# A Provably Secure Three-Factor Authentication Protocol for Wireless Sensor Networks

Authors: Tsu-Yang Wu; Lei Yang; Zhiyuan Lee; Shu-Chuan Chu; Saru Kumari; Sachin Kumar
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

The wireless sensor network is a network composed of sensor nodes self-organizing through the application of wireless communication technology. The application of wireless sensor networks (WSNs) requires high security, but the transmission of sensitive data may be exposed to the adversary. Therefore, to guarantee the security of information transmission, researchers propose numerous security authentication protocols. Recently, Wu et al. proposed a new three-factor authentication protocol for WSNs. However, we find that their protocol cannot resist key compromise impersonation attacks and known session-specific temporary information attacks. Meanwhile, it also violates perfect forward secrecy and anonymity. To overcome the proposed attacks, this paper proposes an enhanced protocol in which the security is verified by the formal analysis and informal analysis, Burross-Abadii-Needham (BAN) logic, and ProVerif tools. The comparison of security and performance proves that our protocol has higher security and lower computational overhead.


---

## Body

## 1. Introduction

With the development of artificial intelligence technologies [1–3], the application of sensors has become more common, and the demand for high-end sensors is also increasing day by day. Sensors have developed from wired sensors to today’s wireless sensors, and wireless sensors are the most common category in daily applications. The wireless sensor network [4, 5] is a self-organizing network formed by multiple functional nodes through wireless communication. These functional nodes include a large number of sensor nodes and gateway nodes. Sensor nodes perceive, collect, process, and transmit the information of the perceived object through the scope covered by the wireless sensor network.Wireless body area network [6] usually installs sensors on clothes or attached to the human body and can also be implanted into the skin to monitor the user’s physical activities and the state of body functions. The physical health data monitored by the sensors are sent to the cloud server for storage and analysis through the Internet of Things (IoTs). Users can view these data through the Internet and understand the physical condition, to achieve the purpose of early treatment of illnesses and reduce the number of deaths due to diseases. Wireless sensors are used in the growth of crops to monitor environmental factors such as humidity, temperature, and light that affect crop growth. The data monitored by the sensors are sent to the gateway node, which can send the data to the user to understand the growth status of crops, achieve the harvesting effect, and increase the income of farmers. The data collected by wireless sensor networks, whether used in military, medical, or other environments, is sensitive and private [7–13], so it is important to establish a secure authentication mechanism. Figure 1 shows a typical architecture in the wireless sensor network.Figure 1
A typical wireless sensor network architecture.In most authentication mechanisms of the wireless sensor networks, there are three components: user, sensor node, and gateway node. This paper will adopt such a structure, after the user logs in to the network, the data in the sensor are obtained through the gateway, and message authentication and key exchange are completed in this process. Since WSN is an open network, only using the password as a factor for encryption authentication will lead to a large number of vulnerabilities. In 2009, Das [14] proposed a protocol for encryption and authentication in wireless sensor network environments with a password and smart card. In 2010, Khan and Alghathbar [15] considered that in the protocol [14], users could not update their passwords and would be subject to internal privilege attacks. To solve these security vulnerabilities, they improved the protocol based on [14]. Chen and Shih [16] believed that [14] had security flaws in mutual authentication. To solve these flaws, they proposed a mutual authentication protocol that could be robust in wireless sensor networks. Vaidya et al. [17] found that Das’s protocol [14] could be attacked by stolen smart card attacks, password guessing attacks, and other attacks, so Vaidya et al. improved a two-factor authentication protocol in the WSN environment. In 2016, Vaidya et al. [18] believed that [14–16] would be subject to stolen smart card attacks and sensor impersonation attacks and proposed two-factor authentication based on the key agreement in WSNs. Kim et al. [19] pointed out that [18] cannot resist gateway node bypass attacks and user impersonation attacks and eliminated these security flaws by improving the scheme. With the rapid development of WSNs, more and more two-factor schemes have been proposed in the wireless sensor network environments [20–23].To solve the security vulnerabilities in two-factor authentication (such as stolen smart card attacks and password guessing attacks), biometric data is added as the third factor to the authentication scheme of the wireless sensor network. In 2010, Yuan et al. [24] found that Wong et al.’s dynamic authentication scheme [25] was vulnerable to the threat of the same ID and the stolen-verifier attack. They proposed a scheme based on biometric user authentication in the wireless sensor network environment. In 2011, Yoon and Yoo [26] found that Yuan et al.’s scheme [24] would be subject to an insider attack and impersonation attack and also had message integrity problems. Then, they proposed a wireless sensor network authentication scheme based on the smart card and biometric without the password. In 2013, Althobaiti et al. [27] pointed out that Yoon et al.’s scheme [26] would be subject to denial of service attacks and proposed an efficient authentication protocol based on biometric for WSNs. In 2015, Das [28] proposed a three-factor user authentication scheme for distributed WSNs. In 2017, Das [29] also proposed a new user authentication scheme based on biometrics. In the same year, Maurya and Sastry [30] considered that [29] would be attacked by a stolen smart card and proposed efficient user authentication protocols for WSNs and the IoTs. In 2018, Wu et al. [31] believed that both [28, 29] had security vulnerabilities such as offline password guessing attacks, user impersonation attacks, and violation of perfect forward security and then proposed an improved three-factor scheme. In the same year, Das et al. [32] proposed an authentication scheme based on biometrics to protect user privacy in the cloud environment. Then, Ryu et al. [33] pointed out that [31] could not provide user anonymity and was also subject to user impersonation attacks. In 2019, Hussain and Chaudhry [34] found that [32] would be subject to the smart card stolen attacks and traceability attacks and could not provide perfect forward security. In the same year, Chen et al. [35] proposed an improved three-factor authentication scheme under the medical wireless sensor network.Recently, Wu et al. [36] believed that [32, 35] were attacked by the off-line password guessing attacks. Therefore, they proposed a new three-factor authentication protocol for wireless sensor networks with the concept of the Internet of Things and claimed that the protocol has higher security advantages. However, we found that their protocol cannot resist key compromise impersonation attacks, violates perfect forward security, cannot provide anonymity, and cannot resist known session-specific temporary information attacks. This paper presents an improved three-factor authentication protocol for provable security. Through the formal analysis in the Real-Or-Random (ROR) model and the informal analysis, the security of the protocol is proved. Further, we also prove the security through BAN logic and ProVerif tools. The comparison of security and performance proves that the improved protocol has higher security and lower computational overhead.The framework of the rest of this paper is as follows. In the second and third sections, we give a brief review and cryptanalysis of the protocol proposed by Wu et al. Section4 describes the improved protocol in detail. Section 5 is the security proof of the improved protocol. Section 6 is the comparison of performance and security. Section 7 is the summary of the whole paper.


## 2. Review of Wu et al.’s Protocol

Wu et al.’s protocol [36] mainly includes two phases: registration and authentication and key exchange. The symbols and descriptions used in this paper are shown in Table 1.Table 1
Symbols and descriptions.
SymbolDescriptionUiUserSjSensorGWNGatewayAAdversarySASystem administratorSCSmart cardSKSession keyx, IDgGWN’s master key and identitysjSj’s secret valueIDi,PWi,BiUi’s identity, password, and biometricsTiTimestampGen⋅Fuzzy generator functionRep⋅Fuzzy reproduction functionh⋅Hash function


### 2.1. Registration

Sensor Node Registration. Sensor Sj selects its own identity SIDj and sends SIDj to gateway node GWN. Then, GWN selects x as the master key and computes SMj=hSIDjx. Finally, GWN sends SMj to Sj.User Registration. User Ui selects his own IDi and sends it to the system administrator SA. Then, SA checks whether IDi exists in its database. If it exists, reject the request. Otherwise, SA selects SCNi,PIDi and computes B1=hPIDix, B2=hSCNix. The values B1,B2,SCNi,PIDi,H⋅ are stored in a smart card SC and IDi is stored in SA’s database. Finally, SA sends SC to Ui. Upon receiving the smart card, Ui enters his PWi, Bi, selects r0, and computes C0=HBi, Pi=hC0PWir0, C1=B1⊕hIDiPi, C2=B2⊕hIDiPWi, and C3=r0⊕hIDiPWiC0. Then, Ui stores C1,C2,C3 to SC and deletes B1,B2 from SC. Note that, all communications in this phase are based on a secure channel.


### 2.2. Authentication and Key Exchange

Ui inserts SC and enters IDi, PWi, and Bi. Then, the smart card selects N1, T1 and computes C0=HBi, r0=C3⊕hIDiPWiC0, Pi=hC0PWir0, B1=C1⊕hIDiPi, B2=C2⊕hIDiPWi, D1=B1⊕N1, D2=IDi⊕hPIDiN1T1, D3=SCNi⊕hIDiN1T1, D4=SIDj⊕hB2N1T1, D5=hIDiPIDiSCNiN1SIDj. Finally, Ui sends M1=PIDi,D1,D2,D3,D4,D5,T1 to GWN.GWN first checks whether T1 is valid. If it times out, the request is terminated. Otherwise, GWN calculates B1=hPIDix, N1=D1⊕B1, IDi=D2⊕hPIDiN1T1 and then searches for IDi in its database. If it is not found, terminates. Otherwise, GWN computes SCNi=D3⊕hIDiN1T1, B2=hSCNix, SIDj=D4⊕hB2N1T1, and verifies D5=?hIDiPIDiSCNiN1SIDj. If the verification holds, GWN selects T2 and calculates SMj=hSIDjx, D6=N1⊕hIDgSMjT2, and D7=hN1SMjSIDj. Finally, GWN sends M2=D6,D7,IDg,T2 to Sj.Sj first checks whether T2 is valid. If it times out, the communication is terminated. Otherwise, Sj calculates N1=D6⊕hIDgSMjT2 and verifies D7=?hN1SMjSIDj. If the verification holds, Sj selects T3, N2 and computes SKs=hN1N2, D8=N1⊕N2, and D9=hSKsSMjIDgSIDjT3. Finally, Sj sends M3=D8,D9,T3 to GWN.GWN first checks whether T3 is valid. If it times out, the communication is terminated. Otherwise, GWN calculates N2=D8⊕N1, SKg=hN1N2 and verifies D9=?hSKgSMjIDgSIDjT3. If the verification holds, GWN selects T4, PIDinew and computes B1new=hPIDinewx, D10=B1new⊕hB1N1T4, D11=PIDinew⊕hB1newN2T4, and D12=hSKgB1newPIDinewB1IDiSIDj. Finally, GWN sends M4=D8,D10,D11,D12,T4 to Ui.Ui first checks whether T4 is valid. If it times out, the communication is terminated. Otherwise, Ui calculates N2=D8⊕N1, B1new=D10⊕hB1N1T4, PIDinew=D11⊕hB1newN2T4, SKu=hN1N2, and verifies D12=?hSKuB1newPIDinewB1IDiSIDj. If the verification holds, Ui computes C1new=B1new⊕hIDiPi and stores C1new,PIDinew to the smart card and deletes the old C1,PIDi.After finish the above steps,Ui, GWN, and Sj can establish a session SK=SKu=SKg=SKs=hN1N2 to communicate. Note that, B1new and PIDinew are used in the next section.


