# An Improved Anonymous Authentication Protocol for Wearable Health Monitoring Systems

Authors: Jiaqing Mo; Wei Shen; Weisheng Pan
Journal: Wireless Communications and Mobile Computing
 (2020)

---

## Abstract

Wearable health monitoring system (WHMS), which helps medical professionals to collect patients’ healthcare data and provides diagnosis via mobile devices, has become increasingly popular thanks to the significant advances in the wireless sensor network. Because health data are privacy-related, they should be protected from illegal access when transmitted over a public wireless channel. Recently, Jiang et al. presented a two-factor authentication protocol on quadratic residues with fuzzy verifier for WHMS. However, we observe that their scheme is vulnerable to known session special temporary information (KSSTI) attack, privileged insider attack, and denial-of-service (DoS) attack. To defeat these weaknesses, we propose an improved two-factor authentication and key agreement scheme for WHMS. Through rigorous formal proofs under the random oracle model and comprehensive informal security analysis, we demonstrate that the improved scheme overcomes the disadvantages of Jiang et al.’s protocol and withstands possible known attacks. In addition, comparisons with several relevant protocols show that the proposed scheme achieves more security features and has suitable efficiency. Thus, our scheme is a reasonable authentication solution for WHMS.


---

## Body

## 1. Introduction

At present, electronic-health (e-health) services are greatly promoted with the significant advances in computer science, wireless communication technologies, low-power sensors, and various security solutions [1–8] have been developed to build secure e-health systems. Wireless sensor network (WSN) plays an important role in e-health via sensing, measuring, gathering patient’s information for doctor’s diagnosis, or recording in the medical server. Wearable health monitoring system (WHMS), one of the most popular application of e-health notation, has attracted extensive attention in academia and industry for its mobility, flexibility, and low cost [9–12]. WHMS is a WSN, with wearable sensors installed or implanted in the body of the patient, monitors the health conditions of patients by sensing, measuring, and gathering their physiological data and sends them to the medical professional or medical center via a wireless channel for proper diagnosis and further medical treatment. With data like heart rate, blood pressure, and body temperature, doctors in distance can assess the patient’s health status. Figure 1 illustrates a typical scenario of WHMS. Advantages of providing healthcare services using WHMS are as follows:
(1)
Enhance medical care quality
(2)
Continuous monitoring of patients
(3)
Save money and time for patients
(4)
Real-time physician diagnosis and interventionFigure 1
A typical scenario of WHMS.


### 1.1. Related Works

Although WHMS provides efficiency and simplicity for medical professionals, and patients can benefit greatly from WHMS, security and privacy cannot be overlooked since the sensed data are transmitted via insecure wireless channels. Thus, it is necessary to design a robust authenticated mechanism to protect the patient’s physiological data which are sensitive and should be a secret. If the patient’s data are illegally captured and tampered by the attacker, medical professionals will make wrong diagnosis based on these data. Furthermore, the leaked data may be used for commercial purpose or other horrible purposes. Specifically, medical professionals should be authenticated before accessing the physiological data from the wearable sensors on the patient, and their identity and password should not be revealed if the malicious attacker eavesdrops the messages through the gateway in WHMS, and vice versa. In the meantime, a shared session key should be generated between medical professionals and the sensor node deployed on the patient’s body to protect secure communication among the communicating parties.To address this issue, some user authentication protocols have been proposed for patient’s health monitoring [13–23]. Several authentication schemes [16–18] based on elliptical curve cryptography (ECC) have been presented because ECC can reach the identical RSA security level with faster computation and smaller key size. Although the security of these ECC-based schemes are continuously enhanced, these schemes are still not lightweight enough for WHMS since point multiplication consumes a large computation response, while the computation capability and energy of the mobile device and sensors are limited.Kumar et al. [24] suggested a user authentication protocol named E-SAP to monitor patient’s physiological data in wireless medical sensor network in 2012, claiming that their protocol was secure against known attacks. However, both He et al. [25] and Khan and Kumari [26] scrutinized Kumar et al.’s scheme and found some security defects like password guessing attack and lack of user anonymity and put forward their improved versions, respectively. Unfortunately, Wu et al. [20], Mir et al. [21], and Li et al. [22] independently pointed out that He et al.’s scheme [25] was vulnerable to security weaknesses, including denial-of-service attack, impersonation attack, offline guessing attack, and sensor node capture attack. To fix these loopholes, they suggested an improved version and declared that their new proposal was more secure than the previous ones. In 2016, Das et al. [27] identified the security defects in Li et al.’s protocol [28], i.e., privileged insider attack, sensor capture attack, and lack of user anonymity, and suggested an enhanced scheme based on biometrics. Later, Amin et al. [19] introduced a mutual authenticated protocol with user anonymity in WHMS and declared that their scheme was robust against the known threats. However, it was revealed by Jiang et al. [29] that this protocol suffers from several weaknesses, such as stolen mobile device attack, desynchronization attack, and sensor key exposure. To secure Amin et al.’s scheme, Jiang et al. suggested an improved two-factor (password and smartcard) scheme using quadratic residues [29, 30], fuzzy verifier [31], and timestamp mechanism. Further, security analysis showed that their scheme achieved the desired security features; thus, they had confidence in the security of their solution.Independently, Challa et al. [32] proposed an improved three-factor (password, smartcard, and biometrics) authenticated protocol for wireless healthcare sensor network to improve the security of Liu and Chung’s scheme [23]. However, in their scheme the user communicates with the remote sensor directly which means power consumption of the sensor increases greatly, and the sensor’s lifetime will reduce rapidly. Thus, their scheme is inapplicable to the wireless healthcare sensor network. Ali et al. [33] devised an anonymous three-factor-based protocol to thwart security threats like offline password guessing attack, user impersonation attack, and known session key temporary information attack in Amin et al.’s scheme [19]. Shen et al. [34] put forward a multilayer authenticated protocol using ECC for the wireless body area network to implement secure authentication and group key generation between the sensor and the mobile device. Li et al. [35] suggested a lightweight authentication protocol for centralized WBAN with two hops while preserving anonymity and unlinkability of data transmission. Shen et al. [36] presented an efficient ECC-based pairing-free certificateless public key signature authentication protocol for WBAN with two round messages. However, according to [37, 38], these kinds of authentication protocol with just two round messages are prone to failure of perfect forward secrecy.


### 1.2. Motivations and Contributions

When cryptanalyzing Jiang et al.’s scheme [29], regrettably, we find that their protocol is not as robust as they claimed. Although fuzzy verifier is used to thwart offline password guessing attack in Jiang et al.’s scheme, their scheme is still vulnerable to privileged insider attack, which leads to user impersonation attack. Ridiculously, Jiang et al.’s scheme [29] is subject to KSSTI attack, which means that their protocol is vulnerable to sensor key disclosure as the previous one. Further, we reveal that their protocol suffers from denial-of-service (DoS) attack.Motivated by the thought of addressing the security defects in Jiang et al.’s scheme [29], we propose an improved two-factor authenticated scheme making use of quadratic residues for WHMS environment.Our contributions of this work are threefold as listed below:(i)
First, we cryptanalyze the recent authentication scheme of Jiang et al. [29] in WHMS and find its vulnerability of KSSTI attack, privileged insider attack, and DoS attack
(ii)
Second, we propose an improved secure two-factor authentication and key agreement using quadratic residues to address the security weaknesses in Jiang et al.’s protocol
(iii)
Third, we provide the formal security proof of our proposed scheme under the random oracle model and conduct an informal security analysis to demonstrate that the improved scheme is secure against known attacks. Moreover, we make a performance comparison between the improved protocol and the related schemes


### 1.3. Organization of the Paper

The remainder of this paper is sketched as follows: Section2 explains the preliminaries of quadratic residues and security requirements. We cryptanalyze Jiang et al.’s protocol [29] in Section 3. In Section 4, we present our improved two-factor authentication and key agreement scheme for WHMS. Next, security analysis and performance comparison are given in Section 5. Finally, the paper is concluded in Section 6.


