# CasCP: Efficient and Secure Certificateless Authentication Scheme for Wireless Body Area Networks with Conditional Privacy-Preserving

Authors: Yong Xie; Songsong Zhang; Xiang Li; Yanggui Li; Yuan Chai
Journal: Security and Communication Networks
 (2019)

---

## Abstract

As the aging population of society continues to intensify, the series of problems brought about by aging is becoming more and more serious. Because the health problem of the elderly brings many social problems, people have paid close attention to it. Fortunately, as a typical smart healthcare system, wireless body area networks (WBANs) present quit nice medical care for people, especially the aged. However, personal health information is very sensitive. But, the common communication channel is used in WBANs and any malicious entity can initiate a security attack on WBANs. To ensure secure communication and privacy-preserving which are the premise of the sound development of WBANs, an improved and efficient certificateless authentication scheme with conditional privacy-preserving is proposed in this paper on the basis of analyzing the most recent presented certificateless authentication scheme for WBANs. The proposed scheme also provides batch authentication to decrease authentication and communication cost. A rigid security proof demonstrates that our proposed scheme resists every type of security attack and can provide condition privacy-preserving. The performance analysis shows that our proposed scheme has some advantages in computation and communication cost.


---

## Body

## 1. Introduction

Nowadays, the population growth rate in many countries around the world is decreasing. Most of these counties have gradually entered an aged society. World Health Organization (WHO) has predicted that human life expectancy will reach 75 year old in 2030, and about 80 million people will be 60 year old in America and 430 million in China by 2050 [1]. Sociologists have pointed out that the aging population structure will put tremendous pressure on all aspects in society, especially healthcare.In order to provide comprehensive and accurate care for the elderly, researchers have launched various research on smart healthcare. With the rapid development of wearable sensors, especially health sensors, wireless body area networks (WBANs) have a profound significance for improving the health monitoring of the elderly [2]. Information technologies are used in WBANs and can be well applied to medical related services [3]. In WBAN, client’s information, such as weight trend, diet attempt, food-intake, hematologic biochemical parameters, respiratory rate, cardiac status, blood data, etc., is transmitted to the corresponding medical service application providers (AP) by wireless communication from body sensors. The client’s doctor will receive this information soon and provide timely treatment based on this information [4, 5]. The scenes of sensor nodes collect and send the client real-time physiological data to AP and the typical smart medical service based WBANs can be depicted as in Figure 1.Figure 1
The typical smart medical services based WBANs.However, the security and privacy issues in WBANs are very serious and worthy of paid close attention. It is well known that private personal health information is very sensitive, which may cause serious problems such as family conflicts, corporate crisis, and even state instability [6]. The health data are sent to AP through insecure communication channel and suffered from intercepting, eavesdropping, modification, and other attacks with little problem. The security of health data is critical to the patient as a forged health data results in doctor’s misdiagnosis and extremely may endanger the life of a patient. If WBANs cannot provide strong security protection measures, client’s personal health information cannot be effectively protected, client will no longer trust WBANs, and people will no longer accept WBANs. Then, WBANs cannot get further development and cannot achieve the goal of smart medical care [7].In order to meet the challenges of security and privacy protection in WBANs, many researchers have made continuous efforts and obtained some research results on WBANs authentication scheme. One important way is digit signature and data encryption. PKI-based authentication scheme and identity-based authentication scheme have been adopted to WBANs for a long time. But the PKI-based authentication scheme causes heavy certificate management and identity-based authentication scheme has an inevitable problem of key escrow. To solve this issue, certificateless authentication technology is introduced to WBANs and presents good application prospects. Recently, Jiet al. [8] proposed an efficient certificateless authentication scheme for WBANs. Jiet al. presented security analysis to show that their scheme can secure against all kinds of security attacks. However, their scheme cannot resist forgery attack and bath authentication attack, which is demonstrated in Section 5 in this paper. To the best of our knowledge, no universally accepted effective and secure authentication scheme for WBAN has been proposed, especially constructed by using certificateless public key cryptography [9]. Because of the strong privacy protection requirements of health data, limited communication channel, limited computing power, and fully open wireless communication environment, it is a huge challenge to build an efficient and secure certificateless authentication scheme for WBANs.


### 1.1. Motivations and Contributions

On reviewing Jiet al.’s certificateless authentication scheme [8], we decided to solve their security deficiencies while appreciating their high efficiency in message signing phase and authentication phase. In this paper, we present an improved and secure certificateless authentication scheme with conditional privacy-preserving (called CasCP). CasCP constructs signature and authentication algorithm by using elliptic curve cryptography (EEC) and no longer needs complex bilinear pairing operation. To sum up, there are three major contributions in our proposed scheme.First, we present an improved and secure certificateless authentication scheme with conditional privacy-preserving. The proposed scheme includes five key phases for WBANs.Second, we present a rigid security proof and detailed security analysis. It shows that CasCP can be secure against all known security attacks and providing privacy-preserving.Third, the performance analysis shows that CasCP requires less computational and communication costs than recent similar schemes.


### 1.2. Organization of the Paper

The rest of the paper is arranged as follows. Related works and preliminaries are presented in Sections2 and 3. Section 4 shows the system model and security requirements. Jiet al.’s certificateless authentication scheme is reviewed and analyzed in Section 5. Next, the CasCP is proposed in Section 6. Security proof and performance analysis are presented in Sections 7 and 8. At last, it draws a conclusion.


## 1.1. Motivations and Contributions

On reviewing Jiet al.’s certificateless authentication scheme [8], we decided to solve their security deficiencies while appreciating their high efficiency in message signing phase and authentication phase. In this paper, we present an improved and secure certificateless authentication scheme with conditional privacy-preserving (called CasCP). CasCP constructs signature and authentication algorithm by using elliptic curve cryptography (EEC) and no longer needs complex bilinear pairing operation. To sum up, there are three major contributions in our proposed scheme.First, we present an improved and secure certificateless authentication scheme with conditional privacy-preserving. The proposed scheme includes five key phases for WBANs.Second, we present a rigid security proof and detailed security analysis. It shows that CasCP can be secure against all known security attacks and providing privacy-preserving.Third, the performance analysis shows that CasCP requires less computational and communication costs than recent similar schemes.


## 1.2. Organization of the Paper

The rest of the paper is arranged as follows. Related works and preliminaries are presented in Sections2 and 3. Section 4 shows the system model and security requirements. Jiet al.’s certificateless authentication scheme is reviewed and analyzed in Section 5. Next, the CasCP is proposed in Section 6. Security proof and performance analysis are presented in Sections 7 and 8. At last, it draws a conclusion.


## 2. Related Works

In order to present a secure communication in WBANs, there are many security requirements. Among all of the security requirements, the remote authentication is the most basic and important requirement. In 1981, Lamport proposed the first remote authentication scheme [10] that allows the mobile user to authenticate with a server through a public channel and generate the session key to encrypt the later session. From then on, more and more remote authentication schemes have been proposed to apply to different environments.Some works in [11–15] are constructed based on traditional public key cryptosystem (PKC). But there are many difficulties in the establishment, implementation, and management of traditional PKC system. In order to solve the problems in traditional PKC system for WBANs, some researchers have proposed mutual authentication scheme using identity-based public key cryptography [16, 17]. In this way, these authentication schemes solve the difficulties in traditional PKC system. However, there is another thorny problem, key escrow problem; that is, if the key generation center has been compromised, the system goes into a state of being out of control.In 2003, Al Riyamiet al. [18] proposed certificateless cryptography, which can erase key escrow problem in identity-based PKC. Based on the previous work [18], scholars have proposed a lot of secure authentication schemes [19, 20] by using certificateless cryptography. In 2005, Huanget al. [21] proposed an improved scheme over Al Riyamiet al.’s [18] that can avoid security leaks. Huanget al. [20] proposed two certificateless signature schemes on assuming three-kind-adversary security model. However, it has been pointed out their scheme cannot resist key replacement attacks [22].To decrease authentication and communication cost, Bonehet al. [23] presented a certificateless authentication scheme with batch authentication in 2003. Batch authentication has been widely used for Internet of thing and other wireless networks, including WBANs. Without doubt, new security issues of batch authentication technology are unavoidable. Until now, researchers have proposed a lot of batch authentication schemes for WBANs and other wireless networks [24–26]. Based on the computational complexity of pairing, batch authentication and aggregate signature schemes [27–29] have been presented by using bilinear pairing. Xionget al. [30] proposed an aggregate signature and batch authentication scheme that do not use clock synchronization and needs less computation cost than Zhanget al.’s [27] scheme. But, an adversary can successfully launch a forgery attack on Xiong et al.’s scheme [31, 32]. Wenet al. [33] constructed an aggregate signature scheme using bilinear pairing with designed verifier. Hartunget al. [34] presented another fault-tolerant batch authentication scheme. Tuet al. [29] proposed a revised authentication scheme to solve the security deficiencies of Xiong’s scheme [30]. Heet al. [35] presented a new certificateless authentication scheme for WBANs. Unfortunately, the foregoing schemes have more or less security deficiencies; some schemes cannot resist security attacks in batch authentication [36–38].Most recently, Jiet al. [8] proposed a certificateless conditional privacy-preserving authentication scheme by using elliptic curve cryptography (ECC) for WBANs. Their proposed scheme has a clear advantage in computation performance when compared with the former certificateless scheme using bilinear pairing. They claimed that their proposed scheme provides conditional privacy-preserving and can resist all kinds of security attacks. However, we demonstrate that a common adversary can successfully launch a forgery attack in individual authentication and batch authentication. To solve the deficiencies of Jiet al.’s authentication scheme, we propose an improved certificateless authentication scheme with conditional privacy-preserving.


## 3. Preliminaries

### 3.1. Elliptic Curve Cryptosystem (ECC)

In 1984, Miller proposed elliptic curve cryptography (ECC) for the first time [39]. Koblitz [40] proposed an ECC instance based on the difficulty of elliptic curve discrete logarithm problem (ECDLP) before long. Since then, researchers have proposed a lot of secure authentication schemes that are constructed with ECC since ECC is efficient to decrease computation cost [41]. The definition of ECC can be depicted as follows.Letp be a large prime number; Fp is a finite field over p. Elliptic curve E/Ep meets equation y2=x3+ax+bmod⁡p with a,b∈Fp and 4a3+27b2mod⁡p≠0. Let point Θ be an infinite point. Θ and other points in E/Ep form an addictive group G. Given P and Q are different points on E/Ep, P+Q is defined as point addition. m·P=P+P+⋯+P︸mtimes is defined as scalar multiplication. n is defined as order if n is the smallest number that meets n·P=Θ.


