# Improved Secure and Lightweight Authentication Scheme for Next-Generation IoT Infrastructure

Authors: Chien-Ming Chen; Shuangshuang Liu
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The Internet of Things (IoT) is a huge network formed by connecting various information sensing devices through the Internet. Although IoT has been popularized in many fields, connected devices can be used only when network security is guaranteed. Recently, Rana et al. proposed a secure and lightweight authentication protocol for the next-generation IoT infrastructure. They claim that their protocol can resist major security attacks. However, in this study, we prove that their protocol is still vulnerable to offline password guessing attacks and privilege internal attacks. In order to solve these shortcomings, we propose an improved protocol, which is proved to be secure by formal and informal analysis. In addition, after comparing the time and memory consumption with other protocols, we find that our protocol has more advantages.


---

## Body

## 1. Introduction

In recent years, the Internet of Things (IoT) [1–4] has become popular in our everyday life. IoT refers to the real-time collection of any information that needs to be monitored, connected, and interacted with through the use of various devices and technologies such as sensors, radio frequency identification technology, global positioning system, and laser scanners. In the IoT environment, every object (virtual or physical) can be perceived, identified, accessed, and interconnected in a dynamic, ubiquitous network through the Internet. IoT brings great convenience to our lives. Vehicular ad hoc networks [5, 6] are considered to be one of the most promising applications of IoT. They allow people, vehicles, and roadside units to cooperate closely. IoT is also applied to medical healthcare, which is also closely related to our lives. Through the use of IoT, medical healthcare environments have taken on a new look. In an IoT-enabled healthcare system [7–9], wearable sensors can be used to collect information about patients and the surrounding environment. Another example of an IoT application is the smart home [10, 11]. Smart homes improve people’s lifestyles and make them more comfortable, safer, and more efficient. In addition, the cloud system based on IoT can help the national government manage some resources to a great extent. The management data through the cloud system greatly reduces human resources and greatly improves the utilization rate of resources. These advantages are mainly based on the principle of the cloud-based Internet of Things. The application of such technology supports legitimate users to access normal data from hospitals, homes, borders, and other areas, which can better manage data to a certain extent.Because IoT has grown so seamlessly, many end users are ignorant of the existence of these devices. Due to their invisibility, IoT device security is crucial, yet challenging to manage. Several IoT networks have recently been taken over to carry out malicious attacks. For these reasons, addressing these IoT security challenges is critical to their successful development. However, there has been a significant expansion in the number of IoT devices. Designing security mechanisms for all of these devices is complicated due to the heterogeneity and complexity of IoT networks.For an IoT network to be secure, all the entities (servers, end users, and devices) must mutually authenticate their identities. In addition, all communication should be encrypted to maintain data confidentiality. This means that a common session key for both sides of the communication is required. Therefore, designing a secure and efficient authenticated key agreement (AKA) scheme is crucial [12–15].Various AKA schemes for IoT have been proposed. In 2004, Kumari et al. [16] found that Chang et al.’s scheme [17] is vulnerable to offline password-guessing attacks, internal attacks, and server masquerading attacks. They also pointed out that the protocol [17] has security vulnerabilities during the password update phase. To overcome these security weaknesses, Kumari et al. designed an improved scheme. Kumari et al. claimed that their scheme is more secure, more efficient, and more suitable for real-life IoT network use. However, Kaul and Awasthi [18] discovered that Kumari et al.’s protocol [16] is still vulnerable to some attacks. In their scheme, attackers can easily capture some security parameters transmitted on a public channel and then calculate the session key. In response to this, Kaul and Awasthi [18] proposed a robust and secure user authentication protocol based on resource-friendly symmetric cryptographic primitives. Unfortunately, Rana et al. [19] proved that the protocol [18] cannot resist various types of attacks. Therefore, they proposed a secure, lightweight AKA scheme for next-generation IoT infrastructure.In this study, however, we found that Rana et al.’s scheme [19] is still vulnerable to offline password-guessing attacks and privileged-insider attacks. In their scheme [19], an illegal insider or malicious attacker can calculate the session key or guess passwords if they can capture a user’s smart card. Therefore, we propose a new AKA scheme. In the proposed scheme, we utilize the biological information of the users because it is difficult for attackers to obtain this information. To demonstrate that the proposed scheme is indeed secure, we analyze it using Burrows–Abadi–Needham (BAN) logic [20] and also show that it is secure against various types of attacks. Compared with the previous scheme, the proposed scheme has better performance in terms of memory overhead.The remainder of this paper is organized as follows. In Section2, we briefly review the scheme proposed by Rana et al. [19]. Section 3 demonstrates that Rana et al.’s scheme [19] is vulnerable to offline password-guessing attacks and privileged-insider attacks. Our proposed scheme is described in Section 4. Sections 5 and 6 provide security and performance analyses and comparisons. Finally, Section 7 concludes the paper.


