# Provably Secure and Lightweight Patient Monitoring Protocol for Wireless Body Area Network in IoHT

Authors: Qi Xie; Dongnan Liu; Zixuan Ding; Xiao Tan; Lidong Han
Journal: Journal of Healthcare Engineering
 (2023)

---

## Abstract

As one of the important applications of Internet of Health Things (IoHT) technology in the field of healthcare, wireless body area network (WBAN) has been widely used in medical therapy, and it can not only monitor and record physiological information but also transmit the data collected by sensor devices to the server in time. However, due to the unreliability and vulnerability of wireless network communication, as well as the limited storage and computing resources of sensor nodes in WBAN, a lot of authentication protocols for WBAN have been devised. In 2021, Alzahrani et al. designed an anonymous medical monitoring protocol, which uses lightweight cryptographic primitives for WBAN. However, we find that their protocol is defenseless to off-line identity guessing attacks, known-key attacks, and stolen-verifier attacks and has no perfect forward secrecy. Therefore, a patient monitoring protocol for WBAN in IoHT is proposed. We use security proof under the random oracle model (ROM) and automatic verification tool ProVerif to demonstrate that our protocol is secure. According to comparisons with related protocols, our protocol can achieve both high computational efficiency and security.


---

## Body

## 1. Introduction

Wireless body area network (WBAN) exists as a transmission network for body monitoring. It has intellectual network appliances, such as personal wireless terminals, wearable devices, and wireless sensors. Individuals can use network devices to build personalized health networks based on WBAN, and they are substantial participants in the Internet of Health Things (IoHT) application. WBAN is widely used in patient monitoring, physiological parameter measurement, and so on. The measured data are transmitted by the sensor to the devices with a forwarding function in real time using wireless network transmission and then stored in the database of the remote server [1–3]. Using WBAN-based systems, patient-specific electronic medical records can be established, and professionals can analyze medical data through patient electronic records. Moreover, the electronic data of patients can be used for later analysis and diagnosis, and medical personnel can provide targeted medical services based on these data [4].The communication and interaction of WBAN are based on an open wireless channel, so it is inevitable to face a series of challenges. Attackers can eavesdrop, tamper, intercept publicly transmitted information, and use the obtained information to launch attacks and obtain patients’ privacy. This poses a great threat to the medical IoHT and patient privacy [5, 6]. In addition, the WBAN system requires real-time data transmission and timely processing of a large number of communication requests, which makes the energy consumption of infrastructures with limited efficiency very heavy [7]. However, most devices for WBAN have limited computing power, so they cannot perform traditional cryptographic calculations. Moreover, intensive computation will bring about overblown network loads, which will affect the performance of the system. Therefore, the medical field urgently needs a lightweight privacy-protected secure key agreement to meet the above challenges.In recent years, a lot of anonymous medical key agreements have been proposed. An innovative dynamic ID-based key agreement in telecare medical information system (TMIS) was presented by Chen et al. [8]. However, Xie et al. [9] state that Chen et al.’s scheme cannot defend against off-line password guessing attacks and impersonation attacks and has no privacy protection and perfect forward secrecy. Xie et al. [10] presented a novel authentication protocol for TMIS in 2014, which is considered to be pragmatic and secure. Radhakrishnan and Muniyandi [11] submitted a two-factor key agreement for TMIS based on elliptic curve cryptography (ECC). In 2015, Wang and Zhang [12] solved the anonymity of authentication in WBAN using bilinear pairs, and their scheme could defend against known-key attacks and man-in-middle attacks. However, according to the research of Jiang et al. [13], the protocol cannot resist client forgery attacks, is not suitable for practical applications, and may lead to nonsynchronization of system logs. In 2017, Li et al. [14] proposed an anonymous authentication scheme. It employs lightweight cryptographic primitives (e.g., hash function operations) and asserts that it has realized the mutual authentication of the sensor nodes worn by patients and the hub node and has realized unlinkability and anonymity. Later, Koya et al. [15] stated that it is not feasible because their scheme assumes that the central node is entirely credible. Moreover, it is defenseless to sensor impersonation attacks. Soni and Singh [16] submitted a lightweight authentication scheme employing low-cost operations for WBAN. Based on the wireless medical sensor network, Jan et al. [17] submitted a patient key agreement for the healthcare system to realize secure and efficient communication between users and sensors. Recently, Ullah et al. [18] submitted a hyperelliptic curve and pragmatic IoT-based crossdomain authentication scheme for WBAN. In addition, Ullah et al. [19–21] proposed a multimessage signcryption protocol, anonymous certificateless signcryption protocol, and certificate-founded signcryption protocol for IoHT. Khan et al. [22] proposed an online-offline certificate-less signature protocol for IoHT.Wu et al. [23] designed an identity authentication scheme using unilateral bilinear pairing technology which only performs bilinear pairing at the access point (AP). After that, Chen and Peng [24] declared that it cannot realize mutual authentication and is also susceptible to client forgery attacks. Li et al. [25] devised a key agreement founded on ECC to realize user anonymity. But Sowjanya et al. [26] found that their scheme not only has the problems of clock nonsynchronization and excessive control power of users but also no perfect forward secrecy. Kalra and Sood [27] submitted a secure key agreement that is not affected by time synchronization, which is based on the password. In 2021, Chunka et al. [28] reviewed their scheme and found that it had many security issues. For instance, due to the defects in the gateway design, the scheme cannot confirm the authenticities of sensor nodes, so it cannot resist the sensor nodes captured attacks, and the gateway private key is prone to be leaked. In addition, a large number of redundant multiple hash calculations increase the computational burden on the system. Xu et al. [29] raised an anonymous and lightweight patient monitoring protocol using lightweight cryptographic primitives. The survey of Alzahrani et al. [30] shows that off-line identity guessing attacks will wreck its anonymity, and it is also defenseless to key compromise attacks and replay attacks.


### 1.1. Motivation and Contributions

According to the summary of the existing literature [30–33], we found that some protocols using lightweight cryptographic primitives cannot resist various attacks, and many protocols based on asymmetric cryptography have high time complexity. In 2021, Alzahrani et al. [30] designed an anonymous medical monitoring scheme. Nevertheless, their scheme is defenseless to stolen-verifier attacks, known-key attacks, and off-line identity guessing attacks and has no perfect forward secrecy. To realize a secure and lightweight authentication protocol in WBAN systems, we propose a patient monitoring protocol. Here, our contributions are as follows:(i)
We reviewed Alzahrani et al.’s [30] protocol and analyzed its drawbacks, for example, known-key attacks, stolen-verifier attacks, and off-line identity guessing attacks(ii)
A patient monitoring protocol is proposed to realize the security and lightweight requirements of WBAN systems(iii)
Using the automated verification tool ProVerif and formal security proof in ROM, we demonstrate the proposed protocol is secure(iv)
Our protocol is relatively pragmatic and secure by performance comparisonThe remaining section is constructed as follows: the system model and preliminaries are given in Section2. In Section 3, we describe the review and drawbacks of Alzahrani et al.’s protocol. Section 4 proposes a patient monitoring scheme. Its security is analyzed in Sections 5 and 6. Its security properties, computation cost, storage cost, and communication cost between ours and some related protocols are evaluated in Section 7. Section 8 concludes the paper.


## 1.1. Motivation and Contributions

According to the summary of the existing literature [30–33], we found that some protocols using lightweight cryptographic primitives cannot resist various attacks, and many protocols based on asymmetric cryptography have high time complexity. In 2021, Alzahrani et al. [30] designed an anonymous medical monitoring scheme. Nevertheless, their scheme is defenseless to stolen-verifier attacks, known-key attacks, and off-line identity guessing attacks and has no perfect forward secrecy. To realize a secure and lightweight authentication protocol in WBAN systems, we propose a patient monitoring protocol. Here, our contributions are as follows:(i)
We reviewed Alzahrani et al.’s [30] protocol and analyzed its drawbacks, for example, known-key attacks, stolen-verifier attacks, and off-line identity guessing attacks(ii)
A patient monitoring protocol is proposed to realize the security and lightweight requirements of WBAN systems(iii)
Using the automated verification tool ProVerif and formal security proof in ROM, we demonstrate the proposed protocol is secure(iv)
Our protocol is relatively pragmatic and secure by performance comparisonThe remaining section is constructed as follows: the system model and preliminaries are given in Section2. In Section 3, we describe the review and drawbacks of Alzahrani et al.’s protocol. Section 4 proposes a patient monitoring scheme. Its security is analyzed in Sections 5 and 6. Its security properties, computation cost, storage cost, and communication cost between ours and some related protocols are evaluated in Section 7. Section 8 concludes the paper.


## 2. System Model and Preliminaries

In this section, we present the system model and attack model. Concurrently, we describe the physically unclonable function (PUF).


