# Cryptanalysis and Security Improvement of Two Authentication Schemes for Healthcare Systems Using Wireless Medical Sensor Networks

Authors: Jiaqing Mo; Zhongwang Hu; Yuhua Lin
Journal: Security and Communication Networks
 (2020)

---

## Abstract

Wireless medical sensor networks (WMSNs) play an important role in collecting healthcare data of the remote patient and transmitting them to the medical professional for proper diagnosis via wireless channel. To protect the patient's healthcare data which is private-related and sensitive, some authentication schemes for healthcare systems using WMSN have been proposed to ensure the secure communication between the medical sensors and the medical professional. Since cryptanalyzing the security defects of authenticated protocols is crucial to put forward solutions and propose truly robust protocols, we scrutinize two state-of-the-art authentication protocols using WMSN for healthcare systems. Firstly, we examine Ali et al.’s enhanced three-factor based authentication protocol and show that although it provides a formal proof and a security verification, it still fails to resist offline dictionary guessing attack, desynchronization attack, and privileged insider attack and contains a serious flaw in the password change phase. Secondly, we investigate Shuai et al.’s lightweight and three-factor based authentication protocol and point out that it cannot achieve high security level as they claimed; it is actually subject to offline dictionary guessing attack and privileged insider attack, and it also has a design flaw in the password change phase. In addition, we suggest several countermeasures to thwart these security weaknesses in these two schemes for WMSN and the similar kinds.


---

## Body

## 1. Introduction

Internet of Things (IoT), which enables a variety of things to connect each other via the Internet or wireless communication, by employing data-collecting devices such as sensors and radio frequency identification (RFID), has a wide range of applications [1, 2]. As an indispensable part of IoT, wireless sensor networks (WSNs) can collect data from specific objects and share them with human beings; thus, WSN is widely applied in many application scenarios, like healthcare service [3, 4], environment monitoring [5], and habitats [6]. Wireless medical sensor network (WMSN) is a popular application of WSN for healthcare systems, in which wearable sensors gather the patient’s physiological information such as blood pressure, body temperature, and heart rate and send them to the medical professionals for diagnosis or further treatment [7]. It is obvious that WMSN not only monitors the patient in real-time but also saves his time and money and improves the efficiency of the medical professional. Generally, a typical WMSN mainly includes three entries: a gateway node, sensor nodes, and medical professional. The gateway node (GWN) has powerful computation and ammunition capabilities and plays the role of a communication bridge between the sensors and medical professionals. The sensor nodes, resource-restraint in computation and communication capabilities, are implanted or installed in the patient’s body to gather the physiological information and transmit them to medical professionals in the distance with the help of GWN. However, the physiological information of the patient is sensitive, and they are transmitted over insecure wireless channel. If the attacker intercepts and modifies these physiological data, the doctor may make a wrong diagnosis.Although some measures have been developed to protect the security of WSN at link layer and network layer in IEEE 802.15.4 by IETF [8, 9], it is still necessary to design a robust authentication mechanism in application layer to protect the sensitive sensed data from unauthorized access. That is to say, the identity legitimacy of the medical professional should be verified before accessing the sensor data. In addition, the sensor node to be accessed should be authenticated for the criticality and sensitivity of the sensed data from the patient. Particularly, a session key should be negotiated between the medical professional and the sensor node to secure the real-time access.Over years, a series of authentication protocols have been proposed for WMSN to protect the transmitted data against unauthorized access from an attacker or a malicious user. We brief the previous schemes related to WMSN. Because of the limitations of wearable sensor’s computation and communication capabilities, WMSN authentication schemes concern efficiency and adopt lightweight cryptography operations on the premise of ensuring security. In 2012, Kumar et al. [10] presented an efficient remote user authentication protocol named E-SAP for healthcare applications in WMSN environment and claimed that their scheme is secure against various known attacks. However, He et al. [11] showed that Kumar et al.’s scheme suffers from offline password guessing attack and privileged insider attack, as well as failure to provide user anonymity. In addition, they suggested a robust and efficient anonymous authentication protocol for patient monitoring using WMSN. Unfortunately, both Wu et al. [12] and Li et al. [13] indicated that the protocol in [11] is still vulnerable to some security weaknesses, such as denial of service attack, lack of wrong password detection mechanism, user impersonation attack, senor node capture attack, and offline password guessing attack. As a remedy, they also gave their enhanced protocol, respectively. However, Das et al. [14] observed that Li et al.’s scheme [13] is insecure to withstand sensor node capture attack, privileged insider attack, and lack of user anonymity. Further, they contributed an efficient and secure authentication protocol for WMSN. In the same year, Srinivas et al. [15] described that Wu et al.’s scheme [12] is subject to insider attack, user impersonation attack, and stolen smartcard attack. To thwart these security defects, they devised an efficient authentication scheme using lightweight operations for WMSN. But Wu et al. [16] pointed out that the scheme in [15] is unsuitable for practical deployment owing to security weaknesses like offline password guessing attack, and a lightweight two-factor authentication scheme for healthcare systems using WMSN was introduced to fix these drawbacks.In 2016, Amin et al. [17] proposed a two-factor anonymous patient monitoring system using hash function in WMSN. The purpose of scheme in [17] is to design a robust and efficient user authentication protocol so as to provide secure data access in WMSN. However, Jiang et al. [18] claimed that scheme in [17] fails to resist stolen mobile device attack and desynchronization attack, as well as suffering from security issue of sensor key exposure. Afterwards, they devised an enhanced protocol. In addition, protocol in [17] was deemed vulnerable to user impersonation attack, offline password guessing attack, known session key temporary information, revelation of secret parameters, and identity guessing attack by Ali et al. [19], and then they proposed an enhanced three-factor authentication protocol to overcome these vulnerabilities. Although Jiang et al. [18] adopted fuzzy verifier technique and asserted that their protocol achieves admirable security properties, we find that their scheme is susceptible to privileged insider attack, denial of service attack, and known session special temporary information attack.Since elliptical curve cryptography (ECC) can achieve the same symmetric cryptography algorithm (i.e., RSA) security level with faster computation and smaller key size, many authentication protocols have been developed for WMSN on ECC to enhance their security in recent years. In 2016, Hayajneh et al. [20] proposed an authentication protocol for remote patient monitoring with Rabin algorithm and used Tmote sky notes to prove its efficiency. In the same year, Liu and Chung [21] devised a remote user authentication scheme on bilinear pair to facilitate security and privacy protection in wireless healthcare sensor networks and asserted their scheme can resist various known attacks. But, Challa et al. [22] claimed that the protocol in [20] is susceptible to stolen smartcard attack, offline password guessing attack, privileged insider attack, user impersonation attack, and even inappropriate mutual authentication. To improve efficiency and security, they introduced a three-factor authentication protocol using lightweight ECC point multiplications with formal proof. In 2019, to ensure secure communication and privacy-preserving, Xie et al. [23] proposed an efficient and certificateless authentication scheme named CasCP with batch authentication in wireless body area networks. In the same year, Li et al. [2] considered that the protocol in [17] is vulnerable to denial of services (DoS) attack and cannot provide forward secrecy and proposed an ECC-based three-factor authentication protocol using fuzzy commitment and fuzzy verifier techniques to enhance the security of [17].More recently, Ali et al. [19] analyzed protocol in [17] and showed that their protocol suffers from offline password guessing attack, user impersonation attack, and revelation of secret parameter, and a new three-factor protocol is introduced to resist various attacks. But, in this work, in contrast to their assertions, we examine Ali et al.’s protocol and point out that their scheme is still vulnerable to offline dictionary guessing attack, desynchronization attack, and privileged insider attack and has a flaw in the password change phase. In addition, Shuai et al. [24] in 2019 proposed a lightweight three-factor authentication scheme for patient monitoring using on-body wireless networks and employing one-time hash chain technique and pseudonym identity method to improve its security. The on-body wireless network is actually a WMSN, since the former is like the latter, in which the sensors installed on the patient collect physiological data and transmit them to the doctor or the health professional through GWN for further processing. However, in this paper, we prove that Shuai et al. [24] suffers from three security drawbacks, that is, offline dictionary guessing attack, privileged insider attack, and flaw in the password change phase.As two case studies, our analysis shows that a number of WMSN authentication protocols for healthcare systems and the similar kinds are not secure under some provable security models. Furthermore, our cryptanalysis of the two schemes highlights that it is important to pay attention to potential threats when proposing a new authentication protocol.In brief, our main contributions are summarized as follows.(1)
First, we cryptanalyze Ali et al.’s protocol [19] and reveal that it cannot withstand offline dictionary guessing attack and desynchronization attack and contains a serious flaw in the password change phase.(2)
Second, we cryptanalyze Shuai et al.’s protocol [24] and show that their scheme is vulnerable to offline dictionary guessing attack as [19] and privileged insider attack. In addition, we point out a design flaw in the password change phase of their scheme.(3)
Third, we put forward some effective countermeasures to amend these two schemes and similar authentication protocols with the same defects.The remainder of this work is organized as follows: In Section2, we review Ali et al.’s protocol and show their security weaknesses. Shuai et al.’s protocol is reviewed and cryptanalyzed in Section 3. Section 4 puts forward several countermeasures to fix the discovered threats. Finally, conclusion is made in Section 5.


## 2. Cryptanalysis on Ali et al.’s Protocol

In this section, we briefly review and cryptanalyze Ali et al.’s protocol [19], which is a lightweight three-factor based authentication protocol for healthcare monitoring in WMSN environment. Their scheme consists of five phases: system setup, user registration, login, authentication, and password change. To facilitate description, we list notations in Table 1 and they will be used throughout this work.Table 1
Notations.
Notation
Description
U
i
i
th user
RA
Registration agent
GWN
Gateway node
S
j
j
th sensor node
IDi
The identity ofUi
SIDj
The identity ofSj
PWi
The password ofUi
BIOi
U
i’s biometrics
⊕
The bitwise XOR operation
||
The concatenation operation
⟹
The secure channel
⟶
The public channel
h()
A secure one-way hash function
H()
Bio-hash function
E
k()/Dk()
The symmetric encryption/decryption function with keyk
T
i
The current timestamp,i = 1, 2, …
MD
Mobile device ofUi
MIDi
Temporary identity ofUi
ID
g
The identity of GWN
NCk0
Serial number in GWN side
NCk
Serial number inSj side


### 2.1. Review of Ali et al.’s Scheme

#### 2.1.1. System Setup

Firstly, the administrator SA selects identity SIDj for each sensor node and computes XGS = h(SIDj || XG), Kj = h(XGS || YG || XG), where XG and YG are secret keys of GWN. Afterwards, SA stores {XGS, Kj} in the memory of the sensor node Sj.


#### 2.1.2. User Registration

If the user wants to access the sensor, he must register in the gateway node first.(1)
Ui ⟹ GWN: {IDi, RPWi, Fi}RPWi = h(IDi || PWi || ri), Fi = H (BIOi || ri), where ri is a random number of Ui.(2)
GWN ⟹Ui: smartcard = {Ai, Ci, Di, DIDi, H(), h()}Ai = h(DIDi || XG || IDg) ⊕ h(RPWi || Fi), Ci = Rg ⊕ h(DIDi || XG || IDg), Di = h(RPWi || Rg || Fi), and {DIDi, Ci} is stored in GWN’s database. DIDi is a dynamic identity chosen by GWN and Rg is a random number.(3)
Ui computes Rn = ri ⊕ h(IDi || PWi || H(BIOi)) and stores it in the smartcard.


#### 2.1.3. Login

(1)
U
i inserts his smartcard, inputs IDi, PWi and imprints BIOi, and then the smartcard computes ri = Rn ⊕ h(IDi || PWi || H(BIOi)), RPWi = h(IDi || PWi || ri), Fi = H (BIOi || ri), h(DIDi || XG || IDg) = Ai ⊕ h(RPWi || Fi), Rg = Ci ⊕ h(DIDi || XG || IDg), and Di′ = h(RPWi || Rg || Fi) and checks Di′? = Di. If it fails, Ui aborts this login request.
(2)
U
i ⟶ GWN: {DIDi, M1, M2, M3}.
M
1 = Mi ⊕ h(DIDi || XG || IDg), M2=EhMiRgIDiSIDjT1Ai, M3 = h(IDi || SIDj || h(RPWi || Fi)), where Mi is a random nonce and T1 is the current timestamp.


