doctor’s checklist <DIDi, LDi> to track the doctor’s true identity, the privileged insider cannot guess the doctor’s password DPWi or private key sDi. Therefore, he/she has no advantage in breaking the robustness of the proposed authentication protocol.


#### 5.2.2. Replay Attack

Owing to the open nature of the wireless communication channel, the replay attack poses a great security threat to the wireless body area networks. According to the specification of the proposed protocol, the first step of each entity (the patient or doctor) is to check the freshness of the authentication messages using the timestampsTi or Tj. In addition, the timestamp is hashed and Exclusive OR (⊕) with other parameters (c1, c2, or b5), which is contained in the authentication messages. Therefore, if the timestamp is not fresh, the receiver discards the message directly and aborts the session. If the adversary modifies the timestamp, he/she cannot calculate the corresponding parameters. Consequently, our proposed protocol is able to withstand the reply attack.


#### 5.2.3. Impersonation Attack

LetA be an adversary and he has the ability to intercept the authentication message of the patient Pj: {a1, c1, Tj}. A may try to generate a forged authentication message a∗1,c∗1,T∗1. Since A has not registered at RC and does not know the secret value u, it is impossible for A to obtain its own correct public key PK∗Pj. Even though the adversary A chooses a new random number k∗ to the corresponding parameter a∗1, he cannot compute the correct parameters a∗3 and a∗4. Therefore, it is easy to find that the adversary cannot pretend to be a patient.Similarly, we can get that the adversaryA has no ability to pretend to be a doctor because he does not know the RC’s secret value u. Therefore, the proposed authentication protocol can resist the impersonation attack.


#### 5.2.4. Stolen Smart Card Attack

In the proposed protocol, every doctor has a smart card to login to the wireless body area networks. Suppose an adversaryA picks up or steals a doctor’s smart card and extracts the stored secret parameters {Bi, Vi, PKDi, LDi, ri}, where Bi = h(Ai), Vi = Ai ⊕ h(DIDi ||h(ri ⊕ DPWi)), PKDi = sDi·u·P, and LDi = sDi⋅v⋅P. Furthermore, assume that the adversary A eavesdrops the authentication message {b1, b5, c2, Certi, Ti} sent by the doctor. Using these obtained parameters, if A wants to pretend to be a doctor and launch an attack, he must try to guess the doctor’s password DPWi to generate the doctor’s private key sDi = h(ri ⊕ DPWi). Without knowing the doctor’s password, the adversary A cannot compute the doctor’s private key. Then he cannot further generate the correct authentication message. Therefore, it is easy to find that the proposed protocol is resistant to stolen smart card attack.


#### 5.2.5. User Anonymity

User anonymity is a very important security requirement in the WBAN. To protect the privacy of doctors and patients, the proposed protocol has made the following measures. In the patient side, the random valuek ∈ Z∗p and the timestamp Tj are used in each round of the patient to doctor authentication. The patient’s master key sPj and public key PKPj are encrypted in a3, a4 with k and Tj, respectively. Suppose that the adversary A could intercept the message {a1, c1, Tj}, it is an impossible task for to obtain the patient's fixed master key sPj and public key PKPj. Similarly, the adversary A cannot use the message transferred from the doctor to the patient to obtain the doctor’s fixed parameters. Consequently, the proposed authentication protocol can achieve the anonymity of the patients and the doctors.


#### 5.2.6. Authentication and Data Integrity

In the proposed scheme, the patient’s physiological parameter data and the doctor’s query request information demand are encrypted by the hash valuesH(a2) and H(b2), respectively. In addition, the values h(data) and h(demand) are the parameters of a3 and b3, respectively. According to the property of hash, if any bits are modified, the verify equationse^a3,PKDi?=e^PKRC,hdata⋅sDi⋅a4 and e^b3,PKPj?=e^PKRC,hdemand⋅sPj⋅b4 cannot be established. Consequently, the proposed authentication protocol can check the integrity of the messages transmitted between the doctor and the patient.