### 3.2. Complexity Assumptions

Elliptic curve discrete logarithm problem (ECDLP): given two random pointsP,Q∈E/Ep and Q=x·P, without knowing x∈RZp∗, it is hard to compute x from Q. The probability for an adversary A to solve the ECDLP problem is AdvAECDLP=Pr[A(P,Q=x·P)=x]. The hardness is that to compute a from Q is negligible [42].


## 3.1. Elliptic Curve Cryptosystem (ECC)

In 1984, Miller proposed elliptic curve cryptography (ECC) for the first time [39]. Koblitz [40] proposed an ECC instance based on the difficulty of elliptic curve discrete logarithm problem (ECDLP) before long. Since then, researchers have proposed a lot of secure authentication schemes that are constructed with ECC since ECC is efficient to decrease computation cost [41]. The definition of ECC can be depicted as follows.Letp be a large prime number; Fp is a finite field over p. Elliptic curve E/Ep meets equation y2=x3+ax+bmod⁡p with a,b∈Fp and 4a3+27b2mod⁡p≠0. Let point Θ be an infinite point. Θ and other points in E/Ep form an addictive group G. Given P and Q are different points on E/Ep, P+Q is defined as point addition. m·P=P+P+⋯+P︸mtimes is defined as scalar multiplication. n is defined as order if n is the smallest number that meets n·P=Θ.


## 3.2. Complexity Assumptions

Elliptic curve discrete logarithm problem (ECDLP): given two random pointsP,Q∈E/Ep and Q=x·P, without knowing x∈RZp∗, it is hard to compute x from Q. The probability for an adversary A to solve the ECDLP problem is AdvAECDLP=Pr[A(P,Q=x·P)=x]. The hardness is that to compute a from Q is negligible [42].


## 4. System Model and Security Model

### 4.1. System Model

There are three main entities in WBANs, i.e., key generation center (KGC), clients (including his/her PDA), and application providers (AP). KGC generates the system parameters and location public key and secret key for APs. Each client generates his/her secret value and then registers with KGC to obtain their public key, partial private key, and PDA with system parameter and partial key. At last, the clients could sign and send their messages to APs. In the process, AP and client should be authenticated each other and obtain an identical session key. The common network structure of wireless body area networks (WBANs) is illustrated in Figure2.Figure 2
A common network structure of WBANs.Generally speaking, the messages in WBANs include sensitive health data. To ensure data integrity and identity authentication, these data should be signed and encrypted by PDA. The data with a signature could fall into two types: valid signature that can pass AP’s authentication and invalid signature that cannot pass AP’s authentication. When AP receives messages from different clients, AP can authenticate message one by one and also can adopt a more efficient way to authenticate multimessages, such as batch authentication. In our proposed scheme, batch authentication is used to improve authentication efficiency.


### 4.2. Security Model

In this section, we analyze the adversary model of certificateless authentication scheme for WBANs. As Al Riyami’s work [18], two-level attacks exist in the certificateless PKC. One is type-I adversary (called AI) who is able to simulate an “outsider” attacker; another is type-II adversary who is able to simulate an “insider” attacker (called AII), who may be an “honest but curious” KGC. AI cannot get system secret key and users’ partial key; however it could compromise users’ secret value. AII can get the system secret key and users’ partial key but cannot get user secret value [43].According to the ability of adversaryA (include AI and AII) and the system model of WBANs, we define security model as a game between a challenger C and A under the random Oracle model for the proposed scheme. Three steps are included in the game.Initialization:C generates system parameters and system secret key. Then C gives the public parameters to A.Oracle query:A can make queries with h Oracle, Create-User, Replace-Public-Key, Extract-Secret-Value, Extract-Partial-Key, and Sign Oracle at will, unlimited query times and order. Then C answers A by the definition of game.Output:C forges a signature after A has finished the above Oracle queries. At last, the advantage of successfully forging a valid signature is analyzed.According to the definition of the game,A can breach the authentication scheme ϕ only if A could make a valid signature and pass authentication. Let AdvϕAuth(A) be the probability that A can breach ϕ during the game.Definition 1.
An authentication scheme for WBANs can be determined to be secure only if the probabilityAdvϕAuth(A) is negligible for any probabilistic-polynomial-time (PPT) adversary A.As definition of security requirement in most works for WBAN, we also agree that a secure certificateless authentication scheme for WBAN should provide anonymity, mutual authentication, traceability, and session key establishment; it also should be secure against modification attack, impersonation attack, replay attack, batch authentication attack, and other security attacks [44].


## 4.1. System Model

There are three main entities in WBANs, i.e., key generation center (KGC), clients (including his/her PDA), and application providers (AP). KGC generates the system parameters and location public key and secret key for APs. Each client generates his/her secret value and then registers with KGC to obtain their public key, partial private key, and PDA with system parameter and partial key. At last, the clients could sign and send their messages to APs. In the process, AP and client should be authenticated each other and obtain an identical session key. The common network structure of wireless body area networks (WBANs) is illustrated in Figure2.Figure 2
A common network structure of WBANs.Generally speaking, the messages in WBANs include sensitive health data. To ensure data integrity and identity authentication, these data should be signed and encrypted by PDA. The data with a signature could fall into two types: valid signature that can pass AP’s authentication and invalid signature that cannot pass AP’s authentication. When AP receives messages from different clients, AP can authenticate message one by one and also can adopt a more efficient way to authenticate multimessages, such as batch authentication. In our proposed scheme, batch authentication is used to improve authentication efficiency.


## 4.2. Security Model

In this section, we analyze the adversary model of certificateless authentication scheme for WBANs. As Al Riyami’s work [18], two-level attacks exist in the certificateless PKC. One is type-I adversary (called AI) who is able to simulate an “outsider” attacker; another is type-II adversary who is able to simulate an “insider” attacker (called AII), who may be an “honest but curious” KGC. AI cannot get system secret key and users’ partial key; however it could compromise users’ secret value. AII can get the system secret key and users’ partial key but cannot get user secret value [43].According to the ability of adversaryA (include AI and AII) and the system model of WBANs, we define security model as a game between a challenger C and A under the random Oracle model for the proposed scheme. Three steps are included in the game.Initialization:C generates system parameters and system secret key. Then C gives the public parameters to A.Oracle query:A can make queries with h Oracle, Create-User, Replace-Public-Key, Extract-Secret-Value, Extract-Partial-Key, and Sign Oracle at will, unlimited query times and order. Then C answers A by the definition of game.Output:C forges a signature after A has finished the above Oracle queries. At last, the advantage of successfully forging a valid signature is analyzed.According to the definition of the game,A can breach the authentication scheme ϕ only if A could make a valid signature and pass authentication. Let AdvϕAuth(A) be the probability that A can breach ϕ during the game.Definition 1.
An authentication scheme for WBANs can be determined to be secure only if the probabilityAdvϕAuth(A) is negligible for any probabilistic-polynomial-time (PPT) adversary A.As definition of security requirement in most works for WBAN, we also agree that a secure certificateless authentication scheme for WBAN should provide anonymity, mutual authentication, traceability, and session key establishment; it also should be secure against modification attack, impersonation attack, replay attack, batch authentication attack, and other security attacks [44].


## 5. Review and Analysis of Jiet al.’s Scheme

In this section, we will review and analyze Jiet al.’s scheme [8]. To more clearly, Table 1 lists the notations and their descriptions adopted in Jiet al.’s scheme.Table 1
Notations used and description.
Symbol Description G Acyclic group on an ECC with orderq  P The generator point of groupG  s The secret key of TA  Ppub The public key of TA  RIDi The real identity of a client  IDA The identity of a AP  PIDi The pseudo identity of client  T Validity period of pseudo identity  t signature time  H(.) One-way hash function


### 5.1. Review of Jiet al.’s Scheme

There are four phases in Jiet al.’s scheme [8], and the four phases can be briefly depicted as follows.System Initialization Phase. TA executes this phase based on security parameter l.(1) Choose two prime numbersp and q, define a finite field Fp, and then generate group G with order q on Fp.(2) LetP be a generator of G, choose s∈RZq∗, and compute Ppub=sP as its public key. Then choose four one-way hash functions, H0,H1,H2,H3→Zq∗.(3) SelectzA∈RZq∗ for each registered AP and compute bA=zA+sH0(IDA) as AP’s private key and BA=zAP as AP’s public key.Pseudo Identity Generation and Message Singing Phase. In this phase, each valid client should register with TA, then he/she can sign messages with his/her private key and send to AP. The detailed steps are as follows:(1) The client choosesri,xi∈RZq∗, computes Xi=xiP and PIDi,1=riP, and then sends {RIDi,PWi,PIDi,Xi} to TA via a secure way.(2) TA computesβ=H0(RIDi)⊕H0(PWi) and PIDi,2=RIDi⊕H2(sPIDi,1,Ti), where Ti is the validity period of pseudo identity. Then TA chooses wi∈RZq∗ and computes Yi=wiP and yi=wi+sαmod⁡q, where αi=H1(PIDi,Xi) and PIDi=(PIDi,1,PIDi,1,Ti). Finally, TA loads {PIDi,yi,β,Yi} into the client’s PDA. Now, the client’s private key is SKi=(xi,yi), and public key is PKi=(Xi,Yi).(3) Before signing a message, the client should input hisRIDi and PWi into his/her PDA. PDA checks whether it meets β=?H0(RIDi)⊕H0(PWi). If it does, the client can sign by using PDA as next step.(4) Assume medical message beMi; PDA chooses di∈RZq∗ and timestamps ti and computes Di=diP, ui=H3(Mi,PIDi,Di,ti), σi=xi+yi+di·uimod⁡q, and K=di(BA+H0(IDA)Ppub), where K will be the session key between AP and the client. At last, PDA sends {PIDi,Mi,σi,Di,ti} to AP.Authentication Phase. AP can authenticate messages by the following two ways.(i) Individual Authentication. When receiving a message {PIDi,Mi,ξi,Di,ti}, AP checks whether Ti and ti are valid. If they do, AP computes αi=H1(PIDi,Xi) and ui=H3(Mi,PIDi,Di,ti) and checks whether σiP=?Xi+Yi+αiPpub+uiDi holds or not. If it holds, AP accepts the message and computes session key K=bADi and then sends MACK(BA) to the client. At last, the client uses K as session key if the received MACK(BA) is identical to his/her MACK(BA).(ii) Batch Authentication. When receiving n messages {PIDi,Mi,ξi,Di,ti}i=1ton from different clients, AP checks Ti and ti for each message. Then AP computes αi=H1(PIDi,Xi) and ui=H3(Mi,PIDi,Di,ti) for each message and checks whether the n messages meet the following equation:(1)∑i=1nσiP=∑i=1nXi+∑i=1nYi+∑i=1nαiPpub+∑i=1nuiDiIf does, AP accepts these messages.Password Change Phase. For security of PDA, the client can renew password PWi locally by following steps.(1) The client inputsRIDi and old password PWi; the PDA checks β=?H0(RIDi)⊕H0(PWi). If it does, the PDA requires the client to input new password PWi∗, then computes β∗=β⊕H0(PWi)⊕H0(PWi∗), and replaces β with β∗.