#### 2.1.4. Authentication

(1)
GWN ⟶Sj: {M1, M4, M5, M6}
GWN computesMi = M1 ⊕ h(DIDi || XG || IDg), Rg = Ci ⊕ h(DIDi || XG || IDg) and decrypts M2 to obtain (IDi || SIDj || T1 || Ai) using h(Mi || Rg). If T1 is not fresh, GWN aborts this session; otherwise, GWN computes h(RPWi || Fi) = Ai ⊕ h(DIDi || XG || IDg), M3′ = h(IDi || SIDj || h(RPWi || Fi)), and checks whether M3′ ? = M3. If it is false, GWN terminates the session. Otherwise, GWN computes XGS = h(SIDj || XG), Kj = h(XGS || YG || XG), M4=EhXGSKjIDgIDiMiAiT3, M5 = Ni ⊕ h(T3 || h(RPWi || Fi)), and M6 = h(IDi || Ni || T3 || IDg).
(2)
S
j ⟶ GWN: {M7, M8, T5}
S
j decrypts M4 to get (IDg || IDi || Mi || Ai || T3) with key h(XGS || Kj) and verifies the freshness of T3. If not, Sj aborts the session. Otherwise, GWN computes h(RPWi || Fi) = M1 ⊕ Mi ⊕ Ai, Ni = h(T3 || h(RPWi || Fi)) ⊕ M5, M6′ = h(IDi|| Ni || T3|| IDg) and checks whether M6′? = M6. If not, GWN aborts the session. Otherwise, Sj computes M7 = Vi ⊕ h(Mi || Ni), SK = h(h(RPWi || Fi) || Mi ||Ni || Vi), and M8 = h(SK || IDi || IDg || T5).
(3)
GWN ⟶Ui: {M9, M10}
GWN checks the freshness ofT5. GWN aborts the session if T5 is not fresh. Otherwise, GWN computes Vi = M7 ⊕ h(Mi || Ni), SK′ = h(h(RPWi || Fi) || Mi || Ni||Vi), and M8′ = h(SK′||IDi || IDg || T5) and checks whether M8′? = M8. If not, GWN aborts the session. Otherwise, GWN computes Cin = Rg ⊕ h(DIDin || XG || IDg), M9=EhRPWiFiCinNiViDIDin, and M10 = h(SK || Cin || DIDin) and updates the database with {DIDin, Cin}.
(4)
U
i decrypts M9 with h(RPWi || Fi) to obtain (Cin || Ni || Vi || DIDin), computes SK′ = h(h(RPWi || Fi) || Mi || Ni || Vi), and checks whether M10 ? = h(SK′ || Cin|| DIDin). If yes, Ui replaces (DIDi, Ci) with (DIDin, Cin). Otherwise, Ui rejects the session.


#### 2.1.5. Password Change

This phase is performed ifUi wants to change his password.(1)
Ui inserts smartcard and keys IDi, PWi, and imprints BIOi, and then the smartcard computes ri = Rn ⊕ h(IDi || PWi || H (BIOi)), RPWi = h(IDi || PWi || ri), Fi = H(BIOi || ri), h(DIDi || XG || IDg) = Ai ⊕ h(RPWi || Fi), Rg = Ci ⊕ h(DIDi || XG || IDg), and Di′ = h(RPWi || Rg || Fi) and compares Di′? = Di. If it fails, smartcard aborts the session. Otherwise, the procedure continues.(2)
Ui inputs his new password PWinew, and the smartcard computes RPWinew = h(IDi || PWinew || ri), Ainew = Ai ⊕ h(DIDi || XG || IDg) ⊕ h(RPWinew || Fi), and Dinew = h(RPWinew || Ci ⊕ h(DIDi || XG || IDg) || Fi). Finally, smartcard replaces (Ai, Di) with (Ainew, Dinew).


### 2.2. Cryptanalysis of Ali et al.’s Protocol

Although Ali et al.’s protocol [19] is equipped with a formal security proof to show that their scheme can withstand various known attacks, it still suffers from some security defects. In this subsection, we prove that their protocol cannot resist offline dictionary guessing attack, desynchronization attack, and privileged insider attack and has a flaw in the password change phase though they tried to fix the security drawbacks in Amin et al.’s scheme. Since it is crucial to depict the capabilities of the adversary in designing a robust authentication protocol in WSN environment, we summarize the adversary model as follows [19, 25–27].(1)
The attacker can intercept, delete, modify, and insert the messages exchanged between the related communication parties over public channel.(2)
The attacker cannot guess the secret key and random number since they are assumed sufficiently large.(3)
The attacker can offline enumerate the user-memorable identities and low-entropy passwords in polynomial time simultaneously.(4)
As far as privileged insider attack is taken into account, the privileged-insider in GWN being an attacker can learn the submitted information by the user during the registration phase of authentication protocol.(5)
When considering whether some multifactor authentication protocol can provide truly multifactor security (i.e., then factors protocol is secure, even if n-1 factors are compromised), it is reasonable to suppose that (i) the attacker can somehow obtain the lost/stolen smartcard and retrieve the secret information by using side-channel attack [28, 29]. (ii) The attacker can collect the biometrics of the user through malicious device without awareness of victim.


#### 2.2.1. Offline Dictionary Guessing Attack

It is widely regarded that the password-based authentication schemes are prone to password guessing attack [30–32], including online password guessing attack and offline password guessing attack, since the users tend to choose a password that is easy to remember. The online password guessing can be relatively detected by judging whether the time of logins exceeds the threshold. On the contrary, during this guessing attack, the attacker does not need to communicate with related communication parties, and thus the offline password guessing attack is not easily surmounted.In Ali et al.’s scheme, they claimed their scheme not only can withstand password guessing attack, but also can withstand identity guessing attack. Unfortunately, we prove that their claim is not convincing as they claimed. According to the aforementioned adversary model, we assume that the user’s lost/stolen smartcard is obtained by the attacker, and the user’s biometrics is also collected by the attacker without awareness of owner, and the attackers can launch offline password guessing attack and offline identity guessing attack simultaneously in terms of item 3 in the adversary model, which we call offline dictionary guessing attack. The offline dictionary guessing attack is conducted to get the user’s identity and password by the attacker with the following procedure.Step 1: the attacker extracts the secret data {Ai, Di, DIDi, H(), h(), Rn} from the smartcard by using methods reported in [28].Step 2: the attacker selects a candidate pair (IDi∗, PWi∗) from DID and DPW, where DID denotes the identity space and DPW denotes the password space.Step 3: the attacker computesri∗ = Rn ⊕ h(IDi∗ || PWi∗ ||H(BIOi)), RPWi = h(IDi∗ || PWi∗ || ri∗), Fi∗ = H(BIOi ||ri∗), h(DIDi || XG || IDg) = Ai ⊕ h(RPWi∗||Fi∗), Rg∗ = Ci ⊕h(DIDi || XG || IDg)∗.Step 4: the attacker checks whether the extractedDi equals the computed h(RPWi∗ || Rg∗ || Fi∗).Step 5: if it holds, the attacker has found a right pair (IDi, PWi). Otherwise, the attacker repeats steps 2–4 until the right pair (IDi, PWi) is found.For ease of achieving user friendliness, Ali et al.’s scheme [19], like previous schemes [12, 17, 18], provides the password update phase, allowing the users to select their own ID and password and make changes. Generally, the user likes to choose an easy-to-remember identity and password, which are often low-entropy. Thus, this makes sense for the attacker to perform offline dictionary guessing attack by enumerating pairs (IDi, PWi) in polynomial time. Let |DID| and |DPW| represent the size of DID and DPW, respectively. In addition, we set Th and TH as the execution time of hash function h() and bio-hash function H(), respectively. The time complexity of the above attack procedure is O(|DID| ∗ |DPW| ∗ 4Th ∗ 2TH). Since Th and TH are limited, it is clear that the time required by the attacker to carry out the above attack procedure is linear to |DID| ∗ |DPW|. As reported in [33, 34], both the identity space DID and the password space DPW are rather limited in practice (e.g., |DID| ≤ DPW| ≤ 106 [33, 34]), and thus, it is possible for the attacker to guess (IDi, PWi) within polynomial time. Wang and Wang [35] even pointed out that the time spent on the above guessing attack can be greatly reduced to the level of seconds on an ordinary computer. Therefore, Ali et al.’s protocol [19] is vulnerable to offline dictionary guessing attack.Based on the aforementioned attack, after the attacker has obtained the user’s identity and password, he can impersonate the user to log onto GWN with the smartcard and the collected biometrics. In this regard, Ali et al.’s protocol suffers from user impersonation attack.


#### 2.2.2. Desynchronization Attack

To achieve security features of user anonymity and user untraceability, Ali et al.’s protocol [19] makes use of synchronous update mechanism; that is, GWN updates the dynamic identity DIDi and Ci synchronously with Ui via message {M9, M10}. In this way, the attacker cannot trace a particular user by eavesdropping messages over the public channel. However, we point out that the attacker can breach this synchronous mechanism by blocking the last message {M9, M10}, leading to failure when the user logs onto GWN the next time. Such attack is illustrated as follows.In Step 7 of the authentication phase after updating {DIDin, Cin} in the database, GWN sends message {M9, M10} to Ui, where M9=EhRPWiFiCinNiViDIDin, M10 = h(SK || Cin || DIDin) and DIDin is a new dynamic identity. Upon receiving the message, Ui will generate a session key and replace {DIDi, Ci} with {DIDin, Cin}. If the malicious attacker blocks this message at the end of authentication process, and the parameters {DIDi, Ci} in the user’s smartcard remain unchanged while {DIDi, Ci} on the GWN side have been updated, it means the attacker has broken the dynamic identity synchronization mechanism between GWN and the user by means of blocking messages. As a result, the medical professional can no longer log onto GWN to access data from the sensor on the patient.


#### 2.2.3. Privileged Insider Attack

According to item 4 of the adversary model, a privileged insider of GWN obtains the user’s registration request information {IDi, RPWi, Fi}, as well as the secret data {Ai, Ci, Di, DIDi, H(), h()} on the smartcard before GWN sent the smartcard to the user. With this information, he launches a privileged insider attack as follows.Step 1: he eavesdrops the messages {M1, M4, M5, M6} and {M9, M10} from the public channel.Step 2: then, he decryptsM9 using decryption key h(RPWi || Fi) to obtain Ni and Vi.Step 3: further, he acquiresMi by computing Mi = h(RPWi || Fi) ⊕ M1 ⊕ Ai.Step 4: finally, with the known parametersh(RPWi || Fi), Mi, Ni, Vi, the attacker can compute the session key SK = h(h(RPWi || Fi) || Mi || Ni || Vi).Therefore, Ali et al.’s scheme suffers from privileged insider attack.


#### 2.2.4. Flaw in Password Change Phase

In Ali et al.’s protocol, they provide a password change phase to allow users to freely change the password locally. However, our scrutiny reveals that their password change phase has a fatal flaw which will prevent the user from logging onto GWN. In their scheme, before changing the password, the user is asked to input his identity and old password and imprint his biometrics. If the identity legitimacy of the user is verified by the smartcard, the user is allowed to enter a new password to update the old one. Then, the smartcard computesRPWinew = h(IDi || PWinew || ri), Ainew = Ai ⊕ h(DIDi || Xq ||IDg) ⊕ h(RPWinew || Fi), Dinew = h(RPWinew || Ci ⊕ h(DIDi ||XG || IDg) || Fi)). At last, the smartcard replaces {Ai, Di} with {Ainew, Dinew}. Note that Rn has not been updated with the new password PWinew. Thereafter, if the user wants to log onto GWN, he enters IDi, PWinew and imprints BIOi, and the smartcard computes ri′ = Rn ⊕ h(IDi || PWinew || H(BIOi)). It is evident that ri′ ≠ ri, since PWinew ≠ PWi. Accordingly, because the calculation of Di is related to ri, the computed Di is not equal to the stored Di in the smartcard. For this reason, the legal user is always rejected from logging onto GWN once he changed his password. Thus, Ali et al.’s protocol suffers with a serious flaw in the password change phase.


## 2.1. Review of Ali et al.’s Scheme

### 2.1.1. System Setup

Firstly, the administrator SA selects identity SIDj for each sensor node and computes XGS = h(SIDj || XG), Kj = h(XGS || YG || XG), where XG and YG are secret keys of GWN. Afterwards, SA stores {XGS, Kj} in the memory of the sensor node Sj.


### 2.1.2. User Registration

If the user wants to access the sensor, he must register in the gateway node first.(1)
Ui ⟹ GWN: {IDi, RPWi, Fi}RPWi = h(IDi || PWi || ri), Fi = H (BIOi || ri), where ri is a random number of Ui.(2)
GWN ⟹Ui: smartcard = {Ai, Ci, Di, DIDi, H(), h()}Ai = h(DIDi || XG || IDg) ⊕ h(RPWi || Fi), Ci = Rg ⊕ h(DIDi || XG || IDg), Di = h(RPWi || Rg || Fi), and {DIDi, Ci} is stored in GWN’s database. DIDi is a dynamic identity chosen by GWN and Rg is a random number.(3)
Ui computes Rn = ri ⊕ h(IDi || PWi || H(BIOi)) and stores it in the smartcard.


### 2.1.3. Login

(1)
U
i inserts his smartcard, inputs IDi, PWi and imprints BIOi, and then the smartcard computes ri = Rn ⊕ h(IDi || PWi || H(BIOi)), RPWi = h(IDi || PWi || ri), Fi = H (BIOi || ri), h(DIDi || XG || IDg) = Ai ⊕ h(RPWi || Fi), Rg = Ci ⊕ h(DIDi || XG || IDg), and Di′ = h(RPWi || Rg || Fi) and checks Di′? = Di. If it fails, Ui aborts this login request.
(2)
U
i ⟶ GWN: {DIDi, M1, M2, M3}.
M
1 = Mi ⊕ h(DIDi || XG || IDg), M2=EhMiRgIDiSIDjT1Ai, M3 = h(IDi || SIDj || h(RPWi || Fi)), where Mi is a random nonce and T1 is the current timestamp.