#### 5.2.7. Unlinkability and Conditional Traceability

For the adversaryA, he could intercept the messages {a1, c1, Tj} and {b1, b5, c2, Certi, Ti}. However, the random numbers k and r are different in each round of the message authentication. Therefore, it is difficult for the adversary A to trace the messages which were transmitted from the doctor or the patient. On the other hand, the RC has the ability to track the doctor’s actual identity through the formula in Step DA-5. Therefore, except for the ability of RC to track the identity of doctors, other entities cannot track the identity of doctors or patients.


## 5.1. BAN Logic-Based Formal Security Analysis

We use BAN logic to analyze the security and correctness of our proposed authentication protocol. Table2 summarizes the notations and rules of the BAN logic.Table 2
The notations and rules of the BAN logic.
NotationsDescriptionP, QA principalP ◁ XP sees XP|∼XP said X, X was send by PP|⇒XP has jurisdiction over X⟶kPk is P’s public keyP↔kQk is only known to P and Q.#(X)X is fresh<X>kFormulaeX is combined with the formulae k{X}kX is encrypted by the key kP|≡XP has faith in the truth of XRule 1: message meaning ruleP|≡P↔kQ,P⊲Xk/P|≡Q|∼X or P|≡⟶kQ,P⊲Xk/P|≡Q|∼XRule 2: nonce verification ruleP|≡#X,P|≡Q|∼X/P|≡Q|≡XRule 3: jurisdiction ruleP|≡Q⇒X,P|≡Q|≡X/P|≡XRule 4: decomposition ruleP|≡Q|≡X,Y/P|≡Q|≡XGoals. According to the analytic procedures of the BAN logic, the proposed authentication protocol must satisfy the following security goals:Goal1: Pj|≡Di|≡Pj↔c1DiGoal2: Di|≡Pj|≡Di↔c2PjThe initial status forms of the proposed authentication protocol are formally described as follows:A1: Di|≡#Ti,rA2: Pj|≡#Tj,kA3: Di⊲a3,dataHa2A4: Pj⊲demand,TiHb2The idealized transformed message of the proposed authentication protocol is described as follows:Msg1: Pj⟶Di:a1,c1,TjMsg2: Di⟶Pj:b1,b5,c2,Certi,TiThe main analysis steps of the proposed authentication protocol based on the BAN logic are described as follows:ByA2, A3, and the message meaning rule, it is easy to getS1: Di|≡Pj|∼a3,dataHa2By S1, A3, Msg1, and the nonce verification rule in which k is the necessary part of H(a2), it is easy to get S2: Pj|≡Di|≡Pj↔Ha2DiByS2, Msg1, and the nonce verification rule in which Tj is the part of c1, it is easy to get S3: Pj|≡Di|≡Pj↔c1Di (Goal1)ByA1, A4, and the message meaning rule, it is easy to get S4: Pj|≡Di|∼b5,c2,TiHb2ByS4, A4, Msg1, and the nonce verification rule in which r is the necessary part of H(b2), it is easy to get S5: Di|≡Pj|≡Di↔Hb2PjBy S5, Msg2 and the nonce verification rule in which Ti is the part of c2, it is easy to get S6: Di|≡Pj|≡Di↔c2Pj (Goal2)


## 5.2. Informal Security Analysis

In this section, the security and functional features of the proposed authentication protocol are discussed. Through the detailed analysis, it has been proven that the proposed protocol can withstand various common attacks.


### 5.2.1. Privileged Insider Attack

In the proposed protocol, RC does not store any patient-related information. Therefore, the privileged insider cannot obtain any critical information about the patient. In another, although RC stores the doctor’s checklist <DIDi, LDi> to track the doctor’s true identity, the privileged insider cannot guess the doctor’s password DPWi or private key sDi. Therefore, he/she has no advantage in breaking the robustness of the proposed authentication protocol.