## 2. Review of Rana et al.’s Scheme

In this section, we briefly review Rana et al.’s AKA scheme. Their scheme contains three phases: user registration, login, and authentication, and the steps of their scheme are described below. Notations used in this paper are listed in Table1.Table 1
Notations used in the proposed scheme.
NotationsDescriptionsUccth legal userIDccth user identitySLegal serverPWccth user passworda,bPrivate key and number of serverycArbitrary number forUcSCcUser’s smart cardT1Time stamp obtained at user’s sideT2Server’s current time stampT′Threshold valueδTcTime of transmission delay⊕XOR operator∥Concatenation operatorh⋅Noncollision hash functionSKSession keyAThe attackerRiBiometric ofUcdsLong-term key⇒Private communication channel⟶Public communication channel


### 2.1. User Registration Phase

(1)
First, the userUc selects their own identification IDc, password PWc, and an arbitrary number b. Then, the following is calculated:(1)RPWc=hm∥PWc,andIDc,RPWc is transmitted to the server through a secure channel.(2)
After the server receives the information from the user, it selects an arbitrary numberyc and calculates(2)DIDc=EncdsIDc∥yc,αc=hIDc⊕a∥b,βc=αc⊕hIDc⊕RPWc,γc=yc⊕hαc⊕RPWc,χc=hIDc∥RPWc∥yc∥αc.(3)
Then, the server stores the parametersβc,γc,χc,DIDc,h⋅ in the smart card memory and sends them to the user Uc through a secure channel.(4)
Finally, the user calculates(3)ηc=hIDc⊕PWc∥m,and storesηc in the smart card. Now, the smart card contains parameters βc,γc,χc,ηc,DIDc,h⋅.


### 2.2. Login Phase

When a registered user wants to log in to the system, they perform the following operations:(1)
UserUc enters their IDc′ and PWc′ and inserts the smart card(2)
The smart card reader extracts parametersm=ηc⊕hIDc′⊕PWc′ and RPWc′=hm∥PWc′(3)
Further, the smart card reader can extract parametersαc′=βc⊕hIDc′⊕RPWc′ and yc′=γc⊕hαc′⊕RPWc′ and calculate(4)χc′=hIDc′∥RPWc′∥yc′∥αc′.Ifχc′=χc, it means that the legitimate user is allowed to log in; otherwise, the login is refused(4)
After verifying the legitimacy of the user, the reader calculates(5)ωc=yc⊕IDc′⊕αc′⊕hIDc′⊕αc′⊕T1,νc=hIDc′∥αc′∥yc∥αc′⊕yc∥T1.The reader then sends the login requestDIDc,ωc,νc,T1 to the server through a secure channel.


### 2.3. Authentication Phase

In this phase, the smart card reader and server authenticate each other by performing the following steps:(1)
S first verifies the validity of the timestamp by calculating T2-T1. If the calculated value is less than the given threshold δT, the login request proceeds; otherwise, it is rejected.(2)
After that,S extracts and calculates IDc′ using IDc′∥yc = DecdsDIDc and then calculates the values:(6)αc′=hIDc′⊕a∥b,yc′=ωc′⊕IDc′⊕αc′⊕hIDc′⊕αc′⊕T1,νc′=hIDc′∥αc′∥yc′∥αc′⊕yc′∥T1.Then,S verifies the validity of the login by comparing the calculated νc′ with the stored νc. If the two are equal, the verification passes; otherwise, the verification fails and the server refuses to accept the login request.(3)
After verifying the correctness ofνc, the server continues to calculatez(7)μc=hIDc′∥yc′∥αc′⊕yc′∥T2.Then,S sends the calculated μc and timestamp T2 to U.(4)
WhenU receives the information from the server, it first verifies the validity of T2 and then calculates(8)μc′=hIDc∥yc∥αc⊕yc∥T2.U checks whether μc′ is equal to μc. If so, S is successfully verified.(5)
Finally, after mutual verification, the session keySK can be calculated:(9)SK=hIDc⊕αc⊕yc⊕T1⊕T2.


## 2.1. User Registration Phase

(1)
First, the userUc selects their own identification IDc, password PWc, and an arbitrary number b. Then, the following is calculated:(1)RPWc=hm∥PWc,andIDc,RPWc is transmitted to the server through a secure channel.(2)
After the server receives the information from the user, it selects an arbitrary numberyc and calculates(2)DIDc=EncdsIDc∥yc,αc=hIDc⊕a∥b,βc=αc⊕hIDc⊕RPWc,γc=yc⊕hαc⊕RPWc,χc=hIDc∥RPWc∥yc∥αc.(3)
Then, the server stores the parametersβc,γc,χc,DIDc,h⋅ in the smart card memory and sends them to the user Uc through a secure channel.(4)
Finally, the user calculates(3)ηc=hIDc⊕PWc∥m,and storesηc in the smart card. Now, the smart card contains parameters βc,γc,χc,ηc,DIDc,h⋅.


## 2.2. Login Phase

When a registered user wants to log in to the system, they perform the following operations:(1)
UserUc enters their IDc′ and PWc′ and inserts the smart card(2)
The smart card reader extracts parametersm=ηc⊕hIDc′⊕PWc′ and RPWc′=hm∥PWc′(3)
Further, the smart card reader can extract parametersαc′=βc⊕hIDc′⊕RPWc′ and yc′=γc⊕hαc′⊕RPWc′ and calculate(4)χc′=hIDc′∥RPWc′∥yc′∥αc′.Ifχc′=χc, it means that the legitimate user is allowed to log in; otherwise, the login is refused(4)
After verifying the legitimacy of the user, the reader calculates(5)ωc=yc⊕IDc′⊕αc′⊕hIDc′⊕αc′⊕T1,νc=hIDc′∥αc′∥yc∥αc′⊕yc∥T1.The reader then sends the login requestDIDc,ωc,νc,T1 to the server through a secure channel.