### 2.1.4. Authentication

(1)
GWN ⟶Sj: {M1, M4, M5, M6}
GWN computesMi = M1 ⊕ h(DIDi || XG || IDg), Rg = Ci ⊕ h(DIDi || XG || IDg) and decrypts M2 to obtain (IDi || SIDj || T1 || Ai) using h(Mi || Rg). If T1 is not fresh, GWN aborts this session; otherwise, GWN computes h(RPWi || Fi) = Ai ⊕ h(DIDi || XG || IDg), M3′ = h(IDi || SIDj || h(RPWi || Fi)), and checks whether M3′ ? = M3. If it is false, GWN terminates the session. Otherwise, GWN computes XGS = h(SIDj || XG), Kj = h(XGS || YG || XG), M4=EhXGSKjIDgIDiMiAiT3, M5 = Ni ⊕ h(T3 || h(RPWi || Fi)), and M6 = h(IDi || Ni || T3 || IDg).
(2)
S
j ⟶ GWN: {M7, M8, T5}
S
j decrypts M4 to get (IDg || IDi || Mi || Ai || T3) with key h(XGS || Kj) and verifies the freshness of T3. If not, Sj aborts the session. Otherwise, GWN computes h(RPWi || Fi) = M1 ⊕ Mi ⊕ Ai, Ni = h(T3 || h(RPWi || Fi)) ⊕ M5, M6′ = h(IDi|| Ni || T3|| IDg) and checks whether M6′? = M6. If not, GWN aborts the session. Otherwise, Sj computes M7 = Vi ⊕ h(Mi || Ni), SK = h(h(RPWi || Fi) || Mi ||Ni || Vi), and M8 = h(SK || IDi || IDg || T5).
(3)
GWN ⟶Ui: {M9, M10}
GWN checks the freshness ofT5. GWN aborts the session if T5 is not fresh. Otherwise, GWN computes Vi = M7 ⊕ h(Mi || Ni), SK′ = h(h(RPWi || Fi) || Mi || Ni||Vi), and M8′ = h(SK′||IDi || IDg || T5) and checks whether M8′? = M8. If not, GWN aborts the session. Otherwise, GWN computes Cin = Rg ⊕ h(DIDin || XG || IDg), M9=EhRPWiFiCinNiViDIDin, and M10 = h(SK || Cin || DIDin) and updates the database with {DIDin, Cin}.
(4)
U
i decrypts M9 with h(RPWi || Fi) to obtain (Cin || Ni || Vi || DIDin), computes SK′ = h(h(RPWi || Fi) || Mi || Ni || Vi), and checks whether M10 ? = h(SK′ || Cin|| DIDin). If yes, Ui replaces (DIDi, Ci) with (DIDin, Cin). Otherwise, Ui rejects the session.


### 2.1.5. Password Change

This phase is performed ifUi wants to change his password.(1)
Ui inserts smartcard and keys IDi, PWi, and imprints BIOi, and then the smartcard computes ri = Rn ⊕ h(IDi || PWi || H (BIOi)), RPWi = h(IDi || PWi || ri), Fi = H(BIOi || ri), h(DIDi || XG || IDg) = Ai ⊕ h(RPWi || Fi), Rg = Ci ⊕ h(DIDi || XG || IDg), and Di′ = h(RPWi || Rg || Fi) and compares Di′? = Di. If it fails, smartcard aborts the session. Otherwise, the procedure continues.(2)
Ui inputs his new password PWinew, and the smartcard computes RPWinew = h(IDi || PWinew || ri), Ainew = Ai ⊕ h(DIDi || XG || IDg) ⊕ h(RPWinew || Fi), and Dinew = h(RPWinew || Ci ⊕ h(DIDi || XG || IDg) || Fi). Finally, smartcard replaces (Ai, Di) with (Ainew, Dinew).


## 2.1.1. System Setup

Firstly, the administrator SA selects identity SIDj for each sensor node and computes XGS = h(SIDj || XG), Kj = h(XGS || YG || XG), where XG and YG are secret keys of GWN. Afterwards, SA stores {XGS, Kj} in the memory of the sensor node Sj.


## 2.1.2. User Registration

If the user wants to access the sensor, he must register in the gateway node first.(1)
Ui ⟹ GWN: {IDi, RPWi, Fi}RPWi = h(IDi || PWi || ri), Fi = H (BIOi || ri), where ri is a random number of Ui.(2)
GWN ⟹Ui: smartcard = {Ai, Ci, Di, DIDi, H(), h()}Ai = h(DIDi || XG || IDg) ⊕ h(RPWi || Fi), Ci = Rg ⊕ h(DIDi || XG || IDg), Di = h(RPWi || Rg || Fi), and {DIDi, Ci} is stored in GWN’s database. DIDi is a dynamic identity chosen by GWN and Rg is a random number.(3)
Ui computes Rn = ri ⊕ h(IDi || PWi || H(BIOi)) and stores it in the smartcard.


## 2.1.3. Login

(1)
U
i inserts his smartcard, inputs IDi, PWi and imprints BIOi, and then the smartcard computes ri = Rn ⊕ h(IDi || PWi || H(BIOi)), RPWi = h(IDi || PWi || ri), Fi = H (BIOi || ri), h(DIDi || XG || IDg) = Ai ⊕ h(RPWi || Fi), Rg = Ci ⊕ h(DIDi || XG || IDg), and Di′ = h(RPWi || Rg || Fi) and checks Di′? = Di. If it fails, Ui aborts this login request.
(2)
U
i ⟶ GWN: {DIDi, M1, M2, M3}.
M
1 = Mi ⊕ h(DIDi || XG || IDg), M2=EhMiRgIDiSIDjT1Ai, M3 = h(IDi || SIDj || h(RPWi || Fi)), where Mi is a random nonce and T1 is the current timestamp.


## 2.1.4. Authentication

(1)
GWN ⟶Sj: {M1, M4, M5, M6}
GWN computesMi = M1 ⊕ h(DIDi || XG || IDg), Rg = Ci ⊕ h(DIDi || XG || IDg) and decrypts M2 to obtain (IDi || SIDj || T1 || Ai) using h(Mi || Rg). If T1 is not fresh, GWN aborts this session; otherwise, GWN computes h(RPWi || Fi) = Ai ⊕ h(DIDi || XG || IDg), M3′ = h(IDi || SIDj || h(RPWi || Fi)), and checks whether M3′ ? = M3. If it is false, GWN terminates the session. Otherwise, GWN computes XGS = h(SIDj || XG), Kj = h(XGS || YG || XG), M4=EhXGSKjIDgIDiMiAiT3, M5 = Ni ⊕ h(T3 || h(RPWi || Fi)), and M6 = h(IDi || Ni || T3 || IDg).
(2)
S
j ⟶ GWN: {M7, M8, T5}
S
j decrypts M4 to get (IDg || IDi || Mi || Ai || T3) with key h(XGS || Kj) and verifies the freshness of T3. If not, Sj aborts the session. Otherwise, GWN computes h(RPWi || Fi) = M1 ⊕ Mi ⊕ Ai, Ni = h(T3 || h(RPWi || Fi)) ⊕ M5, M6′ = h(IDi|| Ni || T3|| IDg) and checks whether M6′? = M6. If not, GWN aborts the session. Otherwise, Sj computes M7 = Vi ⊕ h(Mi || Ni), SK = h(h(RPWi || Fi) || Mi ||Ni || Vi), and M8 = h(SK || IDi || IDg || T5).
(3)
GWN ⟶Ui: {M9, M10}
GWN checks the freshness ofT5. GWN aborts the session if T5 is not fresh. Otherwise, GWN computes Vi = M7 ⊕ h(Mi || Ni), SK′ = h(h(RPWi || Fi) || Mi || Ni||Vi), and M8′ = h(SK′||IDi || IDg || T5) and checks whether M8′? = M8. If not, GWN aborts the session. Otherwise, GWN computes Cin = Rg ⊕ h(DIDin || XG || IDg), M9=EhRPWiFiCinNiViDIDin, and M10 = h(SK || Cin || DIDin) and updates the database with {DIDin, Cin}.
(4)
U
i decrypts M9 with h(RPWi || Fi) to obtain (Cin || Ni || Vi || DIDin), computes SK′ = h(h(RPWi || Fi) || Mi || Ni || Vi), and checks whether M10 ? = h(SK′ || Cin|| DIDin). If yes, Ui replaces (DIDi, Ci) with (DIDin, Cin). Otherwise, Ui rejects the session.


## 2.1.5. Password Change

This phase is performed ifUi wants to change his password.(1)
Ui inserts smartcard and keys IDi, PWi, and imprints BIOi, and then the smartcard computes ri = Rn ⊕ h(IDi || PWi || H (BIOi)), RPWi = h(IDi || PWi || ri), Fi = H(BIOi || ri), h(DIDi || XG || IDg) = Ai ⊕ h(RPWi || Fi), Rg = Ci ⊕ h(DIDi || XG || IDg), and Di′ = h(RPWi || Rg || Fi) and compares Di′? = Di. If it fails, smartcard aborts the session. Otherwise, the procedure continues.(2)
Ui inputs his new password PWinew, and the smartcard computes RPWinew = h(IDi || PWinew || ri), Ainew = Ai ⊕ h(DIDi || XG || IDg) ⊕ h(RPWinew || Fi), and Dinew = h(RPWinew || Ci ⊕ h(DIDi || XG || IDg) || Fi). Finally, smartcard replaces (Ai, Di) with (Ainew, Dinew).


## 2.2. Cryptanalysis of Ali et al.’s Protocol

Although Ali et al.’s protocol [19] is equipped with a formal security proof to show that their scheme can withstand various known attacks, it still suffers from some security defects. In this subsection, we prove that their protocol cannot resist offline dictionary guessing attack, desynchronization attack, and privileged insider attack and has a flaw in the password change phase though they tried to fix the security drawbacks in Amin et al.’s scheme. Since it is crucial to depict the capabilities of the adversary in designing a robust authentication protocol in WSN environment, we summarize the adversary model as follows [19, 25–27].(1)
The attacker can intercept, delete, modify, and insert the messages exchanged between the related communication parties over public channel.(2)
The attacker cannot guess the secret key and random number since they are assumed sufficiently large.(3)
The attacker can offline enumerate the user-memorable identities and low-entropy passwords in polynomial time simultaneously.(4)
As far as privileged insider attack is taken into account, the privileged-insider in GWN being an attacker can learn the submitted information by the user during the registration phase of authentication protocol.(5)
When considering whether some multifactor authentication protocol can provide truly multifactor security (i.e., then factors protocol is secure, even if n-1 factors are compromised), it is reasonable to suppose that (i) the attacker can somehow obtain the lost/stolen smartcard and retrieve the secret information by using side-channel attack [28, 29]. (ii) The attacker can collect the biometrics of the user through malicious device without awareness of victim.


### 2.2.1. Offline Dictionary Guessing Attack

It is widely regarded that the password-based authentication schemes are prone to password guessing attack [30–32], including online password guessing attack and offline password guessing attack, since the users tend to choose a password that is easy to remember. The online password guessing can be relatively detected by judging whether the time of logins exceeds the threshold. On the contrary, during this guessing attack, the attacker does not need to communicate with related communication parties, and thus the offline password guessing attack is not easily surmounted.In Ali et al.’s scheme, they claimed their scheme not only can withstand password guessing attack, but also can withstand identity guessing attack. Unfortunately, we prove that their claim is not convincing as they claimed. According to the aforementioned adversary model, we assume that the user’s lost/stolen smartcard is obtained by the attacker, and the user’s biometrics is also collected by the attacker without awareness of owner, and the attackers can launch offline password guessing attack and offline identity guessing attack simultaneously in terms of item 3 in the adversary model, which we call offline dictionary guessing attack. The offline dictionary guessing attack is conducted to get the user’s identity and password by the attacker with the following procedure.Step 1: the attacker extracts the secret data {Ai, Di, DIDi, H(), h(), Rn} from the smartcard by using methods reported in [28].Step 2: the attacker selects a candidate pair (IDi∗, PWi∗) from DID and DPW, where DID denotes the identity space and DPW denotes the password space.Step 3: the attacker computesri∗ = Rn ⊕ h(IDi∗ || PWi∗ ||H(BIOi)), RPWi = h(IDi∗ || PWi∗ || ri∗), Fi∗ = H(BIOi ||ri∗), h(DIDi || XG || IDg) = Ai ⊕ h(RPWi∗||Fi∗), Rg∗ = Ci ⊕h(DIDi || XG || IDg)∗.Step 4: the attacker checks whether the extractedDi equals the computed h(RPWi∗ || Rg∗ || Fi∗).Step 5: if it holds, the attacker has found a right pair (IDi, PWi). Otherwise, the attacker repeats steps 2–4 until the right pair (IDi, PWi) is found.For ease of achieving user friendliness, Ali et al.’s scheme [19], like previous schemes [12, 17, 18], provides the password update phase, allowing the users to select their own ID and password and make changes. Generally, the user likes to choose an easy-to-remember identity and password, which are often low-entropy. Thus, this makes sense for the attacker to perform offline dictionary guessing attack by enumerating pairs (IDi, PWi) in polynomial time. Let |DID| and |DPW| represent the size of DID and DPW, respectively. In addition, we set Th and TH as the execution time of hash function h() and bio-hash function H(), respectively. The time complexity of the above attack procedure is O(|DID| ∗ |DPW| ∗ 4Th ∗ 2TH). Since Th and TH are limited, it is clear that the time required by the attacker to carry out the above attack procedure is linear to |DID| ∗ |DPW|. As reported in [33, 34], both the identity space DID and the password space DPW are rather limited in practice (e.g., |DID| ≤ DPW| ≤ 106 [33, 34]), and thus, it is possible for the attacker to guess (IDi, PWi) within polynomial time. Wang and Wang [35] even pointed out that the time spent on the above guessing attack can be greatly reduced to the level of seconds on an ordinary computer. Therefore, Ali et al.’s protocol [19] is vulnerable to offline dictionary guessing attack.Based on the aforementioned attack, after the attacker has obtained the user’s identity and password, he can impersonate the user to log onto GWN with the smartcard and the collected biometrics. In this regard, Ali et al.’s protocol suffers from user impersonation attack.