### 2.1. System Model

Figure1 illustrates its system model. It adopts the centralized two-hop architecture of WBAN, which includes the following devices: sensor nodes (SNs), relay nodes (RNs), and medical server node (MS). RN is the intermediate node, and only needs to forward messages between SN and MS, and it can add or delete its identity before forwarding messages. RN is always within the communication coverage of MS, and SN is covered by at least one RN. Resource-constrained SN monitors and collects patients’ medical health data by being worn or embedded into patients.Figure 1
System model.


### 2.2. Attack Model

Presuming the attacker (AR) maintains the following capacities:(1)
AR can capture messages transmitted via open channels and may eavesdrop, replace, replay, or intercept the data in these messages(2)
AR can obtain verifier table stored in MS, but cannot obtain its secret key(3)
AR can captureSNj and RN and then retrieve all data stored in their memory(4)
We adopt Dolev–Yao threat model [34] and assume that the public channel is insecure


### 2.3. Physically Unclonable Function

As a hardware security technology, a physically unclonable function (PUF) can be regarded as the “digital fingerprint” of the chip [35]. It uses the inherent physical differences to produce a specific unclonable response to a given challenge. Therefore, it is difficult to be predicted before production and cloned after production. It has broad application prospects in the field of security. According to the same challenge, the response of PUF can remain unchanged under different conditions. Any detection or observation of PUF will change the circuit characteristics, and the output of PUF will also change. Therefore, PUF is often used to protect crucial data in cryptography [36].All notations in our paper are illustrated in Table1.Table 1
Notations.
NotationsDescriptionSNjjth sensor nodeRNRelay nodeMSMedical server nodeSAServer administratorARThe adversaryidj, idRIdentity ofSNj/identity of RNKMS, QSecret key and public key ofMS, where Q=KMS∙PKSHSession keyr,PR1,PR2Random integersbjRandom number generated bySNjm,rnewRandom integers generated byMSaj,r,PR1,PR2Random integers generated bySAT, T1, T2, T3, T4TimestampsPThe base point of the elliptic curve⊕XOR operationPUF∙Physically unclonable functionh∙Hash functionΔTThe maximum transmission delay


## 2.1. System Model

Figure1 illustrates its system model. It adopts the centralized two-hop architecture of WBAN, which includes the following devices: sensor nodes (SNs), relay nodes (RNs), and medical server node (MS). RN is the intermediate node, and only needs to forward messages between SN and MS, and it can add or delete its identity before forwarding messages. RN is always within the communication coverage of MS, and SN is covered by at least one RN. Resource-constrained SN monitors and collects patients’ medical health data by being worn or embedded into patients.Figure 1
System model.


## 2.2. Attack Model

Presuming the attacker (AR) maintains the following capacities:(1)
AR can capture messages transmitted via open channels and may eavesdrop, replace, replay, or intercept the data in these messages(2)
AR can obtain verifier table stored in MS, but cannot obtain its secret key(3)
AR can captureSNj and RN and then retrieve all data stored in their memory(4)
We adopt Dolev–Yao threat model [34] and assume that the public channel is insecure


## 2.3. Physically Unclonable Function

As a hardware security technology, a physically unclonable function (PUF) can be regarded as the “digital fingerprint” of the chip [35]. It uses the inherent physical differences to produce a specific unclonable response to a given challenge. Therefore, it is difficult to be predicted before production and cloned after production. It has broad application prospects in the field of security. According to the same challenge, the response of PUF can remain unchanged under different conditions. Any detection or observation of PUF will change the circuit characteristics, and the output of PUF will also change. Therefore, PUF is often used to protect crucial data in cryptography [36].All notations in our paper are illustrated in Table1.Table 1
Notations.
NotationsDescriptionSNjjth sensor nodeRNRelay nodeMSMedical server nodeSAServer administratorARThe adversaryidj, idRIdentity ofSNj/identity of RNKMS, QSecret key and public key ofMS, where Q=KMS∙PKSHSession keyr,PR1,PR2Random integersbjRandom number generated bySNjm,rnewRandom integers generated byMSaj,r,PR1,PR2Random integers generated bySAT, T1, T2, T3, T4TimestampsPThe base point of the elliptic curve⊕XOR operationPUF∙Physically unclonable functionh∙Hash functionΔTThe maximum transmission delay


## 3. Drawbacks of Alzahrani et al.’s Scheme

### 3.1. Review of Alzahrani et al.’s Scheme

We briefly review Alzahrani et al.’s [30] anonymous authentication protocol, which involves three steps: (1) system initialization; (2) device registration; (3) mutual authentication and key agreement. SA performs step (1) and step (2) through a private channel as follows.


#### 3.1.1. System Initialization

(i)
SA generates a long-term master secret keyKMS for MS(ii)
Subsequently, MS reserves the master secret keyKMS


#### 3.1.2. Devices Registration

(i)
SA selects three random integersr, PR1, PR2, and an identity idj for the sensor node SNj and reserves tuple <idj, PR1, PR2> in the memory of MS(ii)
SA computesxNj=r⊕KMS, yNj =  idj⊕h(KMS, r)(iii)
SA reserves tuple <idj, xNj, yNj, PR1, PR2> in the memory of SNj(iv)
Finally, the verification table of MS is <idj, PR1, PR2, idR>


#### 3.1.3. Mutual Authentication and Key Agreement

The communications betweenSNj and MS are as follows:(i)
SNj creates a current timestamp T1 and computes the validation Vidj=hidj,xNj,yNj,PR2,T1, where idj is SNj’s identity, xNj=r⊕KMS,yNj=idj⊕hKMS,r,PR2 denotes a random integer, and the current timestamp is denoted as T1.(ii)
SNj submits Message1 tuple <xNj, yNj, Vidj, T1> to RN.(iii)
RN appends its identityidR and forwards the Message2 tuple <xNj, yNj, Vidj, T1, idR> to MS.(iv)
MS scans the identityidR and finishes the session if no record is found in its memory. Otherwise, MS creates the current timestamp T2 and checks if T2−T1≤ΔT, and if not, finishes the session. Otherwise, MS computes r∗=xNj⊕KMS,idj∗=yNj⊕hKMS,r∗. MS checks the validity of the identity idj∗, if so, MS extracts the tuple <idj∗, PR1, PR2> from its memory, computes Vidj∗=hidj∗,xNj,yNj,PR2,T1, and checks Vidj∗? = Vidj. If so, MS generates random nonce m and rnew and computes s=idj∗⊕yNj, j=idj∗⊕xNj, v=m⊕s, xNjnew=rnew⊕KMS, yNjnew=idj∗⊕hKMS,rnew, g=hm,s,j,PR2, u=xNjnew⊕g, n=yNjnew⊕g, Δ=hm,idj∗,s,xNjnew,yNjnew, and the session key KSH=hm,j,PR1,PR2. Afterwards, MS sends the Message3 tuple <v, u, Δ, n, idR> to RN. MS displaces PR1 with PR2 and PR2 with KSH.(v)
RN removes its identityidR and forwards the Message 4 tuple <v, u, Δ, n> to SNj.(vi)
SNj computes s∗=idj⊕yNj, m∗=v⊕s∗, j∗=idj⊕xNj, g∗=hm∗,s∗,j∗PR2, xNjnew+=u⊕g∗, yNjnew+=n⊕g∗, Δ∗=hm∗,idj,s∗,xNjnew+,yNjnew+. Afterwards, SNj checks Δ∗?=Δ. If so, SNj computes the session key KSH=hm∗,j∗,PR1,PR2. SNj displaces xNj and yNj, with xNjnew+ and yNjnew+, and stores them in its memory. Finally, SNj displaces PR1 with PR2 and PR2 with KSH.


### 3.2. Drawbacks

#### 3.2.1. Off-Line Identity Guessing Attack

Supposing an adversary (AR) can eavesdrop on the conversation betweenSNj and MS. AR intercepts the first round of xNj−1, yNj−1, and the second round of xNj−2, yNj−2, where xNj−2 and yNj−2 are the first round of xNj−1new+ and yNj−1new+. AR computes Δ∗=hm∗,idj,s∗,xNj−1new+,yNj−1new+, where m∗=v⊕s∗, s∗=idj⊕yNj. Only idj in Δ∗ is unknown, and AR guesses idj to verify if Δ∗? = Δ. If so, AR obtains idj successfully. Otherwise, guesses idj again.


#### 3.2.2. Desynchronization Attack

If AR intercepts Message4 and drops it, theSNj will miss it. The insecurity is that MS has updated xNj, yNj, PR1, PR2, but SNj has not. This will make every subsequent authentication process between SNj and MS fail.