## 2.3. Authentication Phase

In this phase, the smart card reader and server authenticate each other by performing the following steps:(1)
S first verifies the validity of the timestamp by calculating T2-T1. If the calculated value is less than the given threshold δT, the login request proceeds; otherwise, it is rejected.(2)
After that,S extracts and calculates IDc′ using IDc′∥yc = DecdsDIDc and then calculates the values:(6)αc′=hIDc′⊕a∥b,yc′=ωc′⊕IDc′⊕αc′⊕hIDc′⊕αc′⊕T1,νc′=hIDc′∥αc′∥yc′∥αc′⊕yc′∥T1.Then,S verifies the validity of the login by comparing the calculated νc′ with the stored νc. If the two are equal, the verification passes; otherwise, the verification fails and the server refuses to accept the login request.(3)
After verifying the correctness ofνc, the server continues to calculatez(7)μc=hIDc′∥yc′∥αc′⊕yc′∥T2.Then,S sends the calculated μc and timestamp T2 to U.(4)
WhenU receives the information from the server, it first verifies the validity of T2 and then calculates(8)μc′=hIDc∥yc∥αc⊕yc∥T2.U checks whether μc′ is equal to μc. If so, S is successfully verified.(5)
Finally, after mutual verification, the session keySK can be calculated:(9)SK=hIDc⊕αc⊕yc⊕T1⊕T2.


## 3. Cryptanalysis of Rana et al.’s Scheme

In this section, we first describe the threat model. Then, we show that Rana et al.’s scheme is insecure against offline password-guessing attacks and privileged-insider attacks.


### 3.1. Threat Model

This threat pattern shows the capabilities of an adversary, which are also considered and discussed in [21, 22]. A′s capabilities are as follows:(1)
A can perform complete access control on the transmission channel. It can block, change, remove, replay, and hinder the messages passed between participants through a public channel.(2)
A can get the information stored in the smart card using power analysis [23, 24].(3)
A can obtain the information in the smart card and the information transmitted by the user on the secure channel during the registration process [25].(4)
A can simultaneously obtain the information in the smart card and perform offline password guessing as stated in [26, 27].(5)
A can know any two of the user’s password, smart card, and biological information.(6)
A can obtain the session key that the user communicated with the server before.(7)
A can register as a legitimate user in a legitimate way.


### 3.2. Offline Password-Guessing Attack

(1)
First, the attackerA steals the smart card and gets the information βcN,γcN,χcN,ηcN(2)
A guesses the user’s IDc and PWc at the same time(3)
According to the user’sIDc, password PWc, and ηc and γc values obtained from the smart card, A calculates(10)m=ηc⊕hIDc⊕PWc,RPWc=hm∥PWc,αc=βc⊕hIDc⊕RPWc,yc=γc⊕hαc⊕RPWc.(4)
Finally,A obtains the session key SK according to the value of αc and yc calculated above:(11)SK=hIDc⊕αc⊕yc⊕T1⊕T2.


### 3.3. Privileged-Insider Attack

(1)
First, the attackerA steals the smart card and gets the information βcN,γcN,χcN,ηcN(2)
Then, privileged insiders can obtain the informationIDC and RPWc of legitimate users during registration(3)
A can calculate the following parameters by using the information βc obtained in the smart card and the information IDC and RPWc obtained during user registration:(12)αc=βc⊕hIDc⊕RPWc,yc=γc⊕hαc⊕RPWc.(4)
Finally, the attacker can calculate the session keySK according to the above parameters:(13)SK=hIDc⊕αc⊕yc⊕T1⊕T2.


## 3.1. Threat Model

This threat pattern shows the capabilities of an adversary, which are also considered and discussed in [21, 22]. A′s capabilities are as follows:(1)
A can perform complete access control on the transmission channel. It can block, change, remove, replay, and hinder the messages passed between participants through a public channel.(2)
A can get the information stored in the smart card using power analysis [23, 24].(3)
A can obtain the information in the smart card and the information transmitted by the user on the secure channel during the registration process [25].(4)
A can simultaneously obtain the information in the smart card and perform offline password guessing as stated in [26, 27].(5)
A can know any two of the user’s password, smart card, and biological information.(6)
A can obtain the session key that the user communicated with the server before.(7)
A can register as a legitimate user in a legitimate way.


## 3.2. Offline Password-Guessing Attack

(1)
First, the attackerA steals the smart card and gets the information βcN,γcN,χcN,ηcN(2)
A guesses the user’s IDc and PWc at the same time(3)
According to the user’sIDc, password PWc, and ηc and γc values obtained from the smart card, A calculates(10)m=ηc⊕hIDc⊕PWc,RPWc=hm∥PWc,αc=βc⊕hIDc⊕RPWc,yc=γc⊕hαc⊕RPWc.(4)
Finally,A obtains the session key SK according to the value of αc and yc calculated above:(11)SK=hIDc⊕αc⊕yc⊕T1⊕T2.