### 2.2.2. Desynchronization Attack

To achieve security features of user anonymity and user untraceability, Ali et al.’s protocol [19] makes use of synchronous update mechanism; that is, GWN updates the dynamic identity DIDi and Ci synchronously with Ui via message {M9, M10}. In this way, the attacker cannot trace a particular user by eavesdropping messages over the public channel. However, we point out that the attacker can breach this synchronous mechanism by blocking the last message {M9, M10}, leading to failure when the user logs onto GWN the next time. Such attack is illustrated as follows.In Step 7 of the authentication phase after updating {DIDin, Cin} in the database, GWN sends message {M9, M10} to Ui, where M9=EhRPWiFiCinNiViDIDin, M10 = h(SK || Cin || DIDin) and DIDin is a new dynamic identity. Upon receiving the message, Ui will generate a session key and replace {DIDi, Ci} with {DIDin, Cin}. If the malicious attacker blocks this message at the end of authentication process, and the parameters {DIDi, Ci} in the user’s smartcard remain unchanged while {DIDi, Ci} on the GWN side have been updated, it means the attacker has broken the dynamic identity synchronization mechanism between GWN and the user by means of blocking messages. As a result, the medical professional can no longer log onto GWN to access data from the sensor on the patient.


### 2.2.3. Privileged Insider Attack

According to item 4 of the adversary model, a privileged insider of GWN obtains the user’s registration request information {IDi, RPWi, Fi}, as well as the secret data {Ai, Ci, Di, DIDi, H(), h()} on the smartcard before GWN sent the smartcard to the user. With this information, he launches a privileged insider attack as follows.Step 1: he eavesdrops the messages {M1, M4, M5, M6} and {M9, M10} from the public channel.Step 2: then, he decryptsM9 using decryption key h(RPWi || Fi) to obtain Ni and Vi.Step 3: further, he acquiresMi by computing Mi = h(RPWi || Fi) ⊕ M1 ⊕ Ai.Step 4: finally, with the known parametersh(RPWi || Fi), Mi, Ni, Vi, the attacker can compute the session key SK = h(h(RPWi || Fi) || Mi || Ni || Vi).Therefore, Ali et al.’s scheme suffers from privileged insider attack.


### 2.2.4. Flaw in Password Change Phase

In Ali et al.’s protocol, they provide a password change phase to allow users to freely change the password locally. However, our scrutiny reveals that their password change phase has a fatal flaw which will prevent the user from logging onto GWN. In their scheme, before changing the password, the user is asked to input his identity and old password and imprint his biometrics. If the identity legitimacy of the user is verified by the smartcard, the user is allowed to enter a new password to update the old one. Then, the smartcard computesRPWinew = h(IDi || PWinew || ri), Ainew = Ai ⊕ h(DIDi || Xq ||IDg) ⊕ h(RPWinew || Fi), Dinew = h(RPWinew || Ci ⊕ h(DIDi ||XG || IDg) || Fi)). At last, the smartcard replaces {Ai, Di} with {Ainew, Dinew}. Note that Rn has not been updated with the new password PWinew. Thereafter, if the user wants to log onto GWN, he enters IDi, PWinew and imprints BIOi, and the smartcard computes ri′ = Rn ⊕ h(IDi || PWinew || H(BIOi)). It is evident that ri′ ≠ ri, since PWinew ≠ PWi. Accordingly, because the calculation of Di is related to ri, the computed Di is not equal to the stored Di in the smartcard. For this reason, the legal user is always rejected from logging onto GWN once he changed his password. Thus, Ali et al.’s protocol suffers with a serious flaw in the password change phase.


## 2.2.1. Offline Dictionary Guessing Attack

It is widely regarded that the password-based authentication schemes are prone to password guessing attack [30–32], including online password guessing attack and offline password guessing attack, since the users tend to choose a password that is easy to remember. The online password guessing can be relatively detected by judging whether the time of logins exceeds the threshold. On the contrary, during this guessing attack, the attacker does not need to communicate with related communication parties, and thus the offline password guessing attack is not easily surmounted.In Ali et al.’s scheme, they claimed their scheme not only can withstand password guessing attack, but also can withstand identity guessing attack. Unfortunately, we prove that their claim is not convincing as they claimed. According to the aforementioned adversary model, we assume that the user’s lost/stolen smartcard is obtained by the attacker, and the user’s biometrics is also collected by the attacker without awareness of owner, and the attackers can launch offline password guessing attack and offline identity guessing attack simultaneously in terms of item 3 in the adversary model, which we call offline dictionary guessing attack. The offline dictionary guessing attack is conducted to get the user’s identity and password by the attacker with the following procedure.Step 1: the attacker extracts the secret data {Ai, Di, DIDi, H(), h(), Rn} from the smartcard by using methods reported in [28].Step 2: the attacker selects a candidate pair (IDi∗, PWi∗) from DID and DPW, where DID denotes the identity space and DPW denotes the password space.Step 3: the attacker computesri∗ = Rn ⊕ h(IDi∗ || PWi∗ ||H(BIOi)), RPWi = h(IDi∗ || PWi∗ || ri∗), Fi∗ = H(BIOi ||ri∗), h(DIDi || XG || IDg) = Ai ⊕ h(RPWi∗||Fi∗), Rg∗ = Ci ⊕h(DIDi || XG || IDg)∗.Step 4: the attacker checks whether the extractedDi equals the computed h(RPWi∗ || Rg∗ || Fi∗).Step 5: if it holds, the attacker has found a right pair (IDi, PWi). Otherwise, the attacker repeats steps 2–4 until the right pair (IDi, PWi) is found.For ease of achieving user friendliness, Ali et al.’s scheme [19], like previous schemes [12, 17, 18], provides the password update phase, allowing the users to select their own ID and password and make changes. Generally, the user likes to choose an easy-to-remember identity and password, which are often low-entropy. Thus, this makes sense for the attacker to perform offline dictionary guessing attack by enumerating pairs (IDi, PWi) in polynomial time. Let |DID| and |DPW| represent the size of DID and DPW, respectively. In addition, we set Th and TH as the execution time of hash function h() and bio-hash function H(), respectively. The time complexity of the above attack procedure is O(|DID| ∗ |DPW| ∗ 4Th ∗ 2TH). Since Th and TH are limited, it is clear that the time required by the attacker to carry out the above attack procedure is linear to |DID| ∗ |DPW|. As reported in [33, 34], both the identity space DID and the password space DPW are rather limited in practice (e.g., |DID| ≤ DPW| ≤ 106 [33, 34]), and thus, it is possible for the attacker to guess (IDi, PWi) within polynomial time. Wang and Wang [35] even pointed out that the time spent on the above guessing attack can be greatly reduced to the level of seconds on an ordinary computer. Therefore, Ali et al.’s protocol [19] is vulnerable to offline dictionary guessing attack.Based on the aforementioned attack, after the attacker has obtained the user’s identity and password, he can impersonate the user to log onto GWN with the smartcard and the collected biometrics. In this regard, Ali et al.’s protocol suffers from user impersonation attack.


## 2.2.2. Desynchronization Attack

To achieve security features of user anonymity and user untraceability, Ali et al.’s protocol [19] makes use of synchronous update mechanism; that is, GWN updates the dynamic identity DIDi and Ci synchronously with Ui via message {M9, M10}. In this way, the attacker cannot trace a particular user by eavesdropping messages over the public channel. However, we point out that the attacker can breach this synchronous mechanism by blocking the last message {M9, M10}, leading to failure when the user logs onto GWN the next time. Such attack is illustrated as follows.In Step 7 of the authentication phase after updating {DIDin, Cin} in the database, GWN sends message {M9, M10} to Ui, where M9=EhRPWiFiCinNiViDIDin, M10 = h(SK || Cin || DIDin) and DIDin is a new dynamic identity. Upon receiving the message, Ui will generate a session key and replace {DIDi, Ci} with {DIDin, Cin}. If the malicious attacker blocks this message at the end of authentication process, and the parameters {DIDi, Ci} in the user’s smartcard remain unchanged while {DIDi, Ci} on the GWN side have been updated, it means the attacker has broken the dynamic identity synchronization mechanism between GWN and the user by means of blocking messages. As a result, the medical professional can no longer log onto GWN to access data from the sensor on the patient.


## 2.2.3. Privileged Insider Attack

According to item 4 of the adversary model, a privileged insider of GWN obtains the user’s registration request information {IDi, RPWi, Fi}, as well as the secret data {Ai, Ci, Di, DIDi, H(), h()} on the smartcard before GWN sent the smartcard to the user. With this information, he launches a privileged insider attack as follows.Step 1: he eavesdrops the messages {M1, M4, M5, M6} and {M9, M10} from the public channel.Step 2: then, he decryptsM9 using decryption key h(RPWi || Fi) to obtain Ni and Vi.Step 3: further, he acquiresMi by computing Mi = h(RPWi || Fi) ⊕ M1 ⊕ Ai.Step 4: finally, with the known parametersh(RPWi || Fi), Mi, Ni, Vi, the attacker can compute the session key SK = h(h(RPWi || Fi) || Mi || Ni || Vi).Therefore, Ali et al.’s scheme suffers from privileged insider attack.


## 2.2.4. Flaw in Password Change Phase

In Ali et al.’s protocol, they provide a password change phase to allow users to freely change the password locally. However, our scrutiny reveals that their password change phase has a fatal flaw which will prevent the user from logging onto GWN. In their scheme, before changing the password, the user is asked to input his identity and old password and imprint his biometrics. If the identity legitimacy of the user is verified by the smartcard, the user is allowed to enter a new password to update the old one. Then, the smartcard computesRPWinew = h(IDi || PWinew || ri), Ainew = Ai ⊕ h(DIDi || Xq ||IDg) ⊕ h(RPWinew || Fi), Dinew = h(RPWinew || Ci ⊕ h(DIDi ||XG || IDg) || Fi)). At last, the smartcard replaces {Ai, Di} with {Ainew, Dinew}. Note that Rn has not been updated with the new password PWinew. Thereafter, if the user wants to log onto GWN, he enters IDi, PWinew and imprints BIOi, and the smartcard computes ri′ = Rn ⊕ h(IDi || PWinew || H(BIOi)). It is evident that ri′ ≠ ri, since PWinew ≠ PWi. Accordingly, because the calculation of Di is related to ri, the computed Di is not equal to the stored Di in the smartcard. For this reason, the legal user is always rejected from logging onto GWN once he changed his password. Thus, Ali et al.’s protocol suffers with a serious flaw in the password change phase.


## 3. Cryptanalysis on Shuai et al.’s Protocol

In this section, we review and cryptanalyze Shuai et al.’s protocol [24] proposed in 2019, which is an anonymous authentication scheme for remote patient monitoring. To achieve some desirable security attributes, their scheme employs pseudonym identity method to preserve user anonymity and adopts one-time hash chain technique to achieve forward secrecy. The serial number technique is also used to resist desynchronization attack. Furthermore, they conduct an informal security analysis to show that their scheme is secure against various attacks. However, in the following section, we find that their scheme is susceptible to offline dictionary guessing attack; that is, their protocol fails to provide truly a three-factor security. On the other hand, we show that their protocol is suspected to privileged insider attack.


### 3.1. Review of Shuai et al.’s Scheme

We will concisely review Shuai et al.’s scheme. Their protocol involves initialization phase, registration phase, login phase, authentication and key agreement phase, and password change phase.


#### 3.1.1. Initialization Phase

The RA performs this phase offline. RA chooses two random numbersIDg and K as the identity and master secret key to GWN, respectively. Next, RA chooses a collision-resistant cryptographic hash function h() for all communication participants. Finally, RA chooses a unique identity SIDj for each wearable sensor node Sj and stores SIDj into Sj’s memory.


#### 3.1.2. Registration Phase

This phase consists of two points, that is, user registration phase and wearable sensor node registration phase.(1)
User registration(i)
Ui => RA: {IDi, Ai}The userUi inputs his IDi, PWi, and imprints biometrics BIOi to mobile device MD. Thereafter, MD computes Gen(BIOi) = (Ri, Pi), Ai = h(PWi || Ri || ai), where Gen is a probabilistic generation procedure, Ri is a secret random key, Pi is an auxiliary string, and ai is a random secret value generated by Ui.(ii)
RA =>Ui: {MIDi, Bi, Ci, KGU}RA chooses three noncesbi, r1, r2 and sets KGU = r1, MIDi = MIDi0 = r2, MIDi1 = null. Afterwards, RA calculates Bi = Ai ⊕ h(IDi || K || bi), Ci = h(h(IDi || K || bi)||Ai), stores {IDi, MIDi0, MIDi1, bi, KGU} into the user information table, and copies this table to GWN.(iii)
Ui calculates Di = h(IDi || PWi || Ri) ⊕ ai and then stores {Di, Pi} into the MD’s memory. Finally, MD contains secret data {MIDi, Bi, Ci, Di, KGU, Pi}.(2)
Wearable sensor node registration phase(i)
Sj => RA: {SIDj}.(ii)
RA =>Sj: {KGS, NCK}.RA chooses a random nonceKGS and set NCK = NCK0 = 0, and then RA stores {SIDj, KGS, NCK0} into the sensor node information table and copies it to GWN.(iii)
On receipt of the message,Sj stores {KGS, NCK} into its memory.