### 5.2.2. Replay Attack

Owing to the open nature of the wireless communication channel, the replay attack poses a great security threat to the wireless body area networks. According to the specification of the proposed protocol, the first step of each entity (the patient or doctor) is to check the freshness of the authentication messages using the timestampsTi or Tj. In addition, the timestamp is hashed and Exclusive OR (⊕) with other parameters (c1, c2, or b5), which is contained in the authentication messages. Therefore, if the timestamp is not fresh, the receiver discards the message directly and aborts the session. If the adversary modifies the timestamp, he/she cannot calculate the corresponding parameters. Consequently, our proposed protocol is able to withstand the reply attack.


### 5.2.3. Impersonation Attack

LetA be an adversary and he has the ability to intercept the authentication message of the patient Pj: {a1, c1, Tj}. A may try to generate a forged authentication message a∗1,c∗1,T∗1. Since A has not registered at RC and does not know the secret value u, it is impossible for A to obtain its own correct public key PK∗Pj. Even though the adversary A chooses a new random number k∗ to the corresponding parameter a∗1, he cannot compute the correct parameters a∗3 and a∗4. Therefore, it is easy to find that the adversary cannot pretend to be a patient.Similarly, we can get that the adversaryA has no ability to pretend to be a doctor because he does not know the RC’s secret value u. Therefore, the proposed authentication protocol can resist the impersonation attack.


### 5.2.4. Stolen Smart Card Attack

In the proposed protocol, every doctor has a smart card to login to the wireless body area networks. Suppose an adversaryA picks up or steals a doctor’s smart card and extracts the stored secret parameters {Bi, Vi, PKDi, LDi, ri}, where Bi = h(Ai), Vi = Ai ⊕ h(DIDi ||h(ri ⊕ DPWi)), PKDi = sDi·u·P, and LDi = sDi⋅v⋅P. Furthermore, assume that the adversary A eavesdrops the authentication message {b1, b5, c2, Certi, Ti} sent by the doctor. Using these obtained parameters, if A wants to pretend to be a doctor and launch an attack, he must try to guess the doctor’s password DPWi to generate the doctor’s private key sDi = h(ri ⊕ DPWi). Without knowing the doctor’s password, the adversary A cannot compute the doctor’s private key. Then he cannot further generate the correct authentication message. Therefore, it is easy to find that the proposed protocol is resistant to stolen smart card attack.


### 5.2.5. User Anonymity

User anonymity is a very important security requirement in the WBAN. To protect the privacy of doctors and patients, the proposed protocol has made the following measures. In the patient side, the random valuek ∈ Z∗p and the timestamp Tj are used in each round of the patient to doctor authentication. The patient’s master key sPj and public key PKPj are encrypted in a3, a4 with k and Tj, respectively. Suppose that the adversary A could intercept the message {a1, c1, Tj}, it is an impossible task for to obtain the patient's fixed master key sPj and public key PKPj. Similarly, the adversary A cannot use the message transferred from the doctor to the patient to obtain the doctor’s fixed parameters. Consequently, the proposed authentication protocol can achieve the anonymity of the patients and the doctors.


### 5.2.6. Authentication and Data Integrity

In the proposed scheme, the patient’s physiological parameter data and the doctor’s query request information demand are encrypted by the hash valuesH(a2) and H(b2), respectively. In addition, the values h(data) and h(demand) are the parameters of a3 and b3, respectively. According to the property of hash, if any bits are modified, the verify equationse^a3,PKDi?=e^PKRC,hdata⋅sDi⋅a4 and e^b3,PKPj?=e^PKRC,hdemand⋅sPj⋅b4 cannot be established. Consequently, the proposed authentication protocol can check the integrity of the messages transmitted between the doctor and the patient.


### 5.2.7. Unlinkability and Conditional Traceability

For the adversaryA, he could intercept the messages {a1, c1, Tj} and {b1, b5, c2, Certi, Ti}. However, the random numbers k and r are different in each round of the message authentication. Therefore, it is difficult for the adversary A to trace the messages which were transmitted from the doctor or the patient. On the other hand, the RC has the ability to track the doctor’s actual identity through the formula in Step DA-5. Therefore, except for the ability of RC to track the identity of doctors, other entities cannot track the identity of doctors or patients.