## 3.3. Privileged-Insider Attack

(1)
First, the attackerA steals the smart card and gets the information βcN,γcN,χcN,ηcN(2)
Then, privileged insiders can obtain the informationIDC and RPWc of legitimate users during registration(3)
A can calculate the following parameters by using the information βc obtained in the smart card and the information IDC and RPWc obtained during user registration:(12)αc=βc⊕hIDc⊕RPWc,yc=γc⊕hαc⊕RPWc.(4)
Finally, the attacker can calculate the session keySK according to the above parameters:(13)SK=hIDc⊕αc⊕yc⊕T1⊕T2.


## 4. Proposed Scheme

In this section, we describe the specific process of the protocol and the overall architecture diagram. The main body of the protocol includes users and servers. The agreement consists of four phases: user registration, login, authentication, and password change. Figure1 illustrates the architecture of the proposed protocol. User represents the main participant in the communication, and server represents the entity that communicates with the user.Figure 1
Network architecture.


### 4.1. User Registration Phase

Figure2 illustrates the user registration phase. The detailed steps are as follows:(1)
First,Uc selects their IDc, password PWc, and bio information Ri, as well as an arbitrary number m, to calculate(14)BRPWc=hRi⊕PWc∥m.Then,ds is used to encrypt IDc, with the result:(15)DIDc=EncdsIDc.Uc then transmits DIDc,BRPWc to S through a secure channel.(2)
After receiving the information fromU, S selects an arbitrary number yc to decrypt DIDc, obtains the value of IDc, and then calculates(16)IDc=DecdsDIDc,αc=hIDc⊕a∥b,βc=αc⊕hIDc⊕BRPWc,γc=yc⊕hαc⊕BRPWc,χc=hIDc∥BRPWc∥yc∥αc.(3)
Finally, the calculated parametersβc,γc,χc,DIDc,h⋅ are stored in the smart card, and S sends the smart card to U through a secure channel. U calculates ηc after receiving the message:(17)ηc=Ri⊕m⊕hIDc⊕PWc.Then,ηc is saved in the smart card, and the registration process of the user is complete.Figure 2
User registration phase.


### 4.2. Login Phase

(1)
U enters their own IDc′, PWc′, and bio information Ri.(2)
After inputting the information, calculate(18)m=ηc⊕Ri⊕hIDc′⊕PWc′,BRPWc′=hRi⊕PWc′∥m,αc′=βc⊕hIDc′⊕BRPWc′,yc′=γc⊕hαc′⊕BRPWc′,χc′=hIDc′∥BRPWc′∥yc′∥αc′.Then, verify whetherχc′ and χc are equal. If they are equal, the verification passes; otherwise, the login request sent by U to S is rejected.(3)
If the verification passes, the reader will calculate(19)ωc=yc′⊕hIDc′⊕αc′⊕hIDc′⊕αc′⊕T1,υc=hIDc′∥αc′∥yc′∥αc′⊕yc′∥T1.Then, the login requestDIDc,ωc,υc,T1 is sent to the server.


### 4.3. Authentication Phase

This section describes the process of mutual authentication betweenS and U. After the user sends the login request to the server, the server starts to verify whether U is legitimate by calculating a series of parameters, and U verifies the validity of S by calculating the values of some parameters. The authentication process is described in detail below. The login phase and authentication phase are shown in Figure 3.(1)
AfterS receives the request from U, it first verifies whether the present timestamp is reasonable. It then decrypts DIDc to obtain IDc and calculates(20)αc′=hIDc′⊕a∥b,yc′=ωc′⊕hIDc′⊕αc′⊕IDc′⊕αc′⊕T1,υc′=hIDc′∥αc′∥yc′∥αc′⊕yc′∥T1.S verifies whether υc′ and υc are equal. If not, S rejects the login request from U. If equal, S receives the login request from U and then calculates the session key of both sides:(21)SK=hIDc′⊕αc′⊕yc′⊕T1⊕T2.(2)
After calculating the session key,S continues to calculate(22)μc=hIDc′∥yc′∥αc′⊕yc′∥T2.Then,S passes μc,T2 to U(3)
After receiving the message fromS, the user first verifies the validity of the timestamp T2 and then calculates(23)μc′=hIDc∥yc′∥αc′⊕yc′∥T2.U verifies whether μc′ is equal to μc. If it is equal, U calculates the session key:(24)SK=hIDc⊕αc′⊕yc′⊕T1⊕T2.Here, the authentication process forU and S is completed.Figure 3
Login and authentication phase.


### 4.4. Password Change Phase

IfU wants to change their password PWc to PWcN, the following steps are performed:(1)
U first inserts their own smart card and enters their IDc, current password PWc, bio information Ri, and new password PWcN.(2)
According to some parameter values in the smart card and their own identity information, the following are calculated:(25)m=ηc⊕Ri⊕hIDc′⊕PWc′,BRPWc′=hRi⊕PWc′∥m,αc′=βc⊕hIDc′⊕BRPWc′,yc′=γc⊕hαc′⊕BRPWc′,χc′=hIDc′∥BRPWc′∥yc′∥αc′.If the calculated value ofχc′ is equal to the value of χc stored in the smart card, the user is considered legitimate and allowed to change the password.(3)
Some parameter values need to be updated in the process of password modification. The specific calculation process is as follows:(26)BRPWcN=hRi⊕PWcN∥m,βcN=αc⊕hIDc⊕RPWcN,γcN=yc⊕hαc⊕RPWcN,χcN=hIDc∥RPWcN∥yc∥αc,ηcN=Ri⊕m⊕hIDc⊕PWcN.(4)
Finally, the valuesβc,γc,χc,ηc stored in the smart card are updated to the modified values βcN,γcN,χcN,ηcN, and the process of password modification is completed.