## 1.1. Related Works

Although WHMS provides efficiency and simplicity for medical professionals, and patients can benefit greatly from WHMS, security and privacy cannot be overlooked since the sensed data are transmitted via insecure wireless channels. Thus, it is necessary to design a robust authenticated mechanism to protect the patient’s physiological data which are sensitive and should be a secret. If the patient’s data are illegally captured and tampered by the attacker, medical professionals will make wrong diagnosis based on these data. Furthermore, the leaked data may be used for commercial purpose or other horrible purposes. Specifically, medical professionals should be authenticated before accessing the physiological data from the wearable sensors on the patient, and their identity and password should not be revealed if the malicious attacker eavesdrops the messages through the gateway in WHMS, and vice versa. In the meantime, a shared session key should be generated between medical professionals and the sensor node deployed on the patient’s body to protect secure communication among the communicating parties.To address this issue, some user authentication protocols have been proposed for patient’s health monitoring [13–23]. Several authentication schemes [16–18] based on elliptical curve cryptography (ECC) have been presented because ECC can reach the identical RSA security level with faster computation and smaller key size. Although the security of these ECC-based schemes are continuously enhanced, these schemes are still not lightweight enough for WHMS since point multiplication consumes a large computation response, while the computation capability and energy of the mobile device and sensors are limited.Kumar et al. [24] suggested a user authentication protocol named E-SAP to monitor patient’s physiological data in wireless medical sensor network in 2012, claiming that their protocol was secure against known attacks. However, both He et al. [25] and Khan and Kumari [26] scrutinized Kumar et al.’s scheme and found some security defects like password guessing attack and lack of user anonymity and put forward their improved versions, respectively. Unfortunately, Wu et al. [20], Mir et al. [21], and Li et al. [22] independently pointed out that He et al.’s scheme [25] was vulnerable to security weaknesses, including denial-of-service attack, impersonation attack, offline guessing attack, and sensor node capture attack. To fix these loopholes, they suggested an improved version and declared that their new proposal was more secure than the previous ones. In 2016, Das et al. [27] identified the security defects in Li et al.’s protocol [28], i.e., privileged insider attack, sensor capture attack, and lack of user anonymity, and suggested an enhanced scheme based on biometrics. Later, Amin et al. [19] introduced a mutual authenticated protocol with user anonymity in WHMS and declared that their scheme was robust against the known threats. However, it was revealed by Jiang et al. [29] that this protocol suffers from several weaknesses, such as stolen mobile device attack, desynchronization attack, and sensor key exposure. To secure Amin et al.’s scheme, Jiang et al. suggested an improved two-factor (password and smartcard) scheme using quadratic residues [29, 30], fuzzy verifier [31], and timestamp mechanism. Further, security analysis showed that their scheme achieved the desired security features; thus, they had confidence in the security of their solution.Independently, Challa et al. [32] proposed an improved three-factor (password, smartcard, and biometrics) authenticated protocol for wireless healthcare sensor network to improve the security of Liu and Chung’s scheme [23]. However, in their scheme the user communicates with the remote sensor directly which means power consumption of the sensor increases greatly, and the sensor’s lifetime will reduce rapidly. Thus, their scheme is inapplicable to the wireless healthcare sensor network. Ali et al. [33] devised an anonymous three-factor-based protocol to thwart security threats like offline password guessing attack, user impersonation attack, and known session key temporary information attack in Amin et al.’s scheme [19]. Shen et al. [34] put forward a multilayer authenticated protocol using ECC for the wireless body area network to implement secure authentication and group key generation between the sensor and the mobile device. Li et al. [35] suggested a lightweight authentication protocol for centralized WBAN with two hops while preserving anonymity and unlinkability of data transmission. Shen et al. [36] presented an efficient ECC-based pairing-free certificateless public key signature authentication protocol for WBAN with two round messages. However, according to [37, 38], these kinds of authentication protocol with just two round messages are prone to failure of perfect forward secrecy.


## 1.2. Motivations and Contributions

When cryptanalyzing Jiang et al.’s scheme [29], regrettably, we find that their protocol is not as robust as they claimed. Although fuzzy verifier is used to thwart offline password guessing attack in Jiang et al.’s scheme, their scheme is still vulnerable to privileged insider attack, which leads to user impersonation attack. Ridiculously, Jiang et al.’s scheme [29] is subject to KSSTI attack, which means that their protocol is vulnerable to sensor key disclosure as the previous one. Further, we reveal that their protocol suffers from denial-of-service (DoS) attack.Motivated by the thought of addressing the security defects in Jiang et al.’s scheme [29], we propose an improved two-factor authenticated scheme making use of quadratic residues for WHMS environment.Our contributions of this work are threefold as listed below:(i)
First, we cryptanalyze the recent authentication scheme of Jiang et al. [29] in WHMS and find its vulnerability of KSSTI attack, privileged insider attack, and DoS attack
(ii)
Second, we propose an improved secure two-factor authentication and key agreement using quadratic residues to address the security weaknesses in Jiang et al.’s protocol
(iii)
Third, we provide the formal security proof of our proposed scheme under the random oracle model and conduct an informal security analysis to demonstrate that the improved scheme is secure against known attacks. Moreover, we make a performance comparison between the improved protocol and the related schemes


## 1.3. Organization of the Paper

The remainder of this paper is sketched as follows: Section2 explains the preliminaries of quadratic residues and security requirements. We cryptanalyze Jiang et al.’s protocol [29] in Section 3. In Section 4, we present our improved two-factor authentication and key agreement scheme for WHMS. Next, security analysis and performance comparison are given in Section 5. Finally, the paper is concluded in Section 6.


## 2. Preliminaries

### 2.1. Quadratic Residues

According to [29, 30], the definition of quadratic residue is described as follows.Letp and q denote two large primes, respectively, and n=pq. If there is a solution for y=x2modn, i.e., y has a square root, then y is called a quadratic residue modn. Let Qn be a set of quadratic residue numbers in [1, n‐1], and y∈Qn. Because of the difficulty in factoring n, it is hard to find x without the knowledge of p and q.


### 2.2. Security Requirements

It is important to understand the security requirements in designing or cryptanalyzing an authentication protocol. Hence, according to the previous works [38, 39], the security requirements of authentication protocol for WHMS are summarized as follows.
(1)
Resisting Stolen Mobile Device Attack. If an unauthorized person obtains the lost/stolen mobile device, it is impossible for him to impersonate a valid user with a counterfeit login request by using the information extracted from the mobile device
(2)
Resisting Impersonation Attack. The communication parties in WHMS include the user, GWN, and sensor node. It is an important requirement that the attacker is incapable of logging in WHMS to imitate a legitimate user and access the privileged resources in such a way. In addition, if the malicious attacker can impersonate the GWN to identify the legitimacy of the user in the authentication process, it means that the data in sensors can be accessed in an unauthorized manner. The authenticated scheme should also prevent the attacker from sensor node impersonation attack, in which the attacker can impersonate sensor nodes and sends bogus data to the user
(3)
Resisting Known Attacks. It requires that the authentication scheme for WHMS be secure from various known basic or sophisticated attacks, such as replay attack, privileged insider attack, KSSTI attack, man-in-the-middle attack, and desynchronization attack
(4)
Forward and Backward Secrecy. It requires that the attacker not be able to obtain the previous session keys or the future ones by using the compromised session key
(5)
User Anonymity. It is a crucial requirement to prevent the attacker from tracing the user’s behavior to preserve user privacy
(6)
Sensor Anonymity. It is an additional requirement to enhance the security of authentication protocol for WHMS, because the information sent from the sensor to medical professional is sensitive, and sensor anonymity can help confuse the intelligent attacker’s traffic analysis that may render the communication ineffective
(7)
Mutual Authentication and Key Agreement. It is an essential requirement in WHMS scenario, and it requires the communication parties be able to authenticate each other and generate a shared session key to provide confidentiality of messages in wireless channel


## 2.1. Quadratic Residues

According to [29, 30], the definition of quadratic residue is described as follows.Letp and q denote two large primes, respectively, and n=pq. If there is a solution for y=x2modn, i.e., y has a square root, then y is called a quadratic residue modn. Let Qn be a set of quadratic residue numbers in [1, n‐1], and y∈Qn. Because of the difficulty in factoring n, it is hard to find x without the knowledge of p and q.


## 2.2. Security Requirements

It is important to understand the security requirements in designing or cryptanalyzing an authentication protocol. Hence, according to the previous works [38, 39], the security requirements of authentication protocol for WHMS are summarized as follows.
(1)
Resisting Stolen Mobile Device Attack. If an unauthorized person obtains the lost/stolen mobile device, it is impossible for him to impersonate a valid user with a counterfeit login request by using the information extracted from the mobile device
(2)
Resisting Impersonation Attack. The communication parties in WHMS include the user, GWN, and sensor node. It is an important requirement that the attacker is incapable of logging in WHMS to imitate a legitimate user and access the privileged resources in such a way. In addition, if the malicious attacker can impersonate the GWN to identify the legitimacy of the user in the authentication process, it means that the data in sensors can be accessed in an unauthorized manner. The authenticated scheme should also prevent the attacker from sensor node impersonation attack, in which the attacker can impersonate sensor nodes and sends bogus data to the user
(3)
Resisting Known Attacks. It requires that the authentication scheme for WHMS be secure from various known basic or sophisticated attacks, such as replay attack, privileged insider attack, KSSTI attack, man-in-the-middle attack, and desynchronization attack
(4)
Forward and Backward Secrecy. It requires that the attacker not be able to obtain the previous session keys or the future ones by using the compromised session key
(5)
User Anonymity. It is a crucial requirement to prevent the attacker from tracing the user’s behavior to preserve user privacy
(6)
Sensor Anonymity. It is an additional requirement to enhance the security of authentication protocol for WHMS, because the information sent from the sensor to medical professional is sensitive, and sensor anonymity can help confuse the intelligent attacker’s traffic analysis that may render the communication ineffective
(7)
Mutual Authentication and Key Agreement. It is an essential requirement in WHMS scenario, and it requires the communication parties be able to authenticate each other and generate a shared session key to provide confidentiality of messages in wireless channel


## 3. Cryptanalysis on Jiang et al.’s Protocol

In this section, we cryptanalyze Jiang et al.’s protocol [29]. Due to the space limitation, the review of protocol [29] is omitted. The symbols involved are listed in Table 1.Table 1
Notations.
Symbol
Meaning
Ui
Medical professional
GWN
Gateway
Sj
Thejth sensor node
MD
The mobile device
IDi
Ui’s identity
PWi
Ui’s password
SIDj
Sj’s identity
K
GWN’s secret key
R1, R2, and R3
Random nonces produced byUi, GWN, and Sj, respectively
h
One-way hash function
‖
Concatenation
⊕
Bitwise XOR operationJiang et al. [29] criticized Amin et al.’s scheme [19] for its vulnerability of stolen mobile device attack, desynchronization attack, and sensor key exposure. To eliminate these security risks, they put forward countermeasures like public key primitive quadratic residue, the concept of fuzzy verifier, hash function, and timestamp mechanism to enhance the security of Amin et al.’s scheme. Unfortunately, we point out several security vulnerabilities in Jiang et al.’s protocol. More specifically, it is susceptible to KSSTI attack, privileged insider attack, and DoS attack. Before elaborating a security analysis, we summarize the following adversary model used in this work.