#### 3.2.3. Stolen-Verifier Attack

If the verifier table <idj, PR1, PR2, idR> of MS is stolen, AR can obtain all the data in it. AR eavesdrops on the communication between SNj and MS, intercepts Message1 tuple <xNj, yNj, Vidj, T1>, Message 4 tuple <v, u, Δ, n>, computes s∗=idj⊕yNj, m∗=v⊕s∗, and j∗=idj⊕xNj, and computes the session key KSH=hm∗,j∗,PR1,PR2. That is, AR can obtain the session key.


#### 3.2.4. Known-Key Attack

If the session keys of two consecutive rounds are leaked, AR will getPR1−3 and PR2−3 of the third round. According to identity guessing attacks, AR obtains the SN’s identity idj. In the third round of protocol execution, AR intercepts message 1 and message 4 and computes s∗=idj⊕yNj−3, m∗=v⊕s∗, g∗=hm∗,s∗,j∗PR2−3, xNj−3new+=u⊕g∗, yNj−3new+=n⊕g∗,KSH=hm∗,j∗,PR1−3,PR2−3. Therefore, the session key of the subsequent round will be obtained by the AR.


#### 3.2.5. No Perfect Forward Security

If the long-term secret keyKMS and short-term secret key PR1 and PR2 of the Alzahrani et al.’s [30] scheme are leaked, AR calculates r∗=xNj⊕KMS, idj=yNj⊕hKMS,r∗. Then, AR calculates s∗=idj⊕yNj, m∗=v⊕s∗, g∗=hm∗,s∗,j∗,PR2. Finally, AR can compute the session key KSH=hm∗,j∗,PR1,PR2. Therefore, it doesn’t achieve perfect forward secrecy.


## 3.1. Review of Alzahrani et al.’s Scheme

We briefly review Alzahrani et al.’s [30] anonymous authentication protocol, which involves three steps: (1) system initialization; (2) device registration; (3) mutual authentication and key agreement. SA performs step (1) and step (2) through a private channel as follows.


### 3.1.1. System Initialization

(i)
SA generates a long-term master secret keyKMS for MS(ii)
Subsequently, MS reserves the master secret keyKMS


### 3.1.2. Devices Registration

(i)
SA selects three random integersr, PR1, PR2, and an identity idj for the sensor node SNj and reserves tuple <idj, PR1, PR2> in the memory of MS(ii)
SA computesxNj=r⊕KMS, yNj =  idj⊕h(KMS, r)(iii)
SA reserves tuple <idj, xNj, yNj, PR1, PR2> in the memory of SNj(iv)
Finally, the verification table of MS is <idj, PR1, PR2, idR>


### 3.1.3. Mutual Authentication and Key Agreement

The communications betweenSNj and MS are as follows:(i)
SNj creates a current timestamp T1 and computes the validation Vidj=hidj,xNj,yNj,PR2,T1, where idj is SNj’s identity, xNj=r⊕KMS,yNj=idj⊕hKMS,r,PR2 denotes a random integer, and the current timestamp is denoted as T1.(ii)
SNj submits Message1 tuple <xNj, yNj, Vidj, T1> to RN.(iii)
RN appends its identityidR and forwards the Message2 tuple <xNj, yNj, Vidj, T1, idR> to MS.(iv)
MS scans the identityidR and finishes the session if no record is found in its memory. Otherwise, MS creates the current timestamp T2 and checks if T2−T1≤ΔT, and if not, finishes the session. Otherwise, MS computes r∗=xNj⊕KMS,idj∗=yNj⊕hKMS,r∗. MS checks the validity of the identity idj∗, if so, MS extracts the tuple <idj∗, PR1, PR2> from its memory, computes Vidj∗=hidj∗,xNj,yNj,PR2,T1, and checks Vidj∗? = Vidj. If so, MS generates random nonce m and rnew and computes s=idj∗⊕yNj, j=idj∗⊕xNj, v=m⊕s, xNjnew=rnew⊕KMS, yNjnew=idj∗⊕hKMS,rnew, g=hm,s,j,PR2, u=xNjnew⊕g, n=yNjnew⊕g, Δ=hm,idj∗,s,xNjnew,yNjnew, and the session key KSH=hm,j,PR1,PR2. Afterwards, MS sends the Message3 tuple <v, u, Δ, n, idR> to RN. MS displaces PR1 with PR2 and PR2 with KSH.(v)
RN removes its identityidR and forwards the Message 4 tuple <v, u, Δ, n> to SNj.(vi)
SNj computes s∗=idj⊕yNj, m∗=v⊕s∗, j∗=idj⊕xNj, g∗=hm∗,s∗,j∗PR2, xNjnew+=u⊕g∗, yNjnew+=n⊕g∗, Δ∗=hm∗,idj,s∗,xNjnew+,yNjnew+. Afterwards, SNj checks Δ∗?=Δ. If so, SNj computes the session key KSH=hm∗,j∗,PR1,PR2. SNj displaces xNj and yNj, with xNjnew+ and yNjnew+, and stores them in its memory. Finally, SNj displaces PR1 with PR2 and PR2 with KSH.


## 3.1.1. System Initialization

(i)
SA generates a long-term master secret keyKMS for MS(ii)
Subsequently, MS reserves the master secret keyKMS


## 3.1.2. Devices Registration

(i)
SA selects three random integersr, PR1, PR2, and an identity idj for the sensor node SNj and reserves tuple <idj, PR1, PR2> in the memory of MS(ii)
SA computesxNj=r⊕KMS, yNj =  idj⊕h(KMS, r)(iii)
SA reserves tuple <idj, xNj, yNj, PR1, PR2> in the memory of SNj(iv)
Finally, the verification table of MS is <idj, PR1, PR2, idR>


## 3.1.3. Mutual Authentication and Key Agreement

The communications betweenSNj and MS are as follows:(i)
SNj creates a current timestamp T1 and computes the validation Vidj=hidj,xNj,yNj,PR2,T1, where idj is SNj’s identity, xNj=r⊕KMS,yNj=idj⊕hKMS,r,PR2 denotes a random integer, and the current timestamp is denoted as T1.(ii)
SNj submits Message1 tuple <xNj, yNj, Vidj, T1> to RN.(iii)
RN appends its identityidR and forwards the Message2 tuple <xNj, yNj, Vidj, T1, idR> to MS.(iv)
MS scans the identityidR and finishes the session if no record is found in its memory. Otherwise, MS creates the current timestamp T2 and checks if T2−T1≤ΔT, and if not, finishes the session. Otherwise, MS computes r∗=xNj⊕KMS,idj∗=yNj⊕hKMS,r∗. MS checks the validity of the identity idj∗, if so, MS extracts the tuple <idj∗, PR1, PR2> from its memory, computes Vidj∗=hidj∗,xNj,yNj,PR2,T1, and checks Vidj∗? = Vidj. If so, MS generates random nonce m and rnew and computes s=idj∗⊕yNj, j=idj∗⊕xNj, v=m⊕s, xNjnew=rnew⊕KMS, yNjnew=idj∗⊕hKMS,rnew, g=hm,s,j,PR2, u=xNjnew⊕g, n=yNjnew⊕g, Δ=hm,idj∗,s,xNjnew,yNjnew, and the session key KSH=hm,j,PR1,PR2. Afterwards, MS sends the Message3 tuple <v, u, Δ, n, idR> to RN. MS displaces PR1 with PR2 and PR2 with KSH.(v)
RN removes its identityidR and forwards the Message 4 tuple <v, u, Δ, n> to SNj.(vi)
SNj computes s∗=idj⊕yNj, m∗=v⊕s∗, j∗=idj⊕xNj, g∗=hm∗,s∗,j∗PR2, xNjnew+=u⊕g∗, yNjnew+=n⊕g∗, Δ∗=hm∗,idj,s∗,xNjnew+,yNjnew+. Afterwards, SNj checks Δ∗?=Δ. If so, SNj computes the session key KSH=hm∗,j∗,PR1,PR2. SNj displaces xNj and yNj, with xNjnew+ and yNjnew+, and stores them in its memory. Finally, SNj displaces PR1 with PR2 and PR2 with KSH.


## 3.2. Drawbacks

### 3.2.1. Off-Line Identity Guessing Attack

Supposing an adversary (AR) can eavesdrop on the conversation betweenSNj and MS. AR intercepts the first round of xNj−1, yNj−1, and the second round of xNj−2, yNj−2, where xNj−2 and yNj−2 are the first round of xNj−1new+ and yNj−1new+. AR computes Δ∗=hm∗,idj,s∗,xNj−1new+,yNj−1new+, where m∗=v⊕s∗, s∗=idj⊕yNj. Only idj in Δ∗ is unknown, and AR guesses idj to verify if Δ∗? = Δ. If so, AR obtains idj successfully. Otherwise, guesses idj again.