### 5.2. Analysis of Jiet al.’s Scheme

In this subsection, the security deficiencies of Jiet al.’s scheme are analyzed.(i) Not Be Secure against Forge Attack. Jiet al. show that their scheme could resist any forge attacks. However, any PPT AI could lightly win Game I in their scheme; that is, it could not be secure against forge attack. Assuming that the client’s identity is PIDi, the adversary is AI. AI launches the forge attack as the following steps:(1)AI has intercepted or received a valid message {PIDi,Mi,ξi,Di,ti}, which meets verification function σiP=Xi+Yi+αiPpub+uiDi. Then AI selects wi∗∈RZq∗, message Mi∗, and timestamps ti∗.(2)AI computes Yi∗=wi∗P-(Xi+αiPpub), Di∗=di∗P, ui∗=H3(Mi∗,PIDi,Di∗,ti∗), and σi∗=wi∗+ui∗di∗mod⁡q, where PIDi is a valid pseudo identity. At last, AI sends the forged message {PIDi,Mi∗,ξi∗,Di∗,ti∗} to AP by using PIDi’s identity.(3) AP receives message{PIDi,Mi∗,ξi∗,Di∗,ti∗}, and checks whether the equation σi∗P=Xi+Yi∗+αiPpub+ui∗Di∗ holds or not. Let us expand the equation as follows:(2)Xi+Yi∗+αiPpub+ui∗Di∗=Xi+Yi∗+αiPpub+ui∗Di∗=Xi+-αiPpub+Xi+wi∗P+αiPpub+ui∗Di∗=Yi∗+ui∗Di∗=wi∗+ui∗di∗P=σi∗PAs shown above,AI can forge a valid message by using PIDi’s identity easily. Therefore, Jiet al.’s scheme cannot resist any AI’s forge attack.(ii) Not Be Secure against Batch Authentication Attack. The adversary AI can also launch security attack in the batch authentication step of Jiet al.’s scheme. AI can do as the following steps.(1)AI can forge two signatures σ1=xi+yi and σ2=uidi on two messages {PIDi,Mi,σ1,Di,ti} and {PIDi,Mi,σ2,Di,ti}, which cannot meet the verification. However, σ1 and σ2 can meet the batch authentication function of Jiet al.’s scheme as ∑12σiP=∑12Xi+∑12Yi+∑12αiPpub+∑12uiDi=Xi+Yi+αiPpub+uiDi.Therefore, Jiet al.’s scheme cannot resist any AI’s batch authentication attack.


## 5.1. Review of Jiet al.’s Scheme

There are four phases in Jiet al.’s scheme [8], and the four phases can be briefly depicted as follows.System Initialization Phase. TA executes this phase based on security parameter l.(1) Choose two prime numbersp and q, define a finite field Fp, and then generate group G with order q on Fp.(2) LetP be a generator of G, choose s∈RZq∗, and compute Ppub=sP as its public key. Then choose four one-way hash functions, H0,H1,H2,H3→Zq∗.(3) SelectzA∈RZq∗ for each registered AP and compute bA=zA+sH0(IDA) as AP’s private key and BA=zAP as AP’s public key.Pseudo Identity Generation and Message Singing Phase. In this phase, each valid client should register with TA, then he/she can sign messages with his/her private key and send to AP. The detailed steps are as follows:(1) The client choosesri,xi∈RZq∗, computes Xi=xiP and PIDi,1=riP, and then sends {RIDi,PWi,PIDi,Xi} to TA via a secure way.(2) TA computesβ=H0(RIDi)⊕H0(PWi) and PIDi,2=RIDi⊕H2(sPIDi,1,Ti), where Ti is the validity period of pseudo identity. Then TA chooses wi∈RZq∗ and computes Yi=wiP and yi=wi+sαmod⁡q, where αi=H1(PIDi,Xi) and PIDi=(PIDi,1,PIDi,1,Ti). Finally, TA loads {PIDi,yi,β,Yi} into the client’s PDA. Now, the client’s private key is SKi=(xi,yi), and public key is PKi=(Xi,Yi).(3) Before signing a message, the client should input hisRIDi and PWi into his/her PDA. PDA checks whether it meets β=?H0(RIDi)⊕H0(PWi). If it does, the client can sign by using PDA as next step.(4) Assume medical message beMi; PDA chooses di∈RZq∗ and timestamps ti and computes Di=diP, ui=H3(Mi,PIDi,Di,ti), σi=xi+yi+di·uimod⁡q, and K=di(BA+H0(IDA)Ppub), where K will be the session key between AP and the client. At last, PDA sends {PIDi,Mi,σi,Di,ti} to AP.Authentication Phase. AP can authenticate messages by the following two ways.(i) Individual Authentication. When receiving a message {PIDi,Mi,ξi,Di,ti}, AP checks whether Ti and ti are valid. If they do, AP computes αi=H1(PIDi,Xi) and ui=H3(Mi,PIDi,Di,ti) and checks whether σiP=?Xi+Yi+αiPpub+uiDi holds or not. If it holds, AP accepts the message and computes session key K=bADi and then sends MACK(BA) to the client. At last, the client uses K as session key if the received MACK(BA) is identical to his/her MACK(BA).(ii) Batch Authentication. When receiving n messages {PIDi,Mi,ξi,Di,ti}i=1ton from different clients, AP checks Ti and ti for each message. Then AP computes αi=H1(PIDi,Xi) and ui=H3(Mi,PIDi,Di,ti) for each message and checks whether the n messages meet the following equation:(1)∑i=1nσiP=∑i=1nXi+∑i=1nYi+∑i=1nαiPpub+∑i=1nuiDiIf does, AP accepts these messages.Password Change Phase. For security of PDA, the client can renew password PWi locally by following steps.(1) The client inputsRIDi and old password PWi; the PDA checks β=?H0(RIDi)⊕H0(PWi). If it does, the PDA requires the client to input new password PWi∗, then computes β∗=β⊕H0(PWi)⊕H0(PWi∗), and replaces β with β∗.


## 5.2. Analysis of Jiet al.’s Scheme

In this subsection, the security deficiencies of Jiet al.’s scheme are analyzed.(i) Not Be Secure against Forge Attack. Jiet al. show that their scheme could resist any forge attacks. However, any PPT AI could lightly win Game I in their scheme; that is, it could not be secure against forge attack. Assuming that the client’s identity is PIDi, the adversary is AI. AI launches the forge attack as the following steps:(1)AI has intercepted or received a valid message {PIDi,Mi,ξi,Di,ti}, which meets verification function σiP=Xi+Yi+αiPpub+uiDi. Then AI selects wi∗∈RZq∗, message Mi∗, and timestamps ti∗.(2)AI computes Yi∗=wi∗P-(Xi+αiPpub), Di∗=di∗P, ui∗=H3(Mi∗,PIDi,Di∗,ti∗), and σi∗=wi∗+ui∗di∗mod⁡q, where PIDi is a valid pseudo identity. At last, AI sends the forged message {PIDi,Mi∗,ξi∗,Di∗,ti∗} to AP by using PIDi’s identity.(3) AP receives message{PIDi,Mi∗,ξi∗,Di∗,ti∗}, and checks whether the equation σi∗P=Xi+Yi∗+αiPpub+ui∗Di∗ holds or not. Let us expand the equation as follows:(2)Xi+Yi∗+αiPpub+ui∗Di∗=Xi+Yi∗+αiPpub+ui∗Di∗=Xi+-αiPpub+Xi+wi∗P+αiPpub+ui∗Di∗=Yi∗+ui∗Di∗=wi∗+ui∗di∗P=σi∗PAs shown above,AI can forge a valid message by using PIDi’s identity easily. Therefore, Jiet al.’s scheme cannot resist any AI’s forge attack.(ii) Not Be Secure against Batch Authentication Attack. The adversary AI can also launch security attack in the batch authentication step of Jiet al.’s scheme. AI can do as the following steps.(1)AI can forge two signatures σ1=xi+yi and σ2=uidi on two messages {PIDi,Mi,σ1,Di,ti} and {PIDi,Mi,σ2,Di,ti}, which cannot meet the verification. However, σ1 and σ2 can meet the batch authentication function of Jiet al.’s scheme as ∑12σiP=∑12Xi+∑12Yi+∑12αiPpub+∑12uiDi=Xi+Yi+αiPpub+uiDi.Therefore, Jiet al.’s scheme cannot resist any AI’s batch authentication attack.


## 6. The Improved Certificateless Authentication Scheme

In this section, an improved and secure certificateless authentication scheme for WBANs with conditional privacy-preserving (called CasCP) is proposed. The proposed CasCP consists of five phases: system initialization phase, pseudo identity generation phase, message signing phase, authentication phase, and password change phase.To be clear, four new notations and descriptions that adopted in CasCP are listed in Table2.Table 2
New notations and description in our scheme.
Symbol Description KGC Key Generation center  h(.) One-way hash function  MACK(.) One-hash function with keyK  l Security-level parameterNext, the five phases are described as the following subsections.


### 6.1. System Initialization Phase

The KGC runs this phase with security level parameterl as follows.(1) KGC chooses two prime numbersp and q and defines a finite field Fp and then generates group G with order q on Fp.(2) LetP be one of generators of G. KGC chooses s∈RZq∗ and computes Ppub=sP as its public key. Then choose four one-way hash functions, h0,h1,h2,h3→Zq∗.(3) KGC selectszA∈RZq∗ for each registered AP and computes bA=zA+s·h0(IDA) as AP’s private key and BA=zAP as AP’s public key.