### 3.1. Adversary Model

(1)
The attacker can fully control the open communication channel. In other words, he may eavesdrop, intercept, insert, delete, and modify messages exchanged over an open channel [40, 41]
(2)
The attacker can extract all the secret data stored in MD if the lost/stolen mobile device is obtained by him [42, 43]
(3)
The attacker can guess the user’s identity and password offline by enumerating pairs in (ID and PW) from Cartesian productDID×DPW in polynomial time, where DID and DPW denote the identity space and the password space [37, 44], respectively
(4)
The random numbers and the secret keys selected by each communication parties are adequately large to prevent the attacker from guessing these data successfully in polynomial time
(5)
The insider can obtain the registration request message of the user, and the insider can access the verifier table [45, 46]


### 3.2. KSSTI Attack

For an authenticated protocol with key agreement, if the attacker cannot compute the session key through the session-specific temporary information such as random number which has been compromised, we say that this protocol is able to resist KSSTI attack. In Jiang et al.’s scheme, ifUi is legitimate, GWN forwards message M3,M4,M5,T2 to Sj, where M4=M2⊕hSKGW−SjT2, M5=R2⊕hSKGW−SjT2, and R2 is a random nonce produced by GWN. After verifying the authenticity of GWN, Sj sends M6,M7 to GWN, where M7=hR2⊕R3. If R2 is compromised and the attacker captures the messages M3,M4,M5,T2 and M6,M7 from the public channel, he can compute the value hSKGW−SjT2=M5⊕R2, M2=M4⊕hSKGW−SjT2, and R3=M7⊕hR2 and then computes the session key SK=hM2R2R3. Thus, it is not hard to compute the session key if the random number R2 is disclosed. Therefore, Jiang et al.’s scheme is subject to KSSTI attack.


### 3.3. Privileged Insider Attack

The similar analysis is mentioned in Das et al. and Das [27, 47]. In the medical professional registration phase, a medical professional Ui sends his registration IDi,HPWi to GWN securely, where HPWi=hri⊕PWi. Suppose the message IDi,HPWi is known by an insider who is being an attacker, and further suppose that the lost/stolen mobile device containing the secret data Regi,Ai,Ci,m,n,ri,h is obtained by the attacker, he can extract all the secret information from the card using side-channel analysis [43]. Note that Ai=Ri⊕HPWi, Ci=Bi⊕hIDi⊕Ri⊕HPWi. Using these information, the attacker can carry out an attack as follows:
(1)
The attacker computesRi=Ai⊕HPWi, Bi=Ci⊕hIDi⊕Ri⊕HPWi
(2)
The attacker selects a random numberR1′, and computes CIDi′=IDi‖Ri′2modn, M1′=h(IDiBiR1′‖T1). T1 is the current timestamp
(3)
The attacker sendsSIDj,CIDi′,M1′,T1 to GWNUpon receipt of the message, GWN will pass the validation to the attacker and treat the attacker as a valid user and successfully perform the subsequent step of the authentication phase as depicted in Jiang et al.’s protocol. Lastly, GWN sends messageM7,M8,M9 to the user, but the attacker receives the message and computes R2′=M8⊕h(IDi‖R1′), R3′=M7⊕hR2′, and SK′=hhIDi‖R1′‖R2′‖R2′‖R3′ and verifies M9′?=hIDi‖SK′‖R3′. Obviously, the result is true. Therefore, the attacker has generated a shared session key with Sj.Thus, the attacker can imitateUi to login to GWN successfully. In this regard, Jiang et al.’s scheme is not secure against privileged insider attack.


### 3.4. DoS Attack

To authenticateUi, GWN maintains a table containing secret data IDi and Ri with respect to user Ui. When GWN receives the login request from Ui, GWN will retrieve Ri in light of IDi to perform the subsequent procedure. However, because IDi,Ri is stored in the table, if an insider (being attacker) deletes or modifies all or some entries in the table, GWN will fail to lookup entries related to the user who has successfully registered and sends a login request to GWN, which leads to the legitimate user rejected by the GWN. Therefore, Jiang et al.’s scheme is susceptible to DoS attack.


## 3.1. Adversary Model

(1)
The attacker can fully control the open communication channel. In other words, he may eavesdrop, intercept, insert, delete, and modify messages exchanged over an open channel [40, 41]
(2)
The attacker can extract all the secret data stored in MD if the lost/stolen mobile device is obtained by him [42, 43]
(3)
The attacker can guess the user’s identity and password offline by enumerating pairs in (ID and PW) from Cartesian productDID×DPW in polynomial time, where DID and DPW denote the identity space and the password space [37, 44], respectively
(4)
The random numbers and the secret keys selected by each communication parties are adequately large to prevent the attacker from guessing these data successfully in polynomial time
(5)
The insider can obtain the registration request message of the user, and the insider can access the verifier table [45, 46]


## 3.2. KSSTI Attack

For an authenticated protocol with key agreement, if the attacker cannot compute the session key through the session-specific temporary information such as random number which has been compromised, we say that this protocol is able to resist KSSTI attack. In Jiang et al.’s scheme, ifUi is legitimate, GWN forwards message M3,M4,M5,T2 to Sj, where M4=M2⊕hSKGW−SjT2, M5=R2⊕hSKGW−SjT2, and R2 is a random nonce produced by GWN. After verifying the authenticity of GWN, Sj sends M6,M7 to GWN, where M7=hR2⊕R3. If R2 is compromised and the attacker captures the messages M3,M4,M5,T2 and M6,M7 from the public channel, he can compute the value hSKGW−SjT2=M5⊕R2, M2=M4⊕hSKGW−SjT2, and R3=M7⊕hR2 and then computes the session key SK=hM2R2R3. Thus, it is not hard to compute the session key if the random number R2 is disclosed. Therefore, Jiang et al.’s scheme is subject to KSSTI attack.


## 3.3. Privileged Insider Attack

The similar analysis is mentioned in Das et al. and Das [27, 47]. In the medical professional registration phase, a medical professional Ui sends his registration IDi,HPWi to GWN securely, where HPWi=hri⊕PWi. Suppose the message IDi,HPWi is known by an insider who is being an attacker, and further suppose that the lost/stolen mobile device containing the secret data Regi,Ai,Ci,m,n,ri,h is obtained by the attacker, he can extract all the secret information from the card using side-channel analysis [43]. Note that Ai=Ri⊕HPWi, Ci=Bi⊕hIDi⊕Ri⊕HPWi. Using these information, the attacker can carry out an attack as follows:
(1)
The attacker computesRi=Ai⊕HPWi, Bi=Ci⊕hIDi⊕Ri⊕HPWi
(2)
The attacker selects a random numberR1′, and computes CIDi′=IDi‖Ri′2modn, M1′=h(IDiBiR1′‖T1). T1 is the current timestamp
(3)
The attacker sendsSIDj,CIDi′,M1′,T1 to GWNUpon receipt of the message, GWN will pass the validation to the attacker and treat the attacker as a valid user and successfully perform the subsequent step of the authentication phase as depicted in Jiang et al.’s protocol. Lastly, GWN sends messageM7,M8,M9 to the user, but the attacker receives the message and computes R2′=M8⊕h(IDi‖R1′), R3′=M7⊕hR2′, and SK′=hhIDi‖R1′‖R2′‖R2′‖R3′ and verifies M9′?=hIDi‖SK′‖R3′. Obviously, the result is true. Therefore, the attacker has generated a shared session key with Sj.Thus, the attacker can imitateUi to login to GWN successfully. In this regard, Jiang et al.’s scheme is not secure against privileged insider attack.


## 3.4. DoS Attack

To authenticateUi, GWN maintains a table containing secret data IDi and Ri with respect to user Ui. When GWN receives the login request from Ui, GWN will retrieve Ri in light of IDi to perform the subsequent procedure. However, because IDi,Ri is stored in the table, if an insider (being attacker) deletes or modifies all or some entries in the table, GWN will fail to lookup entries related to the user who has successfully registered and sends a login request to GWN, which leads to the legitimate user rejected by the GWN. Therefore, Jiang et al.’s scheme is susceptible to DoS attack.


## 4. The Proposed Scheme

In this section, we propose a secure and efficient authenticated key agreement scheme for WHMS to thwart the security weaknesses found in Jiang et al.’s scheme. Our scheme not only retains the advantages of Jiang et al.’s scheme but also provides additional security properties and is secure against different attacks. Similarly, our scheme consists of 5 phases: setup, medical professional registration, patient registration, login and authentication phase, and password change.


### 4.1. Setup Phase

This phase is identical to that of Jiang et al.’s scheme. The registration center GWN chooses two large prime noncesp and q and calculates n=pq, then keeps the private key (p, q).


### 4.2. Medical Professional Registration Phase

Step 1.
Ui keys his IDi and PWi, a random nonce ri, and calculates HPWi=hri⊕PWi; then, he transmits IDi,HPWi to GWN via a secure channel.Step 2.
Upon receiving the registration request, GWN selectsm∈24,28, a random nonce Ri, calculates a fuzzy verifier Regi=hhIDi‖Ri‖HPWimodm, Ai=Ri⊕HPWi, Bi=hIDi‖Ri‖K, and Ci=Bi⊕hIDi‖Ri‖HPWi. After that, GWN sends Regi,Ai,Ci,m,n,h to Ui through a secure channel.Step 3.
After receiving the message,Ui calculates Ai∗=Ai⊕hIDi‖ri and Di=ri⊕hhIDi‖PWimodm and updates MD with Regi,Ai∗,Ci,Di,m,n,h.


### 4.3. Patient Registration Phase

This phase is almost the same as in Jiang et al.’s scheme [29].Step 1: The patient forwards his ID to the registration center.Step 2: The registration center selects an appropriate sensor kit and assigns a professional.Step 3: The registration center computesSKGW−Sj=hSIDj‖K for Sj as secret key and delivers the relevant information of the patient to the designated professional.