#### 3.1.3. Login Phase

U
i keys his IDi, PWi, and imprints his biometrics BIOi∗ to MD, and MD computes Ri∗ = Rep(BIOi∗, Pi), ai∗ = Di ⊕ h(IDj || PWi || Ri∗), Ai∗ = h(PWi || Ri || ai∗), h(IDi || K || bi) = Bi ⊕ Ai∗, Ci∗ = h(h(IDi || K || bi) || Ai∗) and checks whether Ci∗ equals the stored Ci. If it is false, MD aborts the session. Otherwise, MD chooses a random nonce R1 and the current timestamp T1, computes MS1 = (R1 || SIDj) ⊕ h(MIDi || h(IDi || K || bi) || KGU), V1 = h(IDi || R1 || h(IDi || K || bi) || MIDi || KGU || T1). Finally, Ui sends message {MIDi, MS1, V1, T1} to GWN.


#### 3.1.4. Authentication and Key Agreement Phase

(1)
On receiving the login request, GWN checks the freshness of timestampT1. If not, GWN rejects the request. Otherwise, the subsequent operations of GWN are divided into three cases.Case 1: If MIDi = MIDi0, GWN extracts {IDi, bi, KGU, MIDi1} from the user information table in light of MIDi and then checks whether the one-time hash chain KGU is updated.(i)
If MIDi1 = NULL, it means that KGU has been updated. GWN computes (R1∗ || SIDj) = MS1 ⊕ h(MIDi0 || h(IDi || K || bi) || KGU), Vi∗ = h(IDi || R1∗ || h(IDi || K || bi) || MIDi0 || KGU || T1), and checks whether Vi∗ = Vi holds. If not, GWN aborts the session. Otherwise, GWN chooses a new pseudonym identity MIDi0∗ and sets MIDi1 = MIDi0, MIDi0 = MIDi0∗.(ii)
If MIDi1 ≠ NULL, it indicates KGU is not updated in the last session. GWN computes KGU∗ = h(KGU), (R1∗ || SIDj) = MSi ⊕ h(MIDi0 || h(IDi || K || bi) || KGU∗) and Vi∗ = h(IDi || R1∗ || h(IDi || K || bi) || MIDi0 || KGU || T1) and checks whether Vi∗ equals Vi. If not, GWN aborts this session. Otherwise, GWN generates a new random pseudonym identity MIDi0∗ and sets MIDi1 = MIDi0, MIDi0 = MIDi0∗, KGU = KGU∗.Case 2: If MIDi = MIDi1, GWN extracts {IDi, bi, KGU}, computes (R1∗ || SIDj) = MS1 ⊕ h(MIDi1 || (h(IDi || K || bi) || KGU), Vi∗ = h(IDi || R1∗ || h(IDi || K || bi) || MIDi1 || KGU || T1), and verifies Vi∗ ? = Vi. If not, GWN aborts this session. Otherwise, GWN selects a new random pseudonym identity MIDi0∗ and sets MIDi0 = MIDi0∗.Case 3: If MIDi1 ≠ MIDi0 and MIDi ≠ MIDi1, GWN aborts the session.
(2)
GWN ⟶Sj: {MS2, V2, NCk0}
GWN chooses a random nonceR2 and computes MS2 = (R1 || R2 || IDi || IDg) ⊕ h(KGS || SIDk || NCk0), V2 = h(IDi || IDg || R1 || R2 || KGS || NCk0). Thereafter, GWN updates KGS and NCk0 with KGS = h(KGS || SIDj) and NCk0 = NCk0 + 1, respectively.
(3)
S
j ⟶ GWN: {MS3, V3}
Upon receiving the message from GWN,Sj checks whether 1  ≤ NCk0 − NCk ≤ N holds, where N is a threshold. If it is false, Sj aborts the session. Otherwise, after setting KGS∗ = KGS, Sj computes N − 1 times KGS∗ = h(KGS∗ || SIDj). If N = 1, Sj will not execute the above hash operation. Then, Sj computes (R1 || R2 || IDi || IDg) = MS2 ⊕ h(KGS∗ || SIDj || (NCk0 −1)), V2∗ = h(IDi || IDg || R1 || R2 || KGS∗ || (NCk0 − 1)), and verifies V2∗? = V2. If it is true, Sj sets KGS = h(KGS∗ || SIDj) and NCk = NCk0. Then, Sj generates a random number R3 and computes SK = h(IDi || IDg || SIDk || R1 || R2 || R3), MS3 = R3 ⊕ h(KGS || SIDj || NCk), V3 = h(SIDj || IDi || SK || R3 || NCk), and transmits {MS3, V3} to GWN.
(4)
GWN ⟶Ui: {MS4, V4}
Upon receiving the message fromSj, GWN computes R3∗ = MS3⊕h(KGS || SIDj || NCk0), SK = h(IDi || IDg || SIDj || R1 || R2 || R3∗), V3∗ = h(SIDj || IDi || SK || R3∗ || NCk0), and verifies V3∗? = V3. If it is false, GWN aborts the session. Otherwise, GWN computes MS4 = (R2 || R3 || IDg || MIDi0) ⊕ h(R1 || h(IDi || K || bi) || KGU || MIDi1), V4 = h(IDi || SIDj || SK || R2 || MIDi0), and sends {MS4, V4} to Ui.
(5)
U
i ⟶ GWN: {V5}
Upon receiving the message,Ui computes (R2 || R3 || IDg || MIDi0) = MS4 ⊕ h(R1 || h(IDi || K || bi) || KGU || MIDi), SK = h(IDi || IDg || SIDj || R1 || R2 || R3), V4∗ = h(IDi || SIDj || SK || R2 || MIDi0), and verifies V4∗? = V4. If it is false, Ui aborts the session. Otherwise, Ui computes V5 = h(IDi || IDg || SIDj || MIDi0 || SK) and sets KGU = h(KGU) and MIDi = MIDi0. After that, Ui sends {V5} to GWN.
(6)
GWN
Upon receiving {V5}, GWN computes V5∗ = h(IDi || IDg || SIDj || MIDi0 || SK) and verifies V5∗? = V5. If it is false, GWN aborts the session. Otherwise, GWN sets KGU = h(KGU) and MIDi1 = NULL and believes that Ui has shared a session key with Sj.


#### 3.1.5. Password Change Phase

U
i inputs IDi, PWi and imprints BIOi to mobile device MD. Then, MD computes Ri∗ = Rep(BIOi, Pi), ai∗ = Di ⊕ h(IDi || PWi || Ri∗), Ai∗ = h(PWi || Ri || ai∗), h(IDi || K || bi) = Bi ⊕ Ai∗, Ci∗ = h(h(IDi || K || bi) || Ai∗), and compares Ci∗ with the stored Ci. If it is true, MD rejects the password change request. Otherwise, MD allows Ui to input a new password PWinew and computes Ainew = h(PWinew || Ri || ai), Binew = h(IDi || K || bi) ⊕ Ainew = Bi ⊕ Ai ⊕ Ainew, and Cinew = h(h(IDi || K || bi) ⊕ Ainew). Finally MD updates {Bi, Ci} with {Binew, Cinew}.


### 3.2. Cryptanalysis on Shuai et al.’s Scheme

Despite armed with three factors and formal security proof, Shuai et al.’s protocol [24] suffers from offline dictionary guessing attack and privileged insider attack and contains a serious design flaw in the password change phase.


#### 3.2.1. Offline Dictionary Guessing Attack

Suppose the attacker has obtained the lost/stolen mobile device and extracted the secret data {MIDi, Bi, Ci, Di, KGU, Pi} from it; meanwhile, he has collected biometrics BIOi of the medical professional via a malicious terminal; the attacker can mount an offline dictionary guessing attack as follows.Step 1: computesRi∗ = Rep(BIOi, Pi);Step 2: chooses a pair (IDi∗, PWi∗) from the dictionary space DID and DPW, respectively.Step 3: computesai∗ = Di ⊕ h(IDi∗ || PWi∗ || ri∗), Ai∗ = h(PWi∗ || ri∗ || Ai∗), h(IDi∗ || K || bi)∗ = Bi ⊕ Ai∗, Ci∗ = h(h(IDi∗ || K || bi)∗ || Ai∗), where Di and Bi are from the mobile device.Step 4: verifies the correctness of (IDi∗, PWi∗) pair by checking whether the computed Ci∗ equals the stored Ci. If it holds, the attacker has found the correct value of (IDi∗, PWi∗). Otherwise, the attacker repeats steps 2–4 until Ci∗ = Ci.It is clear that the time complexity of the above attack isO(|DID| ∗ |DPW| ∗ 3Th), where Th is the execution time of hash function. As analyzed in Section 2.2.1, such attack is quite efficient.


#### 3.2.2. Privileged Insider Attack

Assume privileged insider of RA being an attacker, it is easy for him to know the registration information {IDi, Ai} during the user registration phase. Moreover, he also can learn {IDi, MIDi0, MIDi1, bi, KGU} from the user information table and the registration reply message {MIDi1, Bi, Ci, KGU} from the side of RA and mount a privileged insider attack. The similar attacks have been discussed in [14, 36–38]. Using these information, the attacker can reveal the session key with the following procedure.Step 1: computesh(IDi || K || bi)∗ = Ai ⊕ Bi.Step 2: intercepts the user’s login request message {MIDi, MS1, V1, T1} and GWN’s reply message {MS4, V4} from the public channel.Step 3: acquiresR1 and SIDj by computing (R1 || SIDj)∗ = MS1 ⊕ h(MIDi || h(IDi || K || bi)∗ || KGU).Step 4: acquiresR2, R3, IDg, and MIDi0, by computing (R2 || R3 || IDg, || MIDi0)∗ = MS4 ⊕ h(R1 || h(IDi || K || bi)∗ || KGU || MIDi).Step 5: computes the session key SK =h(IDi || IDg || SIDj || R1 || R2 || R3).With the session key, the attacker can decrypt all the messages between the user and the sensor. In this way, the patient’s sensitive physiological information is exposed to the attacker. Therefore, Shuai et al.’s scheme fails to resist privileged insider attack.


#### 3.2.3. Flaw in Password Change Phase

For ease of the password change phase, Shuai et al.’s scheme also provides the password change phase forUi to change his password locally without contacting the RA. Unfortunately, similar to Ali et al.’s scheme, there is a serious security flaw in their password change phase which prevents the users who change their password from being able to log onto GWN again. Before allowing the user to change the password, the MD verifies his identity legitimacy based on the identity IDi, password PWi, and biometrics information BIOi provided by the user. If the user is legitimate, MD allows Ui to input his new password PWinew. However, this password change phase only updates Bi and Ci stored on the mobile device according to the new password and does not update Di with the new password, which is used to recover the secret random number ai of Ui during the login phase. The user either writes the secret random number ai on a paper or bears it in mind or updates Di with the new password. Thus, if he intends to recover ai by computing ai = Di ⊕ h(IDi || PWinew || Ri∗) when he logs onto GWN, he will fail because the previous PWi is different from the new PWinew, and h() is a collision-resistant function, which causes the computed value of h(IDi || PWi || Ri∗) and h(IDi || PWinew || Ri∗) not to be equal. As a result, the user who has changed his password will be rejected by MD when he intends to log onto GWN again. What is worse, the user can no longer change the password in the future, because MD also needs to verify the legitimacy of the user by recovering the user’s secret random number ai before changing his password.


## 3.1. Review of Shuai et al.’s Scheme

We will concisely review Shuai et al.’s scheme. Their protocol involves initialization phase, registration phase, login phase, authentication and key agreement phase, and password change phase.


### 3.1.1. Initialization Phase

The RA performs this phase offline. RA chooses two random numbersIDg and K as the identity and master secret key to GWN, respectively. Next, RA chooses a collision-resistant cryptographic hash function h() for all communication participants. Finally, RA chooses a unique identity SIDj for each wearable sensor node Sj and stores SIDj into Sj’s memory.


### 3.1.2. Registration Phase

This phase consists of two points, that is, user registration phase and wearable sensor node registration phase.(1)
User registration(i)
Ui => RA: {IDi, Ai}The userUi inputs his IDi, PWi, and imprints biometrics BIOi to mobile device MD. Thereafter, MD computes Gen(BIOi) = (Ri, Pi), Ai = h(PWi || Ri || ai), where Gen is a probabilistic generation procedure, Ri is a secret random key, Pi is an auxiliary string, and ai is a random secret value generated by Ui.(ii)
RA =>Ui: {MIDi, Bi, Ci, KGU}RA chooses three noncesbi, r1, r2 and sets KGU = r1, MIDi = MIDi0 = r2, MIDi1 = null. Afterwards, RA calculates Bi = Ai ⊕ h(IDi || K || bi), Ci = h(h(IDi || K || bi)||Ai), stores {IDi, MIDi0, MIDi1, bi, KGU} into the user information table, and copies this table to GWN.(iii)
Ui calculates Di = h(IDi || PWi || Ri) ⊕ ai and then stores {Di, Pi} into the MD’s memory. Finally, MD contains secret data {MIDi, Bi, Ci, Di, KGU, Pi}.(2)
Wearable sensor node registration phase(i)
Sj => RA: {SIDj}.(ii)
RA =>Sj: {KGS, NCK}.RA chooses a random nonceKGS and set NCK = NCK0 = 0, and then RA stores {SIDj, KGS, NCK0} into the sensor node information table and copies it to GWN.(iii)
On receipt of the message,Sj stores {KGS, NCK} into its memory.