### 6.2. Pseudo Identity Generation Phase

Each WBANs client should register with KGC when he/her wants to obtain healthcare services. The client and KGC complete the pseudo identity phase as follow steps.(1) Assume the client real identity beRIDi and his/her login password for PDA be PWi. He/she chooses xi∈RZq∗, computes Xi=xiP, and then sends {RIDi,PWi,Xi} to KGC via a secure way.(2) Upon receiving{RIDi,PWi,Xi}, KGC chooses wi∈RZq∗ and expiration time Ti and then computes Yi=wiP, β=h0(RIDi)⊕h0(PWi), PIDi=RIDi⊕h1(sXi,Ti,Yi), αi=h2(PIDi,Xi,Yi,Ti), and yi=wi+s·αmod⁡q. Finally, KGC loads {PIDi,yi,β,Yi,Xi,Ti} into the client’s PDA.(3) When the client receives the PDA from KGC, he/she inputsRIDi and PWi into PDA. Next PDA checks whether β=h0(RIDi)⊕h0(PWi) holds or not. If it holds, the client’s private key is SKi=(xi,yi) and public key is PKi=(Xi,Yi). Otherwise, he/she registers again as next step.


### 6.3. Message Signing Phase

In this phase, the client signs messages by using PDA when he/she needs to communicate with others (such as AP) as the following steps.(1) The client inputsRIDi and PWi into PDA firstly. Then PDA checks whether β=h0(RIDi)⊕h0(PWi) holds or not, where β is stored in the PDA. If it holds, the client can sign message by PDA.(2) Assume the medical message beMi. PDA chooses di∈RZq∗ and timestamps ti and then computes Di=diP, ui=h3(Mi,PIDi,Xi,Ti,Yi,Di,ti), σi=xi+yi+di·uimod⁡q, and K=di(BA+h0(IDA)Ppub), where K is the session key between AP and the client. At last, PDA sends {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} to AP.


### 6.4. Authentication Phase

To ensure the security of data, the client and AP can authenticate each other in the proposed scheme. In order to further improve the authentication efficiency, batch authentication is provided. Next, individual authentication and batch authentication are presented.(i) Individual Authentication. (1) When receives a message {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} from the client, AP checks whether Ti and ti valid. If they do, AP computes αi=h2(PIDi,Xi,Yi,Ti) and ui=h3(Mi,PIDi,Xi,Ti,Yi,Di,ti) and checks whether the verification equation(3)σiP=Xi+Yi+αiPpub+uiDiholds or not. If it holds, AP accepts the message and computes session key K∗=bADi and then sends MACK∗(BA) to the client.(2) After receivingMACK∗(BA) from AP, the client uses his/her K that obtained in message signing phase to compute MACK(BA) and then checks whether the received MACK∗(BA) is identical to his/her MACK(BA). If it does, the client and AP have authenticated each other successfully and obtained an identical session key K for subsequent communications.The message signing and individual authentication phase are illustrated as Figure3.Figure 3
Message signing and individual authentication phase.(ii) Batch Authentication. When receiving n messages {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi}i=1ton from different clients, AP can execute batch authentication for the n messages.(1) AP checksTi and ti for each message and then computes αi=h2(PIDi,Xi,Yi,Ti) and ui=h3(Mi,PIDi,Xi,Ti,Yi,Di,ti) for each message.(2) AP selects a small random integer vectorv={v1,v2,…,vn}, which have little computation cost in scalar multiplication [41].(3) At last, AP checks whether then messages meet the following equation:(4)∑i=1nviσiP=∑i=1nviXi+∑i=1nviYi+∑i=1nviαiPpub+∑i=1nviuiDiIf it does, AP accepts these messages.


### 6.5. Password Change Phase

This phase is same as Jiet al.’s scheme, and the description will not be repeated here.


## 6.1. System Initialization Phase

The KGC runs this phase with security level parameterl as follows.(1) KGC chooses two prime numbersp and q and defines a finite field Fp and then generates group G with order q on Fp.(2) LetP be one of generators of G. KGC chooses s∈RZq∗ and computes Ppub=sP as its public key. Then choose four one-way hash functions, h0,h1,h2,h3→Zq∗.(3) KGC selectszA∈RZq∗ for each registered AP and computes bA=zA+s·h0(IDA) as AP’s private key and BA=zAP as AP’s public key.


## 6.2. Pseudo Identity Generation Phase

Each WBANs client should register with KGC when he/her wants to obtain healthcare services. The client and KGC complete the pseudo identity phase as follow steps.(1) Assume the client real identity beRIDi and his/her login password for PDA be PWi. He/she chooses xi∈RZq∗, computes Xi=xiP, and then sends {RIDi,PWi,Xi} to KGC via a secure way.(2) Upon receiving{RIDi,PWi,Xi}, KGC chooses wi∈RZq∗ and expiration time Ti and then computes Yi=wiP, β=h0(RIDi)⊕h0(PWi), PIDi=RIDi⊕h1(sXi,Ti,Yi), αi=h2(PIDi,Xi,Yi,Ti), and yi=wi+s·αmod⁡q. Finally, KGC loads {PIDi,yi,β,Yi,Xi,Ti} into the client’s PDA.(3) When the client receives the PDA from KGC, he/she inputsRIDi and PWi into PDA. Next PDA checks whether β=h0(RIDi)⊕h0(PWi) holds or not. If it holds, the client’s private key is SKi=(xi,yi) and public key is PKi=(Xi,Yi). Otherwise, he/she registers again as next step.


## 6.3. Message Signing Phase

In this phase, the client signs messages by using PDA when he/she needs to communicate with others (such as AP) as the following steps.(1) The client inputsRIDi and PWi into PDA firstly. Then PDA checks whether β=h0(RIDi)⊕h0(PWi) holds or not, where β is stored in the PDA. If it holds, the client can sign message by PDA.(2) Assume the medical message beMi. PDA chooses di∈RZq∗ and timestamps ti and then computes Di=diP, ui=h3(Mi,PIDi,Xi,Ti,Yi,Di,ti), σi=xi+yi+di·uimod⁡q, and K=di(BA+h0(IDA)Ppub), where K is the session key between AP and the client. At last, PDA sends {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} to AP.


## 6.4. Authentication Phase

To ensure the security of data, the client and AP can authenticate each other in the proposed scheme. In order to further improve the authentication efficiency, batch authentication is provided. Next, individual authentication and batch authentication are presented.(i) Individual Authentication. (1) When receives a message {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} from the client, AP checks whether Ti and ti valid. If they do, AP computes αi=h2(PIDi,Xi,Yi,Ti) and ui=h3(Mi,PIDi,Xi,Ti,Yi,Di,ti) and checks whether the verification equation(3)σiP=Xi+Yi+αiPpub+uiDiholds or not. If it holds, AP accepts the message and computes session key K∗=bADi and then sends MACK∗(BA) to the client.(2) After receivingMACK∗(BA) from AP, the client uses his/her K that obtained in message signing phase to compute MACK(BA) and then checks whether the received MACK∗(BA) is identical to his/her MACK(BA). If it does, the client and AP have authenticated each other successfully and obtained an identical session key K for subsequent communications.The message signing and individual authentication phase are illustrated as Figure3.Figure 3
Message signing and individual authentication phase.(ii) Batch Authentication. When receiving n messages {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi}i=1ton from different clients, AP can execute batch authentication for the n messages.(1) AP checksTi and ti for each message and then computes αi=h2(PIDi,Xi,Yi,Ti) and ui=h3(Mi,PIDi,Xi,Ti,Yi,Di,ti) for each message.(2) AP selects a small random integer vectorv={v1,v2,…,vn}, which have little computation cost in scalar multiplication [41].(3) At last, AP checks whether then messages meet the following equation:(4)∑i=1nviσiP=∑i=1nviXi+∑i=1nviYi+∑i=1nviαiPpub+∑i=1nviuiDiIf it does, AP accepts these messages.


## 6.5. Password Change Phase

This phase is same as Jiet al.’s scheme, and the description will not be repeated here.


## 7. Security Proof and Analysis

In this section, a formal security proof of CasCP is presented. It shows that CasCP is unforgeable against adversaryA (included AI and AII), and CasCP can meet the security requirements of WBANs.