### 4.4. Login and Authentication Phase

In this phase, a mutual authentication is performed and a session key is generated betweenUi and sensor Sj for subsequent communication.Step 1.
Ui selects his IDi and PWi, and MD computes ri=Di⊕hhIDi‖PWimodm, HPWi=hri⊕PWi, Ai=Ai∗⊕hIDi‖ri, Ri∗=Ai⊕HPWi, Regi∗=hhIDi‖Ri∗‖HPWi∗modm, and tests Regi∗?=Regi. If it is false, MD chooses a random number R1 and computes Bi∗=Ci⊕hIDi‖Ri‖HPWi, CIDi=IDi‖R1‖Ri∗‖SIDj2modn, M1=hIDi‖Bi∗‖R1‖T1, then forwards msg1=CIDi,M1,T1 to GWN. T1 is the current timestamp.Step 2.
On receiving login requestmsg1, GWN decrypts CIDi with p,q to obtain IDi∗,Ri∗,R1∗,T1 and checks the validity of the timestamp T1. If the verification fails, GWN aborts the session. Otherwise, GWN computes Bi′=hIDi‖Ri‖K and M1∗=hIDi‖Bi′‖R1‖T1 and then tests M1∗=M1. If inequality holds, GWN aborts the procedure. Otherwise, GWN calculates SKGW−Sj=hSIDj‖K, selects a random nonce R2, and computes M2=hIDi∗‖R1∗‖Ri, M3=hhM2“1”‖SKGW−Sj‖R2‖T2, M4=M2⊕hSKGW−Sj‖T2, and M5=R2⊕SKGW−Sj‖SIDj‖T2. Finally, GWN sends msg2=M3,M4,M5,T2 to Sj.Step 3.
On receivingmsg2 from GWN, Sj first checks the freshness of T2. If not, Sj terminates the procedure. Otherwise, Sj computes R2′=M5⊕SKGW−Sj‖SIDj‖T2 and M2=M4⊕hSKGW−Sj‖T2 and tests M3?=hhM2“1”‖SKGW−Sj‖R2′‖T2. If it is false, Sj aborts the session. Otherwise, Sj chooses a random number R3 and computes SK=hM2′‖R2′‖R3, M6=hSK‖R3‖SKGW−Sj, and M7=hR2′‖T3⊕R3, where T3 is the current timestamp. Sj then forwards msg3=M6,M7,T3 to GWN.Step 4.
On receivingmsg3 from Sj, GWN first checks the validity of T3. If it is invalid, GWN terminates the procedure. Otherwise, GWN computes R3′=M7⊕hR2′‖T3, SK′=hM2‖R2‖R3′, and M6′=hSK′‖R3′‖SKGW−Sj and checks whether M6′=M6 holds. If yes, GWN computes M8=R2⊕hIDi∗‖R1∗, M9=R3⊕hIDi∗‖R2∗, and M10=hIDi∗‖SK′‖R3‖T4 and delivers msg4=M8,M9,M10,T4 to Ui, where T4 is the current timestamp.Step 5.
After receivingmsg4 from GWN, Ui validates the timestamp T4. If not, Ui aborts the procedure. Otherwise, Ui computes R2′=M8⊕hIDi‖R1, R3′=M9⊕hIDi‖R2′, and SK∗=hhIDi‖R1‖Ri′‖R2′‖R3′ and checks whether M10?=hIDi‖SK∗‖R3′‖T4 holds. If it is false, Ui terminates the connection. Otherwise, Ui believes that both GWN and Sj are credible.The login and authentication phase is summarized in Figure2.Figure 2
The login and authentication phase of the improved protocol.


### 4.5. Password Change Phase

This phase is also similar to that in Jiang et al.’s scheme [29], and it is applicable if Ui intends to update his password.Step 1.
Ui keys IDi and PWi.Step 2.
MD computesHPWi∗=hri⊕PWi, Ai=Ai∗⊕hIDi‖ri, Ri∗=Ai⊕HPWi∗, and Regi∗=hhIDi‖Ri∗‖HPWi∗modm and checks the condition Regi∗=Regi. If it holds, MD quits this procedure.Step 3.
Ui keys his new password PWinew; then, MD computes HPWinew=hri⊕PWinew, Reginew=hhIDi‖Ri‖HPWinewmodm, Ainew=Rinew⊕HPWinew, Bi=Ci⊕hIDi‖Ri‖HPWi, Cinew=Bi⊕hIDi‖Ri∗‖HPWinew, and Ai∗new=Ainew⊕hIDi‖ri.Step 4.
Finally,Regi,Ai∗,Ci is replaced with Reginew,Ai∗new,Cinew by MD.At last, MD contains the informationReginew,Ai∗new,Cinew,m,n,h.


## 4.1. Setup Phase

This phase is identical to that of Jiang et al.’s scheme. The registration center GWN chooses two large prime noncesp and q and calculates n=pq, then keeps the private key (p, q).


## 4.2. Medical Professional Registration Phase

Step 1.
Ui keys his IDi and PWi, a random nonce ri, and calculates HPWi=hri⊕PWi; then, he transmits IDi,HPWi to GWN via a secure channel.Step 2.
Upon receiving the registration request, GWN selectsm∈24,28, a random nonce Ri, calculates a fuzzy verifier Regi=hhIDi‖Ri‖HPWimodm, Ai=Ri⊕HPWi, Bi=hIDi‖Ri‖K, and Ci=Bi⊕hIDi‖Ri‖HPWi. After that, GWN sends Regi,Ai,Ci,m,n,h to Ui through a secure channel.Step 3.
After receiving the message,Ui calculates Ai∗=Ai⊕hIDi‖ri and Di=ri⊕hhIDi‖PWimodm and updates MD with Regi,Ai∗,Ci,Di,m,n,h.


## 4.3. Patient Registration Phase

This phase is almost the same as in Jiang et al.’s scheme [29].Step 1: The patient forwards his ID to the registration center.Step 2: The registration center selects an appropriate sensor kit and assigns a professional.Step 3: The registration center computesSKGW−Sj=hSIDj‖K for Sj as secret key and delivers the relevant information of the patient to the designated professional.


## 4.4. Login and Authentication Phase

In this phase, a mutual authentication is performed and a session key is generated betweenUi and sensor Sj for subsequent communication.Step 1.
Ui selects his IDi and PWi, and MD computes ri=Di⊕hhIDi‖PWimodm, HPWi=hri⊕PWi, Ai=Ai∗⊕hIDi‖ri, Ri∗=Ai⊕HPWi, Regi∗=hhIDi‖Ri∗‖HPWi∗modm, and tests Regi∗?=Regi. If it is false, MD chooses a random number R1 and computes Bi∗=Ci⊕hIDi‖Ri‖HPWi, CIDi=IDi‖R1‖Ri∗‖SIDj2modn, M1=hIDi‖Bi∗‖R1‖T1, then forwards msg1=CIDi,M1,T1 to GWN. T1 is the current timestamp.Step 2.
On receiving login requestmsg1, GWN decrypts CIDi with p,q to obtain IDi∗,Ri∗,R1∗,T1 and checks the validity of the timestamp T1. If the verification fails, GWN aborts the session. Otherwise, GWN computes Bi′=hIDi‖Ri‖K and M1∗=hIDi‖Bi′‖R1‖T1 and then tests M1∗=M1. If inequality holds, GWN aborts the procedure. Otherwise, GWN calculates SKGW−Sj=hSIDj‖K, selects a random nonce R2, and computes M2=hIDi∗‖R1∗‖Ri, M3=hhM2“1”‖SKGW−Sj‖R2‖T2, M4=M2⊕hSKGW−Sj‖T2, and M5=R2⊕SKGW−Sj‖SIDj‖T2. Finally, GWN sends msg2=M3,M4,M5,T2 to Sj.Step 3.
On receivingmsg2 from GWN, Sj first checks the freshness of T2. If not, Sj terminates the procedure. Otherwise, Sj computes R2′=M5⊕SKGW−Sj‖SIDj‖T2 and M2=M4⊕hSKGW−Sj‖T2 and tests M3?=hhM2“1”‖SKGW−Sj‖R2′‖T2. If it is false, Sj aborts the session. Otherwise, Sj chooses a random number R3 and computes SK=hM2′‖R2′‖R3, M6=hSK‖R3‖SKGW−Sj, and M7=hR2′‖T3⊕R3, where T3 is the current timestamp. Sj then forwards msg3=M6,M7,T3 to GWN.Step 4.
On receivingmsg3 from Sj, GWN first checks the validity of T3. If it is invalid, GWN terminates the procedure. Otherwise, GWN computes R3′=M7⊕hR2′‖T3, SK′=hM2‖R2‖R3′, and M6′=hSK′‖R3′‖SKGW−Sj and checks whether M6′=M6 holds. If yes, GWN computes M8=R2⊕hIDi∗‖R1∗, M9=R3⊕hIDi∗‖R2∗, and M10=hIDi∗‖SK′‖R3‖T4 and delivers msg4=M8,M9,M10,T4 to Ui, where T4 is the current timestamp.Step 5.
After receivingmsg4 from GWN, Ui validates the timestamp T4. If not, Ui aborts the procedure. Otherwise, Ui computes R2′=M8⊕hIDi‖R1, R3′=M9⊕hIDi‖R2′, and SK∗=hhIDi‖R1‖Ri′‖R2′‖R3′ and checks whether M10?=hIDi‖SK∗‖R3′‖T4 holds. If it is false, Ui terminates the connection. Otherwise, Ui believes that both GWN and Sj are credible.The login and authentication phase is summarized in Figure2.Figure 2
The login and authentication phase of the improved protocol.


## 4.5. Password Change Phase

This phase is also similar to that in Jiang et al.’s scheme [29], and it is applicable if Ui intends to update his password.Step 1.
Ui keys IDi and PWi.Step 2.
MD computesHPWi∗=hri⊕PWi, Ai=Ai∗⊕hIDi‖ri, Ri∗=Ai⊕HPWi∗, and Regi∗=hhIDi‖Ri∗‖HPWi∗modm and checks the condition Regi∗=Regi. If it holds, MD quits this procedure.Step 3.
Ui keys his new password PWinew; then, MD computes HPWinew=hri⊕PWinew, Reginew=hhIDi‖Ri‖HPWinewmodm, Ainew=Rinew⊕HPWinew, Bi=Ci⊕hIDi‖Ri‖HPWi, Cinew=Bi⊕hIDi‖Ri∗‖HPWinew, and Ai∗new=Ainew⊕hIDi‖ri.Step 4.
Finally,Regi,Ai∗,Ci is replaced with Reginew,Ai∗new,Cinew by MD.At last, MD contains the informationReginew,Ai∗new,Cinew,m,n,h.