## 5.2.1. Privileged Insider Attack

In the proposed protocol, RC does not store any patient-related information. Therefore, the privileged insider cannot obtain any critical information about the patient. In another, although RC stores the doctor’s checklist <DIDi, LDi> to track the doctor’s true identity, the privileged insider cannot guess the doctor’s password DPWi or private key sDi. Therefore, he/she has no advantage in breaking the robustness of the proposed authentication protocol.


## 5.2.2. Replay Attack

Owing to the open nature of the wireless communication channel, the replay attack poses a great security threat to the wireless body area networks. According to the specification of the proposed protocol, the first step of each entity (the patient or doctor) is to check the freshness of the authentication messages using the timestampsTi or Tj. In addition, the timestamp is hashed and Exclusive OR (⊕) with other parameters (c1, c2, or b5), which is contained in the authentication messages. Therefore, if the timestamp is not fresh, the receiver discards the message directly and aborts the session. If the adversary modifies the timestamp, he/she cannot calculate the corresponding parameters. Consequently, our proposed protocol is able to withstand the reply attack.


## 5.2.3. Impersonation Attack

LetA be an adversary and he has the ability to intercept the authentication message of the patient Pj: {a1, c1, Tj}. A may try to generate a forged authentication message a∗1,c∗1,T∗1. Since A has not registered at RC and does not know the secret value u, it is impossible for A to obtain its own correct public key PK∗Pj. Even though the adversary A chooses a new random number k∗ to the corresponding parameter a∗1, he cannot compute the correct parameters a∗3 and a∗4. Therefore, it is easy to find that the adversary cannot pretend to be a patient.Similarly, we can get that the adversaryA has no ability to pretend to be a doctor because he does not know the RC’s secret value u. Therefore, the proposed authentication protocol can resist the impersonation attack.


## 5.2.4. Stolen Smart Card Attack

In the proposed protocol, every doctor has a smart card to login to the wireless body area networks. Suppose an adversaryA picks up or steals a doctor’s smart card and extracts the stored secret parameters {Bi, Vi, PKDi, LDi, ri}, where Bi = h(Ai), Vi = Ai ⊕ h(DIDi ||h(ri ⊕ DPWi)), PKDi = sDi·u·P, and LDi = sDi⋅v⋅P. Furthermore, assume that the adversary A eavesdrops the authentication message {b1, b5, c2, Certi, Ti} sent by the doctor. Using these obtained parameters, if A wants to pretend to be a doctor and launch an attack, he must try to guess the doctor’s password DPWi to generate the doctor’s private key sDi = h(ri ⊕ DPWi). Without knowing the doctor’s password, the adversary A cannot compute the doctor’s private key. Then he cannot further generate the correct authentication message. Therefore, it is easy to find that the proposed protocol is resistant to stolen smart card attack.


## 5.2.5. User Anonymity

User anonymity is a very important security requirement in the WBAN. To protect the privacy of doctors and patients, the proposed protocol has made the following measures. In the patient side, the random valuek ∈ Z∗p and the timestamp Tj are used in each round of the patient to doctor authentication. The patient’s master key sPj and public key PKPj are encrypted in a3, a4 with k and Tj, respectively. Suppose that the adversary A could intercept the message {a1, c1, Tj}, it is an impossible task for to obtain the patient's fixed master key sPj and public key PKPj. Similarly, the adversary A cannot use the message transferred from the doctor to the patient to obtain the doctor’s fixed parameters. Consequently, the proposed authentication protocol can achieve the anonymity of the patients and the doctors.


## 5.2.6. Authentication and Data Integrity

In the proposed scheme, the patient’s physiological parameter data and the doctor’s query request information demand are encrypted by the hash valuesH(a2) and H(b2), respectively. In addition, the values h(data) and h(demand) are the parameters of a3 and b3, respectively. According to the property of hash, if any bits are modified, the verify equationse^a3,PKDi?=e^PKRC,hdata⋅sDi⋅a4 and e^b3,PKPj?=e^PKRC,hdemand⋅sPj⋅b4 cannot be established. Consequently, the proposed authentication protocol can check the integrity of the messages transmitted between the doctor and the patient.