## 4.1. User Registration Phase

Figure2 illustrates the user registration phase. The detailed steps are as follows:(1)
First,Uc selects their IDc, password PWc, and bio information Ri, as well as an arbitrary number m, to calculate(14)BRPWc=hRi⊕PWc∥m.Then,ds is used to encrypt IDc, with the result:(15)DIDc=EncdsIDc.Uc then transmits DIDc,BRPWc to S through a secure channel.(2)
After receiving the information fromU, S selects an arbitrary number yc to decrypt DIDc, obtains the value of IDc, and then calculates(16)IDc=DecdsDIDc,αc=hIDc⊕a∥b,βc=αc⊕hIDc⊕BRPWc,γc=yc⊕hαc⊕BRPWc,χc=hIDc∥BRPWc∥yc∥αc.(3)
Finally, the calculated parametersβc,γc,χc,DIDc,h⋅ are stored in the smart card, and S sends the smart card to U through a secure channel. U calculates ηc after receiving the message:(17)ηc=Ri⊕m⊕hIDc⊕PWc.Then,ηc is saved in the smart card, and the registration process of the user is complete.Figure 2
User registration phase.


## 4.2. Login Phase

(1)
U enters their own IDc′, PWc′, and bio information Ri.(2)
After inputting the information, calculate(18)m=ηc⊕Ri⊕hIDc′⊕PWc′,BRPWc′=hRi⊕PWc′∥m,αc′=βc⊕hIDc′⊕BRPWc′,yc′=γc⊕hαc′⊕BRPWc′,χc′=hIDc′∥BRPWc′∥yc′∥αc′.Then, verify whetherχc′ and χc are equal. If they are equal, the verification passes; otherwise, the login request sent by U to S is rejected.(3)
If the verification passes, the reader will calculate(19)ωc=yc′⊕hIDc′⊕αc′⊕hIDc′⊕αc′⊕T1,υc=hIDc′∥αc′∥yc′∥αc′⊕yc′∥T1.Then, the login requestDIDc,ωc,υc,T1 is sent to the server.


## 4.3. Authentication Phase

This section describes the process of mutual authentication betweenS and U. After the user sends the login request to the server, the server starts to verify whether U is legitimate by calculating a series of parameters, and U verifies the validity of S by calculating the values of some parameters. The authentication process is described in detail below. The login phase and authentication phase are shown in Figure 3.(1)
AfterS receives the request from U, it first verifies whether the present timestamp is reasonable. It then decrypts DIDc to obtain IDc and calculates(20)αc′=hIDc′⊕a∥b,yc′=ωc′⊕hIDc′⊕αc′⊕IDc′⊕αc′⊕T1,υc′=hIDc′∥αc′∥yc′∥αc′⊕yc′∥T1.S verifies whether υc′ and υc are equal. If not, S rejects the login request from U. If equal, S receives the login request from U and then calculates the session key of both sides:(21)SK=hIDc′⊕αc′⊕yc′⊕T1⊕T2.(2)
After calculating the session key,S continues to calculate(22)μc=hIDc′∥yc′∥αc′⊕yc′∥T2.Then,S passes μc,T2 to U(3)
After receiving the message fromS, the user first verifies the validity of the timestamp T2 and then calculates(23)μc′=hIDc∥yc′∥αc′⊕yc′∥T2.U verifies whether μc′ is equal to μc. If it is equal, U calculates the session key:(24)SK=hIDc⊕αc′⊕yc′⊕T1⊕T2.Here, the authentication process forU and S is completed.Figure 3
Login and authentication phase.


## 4.4. Password Change Phase

IfU wants to change their password PWc to PWcN, the following steps are performed:(1)
U first inserts their own smart card and enters their IDc, current password PWc, bio information Ri, and new password PWcN.(2)
According to some parameter values in the smart card and their own identity information, the following are calculated:(25)m=ηc⊕Ri⊕hIDc′⊕PWc′,BRPWc′=hRi⊕PWc′∥m,αc′=βc⊕hIDc′⊕BRPWc′,yc′=γc⊕hαc′⊕BRPWc′,χc′=hIDc′∥BRPWc′∥yc′∥αc′.If the calculated value ofχc′ is equal to the value of χc stored in the smart card, the user is considered legitimate and allowed to change the password.(3)
Some parameter values need to be updated in the process of password modification. The specific calculation process is as follows:(26)BRPWcN=hRi⊕PWcN∥m,βcN=αc⊕hIDc⊕RPWcN,γcN=yc⊕hαc⊕RPWcN,χcN=hIDc∥RPWcN∥yc∥αc,ηcN=Ri⊕m⊕hIDc⊕PWcN.(4)
Finally, the valuesβc,γc,χc,ηc stored in the smart card are updated to the modified values βcN,γcN,χcN,ηcN, and the process of password modification is completed.