### 7.1. Security Proof

Next, CasCP is assessed on the security under the random Oracle model.Theorem 2.
AssumeAI be a PPT adversary who could win Game I with nonnegligible probability. Let C be a challenger who could solve ECDLP problem on advantage ε1≥(1-qh1/q)qc(1-1/qc)qe(1-qh2/q)(1-qh3/q)1/qcε, where qh1,qh2,qh3,qc,qe are the times of executing h1,h2,h3, Create-User, and Extract-Partial-Key Oracle query, respectively.Proof.
LetAI be a PPT adversary, which attempts to forge target client IDo’s valid message. AI could win Game-I with a probability ε. Given an ECDLP instance (G,P,Q=sP), C runs AI as a subroutine to solve the ECDLP instance.Step 1.
C executes system initialization, and publics the parameters to AI, given an ECDLP instance (G,P,Q=Ppub) to C, from which it tries to compute s from Ppub.Step 2.
A I executes Oracle queries within limited query times, then C will answer AI as the following rules.
(i) Hash-Queries. C answers AI when he/she executes Oracle queries as follows.
(a) h 1 - Q u e r y. As AI executes this query with (ID, X), C looks for (ID, X) in list Lh1. If Lh1 has the entry, C returns τh1 to AI. Otherwise, C chooses τh1,x,T at random and sets τh1←h1(u·Q,X,T). Finally C returns τh1 to AI.
(b) h 2 - Q u e r y. As AI executes this query with (ID), C looks for (ID) in list Lα. If Lα has the entry, C returns τα to AI. Otherwise, C chooses w∈Zq∗ at random and computes Y=wP and sets τα←h2(ID,Y,X,T). Then C returns τα to AI.
(c) h 3 - Q u e r y. As AI executes this query with (ID, M), C looks for (ID, M) in sign list Ls. If Ls has the entry, C returns τu to AI. Otherwise, C chooses d∈Zq∗ at random, computes D=dP, and sets τu←h3(m, PID, X, T, Y, D, t), where PID, X, T, and Y can be obtained from other h queries and create-user query. Then C returns τu to AI.
(ii) C r e a t e - U s e r ( I D ). As AI executes this query with (ID), C looks for (ID) in user list Lu. If Lu has an entry with ID, C returns XID to AI. Otherwise, C randomly selects xID,wID,h1ID∈Zq∗ and computes PID=ID⊕h1ID, PKID=wID·P+α·Q, and yID=⊥. Next, C adds {ID,xID,wID,YID,XID,PKID} to the corresponding list Lu,Lh1,Lh2.
(iii) R e p l a c e - P u b l i c - K e y ( I D ). As AI executes this query with (ID), C chooses x∈Zq∗ at random and computes X=x·P, Finally, C adds (x,X) in Lu and sends (x,X) to AI. As for y, C returns ⊥.
(iv) E x t r a c t - S e c r e t - V a l u e ( I D ). As AI executes this query with (ID), C looks for user list Lu. If Lu has the entry, C returns x to AI.
(v) E x t r a c t - P a r t i a l - K e y ( I D ). As AI executes this query with (ID), C looks for user list Lu. If ID=IDo, C sends ⊥ to AI. Else if Lu has the entry with ID, C sends PK to AI, else C runs Create-User(ID) query and sends PK to AI.
(vi) S i g n ( I D , M ). As AI executes this query with (ID, M), C looks for tuple (ID) in Lu. If ID≠IDo, C randomly selects d∈Zq∗, computes D=dP, u=h3(M,PID,X,T,Y,D,t), and σ=x+y+u·dmod⁡q, and then adds d,D,u in Ls. If ID=IDo, C selects α,d,u∈Zq∗ at randomly and computes D=dP, X=σ·P-Y-uα·Q-u·D and then adds d,D to Ls. At last, C returns (σ,D) to AI.Step 3.
Finally,C obtains a forged message (ID,M,D,σ) under certain restrictions that the AI never makes Extract-Partial-key query with ID and Sign query with (ID,M). If ID≠IDo, C stops the game. Otherwise, C looks for the corresponding entry in Lh2,Lu,Ls. If there is not the corresponding σ, it stops the game. Otherwise, σ meets the following equation:(5)σ·P=X+Y+α·Q+ud·PAI can replay the game based on forgery lemma [45]; he/her could obtain another forged message (ID,M,D∗,σ∗) by selecting another σ∗,α∗,d∗.(6)σ∗·P=X+Y+α∗·Q+u∗d∗·P
According to (5) and (6), C could obtain the s=(σ-σ∗)-(ud-u∗d∗)/α-α∗mod⁡q; i.e., C could solve the ECDLP problem. Next, the probability of C which obtains the correct solution for (P,Q=sP) is analyzed. If C has done successfully, two events must happen.(i)
Ev1: never stop the game.(ii)
Ev2: σ is valid.
Therefore, the advantage ofC is ε1=Pr[Ev1∩Ev2]= Pr[Ev1]  Pr[Ev2∣Ev1]. The occurrence probability of Ev1 could be gained in Create-user, Extract-Partial-key, and Sign Oracle query during the game. Therefore, it can obtain Pr[Ev1]≥(1-qh1/q)qc(1-1/qc)qe(1-qh2/q)(1-qh3/q)q)1/qc. Therefore, we can get ε1≥(1-qh1/q)qc(1-1/qc)qe(1-qh2/q)(1-qh3/q)1/qcε.Theorem 3.
AssumeAII is a PPT super type-II adversary who can succeed in Game-II with nonnegligible probability. Let C be a challenger who can solve the ECDLP problem with advantage ε2≥(1-qh1/q)qc(1-1/qc)qr(1-1/qc)qx(1-qh2/q)(1-qh3/q)1/qcε, where qh1,qh2,qh3,qc,qr,qx denote the times of executing h1,h2,h3, Create-User, Replace-Public-Key, and Extract-Secret-Value Oracle query, respectively.Proof.
AssumeAII is a type-II adversary, and AII attempts to forge target client IDo’s valid message. Then AII could win Game-II with probability ε. Given an ECDLP instance (G,P,Q=xo·P), let C be a challenger. Next, C runs AII as a subroutine to solve ECDLP problem.Step 1.
C executes system initialization and public parameters and s to AII. Assume (G,P,Q=xo·P) is given an ECDLP instance; C tries to compute xo from Q.Step 2.
A I I executes Oracle queries within limited query times, then C will answer AII as the following rules.(i) Hash-Queries. C answers AII when he/she executes Oracle queries as follows.(a) h 1 - Q u e r y. As AII executes the query with (ID, X), C looks for (ID, X) in list Lh1. If Lh1 has the entry, C returns τh1 to AII. Otherwise, C chooses τh1,w∈Zq∗ at random and computes Y=wP and sets τh1←h1(s·X,T,Y). Finally C returns τh1 to AII.(b) h 2 - Q u e r y and h 3 - Q u e r y. As AII executes the two queries, C could answer AII as he/she answers AI in Game I.(ii) C r e a t e - U s e r ( I D ). As AII executes the query with (ID), C looks for user list Lu. If Lu has the entry, C returns TKID. Otherwise, if ID=IDo, C chooses w∈Z∗q and X∈G at random and current time T, calculates Y=w·P, PID=ID⊕h1(α·X,T,Y), α=h2(PID,X,Y,T), and y=w+sαmod⁡q, and sets x=⊥. Then, C will add (ID,u,y,x,α) to list Lu,Lh2, respectively. If ID≠IDo, C chooses u,x∈Z∗q at random and current time T and calculates U=u·P, PID=ID⊕h1(αu·P,T), α=h2(PID,X,Y,T), y=w+αsmod⁡q, and X=x·P. Then, C will add (ID,x,w,y,X,Y,α) to corresponding list Lu,Lh2, respectively.(iii) R e p l a c e - P u b l i c - K e y ( I D ). As AII executes the query with (ID), C will answer AII as the following two cases: if ID≠IDo, C will answer AII with the definition of Partial Key Generation and Private key Generation algorithm. If ID=IDo, C chooses w∈Zq∗ and X∈G at random. Next C calculates Y=w·P, PID=ID⊕h1(sX,T,Y), α=h2(PID,X,Y,T), and y=w+sαmod⁡q and sets x=⊥. Finally, C sends (Y,X) to AII.(iv) E x t r a c t - S e c r e t - V a l u e ( I D ). As AII executes the query with (ID), C looks for it in user list Lu. If Lu has the entry with ID, C sends x to AII. Or, if ID≠IDo, C chooses x∈RZq∗ at random and adds it to Lu as ID’s secret value. Next C sends x to AII. If ID=IDo, C returns ⊥.(v) E x t r a c t - P a r t i a l - K e y ( I D ). As AII executes the query with (ID), C looks for it in Lu. If Lu has the entry with ID, C sends y to AII. Otherwise, C will execute Create-User(ID) query and then sends y to AII.(vi) S i g n ( I D , m ). As AII executes the query with (ID, M), C looks for it in Lu. If ID≠IDo, C chooses d∈Zq∗ at random and current time t and then calculates D=d·P, u=h3(M,PID,X,T,Y,D,t), and σ=x+y+dumod⁡q. Next C adds d,D,σ in Ls and sends (D,σ) to AII. If ID=IDo, C chooses d∈Zq∗ at random and calculates D=d·Q, u=h3(M,PID,X,T,Y,D,t), and σ=x+y+dumod⁡q and then adds σ,D to Ls. At last, C returns (σ) to AII.Step 3.
At last,AII obtains a forged message (ID,M,D,σ) under the constrain restrictions that AII never makes Extract-Partial-Key query with ID and Sign query with (ID,M). If ID≠IDo, C stops the game. Otherwise, C looks for the corresponding entry in Lh2,Lu,Ls. If there is not corresponding σ, C stops the game or σ meets the following authentication equation:(7)σ·P=Q+Y+α·Ppub+ud·QAII can replay the game based on forgery lemma [45]; he/she could obtain another forged messages (ID,M,D∗,σ∗) by selecting another u∗,d∗.(8)σ∗·P=Q+Y+α·Ppub+u∗d∗·Q
According to (7) and (8), C could obtain the xo=(σ-σ∗)/(ud-u∗d∗)mod⁡q; i.e., C could solve the ECDLP problem. Next, the probability that C gains the correct solution for the instance (P,Q=Xo=xo·P) is analyzed. If C has been successful, two events must happen.(i)
Ev1: never abort the game.(ii)
EV2: σ is valid.
Therefore,C’s advantage is ε1=Pr[Ev1∩Ev2]= Pr[Ev1]  Pr[Ev2∣Ev1]. The probability of Ev1’s occurrence can be gained in Create-user, Extract-Partial-key, and Sign Oracle query during the game. Therefore, it can obtain Pr[Ev1]≥(1-qh1/q)qc(1-1/qc)qr(1-1/qc)qx(1-qh2/q)(1-qh3/q)1/qc. Therefore, we can get ε2≥(1-qh1/q)qc(1-1/qc)qr(1-1/qc)qx(1-qh2/q)(1-qh3/q)1/qcε.Now, we can draw a conclusion that CapCP can resist two-level adversary on the condition of the ECDLP assumption which is established.


### 7.2. Other Security Analyses

Next, we will analyze whether CapCP meets the security requirements of WBANs.(i) Anonymity. In CasCP, a client’s real identity is embedded his/her pseudo identity PIDi=RIDi⊕h1(sXi,Ti,Yi). PIDi is generated by KGC, any adversaries cannot retrieve the real identity from PIDi because sXi=sxiP, Xi=xiP, and Ppub=sP make up a classic CDH problem. Therefore CapCP provides anonymity for clients.(ii) Mutual Authentication. After receiving a message {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} from a client, AP checks the validity and integrity of the message according to individual authentication equation. If it holds, the message can be regarded as a valid message. The AP signs and returns reply message in the same way to the client, the AP can also be securely authenticated. Therefore, CasCP can satisfy mutual authentication for WBANs.(iii) Traceability. The clients’ real identities are embedded in PID by PIDi=RIDi⊕h1(sXi,Ti,Yi). KGC is the only authenticated one that can retrieve the real identity from PIDi because only KGC knows the system secret key s. Therefore, CasCP provides identity traceability for KGC.(iv) Modification Attack. Assume a forged message {Mi,PIDi,Xi,Ti,Yi∗,Di∗,ti∗,σi∗} is modified from a valid message {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} by an adversary, the verifier could easily distinguish the forged message {Mi,PIDi,Xi,Ti,Yi∗,Di∗,ti∗,σi∗} because the forged message cannot meet the authentication equation σiP=Xi+Yi+αiPpub+uiDi. Therefore, CasCP is secure against modification attack.(v) Session Key Establishment. In CasCP, the client and AP have a session key as K=di(BA+H0(IDA)Ppub). From the definition of K, K=dibAP, Di=diP, and PKA=bAP are CDH problem instance. An adversary cannot compute a valid session key because of ECDLP assumption’s hardness. Therefore, CasCP can achieve secure session key establishment.(vi) Impersonation Attack. To impersonate a client, an adversary must generate a valid message {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} to meet the authentication equation σiP=Xi+Yi+αiPpub+uiDi. But the adversary cannot generate the valid a valid message according to Theorems 2 and 3. Therefore, CasCP is secure against impersonation attack.(vii) Replay Attack. An adversary replays an old message {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} by new time ti in {Mi,PIDi,Xi,Ti,Yi,Di,ti∗,σi}. However, AP can find that this message is invalid by verification equation σiP=Xi+Yi+αiPpub+uiDi according to the ECDLP assumption’s hardness. That is CasCP can be secure against replay attack.(viii) Batch Authentication Attack. When an invalid message or more messages join in batch authentication process, CasCP uses a small random integer vector to break the inherent relationship among of the signatures of messages. Therefore, an adversary cannot use the invalid or forged messages to launch batch authentication attack.(ix) Lost PDA Attack. To use PDA, the correct RIDi and PWi must be input into PDA. However, the adversary cannot login the PDA without knowing RIDi and PWi, even if the adversary has breached PDA and has got the data in PDA. However, the data is nothing useful for the adversary.