### 3.2.2. Desynchronization Attack

If AR intercepts Message4 and drops it, theSNj will miss it. The insecurity is that MS has updated xNj, yNj, PR1, PR2, but SNj has not. This will make every subsequent authentication process between SNj and MS fail.


### 3.2.3. Stolen-Verifier Attack

If the verifier table <idj, PR1, PR2, idR> of MS is stolen, AR can obtain all the data in it. AR eavesdrops on the communication between SNj and MS, intercepts Message1 tuple <xNj, yNj, Vidj, T1>, Message 4 tuple <v, u, Δ, n>, computes s∗=idj⊕yNj, m∗=v⊕s∗, and j∗=idj⊕xNj, and computes the session key KSH=hm∗,j∗,PR1,PR2. That is, AR can obtain the session key.


### 3.2.4. Known-Key Attack

If the session keys of two consecutive rounds are leaked, AR will getPR1−3 and PR2−3 of the third round. According to identity guessing attacks, AR obtains the SN’s identity idj. In the third round of protocol execution, AR intercepts message 1 and message 4 and computes s∗=idj⊕yNj−3, m∗=v⊕s∗, g∗=hm∗,s∗,j∗PR2−3, xNj−3new+=u⊕g∗, yNj−3new+=n⊕g∗,KSH=hm∗,j∗,PR1−3,PR2−3. Therefore, the session key of the subsequent round will be obtained by the AR.


### 3.2.5. No Perfect Forward Security

If the long-term secret keyKMS and short-term secret key PR1 and PR2 of the Alzahrani et al.’s [30] scheme are leaked, AR calculates r∗=xNj⊕KMS, idj=yNj⊕hKMS,r∗. Then, AR calculates s∗=idj⊕yNj, m∗=v⊕s∗, g∗=hm∗,s∗,j∗,PR2. Finally, AR can compute the session key KSH=hm∗,j∗,PR1,PR2. Therefore, it doesn’t achieve perfect forward secrecy.


## 3.2.1. Off-Line Identity Guessing Attack

Supposing an adversary (AR) can eavesdrop on the conversation betweenSNj and MS. AR intercepts the first round of xNj−1, yNj−1, and the second round of xNj−2, yNj−2, where xNj−2 and yNj−2 are the first round of xNj−1new+ and yNj−1new+. AR computes Δ∗=hm∗,idj,s∗,xNj−1new+,yNj−1new+, where m∗=v⊕s∗, s∗=idj⊕yNj. Only idj in Δ∗ is unknown, and AR guesses idj to verify if Δ∗? = Δ. If so, AR obtains idj successfully. Otherwise, guesses idj again.


## 3.2.2. Desynchronization Attack

If AR intercepts Message4 and drops it, theSNj will miss it. The insecurity is that MS has updated xNj, yNj, PR1, PR2, but SNj has not. This will make every subsequent authentication process between SNj and MS fail.


## 3.2.3. Stolen-Verifier Attack

If the verifier table <idj, PR1, PR2, idR> of MS is stolen, AR can obtain all the data in it. AR eavesdrops on the communication between SNj and MS, intercepts Message1 tuple <xNj, yNj, Vidj, T1>, Message 4 tuple <v, u, Δ, n>, computes s∗=idj⊕yNj, m∗=v⊕s∗, and j∗=idj⊕xNj, and computes the session key KSH=hm∗,j∗,PR1,PR2. That is, AR can obtain the session key.


## 3.2.4. Known-Key Attack

If the session keys of two consecutive rounds are leaked, AR will getPR1−3 and PR2−3 of the third round. According to identity guessing attacks, AR obtains the SN’s identity idj. In the third round of protocol execution, AR intercepts message 1 and message 4 and computes s∗=idj⊕yNj−3, m∗=v⊕s∗, g∗=hm∗,s∗,j∗PR2−3, xNj−3new+=u⊕g∗, yNj−3new+=n⊕g∗,KSH=hm∗,j∗,PR1−3,PR2−3. Therefore, the session key of the subsequent round will be obtained by the AR.


## 3.2.5. No Perfect Forward Security

If the long-term secret keyKMS and short-term secret key PR1 and PR2 of the Alzahrani et al.’s [30] scheme are leaked, AR calculates r∗=xNj⊕KMS, idj=yNj⊕hKMS,r∗. Then, AR calculates s∗=idj⊕yNj, m∗=v⊕s∗, g∗=hm∗,s∗,j∗,PR2. Finally, AR can compute the session key KSH=hm∗,j∗,PR1,PR2. Therefore, it doesn’t achieve perfect forward secrecy.


## 4. Proposed Protocol

A security-enhanced protocol is presented, which involves three steps: (1) system initialization; (2) device registration; (3) mutual authentication and key agreement. SA executes initialization and registration steps through a private channel as follows.


### 4.1. Initialization

SA executes as follows:(1)
The master secret keyKMS is generated by SA(2)
Subsequently, MS accepts the master secret keyKMS via a secure channel and keeps it secretly(3)
SA chooses an elliptic curveEcα,β of large order. P is a base point. SA computes Q=KMS∙P. Afterwards, SA chooses a hash function h∙.


### 4.2. Registration

The registration phase can be described as follows:(1)
SA chooses the random integeraj and the identity idj for the sensor node SNj, an identity idR for RN, and reserves idj and idR in the memory of MS(2)
SA computesxNj=aj⊕hKMS,Tj, yNj=idj⊕hKMS,aj,Tj, MHj=hidj,KMS, where Tj is the current timestamp, and KMS is MS’s secret key(3)
SA reserves the tuple <idj, xNj, yNj, MHj, Tj> in the memory of SNj, and SNj generates a challenge Chaj and computes Resj=PUFChaj, STj=hResj⊕MHj, where PUF is deployed in the sensor node SNj(4)
Finally,SNj stores idj,xNj,yNj,STj,Chaj,Tj, and the verification table of MS is idR,idj


### 4.3. Mutual Authentication and Key Agreement

This phase is shown in Figure2.(1)
SNj chooses the random integer bj and the timestamp T1 and calculates MHj=hPUFChaj⊕STj, A1=bj∙P, A2=bj∙Q, Vidj=hidj,xNj,yNj,A1,A2,hA2,MHj,Tj,T1.(2)
SNj submits the Message1 tuple <xNj, yNj, Vidj, A1, Tj, T1> to RN.(3)
RN appends its identityidR and forwards the Message 2 tuple <xNj, yNj, Vidj, A1, Tj, T1, idR> to MS.(4)
MS scans the identityidR and finishes the session if no record is found in its memory. Otherwise, MS creates the current timestamp T2 and checks if T2−T1≤ΔT, and if not, finishes the session. Otherwise, MS computes aj=xNj⊕hKMS,Tj, idj∗=xNj⊕hKMS,aj,Tj. MS calculates A2∗=KMS∙A1, Vidj∗=hidj∗,xNj,yNj,A1,A2∗,hA2∗,hidj∗,KMS,Tj,T1 and checks Vidj∗? = Vidj. If so, MS creates random numbers ai and bi. Next, MS computes A3=bi∙P, A4=bi∙A1, xNjnew=ai⊕hKMS,T2, yNjnew=idj∗⊕hKMS,ai,T2, μ=xNjnew⊕hA2∗,hidj∗,KMS,T2, λ=yNjnew⊕hT2,A2∗,hidj∗,KMS, the session key KSH=hA1,A2∗,A3,A4,idj∗,T2, and Δ=hxNjnew,yNjnew,KSH,T2. Afterwards, MS sends the Message3 tuple <μ, λ, Δ, A3, T2, idR> to RN.(5)
RN removes its identityidR and forwards the Message4 tuple <μ, λ, Δ, A3, T2> to SNj.(6)
SNj creates the current timestamp T3 and checks if T3−T2≤ΔT, and if not, finishes the session. Otherwise, SNj computes A4∗=bj∙A3, xNjnew∗=μ⊕hA2,MHj,T2, yNjnew∗=λ⊕hT2,A2,MHj, KSH=hA1,A2,A3,A4∗,idj,T2, Δ∗=hxNjnew∗,yNjnew∗,KSH,T2. SNj checks if Δ∗? = Δ. If so, SNj successfully establishes the session key KSH with MS and updates <xNj, yNj, Tj> with <xNjnew∗,yNjnew∗,T2>.Figure 2
Mutual authentication and key agreement phase.


## 4.1. Initialization

SA executes as follows:(1)
The master secret keyKMS is generated by SA(2)
Subsequently, MS accepts the master secret keyKMS via a secure channel and keeps it secretly(3)
SA chooses an elliptic curveEcα,β of large order. P is a base point. SA computes Q=KMS∙P. Afterwards, SA chooses a hash function h∙.