## 5. Security Analysis and Performance Comparison

In this section, we evaluate the security of our proposal under the random oracle model [48] and a comprehensive heuristic security analysis. In addition, the performance comparisons with relevant competitive schemes are made.


### 5.1. Authentication Proof Based on Random Oracle Model

In this section, we use the random oracle model to provide an authentication proof of the proposal. For simplicity, we present our formal security proof based on the security model of the previous works [48, 49].Theorem 1.
SupposeA is a polynomial time-bounded attacker running in time tA and let AdvP,DPWAKEA be the advantage of A in breaking the semantic security of the improved authenticated key exchanged (AKE) scheme P and AdvARAEt be the advantage of the attacker A in cracking robust authenticated encryption (RAE) [50] in polynoamial time t. To break the semantic security of the proposed scheme, A asks at most qs times Send queries, qe times Execute queries, and qh times Hash queries. Thus, we have
(1)AdvP,DPWAKEA≤4qs+qh22ls+qs+qe32lr+1+2qsDPW+2qh1+qs+qe2AdvARAEtA,where ls denotes the security parameter, lr denotes the length of the random number, DPW denotes a password dictionary with a frequency distribution following Zipf’s law [51], and ∣DPW∣ denotes the size of DPW.Proof.
A set of hybrid gamesGmi (i=0,1,2,3,4,5) are completed in the proof. Si represents the event that the attacker successfully guesses a correct bit in the Test query in each Gmi, and PrSi represents the probability of Si. The details of each game are described as follows.
Gm0: this starting game is considered identical to a real attack scenario under random oracle model. Thus, we have
(2)AdvP,DPWAKEA=2PrS0−1.
Gm1: according to the improved scheme, this game simulates queries including Test, Execute, Send, Hash, and Corrupt. And three lists Lh, LA, and LT are created to store the answer of various oracles. We can see that the simulation of Gm1 is indistinguishable to execution of Gm0. Thus, we have
(3)PrS1=PrS0.
Gm2: in this game, we consider the collisions of random oracle query and random numbers in protocol P. If the collision of hash oracle and transcripts msg1, msg2, msg3, and msg4 occurs, the simulator aborts and lets the attacker win the game. According to the birthday paradox, the collision probability of the hash oracle is qh2/2ls+1 at most, and the collision probability of random numbers R1, R2, and R3 is qs+qe3/2lr+2. Thus, we have
(4)PrS2−PrS1≤qh22ls+1+qs+qe32lr+2.
Gm3: in this game, all the oracles are simulated as the previous game. If the attacker guesses M1, M3, M6, and M10 without making corresponding h queries, the simulation will terminate. Thus, Gm3 and Gm2 are indistinguishable, and we have
(5)PrS3−PrS2≤qs2ls.
Gm4: in this game, we take into account both online and offline attacks performed by the attacker. This game can be demonstrated as two cases. The first denotes online guessing attack, and the second denotes offline guessing attack.Case 1.
The attacker asksCorruptUiμ,1 to guess PWi and ri. So, two subcases are considered as follows:
Case 1.1. The attacker chooses a password from DPW online and simulates SendUiμ,GWNλ,msg1 query qs times. Thus, the collision probability is qs/DPW.
Case 1.2. We consider the situation that the attacker guesses ri online intentionally or accidentally, and the collision probability is qs/2ls at most.Case 2.
To launch offline guessing attack, the attacker asksCorruptUiμ,1 along with CorruptUiμ,0 query, as well as Execute and Send queries. Then, Hash oracle will be queried at least qh times, and the simulation will be terminated once an invalid value is returned. Thus, the collision probability is at most qhAdvARAEtA.According to the analysis of the above cases, we have(6)PrS4−PrS3≤qsDPW+qs2ls+qhAdvARAEtA.Gm5: in this game, the attacker executes Send, Execute, and Hash oracle queries on transcripts to break strong forward security. After choosing two indices from 1,2,⋯,qs+qe, the attacker executes a Test oracle and asks CorruptUiμ\GWNλ\Sjν. The simulation will abort if the Test oracle cannot return the session key for the ith instance of Ui and the jth instance of Sj. Thus, we have
(7)PrS5−PrS4≤qhqs+qe2AdvARAEtA.Considering all the games, the attacker has no advantage in surmising the correct bitb. Thus, we have
(8)PrS5=12.Using equations (2)–(8), the theorem is proved.


### 5.2. Analysis of Security Features

This section provides an informal security analysis, which demonstrates that the proposed scheme not only overcomes the security weaknesses in Jiang et al.’s scheme but also withstands various attacks.(1)
Resistance to Stolen Mobile Device Attack. Assume that MD is acquired by the attacker, and he extracts the secret data Regi,Ai,Ci,Di,m,n,h by power analysis [42] or side-channel technique [43]. From the medical professional registration phase, we can see that Regi=hhIDi‖Ri‖HPWimodm, where HPWi=hri⊕PWi. If the attacker tries to guess the IDi and PWi via Regi=hhIDi‖Ri‖hri⊕PWimodm, he will not succeed since Ri and ri are sufficiently large and he cannot guess them in polynomial time according to item 4 of the adversary model in Section 3.1. Furthermore, the attacker can get Ci=Bi⊕hIDi‖Ri‖HPWi where Bi=hIDi‖Ri‖K, but he will also fail when he launches an offline dictionary attack on IDi and PWi because Ri and K are sufficiently large. Therefore, the proposal can withstand stolen mobile device attack
(2)
Resistance to Privileged Insider Attack. Suppose that a privileged insider has obtained the user’s registration request IDi,HPWi, and he also gets the user’s mobile device that contains secret information Regi,Ai,Ci,Di,m,n,h, where Regi=hhIDi‖Ri‖HPWimodm, Ai∗=Ai⊕hIDi‖ri=Ri⊕hri⊕PWi, Ci=Bi⊕hIDi‖Ri‖HPWi, Di=ri⊕hhIDi‖PWimodm, and Bi=hIDi‖Ri‖K. If the attacker chooses a pair (IDi, PWi) from DID×DPW to perform offline password guessing attack via ri=Di⊕hhIDi‖PWimodm and HPWi=hri⊕PWi, and we set ∣DPW∣=∣DID∣=106 and m=28 [51, 52], it can be assured that there are ∣DID∣∗∣DPW∣/m≈232 candidates (IDi, PWi) to prevent the attacker from guessing out the correct password. Moreover, if the insider attacker tries to compromise PWi from Ai∗ or Ci, he will still fail since he does not know random numbers ri and Ri and the long-term key K. Therefore, the proposal can resist privileged insider attack
(3)
Resistance to KSSTI Attack. In our scheme, the session key SK=hM2‖R2‖R3=hhIDi‖R1‖Ri‖R2‖R3 is generated with the parameters IDi, Ri, R1, R2, and R3, which are provided by the mobile device, GWN, and sensor, respectively. If the attacker captures messages msg2=M3,M4,M5,T2 and msg3=M6,M7,T3, we discuss that the proposed scheme can resist KSSTI attack in three cases.Case 1.
Suppose R2 is compromised. It is clear that the attacker can calculate R3=M7⊕hR2‖T3. To obtain M2, the attacker intends to compute M2=M4⊕hSKGW−Sj‖T2. However, the attacker knows nothing about SKGW−Sj, SIDj, and K, resulting in failure of computing M2 by M2=M4⊕hSKGW−Sj‖T2. Thus, the attacker cannot compute the session key if R2 is compromised.Case 2.
Suppose R3 is compromised. To get R2, the attacker first computes hR2T3=M7⊕R3, and hIDiR2=M9⊕R3 and then mounts an offline guessing attack. However, he will be unsuccessful according to item 4 of the adversary model in Section 3.1. Moreover, he cannot compute M2 by M2=M4⊕hSKGW−SjT2 as we analyzed in Case 1. Thus, his dream will not come true in computing the session key SK=hM2R2R3.Case 3.
Suppose R1 is compromised. In our protocol, if the attacker attempts to derive R2 by computing R2=M8⊕hIDiR1, the attacker has to know the identity IDi of the user. However, it is impossible for him to retrieve IDi from other components in the public messages. Thus, the attacker cannot calculate the session key if he only knows R1.(4)
Resistance to GWN Impersonation Attack. During the authentication protocol execution, if the attacker makes an effort to masquerade GWN, he has to generate messages M3,M4,M5,T2 and M8,M9,M10,T4 and transmit them to Sj and Ui, respectively, where M3=hhM2“1”‖SKGW−Sj‖R2‖T2, M4=M2⊕hSKGW−Sj‖T2, M5=R2⊕SKGW−Sj‖SIDj‖T2, M2=hIDi∗‖R1∗‖Ri, M8=R2⊕hIDi∗‖R1∗, M9=R3⊕hIDi‖R2, and M10=hIDi∗‖SK′‖R3‖T4. However, without the knowledge of SIDj,K,IDi and R1,R2,R3,SK, the attacker is unable to generate these two messages to cheat the sensor and the user. Hence, the proposal can withstand GWN impersonation attack
(5)
Resistance to Desynchronization Attack. There are two conditions that may lead to desynchronization attack. First, both parties of communication stored authentication data that needs to be updated simultaneous, and if the message sent from one party to the other is intercepted by the attacker, the result is that the authentication data in one party has been updated whereas the other party’s is still unchanged. In our protocol, MD and the sensor are not required to update their authentication data simultaneously. Second, the authenticated protocol needs to maintain verification tables in GWN, or the server is subject to this attack. However, our improved scheme is not required to store a verification table in GWN. In short, our improved scheme is free from desynchronization attack
(6)
Resistance to Sensor Impersonation Attack. In this attack, the attacker generates a valid message M6,M7,T3 to cheat the GWN. However, because SKGW−Sj is carefully protected by the GWN and the attacker has no knowledge of R2 and R3, the attacker cannot succeed in forging the message M6,M7,T3. Therefore, the improved scheme is able to resist sensor impersonation attack
(7)
Resistance to Replay Attack and Man-in-the-Middle Attack. Generally, random nonce and timestamp are the two main techniques to prevent replay attack in authentication protocol. In our improved scheme, if the attacker captures the login message CIDi,M1,T1 and replays it to GWN, he cannot be authenticated by GWN because GWN will check the freshness of T1 and verify the hash value M1 which is computed with secret random numbers Ri and R1 shared between mobile device and the sensor. In addition, if the attacker generates an imitated login message with a new timestamp T1′, the GWN will reject it because T1′ should be a parameter of M1, and M1 cannot pass the verification of GWN. Thus, the improved scheme is secured from replay attack. Moreover, without knowing IDi,Ri,R1,R2,R3, the attacker is unable to compute the session key SK=hM2‖R2‖R3. Hence, the attacker will fail in passing the authentication of the sensor Sj, which means he cannot produce a valid session with Sj via retransmitting the request message of Ui. Thus, the proposal can thwart man-in-the-middle attack
(8)
Perfect Forward and Backward Secrecy. As can be seen from the login and authentication phase, the session key SK=hM2‖R2‖R3=hhIDi‖R1‖Ri‖R2‖R3 is computed by Ui and Sj, and it relies on IDi,Ri,R1,R2,R3, where the parameters Ri,R1,R2,R3 are randomly generated and unpredictable. Even if the attacker knows the leaked long-term key K of GWN, it is still impossible for him to calculate the session key because he has no knowledge of these random numbers provided by each communication party, i.e., Ui, GWN, and Sj. That is to say, the improved protocol can provide perfect forward and backward secrecy
(9)
Resistance to User Impersonation Attack. Assume that the attacker obtains the mobile device and extracts the secret information Regi,Ai∗,Ci,Di,m,n,h, where Regi=hhIDi‖Ri‖HPWimodm, Ai∗=Ai⊕hIDi‖ri, Ci=Bi⊕hIDi‖Ri‖HPWi, Di=ri⊕hhIDi‖PWimodm, and Bi=hIDi‖Ri‖K. To generate a valid login request CIDi,M1,T1, the attacker should first derive both password and mobile device of the medical professional. In particular, GWN validates the legitimacy of the medical professional by checking M1?=hIDi‖Bi‖R1‖T1, and the key to compute M1 is to get the value of Bi. However, without the knowledge of parameters (IDi, PWi, Ri, and K), the attacker cannot compute Bi, which means the attacker’s legitimacy will not be corroborated by GWN. Hence, the improved scheme is secure from user impersonation attack
(10)
User Anonymity. User anonymity is extremely important in preserving the patient’s privacy. Suppose that the attacker intercepts all the messages of the parties involved during the protocol execution, and in these messages, the component CIDi=IDi‖R1‖Ri∗‖SIDj2modn is related to the identity of the medical professional directly. However, the attacker cannot decrypt CIDi to get IDi because he has no knowledge of n or p,q. Besides, if the attacker attempts to mount identity guessing attack on M8, M9, and M10, respectively, where M8=R2⊕hIDi∗‖R1∗, M9=R3⊕hIDi∗‖R2∗, and M10=hIDi∗‖SK′‖R3‖T4, he will not succeed because the random numbers R1, R2, and R3 are adequately large to prevent him from guessing them out successfully. Therefore, the improved scheme is capable of preserving user anonymity
(11)
Mutual Authentication and Key Agreement. Due to the insecure nature of the wireless channel, mutual authentication has become one of the essential security features in authentication protocol. In the login and authentication phase, GWN authenticates Ui, Sj authenticates GWN, GWN authenticates Sj, and Ui authenticates GWN. Meanwhile, the shared session key SK=hhIDi‖R1‖Ri‖R2‖R3 is generated between Ui and Sj for future secure communication after authenticating each other successfully