## 2.1. Registration

Sensor Node Registration. Sensor Sj selects its own identity SIDj and sends SIDj to gateway node GWN. Then, GWN selects x as the master key and computes SMj=hSIDjx. Finally, GWN sends SMj to Sj.User Registration. User Ui selects his own IDi and sends it to the system administrator SA. Then, SA checks whether IDi exists in its database. If it exists, reject the request. Otherwise, SA selects SCNi,PIDi and computes B1=hPIDix, B2=hSCNix. The values B1,B2,SCNi,PIDi,H⋅ are stored in a smart card SC and IDi is stored in SA’s database. Finally, SA sends SC to Ui. Upon receiving the smart card, Ui enters his PWi, Bi, selects r0, and computes C0=HBi, Pi=hC0PWir0, C1=B1⊕hIDiPi, C2=B2⊕hIDiPWi, and C3=r0⊕hIDiPWiC0. Then, Ui stores C1,C2,C3 to SC and deletes B1,B2 from SC. Note that, all communications in this phase are based on a secure channel.


## 2.2. Authentication and Key Exchange

Ui inserts SC and enters IDi, PWi, and Bi. Then, the smart card selects N1, T1 and computes C0=HBi, r0=C3⊕hIDiPWiC0, Pi=hC0PWir0, B1=C1⊕hIDiPi, B2=C2⊕hIDiPWi, D1=B1⊕N1, D2=IDi⊕hPIDiN1T1, D3=SCNi⊕hIDiN1T1, D4=SIDj⊕hB2N1T1, D5=hIDiPIDiSCNiN1SIDj. Finally, Ui sends M1=PIDi,D1,D2,D3,D4,D5,T1 to GWN.GWN first checks whether T1 is valid. If it times out, the request is terminated. Otherwise, GWN calculates B1=hPIDix, N1=D1⊕B1, IDi=D2⊕hPIDiN1T1 and then searches for IDi in its database. If it is not found, terminates. Otherwise, GWN computes SCNi=D3⊕hIDiN1T1, B2=hSCNix, SIDj=D4⊕hB2N1T1, and verifies D5=?hIDiPIDiSCNiN1SIDj. If the verification holds, GWN selects T2 and calculates SMj=hSIDjx, D6=N1⊕hIDgSMjT2, and D7=hN1SMjSIDj. Finally, GWN sends M2=D6,D7,IDg,T2 to Sj.Sj first checks whether T2 is valid. If it times out, the communication is terminated. Otherwise, Sj calculates N1=D6⊕hIDgSMjT2 and verifies D7=?hN1SMjSIDj. If the verification holds, Sj selects T3, N2 and computes SKs=hN1N2, D8=N1⊕N2, and D9=hSKsSMjIDgSIDjT3. Finally, Sj sends M3=D8,D9,T3 to GWN.GWN first checks whether T3 is valid. If it times out, the communication is terminated. Otherwise, GWN calculates N2=D8⊕N1, SKg=hN1N2 and verifies D9=?hSKgSMjIDgSIDjT3. If the verification holds, GWN selects T4, PIDinew and computes B1new=hPIDinewx, D10=B1new⊕hB1N1T4, D11=PIDinew⊕hB1newN2T4, and D12=hSKgB1newPIDinewB1IDiSIDj. Finally, GWN sends M4=D8,D10,D11,D12,T4 to Ui.Ui first checks whether T4 is valid. If it times out, the communication is terminated. Otherwise, Ui calculates N2=D8⊕N1, B1new=D10⊕hB1N1T4, PIDinew=D11⊕hB1newN2T4, SKu=hN1N2, and verifies D12=?hSKuB1newPIDinewB1IDiSIDj. If the verification holds, Ui computes C1new=B1new⊕hIDiPi and stores C1new,PIDinew to the smart card and deletes the old C1,PIDi.After finish the above steps,Ui, GWN, and Sj can establish a session SK=SKu=SKg=SKs=hN1N2 to communicate. Note that, B1new and PIDinew are used in the next section.


## 3. Cryptanalysis of Wu et al.’s Protocol

In this section, we found that Wu et al.’s protocol [36] is subject to key compromise impersonation attacks and known session-specific temporary information attacks. Meanwhile, their protocol violates perfect forward secrecy and anonymity.Here, we define the capabilities of adversaryA according to the literature [29, 35, 37].
(1)
Messages transmitted over public channels can be eavesdropped, intercepted, modified, and replayed byA(2)
A may try to guess the user’s password and identity in polynomial time(3)
A may successfully steal the user’s SC such that some important parameters can be obtained by A(4)
A may obtain the long-term key of each entityNote that stealing the smart card and obtaining the long-term key cannot be performed at the same time in our proposed following attacks.


### 3.1. Key Compromise Impersonation Attacks

Key compromise impersonation attacks [38] mean that adversary A knows the long-term key of one entity and tries to impersonate the other entity. Here, we assume that A obtains the long-term private key x of GWN. After intercepting M1=PIDi,D1,D2,D3,D4,D5,T1, A can recover B1=hPIDix, N1=D1⊕B1, IDi=D2⊕hPIDiN1T1, SCNi=D3⊕hIDiN1T1, B2=hSCNix, SIDj=D4⊕hB2N1T1, and SMj=hSIDjx.In the following, we show thatA can impersonate Sj to establish a session key with Ui by the above values.
(1)
A intercepts M2=D6,D7,IDg,T2 and selects a random number N2′ and timestamp TA. Then, A computes SKA=hN1N2′, D8′=N1⊕N2′, D9′=hSKASMjIDgSIDjTA and sends M3′=D8′,D9′,TA to GWN(2)
GWN checks whether TA is valid. If it times out, the communication is terminated. Otherwise, GWN calculates N2′=D8′⊕N1, SKg=hN1N2′, and verifies D9′=hSKgSMjIDgSIDjTA. The following steps are similar to the authentication phase in Subsection 2.2 except D11′=PIDinew⊕hB1newN2′T4. Then, GWN sends M4′=D8′,D10,D11′,D12,T4 to Ui(3)
Ui checks whether T4 is valid. If it times out, the communication is terminated. Otherwise, Ui calculates N2′ = D8′⊕N1, B1new=D10⊕hB1N1T4, PIDinew=D11′⊕hB1newN2′T4, SKu=hN1N2′, and verifies D12=?hSKuB1newPIDinewB1IDiSIDj. It is easy to see that the result is trueThus,Ui believes that he can establish a session key SK=SKu=SKA=hN1N2′ with Sj (impersonated by A).


### 3.2. Violating Perfect Forward Secrecy and Anonymity

By the similar attack approach in Subsection3.1, suppose that A gets x and intercepts M1, M3. Then, A can recover IDi=D2⊕hPIDiN1T1 and SK=hN1N2, where B1=hPIDix, N1=D1⊕B1, N2=D8⊕N1. In other words, Wu et al.’s protocol violates perfect forward secrecy and anonymity.


### 3.3. Known Session-Specific Temporary Information Attacks

Here, assume that the adversaryA gets the temporary value N1 and intercepts M3=D8,D9,T3. Then, A can recover the current session key SK=hN1N2, where N2=D8⊕N1. Furthermore, A can compute update values B1new=D10⊕hB1N1T4 and PIDinew=D11⊕hB1newN2T4 by intercepting M1, M3, and M4, where B1=N1⊕D1.In the next section,A may intercept messages M1′, M3′, and M4′ to recover N1′=B1new⊕D1′, N2′=N1′⊕D8′. The session key SK′ can be computed by SK′=hN1′N2′. Meanwhile, the newest updated values B1new′=D10′⊕hB1newN1′T4′, PIDinew′=D11′⊕hB1new′N2′T4′ can be computed. Thus, under a known session-specific temporary information attack approach, we can conclude that Wu et al.’s protocol not only violates “perfect forward secrecy” but also not provides “backward secrecy.”


## 3.1. Key Compromise Impersonation Attacks

Key compromise impersonation attacks [38] mean that adversary A knows the long-term key of one entity and tries to impersonate the other entity. Here, we assume that A obtains the long-term private key x of GWN. After intercepting M1=PIDi,D1,D2,D3,D4,D5,T1, A can recover B1=hPIDix, N1=D1⊕B1, IDi=D2⊕hPIDiN1T1, SCNi=D3⊕hIDiN1T1, B2=hSCNix, SIDj=D4⊕hB2N1T1, and SMj=hSIDjx.In the following, we show thatA can impersonate Sj to establish a session key with Ui by the above values.
(1)
A intercepts M2=D6,D7,IDg,T2 and selects a random number N2′ and timestamp TA. Then, A computes SKA=hN1N2′, D8′=N1⊕N2′, D9′=hSKASMjIDgSIDjTA and sends M3′=D8′,D9′,TA to GWN(2)
GWN checks whether TA is valid. If it times out, the communication is terminated. Otherwise, GWN calculates N2′=D8′⊕N1, SKg=hN1N2′, and verifies D9′=hSKgSMjIDgSIDjTA. The following steps are similar to the authentication phase in Subsection 2.2 except D11′=PIDinew⊕hB1newN2′T4. Then, GWN sends M4′=D8′,D10,D11′,D12,T4 to Ui(3)
Ui checks whether T4 is valid. If it times out, the communication is terminated. Otherwise, Ui calculates N2′ = D8′⊕N1, B1new=D10⊕hB1N1T4, PIDinew=D11′⊕hB1newN2′T4, SKu=hN1N2′, and verifies D12=?hSKuB1newPIDinewB1IDiSIDj. It is easy to see that the result is trueThus,Ui believes that he can establish a session key SK=SKu=SKA=hN1N2′ with Sj (impersonated by A).


## 3.2. Violating Perfect Forward Secrecy and Anonymity

By the similar attack approach in Subsection3.1, suppose that A gets x and intercepts M1, M3. Then, A can recover IDi=D2⊕hPIDiN1T1 and SK=hN1N2, where B1=hPIDix, N1=D1⊕B1, N2=D8⊕N1. In other words, Wu et al.’s protocol violates perfect forward secrecy and anonymity.


## 3.3. Known Session-Specific Temporary Information Attacks

Here, assume that the adversaryA gets the temporary value N1 and intercepts M3=D8,D9,T3. Then, A can recover the current session key SK=hN1N2, where N2=D8⊕N1. Furthermore, A can compute update values B1new=D10⊕hB1N1T4 and PIDinew=D11⊕hB1newN2T4 by intercepting M1, M3, and M4, where B1=N1⊕D1.In the next section,A may intercept messages M1′, M3′, and M4′ to recover N1′=B1new⊕D1′, N2′=N1′⊕D8′. The session key SK′ can be computed by SK′=hN1′N2′. Meanwhile, the newest updated values B1new′=D10′⊕hB1newN1′T4′, PIDinew′=D11′⊕hB1new′N2′T4′ can be computed. Thus, under a known session-specific temporary information attack approach, we can conclude that Wu et al.’s protocol not only violates “perfect forward secrecy” but also not provides “backward secrecy.”


## 4. Improved Protocol

In order to fix our proposed security flaws of Wu et al.’s protocol [36], an enhanced protocol is present.