## 4.2. Registration

The registration phase can be described as follows:(1)
SA chooses the random integeraj and the identity idj for the sensor node SNj, an identity idR for RN, and reserves idj and idR in the memory of MS(2)
SA computesxNj=aj⊕hKMS,Tj, yNj=idj⊕hKMS,aj,Tj, MHj=hidj,KMS, where Tj is the current timestamp, and KMS is MS’s secret key(3)
SA reserves the tuple <idj, xNj, yNj, MHj, Tj> in the memory of SNj, and SNj generates a challenge Chaj and computes Resj=PUFChaj, STj=hResj⊕MHj, where PUF is deployed in the sensor node SNj(4)
Finally,SNj stores idj,xNj,yNj,STj,Chaj,Tj, and the verification table of MS is idR,idj


## 4.3. Mutual Authentication and Key Agreement

This phase is shown in Figure2.(1)
SNj chooses the random integer bj and the timestamp T1 and calculates MHj=hPUFChaj⊕STj, A1=bj∙P, A2=bj∙Q, Vidj=hidj,xNj,yNj,A1,A2,hA2,MHj,Tj,T1.(2)
SNj submits the Message1 tuple <xNj, yNj, Vidj, A1, Tj, T1> to RN.(3)
RN appends its identityidR and forwards the Message 2 tuple <xNj, yNj, Vidj, A1, Tj, T1, idR> to MS.(4)
MS scans the identityidR and finishes the session if no record is found in its memory. Otherwise, MS creates the current timestamp T2 and checks if T2−T1≤ΔT, and if not, finishes the session. Otherwise, MS computes aj=xNj⊕hKMS,Tj, idj∗=xNj⊕hKMS,aj,Tj. MS calculates A2∗=KMS∙A1, Vidj∗=hidj∗,xNj,yNj,A1,A2∗,hA2∗,hidj∗,KMS,Tj,T1 and checks Vidj∗? = Vidj. If so, MS creates random numbers ai and bi. Next, MS computes A3=bi∙P, A4=bi∙A1, xNjnew=ai⊕hKMS,T2, yNjnew=idj∗⊕hKMS,ai,T2, μ=xNjnew⊕hA2∗,hidj∗,KMS,T2, λ=yNjnew⊕hT2,A2∗,hidj∗,KMS, the session key KSH=hA1,A2∗,A3,A4,idj∗,T2, and Δ=hxNjnew,yNjnew,KSH,T2. Afterwards, MS sends the Message3 tuple <μ, λ, Δ, A3, T2, idR> to RN.(5)
RN removes its identityidR and forwards the Message4 tuple <μ, λ, Δ, A3, T2> to SNj.(6)
SNj creates the current timestamp T3 and checks if T3−T2≤ΔT, and if not, finishes the session. Otherwise, SNj computes A4∗=bj∙A3, xNjnew∗=μ⊕hA2,MHj,T2, yNjnew∗=λ⊕hT2,A2,MHj, KSH=hA1,A2,A3,A4∗,idj,T2, Δ∗=hxNjnew∗,yNjnew∗,KSH,T2. SNj checks if Δ∗? = Δ. If so, SNj successfully establishes the session key KSH with MS and updates <xNj, yNj, Tj> with <xNjnew∗,yNjnew∗,T2>.Figure 2
Mutual authentication and key agreement phase.


## 5. Informal Security Analysis

### 5.1. Off-Line Identity Guessing Attack

If an adversary(AR) can eavesdrop on the open channel and guessidj of the sensor node SNj, it is not feasible for him/her to verify whether Vidj∗? = Vidj is correct or not without knowing A2, where A2 = bj∙KMS∙P, Vidj=hidj,xNj,yNj,A1,A2,hA2,MHj,Tj,T1, MHj=hidj,KMS. Because of computational Diffie–Hellman problem (CDHP), AR cannot compute A2=bj∙KMS∙P from A1=bj∙P and Q=KMS∙P. Therefore, off-line identity guessing attack is infeasible.


### 5.2. Desynchronization Attack

In the improved protocol,xNj and yNj are updated as xNjnew and yNjnew on the side of the MS. Even if AR intercepts the Message4, it has no impact on the next session between the sensor node SNj and the MS.


### 5.3. Stolen-Verifier Attack

Stolen-verifier attack means that an adversary can obtain verification table except the secret key from MS by trespassing on the device or side channel attack and then launch attacks. In the proposed scheme, the verification table of MS only contains the identitiesidj and idR of SNj and RN. So the adversary cannot launch any attacks even if he or she obtains these identities. Thus, the protocol defends against stolen-verifier attacks.


### 5.4. Known-Key Attack

Assuming that AR knows the session keyKSH=hA1,A2,A3,A4∗,idj,T2, because KSH only contained in Δ∗=hxNjnew∗,yNjnew∗,KSH,T2, so AR cannot launch any attack.


### 5.5. Smart Card Lost Attack

By the side-channel attack, AR is able to get all data reserved in the smart card when it is lost, and then launch attacks. However, in our protocol, smart card isn’t used, so the protocol defends against the smart card lost attack.


### 5.6. Sensor Node Captured Attack

In the improved protocol, the sensor nodeSNj stores idj,xNj,yNj,STj,Chaj,Tj, where idj is SN1’s identity, xNj=aj⊕hKMS,Tj, yNj⊕idj⊕hKMS,aj,Tj, STj=hPUFChaj⊕MHj, Chaj is the challenge of PUF, Tj is the timestamp, and KMS is the secret key of MS. Assuming that the sensor node SNj is captured by AR, he/she cannot obtain the secret parameter MHj to impersonate SNj because of PUF. In addition, AR cannot obtain the secret key KMS. Therefore, the sensor node captured attack cannot influence the security of nodes and the sensor network.


### 5.7. Anonymity and Unlinkability

The identityidj of the sensor node SNj is in Message 1=xNj,yNj,Vidj,A1,Tj,T1 and transmitted via an open channel, where Vidj=hidj,xNj,yNj,A1,A2,hA2,MHjTj,T1, MHj=hidj,KMS, yNj=idj⊕hKMS,aj,Tj. So an adversary cannot compute the identity idj of the sensor SNj because he can not know the secret key KMS of MS. Thus, our scheme achieves anonymity. Moreover, because each session will generate new bj and Tj, the identity idj of the sensor node SNj cannot be tracked by AR.


### 5.8. Perfect Forward Secrecy

If AR obtains all the secret information of the sensor nodeSNj and the long-term master secret key KMS of MS, because of CDHP, he/she still cannot successfully calculate KSH=hA1,A2,A3,A4∗,idj,T2 without knowing A4∗. Therefore, the protocol achieves perfect forward secrecy.


### 5.9. Impersonation Attack

This attack means that AR can impersonate a legal user to generate and send a message, and the message can be passed through the authentication by the receiver. That is to say, the receiver confirms that the message is initiated by a legitimate user. In our protocol, AR impersonates the sensor nodeSNj to generate and send xNj,yNj,Vidj,A1,Tj,T1 to RN, where xNj=aj⊕hKMS,Tj, yNj=idj⊕hKMS,aj,Tj, Vidj=hidj,xNj,yNj,A1,A2,hA2,MHjTj,T1, KMS is MS’s secret key, and T1 is the timestamp. The adversary cannot forge xNj and yNj without knowing KMS. On the other hand, the adversary cannot compute MHj even if he/she can obtain all data stored in MHj due to the property of PUF. Therefore, the adversary cannot generate the valid Vidj.


### 5.10. Replay Attack

If AR can obtain a message and replay it to the receiver, the message can be passed through the authentication of the receiver. In the proposed scheme, the timestamps and random nonce are used, so the protocol defends against the replay attack.


## 5.1. Off-Line Identity Guessing Attack

If an adversary(AR) can eavesdrop on the open channel and guessidj of the sensor node SNj, it is not feasible for him/her to verify whether Vidj∗? = Vidj is correct or not without knowing A2, where A2 = bj∙KMS∙P, Vidj=hidj,xNj,yNj,A1,A2,hA2,MHj,Tj,T1, MHj=hidj,KMS. Because of computational Diffie–Hellman problem (CDHP), AR cannot compute A2=bj∙KMS∙P from A1=bj∙P and Q=KMS∙P. Therefore, off-line identity guessing attack is infeasible.


## 5.2. Desynchronization Attack

In the improved protocol,xNj and yNj are updated as xNjnew and yNjnew on the side of the MS. Even if AR intercepts the Message4, it has no impact on the next session between the sensor node SNj and the MS.


## 5.3. Stolen-Verifier Attack

Stolen-verifier attack means that an adversary can obtain verification table except the secret key from MS by trespassing on the device or side channel attack and then launch attacks. In the proposed scheme, the verification table of MS only contains the identitiesidj and idR of SNj and RN. So the adversary cannot launch any attacks even if he or she obtains these identities. Thus, the protocol defends against stolen-verifier attacks.