## 5. Security Analysis

### 5.1. Formal Security Analysis

Burrows–Abadi–Needham (BAN) logic [20] has been used in several studies to prove whether a protocol can be executed securely. This section uses BAN logic to prove the security and reliability of our proposed protocol. This proof verifies that our protocol can successfully establish and share a session key between the user and server. In the following proof, U represents the user and S represents the server. The specific proof rules and process are as follows:


#### 5.1.1. BAN Logic Rules

(i)
Message-meaning rule (R1):U∣≡U↔KS,P⊲MK/U∣≡S∣∼M and U∣≡U⇌NS,U⊲MN/U∣≡S∣∼M(ii)
Nonce-verification rule (R2):U∣≡♯M,U∣≡S∣∼M/U∣≡S∣≡M(iii)
Jurisdiction rule (R3):U∣≡S∣⇒M,U∣≡S∣≡M/U∣≡M(iv)
Freshness rule (R4):U∣≡♯M/U∣≡♯M,N(v)
Belief rule (R5):U∣≡M,U∣≡N/U∣≡M,N(vi)
Session key rule (R6):U∣≡♯M,U∣≡S∣≡M/U∣≡U↔KS


#### 5.1.2. Goals

(i)
G1:U∣≡U↔SKS(ii)
G2:S∣≡U↔SKS(iii)
G3:U∣≡S∣≡U↔SKS(iv)
G4:S∣≡U∣≡U↔SKS


#### 5.1.3. Idealizing Communication

(i)
M1:U⟶S: DIDc,ωc,υc,T1(ii)
M2:S⟶U: μ2,T2


#### 5.1.4. Initial State Assumptions

(i)
A1:U∣≡U⇌dsS(ii)
A2:S∣≡U⇌dsS(iii)
A3:S∣≡♯IDc,αc,yc,(iv)
A4:S∣≡U∣⇒IDc(v)
A5:S∣≡U⇌IDcS(vi)
A6:U∣≡U⇌IDcS(vii)
A7:S∣≡U∣⇒αc,yc(viii)
A8:S∣≡♯IDc,αc,yc,(ix)
A9:U∣≡S∣⇒αc,yc


#### 5.1.5. Detailed Steps

By considering the message M1 and using the seeing rule, we getS1:S⊲IDcds,αc,ycds,T1.Using S1, we getS2:S⊲IDcds.Under the assumption of A2, using S2, R1 can be used to obtainS3:S∣≡U∣∼IDc.With conclusion S3, using A3 and R2, the following can be obtained:S4:S∣≡U∣≡IDc.Using A4, R3, and conclusion S4, the following can be obtained:S5:S∣≡IDc.According to conclusion S1, the following can be obtained:S6:S⊲αc,ycIDc.Using A6, R1, and conclusion S6, the following can be obtained:S7:S∣≡U∣∼αc,yc.Using A3, R2, and conclusion S7, the following can be obtained:S8:S∣≡U∣≡αc,yc.Using A7, R3, and conclusion S8, the following can be obtained:S9:S∣≡αc,yc.BecauseSK=hIDc⊕αc⊕yc⊕T1⊕T2, using S5 and S9, we obtainS10:S∣≡U↔SKS (G2).Using A3 and R4, we can obtainS11:S∣≡U∣≡U↔SKS (G4).In addition, considering the message M2, we obtainS12:U⊲αc,ycIDc,T2.By using A6, S1, and R1, we obtainS13:U∣≡S∣∼αc,yc.With conclusion S13, using A8 and applying R2, we obtainS14:U∣≡S∣≡αc,yc.Applying A9, S14, and R3, we obtainS15:U∣≡αc,yc.BecauseSK=hIDc⊕αc⊕yc⊕T1⊕T2, using S5 and S9, we obtainS16:U∣≡S↔SKS (G1).With conclusion S16, using A8 and R4, we can obtainS17:U∣≡S∣≡U↔SKS(G3).


### 5.2. ROR Formal Security Proof

#### 5.2.1. ROR Model

This paper follows the ROR (Random Oracles) model under the proof of security, and two participantsU and S are mentioned in the paper. First, let HUx and HSy as the xth user and yth server, respectively. Then, let U=HUx,HSy and A can perform the following operations.ExecuteU: by executing this query, A can get the messages transmitted by U and S through the common channel.SendU,ℳ: with the help of send query, A can send messages to U and S. In addition, A can also receive response messages from two participants.CorruptU: with the help of this query, A can obtain the parameters information stored in the smart card as well as some temporary parameters information and long-term key.HashString: by performing this operation, A can obtain the value in the hash.TestU: this operation is mainly used to verify whether the session key between the user and the server is secure. By tossing a homogeneous coin C, the result of the coin is known only to A. If C=1, A can know the correct session key. If C=0, a null value is an output.Definition 1.
(one-way anticollision hash function): this is a common mathematical function that inputs a variable length field and then produces a fixed length output. IfAdvm=Prm,nεRA;hm=hn≤t for at most run time m, the hash function is considered hash collision proof.Definition 2.
Symmetric encryption method is used in the proposed protocol. SupposeEK1,Ek2,…,EKn are encryption methods based on different keys K. In the model, the probability that A can crack the correct session key is AdvAKη=2PrA⟵EK1;b0,b1⟵A;α⟵0,1;β⟵EK1bα:Aβ=α−1.Theorem 1.
IfA is a polynomial time η opponent executing our scheme under the ROR model and we choose to look at Zipf’s law [28] for the user’s password, the possibility of A damaging the session key is AdvAPη≤tsend+texe2/2u−1+2AdvAKη+thash2⋅2l−1+2maxD′⋅tsendX′,tsend/2l+ where l represents the length of the password.