### 4.1. Registration

Sensor Node Registration. Sj selects SIDj, sj and sends SIDj,sj to GWN via a secure channel. Then, GWN calculates SMj=hSIDjsjx, s1=sj⊕SMj, and stores sj in its database. Finally, GWN sends s1 to Sj. After receiving s1, Sj computes SMj=sj⊕s1 and stores it in its memory.User Registration. Ui selects IDi, PWi and inputs his Bi to compute Pi=hσiPWiIDi and HIDi=hIDiσi, where GenBi=σi,τi. Then, Ui sends IDi,Pi,HIDi to SA via a secure channel. After receiving IDi,Pi,HIDi, SA checks whether IDi exits its database. If so, deleting the relevant records in the database and reregister. Otherwise, SA selects gi and computes A1=hgiHIDixIDi, A2=A1⊕Pi, and A3=hHIDiPi. Then, SA stores A2,A3 in SC and sends SC to Ui via a secure channel. Meanwhile, HIDi,IDi,gi is stored in SA’s database. After receiving SC, Ui stores τi in SC.The sensor node registration phase and the user registration phase are shown in Figure2.Figure 2
The registration phase.


### 4.2. Authentication and Key Exchange

Ui inserts SC and enters IDi, PWi, and Bi. Then, Ui can compute σi=RepBi,τi, Pi=hσiPWiIDi, HIDi=hIDiσi, A3′=hHIDiPi to check whether A3′ is equal to A3. If the verification holds, Ui generates N1, T1, and computes A1=A2⊕Pi, C1=N1⊕hA1HIDi, C2=IDi⊕hHIDiA1T1, C3=SIDj⊕hA1N1T1, C4=hIDiHIDiSIDjN1T1. Finally, Ui sends M1=HIDi,C1,C2,C3,C4,T1 to GWN.Upon receivingM1, GWN first checks whether T1 is valid. If the times out, the communication is terminated. Otherwise, GWN according to HIDi finds the corresponding IDi,gi in its database and computes A1=hgiHIDixIDi, IDi∗=C2⊕hHIDiA1T1. Then, GWN checks whether IDi∗ equals to IDi. If not, the session is terminated. Otherwise, GWN computes N1=C1⊕hA1HIDi, SIDj=C3⊕hA1N1T1 and verifies C4=?hIDi∗HIDiSIDjN1T1. If the verification holds, GWN generates N2, T2 and computes SMj=hSIDjsjx, C5=N2⊕hSIDjSMjT2, C6=N1⊕hSMjN2, C7=hN1N2SIDjSMjT2. Finally, GWN sends M2=HIDi,C5,C6,C7,T2 to Sj.Upon receivingM2, Sj first checks whether T2 is valid. If the times out, the communication is terminated. Otherwise, Sj computes N2=C5⊕hSIDjSMjT2, N1=C6⊕hSMjN2 and verifies C7=?hN1N2SIDjSMjT2. If the verification holds, Sj generates N3, T3 and computes SKs=hN1N2N3HIDjSIDj, C8=N3⊕hN1N2, C9=hSKsSMjSIDjT3. Finally, Sj sends M3=C8,C9,T3 to GWN.Upon receivingM3, GWN first checks whether T3 is valid. If times out, the communication is terminated. Otherwise, GWN computes N3=C8⊕hN1N2, SKg=hN1N2N3HIDjSIDj and verifies C9=?hSKgSMjSIDjT3. If the verification holds, GWN generates T4 and computes C10=N2⊕hA1PiN1T4, C11=hSKgA1PiIDiT4. Finally, GWN sends M4=C8,C10,C11,T4 to Ui.Upon receivingM4, Ui first checks whether T4 is valid. If times out, the communication is terminated. Otherwise, Ui computes N2=C10⊕hA1PiN1T4, N3=C8⊕hN1N2, SKu=hN1N2N3HIDjSIDj and verifies C11=?hSKuA1PiIDiT4. If the verification holds, SKu=SKg=SKs is set as a session key used to communicate between Ui, GWN, and Sj.The authentication and key exchange phase is shown in Figure3.Figure 3
The authentication and key exchange phase.


## 4.1. Registration

Sensor Node Registration. Sj selects SIDj, sj and sends SIDj,sj to GWN via a secure channel. Then, GWN calculates SMj=hSIDjsjx, s1=sj⊕SMj, and stores sj in its database. Finally, GWN sends s1 to Sj. After receiving s1, Sj computes SMj=sj⊕s1 and stores it in its memory.User Registration. Ui selects IDi, PWi and inputs his Bi to compute Pi=hσiPWiIDi and HIDi=hIDiσi, where GenBi=σi,τi. Then, Ui sends IDi,Pi,HIDi to SA via a secure channel. After receiving IDi,Pi,HIDi, SA checks whether IDi exits its database. If so, deleting the relevant records in the database and reregister. Otherwise, SA selects gi and computes A1=hgiHIDixIDi, A2=A1⊕Pi, and A3=hHIDiPi. Then, SA stores A2,A3 in SC and sends SC to Ui via a secure channel. Meanwhile, HIDi,IDi,gi is stored in SA’s database. After receiving SC, Ui stores τi in SC.The sensor node registration phase and the user registration phase are shown in Figure2.Figure 2
The registration phase.


## 4.2. Authentication and Key Exchange

Ui inserts SC and enters IDi, PWi, and Bi. Then, Ui can compute σi=RepBi,τi, Pi=hσiPWiIDi, HIDi=hIDiσi, A3′=hHIDiPi to check whether A3′ is equal to A3. If the verification holds, Ui generates N1, T1, and computes A1=A2⊕Pi, C1=N1⊕hA1HIDi, C2=IDi⊕hHIDiA1T1, C3=SIDj⊕hA1N1T1, C4=hIDiHIDiSIDjN1T1. Finally, Ui sends M1=HIDi,C1,C2,C3,C4,T1 to GWN.Upon receivingM1, GWN first checks whether T1 is valid. If the times out, the communication is terminated. Otherwise, GWN according to HIDi finds the corresponding IDi,gi in its database and computes A1=hgiHIDixIDi, IDi∗=C2⊕hHIDiA1T1. Then, GWN checks whether IDi∗ equals to IDi. If not, the session is terminated. Otherwise, GWN computes N1=C1⊕hA1HIDi, SIDj=C3⊕hA1N1T1 and verifies C4=?hIDi∗HIDiSIDjN1T1. If the verification holds, GWN generates N2, T2 and computes SMj=hSIDjsjx, C5=N2⊕hSIDjSMjT2, C6=N1⊕hSMjN2, C7=hN1N2SIDjSMjT2. Finally, GWN sends M2=HIDi,C5,C6,C7,T2 to Sj.Upon receivingM2, Sj first checks whether T2 is valid. If the times out, the communication is terminated. Otherwise, Sj computes N2=C5⊕hSIDjSMjT2, N1=C6⊕hSMjN2 and verifies C7=?hN1N2SIDjSMjT2. If the verification holds, Sj generates N3, T3 and computes SKs=hN1N2N3HIDjSIDj, C8=N3⊕hN1N2, C9=hSKsSMjSIDjT3. Finally, Sj sends M3=C8,C9,T3 to GWN.Upon receivingM3, GWN first checks whether T3 is valid. If times out, the communication is terminated. Otherwise, GWN computes N3=C8⊕hN1N2, SKg=hN1N2N3HIDjSIDj and verifies C9=?hSKgSMjSIDjT3. If the verification holds, GWN generates T4 and computes C10=N2⊕hA1PiN1T4, C11=hSKgA1PiIDiT4. Finally, GWN sends M4=C8,C10,C11,T4 to Ui.Upon receivingM4, Ui first checks whether T4 is valid. If times out, the communication is terminated. Otherwise, Ui computes N2=C10⊕hA1PiN1T4, N3=C8⊕hN1N2, SKu=hN1N2N3HIDjSIDj and verifies C11=?hSKuA1PiIDiT4. If the verification holds, SKu=SKg=SKs is set as a session key used to communicate between Ui, GWN, and Sj.The authentication and key exchange phase is shown in Figure3.Figure 3
The authentication and key exchange phase.


## 5. Proof of Security

### 5.1. Correctness by BAN Logic

In this subsection, we use BAN logic to show the correctness of our improved protocol. As far as the proposed protocol is concerned, we need to prove thatUi, Sj, and GWN share a session key SK through rigorous logical analysis. The symbols and rules used for BAN logic are referred to [39–41].


#### 5.1.1. Rules

(i)
R1 (Message meaning (M-M) rule): P∣≡P⇌YQ,P⊲XY/P∣≡Q∣∼X(ii)
R2 (Nonce verification (N-V) rule): P∣≡#X,P∣≡Q∣~X/P∣≡Q∣≡X(iii)
R3 (Jurisdiction rule): P∣≡Q∣⇒X,P∣≡Q∣≡X/P∣≡X(iv)
R4 (Session key (S-K) rule): P∣≡#X,P∣≡Q∣≡X/P∣≡P⟷KQ


#### 5.1.2. Goals

(i)
G1: Ui∣≡Ui⟷SKSj(ii)
G2: Sj∣≡Ui⟷SKSj(iii)
G3: GWN∣≡Ui⟷SKSj(iv)
G4: Ui∣≡Sj∣≡Ui⟷SKSj(v)
G5:Sj∣≡Ui∣≡Ui⟷SKSj(vi)
G6:GWN∣≡Ui∣≡Ui⟷SKSj(vii)
G7:GWN∣≡Sj∣≡Ui⟷SKSj


#### 5.1.3. Idealize the Communication Messages

(i)
M1:Ui⟶GWN:HIDi,C1,C2,C3,C4,T1.(ii)
M2:GWN⟶Sj:HIDi,C5,C6,C7,T2.(iii)
M3:Sj⟶GWN:C8,C9,T3.(iv)
M4:GWN⟶Ui:C10,C11,T4.(v)
M5:Sj⟶Ui:C8


#### 5.1.4. Initial Assumptions

(i)
A1:Ui∣≡#N1(ii)
A2:Sj∣≡#N3(iii)
A3:GWN∣≡#N2(iv)
A4:GWN∣≡Ui∣⇒HIDi(v)
A5:GWN∣≡Ui⇌A1GWN(vi)
A6:GWN∣≡#N1(vii)
A7:GWN∣≡Ui∣⇒N1(viii)
A8:GWN∣≡#SIDj(ix)
A9:GWN∣≡Ui∣⇒SIDj(x)
A10:Sj∣≡GWN∣⇒HIDi(xi)
A11:Sj∣≡GWN∣≡SMj(xii)
A12:Sj∣≡#SMj(xiii)
A13:Sj∣≡#N2(xiv)
A14:Sj∣≡GWN∣⇒N2(xv)
A15:Sj∣≡#N1(xvi)
A16:GWN∣≡Sj⇌hN1N2GWN(xvii)
A17:GWN∣≡#N3(xviii)
A18:GWN∣≡Sj∣⇒N3(xix)
A19:Ui∣≡GWN∣≡A1(xx)
A20:Ui∣≡#A1(xxi)
A21:Ui∣≡#N2(xxii)
A22:Ui∣≡GWN∣⇒N2(xxiii)
A23:Ui∣≡Ui⇌hN1N2Sj(xxiv)
A24:Ui∣≡#N3(xxv)
A25:Ui∣≡Sj∣⇒N3(xxvi)
A26:Sj∣≡GWN∣⇒N1