## 7.1. Security Proof

Next, CasCP is assessed on the security under the random Oracle model.Theorem 2.
AssumeAI be a PPT adversary who could win Game I with nonnegligible probability. Let C be a challenger who could solve ECDLP problem on advantage ε1≥(1-qh1/q)qc(1-1/qc)qe(1-qh2/q)(1-qh3/q)1/qcε, where qh1,qh2,qh3,qc,qe are the times of executing h1,h2,h3, Create-User, and Extract-Partial-Key Oracle query, respectively.Proof.
LetAI be a PPT adversary, which attempts to forge target client IDo’s valid message. AI could win Game-I with a probability ε. Given an ECDLP instance (G,P,Q=sP), C runs AI as a subroutine to solve the ECDLP instance.Step 1.
C executes system initialization, and publics the parameters to AI, given an ECDLP instance (G,P,Q=Ppub) to C, from which it tries to compute s from Ppub.Step 2.
A I executes Oracle queries within limited query times, then C will answer AI as the following rules.
(i) Hash-Queries. C answers AI when he/she executes Oracle queries as follows.
(a) h 1 - Q u e r y. As AI executes this query with (ID, X), C looks for (ID, X) in list Lh1. If Lh1 has the entry, C returns τh1 to AI. Otherwise, C chooses τh1,x,T at random and sets τh1←h1(u·Q,X,T). Finally C returns τh1 to AI.
(b) h 2 - Q u e r y. As AI executes this query with (ID), C looks for (ID) in list Lα. If Lα has the entry, C returns τα to AI. Otherwise, C chooses w∈Zq∗ at random and computes Y=wP and sets τα←h2(ID,Y,X,T). Then C returns τα to AI.
(c) h 3 - Q u e r y. As AI executes this query with (ID, M), C looks for (ID, M) in sign list Ls. If Ls has the entry, C returns τu to AI. Otherwise, C chooses d∈Zq∗ at random, computes D=dP, and sets τu←h3(m, PID, X, T, Y, D, t), where PID, X, T, and Y can be obtained from other h queries and create-user query. Then C returns τu to AI.
(ii) C r e a t e - U s e r ( I D ). As AI executes this query with (ID), C looks for (ID) in user list Lu. If Lu has an entry with ID, C returns XID to AI. Otherwise, C randomly selects xID,wID,h1ID∈Zq∗ and computes PID=ID⊕h1ID, PKID=wID·P+α·Q, and yID=⊥. Next, C adds {ID,xID,wID,YID,XID,PKID} to the corresponding list Lu,Lh1,Lh2.
(iii) R e p l a c e - P u b l i c - K e y ( I D ). As AI executes this query with (ID), C chooses x∈Zq∗ at random and computes X=x·P, Finally, C adds (x,X) in Lu and sends (x,X) to AI. As for y, C returns ⊥.
(iv) E x t r a c t - S e c r e t - V a l u e ( I D ). As AI executes this query with (ID), C looks for user list Lu. If Lu has the entry, C returns x to AI.
(v) E x t r a c t - P a r t i a l - K e y ( I D ). As AI executes this query with (ID), C looks for user list Lu. If ID=IDo, C sends ⊥ to AI. Else if Lu has the entry with ID, C sends PK to AI, else C runs Create-User(ID) query and sends PK to AI.
(vi) S i g n ( I D , M ). As AI executes this query with (ID, M), C looks for tuple (ID) in Lu. If ID≠IDo, C randomly selects d∈Zq∗, computes D=dP, u=h3(M,PID,X,T,Y,D,t), and σ=x+y+u·dmod⁡q, and then adds d,D,u in Ls. If ID=IDo, C selects α,d,u∈Zq∗ at randomly and computes D=dP, X=σ·P-Y-uα·Q-u·D and then adds d,D to Ls. At last, C returns (σ,D) to AI.Step 3.
Finally,C obtains a forged message (ID,M,D,σ) under certain restrictions that the AI never makes Extract-Partial-key query with ID and Sign query with (ID,M). If ID≠IDo, C stops the game. Otherwise, C looks for the corresponding entry in Lh2,Lu,Ls. If there is not the corresponding σ, it stops the game. Otherwise, σ meets the following equation:(5)σ·P=X+Y+α·Q+ud·PAI can replay the game based on forgery lemma [45]; he/her could obtain another forged message (ID,M,D∗,σ∗) by selecting another σ∗,α∗,d∗.(6)σ∗·P=X+Y+α∗·Q+u∗d∗·P
According to (5) and (6), C could obtain the s=(σ-σ∗)-(ud-u∗d∗)/α-α∗mod⁡q; i.e., C could solve the ECDLP problem. Next, the probability of C which obtains the correct solution for (P,Q=sP) is analyzed. If C has done successfully, two events must happen.(i)
Ev1: never stop the game.(ii)
Ev2: σ is valid.
Therefore, the advantage ofC is ε1=Pr[Ev1∩Ev2]= Pr[Ev1]  Pr[Ev2∣Ev1]. The occurrence probability of Ev1 could be gained in Create-user, Extract-Partial-key, and Sign Oracle query during the game. Therefore, it can obtain Pr[Ev1]≥(1-qh1/q)qc(1-1/qc)qe(1-qh2/q)(1-qh3/q)q)1/qc. Therefore, we can get ε1≥(1-qh1/q)qc(1-1/qc)qe(1-qh2/q)(1-qh3/q)1/qcε.Theorem 3.
AssumeAII is a PPT super type-II adversary who can succeed in Game-II with nonnegligible probability. Let C be a challenger who can solve the ECDLP problem with advantage ε2≥(1-qh1/q)qc(1-1/qc)qr(1-1/qc)qx(1-qh2/q)(1-qh3/q)1/qcε, where qh1,qh2,qh3,qc,qr,qx denote the times of executing h1,h2,h3, Create-User, Replace-Public-Key, and Extract-Secret-Value Oracle query, respectively.Proof.
AssumeAII is a type-II adversary, and AII attempts to forge target client IDo’s valid message. Then AII could win Game-II with probability ε. Given an ECDLP instance (G,P,Q=xo·P), let C be a challenger. Next, C runs AII as a subroutine to solve ECDLP problem.Step 1.
C executes system initialization and public parameters and s to AII. Assume (G,P,Q=xo·P) is given an ECDLP instance; C tries to compute xo from Q.Step 2.
A I I executes Oracle queries within limited query times, then C will answer AII as the following rules.(i) Hash-Queries. C answers AII when he/she executes Oracle queries as follows.(a) h 1 - Q u e r y. As AII executes the query with (ID, X), C looks for (ID, X) in list Lh1. If Lh1 has the entry, C returns τh1 to AII. Otherwise, C chooses τh1,w∈Zq∗ at random and computes Y=wP and sets τh1←h1(s·X,T,Y). Finally C returns τh1 to AII.(b) h 2 - Q u e r y and h 3 - Q u e r y. As AII executes the two queries, C could answer AII as he/she answers AI in Game I.(ii) C r e a t e - U s e r ( I D ). As AII executes the query with (ID), C looks for user list Lu. If Lu has the entry, C returns TKID. Otherwise, if ID=IDo, C chooses w∈Z∗q and X∈G at random and current time T, calculates Y=w·P, PID=ID⊕h1(α·X,T,Y), α=h2(PID,X,Y,T), and y=w+sαmod⁡q, and sets x=⊥. Then, C will add (ID,u,y,x,α) to list Lu,Lh2, respectively. If ID≠IDo, C chooses u,x∈Z∗q at random and current time T and calculates U=u·P, PID=ID⊕h1(αu·P,T), α=h2(PID,X,Y,T), y=w+αsmod⁡q, and X=x·P. Then, C will add (ID,x,w,y,X,Y,α) to corresponding list Lu,Lh2, respectively.(iii) R e p l a c e - P u b l i c - K e y ( I D ). As AII executes the query with (ID), C will answer AII as the following two cases: if ID≠IDo, C will answer AII with the definition of Partial Key Generation and Private key Generation algorithm. If ID=IDo, C chooses w∈Zq∗ and X∈G at random. Next C calculates Y=w·P, PID=ID⊕h1(sX,T,Y), α=h2(PID,X,Y,T), and y=w+sαmod⁡q and sets x=⊥. Finally, C sends (Y,X) to AII.(iv) E x t r a c t - S e c r e t - V a l u e ( I D ). As AII executes the query with (ID), C looks for it in user list Lu. If Lu has the entry with ID, C sends x to AII. Or, if ID≠IDo, C chooses x∈RZq∗ at random and adds it to Lu as ID’s secret value. Next C sends x to AII. If ID=IDo, C returns ⊥.(v) E x t r a c t - P a r t i a l - K e y ( I D ). As AII executes the query with (ID), C looks for it in Lu. If Lu has the entry with ID, C sends y to AII. Otherwise, C will execute Create-User(ID) query and then sends y to AII.(vi) S i g n ( I D , m ). As AII executes the query with (ID, M), C looks for it in Lu. If ID≠IDo, C chooses d∈Zq∗ at random and current time t and then calculates D=d·P, u=h3(M,PID,X,T,Y,D,t), and σ=x+y+dumod⁡q. Next C adds d,D,σ in Ls and sends (D,σ) to AII. If ID=IDo, C chooses d∈Zq∗ at random and calculates D=d·Q, u=h3(M,PID,X,T,Y,D,t), and σ=x+y+dumod⁡q and then adds σ,D to Ls. At last, C returns (σ) to AII.Step 3.
At last,AII obtains a forged message (ID,M,D,σ) under the constrain restrictions that AII never makes Extract-Partial-Key query with ID and Sign query with (ID,M). If ID≠IDo, C stops the game. Otherwise, C looks for the corresponding entry in Lh2,Lu,Ls. If there is not corresponding σ, C stops the game or σ meets the following authentication equation:(7)σ·P=Q+Y+α·Ppub+ud·QAII can replay the game based on forgery lemma [45]; he/she could obtain another forged messages (ID,M,D∗,σ∗) by selecting another u∗,d∗.(8)σ∗·P=Q+Y+α·Ppub+u∗d∗·Q
According to (7) and (8), C could obtain the xo=(σ-σ∗)/(ud-u∗d∗)mod⁡q; i.e., C could solve the ECDLP problem. Next, the probability that C gains the correct solution for the instance (P,Q=Xo=xo·P) is analyzed. If C has been successful, two events must happen.(i)
Ev1: never abort the game.(ii)
EV2: σ is valid.
Therefore,C’s advantage is ε1=Pr[Ev1∩Ev2]= Pr[Ev1]  Pr[Ev2∣Ev1]. The probability of Ev1’s occurrence can be gained in Create-user, Extract-Partial-key, and Sign Oracle query during the game. Therefore, it can obtain Pr[Ev1]≥(1-qh1/q)qc(1-1/qc)qr(1-1/qc)qx(1-qh2/q)(1-qh3/q)1/qc. Therefore, we can get ε2≥(1-qh1/q)qc(1-1/qc)qr(1-1/qc)qx(1-qh2/q)(1-qh3/q)1/qcε.Now, we can draw a conclusion that CapCP can resist two-level adversary on the condition of the ECDLP assumption which is established.