## 5.4. Known-Key Attack

Assuming that AR knows the session keyKSH=hA1,A2,A3,A4∗,idj,T2, because KSH only contained in Δ∗=hxNjnew∗,yNjnew∗,KSH,T2, so AR cannot launch any attack.


## 5.5. Smart Card Lost Attack

By the side-channel attack, AR is able to get all data reserved in the smart card when it is lost, and then launch attacks. However, in our protocol, smart card isn’t used, so the protocol defends against the smart card lost attack.


## 5.6. Sensor Node Captured Attack

In the improved protocol, the sensor nodeSNj stores idj,xNj,yNj,STj,Chaj,Tj, where idj is SN1’s identity, xNj=aj⊕hKMS,Tj, yNj⊕idj⊕hKMS,aj,Tj, STj=hPUFChaj⊕MHj, Chaj is the challenge of PUF, Tj is the timestamp, and KMS is the secret key of MS. Assuming that the sensor node SNj is captured by AR, he/she cannot obtain the secret parameter MHj to impersonate SNj because of PUF. In addition, AR cannot obtain the secret key KMS. Therefore, the sensor node captured attack cannot influence the security of nodes and the sensor network.


## 5.7. Anonymity and Unlinkability

The identityidj of the sensor node SNj is in Message 1=xNj,yNj,Vidj,A1,Tj,T1 and transmitted via an open channel, where Vidj=hidj,xNj,yNj,A1,A2,hA2,MHjTj,T1, MHj=hidj,KMS, yNj=idj⊕hKMS,aj,Tj. So an adversary cannot compute the identity idj of the sensor SNj because he can not know the secret key KMS of MS. Thus, our scheme achieves anonymity. Moreover, because each session will generate new bj and Tj, the identity idj of the sensor node SNj cannot be tracked by AR.


## 5.8. Perfect Forward Secrecy

If AR obtains all the secret information of the sensor nodeSNj and the long-term master secret key KMS of MS, because of CDHP, he/she still cannot successfully calculate KSH=hA1,A2,A3,A4∗,idj,T2 without knowing A4∗. Therefore, the protocol achieves perfect forward secrecy.


## 5.9. Impersonation Attack

This attack means that AR can impersonate a legal user to generate and send a message, and the message can be passed through the authentication by the receiver. That is to say, the receiver confirms that the message is initiated by a legitimate user. In our protocol, AR impersonates the sensor nodeSNj to generate and send xNj,yNj,Vidj,A1,Tj,T1 to RN, where xNj=aj⊕hKMS,Tj, yNj=idj⊕hKMS,aj,Tj, Vidj=hidj,xNj,yNj,A1,A2,hA2,MHjTj,T1, KMS is MS’s secret key, and T1 is the timestamp. The adversary cannot forge xNj and yNj without knowing KMS. On the other hand, the adversary cannot compute MHj even if he/she can obtain all data stored in MHj due to the property of PUF. Therefore, the adversary cannot generate the valid Vidj.


## 5.10. Replay Attack

If AR can obtain a message and replay it to the receiver, the message can be passed through the authentication of the receiver. In the proposed scheme, the timestamps and random nonce are used, so the protocol defends against the replay attack.


## 6. Formal Security Analysis

### 6.1. Formal Verification Using ProVerif

As an automated verification cryptographic scheme tool, ProVerif [37] is founded on the Dolev–Yao model and Prolog language. It verifies many cryptographic primitives, for example, public-key cryptography, hash function, and equations. When using ProVerif tool for verifying insecure cryptographic protocols, the tool will give a corresponding attack sequence.The open channel, types, constants, variables, constructors, and destructors of our proposed protocol are represented in Figure3. We designed four events for the improved protocol, which are BeginSNj(), BeginMS(), EndSNj(), and EndMS() as depicted in Figure 4. BeginSNj() represents that the sensor node SNj begins the key agreement session with MS. BeginMS() represents that MS starts the key agreement session with SNj. SNj successfully established a session key with MS, which is indicated as EndSNj(). EndMS() represents MS successfully established a session key with the sensor node SNj.Figure 3
Definitions.Figure 4
Events.Queries are shown in Figure5. Figures 6 and 7 are exhibiting the processes of the sensor node SNj and MS. The main process is represented in Figure 8.Figure 5
Queries.Figure 6
The process of the sensor nodeSNj.Figure 7
The process of MS.Figure 8
Main process.For testifying the improved scheme’s correctness, we propose some queries and finally implement them through simulation, as shown in Figure9.Figure 9
Results.Results (1)–(4) proved that the secret parameters and session key are secure, and sensor nodes are anonymous in our protocol. Results (5)-(7) showed that the two processes began and terminated successfully in sequence.


### 6.2. Formal Security Proof

After identifying the random oracle model (ROM), we calculate the advantage of breaking our protocolP by the adversary A. The notions of ROM are clarified as follows.


#### 6.2.1. Participants & States

Three participantsP is in P, sensor node SN, relay node RN, and medical server node MS. In i-th instance, P, SN, RN, and MS are recorded as INSPi, INSSNi, INSRNi, and INSMSi, respectively. The oracles in ROM have only three states: Accept, Reject, and ⊥. Accept represents a correct message that is received by an oracle. If the message is illegal, the oracle in Reject. ⊥ means both the conditions above have not occurred.If the oracleINSSNiINSMSi is in Accept, and the session key KSNiKMSi has been agreed with INSMSiINSSNi, then INSSNiINSMSi gets the session identity SIDSNiSIDMSi, and its participant’s identity is PIDSNiPIDMSi.


#### 6.2.2. Partnering

IfINSSNi and INSMSi are in Accept, the session key is negotiated. Two partners meet below requirements:(1)
KSNi=KMSi(2)
SIDSNi=SIDMSi(3)
PIDSNi=INSMSi, PIDMSi=INSSNi


#### 6.2.3. Queries

Queries can emulate multiple attacks.ExecuteINSPiif the query is lunched by A, he/she gets all the transcripts.Send (INSPi, Message): which simulates that Message is sent to INSPi. If the message is correct, INSPi responses A, else, the message is ignored.RevealINSSNi,INSMSiif INSSNi and INSMSi are in the state Accept, the session key has been agreed, and the query Test has not been executed yet. Then, the session key will be revealed by this query. Else, return null.CorruptINSSNiwhich simulates the attack of intercepting SNj and returns the stored information idj,xNj,yNj,STj,Chaj,PUF,Tj in it.TestINSSNithis query produces a random bit r, which is performed no more than once. If r=1 and the session key has been agreed, the real session key is returned to A, else, the query returns a random session key.


#### 6.2.4. Freshness

If the ensuing requirements are met,INSPi can be defined as fresh.(1)
INSSNi and INSMSi are in the state Accept(2)
Reveal has not been executed(3)
Corrupt is executed at most once


#### 6.2.5. Semantic Security

The random bitr in Test query determines the output of Test. Meanwhile, A generates a random r′, if r′=r, A knows if the output is session key. The advantage of guessing the correct bit is AdvPA=2Prr=r′−1=2PrsucA−1. P is secure when AdvPA<η, where η is sufficiently small.CDHP: the CDHP is specified that givenP, aP, and bP, computing abP is computationally infeasible in probabilistic polynomial time (PPT). P is the generator point, a,b∈Zp. Subsequently, the advantage of solving CDHP is AdvACDHP=PrAP,aP,bP=abP:P∈EFp;a,b∈Zp, AdvACDHP<η.Theorem 1.
Suppose the adversaryA tends to break the proposed scheme P in PPT. The queries Execute, Send, and Hash are executed qE, qS, and qH times, respectively. Query Test is allowed to be executed at most once. lh is the bit-length of the hash operation’s the output. n=2lt, where lt is the average length of other transcripts. The advantage of breaking P by A in PPT can be expressed as follows:(1)AdvAP≤qS+qE2n+qH22lh+2AdvACDHP+2AdvAPUF.Proof.
To simulate the attacks onP, we define various games Gamei0<i<3. The event SuccessAi0<i<3 corresponding to Gamei means that A completes his/her goal in Gamei.Game0: which simulates the real attack, at the first, the probability of A cracking P is(2)AdvAP=2PrSuccessA0−1.Game1: which simulates that A launches Execute and Test queries to verify the output according to the transcripts Message1,Message2,Message3,Message4. Among the transcripts, A1,Δ,A3,T2 are related to the session key. However, A cannot figure out the relation between them the transcripts and the output of Test because of the random numbers. Therefore, we have(3)PrSuccessA1=PrSuccessA0.Game2: In this game, we simulate A computes the session key KSH through the messages transmitted openly. KSH=hA1,A2∗,A3,A4,idj∗,T2, which is based on CDHP. The advantage of calculating KSH by A is AdvACDHP. Therefore, we have(4)PrSuccessA2−PrSuccessA1=AdvACDHP.Game3: This game simulates A performs CorruptINSSNi to acquire the reserved information idj,xNj,yNj,STj,Chaj,Tj in SNj and try to calculate Δ∗=hxNjnew∗,yNjnew∗,KSH,T2 to testify the KSH’s correctness, where xNjnew∗=μ⊕hA2,MHj,T2, yNjnew∗=λ⊕hT2,A2,MHj, and MHj=hPUFChaj⊕STj. A has to break PUF to obtain MHj. The probability of breaking PUF is AdvAPUF. Therefore, we have(5)PrSuccessA3−PrSuccessA2≤AdvAPUF.Game4: which simulates Execute and Send queries are executed by A to launch the collision attacks. In line with the birthday paradox’s definition, the possibility of a hash collision is qH2/2lh+1. Meanwhile, the collision probability of other transcripts is qS+qE2/2n. Hence, we have(6)PrSuccessA4−PrSuccessA3≤qS+qE22n+qH22lh+1.
The random bitr∈0,1, the probability of guessing r is 1/2, which is equal to guessing the session key. That is,(7)PrSuccessA4=12.
Combining (1) with (6), we got(8)12AdvAP≤qS+qE22n+qH22lh+1+AdvACDHP+AdvAPUF.
(8) can be expressed as follows:(9)AdvAP≤qS+qE2n+qH22lh+2AdvACDHP+2AdvAPUF.