### 3.1.3. Login Phase

U
i keys his IDi, PWi, and imprints his biometrics BIOi∗ to MD, and MD computes Ri∗ = Rep(BIOi∗, Pi), ai∗ = Di ⊕ h(IDj || PWi || Ri∗), Ai∗ = h(PWi || Ri || ai∗), h(IDi || K || bi) = Bi ⊕ Ai∗, Ci∗ = h(h(IDi || K || bi) || Ai∗) and checks whether Ci∗ equals the stored Ci. If it is false, MD aborts the session. Otherwise, MD chooses a random nonce R1 and the current timestamp T1, computes MS1 = (R1 || SIDj) ⊕ h(MIDi || h(IDi || K || bi) || KGU), V1 = h(IDi || R1 || h(IDi || K || bi) || MIDi || KGU || T1). Finally, Ui sends message {MIDi, MS1, V1, T1} to GWN.


### 3.1.4. Authentication and Key Agreement Phase

(1)
On receiving the login request, GWN checks the freshness of timestampT1. If not, GWN rejects the request. Otherwise, the subsequent operations of GWN are divided into three cases.Case 1: If MIDi = MIDi0, GWN extracts {IDi, bi, KGU, MIDi1} from the user information table in light of MIDi and then checks whether the one-time hash chain KGU is updated.(i)
If MIDi1 = NULL, it means that KGU has been updated. GWN computes (R1∗ || SIDj) = MS1 ⊕ h(MIDi0 || h(IDi || K || bi) || KGU), Vi∗ = h(IDi || R1∗ || h(IDi || K || bi) || MIDi0 || KGU || T1), and checks whether Vi∗ = Vi holds. If not, GWN aborts the session. Otherwise, GWN chooses a new pseudonym identity MIDi0∗ and sets MIDi1 = MIDi0, MIDi0 = MIDi0∗.(ii)
If MIDi1 ≠ NULL, it indicates KGU is not updated in the last session. GWN computes KGU∗ = h(KGU), (R1∗ || SIDj) = MSi ⊕ h(MIDi0 || h(IDi || K || bi) || KGU∗) and Vi∗ = h(IDi || R1∗ || h(IDi || K || bi) || MIDi0 || KGU || T1) and checks whether Vi∗ equals Vi. If not, GWN aborts this session. Otherwise, GWN generates a new random pseudonym identity MIDi0∗ and sets MIDi1 = MIDi0, MIDi0 = MIDi0∗, KGU = KGU∗.Case 2: If MIDi = MIDi1, GWN extracts {IDi, bi, KGU}, computes (R1∗ || SIDj) = MS1 ⊕ h(MIDi1 || (h(IDi || K || bi) || KGU), Vi∗ = h(IDi || R1∗ || h(IDi || K || bi) || MIDi1 || KGU || T1), and verifies Vi∗ ? = Vi. If not, GWN aborts this session. Otherwise, GWN selects a new random pseudonym identity MIDi0∗ and sets MIDi0 = MIDi0∗.Case 3: If MIDi1 ≠ MIDi0 and MIDi ≠ MIDi1, GWN aborts the session.
(2)
GWN ⟶Sj: {MS2, V2, NCk0}
GWN chooses a random nonceR2 and computes MS2 = (R1 || R2 || IDi || IDg) ⊕ h(KGS || SIDk || NCk0), V2 = h(IDi || IDg || R1 || R2 || KGS || NCk0). Thereafter, GWN updates KGS and NCk0 with KGS = h(KGS || SIDj) and NCk0 = NCk0 + 1, respectively.
(3)
S
j ⟶ GWN: {MS3, V3}
Upon receiving the message from GWN,Sj checks whether 1  ≤ NCk0 − NCk ≤ N holds, where N is a threshold. If it is false, Sj aborts the session. Otherwise, after setting KGS∗ = KGS, Sj computes N − 1 times KGS∗ = h(KGS∗ || SIDj). If N = 1, Sj will not execute the above hash operation. Then, Sj computes (R1 || R2 || IDi || IDg) = MS2 ⊕ h(KGS∗ || SIDj || (NCk0 −1)), V2∗ = h(IDi || IDg || R1 || R2 || KGS∗ || (NCk0 − 1)), and verifies V2∗? = V2. If it is true, Sj sets KGS = h(KGS∗ || SIDj) and NCk = NCk0. Then, Sj generates a random number R3 and computes SK = h(IDi || IDg || SIDk || R1 || R2 || R3), MS3 = R3 ⊕ h(KGS || SIDj || NCk), V3 = h(SIDj || IDi || SK || R3 || NCk), and transmits {MS3, V3} to GWN.
(4)
GWN ⟶Ui: {MS4, V4}
Upon receiving the message fromSj, GWN computes R3∗ = MS3⊕h(KGS || SIDj || NCk0), SK = h(IDi || IDg || SIDj || R1 || R2 || R3∗), V3∗ = h(SIDj || IDi || SK || R3∗ || NCk0), and verifies V3∗? = V3. If it is false, GWN aborts the session. Otherwise, GWN computes MS4 = (R2 || R3 || IDg || MIDi0) ⊕ h(R1 || h(IDi || K || bi) || KGU || MIDi1), V4 = h(IDi || SIDj || SK || R2 || MIDi0), and sends {MS4, V4} to Ui.
(5)
U
i ⟶ GWN: {V5}
Upon receiving the message,Ui computes (R2 || R3 || IDg || MIDi0) = MS4 ⊕ h(R1 || h(IDi || K || bi) || KGU || MIDi), SK = h(IDi || IDg || SIDj || R1 || R2 || R3), V4∗ = h(IDi || SIDj || SK || R2 || MIDi0), and verifies V4∗? = V4. If it is false, Ui aborts the session. Otherwise, Ui computes V5 = h(IDi || IDg || SIDj || MIDi0 || SK) and sets KGU = h(KGU) and MIDi = MIDi0. After that, Ui sends {V5} to GWN.
(6)
GWN
Upon receiving {V5}, GWN computes V5∗ = h(IDi || IDg || SIDj || MIDi0 || SK) and verifies V5∗? = V5. If it is false, GWN aborts the session. Otherwise, GWN sets KGU = h(KGU) and MIDi1 = NULL and believes that Ui has shared a session key with Sj.


### 3.1.5. Password Change Phase

U
i inputs IDi, PWi and imprints BIOi to mobile device MD. Then, MD computes Ri∗ = Rep(BIOi, Pi), ai∗ = Di ⊕ h(IDi || PWi || Ri∗), Ai∗ = h(PWi || Ri || ai∗), h(IDi || K || bi) = Bi ⊕ Ai∗, Ci∗ = h(h(IDi || K || bi) || Ai∗), and compares Ci∗ with the stored Ci. If it is true, MD rejects the password change request. Otherwise, MD allows Ui to input a new password PWinew and computes Ainew = h(PWinew || Ri || ai), Binew = h(IDi || K || bi) ⊕ Ainew = Bi ⊕ Ai ⊕ Ainew, and Cinew = h(h(IDi || K || bi) ⊕ Ainew). Finally MD updates {Bi, Ci} with {Binew, Cinew}.


## 3.1.1. Initialization Phase

The RA performs this phase offline. RA chooses two random numbersIDg and K as the identity and master secret key to GWN, respectively. Next, RA chooses a collision-resistant cryptographic hash function h() for all communication participants. Finally, RA chooses a unique identity SIDj for each wearable sensor node Sj and stores SIDj into Sj’s memory.


## 3.1.2. Registration Phase

This phase consists of two points, that is, user registration phase and wearable sensor node registration phase.(1)
User registration(i)
Ui => RA: {IDi, Ai}The userUi inputs his IDi, PWi, and imprints biometrics BIOi to mobile device MD. Thereafter, MD computes Gen(BIOi) = (Ri, Pi), Ai = h(PWi || Ri || ai), where Gen is a probabilistic generation procedure, Ri is a secret random key, Pi is an auxiliary string, and ai is a random secret value generated by Ui.(ii)
RA =>Ui: {MIDi, Bi, Ci, KGU}RA chooses three noncesbi, r1, r2 and sets KGU = r1, MIDi = MIDi0 = r2, MIDi1 = null. Afterwards, RA calculates Bi = Ai ⊕ h(IDi || K || bi), Ci = h(h(IDi || K || bi)||Ai), stores {IDi, MIDi0, MIDi1, bi, KGU} into the user information table, and copies this table to GWN.(iii)
Ui calculates Di = h(IDi || PWi || Ri) ⊕ ai and then stores {Di, Pi} into the MD’s memory. Finally, MD contains secret data {MIDi, Bi, Ci, Di, KGU, Pi}.(2)
Wearable sensor node registration phase(i)
Sj => RA: {SIDj}.(ii)
RA =>Sj: {KGS, NCK}.RA chooses a random nonceKGS and set NCK = NCK0 = 0, and then RA stores {SIDj, KGS, NCK0} into the sensor node information table and copies it to GWN.(iii)
On receipt of the message,Sj stores {KGS, NCK} into its memory.


## 3.1.3. Login Phase

U
i keys his IDi, PWi, and imprints his biometrics BIOi∗ to MD, and MD computes Ri∗ = Rep(BIOi∗, Pi), ai∗ = Di ⊕ h(IDj || PWi || Ri∗), Ai∗ = h(PWi || Ri || ai∗), h(IDi || K || bi) = Bi ⊕ Ai∗, Ci∗ = h(h(IDi || K || bi) || Ai∗) and checks whether Ci∗ equals the stored Ci. If it is false, MD aborts the session. Otherwise, MD chooses a random nonce R1 and the current timestamp T1, computes MS1 = (R1 || SIDj) ⊕ h(MIDi || h(IDi || K || bi) || KGU), V1 = h(IDi || R1 || h(IDi || K || bi) || MIDi || KGU || T1). Finally, Ui sends message {MIDi, MS1, V1, T1} to GWN.


## 3.1.4. Authentication and Key Agreement Phase

(1)
On receiving the login request, GWN checks the freshness of timestampT1. If not, GWN rejects the request. Otherwise, the subsequent operations of GWN are divided into three cases.Case 1: If MIDi = MIDi0, GWN extracts {IDi, bi, KGU, MIDi1} from the user information table in light of MIDi and then checks whether the one-time hash chain KGU is updated.(i)
If MIDi1 = NULL, it means that KGU has been updated. GWN computes (R1∗ || SIDj) = MS1 ⊕ h(MIDi0 || h(IDi || K || bi) || KGU), Vi∗ = h(IDi || R1∗ || h(IDi || K || bi) || MIDi0 || KGU || T1), and checks whether Vi∗ = Vi holds. If not, GWN aborts the session. Otherwise, GWN chooses a new pseudonym identity MIDi0∗ and sets MIDi1 = MIDi0, MIDi0 = MIDi0∗.(ii)
If MIDi1 ≠ NULL, it indicates KGU is not updated in the last session. GWN computes KGU∗ = h(KGU), (R1∗ || SIDj) = MSi ⊕ h(MIDi0 || h(IDi || K || bi) || KGU∗) and Vi∗ = h(IDi || R1∗ || h(IDi || K || bi) || MIDi0 || KGU || T1) and checks whether Vi∗ equals Vi. If not, GWN aborts this session. Otherwise, GWN generates a new random pseudonym identity MIDi0∗ and sets MIDi1 = MIDi0, MIDi0 = MIDi0∗, KGU = KGU∗.Case 2: If MIDi = MIDi1, GWN extracts {IDi, bi, KGU}, computes (R1∗ || SIDj) = MS1 ⊕ h(MIDi1 || (h(IDi || K || bi) || KGU), Vi∗ = h(IDi || R1∗ || h(IDi || K || bi) || MIDi1 || KGU || T1), and verifies Vi∗ ? = Vi. If not, GWN aborts this session. Otherwise, GWN selects a new random pseudonym identity MIDi0∗ and sets MIDi0 = MIDi0∗.Case 3: If MIDi1 ≠ MIDi0 and MIDi ≠ MIDi1, GWN aborts the session.
(2)
GWN ⟶Sj: {MS2, V2, NCk0}
GWN chooses a random nonceR2 and computes MS2 = (R1 || R2 || IDi || IDg) ⊕ h(KGS || SIDk || NCk0), V2 = h(IDi || IDg || R1 || R2 || KGS || NCk0). Thereafter, GWN updates KGS and NCk0 with KGS = h(KGS || SIDj) and NCk0 = NCk0 + 1, respectively.
(3)
S
j ⟶ GWN: {MS3, V3}
Upon receiving the message from GWN,Sj checks whether 1  ≤ NCk0 − NCk ≤ N holds, where N is a threshold. If it is false, Sj aborts the session. Otherwise, after setting KGS∗ = KGS, Sj computes N − 1 times KGS∗ = h(KGS∗ || SIDj). If N = 1, Sj will not execute the above hash operation. Then, Sj computes (R1 || R2 || IDi || IDg) = MS2 ⊕ h(KGS∗ || SIDj || (NCk0 −1)), V2∗ = h(IDi || IDg || R1 || R2 || KGS∗ || (NCk0 − 1)), and verifies V2∗? = V2. If it is true, Sj sets KGS = h(KGS∗ || SIDj) and NCk = NCk0. Then, Sj generates a random number R3 and computes SK = h(IDi || IDg || SIDk || R1 || R2 || R3), MS3 = R3 ⊕ h(KGS || SIDj || NCk), V3 = h(SIDj || IDi || SK || R3 || NCk), and transmits {MS3, V3} to GWN.
(4)
GWN ⟶Ui: {MS4, V4}
Upon receiving the message fromSj, GWN computes R3∗ = MS3⊕h(KGS || SIDj || NCk0), SK = h(IDi || IDg || SIDj || R1 || R2 || R3∗), V3∗ = h(SIDj || IDi || SK || R3∗ || NCk0), and verifies V3∗? = V3. If it is false, GWN aborts the session. Otherwise, GWN computes MS4 = (R2 || R3 || IDg || MIDi0) ⊕ h(R1 || h(IDi || K || bi) || KGU || MIDi1), V4 = h(IDi || SIDj || SK || R2 || MIDi0), and sends {MS4, V4} to Ui.
(5)
U
i ⟶ GWN: {V5}
Upon receiving the message,Ui computes (R2 || R3 || IDg || MIDi0) = MS4 ⊕ h(R1 || h(IDi || K || bi) || KGU || MIDi), SK = h(IDi || IDg || SIDj || R1 || R2 || R3), V4∗ = h(IDi || SIDj || SK || R2 || MIDi0), and verifies V4∗? = V4. If it is false, Ui aborts the session. Otherwise, Ui computes V5 = h(IDi || IDg || SIDj || MIDi0 || SK) and sets KGU = h(KGU) and MIDi = MIDi0. After that, Ui sends {V5} to GWN.
(6)
GWN
Upon receiving {V5}, GWN computes V5∗ = h(IDi || IDg || SIDj || MIDi0 || SK) and verifies V5∗? = V5. If it is false, GWN aborts the session. Otherwise, GWN sets KGU = h(KGU) and MIDi1 = NULL and believes that Ui has shared a session key with Sj.