#### 5.2.2. Security Proof

Proof.
In the proof process, we define six gamesGM0 to GM5 and prove the theorem mentioned above according to the defined six game rules. SuccAGMiη represents the probability of A′s success in the game. The specific proof is as follows.GM0: in the initial game, A does not perform any query operations. According to the definition of security primitives, we can get AdvAPη=2PrSuccAGM0η.GM1: GM1 adds the execute operation on the basis of GM0, that is, A can intercept and tamper with the information transmitted on the public channel M1  =  DIDc,ωc,vc,T1 and M2  =  μc,T2. However, A cannot obtain the session keys of both parties according to the information obtained on the public channel, so the probability of GM1 is equal to that of GM0, PrSuccAGM1η=PrSuccAGM0η.GM2: GM2 adds Hash and Send query operations on the basis of GM1. According to the birthday paradox, it can be concluded that the maximum probability of hash collision is thash2/2l+1. Therefore, it can be concluded that the maximum probability of hash collision of text transmitted by both sides of the session is tsend+texe2/2u. Finally, we can draw a conclusion PrSuccAGM2η−PrSuccAGM1η≤thash2/2l+1+tsend+texe2/2u. The symbol l appearing in the formula represents the length of the hash value and u represents the length of the transmitted text.GM3: on the basis of the above game rules, we added the provision that A can obtain the parameters information stored in the smart card in the new round of game, that is, A can obtain the parameters βc,yc,γc,DIDc by executing the Corrupt operation. On this basis, we perform an offline password guessing attack. First, A calculates αc=βc⊕hIDc′⊕BRPW′, BRPW′=hRi⊕PWc′∥m, but U′s identity IDc and U′s biological information Ri are confidential to us, so they cannot be obtained. According to Zipf’s law [28], we can draw a conclusion: PrSuccAGM3η−PrSuccAGM2η≤maxD′⋅tsendX′,tsend/2l.GM4: in this game rule, we analyze the security of the communication session key between both sides. We mainly analyze it from the following three aspects. The first is to prove that the protocol has perfect forward security. The second is to prove that A can block the user impersonation attacks. The third is that A can block the known session-specific temporary information attacks.Perfect forward security:A obtains the value of the long-term key ds through Corrupt.Known session-specific temporary information attacks:A obtains the value of temporary information m or yc through Corrupt query.User impersonation attacks:A obtains the information DIDc,ωc.vc,T1 transmitted by both communication parties through the public channel through Exe query, but U′s identity IDc is obtained by symmetric encryption with the long-term key ds. However, the value of the long-term key ds cannot be obtained.The session keySK=hIDc⊕αc⊕yc⊕T1⊕T2 of both communication parties: in the first case, A must obtain the values of αc and yc in order to obtain the session key, but the value of αc needs U′s biological information. In the second case, A obtains the value of temporary information, but U′s identity IDc is obtained through symmetric encryption. In the third case, because U′s identity IDc is obtained through symmetric encryption, A cannot obtain U′s real identity, so it is impossible to carry out simulated attacks. Therefore, we can conclude that PrSuccAGM4η−PrSuccAGM3η≤ADVAKη.GM5: in the final rule of the game, A uses hash query hIDc⊕αc⊕yc⊕T1⊕T2; then, A can guess the possibility of the session key: PrSuccAGM5η−PrSuccAGM4η≤thash2/2l+1.
As we all know, the probability of guessing the session key correctly is|PrSuccAGM5η=1/2.
To sum up, we can get it according to the above formula:(27)12AdvAPη=PrSuccAGM0η−12=PrSuccAGM0η−PrSuccAGM5η=PrSuccAGM1η−PrSuccAGM5η≤PrSuccAGM5η−PrSuccAGM4η+PrSuccAGM4η−PrSuccAGM3η+PrSuccAGM3η−PrSuccAGM2η+PrSuccAGM2η−PrSuccAGM1η=tsend+texe22u+AdvAKη+thash22l+maxD′⋅tsendX′,tsend2l.
So, we come to the final conclusionAdvAPη≤tsend+texe2/2u−1+2AdvAKη+thash2⋅2l−1+2maxD′⋅tsendX′,tsend/2l.


### 5.3. Informal Security Analysis

In this section, we further show that the proposed scheme is secure against the following attacks.


#### 5.3.1. Privileged-Insider Attack

In this protocol, even if the attacker obtains the informationDIDc,BRPWc of the user in the registration process and the information βc,γc,χc,ηc in the smart card, they cannot successfully obtain the session key. Because SK=hIDc⊕αc⊕yc⊕T1⊕T2 and the user’s IDc is encrypted by ds before being transmitted to the server, even if the attacker obtains the value of DIDc and BRPWc, the attack is futile. Therefore, this protocol can resist privileged-internal attacks.