### 5.3. Security and Performance Comparison

In this section, we compare the security features and performances of the improved scheme with the relevant competitive schemes [27, 29, 33, 53, 54].Table2 shows the comparison results of security features between the improved scheme and the related ones [27, 29, 33, 53, 54]. From Table 2, it is evident that our scheme has overcome the security weaknesses existing in Jiang et al.’s scheme [29], while the other protocols have security vulnerabilities more or less, e.g., protocols [27, 29, 33] suffer from user impersonation attack and cannot preserve user anonymity, protocols [53, 54] are vulnerable to stolen mobile device attack, and protocol [54] cannot resist replay and privileged insider attack. Particularly, some protocols [33, 53] cannot resist user impersonation attack when the mobile device is obtained by the attacker.Table 2
Comparison of security features.
[27]
[29]
[33]
[53]
[54]
Ours
S1
Yes
Yes
No
No
Yes
Yes
S2
No
No
No
No
Yes
Yes
S3
Yes
Yes
Yes
Yes
Yes
Yes
S4
Yes
Yes
Yes
Yes
Yes
Yes
S5
Yes
Yes
Yes
Yes
Yes
Yes
S6
Yes
No
No
Yes
Yes
Yes
S7
Yes
Yes
Yes
Yes
Yes
Yes
S8
Yes
No
No
Yes
No
Yes
S9
Yes
No
Yes
No
No
Yes
S10
Yes
Yes
Yes
Yes
Yes
Yes
S11
No
Yes
No
No
Yes
Yes
S12
Yes
No
No
Yes
Yes
Yes
S13
Yes
Yes
Yes
Yes
Yes
Yes
S1: resisting stolen mobile device attack; S2: resisting user impersonation attack; S3: resisting GWN impersonation attack; S4: resisting sensor node impersonation attack; S5: resisting desynchronization attack; S6: resisting KSSTI attack; S7: perfect forward and backward secrecy; S8: resisting replay attack; S9: resisting privileged insider attack; S10: resisting man-in-the-middle attack; S11: user anonymity; S12: sensor anonymity; S13: mutual authentication and key agreement.To facilitate the comparison of performances during the login and authentication phase, we use the various time notations of cryptographic operation as shown in Table3. To make a comparison of computation cost fairly, we also provide the time cost of various cryptographic calculations as the benchmark [41, 44, 53] in Table 3. Additionally, we assume that the length of an identity, a random number, a hash value, a timestamp, an elliptic curve point, the block size of AES symmetric encryption/decryption, and the modular exponentiation are 32 bits, 128 bits, 160 bits, 32 bits, 320 bits, 128 bits [55], and 1024 bits [14], respectively. The comprehensive study of the improved scheme and the related schemes [27, 29, 33, 53, 54] is given in Table 4. Furthermore, the performances of the sensor node are summarized in Table 5, because energy consumption is vital to evaluate the lifetime of the sensor node. For the convenience of understanding, the comparison graphs of computation cost, communication overhead, and traffic of sensor node are shown in Figures 3, 4, and 5, respectively.Table 3
Execution time of cryptographic operation.
Notation
Meaning
Time (ms)
Th
Time of a hash operation
0.0004 [53]
Tm
Time of a modular squaring
=Th [41]
TP
Time of ECC point multiplication
7.3529 [44]
Ts
Time of symmetric encryption/decryption
0.1303 [44]
TQR
Time of square root modularn
1.8382 [41, 44]
TR
Time of Rep operation
=TP [53]Table 4
Performance comparison.
[27]
[29]
[33]
[53]
[54]
Ours
Ui
8Th+TR+2TS
9Th+TM
11Th+TR+2TP
9Th+TR+2TS
10Th+3TP
11Th+TM
GWN
7Th+6TS
14Th+TQR
10Th
13Th+2TS
8Th+TP
13Th+TQR
Sj
5Th+2TS
7Th
3Th+2TP
5Th
4Th+2TP
7Th
Total cost
20Th+TR+10TS
30Th+6TM+TQR
24Th+TR+4TP
27Th+TM+4TS
22Th+6TP
31Th+6TM+TQR
Estimated time (ms)
8.66
1.84
36.77
7.88
51.61
1.97
Communication overhead (bits)
2944
2560
3072
2496
2880
2592Table 5
Traffic comparison of sensor node.
[27]
[29]
[33]
[53]
[54]
Ours
Receive
544
512
640
864
640
512
Send
672
320
640
352
640
352
Total
1216
832
1280
1216
1280
864Figure 3
Comparison of computation cost.Figure 4
Comparison of communication overhead.Figure 5
Comparison on traffic of sensor node.In Table4, it is evident that the protocol [29] is the most efficient one in terms of computation cost and communication overhead. Our improved scheme requires a little more computation cost and communication overhead than protocol [29]. However, the performance of our improved scheme is more efficient than protocols [27, 33, 53, 54] as justified from Table 4. In particular, protocols [33, 54] are the two most inefficient schemes among all the schemes since they employ ECC in which point multiplication needs more time than other operations, and elliptic curve point also needs more length than other symbols in communication.From Table5, it can be seen that the traffic length of sensor node in our protocol is 864 bits, which is just slightly higher than that in [29], but much lower than those in [27, 33, 53, 54]. Therefore, the potential energy consumption of our improved scheme is keeping at a manageable level for WMHS that helps to prolong the lifetime of the sensor.Although our scheme is not the most efficient one, it is worth noting that the security analysis and the comparison results of security features in Table2 have shown that our improved scheme overcomes the security risks in [27, 29, 33, 53, 54]. In a word, our improved scheme has higher security level while its computation cost and communication overhead are within reasonable level for WMHS environment.