#### 5.1.5. The Proof of our Proposed Protocol via BAN Logic

ByM1, we have S1:GWN⊲HIDi,C1:N1,HIDiA1,C2,C3:SIDjA1,C4,T1 and further S2:GWN∣≡Ui∣≡HIDi. Base on A4, S2, and R3 (Jurisdiction rule), we can obtain S3:GWN∣≡HIDi. According to S1, it implies S4:GWN⊲N1,HIDiA1. By A5, S4, andR1 (M-M rule), it implies S5:GWN∣≡Ui∣~N1,HIDi. By A6, S5, and R2 (N-V rule), we can obtain S6:GWN∣≡Ui∣≡N1. According to A7, S6, and R3 (Jurisdiction rule), it implies S7:GWN∣≡N1. According to S1, we have S8:GWN⊲SIDjA1. By A5, S8, and R1 (M-M rule), it implies S9:GWN∣≡Ui∣~SIDj. By A8, S9, and R2 (N-V rule), we can obtain S10:GWN∣≡Ui∣≡SIDj. According to A9, S10, andR3 (Jurisdiction rule), it implies S11:GWN∣≡SIDj.ByM2, we have S12:Sj⊲HIDi,C5:N2hSIDjSMjT2,C6:N1hSMjN2,C7,T2 and further S13:Sj∣≡GWN∣≡HIDi. Base on A10, S13, and R3 (Jurisdiction rule), we can obtain S14:Sj∣≡HIDi. By A11, A12, and R4 (S-K rule), it implies S15:Sj∣≡Sj⇌hSIDjSMjT2GWN. According to S12, we have S16:Sj⊲N2hSIDjSMjT2. Base on S15, S16, and R1 (M-M rule), it implies S17:Sj∣≡GWN∣~N2. By A13, S17 and R2 (N-V rule), we can obtain S18:Sj∣≡GWN∣≡N2. According to A14, S18, and R3 (Jurisdiction rule), it implies S19:Sj∣≡N2. Base on A11, A12, and R4 (S-K rule), we have S20:Sj∣≡Sj⇌hSMjN2GWN. According to S12, we have S21:Sj⊲N1hSMjN2. By S20, S21, and R1 (M-M rule), it implies S22:Sj∣≡GWN∣~N1. By A15, S22, and R2 (N-V rule), we can obtain S23:Sj∣≡GWN∣≡N1. Base on A26, S23, and R3 (Jurisdiction rule), it implies S24:Sj∣≡N1. Since SK=hN1N2N3HIDjSIDj, S25:Sj∣≡Ui⟷SKSj is obtained. G2 According to A2, S25, and R4 (S-K rule), we can obtain S26:GWN∣≡Ui⇌A1GWN. G5.ByM3, we have S27:GWN⊲C8:N3hN1N2,C9,T3 and further S28:GWN⊲N3hN1N2. Base on A16, S28, and R1 (M-M rule), we can obtain S29:GWN∣≡Sj∣~N3. By A17, S29 and R2 (N-V rule), it implies S30:GWN∣≡Sj∣≡N3. Base on A18, S30 and R3 (Jurisdiction rule), we can obtain S31:GWN∣≡N3. According to S2, S11, and S31, it implies S32:GWN∣≡Ui⟷SKSj. G3 Base on A6, S32, and R4 (S-K rule), we can obtain S33:GWN∣≡Ui∣≡Ui⟷SKSj.G6 According to A27, S32, and R4 (S-K rule), it implies S34:GWN∣≡Sj∣≡Ui⟷SKSj. G7ByM4, we have S35:Ui⊲C10:N2hA1PiN1T4,C11,T4. Base on A19, A20, and R4 (S-K rule), we can obtain S36:Ui∣≡Ui⇌hA1PiN1T4GWN. According to S35, we have S37:Ui⊲N2hA1PiN1T4. Base on S36, S37, and R1 (M-M rule), it implies S38:Ui∣≡GWN∣~N2. By A21, S38, and R2 (N-V rule), we can obtain S39:Ui∣≡GWN∣≡N2. According to A22, S39, and R3 (Jurisdiction rule), it implies S40:Ui∣≡N2.ByM5, we have S41:Ui⊲C8:N3hN1N2. Base onA23, S41, and R1 (M-M rule), it implies S42:Ui∣≡Sj∣~N3. By A24, S42, and R2 (N-V rule), we can obtain S43:Ui∣≡Sj∣≡N3. Base on A25, S43, and R3 (Jurisdiction rule), it implies S44:Ui∣≡N3. According to S40 and S44, we can obtain S45:Ui∣≡Ui⟷SKSj. G1 According to A24 and S45, we can obtain S45:Ui∣≡Sj∣≡Ui⟷SKSj. G4


### 5.2. Formal Security Analysis

In this section, we perform a formal security analysis of the improved protocol in ROR model [42–48]. The proposed protocol involves three entities, Ui, Sj, and GWN. We use ΠUx,, and ΠGWNz to represent the xth instance of Ui, the yth instance of Sj, and the zth instance of GWN, respectively. Here, we define that adversary A has the ability to initiate the following query. Note that, O=ΠUx,ΠSy,ΠGWNz.
(i)
𝐸𝑥𝑒𝑐𝑢𝑡𝑒(O): if A executes this query, it can obtain an entire communication record on the public channel(ii)
S𝑒𝑛𝑑(O, 𝑀): if A executes this query, it can send M to O and receive the response from O(iii)
Hashstring: if A executes this query, it can input string to get its hash value(iv)
CorruptO: if A executes this query, it can get secret values of one party, such as some parameter stored in the smart card, long-term secret key, or temporary information(v)
TestO: if A executes this query, it flips a coin C. If C=1, then can get the correct session key; if C=0, A gets a random string of the same length as the session keyTheorem 1.
In the ROR model, assume thatA can make Execute, Send, Hash, Corrupt, and Test queries. Then, the advantage of A to break the proposed protocol P in polynomial time ξ is AdvAPξ≤qsend/2l−2+3qhash2/2l−1+2maxC′⋅qsends′,qsend/2l, where qsend is the number of times to execute Send queries, qhash is the number of times to execute Hash queries, C′ and s′ are two constants [49], and l is the bits of biological information.Proof.
We prove this theorem by following game sequencesGM0 to GM5. SuccAGMnξ is defined by the probability that A succeeds in GMn, which is the probability that C=1. The detailed simulations of queries in real attacks are shown in Tables 2 and 3. The details are as follows.Table 2
Simulation ofSend query.
On a querySendΠUx,start, assuming that ΠUx is a normal state, we perform the following operations. Select NA1, TA1, and compute A1=A2⊕Pi, C1=N1⊕hA1HIDi, C2=IDi⊕hHIDiA1TA1, C3=SIDj⊕hA1NA1TA1, C4=hIDiHIDiSIDjNA1TA1. Then, the query is answered by M1=HIDi,C1,C2,C3,C4,T1.On a querySendΠGWNz,HIDi,C1,C2,C3,C4,T1 and assume that ΠGWNz is a normal state to perform the following operations. Compute Ai,IDi,N1,SIDj, C4, and check A1. If equal, select NA2, TA2, and compute SMj,C5,C6,C7. Then, the query is answered by M2=HIDi,C5,C6,C7,T2.On a querySendΠSy,HIDi,C5,C6,C7,T2, assuming that ΠSy is a normal state, do the following. Compute N2,N1,C7, check C7. If equal, select NA3, TA3, and compute SKs,C8,C9. Then, the query is answered by M3=C8,C9,T3.On a querySendΠGWNz,C8,C9,T3 and assume that ΠGWNz is a normal state to perform the following operations. Compute N3,SKg,C9, and check C9. If equal, select TA4, and compute C10,C11. Then, the query is answered by M4=C8,C10,C11,T4.On a query, assuming thatΠUx is a normal state, we perform the following operations. Compute N2,N3,SKu,C11, the instance ΠUx checks C11; if not equal, it will be terminated. Otherwise, compute SK=hN1N2N3HIDjSIDj. Finally, the user instance accepts and terminates.Table 3
Simulation ofExecute,Corrupt, and Test query.
On aExecute query, we use the simulation of Send query to do the following operations: HIDi,C1,C2,C3,C4,T1⟵SendΠUx,start, HIDi,C5,C6,C7,T2⟵SendΠGWNz,HIDi,C1,C2,C3,C4,T1, C8,C9,T3⟵SendΠSy,HIDi,C5,C6,C7,T2, C8,C10,C11,T4⟵SendΠGWNz,C8,C9,T3. This query is answered by HIDi,C1,C2,C3,C4,T1, HIDi,C5,C6,C7,T2, C8,C9,T3, and C8,C10,C11,T4.For a recordstring,r that appears in the Hashstring query, return r=Hashstring. Otherwise, select an element r, add the record string,r to the list, and return r.On a queryCorruptΠUx, and if ΠUx is accepted, the query is answered by the parameter A2,A3,τi in the smart card.On aTest query, flip a coin C to get the result of SK. If C=1, return SK; otherwise, return a string of the same length.GM0: Flip C to start the game. GM0 is a game played without any queries. Therefore, we can get the probability of A successfully breaking P as
(1)AdvAPξ=2PrSuccAGM0ξ−1.GM1: The difference between GM1 and GM0 is that GM1 adds the Execute query. In GM1, A just gets messages M1=HIDi,C1,C2,C3,C4,T1, M2=HIDi,C5,C6,C7,T2, M3=C8,C9,T3, and M4=C8,C10,C11,T4. After GM1 is over, A queries the session key through Test, but N1,N2, and N3 are all confidential to A. Therefore, the probability of GM1 and GM0 is equal, that is,
(2)PrSuccAGM1ξ=PrSuccAGM0ξ.GM2: The difference between GM2 and GM1 is that GM2 adds the Send query. According to Zipf’s law [49], we can get
(3)∣PrSuccAGM2ξ−PrSuccAGM1ξ∣≤qsend2l.GM3: The difference between GM3 and GM2 is that GM3 adds the Hash query and deletes the Send query. According to the birthday paradox, we can get
(4)∣PrSuccAGM3ξ−PrSuccAGM2ξ∣≤qhash22l+1.GM4: In this game, we discuss the security of the session key in two cases. The first is to obtain the long-term private key x of ΠGWNz to verify the perfect forward security; the second is to get temporary information to verify whether the known session-specific temporary information attacks can be resisted.
(1)
Perfect forward security.A uses ΠGWNz to try to get the private key x of GWN or uses ΠUx or ΠSy to try to get a secret value in the registration phase(2)
Known session-specific temporary information attacks.A uses either ΠUx or ΠSy or ΠGWNz to try to obtain the temporary information of the corresponding partyIn both cases,A can only compute the session key through Send and Hash queries. For the first case, if A only knows the private key x of GWN, or a secret value of ΠUx or ΠSy in the registration phase, it cannot get the temporary information N1,N2, and N3 in SK=hN1N2N3HIDjSIDj. For the second case, we assume that A gets N1, but N2 and N3 are kept secret. Similarly, if N2 or N3 is leaked, the session key cannot be calculated. Therefore, we have
(5)∣PrSuccAGM4ξ−PrSuccAGM3ξ∣≤qsend2l+qhash2/2l+1.GM5: In this game, A uses CorruptΠUx to get the parameters A2,A3,τi stored in the SC and attempts to launch the stolen smart card attacks and the offline password guessing attacks. Suppose A gets HIDi according to M1, and computes σi=RepBi,τi, Pi=hσiPWiIDi, A3′=hHIDiPi until A3′=A3. However, Bi, PWi, and IDi are all confidential to A. The probability that A can guess the biological information of the l bits is 1/2l [50]. In Zipf’s law [49], the probability of guessing the password is more than 0.5 when qsend≤106. Therefore, we get
(6)∣PrSuccAGM5ξ−PrSuccAGM4ξ∣≤maxC′⋅qsends′,qsend2l,where C′ and s′ are constants depending on the size of the password.GM6: The purpose of this game is to verify whether it can resist impersonation attacks. The difference between GM6 and GM5 is that when GM6 initiates hN1N2N3HIDjSIDj query to guess the session key, the game is terminated. Therefore, we have
(7)∣PrSuccAGM6ξ−PrSuccAGM5ξ∣≤qhash22l+1.Since the probability ofGM6 success and failure is equal, the probability of A successfully guessing the session key is
(8)PrSuccAGM0ξ=12.According to formulas (1) to (8), we can get
(9)12AdvAPξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤∑i=05PrSuccAGMi+1ξ−PrSuccAGMiξ=qsend2l−1+3qhash22l+maxC′⋅qsends′,qsend2l.Thus, we haveAdvAPξ≤qsend/2l−2+3qhash2/2l−1+2maxC′⋅qsends′,qsend/2l.