## 6.1. Formal Verification Using ProVerif

As an automated verification cryptographic scheme tool, ProVerif [37] is founded on the Dolev–Yao model and Prolog language. It verifies many cryptographic primitives, for example, public-key cryptography, hash function, and equations. When using ProVerif tool for verifying insecure cryptographic protocols, the tool will give a corresponding attack sequence.The open channel, types, constants, variables, constructors, and destructors of our proposed protocol are represented in Figure3. We designed four events for the improved protocol, which are BeginSNj(), BeginMS(), EndSNj(), and EndMS() as depicted in Figure 4. BeginSNj() represents that the sensor node SNj begins the key agreement session with MS. BeginMS() represents that MS starts the key agreement session with SNj. SNj successfully established a session key with MS, which is indicated as EndSNj(). EndMS() represents MS successfully established a session key with the sensor node SNj.Figure 3
Definitions.Figure 4
Events.Queries are shown in Figure5. Figures 6 and 7 are exhibiting the processes of the sensor node SNj and MS. The main process is represented in Figure 8.Figure 5
Queries.Figure 6
The process of the sensor nodeSNj.Figure 7
The process of MS.Figure 8
Main process.For testifying the improved scheme’s correctness, we propose some queries and finally implement them through simulation, as shown in Figure9.Figure 9
Results.Results (1)–(4) proved that the secret parameters and session key are secure, and sensor nodes are anonymous in our protocol. Results (5)-(7) showed that the two processes began and terminated successfully in sequence.


## 6.2. Formal Security Proof

After identifying the random oracle model (ROM), we calculate the advantage of breaking our protocolP by the adversary A. The notions of ROM are clarified as follows.


### 6.2.1. Participants & States

Three participantsP is in P, sensor node SN, relay node RN, and medical server node MS. In i-th instance, P, SN, RN, and MS are recorded as INSPi, INSSNi, INSRNi, and INSMSi, respectively. The oracles in ROM have only three states: Accept, Reject, and ⊥. Accept represents a correct message that is received by an oracle. If the message is illegal, the oracle in Reject. ⊥ means both the conditions above have not occurred.If the oracleINSSNiINSMSi is in Accept, and the session key KSNiKMSi has been agreed with INSMSiINSSNi, then INSSNiINSMSi gets the session identity SIDSNiSIDMSi, and its participant’s identity is PIDSNiPIDMSi.


### 6.2.2. Partnering

IfINSSNi and INSMSi are in Accept, the session key is negotiated. Two partners meet below requirements:(1)
KSNi=KMSi(2)
SIDSNi=SIDMSi(3)
PIDSNi=INSMSi, PIDMSi=INSSNi


### 6.2.3. Queries

Queries can emulate multiple attacks.ExecuteINSPiif the query is lunched by A, he/she gets all the transcripts.Send (INSPi, Message): which simulates that Message is sent to INSPi. If the message is correct, INSPi responses A, else, the message is ignored.RevealINSSNi,INSMSiif INSSNi and INSMSi are in the state Accept, the session key has been agreed, and the query Test has not been executed yet. Then, the session key will be revealed by this query. Else, return null.CorruptINSSNiwhich simulates the attack of intercepting SNj and returns the stored information idj,xNj,yNj,STj,Chaj,PUF,Tj in it.TestINSSNithis query produces a random bit r, which is performed no more than once. If r=1 and the session key has been agreed, the real session key is returned to A, else, the query returns a random session key.


### 6.2.4. Freshness

If the ensuing requirements are met,INSPi can be defined as fresh.(1)
INSSNi and INSMSi are in the state Accept(2)
Reveal has not been executed(3)
Corrupt is executed at most once


### 6.2.5. Semantic Security

The random bitr in Test query determines the output of Test. Meanwhile, A generates a random r′, if r′=r, A knows if the output is session key. The advantage of guessing the correct bit is AdvPA=2Prr=r′−1=2PrsucA−1. P is secure when AdvPA<η, where η is sufficiently small.CDHP: the CDHP is specified that givenP, aP, and bP, computing abP is computationally infeasible in probabilistic polynomial time (PPT). P is the generator point, a,b∈Zp. Subsequently, the advantage of solving CDHP is AdvACDHP=PrAP,aP,bP=abP:P∈EFp;a,b∈Zp, AdvACDHP<η.Theorem 1.
Suppose the adversaryA tends to break the proposed scheme P in PPT. The queries Execute, Send, and Hash are executed qE, qS, and qH times, respectively. Query Test is allowed to be executed at most once. lh is the bit-length of the hash operation’s the output. n=2lt, where lt is the average length of other transcripts. The advantage of breaking P by A in PPT can be expressed as follows:(1)AdvAP≤qS+qE2n+qH22lh+2AdvACDHP+2AdvAPUF.Proof.
To simulate the attacks onP, we define various games Gamei0<i<3. The event SuccessAi0<i<3 corresponding to Gamei means that A completes his/her goal in Gamei.Game0: which simulates the real attack, at the first, the probability of A cracking P is(2)AdvAP=2PrSuccessA0−1.Game1: which simulates that A launches Execute and Test queries to verify the output according to the transcripts Message1,Message2,Message3,Message4. Among the transcripts, A1,Δ,A3,T2 are related to the session key. However, A cannot figure out the relation between them the transcripts and the output of Test because of the random numbers. Therefore, we have(3)PrSuccessA1=PrSuccessA0.Game2: In this game, we simulate A computes the session key KSH through the messages transmitted openly. KSH=hA1,A2∗,A3,A4,idj∗,T2, which is based on CDHP. The advantage of calculating KSH by A is AdvACDHP. Therefore, we have(4)PrSuccessA2−PrSuccessA1=AdvACDHP.Game3: This game simulates A performs CorruptINSSNi to acquire the reserved information idj,xNj,yNj,STj,Chaj,Tj in SNj and try to calculate Δ∗=hxNjnew∗,yNjnew∗,KSH,T2 to testify the KSH’s correctness, where xNjnew∗=μ⊕hA2,MHj,T2, yNjnew∗=λ⊕hT2,A2,MHj, and MHj=hPUFChaj⊕STj. A has to break PUF to obtain MHj. The probability of breaking PUF is AdvAPUF. Therefore, we have(5)PrSuccessA3−PrSuccessA2≤AdvAPUF.Game4: which simulates Execute and Send queries are executed by A to launch the collision attacks. In line with the birthday paradox’s definition, the possibility of a hash collision is qH2/2lh+1. Meanwhile, the collision probability of other transcripts is qS+qE2/2n. Hence, we have(6)PrSuccessA4−PrSuccessA3≤qS+qE22n+qH22lh+1.
The random bitr∈0,1, the probability of guessing r is 1/2, which is equal to guessing the session key. That is,(7)PrSuccessA4=12.
Combining (1) with (6), we got(8)12AdvAP≤qS+qE22n+qH22lh+1+AdvACDHP+AdvAPUF.
(8) can be expressed as follows:(9)AdvAP≤qS+qE2n+qH22lh+2AdvACDHP+2AdvAPUF.