## 5.2.7. Unlinkability and Conditional Traceability

For the adversaryA, he could intercept the messages {a1, c1, Tj} and {b1, b5, c2, Certi, Ti}. However, the random numbers k and r are different in each round of the message authentication. Therefore, it is difficult for the adversary A to trace the messages which were transmitted from the doctor or the patient. On the other hand, the RC has the ability to track the doctor’s actual identity through the formula in Step DA-5. Therefore, except for the ability of RC to track the identity of doctors, other entities cannot track the identity of doctors or patients.


## 6. Performance Analysis

In this section, the performance of the proposed scheme is evaluated in terms of computational cost, and communication overhead, and security requirements. We then compare the proposed scheme with the existing research activities in terms of security and functional features.


### 6.1. Computation Cost

In the proposed scheme, the computational cost isreferred to the time which was consumed in the phase of message generation and verification. The multiplicative cyclic groups used in the proposed scheme are built based on a Type-A elliptic curve, which is defined in the pairing-based cryptography (PBC) library [34]. In addition, we use C language under specific IDE and C/CCC MIRACL Library to implement the related cryptographic operations. To evaluate the computational costs of the proposed scheme, some of the related notations are listed in Table 3.Table 3
Execution time of the related pairing-based operations.
NotationsExecution time for various operationsThOne-way hash functionH (·) or h (·)TpairBilinear pairing computationTaddAddition operation of points in ECCTexpExponential operationTmulScalar multiplication of elliptic curveTenSymmetric encryption algorithm AES (128-bit key)Our implementation uses a PC with Intel Core i7 CPU 2.6 GHz and 8 GB memory to run the proposed authentication protocol. In our simulation, each randomized ID is 1024 bits, and the size of the ECC point is 160 bits. The execution time for each cryptographic operation is derived after 10 times experiments. The average running time of each cryptographic operation is listed in Table4. It needs to be explained here that we have ignored the running time of the XOR operation because it is negligible.Table 4
Execution time of the related pairing-based operations.
Encryption elementTh (ms)Tpair (ms)Tadd (ms)Texp (ms)Tmul (ms)Ten (ms)Running time<13.61<12.741.63<1In our implementation, the costs of the registration and smart card distribution are not considered since it only runs a limited number of times in the initial stage of the proposed protocol. Table5 shows a comparison for computation cost between the proposed authentication protocol and the related works. From Table 5, it is obvious that the proposed authentication protocol takes only one point multiplication, one pairing, and one hash function to generate the certificate. And the time of verifying the certificate only needs one hash function, two point multiplication, and one pairing operation. Compared with the related research activities, it is easy to find that the proposed protocol needs a very low computational overhead to complete the authentication process.Table 5
Execution time of the related pairing-based operations.
SchemesTime of generating the certificateTime of verifying the certificateWu et al.’s scheme3Th + 4Tmul + Ten4Th + 4Tmul + Tpair + TenShen et al.’s schemeTh + 3TmulTh + 4Tpair + Ten + 2TmulDas et al.’s scheme5Th + 2Ten4Th + 2TenLiu et al.’s scheme2Tpair + 3Th + Tmul3Tpair + 3Th + 3TmulProposed schemeTh + Tmul + TpairTh + 2Tmul + Tpair