### 5.3. Informal Security Analysis

#### 5.3.1. Replay Attacks

The replay attacks are to send the sent message repeatedly, to launch some other attacks to interfere with normal communication. First, ifM1 is replayed, the session key cannot be successfully established between the user and the sensor, because the message cannot be validated by GWN, and further, because each round gi and N1 will be refreshed. So, let us see what happens when M2,M3,M4 are replayed? If M2 is replayed, the sensor passes the verification, and the same session key is established as the previous round, but the user will not verify this message because gi or A1 will be updated every round. If M3 or M4 is replayed, the user will not pass the verification, and the session will be terminated for the same reason as that of M2. Therefore, our improved protocol is resistant to replay attacks.


#### 5.3.2. Privileged-Insider Attacks

In this paper, we specify that privileged insiders only have access to the content stored in the gateway database. In other words, privileged insiders can getHIDi,IDi,gi, but to calculate sensitive information such as A1 and A3, they also need to obtain private information such as Pi and gateway key x, while Pi=hσiPWiIDi. Therefore, our improved protocol is resistant to privileged-insider attacks.


#### 5.3.3. Three-Factor Secrecy

The three factors are password, smart card, and biometric information. According to the previous analysis,A1 and Pi are the key parameters for launching an attack to compute the session key. Now, let A get any two of the three factors.
(1)
Password and smart card. Even ifA knows the password and can extract the parameters from SC, he cannot be able to calculate A1 and Pi for any attack(2)
Password and biometrics. IfA gets the password and biometrics and wants to compute A1, he needs to know A2 and Pi. However, A2 is stored on a smart card(3)
Biometrics and smart card. AfterA obtains the biometric and smart card, he/she needs to know the information about PWi and IDi to calculate Pi, so A cannot compute A1=A2⊕PiTherefore, our protocol provides three-factor secrecy.


#### 5.3.4. User Anonymity

The real identity of the user only appears in the registration phase, as well as the authentication phase. However, in the authentication phase, the user enters his/her identity only when he/she logs in. During the authentication process,HIDi is always protecting the user’s identity. Therefore, our protocol provides anonymity.


### 5.4. ProVerif

ProVerif [30, 32, 50–53] is a formal simulation tool for automatic verification of cryptographic protocols developed by Bruno Blanchet and based on the Dolev-Yao model. It can describe various cryptographic primitives such as public-key cryptography, shared key cryptography, and hash function, and the syntax used is easy to master. In this paper, we use the ProVerif tool to verify whether the proposed protocol has vulnerabilities. If there are vulnerabilities, the ProVerif tool will return an attack sequence. The specific operation is as follows.Our protocol involves three parties communicating with the user, sensor, and gateway, in addition to using two channels, an encrypted channel and a public channel. The symbols, functions, and related definitions involved in ProVerif are described in Figure4(a).Figure 4
Definitions and queries.
(a)
Definitions(b)
Events and queriesThe proposed protocol involves 6 events, namely, UserStarted(), UserAuthed(), SensorAcGWN(), GWNAcUser(), GWNAcSensor(), and UserAcGWN(), which, respectively, indicate that the user starts authentication, the user completes the authentication, the sensor completes the authentication to the gateway, the gateway completes the authentication to the user, the gateway completes the authentication to the sensor, and the user completes the authentication to the gateway. For the security of the proposed protocol, ProVerif will verify the user anonymity, the security of the session key, and the reasonableness of the authentication process. Figure4(b) shows these events and queries.Figure5(a) shows the operations performed by the user and the sensor in the ProVerif. Figure 5(b) shows the operation of the gateway in the ProVerif. Figure 5(c) shows the results obtained after using the ProVerif tool to complete the verification. According to Figure 5(c), it is obvious that the proposed protocol can provide user anonymity and session key security, while the authentication process is executed in sequence.Figure 5
Process and results.
(a)
Process(b)
Process(c)
Results


## 5.1. Correctness by BAN Logic

In this subsection, we use BAN logic to show the correctness of our improved protocol. As far as the proposed protocol is concerned, we need to prove thatUi, Sj, and GWN share a session key SK through rigorous logical analysis. The symbols and rules used for BAN logic are referred to [39–41].


### 5.1.1. Rules

(i)
R1 (Message meaning (M-M) rule): P∣≡P⇌YQ,P⊲XY/P∣≡Q∣∼X(ii)
R2 (Nonce verification (N-V) rule): P∣≡#X,P∣≡Q∣~X/P∣≡Q∣≡X(iii)
R3 (Jurisdiction rule): P∣≡Q∣⇒X,P∣≡Q∣≡X/P∣≡X(iv)
R4 (Session key (S-K) rule): P∣≡#X,P∣≡Q∣≡X/P∣≡P⟷KQ


### 5.1.2. Goals

(i)
G1: Ui∣≡Ui⟷SKSj(ii)
G2: Sj∣≡Ui⟷SKSj(iii)
G3: GWN∣≡Ui⟷SKSj(iv)
G4: Ui∣≡Sj∣≡Ui⟷SKSj(v)
G5:Sj∣≡Ui∣≡Ui⟷SKSj(vi)
G6:GWN∣≡Ui∣≡Ui⟷SKSj(vii)
G7:GWN∣≡Sj∣≡Ui⟷SKSj


### 5.1.3. Idealize the Communication Messages

(i)
M1:Ui⟶GWN:HIDi,C1,C2,C3,C4,T1.(ii)
M2:GWN⟶Sj:HIDi,C5,C6,C7,T2.(iii)
M3:Sj⟶GWN:C8,C9,T3.(iv)
M4:GWN⟶Ui:C10,C11,T4.(v)
M5:Sj⟶Ui:C8


### 5.1.4. Initial Assumptions

(i)
A1:Ui∣≡#N1(ii)
A2:Sj∣≡#N3(iii)
A3:GWN∣≡#N2(iv)
A4:GWN∣≡Ui∣⇒HIDi(v)
A5:GWN∣≡Ui⇌A1GWN(vi)
A6:GWN∣≡#N1(vii)
A7:GWN∣≡Ui∣⇒N1(viii)
A8:GWN∣≡#SIDj(ix)
A9:GWN∣≡Ui∣⇒SIDj(x)
A10:Sj∣≡GWN∣⇒HIDi(xi)
A11:Sj∣≡GWN∣≡SMj(xii)
A12:Sj∣≡#SMj(xiii)
A13:Sj∣≡#N2(xiv)
A14:Sj∣≡GWN∣⇒N2(xv)
A15:Sj∣≡#N1(xvi)
A16:GWN∣≡Sj⇌hN1N2GWN(xvii)
A17:GWN∣≡#N3(xviii)
A18:GWN∣≡Sj∣⇒N3(xix)
A19:Ui∣≡GWN∣≡A1(xx)
A20:Ui∣≡#A1(xxi)
A21:Ui∣≡#N2(xxii)
A22:Ui∣≡GWN∣⇒N2(xxiii)
A23:Ui∣≡Ui⇌hN1N2Sj(xxiv)
A24:Ui∣≡#N3(xxv)
A25:Ui∣≡Sj∣⇒N3(xxvi)
A26:Sj∣≡GWN∣⇒N1


### 5.1.5. The Proof of our Proposed Protocol via BAN Logic

ByM1, we have S1:GWN⊲HIDi,C1:N1,HIDiA1,C2,C3:SIDjA1,C4,T1 and further S2:GWN∣≡Ui∣≡HIDi. Base on A4, S2, and R3 (Jurisdiction rule), we can obtain S3:GWN∣≡HIDi. According to S1, it implies S4:GWN⊲N1,HIDiA1. By A5, S4, andR1 (M-M rule), it implies S5:GWN∣≡Ui∣~N1,HIDi. By A6, S5, and R2 (N-V rule), we can obtain S6:GWN∣≡Ui∣≡N1. According to A7, S6, and R3 (Jurisdiction rule), it implies S7:GWN∣≡N1. According to S1, we have S8:GWN⊲SIDjA1. By A5, S8, and R1 (M-M rule), it implies S9:GWN∣≡Ui∣~SIDj. By A8, S9, and R2 (N-V rule), we can obtain S10:GWN∣≡Ui∣≡SIDj. According to A9, S10, andR3 (Jurisdiction rule), it implies S11:GWN∣≡SIDj.ByM2, we have S12:Sj⊲HIDi,C5:N2hSIDjSMjT2,C6:N1hSMjN2,C7,T2 and further S13:Sj∣≡GWN∣≡HIDi. Base on A10, S13, and R3 (Jurisdiction rule), we can obtain S14:Sj∣≡HIDi. By A11, A12, and R4 (S-K rule), it implies S15:Sj∣≡Sj⇌hSIDjSMjT2GWN. According to S12, we have S16:Sj⊲N2hSIDjSMjT2. Base on S15, S16, and R1 (M-M rule), it implies S17:Sj∣≡GWN∣~N2. By A13, S17 and R2 (N-V rule), we can obtain S18:Sj∣≡GWN∣≡N2. According to A14, S18, and R3 (Jurisdiction rule), it implies S19:Sj∣≡N2. Base on A11, A12, and R4 (S-K rule), we have S20:Sj∣≡Sj⇌hSMjN2GWN. According to S12, we have S21:Sj⊲N1hSMjN2. By S20, S21, and R1 (M-M rule), it implies S22:Sj∣≡GWN∣~N1. By A15, S22, and R2 (N-V rule), we can obtain S23:Sj∣≡GWN∣≡N1. Base on A26, S23, and R3 (Jurisdiction rule), it implies S24:Sj∣≡N1. Since SK=hN1N2N3HIDjSIDj, S25:Sj∣≡Ui⟷SKSj is obtained. G2 According to A2, S25, and R4 (S-K rule), we can obtain S26:GWN∣≡Ui⇌A1GWN. G5.ByM3, we have S27:GWN⊲C8:N3hN1N2,C9,T3 and further S28:GWN⊲N3hN1N2. Base on A16, S28, and R1 (M-M rule), we can obtain S29:GWN∣≡Sj∣~N3. By A17, S29 and R2 (N-V rule), it implies S30:GWN∣≡Sj∣≡N3. Base on A18, S30 and R3 (Jurisdiction rule), we can obtain S31:GWN∣≡N3. According to S2, S11, and S31, it implies S32:GWN∣≡Ui⟷SKSj. G3 Base on A6, S32, and R4 (S-K rule), we can obtain S33:GWN∣≡Ui∣≡Ui⟷SKSj.G6 According to A27, S32, and R4 (S-K rule), it implies S34:GWN∣≡Sj∣≡Ui⟷SKSj. G7ByM4, we have S35:Ui⊲C10:N2hA1PiN1T4,C11,T4. Base on A19, A20, and R4 (S-K rule), we can obtain S36:Ui∣≡Ui⇌hA1PiN1T4GWN. According to S35, we have S37:Ui⊲N2hA1PiN1T4. Base on S36, S37, and R1 (M-M rule), it implies S38:Ui∣≡GWN∣~N2. By A21, S38, and R2 (N-V rule), we can obtain S39:Ui∣≡GWN∣≡N2. According to A22, S39, and R3 (Jurisdiction rule), it implies S40:Ui∣≡N2.ByM5, we have S41:Ui⊲C8:N3hN1N2. Base onA23, S41, and R1 (M-M rule), it implies S42:Ui∣≡Sj∣~N3. By A24, S42, and R2 (N-V rule), we can obtain S43:Ui∣≡Sj∣≡N3. Base on A25, S43, and R3 (Jurisdiction rule), it implies S44:Ui∣≡N3. According to S40 and S44, we can obtain S45:Ui∣≡Ui⟷SKSj. G1 According to A24 and S45, we can obtain S45:Ui∣≡Sj∣≡Ui⟷SKSj. G4