## 5.1. Authentication Proof Based on Random Oracle Model

In this section, we use the random oracle model to provide an authentication proof of the proposal. For simplicity, we present our formal security proof based on the security model of the previous works [48, 49].Theorem 1.
SupposeA is a polynomial time-bounded attacker running in time tA and let AdvP,DPWAKEA be the advantage of A in breaking the semantic security of the improved authenticated key exchanged (AKE) scheme P and AdvARAEt be the advantage of the attacker A in cracking robust authenticated encryption (RAE) [50] in polynoamial time t. To break the semantic security of the proposed scheme, A asks at most qs times Send queries, qe times Execute queries, and qh times Hash queries. Thus, we have
(1)AdvP,DPWAKEA≤4qs+qh22ls+qs+qe32lr+1+2qsDPW+2qh1+qs+qe2AdvARAEtA,where ls denotes the security parameter, lr denotes the length of the random number, DPW denotes a password dictionary with a frequency distribution following Zipf’s law [51], and ∣DPW∣ denotes the size of DPW.Proof.
A set of hybrid gamesGmi (i=0,1,2,3,4,5) are completed in the proof. Si represents the event that the attacker successfully guesses a correct bit in the Test query in each Gmi, and PrSi represents the probability of Si. The details of each game are described as follows.
Gm0: this starting game is considered identical to a real attack scenario under random oracle model. Thus, we have
(2)AdvP,DPWAKEA=2PrS0−1.
Gm1: according to the improved scheme, this game simulates queries including Test, Execute, Send, Hash, and Corrupt. And three lists Lh, LA, and LT are created to store the answer of various oracles. We can see that the simulation of Gm1 is indistinguishable to execution of Gm0. Thus, we have
(3)PrS1=PrS0.
Gm2: in this game, we consider the collisions of random oracle query and random numbers in protocol P. If the collision of hash oracle and transcripts msg1, msg2, msg3, and msg4 occurs, the simulator aborts and lets the attacker win the game. According to the birthday paradox, the collision probability of the hash oracle is qh2/2ls+1 at most, and the collision probability of random numbers R1, R2, and R3 is qs+qe3/2lr+2. Thus, we have
(4)PrS2−PrS1≤qh22ls+1+qs+qe32lr+2.
Gm3: in this game, all the oracles are simulated as the previous game. If the attacker guesses M1, M3, M6, and M10 without making corresponding h queries, the simulation will terminate. Thus, Gm3 and Gm2 are indistinguishable, and we have
(5)PrS3−PrS2≤qs2ls.
Gm4: in this game, we take into account both online and offline attacks performed by the attacker. This game can be demonstrated as two cases. The first denotes online guessing attack, and the second denotes offline guessing attack.Case 1.
The attacker asksCorruptUiμ,1 to guess PWi and ri. So, two subcases are considered as follows:
Case 1.1. The attacker chooses a password from DPW online and simulates SendUiμ,GWNλ,msg1 query qs times. Thus, the collision probability is qs/DPW.
Case 1.2. We consider the situation that the attacker guesses ri online intentionally or accidentally, and the collision probability is qs/2ls at most.Case 2.
To launch offline guessing attack, the attacker asksCorruptUiμ,1 along with CorruptUiμ,0 query, as well as Execute and Send queries. Then, Hash oracle will be queried at least qh times, and the simulation will be terminated once an invalid value is returned. Thus, the collision probability is at most qhAdvARAEtA.According to the analysis of the above cases, we have(6)PrS4−PrS3≤qsDPW+qs2ls+qhAdvARAEtA.Gm5: in this game, the attacker executes Send, Execute, and Hash oracle queries on transcripts to break strong forward security. After choosing two indices from 1,2,⋯,qs+qe, the attacker executes a Test oracle and asks CorruptUiμ\GWNλ\Sjν. The simulation will abort if the Test oracle cannot return the session key for the ith instance of Ui and the jth instance of Sj. Thus, we have
(7)PrS5−PrS4≤qhqs+qe2AdvARAEtA.Considering all the games, the attacker has no advantage in surmising the correct bitb. Thus, we have
(8)PrS5=12.Using equations (2)–(8), the theorem is proved.


## 5.2. Analysis of Security Features

This section provides an informal security analysis, which demonstrates that the proposed scheme not only overcomes the security weaknesses in Jiang et al.’s scheme but also withstands various attacks.(1)
Resistance to Stolen Mobile Device Attack. Assume that MD is acquired by the attacker, and he extracts the secret data Regi,Ai,Ci,Di,m,n,h by power analysis [42] or side-channel technique [43]. From the medical professional registration phase, we can see that Regi=hhIDi‖Ri‖HPWimodm, where HPWi=hri⊕PWi. If the attacker tries to guess the IDi and PWi via Regi=hhIDi‖Ri‖hri⊕PWimodm, he will not succeed since Ri and ri are sufficiently large and he cannot guess them in polynomial time according to item 4 of the adversary model in Section 3.1. Furthermore, the attacker can get Ci=Bi⊕hIDi‖Ri‖HPWi where Bi=hIDi‖Ri‖K, but he will also fail when he launches an offline dictionary attack on IDi and PWi because Ri and K are sufficiently large. Therefore, the proposal can withstand stolen mobile device attack
(2)
Resistance to Privileged Insider Attack. Suppose that a privileged insider has obtained the user’s registration request IDi,HPWi, and he also gets the user’s mobile device that contains secret information Regi,Ai,Ci,Di,m,n,h, where Regi=hhIDi‖Ri‖HPWimodm, Ai∗=Ai⊕hIDi‖ri=Ri⊕hri⊕PWi, Ci=Bi⊕hIDi‖Ri‖HPWi, Di=ri⊕hhIDi‖PWimodm, and Bi=hIDi‖Ri‖K. If the attacker chooses a pair (IDi, PWi) from DID×DPW to perform offline password guessing attack via ri=Di⊕hhIDi‖PWimodm and HPWi=hri⊕PWi, and we set ∣DPW∣=∣DID∣=106 and m=28 [51, 52], it can be assured that there are ∣DID∣∗∣DPW∣/m≈232 candidates (IDi, PWi) to prevent the attacker from guessing out the correct password. Moreover, if the insider attacker tries to compromise PWi from Ai∗ or Ci, he will still fail since he does not know random numbers ri and Ri and the long-term key K. Therefore, the proposal can resist privileged insider attack
(3)
Resistance to KSSTI Attack. In our scheme, the session key SK=hM2‖R2‖R3=hhIDi‖R1‖Ri‖R2‖R3 is generated with the parameters IDi, Ri, R1, R2, and R3, which are provided by the mobile device, GWN, and sensor, respectively. If the attacker captures messages msg2=M3,M4,M5,T2 and msg3=M6,M7,T3, we discuss that the proposed scheme can resist KSSTI attack in three cases.Case 1.
Suppose R2 is compromised. It is clear that the attacker can calculate R3=M7⊕hR2‖T3. To obtain M2, the attacker intends to compute M2=M4⊕hSKGW−Sj‖T2. However, the attacker knows nothing about SKGW−Sj, SIDj, and K, resulting in failure of computing M2 by M2=M4⊕hSKGW−Sj‖T2. Thus, the attacker cannot compute the session key if R2 is compromised.Case 2.
Suppose R3 is compromised. To get R2, the attacker first computes hR2T3=M7⊕R3, and hIDiR2=M9⊕R3 and then mounts an offline guessing attack. However, he will be unsuccessful according to item 4 of the adversary model in Section 3.1. Moreover, he cannot compute M2 by M2=M4⊕hSKGW−SjT2 as we analyzed in Case 1. Thus, his dream will not come true in computing the session key SK=hM2R2R3.Case 3.
Suppose R1 is compromised. In our protocol, if the attacker attempts to derive R2 by computing R2=M8⊕hIDiR1, the attacker has to know the identity IDi of the user. However, it is impossible for him to retrieve IDi from other components in the public messages. Thus, the attacker cannot calculate the session key if he only knows R1.(4)
Resistance to GWN Impersonation Attack. During the authentication protocol execution, if the attacker makes an effort to masquerade GWN, he has to generate messages M3,M4,M5,T2 and M8,M9,M10,T4 and transmit them to Sj and Ui, respectively, where M3=hhM2“1”‖SKGW−Sj‖R2‖T2, M4=M2⊕hSKGW−Sj‖T2, M5=R2⊕SKGW−Sj‖SIDj‖T2, M2=hIDi∗‖R1∗‖Ri, M8=R2⊕hIDi∗‖R1∗, M9=R3⊕hIDi‖R2, and M10=hIDi∗‖SK′‖R3‖T4. However, without the knowledge of SIDj,K,IDi and R1,R2,R3,SK, the attacker is unable to generate these two messages to cheat the sensor and the user. Hence, the proposal can withstand GWN impersonation attack
(5)
Resistance to Desynchronization Attack. There are two conditions that may lead to desynchronization attack. First, both parties of communication stored authentication data that needs to be updated simultaneous, and if the message sent from one party to the other is intercepted by the attacker, the result is that the authentication data in one party has been updated whereas the other party’s is still unchanged. In our protocol, MD and the sensor are not required to update their authentication data simultaneously. Second, the authenticated protocol needs to maintain verification tables in GWN, or the server is subject to this attack. However, our improved scheme is not required to store a verification table in GWN. In short, our improved scheme is free from desynchronization attack
(6)
Resistance to Sensor Impersonation Attack. In this attack, the attacker generates a valid message M6,M7,T3 to cheat the GWN. However, because SKGW−Sj is carefully protected by the GWN and the attacker has no knowledge of R2 and R3, the attacker cannot succeed in forging the message M6,M7,T3. Therefore, the improved scheme is able to resist sensor impersonation attack
(7)
Resistance to Replay Attack and Man-in-the-Middle Attack. Generally, random nonce and timestamp are the two main techniques to prevent replay attack in authentication protocol. In our improved scheme, if the attacker captures the login message CIDi,M1,T1 and replays it to GWN, he cannot be authenticated by GWN because GWN will check the freshness of T1 and verify the hash value M1 which is computed with secret random numbers Ri and R1 shared between mobile device and the sensor. In addition, if the attacker generates an imitated login message with a new timestamp T1′, the GWN will reject it because T1′ should be a parameter of M1, and M1 cannot pass the verification of GWN. Thus, the improved scheme is secured from replay attack. Moreover, without knowing IDi,Ri,R1,R2,R3, the attacker is unable to compute the session key SK=hM2‖R2‖R3. Hence, the attacker will fail in passing the authentication of the sensor Sj, which means he cannot produce a valid session with Sj via retransmitting the request message of Ui. Thus, the proposal can thwart man-in-the-middle attack
(8)
Perfect Forward and Backward Secrecy. As can be seen from the login and authentication phase, the session key SK=hM2‖R2‖R3=hhIDi‖R1‖Ri‖R2‖R3 is computed by Ui and Sj, and it relies on IDi,Ri,R1,R2,R3, where the parameters Ri,R1,R2,R3 are randomly generated and unpredictable. Even if the attacker knows the leaked long-term key K of GWN, it is still impossible for him to calculate the session key because he has no knowledge of these random numbers provided by each communication party, i.e., Ui, GWN, and Sj. That is to say, the improved protocol can provide perfect forward and backward secrecy
(9)
Resistance to User Impersonation Attack. Assume that the attacker obtains the mobile device and extracts the secret information Regi,Ai∗,Ci,Di,m,n,h, where Regi=hhIDi‖Ri‖HPWimodm, Ai∗=Ai⊕hIDi‖ri, Ci=Bi⊕hIDi‖Ri‖HPWi, Di=ri⊕hhIDi‖PWimodm, and Bi=hIDi‖Ri‖K. To generate a valid login request CIDi,M1,T1, the attacker should first derive both password and mobile device of the medical professional. In particular, GWN validates the legitimacy of the medical professional by checking M1?=hIDi‖Bi‖R1‖T1, and the key to compute M1 is to get the value of Bi. However, without the knowledge of parameters (IDi, PWi, Ri, and K), the attacker cannot compute Bi, which means the attacker’s legitimacy will not be corroborated by GWN. Hence, the improved scheme is secure from user impersonation attack
(10)
User Anonymity. User anonymity is extremely important in preserving the patient’s privacy. Suppose that the attacker intercepts all the messages of the parties involved during the protocol execution, and in these messages, the component CIDi=IDi‖R1‖Ri∗‖SIDj2modn is related to the identity of the medical professional directly. However, the attacker cannot decrypt CIDi to get IDi because he has no knowledge of n or p,q. Besides, if the attacker attempts to mount identity guessing attack on M8, M9, and M10, respectively, where M8=R2⊕hIDi∗‖R1∗, M9=R3⊕hIDi∗‖R2∗, and M10=hIDi∗‖SK′‖R3‖T4, he will not succeed because the random numbers R1, R2, and R3 are adequately large to prevent him from guessing them out successfully. Therefore, the improved scheme is capable of preserving user anonymity
(11)
Mutual Authentication and Key Agreement. Due to the insecure nature of the wireless channel, mutual authentication has become one of the essential security features in authentication protocol. In the login and authentication phase, GWN authenticates Ui, Sj authenticates GWN, GWN authenticates Sj, and Ui authenticates GWN. Meanwhile, the shared session key SK=hhIDi‖R1‖Ri‖R2‖R3 is generated between Ui and Sj for future secure communication after authenticating each other successfully