## 3.1.5. Password Change Phase

U
i inputs IDi, PWi and imprints BIOi to mobile device MD. Then, MD computes Ri∗ = Rep(BIOi, Pi), ai∗ = Di ⊕ h(IDi || PWi || Ri∗), Ai∗ = h(PWi || Ri || ai∗), h(IDi || K || bi) = Bi ⊕ Ai∗, Ci∗ = h(h(IDi || K || bi) || Ai∗), and compares Ci∗ with the stored Ci. If it is true, MD rejects the password change request. Otherwise, MD allows Ui to input a new password PWinew and computes Ainew = h(PWinew || Ri || ai), Binew = h(IDi || K || bi) ⊕ Ainew = Bi ⊕ Ai ⊕ Ainew, and Cinew = h(h(IDi || K || bi) ⊕ Ainew). Finally MD updates {Bi, Ci} with {Binew, Cinew}.


## 3.2. Cryptanalysis on Shuai et al.’s Scheme

Despite armed with three factors and formal security proof, Shuai et al.’s protocol [24] suffers from offline dictionary guessing attack and privileged insider attack and contains a serious design flaw in the password change phase.


### 3.2.1. Offline Dictionary Guessing Attack

Suppose the attacker has obtained the lost/stolen mobile device and extracted the secret data {MIDi, Bi, Ci, Di, KGU, Pi} from it; meanwhile, he has collected biometrics BIOi of the medical professional via a malicious terminal; the attacker can mount an offline dictionary guessing attack as follows.Step 1: computesRi∗ = Rep(BIOi, Pi);Step 2: chooses a pair (IDi∗, PWi∗) from the dictionary space DID and DPW, respectively.Step 3: computesai∗ = Di ⊕ h(IDi∗ || PWi∗ || ri∗), Ai∗ = h(PWi∗ || ri∗ || Ai∗), h(IDi∗ || K || bi)∗ = Bi ⊕ Ai∗, Ci∗ = h(h(IDi∗ || K || bi)∗ || Ai∗), where Di and Bi are from the mobile device.Step 4: verifies the correctness of (IDi∗, PWi∗) pair by checking whether the computed Ci∗ equals the stored Ci. If it holds, the attacker has found the correct value of (IDi∗, PWi∗). Otherwise, the attacker repeats steps 2–4 until Ci∗ = Ci.It is clear that the time complexity of the above attack isO(|DID| ∗ |DPW| ∗ 3Th), where Th is the execution time of hash function. As analyzed in Section 2.2.1, such attack is quite efficient.


### 3.2.2. Privileged Insider Attack

Assume privileged insider of RA being an attacker, it is easy for him to know the registration information {IDi, Ai} during the user registration phase. Moreover, he also can learn {IDi, MIDi0, MIDi1, bi, KGU} from the user information table and the registration reply message {MIDi1, Bi, Ci, KGU} from the side of RA and mount a privileged insider attack. The similar attacks have been discussed in [14, 36–38]. Using these information, the attacker can reveal the session key with the following procedure.Step 1: computesh(IDi || K || bi)∗ = Ai ⊕ Bi.Step 2: intercepts the user’s login request message {MIDi, MS1, V1, T1} and GWN’s reply message {MS4, V4} from the public channel.Step 3: acquiresR1 and SIDj by computing (R1 || SIDj)∗ = MS1 ⊕ h(MIDi || h(IDi || K || bi)∗ || KGU).Step 4: acquiresR2, R3, IDg, and MIDi0, by computing (R2 || R3 || IDg, || MIDi0)∗ = MS4 ⊕ h(R1 || h(IDi || K || bi)∗ || KGU || MIDi).Step 5: computes the session key SK =h(IDi || IDg || SIDj || R1 || R2 || R3).With the session key, the attacker can decrypt all the messages between the user and the sensor. In this way, the patient’s sensitive physiological information is exposed to the attacker. Therefore, Shuai et al.’s scheme fails to resist privileged insider attack.


### 3.2.3. Flaw in Password Change Phase

For ease of the password change phase, Shuai et al.’s scheme also provides the password change phase forUi to change his password locally without contacting the RA. Unfortunately, similar to Ali et al.’s scheme, there is a serious security flaw in their password change phase which prevents the users who change their password from being able to log onto GWN again. Before allowing the user to change the password, the MD verifies his identity legitimacy based on the identity IDi, password PWi, and biometrics information BIOi provided by the user. If the user is legitimate, MD allows Ui to input his new password PWinew. However, this password change phase only updates Bi and Ci stored on the mobile device according to the new password and does not update Di with the new password, which is used to recover the secret random number ai of Ui during the login phase. The user either writes the secret random number ai on a paper or bears it in mind or updates Di with the new password. Thus, if he intends to recover ai by computing ai = Di ⊕ h(IDi || PWinew || Ri∗) when he logs onto GWN, he will fail because the previous PWi is different from the new PWinew, and h() is a collision-resistant function, which causes the computed value of h(IDi || PWi || Ri∗) and h(IDi || PWinew || Ri∗) not to be equal. As a result, the user who has changed his password will be rejected by MD when he intends to log onto GWN again. What is worse, the user can no longer change the password in the future, because MD also needs to verify the legitimacy of the user by recovering the user’s secret random number ai before changing his password.


## 3.2.1. Offline Dictionary Guessing Attack

Suppose the attacker has obtained the lost/stolen mobile device and extracted the secret data {MIDi, Bi, Ci, Di, KGU, Pi} from it; meanwhile, he has collected biometrics BIOi of the medical professional via a malicious terminal; the attacker can mount an offline dictionary guessing attack as follows.Step 1: computesRi∗ = Rep(BIOi, Pi);Step 2: chooses a pair (IDi∗, PWi∗) from the dictionary space DID and DPW, respectively.Step 3: computesai∗ = Di ⊕ h(IDi∗ || PWi∗ || ri∗), Ai∗ = h(PWi∗ || ri∗ || Ai∗), h(IDi∗ || K || bi)∗ = Bi ⊕ Ai∗, Ci∗ = h(h(IDi∗ || K || bi)∗ || Ai∗), where Di and Bi are from the mobile device.Step 4: verifies the correctness of (IDi∗, PWi∗) pair by checking whether the computed Ci∗ equals the stored Ci. If it holds, the attacker has found the correct value of (IDi∗, PWi∗). Otherwise, the attacker repeats steps 2–4 until Ci∗ = Ci.It is clear that the time complexity of the above attack isO(|DID| ∗ |DPW| ∗ 3Th), where Th is the execution time of hash function. As analyzed in Section 2.2.1, such attack is quite efficient.


## 3.2.2. Privileged Insider Attack

Assume privileged insider of RA being an attacker, it is easy for him to know the registration information {IDi, Ai} during the user registration phase. Moreover, he also can learn {IDi, MIDi0, MIDi1, bi, KGU} from the user information table and the registration reply message {MIDi1, Bi, Ci, KGU} from the side of RA and mount a privileged insider attack. The similar attacks have been discussed in [14, 36–38]. Using these information, the attacker can reveal the session key with the following procedure.Step 1: computesh(IDi || K || bi)∗ = Ai ⊕ Bi.Step 2: intercepts the user’s login request message {MIDi, MS1, V1, T1} and GWN’s reply message {MS4, V4} from the public channel.Step 3: acquiresR1 and SIDj by computing (R1 || SIDj)∗ = MS1 ⊕ h(MIDi || h(IDi || K || bi)∗ || KGU).Step 4: acquiresR2, R3, IDg, and MIDi0, by computing (R2 || R3 || IDg, || MIDi0)∗ = MS4 ⊕ h(R1 || h(IDi || K || bi)∗ || KGU || MIDi).Step 5: computes the session key SK =h(IDi || IDg || SIDj || R1 || R2 || R3).With the session key, the attacker can decrypt all the messages between the user and the sensor. In this way, the patient’s sensitive physiological information is exposed to the attacker. Therefore, Shuai et al.’s scheme fails to resist privileged insider attack.


## 3.2.3. Flaw in Password Change Phase

For ease of the password change phase, Shuai et al.’s scheme also provides the password change phase forUi to change his password locally without contacting the RA. Unfortunately, similar to Ali et al.’s scheme, there is a serious security flaw in their password change phase which prevents the users who change their password from being able to log onto GWN again. Before allowing the user to change the password, the MD verifies his identity legitimacy based on the identity IDi, password PWi, and biometrics information BIOi provided by the user. If the user is legitimate, MD allows Ui to input his new password PWinew. However, this password change phase only updates Bi and Ci stored on the mobile device according to the new password and does not update Di with the new password, which is used to recover the secret random number ai of Ui during the login phase. The user either writes the secret random number ai on a paper or bears it in mind or updates Di with the new password. Thus, if he intends to recover ai by computing ai = Di ⊕ h(IDi || PWinew || Ri∗) when he logs onto GWN, he will fail because the previous PWi is different from the new PWinew, and h() is a collision-resistant function, which causes the computed value of h(IDi || PWi || Ri∗) and h(IDi || PWinew || Ri∗) not to be equal. As a result, the user who has changed his password will be rejected by MD when he intends to log onto GWN again. What is worse, the user can no longer change the password in the future, because MD also needs to verify the legitimacy of the user by recovering the user’s secret random number ai before changing his password.


## 4. Countermeasures

In order to address the security weaknesses in Ali et al.’s protocol and Shuai et al.’s protocol, we provide several possible countermeasures in this section.


### 4.1. Countermeasures to Offline Dictionary Guessing Attack

Our previous analysis shows that neither Ali et al.’s scheme nor Shuai et al.’s Scheme can provide truly three-factor security; that is, the attacker can launch an offline dictionary guessing attack to acquire the user’s identity and password if he obtains the user’s smartcard (or mobile device) and biometrics somehow. The root cause of this attack described above is that the password verifierDi = h(RFWi || Rg || Fi) of Ali et al.’s protocol and Ci = h(h(IDi || K || bi) || Ai) are stored in a smartcard (mobile device). Consequently, if the smartcard is obtained by the attacker, he will try to make a breach in the password verifier for offline dictionary guessing attack.To thwart this security weakness without radical improvement while keeping usability, a feasible countermeasure is to utilize “fuzzy verifier” technique [25]. In the following, taking Ali et al.’s protocol as a case study to show how to integrate fuzzy verifier, we revise the password verifier Di as Di = h(h(RPWi || Rg || Fi) mod n) during the user registration phase, where n represents the space size of (IDi, PWi) pair. If the attacker has obtained the user’s smartcard and biometrics, he picks up a pair (IDi∗, PWi∗) from DID and DPW to perform offline dictionary guessing attack as described in Section 2.2.1. However, it is hard for the attacker to find a correct pair (IDi, PWi) since there are (|DID| ∗ |DPW|)/n ≈ 232 candidates of (IDi, PWi) pair (suppose n = 28, |DID| = |DPW| = 26 [25, 33]). Someone may question if the attacker will just pick up an incorrect pair of (IDi, PWi) but can satisfy Di = h(h(RPWi || Rg || Fi) mod n). The probability of such an event is 1/28. Moreover, if the user is asked to enter the old/new password twice, and the hash function h() responds as a random oracle, the probability will greatly reduce to (1/28)2 = 1/216 [25, 33, 34]. Therefore, the fuzzy verifier that provides adequate candidate can effectively prevent the attacker from mounting offline dictionary guessing attack successfully. In addition, the effectiveness of fuzzy verifier technique has been discussed and verified in Section V-B of [24], and the interested readers can refer to it for more information.