## 5.1.1. Rules

(i)
R1 (Message meaning (M-M) rule): P∣≡P⇌YQ,P⊲XY/P∣≡Q∣∼X(ii)
R2 (Nonce verification (N-V) rule): P∣≡#X,P∣≡Q∣~X/P∣≡Q∣≡X(iii)
R3 (Jurisdiction rule): P∣≡Q∣⇒X,P∣≡Q∣≡X/P∣≡X(iv)
R4 (Session key (S-K) rule): P∣≡#X,P∣≡Q∣≡X/P∣≡P⟷KQ


## 5.1.2. Goals

(i)
G1: Ui∣≡Ui⟷SKSj(ii)
G2: Sj∣≡Ui⟷SKSj(iii)
G3: GWN∣≡Ui⟷SKSj(iv)
G4: Ui∣≡Sj∣≡Ui⟷SKSj(v)
G5:Sj∣≡Ui∣≡Ui⟷SKSj(vi)
G6:GWN∣≡Ui∣≡Ui⟷SKSj(vii)
G7:GWN∣≡Sj∣≡Ui⟷SKSj


## 5.1.3. Idealize the Communication Messages

(i)
M1:Ui⟶GWN:HIDi,C1,C2,C3,C4,T1.(ii)
M2:GWN⟶Sj:HIDi,C5,C6,C7,T2.(iii)
M3:Sj⟶GWN:C8,C9,T3.(iv)
M4:GWN⟶Ui:C10,C11,T4.(v)
M5:Sj⟶Ui:C8


## 5.1.4. Initial Assumptions

(i)
A1:Ui∣≡#N1(ii)
A2:Sj∣≡#N3(iii)
A3:GWN∣≡#N2(iv)
A4:GWN∣≡Ui∣⇒HIDi(v)
A5:GWN∣≡Ui⇌A1GWN(vi)
A6:GWN∣≡#N1(vii)
A7:GWN∣≡Ui∣⇒N1(viii)
A8:GWN∣≡#SIDj(ix)
A9:GWN∣≡Ui∣⇒SIDj(x)
A10:Sj∣≡GWN∣⇒HIDi(xi)
A11:Sj∣≡GWN∣≡SMj(xii)
A12:Sj∣≡#SMj(xiii)
A13:Sj∣≡#N2(xiv)
A14:Sj∣≡GWN∣⇒N2(xv)
A15:Sj∣≡#N1(xvi)
A16:GWN∣≡Sj⇌hN1N2GWN(xvii)
A17:GWN∣≡#N3(xviii)
A18:GWN∣≡Sj∣⇒N3(xix)
A19:Ui∣≡GWN∣≡A1(xx)
A20:Ui∣≡#A1(xxi)
A21:Ui∣≡#N2(xxii)
A22:Ui∣≡GWN∣⇒N2(xxiii)
A23:Ui∣≡Ui⇌hN1N2Sj(xxiv)
A24:Ui∣≡#N3(xxv)
A25:Ui∣≡Sj∣⇒N3(xxvi)
A26:Sj∣≡GWN∣⇒N1


## 5.1.5. The Proof of our Proposed Protocol via BAN Logic

ByM1, we have S1:GWN⊲HIDi,C1:N1,HIDiA1,C2,C3:SIDjA1,C4,T1 and further S2:GWN∣≡Ui∣≡HIDi. Base on A4, S2, and R3 (Jurisdiction rule), we can obtain S3:GWN∣≡HIDi. According to S1, it implies S4:GWN⊲N1,HIDiA1. By A5, S4, andR1 (M-M rule), it implies S5:GWN∣≡Ui∣~N1,HIDi. By A6, S5, and R2 (N-V rule), we can obtain S6:GWN∣≡Ui∣≡N1. According to A7, S6, and R3 (Jurisdiction rule), it implies S7:GWN∣≡N1. According to S1, we have S8:GWN⊲SIDjA1. By A5, S8, and R1 (M-M rule), it implies S9:GWN∣≡Ui∣~SIDj. By A8, S9, and R2 (N-V rule), we can obtain S10:GWN∣≡Ui∣≡SIDj. According to A9, S10, andR3 (Jurisdiction rule), it implies S11:GWN∣≡SIDj.ByM2, we have S12:Sj⊲HIDi,C5:N2hSIDjSMjT2,C6:N1hSMjN2,C7,T2 and further S13:Sj∣≡GWN∣≡HIDi. Base on A10, S13, and R3 (Jurisdiction rule), we can obtain S14:Sj∣≡HIDi. By A11, A12, and R4 (S-K rule), it implies S15:Sj∣≡Sj⇌hSIDjSMjT2GWN. According to S12, we have S16:Sj⊲N2hSIDjSMjT2. Base on S15, S16, and R1 (M-M rule), it implies S17:Sj∣≡GWN∣~N2. By A13, S17 and R2 (N-V rule), we can obtain S18:Sj∣≡GWN∣≡N2. According to A14, S18, and R3 (Jurisdiction rule), it implies S19:Sj∣≡N2. Base on A11, A12, and R4 (S-K rule), we have S20:Sj∣≡Sj⇌hSMjN2GWN. According to S12, we have S21:Sj⊲N1hSMjN2. By S20, S21, and R1 (M-M rule), it implies S22:Sj∣≡GWN∣~N1. By A15, S22, and R2 (N-V rule), we can obtain S23:Sj∣≡GWN∣≡N1. Base on A26, S23, and R3 (Jurisdiction rule), it implies S24:Sj∣≡N1. Since SK=hN1N2N3HIDjSIDj, S25:Sj∣≡Ui⟷SKSj is obtained. G2 According to A2, S25, and R4 (S-K rule), we can obtain S26:GWN∣≡Ui⇌A1GWN. G5.ByM3, we have S27:GWN⊲C8:N3hN1N2,C9,T3 and further S28:GWN⊲N3hN1N2. Base on A16, S28, and R1 (M-M rule), we can obtain S29:GWN∣≡Sj∣~N3. By A17, S29 and R2 (N-V rule), it implies S30:GWN∣≡Sj∣≡N3. Base on A18, S30 and R3 (Jurisdiction rule), we can obtain S31:GWN∣≡N3. According to S2, S11, and S31, it implies S32:GWN∣≡Ui⟷SKSj. G3 Base on A6, S32, and R4 (S-K rule), we can obtain S33:GWN∣≡Ui∣≡Ui⟷SKSj.G6 According to A27, S32, and R4 (S-K rule), it implies S34:GWN∣≡Sj∣≡Ui⟷SKSj. G7ByM4, we have S35:Ui⊲C10:N2hA1PiN1T4,C11,T4. Base on A19, A20, and R4 (S-K rule), we can obtain S36:Ui∣≡Ui⇌hA1PiN1T4GWN. According to S35, we have S37:Ui⊲N2hA1PiN1T4. Base on S36, S37, and R1 (M-M rule), it implies S38:Ui∣≡GWN∣~N2. By A21, S38, and R2 (N-V rule), we can obtain S39:Ui∣≡GWN∣≡N2. According to A22, S39, and R3 (Jurisdiction rule), it implies S40:Ui∣≡N2.ByM5, we have S41:Ui⊲C8:N3hN1N2. Base onA23, S41, and R1 (M-M rule), it implies S42:Ui∣≡Sj∣~N3. By A24, S42, and R2 (N-V rule), we can obtain S43:Ui∣≡Sj∣≡N3. Base on A25, S43, and R3 (Jurisdiction rule), it implies S44:Ui∣≡N3. According to S40 and S44, we can obtain S45:Ui∣≡Ui⟷SKSj. G1 According to A24 and S45, we can obtain S45:Ui∣≡Sj∣≡Ui⟷SKSj. G4