### 6.2. Communication Overhead

To analyze the communication overhead of the proposed authentication protocol, the size of the parameters used in the proposed scheme is shown below. The length of the random number, the point of ECC, the identity, the output of a hash function, and the timestamp are 128 bits, 320 bits, 128 bits, 160 bits, and 32 bits, respectively. We assumed that the length of the physical parameters of the patientdata and the query request information of the doctor demand are 500 bits and 300 bits, respectively.Under these deliberations, in the patient to doctor authentication phase of the proposed protocol, the patient sends the messageM1 = {a1, c1, Tj} to the doctor. Similarly, in the doctor to patient authentication phase, the doctor sends the message M2 = {b1, b5, c2, Certi, Ti} to the doctor. These two messages need 320 + 500 + 320 + 320 + 32 + 32 = 1524 bits and 320 + 320 + 300 + 320 + 32 = 1292 bits, respectively. In Table 6, we summarize the brief comparison of communication overhead between the proposed scheme and other existing schemes.Table 6
The comparison of communication cost in different schemes.
SchemeNumber of messagesCommunication cost (bits)Wu et al.’s scheme32112Shen et al.’s scheme43040Das et al.’s scheme21536Liu et al.’s scheme43840Proposed scheme22816Compared with other existing schemes, the proposed scheme’s communication cost is similar to that of other related research works. However, the messages in the proposed protocol contain the patient’s physical parameter data and the doctor’s query request information demand. In other words, the proposed scheme can not only achieve the identity authentication, but also complete the transfer of the patient's physiological data and the data requested by the doctor. Therefore, the proposed protocol is not only efficient in terms of communication overhead in the WBAN system but also has more extra features.


### 6.3. Security Requirements

We compare the proposed authentication protocol with the related authentication schemes in terms of security requirements such as replay attack, impersonation attack, secure mutual authentication, message integrity, and confidentiality. The detailed comparison of various security attacks and functions is shown in Table7. The comments from Table 7 show that our authentication protocol not only gives the support of much more functionality but also overcomes more security weaknesses.Table 7
The comparison of security requirements.
SchemeI1I2I3I4I5I6I7Wu et al.’s scheme√√√√√×√Shen et al.’s scheme√×√√×√√Das et al.’s scheme√√√×√√×Liu et al.’s scheme√√√√×√√Proposed scheme√√√√√√√Note. I1: replay attack; I2: impersonation attack; I3: privileged insider attack; I4: secure mutual authentication; I5: message integrity and confidentiality; I6: user privacy; I7: loss of device attack.


## 6.1. Computation Cost

In the proposed scheme, the computational cost isreferred to the time which was consumed in the phase of message generation and verification. The multiplicative cyclic groups used in the proposed scheme are built based on a Type-A elliptic curve, which is defined in the pairing-based cryptography (PBC) library [34]. In addition, we use C language under specific IDE and C/CCC MIRACL Library to implement the related cryptographic operations. To evaluate the computational costs of the proposed scheme, some of the related notations are listed in Table 3.Table 3
Execution time of the related pairing-based operations.
NotationsExecution time for various operationsThOne-way hash functionH (·) or h (·)TpairBilinear pairing computationTaddAddition operation of points in ECCTexpExponential operationTmulScalar multiplication of elliptic curveTenSymmetric encryption algorithm AES (128-bit key)Our implementation uses a PC with Intel Core i7 CPU 2.6 GHz and 8 GB memory to run the proposed authentication protocol. In our simulation, each randomized ID is 1024 bits, and the size of the ECC point is 160 bits. The execution time for each cryptographic operation is derived after 10 times experiments. The average running time of each cryptographic operation is listed in Table4. It needs to be explained here that we have ignored the running time of the XOR operation because it is negligible.Table 4
Execution time of the related pairing-based operations.
Encryption elementTh (ms)Tpair (ms)Tadd (ms)Texp (ms)Tmul (ms)Ten (ms)Running time<13.61<12.741.63<1In our implementation, the costs of the registration and smart card distribution are not considered since it only runs a limited number of times in the initial stage of the proposed protocol. Table5 shows a comparison for computation cost between the proposed authentication protocol and the related works. From Table 5, it is obvious that the proposed authentication protocol takes only one point multiplication, one pairing, and one hash function to generate the certificate. And the time of verifying the certificate only needs one hash function, two point multiplication, and one pairing operation. Compared with the related research activities, it is easy to find that the proposed protocol needs a very low computational overhead to complete the authentication process.Table 5
Execution time of the related pairing-based operations.
SchemesTime of generating the certificateTime of verifying the certificateWu et al.’s scheme3Th + 4Tmul + Ten4Th + 4Tmul + Tpair + TenShen et al.’s schemeTh + 3TmulTh + 4Tpair + Ten + 2TmulDas et al.’s scheme5Th + 2Ten4Th + 2TenLiu et al.’s scheme2Tpair + 3Th + Tmul3Tpair + 3Th + 3TmulProposed schemeTh + Tmul + TpairTh + 2Tmul + Tpair