### 4.2. Countermeasures to Desynchronization Attack

We have demonstrated that Ali et al.’s protocol is insecure against desynchronization attack in Section2.2.2. Specifically, to provide user anonymity and untraceability, GWN chooses a new dynamic identity DIDin, computes the corresponding Cin, and stores {DIDin, Cin} in its database. Meanwhile, to keep consistency in the next login, the user needs to update {DIDin, Cin} in the smartcard simultaneously. However, Ali et al.’s protocol only considers the case where all messages in the ideal situation are successfully received by the receiver. If the attacker blocks the message {M9, M10} from the GWN to the user to break the consistency in the authentication process, the authenticated parameters {DIDin, Cin} are made to be different between GWN and the user Ui, which means Ui could not log onto GWN ever since.To cope with such an attack, an effective countermeasure is to avoid updating the user dynamic identity DIDi simultaneously on both sides of communication parties. That is, during the authentication phase, GWN chooses a new dynamic identity DIDin for Ui, but does not need to save it to the database. After decrypting M9, Ui conceals DIDin with the new random number Mi and other information generated in each login, stores it in the smartcard, and restores DIDin on the next login. If message {M9, M10} is blocked, on the one hand, the attacker cannot obtain the new DIDin because M9 is encrypted; on the other hand, Ui does not update DIDi in the smartcard since he has not received {M9, M10}. When Ui logs onto GWN next time, GWN can still recover Mi with the stored DIDi instead of DIDin. In this way, although the attacker attempts to break the synchronization, he will not succeed because the dynamic identity information of the user has not been saved in GWN, and GWN will perform the subsequent procedure regardless of whether {M9, M10} is blocked or not. Hence, the desynchronization attack is thwarted effectively. It is worth noting that we only give the main idea of the measure, not a complete scheme, because the detailed solution requires a long paper. In addition, their user registration phase and the password change also need to be revised correspondingly, and we omitted them due to the space constraints.


### 4.3. Countermeasures to Privileged Insider Attack

Our aforementioned analysis shows that both of the two schemes suffer from privileged insider attack. The root cause is that to improve the computation efficiency, they use lightweight operations based on hash function and random numbers to generate the session key, which makes the leakage of a small amount of secret data easily lead to the leakage of other secret data. To thwart this attack, the public-key operations such as modular exponentiation or elliptic curve point multiplication should be adopted in their scheme [31]. We take the GWN and sensor side as the server side and keep the user as the client side; according to [31], modular exponentiation operation should be performed at least twice on the server side. Take Ali et al.’s scheme as an example and use elliptic curve point multiplication; without requiring radical improvement, the main idea of overcoming privileged insider attack during the login and authentication phase is sketched as follows.Step 1: after generating the random nonceMi in the login phase, Ui computes W1 = MiP and sends the message containing W1 to GWN. P is a generator in elliptic curve group over a finite field.Step 2: because GWN does not need to participate in negotiating session key, GWN sends the message containingW1 to Sj after the user’s identity legitimacy verification is passed.Step 3: if the legitimacy authentication of GWN is passed, the sensorSj selects the random number Vi and calculates W2 = ViP and computes the session key SK = h(h(RPWi || Fi) || W1 || W2 || ViW1) = h(h(RPWi || Fi) || MiP || ViP || ViMiP). Afterwards, Sj sends a message containing W2 to Ui via GWN.Step 4: if the legitimacy of GWN andSj is ensured, Ui computes the session key SK = h(h(RPWi || Fi) || W1 || W2 || MiW2) = h(h(RPWi || Fi) || MiP || ViP || MiViP).If the attacker eavesdropsW1 and W2 from the public channel and intends to find Mi and Vi from W1 and W2, respectively, it is infeasible since he has to resolve elliptic curve discrete logarithm problem [2]; and if he intends to compute MiViP from W1 and W2, it is also impossible since he faces the hardness of elliptic curve computational Diffie-Hellman problem [2].


### 4.4. Countermeasures to Flaw in Password Change Phase

As we have analyzed before, both Ali et al.’s scheme and Shuai et al.’s scheme contain serious flaws in their password change phase which renders the user unable to log onto GWN again after changing his password. The reason is that none of their password change phase are designed to recover the secret random number for login. Thus, the countermeasures to fix these design flaws are obvious, and we describe them as follows.(1)
For Ali et al.’s protocol,Rnnew = ri ⊕ h(IDi∗ || PWinew || H(BIOi)) should be added in step 2 of the password change phase, and Rnnew is also needed to replace the previous Rn in the smartcard.(2)
For Shuai et al.’s protocol, when performing step 2 of the password change phase, MD needs to additionally computeDinew = ai ⊕ h(IDi || PWinew || Ri) and replaces Di with Dinew in MD.


## 4.1. Countermeasures to Offline Dictionary Guessing Attack

Our previous analysis shows that neither Ali et al.’s scheme nor Shuai et al.’s Scheme can provide truly three-factor security; that is, the attacker can launch an offline dictionary guessing attack to acquire the user’s identity and password if he obtains the user’s smartcard (or mobile device) and biometrics somehow. The root cause of this attack described above is that the password verifierDi = h(RFWi || Rg || Fi) of Ali et al.’s protocol and Ci = h(h(IDi || K || bi) || Ai) are stored in a smartcard (mobile device). Consequently, if the smartcard is obtained by the attacker, he will try to make a breach in the password verifier for offline dictionary guessing attack.To thwart this security weakness without radical improvement while keeping usability, a feasible countermeasure is to utilize “fuzzy verifier” technique [25]. In the following, taking Ali et al.’s protocol as a case study to show how to integrate fuzzy verifier, we revise the password verifier Di as Di = h(h(RPWi || Rg || Fi) mod n) during the user registration phase, where n represents the space size of (IDi, PWi) pair. If the attacker has obtained the user’s smartcard and biometrics, he picks up a pair (IDi∗, PWi∗) from DID and DPW to perform offline dictionary guessing attack as described in Section 2.2.1. However, it is hard for the attacker to find a correct pair (IDi, PWi) since there are (|DID| ∗ |DPW|)/n ≈ 232 candidates of (IDi, PWi) pair (suppose n = 28, |DID| = |DPW| = 26 [25, 33]). Someone may question if the attacker will just pick up an incorrect pair of (IDi, PWi) but can satisfy Di = h(h(RPWi || Rg || Fi) mod n). The probability of such an event is 1/28. Moreover, if the user is asked to enter the old/new password twice, and the hash function h() responds as a random oracle, the probability will greatly reduce to (1/28)2 = 1/216 [25, 33, 34]. Therefore, the fuzzy verifier that provides adequate candidate can effectively prevent the attacker from mounting offline dictionary guessing attack successfully. In addition, the effectiveness of fuzzy verifier technique has been discussed and verified in Section V-B of [24], and the interested readers can refer to it for more information.


## 4.2. Countermeasures to Desynchronization Attack

We have demonstrated that Ali et al.’s protocol is insecure against desynchronization attack in Section2.2.2. Specifically, to provide user anonymity and untraceability, GWN chooses a new dynamic identity DIDin, computes the corresponding Cin, and stores {DIDin, Cin} in its database. Meanwhile, to keep consistency in the next login, the user needs to update {DIDin, Cin} in the smartcard simultaneously. However, Ali et al.’s protocol only considers the case where all messages in the ideal situation are successfully received by the receiver. If the attacker blocks the message {M9, M10} from the GWN to the user to break the consistency in the authentication process, the authenticated parameters {DIDin, Cin} are made to be different between GWN and the user Ui, which means Ui could not log onto GWN ever since.To cope with such an attack, an effective countermeasure is to avoid updating the user dynamic identity DIDi simultaneously on both sides of communication parties. That is, during the authentication phase, GWN chooses a new dynamic identity DIDin for Ui, but does not need to save it to the database. After decrypting M9, Ui conceals DIDin with the new random number Mi and other information generated in each login, stores it in the smartcard, and restores DIDin on the next login. If message {M9, M10} is blocked, on the one hand, the attacker cannot obtain the new DIDin because M9 is encrypted; on the other hand, Ui does not update DIDi in the smartcard since he has not received {M9, M10}. When Ui logs onto GWN next time, GWN can still recover Mi with the stored DIDi instead of DIDin. In this way, although the attacker attempts to break the synchronization, he will not succeed because the dynamic identity information of the user has not been saved in GWN, and GWN will perform the subsequent procedure regardless of whether {M9, M10} is blocked or not. Hence, the desynchronization attack is thwarted effectively. It is worth noting that we only give the main idea of the measure, not a complete scheme, because the detailed solution requires a long paper. In addition, their user registration phase and the password change also need to be revised correspondingly, and we omitted them due to the space constraints.


## 4.3. Countermeasures to Privileged Insider Attack

Our aforementioned analysis shows that both of the two schemes suffer from privileged insider attack. The root cause is that to improve the computation efficiency, they use lightweight operations based on hash function and random numbers to generate the session key, which makes the leakage of a small amount of secret data easily lead to the leakage of other secret data. To thwart this attack, the public-key operations such as modular exponentiation or elliptic curve point multiplication should be adopted in their scheme [31]. We take the GWN and sensor side as the server side and keep the user as the client side; according to [31], modular exponentiation operation should be performed at least twice on the server side. Take Ali et al.’s scheme as an example and use elliptic curve point multiplication; without requiring radical improvement, the main idea of overcoming privileged insider attack during the login and authentication phase is sketched as follows.Step 1: after generating the random nonceMi in the login phase, Ui computes W1 = MiP and sends the message containing W1 to GWN. P is a generator in elliptic curve group over a finite field.Step 2: because GWN does not need to participate in negotiating session key, GWN sends the message containingW1 to Sj after the user’s identity legitimacy verification is passed.Step 3: if the legitimacy authentication of GWN is passed, the sensorSj selects the random number Vi and calculates W2 = ViP and computes the session key SK = h(h(RPWi || Fi) || W1 || W2 || ViW1) = h(h(RPWi || Fi) || MiP || ViP || ViMiP). Afterwards, Sj sends a message containing W2 to Ui via GWN.Step 4: if the legitimacy of GWN andSj is ensured, Ui computes the session key SK = h(h(RPWi || Fi) || W1 || W2 || MiW2) = h(h(RPWi || Fi) || MiP || ViP || MiViP).If the attacker eavesdropsW1 and W2 from the public channel and intends to find Mi and Vi from W1 and W2, respectively, it is infeasible since he has to resolve elliptic curve discrete logarithm problem [2]; and if he intends to compute MiViP from W1 and W2, it is also impossible since he faces the hardness of elliptic curve computational Diffie-Hellman problem [2].


## 4.4. Countermeasures to Flaw in Password Change Phase

As we have analyzed before, both Ali et al.’s scheme and Shuai et al.’s scheme contain serious flaws in their password change phase which renders the user unable to log onto GWN again after changing his password. The reason is that none of their password change phase are designed to recover the secret random number for login. Thus, the countermeasures to fix these design flaws are obvious, and we describe them as follows.(1)
For Ali et al.’s protocol,Rnnew = ri ⊕ h(IDi∗ || PWinew || H(BIOi)) should be added in step 2 of the password change phase, and Rnnew is also needed to replace the previous Rn in the smartcard.(2)
For Shuai et al.’s protocol, when performing step 2 of the password change phase, MD needs to additionally computeDinew = ai ⊕ h(IDi || PWinew || Ri) and replaces Di with Dinew in MD.


## 5. Conclusion

In the past few years, many three-factor authentication protocols have been proposed for WMSN and the similar environment. But, most of them are vulnerable to some inherent security defects more or less. In this paper, we briefly review and cryptanalyze the two quite recent and typical authentication protocols with key agreement presented by Ali et al. and Shuai et al., respectively. Firstly, we point out that although Ali et al. tried to overcome the security defects in the previous scheme and provide security proof with BAN logic and simulation under AVISPA, they are still vulnerable to offline dictionary guessing attack, desynchronization attack, and privileged insider attack and even contain a serious design flaw in the password change phase. Secondly, we demonstrate that Shuai et al.’s protocol is also insecure against offline dictionary guessing attack and privileged insider attack and has a design flaw in the password change phase. Thereafter, we put forward some possible countermeasures to eliminate these security weaknesses. Note that in this paper, the assumption that an attacker can simultaneously obtain both the secret information on the smartcard (mobile device) and the biometrics of the user is a trivial case, but it still cannot be ignored since security is one of the most important factors to consider in designing a protocol. Otherwise, if it is not based on this assumption, the attacker will require higher time complexity when carrying out offline ID and password dictionary attacks on the two protocols. Our efforts highlight that it is important to be aware of potential security risks in designing authentication protocols for WMSN and the similar kinds. This also indicates the necessity of our work.



---

*Source: 5047379-2020-02-19.xml*