## 7.2. Other Security Analyses

Next, we will analyze whether CapCP meets the security requirements of WBANs.(i) Anonymity. In CasCP, a client’s real identity is embedded his/her pseudo identity PIDi=RIDi⊕h1(sXi,Ti,Yi). PIDi is generated by KGC, any adversaries cannot retrieve the real identity from PIDi because sXi=sxiP, Xi=xiP, and Ppub=sP make up a classic CDH problem. Therefore CapCP provides anonymity for clients.(ii) Mutual Authentication. After receiving a message {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} from a client, AP checks the validity and integrity of the message according to individual authentication equation. If it holds, the message can be regarded as a valid message. The AP signs and returns reply message in the same way to the client, the AP can also be securely authenticated. Therefore, CasCP can satisfy mutual authentication for WBANs.(iii) Traceability. The clients’ real identities are embedded in PID by PIDi=RIDi⊕h1(sXi,Ti,Yi). KGC is the only authenticated one that can retrieve the real identity from PIDi because only KGC knows the system secret key s. Therefore, CasCP provides identity traceability for KGC.(iv) Modification Attack. Assume a forged message {Mi,PIDi,Xi,Ti,Yi∗,Di∗,ti∗,σi∗} is modified from a valid message {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} by an adversary, the verifier could easily distinguish the forged message {Mi,PIDi,Xi,Ti,Yi∗,Di∗,ti∗,σi∗} because the forged message cannot meet the authentication equation σiP=Xi+Yi+αiPpub+uiDi. Therefore, CasCP is secure against modification attack.(v) Session Key Establishment. In CasCP, the client and AP have a session key as K=di(BA+H0(IDA)Ppub). From the definition of K, K=dibAP, Di=diP, and PKA=bAP are CDH problem instance. An adversary cannot compute a valid session key because of ECDLP assumption’s hardness. Therefore, CasCP can achieve secure session key establishment.(vi) Impersonation Attack. To impersonate a client, an adversary must generate a valid message {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} to meet the authentication equation σiP=Xi+Yi+αiPpub+uiDi. But the adversary cannot generate the valid a valid message according to Theorems 2 and 3. Therefore, CasCP is secure against impersonation attack.(vii) Replay Attack. An adversary replays an old message {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} by new time ti in {Mi,PIDi,Xi,Ti,Yi,Di,ti∗,σi}. However, AP can find that this message is invalid by verification equation σiP=Xi+Yi+αiPpub+uiDi according to the ECDLP assumption’s hardness. That is CasCP can be secure against replay attack.(viii) Batch Authentication Attack. When an invalid message or more messages join in batch authentication process, CasCP uses a small random integer vector to break the inherent relationship among of the signatures of messages. Therefore, an adversary cannot use the invalid or forged messages to launch batch authentication attack.(ix) Lost PDA Attack. To use PDA, the correct RIDi and PWi must be input into PDA. However, the adversary cannot login the PDA without knowing RIDi and PWi, even if the adversary has breached PDA and has got the data in PDA. However, the data is nothing useful for the adversary.


## 8. Performance Analysis

In this section, the performance analysis of computation and communication cost is presented among four authentication schemes for WBANs that are the proposed scheme (CapCP), Jiet al.’s scheme [8] (2018), Heet al.’s scheme [7] (2017), and Wuet al.’s scheme [46] (2016).It is important to be fair and objective for performance analysis. Therefore, we adopt the simulation results of cryptographic operation execution time in [8]. Their simulation environments are set as follows: operation system is Windows 8, hardware is formed with 2.50 CHz Intel Core i5-2450 CPU, memory is 8.00 GB, and PBC (pairing based cryptography) is used to run the related cryptographic operations. Table 3 lists the execution times of main time-consuming cryptographic operations; the other cryptographic operations, such as point addition operation and one-way hash function which are much less than scalar multiplication, are not included in the comparison.Table 3
The execution time of cryptographic operations.
Operation Abbreviations Execute time Scalar multiplication T m 2.576  Exponentiation operation T e 3.857  Bilinear pairing operation T p 4.163


### 8.1. Computation Cost Analysis

Next, the proposed CasCP is compared with three authentication schemes for WBANs in terms of computation cost in the client’s message signing phase, AP’s individual authentication phase, and AP’s batch authentication phase.In Wuet al.’s scheme, the computation cost of the client in message signing phase comprises three scalar multiplication and two exponentiation operations; the computation cost of the AP in individual authentication phase comprises three scalar multiplication, two exponentiation operations, and one bilinear pairing operation; the n messages computation cost of the AP in batch authentication phase comprises 3n scalar multiplication, 2n exponentiation operation, and n bilinear pairing operations.In Heet al.’s scheme, the computation cost of the client in message signing phase comprises four scalar multiplication operations; the computation cost of the AP in individual authentication phase comprises four scalar multiplications and one bilinear pairing operations; the n messages computation cost of the AP in batch authentication phase comprises 4n scalar multiplication and n bilinear pairing operations.In Jiet al.’s scheme, the computation cost of the client in message signing phase comprises three scalar multiplication operations; the computation cost of the AP in the individual authentication phase comprises four scalar multiplications; the n messages computation cost of the AP in batch authentication phase comprises n+3 scalar multiplication operations.The proposed CasCP scheme adds a random small integer vector in batch authentication to increase its security. But the increased computational overhead is small; therefore it will not be considered in the computation cost comparison. That is, CasCP’s computation costs in different phase can be considered to be the same as Jiet al.’s scheme. Here it is not presented; please refer to the previous analysis for Jiet al.’s scheme.On the results of Table3, the total execution time of the three phases in the four schemes is drawn, shown in Table 4.Table 4
The computation cost comparison of the four schemes.
message signing phase (client) individual authentication phase (AP) Wu’s Scheme 2 T e + 3 T m ≈ 15.442 m s 1 T p + 3 T m + 2 T e ≈ 19.604  He’s Scheme 4 T m ≈ 10.304 m s 1Tp+4Tm≈14.446ms  Ji’s Scheme 3 T m ≈ 7.728 m s 3 T m ≈ 7.728 m s  CasCP 3 T m ≈ 7.728 m s 3 T m ≈ 7.728 m sThe computation cost times of the client in message signing phase of CasCP and Jiet al.’ scheme are 7.728 ms, which decrease by 49% and 25% when compared with the corresponding computation time of Wuet al.’s scheme and Heet al.’ scheme. The computation cost time of AP in individual authentication phase is 7.728 ms, which decreases by 60% and 46% when compared with the corresponding computation time of Wuet al.’s scheme and Heet al.’ scheme. The more intuitive computation cost comparison of the two phases in the four schemes is shown in Figure 4.Figure 4
The computation costs of the two phases in the four schemes.The computation cost comparisons of AP in batch authentication phase (assumen=30 messages) are illustrated in Figure 5. As shown in Figure 5, our proposed CasCP and Jiet al.’ scheme take an advantage on computation cost than Wuet al.’s scheme and Heet al.’s scheme.Figure 5
The computation costs of the four schemes for 30 messages in batch authentication phase.According to the former computation cost analysis in batch authentication phase, the proposed CasCP and Jiet al.’s scheme have a clear advantage than the other two schemes. Figure 6 depicts the computation costs in batch authentication phase for the different number of messages of the four schemes. Therefore, CasCP and Jiet al.’s scheme are more efficient than Wuet al.’s scheme and Heet al.’s scheme regardless of the number of messages.Figure 6
The computation costs of the four schemes for different number of messages in batch authentication.In summary, compared with Wuet al.’s scheme and Heet al.’s scheme, CasCP and Jiet al.’s scheme have lower computation cost in message signing phase, individual authentication phase, and batch authentication phase.