## 5.3. Security and Performance Comparison

In this section, we compare the security features and performances of the improved scheme with the relevant competitive schemes [27, 29, 33, 53, 54].Table2 shows the comparison results of security features between the improved scheme and the related ones [27, 29, 33, 53, 54]. From Table 2, it is evident that our scheme has overcome the security weaknesses existing in Jiang et al.’s scheme [29], while the other protocols have security vulnerabilities more or less, e.g., protocols [27, 29, 33] suffer from user impersonation attack and cannot preserve user anonymity, protocols [53, 54] are vulnerable to stolen mobile device attack, and protocol [54] cannot resist replay and privileged insider attack. Particularly, some protocols [33, 53] cannot resist user impersonation attack when the mobile device is obtained by the attacker.Table 2
Comparison of security features.
[27]
[29]
[33]
[53]
[54]
Ours
S1
Yes
Yes
No
No
Yes
Yes
S2
No
No
No
No
Yes
Yes
S3
Yes
Yes
Yes
Yes
Yes
Yes
S4
Yes
Yes
Yes
Yes
Yes
Yes
S5
Yes
Yes
Yes
Yes
Yes
Yes
S6
Yes
No
No
Yes
Yes
Yes
S7
Yes
Yes
Yes
Yes
Yes
Yes
S8
Yes
No
No
Yes
No
Yes
S9
Yes
No
Yes
No
No
Yes
S10
Yes
Yes
Yes
Yes
Yes
Yes
S11
No
Yes
No
No
Yes
Yes
S12
Yes
No
No
Yes
Yes
Yes
S13
Yes
Yes
Yes
Yes
Yes
Yes
S1: resisting stolen mobile device attack; S2: resisting user impersonation attack; S3: resisting GWN impersonation attack; S4: resisting sensor node impersonation attack; S5: resisting desynchronization attack; S6: resisting KSSTI attack; S7: perfect forward and backward secrecy; S8: resisting replay attack; S9: resisting privileged insider attack; S10: resisting man-in-the-middle attack; S11: user anonymity; S12: sensor anonymity; S13: mutual authentication and key agreement.To facilitate the comparison of performances during the login and authentication phase, we use the various time notations of cryptographic operation as shown in Table3. To make a comparison of computation cost fairly, we also provide the time cost of various cryptographic calculations as the benchmark [41, 44, 53] in Table 3. Additionally, we assume that the length of an identity, a random number, a hash value, a timestamp, an elliptic curve point, the block size of AES symmetric encryption/decryption, and the modular exponentiation are 32 bits, 128 bits, 160 bits, 32 bits, 320 bits, 128 bits [55], and 1024 bits [14], respectively. The comprehensive study of the improved scheme and the related schemes [27, 29, 33, 53, 54] is given in Table 4. Furthermore, the performances of the sensor node are summarized in Table 5, because energy consumption is vital to evaluate the lifetime of the sensor node. For the convenience of understanding, the comparison graphs of computation cost, communication overhead, and traffic of sensor node are shown in Figures 3, 4, and 5, respectively.Table 3
Execution time of cryptographic operation.
Notation
Meaning
Time (ms)
Th
Time of a hash operation
0.0004 [53]
Tm
Time of a modular squaring
=Th [41]
TP
Time of ECC point multiplication
7.3529 [44]
Ts
Time of symmetric encryption/decryption
0.1303 [44]
TQR
Time of square root modularn
1.8382 [41, 44]
TR
Time of Rep operation
=TP [53]Table 4
Performance comparison.
[27]
[29]
[33]
[53]
[54]
Ours
Ui
8Th+TR+2TS
9Th+TM
11Th+TR+2TP
9Th+TR+2TS
10Th+3TP
11Th+TM
GWN
7Th+6TS
14Th+TQR
10Th
13Th+2TS
8Th+TP
13Th+TQR
Sj
5Th+2TS
7Th
3Th+2TP
5Th
4Th+2TP
7Th
Total cost
20Th+TR+10TS
30Th+6TM+TQR
24Th+TR+4TP
27Th+TM+4TS
22Th+6TP
31Th+6TM+TQR
Estimated time (ms)
8.66
1.84
36.77
7.88
51.61
1.97
Communication overhead (bits)
2944
2560
3072
2496
2880
2592Table 5
Traffic comparison of sensor node.
[27]
[29]
[33]
[53]
[54]
Ours
Receive
544
512
640
864
640
512
Send
672
320
640
352
640
352
Total
1216
832
1280
1216
1280
864Figure 3
Comparison of computation cost.Figure 4
Comparison of communication overhead.Figure 5
Comparison on traffic of sensor node.In Table4, it is evident that the protocol [29] is the most efficient one in terms of computation cost and communication overhead. Our improved scheme requires a little more computation cost and communication overhead than protocol [29]. However, the performance of our improved scheme is more efficient than protocols [27, 33, 53, 54] as justified from Table 4. In particular, protocols [33, 54] are the two most inefficient schemes among all the schemes since they employ ECC in which point multiplication needs more time than other operations, and elliptic curve point also needs more length than other symbols in communication.From Table5, it can be seen that the traffic length of sensor node in our protocol is 864 bits, which is just slightly higher than that in [29], but much lower than those in [27, 33, 53, 54]. Therefore, the potential energy consumption of our improved scheme is keeping at a manageable level for WMHS that helps to prolong the lifetime of the sensor.Although our scheme is not the most efficient one, it is worth noting that the security analysis and the comparison results of security features in Table2 have shown that our improved scheme overcomes the security risks in [27, 29, 33, 53, 54]. In a word, our improved scheme has higher security level while its computation cost and communication overhead are within reasonable level for WMHS environment.


## 6. Conclusion

To defeat the subtle security weaknesses like KSSTI attack, privileged insider attack, and DoS attack in Jiang et al.’s protocol for WMHS, we propose an improved two-factor authenticated key agreement protocol using quadratic residues. The completeness and validity of the improved scheme is proved under the random oracle model. Additionally, we provide a security analysis to demonstrate that the improved scheme is secure against various known attacks. Furthermore, performance comparisons between the improved scheme and the related ones demonstrate that our scheme outperforms the previous ones with regard to security features, computation cost, and communication overhead. Owing to these metrics, we believe that our improved scheme provides a reasonable solution for practical use in WHMS environment.



---

*Source: 5686498-2020-04-23.xml*