## 6.2. Communication Overhead

To analyze the communication overhead of the proposed authentication protocol, the size of the parameters used in the proposed scheme is shown below. The length of the random number, the point of ECC, the identity, the output of a hash function, and the timestamp are 128 bits, 320 bits, 128 bits, 160 bits, and 32 bits, respectively. We assumed that the length of the physical parameters of the patientdata and the query request information of the doctor demand are 500 bits and 300 bits, respectively.Under these deliberations, in the patient to doctor authentication phase of the proposed protocol, the patient sends the messageM1 = {a1, c1, Tj} to the doctor. Similarly, in the doctor to patient authentication phase, the doctor sends the message M2 = {b1, b5, c2, Certi, Ti} to the doctor. These two messages need 320 + 500 + 320 + 320 + 32 + 32 = 1524 bits and 320 + 320 + 300 + 320 + 32 = 1292 bits, respectively. In Table 6, we summarize the brief comparison of communication overhead between the proposed scheme and other existing schemes.Table 6
The comparison of communication cost in different schemes.
SchemeNumber of messagesCommunication cost (bits)Wu et al.’s scheme32112Shen et al.’s scheme43040Das et al.’s scheme21536Liu et al.’s scheme43840Proposed scheme22816Compared with other existing schemes, the proposed scheme’s communication cost is similar to that of other related research works. However, the messages in the proposed protocol contain the patient’s physical parameter data and the doctor’s query request information demand. In other words, the proposed scheme can not only achieve the identity authentication, but also complete the transfer of the patient's physiological data and the data requested by the doctor. Therefore, the proposed protocol is not only efficient in terms of communication overhead in the WBAN system but also has more extra features.


## 6.3. Security Requirements

We compare the proposed authentication protocol with the related authentication schemes in terms of security requirements such as replay attack, impersonation attack, secure mutual authentication, message integrity, and confidentiality. The detailed comparison of various security attacks and functions is shown in Table7. The comments from Table 7 show that our authentication protocol not only gives the support of much more functionality but also overcomes more security weaknesses.Table 7
The comparison of security requirements.
SchemeI1I2I3I4I5I6I7Wu et al.’s scheme√√√√√×√Shen et al.’s scheme√×√√×√√Das et al.’s scheme√√√×√√×Liu et al.’s scheme√√√√×√√Proposed scheme√√√√√√√Note. I1: replay attack; I2: impersonation attack; I3: privileged insider attack; I4: secure mutual authentication; I5: message integrity and confidentiality; I6: user privacy; I7: loss of device attack.


## 7. Conclusion

In this article, an efficient and privacy-preserving authentication protocol for the WBAN is presented. In the proposed authentication scheme, the doctor and the patient are anonymously authenticated by each other before sending the patient-related information (the patient’s physical parameters or the doctor’s query request). The security analysis showed that the proposed authentication protocol could provide resistance against common attacks such as replay attack, impersonation attack, and eavesdropping attack. The proposed authentication scheme takes very little cost for signature and certificate authentication, which is essential for the WBAN-based applications. Moreover, the proposed scheme gives an effective privacy and tracking method to disclose the actual identification of the malicious doctor to improve the usability of the WBAN. The performance analysis showed that the proposed scheme is efficient in terms of computational cost and communication cost. It is more appropriate for practical WBAN-based applications. The future extension of this article is to provide an authentication method that can transmit a larger amount of data for the patient in an efficient manner.



---

*Source: 4939589-2021-07-22.xml*