### 8.2. Communication Cost Comparison

In the subsection, we analyze the communication cost of the proposed CasCP and the three authentication schemes for WBANs in this subsection.According to the definitions of the above cryptographic operations, we assume that the size ofp is 20 bytes, the element in G is 40 bytes, and the size of other communication elements in P is 20 bytes. For simplicity, message Mi is not included in the comparison.In Wuet al.’s scheme, the message sent by a client to AP consists of {IDc,Vi,authc,tc}; the message sent by a client to AP consists of {RAP,authAP,tAP}. The messages include four elements in G, i.e., (IDc,Vi,RAP∈G, 40×3 bytes), and four elements in P, i.e., (ti,authc,TAP,autheAP, 20×4 bytes); the total size of one communication round is 200 bytes.In Heet al.’s scheme, the message sent by a client to AP consists of {QIDi,Ti,ti}; the message sent by a client to AP comprises {Y,auths}. The messages have four elements in G, i.e., (QIDi,Ti,Y∈G, 40×3 bytes), and two elements in P, i.e., (ti,auths, 20×2 bytes); the total size of one communication round is 200 bytes.In Jiet al.’s scheme, the message sent by a client to AP consists of {Mi,PIDi={PIDi,1,PIDi,2,Xi},Ti,Yi,Di,ti,σi}, which has four elements in G, i.e., (PIDi,1,Xi,Yi,Di∈G, 40×4 bytes), and four elements in P, i.e., (ti,PIDi,2,Ti,σi, 20×4 bytes). The message sent by a client to AP consists of {MACK(BA)}. Therefore, the total size of one communication round is 240 bytes.In CasCP, the message sent by a client to AP consists of{Mi,PIDi,Xi,Ti,Yi,Di,ti,σi}, which has three elements in G, i.e., (Xi,Yi,Di∈G, 40×3 bytes), and four elements in P, i.e., (ti,PIDi,Ti,σi, 20×4 bytes). The message sent by a client to AP consists of {MACK(BA)}; the size of {MACK(BA)} is defined as 20 bytes. Therefore, the total size of one communication round is 200 bytes.The communication cost comparison results of one communication round between a client and AP are shown in Table5. Compared with Wuet al.’s scheme and Heet al.’s scheme, CasCP has no advantage because the two schemes decrease communication cost by encrypting data. Tip, the encrypted data must be more than 20 bytes that we assumed. Compared with Jiet al.’s scheme, CasCP scheme’s communication cost has decreased by 15.4%.Table 5
The comparison of communication cost.
Client-AP Component Size Wuet al.’s scheme Client→ AP   {IDc,Vi,authc,tc} 200 bytes AP→ Client   {RAP,authAP,tAP}  Heet al.’s scheme Client→ AP   {QIDi,Ti,ti} 180 bytes AP→ Client   {Y,auths}  Jiet al.’s scheme Client→ AP   {Mi,PIDi={PIDi,1,PIDi,2,Xi},Ti,Yi,Di,ti,σi} 240 bytes AP → Client{MACK(BA)}  CapCP Client→ AP   {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} 200 bytes AP→ Client   {MACK(BA)} Tip:Mi is excluded in comparison.Overall, CasCP scheme needs less computation cost than Wuet al.’s scheme and Heet al.’s scheme. CasCP incurs less communication cost than Jiet al.’s scheme under the premise of solving the security deficiencies of Jiet al.’s scheme, providing conditional privacy-preserving and batch authentication.


## 8.1. Computation Cost Analysis

Next, the proposed CasCP is compared with three authentication schemes for WBANs in terms of computation cost in the client’s message signing phase, AP’s individual authentication phase, and AP’s batch authentication phase.In Wuet al.’s scheme, the computation cost of the client in message signing phase comprises three scalar multiplication and two exponentiation operations; the computation cost of the AP in individual authentication phase comprises three scalar multiplication, two exponentiation operations, and one bilinear pairing operation; the n messages computation cost of the AP in batch authentication phase comprises 3n scalar multiplication, 2n exponentiation operation, and n bilinear pairing operations.In Heet al.’s scheme, the computation cost of the client in message signing phase comprises four scalar multiplication operations; the computation cost of the AP in individual authentication phase comprises four scalar multiplications and one bilinear pairing operations; the n messages computation cost of the AP in batch authentication phase comprises 4n scalar multiplication and n bilinear pairing operations.In Jiet al.’s scheme, the computation cost of the client in message signing phase comprises three scalar multiplication operations; the computation cost of the AP in the individual authentication phase comprises four scalar multiplications; the n messages computation cost of the AP in batch authentication phase comprises n+3 scalar multiplication operations.The proposed CasCP scheme adds a random small integer vector in batch authentication to increase its security. But the increased computational overhead is small; therefore it will not be considered in the computation cost comparison. That is, CasCP’s computation costs in different phase can be considered to be the same as Jiet al.’s scheme. Here it is not presented; please refer to the previous analysis for Jiet al.’s scheme.On the results of Table3, the total execution time of the three phases in the four schemes is drawn, shown in Table 4.Table 4
The computation cost comparison of the four schemes.
message signing phase (client) individual authentication phase (AP) Wu’s Scheme 2 T e + 3 T m ≈ 15.442 m s 1 T p + 3 T m + 2 T e ≈ 19.604  He’s Scheme 4 T m ≈ 10.304 m s 1Tp+4Tm≈14.446ms  Ji’s Scheme 3 T m ≈ 7.728 m s 3 T m ≈ 7.728 m s  CasCP 3 T m ≈ 7.728 m s 3 T m ≈ 7.728 m sThe computation cost times of the client in message signing phase of CasCP and Jiet al.’ scheme are 7.728 ms, which decrease by 49% and 25% when compared with the corresponding computation time of Wuet al.’s scheme and Heet al.’ scheme. The computation cost time of AP in individual authentication phase is 7.728 ms, which decreases by 60% and 46% when compared with the corresponding computation time of Wuet al.’s scheme and Heet al.’ scheme. The more intuitive computation cost comparison of the two phases in the four schemes is shown in Figure 4.Figure 4
The computation costs of the two phases in the four schemes.The computation cost comparisons of AP in batch authentication phase (assumen=30 messages) are illustrated in Figure 5. As shown in Figure 5, our proposed CasCP and Jiet al.’ scheme take an advantage on computation cost than Wuet al.’s scheme and Heet al.’s scheme.Figure 5
The computation costs of the four schemes for 30 messages in batch authentication phase.According to the former computation cost analysis in batch authentication phase, the proposed CasCP and Jiet al.’s scheme have a clear advantage than the other two schemes. Figure 6 depicts the computation costs in batch authentication phase for the different number of messages of the four schemes. Therefore, CasCP and Jiet al.’s scheme are more efficient than Wuet al.’s scheme and Heet al.’s scheme regardless of the number of messages.Figure 6
The computation costs of the four schemes for different number of messages in batch authentication.In summary, compared with Wuet al.’s scheme and Heet al.’s scheme, CasCP and Jiet al.’s scheme have lower computation cost in message signing phase, individual authentication phase, and batch authentication phase.


## 8.2. Communication Cost Comparison

In the subsection, we analyze the communication cost of the proposed CasCP and the three authentication schemes for WBANs in this subsection.According to the definitions of the above cryptographic operations, we assume that the size ofp is 20 bytes, the element in G is 40 bytes, and the size of other communication elements in P is 20 bytes. For simplicity, message Mi is not included in the comparison.In Wuet al.’s scheme, the message sent by a client to AP consists of {IDc,Vi,authc,tc}; the message sent by a client to AP consists of {RAP,authAP,tAP}. The messages include four elements in G, i.e., (IDc,Vi,RAP∈G, 40×3 bytes), and four elements in P, i.e., (ti,authc,TAP,autheAP, 20×4 bytes); the total size of one communication round is 200 bytes.In Heet al.’s scheme, the message sent by a client to AP consists of {QIDi,Ti,ti}; the message sent by a client to AP comprises {Y,auths}. The messages have four elements in G, i.e., (QIDi,Ti,Y∈G, 40×3 bytes), and two elements in P, i.e., (ti,auths, 20×2 bytes); the total size of one communication round is 200 bytes.In Jiet al.’s scheme, the message sent by a client to AP consists of {Mi,PIDi={PIDi,1,PIDi,2,Xi},Ti,Yi,Di,ti,σi}, which has four elements in G, i.e., (PIDi,1,Xi,Yi,Di∈G, 40×4 bytes), and four elements in P, i.e., (ti,PIDi,2,Ti,σi, 20×4 bytes). The message sent by a client to AP consists of {MACK(BA)}. Therefore, the total size of one communication round is 240 bytes.In CasCP, the message sent by a client to AP consists of{Mi,PIDi,Xi,Ti,Yi,Di,ti,σi}, which has three elements in G, i.e., (Xi,Yi,Di∈G, 40×3 bytes), and four elements in P, i.e., (ti,PIDi,Ti,σi, 20×4 bytes). The message sent by a client to AP consists of {MACK(BA)}; the size of {MACK(BA)} is defined as 20 bytes. Therefore, the total size of one communication round is 200 bytes.The communication cost comparison results of one communication round between a client and AP are shown in Table5. Compared with Wuet al.’s scheme and Heet al.’s scheme, CasCP has no advantage because the two schemes decrease communication cost by encrypting data. Tip, the encrypted data must be more than 20 bytes that we assumed. Compared with Jiet al.’s scheme, CasCP scheme’s communication cost has decreased by 15.4%.Table 5
The comparison of communication cost.
Client-AP Component Size Wuet al.’s scheme Client→ AP   {IDc,Vi,authc,tc} 200 bytes AP→ Client   {RAP,authAP,tAP}  Heet al.’s scheme Client→ AP   {QIDi,Ti,ti} 180 bytes AP→ Client   {Y,auths}  Jiet al.’s scheme Client→ AP   {Mi,PIDi={PIDi,1,PIDi,2,Xi},Ti,Yi,Di,ti,σi} 240 bytes AP → Client{MACK(BA)}  CapCP Client→ AP   {Mi,PIDi,Xi,Ti,Yi,Di,ti,σi} 200 bytes AP→ Client   {MACK(BA)} Tip:Mi is excluded in comparison.Overall, CasCP scheme needs less computation cost than Wuet al.’s scheme and Heet al.’s scheme. CasCP incurs less communication cost than Jiet al.’s scheme under the premise of solving the security deficiencies of Jiet al.’s scheme, providing conditional privacy-preserving and batch authentication.


## 9. Conclusion and Future Work

To provide privacy protection, Jiet al. proposed a certificateless authentication scheme for WBANs. However, the security analysis in this paper demonstrates that their scheme cannot be secure against forgery attack and batch authentication attack. To solve the deficiencies, an improved certificateless authentication scheme with conditional privacy-preserving (called CasCP) constructs signature with ECC, without any bilinear pairing operation. CasCP also provides batch authentication function and conditional privacy-preserving. A rigid security proof and analysis prove that CasCP is secure against different level adversary’s attacks, such as adversary AI and adversary AII. Compared with similar authentication scheme, CasCP has some advantages in computation and communication cost. Therefore, the proposed CasCP is more suitable for the WBANs.Although CasCP is efficient and more secure than similar recent proposed schemes, more efficient authentication scheme is more favored, especially lightweight authentication scheme. Therefore, our next work is to study a secure lightweight authentication scheme with batch verification function for WBANs.



---

*Source: 5860286-2019-06-04.xml*