## 5.2. Formal Security Analysis

In this section, we perform a formal security analysis of the improved protocol in ROR model [42–48]. The proposed protocol involves three entities, Ui, Sj, and GWN. We use ΠUx,, and ΠGWNz to represent the xth instance of Ui, the yth instance of Sj, and the zth instance of GWN, respectively. Here, we define that adversary A has the ability to initiate the following query. Note that, O=ΠUx,ΠSy,ΠGWNz.
(i)
𝐸𝑥𝑒𝑐𝑢𝑡𝑒(O): if A executes this query, it can obtain an entire communication record on the public channel(ii)
S𝑒𝑛𝑑(O, 𝑀): if A executes this query, it can send M to O and receive the response from O(iii)
Hashstring: if A executes this query, it can input string to get its hash value(iv)
CorruptO: if A executes this query, it can get secret values of one party, such as some parameter stored in the smart card, long-term secret key, or temporary information(v)
TestO: if A executes this query, it flips a coin C. If C=1, then can get the correct session key; if C=0, A gets a random string of the same length as the session keyTheorem 1.
In the ROR model, assume thatA can make Execute, Send, Hash, Corrupt, and Test queries. Then, the advantage of A to break the proposed protocol P in polynomial time ξ is AdvAPξ≤qsend/2l−2+3qhash2/2l−1+2maxC′⋅qsends′,qsend/2l, where qsend is the number of times to execute Send queries, qhash is the number of times to execute Hash queries, C′ and s′ are two constants [49], and l is the bits of biological information.Proof.
We prove this theorem by following game sequencesGM0 to GM5. SuccAGMnξ is defined by the probability that A succeeds in GMn, which is the probability that C=1. The detailed simulations of queries in real attacks are shown in Tables 2 and 3. The details are as follows.Table 2
Simulation ofSend query.
On a querySendΠUx,start, assuming that ΠUx is a normal state, we perform the following operations. Select NA1, TA1, and compute A1=A2⊕Pi, C1=N1⊕hA1HIDi, C2=IDi⊕hHIDiA1TA1, C3=SIDj⊕hA1NA1TA1, C4=hIDiHIDiSIDjNA1TA1. Then, the query is answered by M1=HIDi,C1,C2,C3,C4,T1.On a querySendΠGWNz,HIDi,C1,C2,C3,C4,T1 and assume that ΠGWNz is a normal state to perform the following operations. Compute Ai,IDi,N1,SIDj, C4, and check A1. If equal, select NA2, TA2, and compute SMj,C5,C6,C7. Then, the query is answered by M2=HIDi,C5,C6,C7,T2.On a querySendΠSy,HIDi,C5,C6,C7,T2, assuming that ΠSy is a normal state, do the following. Compute N2,N1,C7, check C7. If equal, select NA3, TA3, and compute SKs,C8,C9. Then, the query is answered by M3=C8,C9,T3.On a querySendΠGWNz,C8,C9,T3 and assume that ΠGWNz is a normal state to perform the following operations. Compute N3,SKg,C9, and check C9. If equal, select TA4, and compute C10,C11. Then, the query is answered by M4=C8,C10,C11,T4.On a query, assuming thatΠUx is a normal state, we perform the following operations. Compute N2,N3,SKu,C11, the instance ΠUx checks C11; if not equal, it will be terminated. Otherwise, compute SK=hN1N2N3HIDjSIDj. Finally, the user instance accepts and terminates.Table 3
Simulation ofExecute,Corrupt, and Test query.
On aExecute query, we use the simulation of Send query to do the following operations: HIDi,C1,C2,C3,C4,T1⟵SendΠUx,start, HIDi,C5,C6,C7,T2⟵SendΠGWNz,HIDi,C1,C2,C3,C4,T1, C8,C9,T3⟵SendΠSy,HIDi,C5,C6,C7,T2, C8,C10,C11,T4⟵SendΠGWNz,C8,C9,T3. This query is answered by HIDi,C1,C2,C3,C4,T1, HIDi,C5,C6,C7,T2, C8,C9,T3, and C8,C10,C11,T4.For a recordstring,r that appears in the Hashstring query, return r=Hashstring. Otherwise, select an element r, add the record string,r to the list, and return r.On a queryCorruptΠUx, and if ΠUx is accepted, the query is answered by the parameter A2,A3,τi in the smart card.On aTest query, flip a coin C to get the result of SK. If C=1, return SK; otherwise, return a string of the same length.GM0: Flip C to start the game. GM0 is a game played without any queries. Therefore, we can get the probability of A successfully breaking P as
(1)AdvAPξ=2PrSuccAGM0ξ−1.GM1: The difference between GM1 and GM0 is that GM1 adds the Execute query. In GM1, A just gets messages M1=HIDi,C1,C2,C3,C4,T1, M2=HIDi,C5,C6,C7,T2, M3=C8,C9,T3, and M4=C8,C10,C11,T4. After GM1 is over, A queries the session key through Test, but N1,N2, and N3 are all confidential to A. Therefore, the probability of GM1 and GM0 is equal, that is,
(2)PrSuccAGM1ξ=PrSuccAGM0ξ.GM2: The difference between GM2 and GM1 is that GM2 adds the Send query. According to Zipf’s law [49], we can get
(3)∣PrSuccAGM2ξ−PrSuccAGM1ξ∣≤qsend2l.GM3: The difference between GM3 and GM2 is that GM3 adds the Hash query and deletes the Send query. According to the birthday paradox, we can get
(4)∣PrSuccAGM3ξ−PrSuccAGM2ξ∣≤qhash22l+1.GM4: In this game, we discuss the security of the session key in two cases. The first is to obtain the long-term private key x of ΠGWNz to verify the perfect forward security; the second is to get temporary information to verify whether the known session-specific temporary information attacks can be resisted.
(1)
Perfect forward security.A uses ΠGWNz to try to get the private key x of GWN or uses ΠUx or ΠSy to try to get a secret value in the registration phase(2)
Known session-specific temporary information attacks.A uses either ΠUx or ΠSy or ΠGWNz to try to obtain the temporary information of the corresponding partyIn both cases,A can only compute the session key through Send and Hash queries. For the first case, if A only knows the private key x of GWN, or a secret value of ΠUx or ΠSy in the registration phase, it cannot get the temporary information N1,N2, and N3 in SK=hN1N2N3HIDjSIDj. For the second case, we assume that A gets N1, but N2 and N3 are kept secret. Similarly, if N2 or N3 is leaked, the session key cannot be calculated. Therefore, we have
(5)∣PrSuccAGM4ξ−PrSuccAGM3ξ∣≤qsend2l+qhash2/2l+1.GM5: In this game, A uses CorruptΠUx to get the parameters A2,A3,τi stored in the SC and attempts to launch the stolen smart card attacks and the offline password guessing attacks. Suppose A gets HIDi according to M1, and computes σi=RepBi,τi, Pi=hσiPWiIDi, A3′=hHIDiPi until A3′=A3. However, Bi, PWi, and IDi are all confidential to A. The probability that A can guess the biological information of the l bits is 1/2l [50]. In Zipf’s law [49], the probability of guessing the password is more than 0.5 when qsend≤106. Therefore, we get
(6)∣PrSuccAGM5ξ−PrSuccAGM4ξ∣≤maxC′⋅qsends′,qsend2l,where C′ and s′ are constants depending on the size of the password.GM6: The purpose of this game is to verify whether it can resist impersonation attacks. The difference between GM6 and GM5 is that when GM6 initiates hN1N2N3HIDjSIDj query to guess the session key, the game is terminated. Therefore, we have
(7)∣PrSuccAGM6ξ−PrSuccAGM5ξ∣≤qhash22l+1.Since the probability ofGM6 success and failure is equal, the probability of A successfully guessing the session key is
(8)PrSuccAGM0ξ=12.According to formulas (1) to (8), we can get
(9)12AdvAPξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤∑i=05PrSuccAGMi+1ξ−PrSuccAGMiξ=qsend2l−1+3qhash22l+maxC′⋅qsends′,qsend2l.Thus, we haveAdvAPξ≤qsend/2l−2+3qhash2/2l−1+2maxC′⋅qsends′,qsend/2l.


## 5.3. Informal Security Analysis

### 5.3.1. Replay Attacks

The replay attacks are to send the sent message repeatedly, to launch some other attacks to interfere with normal communication. First, ifM1 is replayed, the session key cannot be successfully established between the user and the sensor, because the message cannot be validated by GWN, and further, because each round gi and N1 will be refreshed. So, let us see what happens when M2,M3,M4 are replayed? If M2 is replayed, the sensor passes the verification, and the same session key is established as the previous round, but the user will not verify this message because gi or A1 will be updated every round. If M3 or M4 is replayed, the user will not pass the verification, and the session will be terminated for the same reason as that of M2. Therefore, our improved protocol is resistant to replay attacks.


### 5.3.2. Privileged-Insider Attacks

In this paper, we specify that privileged insiders only have access to the content stored in the gateway database. In other words, privileged insiders can getHIDi,IDi,gi, but to calculate sensitive information such as A1 and A3, they also need to obtain private information such as Pi and gateway key x, while Pi=hσiPWiIDi. Therefore, our improved protocol is resistant to privileged-insider attacks.


### 5.3.3. Three-Factor Secrecy

The three factors are password, smart card, and biometric information. According to the previous analysis,A1 and Pi are the key parameters for launching an attack to compute the session key. Now, let A get any two of the three factors.
(1)
Password and smart card. Even ifA knows the password and can extract the parameters from SC, he cannot be able to calculate A1 and Pi for any attack(2)
Password and biometrics. IfA gets the password and biometrics and wants to compute A1, he needs to know A2 and Pi. However, A2 is stored on a smart card(3)
Biometrics and smart card. AfterA obtains the biometric and smart card, he/she needs to know the information about PWi and IDi to calculate Pi, so A cannot compute A1=A2⊕PiTherefore, our protocol provides three-factor secrecy.


### 5.3.4. User Anonymity

The real identity of the user only appears in the registration phase, as well as the authentication phase. However, in the authentication phase, the user enters his/her identity only when he/she logs in. During the authentication process,HIDi is always protecting the user’s identity. Therefore, our protocol provides anonymity.


## 5.3.1. Replay Attacks

The replay attacks are to send the sent message repeatedly, to launch some other attacks to interfere with normal communication. First, ifM1 is replayed, the session key cannot be successfully established between the user and the sensor, because the message cannot be validated by GWN, and further, because each round gi and N1 will be refreshed. So, let us see what happens when M2,M3,M4 are replayed? If M2 is replayed, the sensor passes the verification, and the same session key is established as the previous round, but the user will not verify this message because gi or A1 will be updated every round. If M3 or M4 is replayed, the user will not pass the verification, and the session will be terminated for the same reason as that of M2. Therefore, our improved protocol is resistant to replay attacks.


## 5.3.2. Privileged-Insider Attacks

In this paper, we specify that privileged insiders only have access to the content stored in the gateway database. In other words, privileged insiders can getHIDi,IDi,gi, but to calculate sensitive information such as A1 and A3, they also need to obtain private information such as Pi and gateway key x, while Pi=hσiPWiIDi. Therefore, our improved protocol is resistant to privileged-insider attacks.


## 5.3.3. Three-Factor Secrecy

The three factors are password, smart card, and biometric information. According to the previous analysis,A1 and Pi are the key parameters for launching an attack to compute the session key. Now, let A get any two of the three factors.
(1)
Password and smart card. Even ifA knows the password and can extract the parameters from SC, he cannot be able to calculate A1 and Pi for any attack(2)
Password and biometrics. IfA gets the password and biometrics and wants to compute A1, he needs to know A2 and Pi. However, A2 is stored on a smart card(3)
Biometrics and smart card. AfterA obtains the biometric and smart card, he/she needs to know the information about PWi and IDi to calculate Pi, so A cannot compute A1=A2⊕PiTherefore, our protocol provides three-factor secrecy.


## 5.3.4. User Anonymity

The real identity of the user only appears in the registration phase, as well as the authentication phase. However, in the authentication phase, the user enters his/her identity only when he/she logs in. During the authentication process,HIDi is always protecting the user’s identity. Therefore, our protocol provides anonymity.


## 5.4. ProVerif

ProVerif [30, 32, 50–53] is a formal simulation tool for automatic verification of cryptographic protocols developed by Bruno Blanchet and based on the Dolev-Yao model. It can describe various cryptographic primitives such as public-key cryptography, shared key cryptography, and hash function, and the syntax used is easy to master. In this paper, we use the ProVerif tool to verify whether the proposed protocol has vulnerabilities. If there are vulnerabilities, the ProVerif tool will return an attack sequence. The specific operation is as follows.Our protocol involves three parties communicating with the user, sensor, and gateway, in addition to using two channels, an encrypted channel and a public channel. The symbols, functions, and related definitions involved in ProVerif are described in Figure4(a).Figure 4
Definitions and queries.
(a)
Definitions(b)
Events and queriesThe proposed protocol involves 6 events, namely, UserStarted(), UserAuthed(), SensorAcGWN(), GWNAcUser(), GWNAcSensor(), and UserAcGWN(), which, respectively, indicate that the user starts authentication, the user completes the authentication, the sensor completes the authentication to the gateway, the gateway completes the authentication to the user, the gateway completes the authentication to the sensor, and the user completes the authentication to the gateway. For the security of the proposed protocol, ProVerif will verify the user anonymity, the security of the session key, and the reasonableness of the authentication process. Figure4(b) shows these events and queries.Figure5(a) shows the operations performed by the user and the sensor in the ProVerif. Figure 5(b) shows the operation of the gateway in the ProVerif. Figure 5(c) shows the results obtained after using the ProVerif tool to complete the verification. According to Figure 5(c), it is obvious that the proposed protocol can provide user anonymity and session key security, while the authentication process is executed in sequence.Figure 5
Process and results.
(a)
Process(b)
Process(c)
Results


## 6. Performance Comparison

In this section, we analyze the security and performance efficiency of the advanced protocol with that of [32, 35, 36].