## 6.2.1. Participants & States

Three participantsP is in P, sensor node SN, relay node RN, and medical server node MS. In i-th instance, P, SN, RN, and MS are recorded as INSPi, INSSNi, INSRNi, and INSMSi, respectively. The oracles in ROM have only three states: Accept, Reject, and ⊥. Accept represents a correct message that is received by an oracle. If the message is illegal, the oracle in Reject. ⊥ means both the conditions above have not occurred.If the oracleINSSNiINSMSi is in Accept, and the session key KSNiKMSi has been agreed with INSMSiINSSNi, then INSSNiINSMSi gets the session identity SIDSNiSIDMSi, and its participant’s identity is PIDSNiPIDMSi.


## 6.2.2. Partnering

IfINSSNi and INSMSi are in Accept, the session key is negotiated. Two partners meet below requirements:(1)
KSNi=KMSi(2)
SIDSNi=SIDMSi(3)
PIDSNi=INSMSi, PIDMSi=INSSNi


## 6.2.3. Queries

Queries can emulate multiple attacks.ExecuteINSPiif the query is lunched by A, he/she gets all the transcripts.Send (INSPi, Message): which simulates that Message is sent to INSPi. If the message is correct, INSPi responses A, else, the message is ignored.RevealINSSNi,INSMSiif INSSNi and INSMSi are in the state Accept, the session key has been agreed, and the query Test has not been executed yet. Then, the session key will be revealed by this query. Else, return null.CorruptINSSNiwhich simulates the attack of intercepting SNj and returns the stored information idj,xNj,yNj,STj,Chaj,PUF,Tj in it.TestINSSNithis query produces a random bit r, which is performed no more than once. If r=1 and the session key has been agreed, the real session key is returned to A, else, the query returns a random session key.


## 6.2.4. Freshness

If the ensuing requirements are met,INSPi can be defined as fresh.(1)
INSSNi and INSMSi are in the state Accept(2)
Reveal has not been executed(3)
Corrupt is executed at most once


## 6.2.5. Semantic Security

The random bitr in Test query determines the output of Test. Meanwhile, A generates a random r′, if r′=r, A knows if the output is session key. The advantage of guessing the correct bit is AdvPA=2Prr=r′−1=2PrsucA−1. P is secure when AdvPA<η, where η is sufficiently small.CDHP: the CDHP is specified that givenP, aP, and bP, computing abP is computationally infeasible in probabilistic polynomial time (PPT). P is the generator point, a,b∈Zp. Subsequently, the advantage of solving CDHP is AdvACDHP=PrAP,aP,bP=abP:P∈EFp;a,b∈Zp, AdvACDHP<η.Theorem 1.
Suppose the adversaryA tends to break the proposed scheme P in PPT. The queries Execute, Send, and Hash are executed qE, qS, and qH times, respectively. Query Test is allowed to be executed at most once. lh is the bit-length of the hash operation’s the output. n=2lt, where lt is the average length of other transcripts. The advantage of breaking P by A in PPT can be expressed as follows:(1)AdvAP≤qS+qE2n+qH22lh+2AdvACDHP+2AdvAPUF.Proof.
To simulate the attacks onP, we define various games Gamei0<i<3. The event SuccessAi0<i<3 corresponding to Gamei means that A completes his/her goal in Gamei.Game0: which simulates the real attack, at the first, the probability of A cracking P is(2)AdvAP=2PrSuccessA0−1.Game1: which simulates that A launches Execute and Test queries to verify the output according to the transcripts Message1,Message2,Message3,Message4. Among the transcripts, A1,Δ,A3,T2 are related to the session key. However, A cannot figure out the relation between them the transcripts and the output of Test because of the random numbers. Therefore, we have(3)PrSuccessA1=PrSuccessA0.Game2: In this game, we simulate A computes the session key KSH through the messages transmitted openly. KSH=hA1,A2∗,A3,A4,idj∗,T2, which is based on CDHP. The advantage of calculating KSH by A is AdvACDHP. Therefore, we have(4)PrSuccessA2−PrSuccessA1=AdvACDHP.Game3: This game simulates A performs CorruptINSSNi to acquire the reserved information idj,xNj,yNj,STj,Chaj,Tj in SNj and try to calculate Δ∗=hxNjnew∗,yNjnew∗,KSH,T2 to testify the KSH’s correctness, where xNjnew∗=μ⊕hA2,MHj,T2, yNjnew∗=λ⊕hT2,A2,MHj, and MHj=hPUFChaj⊕STj. A has to break PUF to obtain MHj. The probability of breaking PUF is AdvAPUF. Therefore, we have(5)PrSuccessA3−PrSuccessA2≤AdvAPUF.Game4: which simulates Execute and Send queries are executed by A to launch the collision attacks. In line with the birthday paradox’s definition, the possibility of a hash collision is qH2/2lh+1. Meanwhile, the collision probability of other transcripts is qS+qE2/2n. Hence, we have(6)PrSuccessA4−PrSuccessA3≤qS+qE22n+qH22lh+1.
The random bitr∈0,1, the probability of guessing r is 1/2, which is equal to guessing the session key. That is,(7)PrSuccessA4=12.
Combining (1) with (6), we got(8)12AdvAP≤qS+qE22n+qH22lh+1+AdvACDHP+AdvAPUF.
(8) can be expressed as follows:(9)AdvAP≤qS+qE2n+qH22lh+2AdvACDHP+2AdvAPUF.


## 7. Performance Analysis

We study and compare security and performance efficiency between ours with others. According to the comparison of the security attributes which are given in Table2, we earn better security. In Windows 10 professional 64-bit, Intel(R) Core(TM) i5-4590, we earn THS=0.068ms (millisecond), TEA=2.501ms, TSE=0.56ms [36], where THS is hash operation, TEA represents ECC operation, and TSE is symmetric key encryption. As Table 3 revealed, we describe the computational cost comparison between other protocols and the proposed protocol. In [14], the server’s and sensor’s total computation cost is 5THS+3THS=8THS0.544ms. Accordingly, the schemes [29, 30] both need 6THS+4THS=10THS0.544ms, and scheme [25] needs 5THS+5TEA+3TSE14.525ms, and ours is 18THS+6TEA16.230ms. Because our protocol is safer than others and achieves perfect forward secrecy, so ours achieve both high computational efficiency and security.Table 2
Security properties comparison.
Attacks/Properties[14][25][29][30]OursAnonymityYesYesNoNoYesMutual authenticationYesYesYesYesYesForger and impersonation attackNoYesYesYesYesOff-line identity guessing attackYesYesNoNoYesSensor node capture attackYesYesYesYesYesSmart card loss attackYesYesYesYesYesDesynchronization attackYesNoYesNoYesStolen‐verifier attackYesYesYesNoYesMan-in-middle attackYesYesYesYesYesReplay attackYesYesNoYesYesKnow-key attackYesYesNoNoYesUntraceabilityYesYesYesYesYesPerfect forward secrecyNoNoNoNoYesTable 3
The computation cost comparison.
SchemesServerSNj (sensor)Total[14]5THS3THS8THS0.544ms[25]3THS+3TEA+2TSE2THS+2TEA+TSE5THS+5TEA+3TSE14.525ms[29]6THS4THS10THS0.680ms[30]6THS4THS10THS0.680msOurs5THS+3TEA13THS+3TEA18THS+6TEA16.230msAccording to [38], outputs of identity, timestamp, and password are 32 bits, and a random integer, hash function, or block encryption is 256 bits, and a point in the elliptic curve is 160 bits. We calculate the storage overhead of the devices participating in authentication. Storage costs comparison is indicated in Table 4, ours maintain the lowest storage overhead. In addition, messages in login and mutual authentication are transmitted 4 times in our scheme. We calculate our communication costs and others, and ours is equivalent to other schemes from Table 5.Table 4
The storage cost comparison.
ProtocolsStorage cost (bits)Total (bits)[14]Sensor544864RN32Server288[25]Sensor15361952RN0Server416[29]Sensor8001108RN32Server276[30]Sensor10561664RN32Server576OursSensor832928RN32Server64Table 5
The communication cost comparison.
Schemes[14][25][29][30]OursCommunication cost (bits)41962752371237123936


## 8. Conclusion

We first point out that Alzahrani et al.’s protocol can’t defend against stolen-verifier attacks, desynchronization attacks, known-key attacks, and off-line identity guessing attacks and has no perfect forward secrecy. After that, we design a patient monitoring scheme based on ECC for WBAN in IoHT. We use verification tool ProVerif and formal security proof to demonstrate the security of our scheme. Through comparative analysis, our protocol is safer and more efficient to suit the lightweight and secrecy in medical scenarios. In the future, we will research more pragmatic and anonymous authentication protocol for more complex WBAN scenarios.



---

*Source: 4845850-2023-02-13.xml*