### 6.1. Security Comparison

In Table4, we demonstrate the security comparison. It is easy to see that our protocol is secure against well-known attacks. Das et al.’s protocol [32] cannot resist offline password guessing attacks and stolen smart card attacks. Meanwhile, their protocol does not provide perfect forward security and user anonymity. Although Chen et al.’s protocol [35] satisfies the last three vulnerabilities A5, A8, and A9, it still cannot resist the offline password guessing attacks. Wu et al.’s protocol [36] can resist offline password guessing attacks, but it is vulnerable to known session-specific temporary information attacks, impersonation attacks, and cannot provide perfect forward security and user anonymity.Table 4
Security comparison.
Das et al.’s protocol [32]Chen et al.’s protocol [35]Wu et al.’s protocol [36]Our protocolA1√√×√A2√√√√A3√√×√A4√√√√A5× [34]√√√A6× [36]× [36]√√A7√√√√A8× [34]√×√A9× [34]√×√A1: known session-specific temporary information attacks; A2: user impersonation attacks; A3: sensor impersonation attacks; A4: man-in-the-middle attacks; A5: stolen smart card attacks; A6: off-line password guessing attacks; A7: privileged-insider attacks; A8: perfect forward secrecy; A9: user anonymity. The “√” denotes that this protocol can resist the attack. The “×” denotes that the protocol cannot resist the attack.


### 6.2. Computational Cost Comparison

The performance is analyzed from the computation cost of protocols. Because the computational cost of XOR and join operations is too small, it can be ignored in comparison. Here, compare the consumption of login authentication and the key exchange phase.Tf represents the time to execute a fuzzy extraction function. Th represents the time to perform a hash operation. Ts represents the time to perform the symmetric encryption/decryption operation. Table 5 shows the computational cost comparison. The results show that the fuzzy extraction function Tf is used once in the total computational cost of each protocol. In addition, Das et al.’s protocol [32], Wu et al.’s protocol [36], and our protocol all use hash operations. However, our protocol has the least number of hash operations. Chen et al.’s protocol [35] not only performed 18 hashing operations but also performed four symmetric encryption/decryption operations, consuming 4Ts. As we all know, the cost of symmetric encryption/decryption operation is very higher than the cost of hash operation. In other words, our improved protocol has a lower computational cost and provides higher security than previous protocols.Table 5
Computational cost comparison.
Das et al.’s protocol [32]Chen et al.’s protocol [35]Wu et al.’s protocol [36]Our protocolUserTf+17ThTf+Ts+10ThTf+13ThTf+11ThGateway12Th2Ts+3Th15Th14ThSensor9ThTs+5Th4Th6ThTotalTf+38ThTf+4Ts+18ThTf+32ThTf+31Th


### 6.3. Communication Cost Comparison

The performance is analyzed from the communication cost of protocols. We accept that the random number and identity are 160 bits, hash operation and the length of the ciphertext for symmetric encryption are 256 bits, and the timestamp is 32 bits.In Das et al.’s protocol [32], the messages in the login and authentication phase are Msg1=TIDi′,Xi,Yi,Zi,T1, Msg2=Xgw,Ygw,Zgw,T2, and Msg3=Vj,Wj,T3, where TIDi′ is an identity, Xi,Yi,Xgw,Ygw,Vj belong to random strings, Zi,Zgw,Wj are hash values, and T1,T2,T3 are timestamps. The total communication cost of [32] is 1824 bits.In Chen et al.’s protocol [35], the messages in the login and authentication phase are M1, M2,Ng, and M3,CDIDj,Ack,Nj, where M1,M2 are ciphertexts, Ng,CDIDj,Ack are random strings, and M3 is a hash value. The total communication cost of [35] is 1248 bits.In Wu et al.’s protocol [36], the messages in the authentication phase are M1=PIDi,D1,D2,D3,D4,D5,T1, M2=D6,D7,IDg,T2, M3=D8,D9,T3, and M4=D8,D10,D11,D12,T4, where PIDi,IDg are identities, D1,D2,D3,D4,D6,D8,D10,D11 are random strings, D5,D7,D9,D12 are hash values, and T1,T2,T3,T4 are timestamps. The total communication cost of [36] is 2912 bits.In our protocol, the messages in the authentication phase areM1=HIDi,C1,C2,C3,C4,T1, M2=HIDi,C5,C6,C7,T2, M3=C8,C9,T3, and M4=C8,C10,C11,T4, where C1,C2,C3,C5,C6,C8,C10 are random strings, HIDi,C4,C7,C9,C11 are hash values, and T1,T2,T3,T4 are timestamps. The total communication cost of our protocol is 2944 bits. The communication cost comparison is shown in Table 6.Table 6
Communication cost comparison.
RoundsCommunication costDas et al.’s protocol [32]31824 bitsChen et al.’s protocol [35]31248 bitsWu et al.’s protocol [36]42912 bitsOur protocol42944 bitsAccording to Table6, we can see that the number of rounds of Das et al.’s and Chen et al.’s protocol is less than the one of Wu et al.’s and our protocol. It is obvious that the communication cost of the first two protocols is lower. However, in Table 5, it can be seen that the computational costs of the first two protocols are relatively high. Although our protocol has a slightly higher communication cost than [36], the efficiency in practical application is almost the same. Furthermore, in Table 4, Wu et al.’s protocol [36] cannot resist known session-specific temporary information attacks and impersonation attacks and cannot provide perfect forward security and user anonymity.


## 6.1. Security Comparison

In Table4, we demonstrate the security comparison. It is easy to see that our protocol is secure against well-known attacks. Das et al.’s protocol [32] cannot resist offline password guessing attacks and stolen smart card attacks. Meanwhile, their protocol does not provide perfect forward security and user anonymity. Although Chen et al.’s protocol [35] satisfies the last three vulnerabilities A5, A8, and A9, it still cannot resist the offline password guessing attacks. Wu et al.’s protocol [36] can resist offline password guessing attacks, but it is vulnerable to known session-specific temporary information attacks, impersonation attacks, and cannot provide perfect forward security and user anonymity.Table 4
Security comparison.
Das et al.’s protocol [32]Chen et al.’s protocol [35]Wu et al.’s protocol [36]Our protocolA1√√×√A2√√√√A3√√×√A4√√√√A5× [34]√√√A6× [36]× [36]√√A7√√√√A8× [34]√×√A9× [34]√×√A1: known session-specific temporary information attacks; A2: user impersonation attacks; A3: sensor impersonation attacks; A4: man-in-the-middle attacks; A5: stolen smart card attacks; A6: off-line password guessing attacks; A7: privileged-insider attacks; A8: perfect forward secrecy; A9: user anonymity. The “√” denotes that this protocol can resist the attack. The “×” denotes that the protocol cannot resist the attack.


## 6.2. Computational Cost Comparison

The performance is analyzed from the computation cost of protocols. Because the computational cost of XOR and join operations is too small, it can be ignored in comparison. Here, compare the consumption of login authentication and the key exchange phase.Tf represents the time to execute a fuzzy extraction function. Th represents the time to perform a hash operation. Ts represents the time to perform the symmetric encryption/decryption operation. Table 5 shows the computational cost comparison. The results show that the fuzzy extraction function Tf is used once in the total computational cost of each protocol. In addition, Das et al.’s protocol [32], Wu et al.’s protocol [36], and our protocol all use hash operations. However, our protocol has the least number of hash operations. Chen et al.’s protocol [35] not only performed 18 hashing operations but also performed four symmetric encryption/decryption operations, consuming 4Ts. As we all know, the cost of symmetric encryption/decryption operation is very higher than the cost of hash operation. In other words, our improved protocol has a lower computational cost and provides higher security than previous protocols.Table 5
Computational cost comparison.
Das et al.’s protocol [32]Chen et al.’s protocol [35]Wu et al.’s protocol [36]Our protocolUserTf+17ThTf+Ts+10ThTf+13ThTf+11ThGateway12Th2Ts+3Th15Th14ThSensor9ThTs+5Th4Th6ThTotalTf+38ThTf+4Ts+18ThTf+32ThTf+31Th


## 6.3. Communication Cost Comparison

The performance is analyzed from the communication cost of protocols. We accept that the random number and identity are 160 bits, hash operation and the length of the ciphertext for symmetric encryption are 256 bits, and the timestamp is 32 bits.In Das et al.’s protocol [32], the messages in the login and authentication phase are Msg1=TIDi′,Xi,Yi,Zi,T1, Msg2=Xgw,Ygw,Zgw,T2, and Msg3=Vj,Wj,T3, where TIDi′ is an identity, Xi,Yi,Xgw,Ygw,Vj belong to random strings, Zi,Zgw,Wj are hash values, and T1,T2,T3 are timestamps. The total communication cost of [32] is 1824 bits.In Chen et al.’s protocol [35], the messages in the login and authentication phase are M1, M2,Ng, and M3,CDIDj,Ack,Nj, where M1,M2 are ciphertexts, Ng,CDIDj,Ack are random strings, and M3 is a hash value. The total communication cost of [35] is 1248 bits.In Wu et al.’s protocol [36], the messages in the authentication phase are M1=PIDi,D1,D2,D3,D4,D5,T1, M2=D6,D7,IDg,T2, M3=D8,D9,T3, and M4=D8,D10,D11,D12,T4, where PIDi,IDg are identities, D1,D2,D3,D4,D6,D8,D10,D11 are random strings, D5,D7,D9,D12 are hash values, and T1,T2,T3,T4 are timestamps. The total communication cost of [36] is 2912 bits.In our protocol, the messages in the authentication phase areM1=HIDi,C1,C2,C3,C4,T1, M2=HIDi,C5,C6,C7,T2, M3=C8,C9,T3, and M4=C8,C10,C11,T4, where C1,C2,C3,C5,C6,C8,C10 are random strings, HIDi,C4,C7,C9,C11 are hash values, and T1,T2,T3,T4 are timestamps. The total communication cost of our protocol is 2944 bits. The communication cost comparison is shown in Table 6.Table 6
Communication cost comparison.
RoundsCommunication costDas et al.’s protocol [32]31824 bitsChen et al.’s protocol [35]31248 bitsWu et al.’s protocol [36]42912 bitsOur protocol42944 bitsAccording to Table6, we can see that the number of rounds of Das et al.’s and Chen et al.’s protocol is less than the one of Wu et al.’s and our protocol. It is obvious that the communication cost of the first two protocols is lower. However, in Table 5, it can be seen that the computational costs of the first two protocols are relatively high. Although our protocol has a slightly higher communication cost than [36], the efficiency in practical application is almost the same. Furthermore, in Table 4, Wu et al.’s protocol [36] cannot resist known session-specific temporary information attacks and impersonation attacks and cannot provide perfect forward security and user anonymity.


## 7. Conclusion

In this paper, we have described the protocol of Wu et al. and found that their protocol was unable to resist known session-specific temporary information attacks, violated perfect forward and backward security, and could not provide user anonymity. In order to solve the vulnerabilities, we proposed a provably secure three-factor authentication protocol, which is proved to be secure by formal and informal security analysis, and the BAN logic, and the ProVerif tool. Finally, through the comparison of performance and security, our protocol can better ensure security and efficiency. In future work, we will work to further improve the security and performance of protocols in wireless sensors.



---

*Source: 5537018-2021-04-16.xml*