#### 5.3.2. Offline Password-Guessing Attacks

Suppose the attacker gets the message in the smart card; then, based on this message, they can guess the password offline. Even if theηc value in the smart card is obtained and the values of IDc and PWc are guessed, the offline password-guessing operation cannot be successful. This is because the calculation of m also involves the value of the user’s biological information Ri, and the value of Ri is difficult to obtain. Therefore, this protocol can effectively resist offline password-guessing attacks.


#### 5.3.3. Replay Attack

Suppose that the malicious attacker intercepts the login informationDIDc,ωc,νc,T1 and authentication information μc,T2 and attempts to replay the login request. The request is invalid because we use the timestamp T1 in the protocol to verify whether the time difference is within the set time threshold. Similarly, if the attacker intercepts the authentication message and attempts to make the authentication request, the user will also test the validity of the timestamp. Therefore, the protocol can effectively resist replay attacks.


#### 5.3.4. Forward Secrecy

Assuming that the attacker obtains the value of the long-term passwordds, they can only use this value to decrypt DIDc to obtain the value of the user’s IDc. However, because SK=hIDc⊕αc⊕yc⊕T1⊕T2, it is not sufficient to only know the value of the user’s IDc. The values of the parameters αc and yc cannot be obtained. Therefore, this protocol can provide perfect forward security.


#### 5.3.5. Known Session-Specific Temporary Information Attacks

Assuming that the attacker obtains the value of temporary session informationm or yc, the session key cannot be obtained successfully. Because the session key calculation is composed of IDc, but IDc is encrypted by long-term key ds, the IDc cannot be obtained by the attacker. Therefore, this protocol can successfully resist known session-specific temporary information attacks.


#### 5.3.6. User Impersonation Attacks

Suppose that the attacker wants to carry out a user impersonation attack. They must first obtain the value ofIDc, but IDc is encrypted by the long-term key ds, and so, it is difficult for the attacker to obtain its value. In addition, assuming that the attacker intercepts the message DIDc,ωc,νc,T1 from the public channel and sends it to the server for verification, the user needs a certain amount of time to decrypt DIDc. Therefore, when the server receives the message from the attacker for verification of the timestamp, it will find that the timestamp exceeds the set time domain and reject the login request. In this way, our protocol successfully resists user impersonation attacks.


#### 5.3.7. Mutual Authentication

In this protocol, users and servers can successfully authenticate each other. First of all, the server authenticates the user through the value ofυc sent by the user. Similarly, the user can verify whether the server is legitimate through the value of μc sent by the server. Only legitimate users and servers can pass the authentication. Therefore, this protocol can effectively provide mutual authentication between users and servers.


## 5.1. Formal Security Analysis

Burrows–Abadi–Needham (BAN) logic [20] has been used in several studies to prove whether a protocol can be executed securely. This section uses BAN logic to prove the security and reliability of our proposed protocol. This proof verifies that our protocol can successfully establish and share a session key between the user and server. In the following proof, U represents the user and S represents the server. The specific proof rules and process are as follows:


### 5.1.1. BAN Logic Rules

(i)
Message-meaning rule (R1):U∣≡U↔KS,P⊲MK/U∣≡S∣∼M and U∣≡U⇌NS,U⊲MN/U∣≡S∣∼M(ii)
Nonce-verification rule (R2):U∣≡♯M,U∣≡S∣∼M/U∣≡S∣≡M(iii)
Jurisdiction rule (R3):U∣≡S∣⇒M,U∣≡S∣≡M/U∣≡M(iv)
Freshness rule (R4):U∣≡♯M/U∣≡♯M,N(v)
Belief rule (R5):U∣≡M,U∣≡N/U∣≡M,N(vi)
Session key rule (R6):U∣≡♯M,U∣≡S∣≡M/U∣≡U↔KS


### 5.1.2. Goals

(i)
G1:U∣≡U↔SKS(ii)
G2:S∣≡U↔SKS(iii)
G3:U∣≡S∣≡U↔SKS(iv)
G4:S∣≡U∣≡U↔SKS


### 5.1.3. Idealizing Communication

(i)
M1:U⟶S: DIDc,ωc,υc,T1(ii)
M2:S⟶U: μ2,T2


### 5.1.4. Initial State Assumptions

(i)
A1:U∣≡U⇌dsS(ii)
A2:S∣≡U⇌dsS(iii)
A3:S∣≡♯IDc,αc,yc,(iv)
A4:S∣≡U∣⇒IDc(v)
A5:S∣≡U⇌IDcS(vi)
A6:U∣≡U⇌IDcS(vii)
A7:S∣≡U∣⇒αc,yc(viii)
A8:S∣≡♯IDc,αc,yc,(ix)
A9:U∣≡S∣⇒αc,yc


### 5.1.5. Detailed Steps

By considering the message M1 and using the seeing rule, we getS1:S⊲IDcds,αc,ycds,T1.Using S1, we getS2:S⊲IDcds.Under the assumption of A2, using S2, R1 can be used to obtainS3:S∣≡U∣∼IDc.With conclusion S3, using A3 and R2, the following can be obtained:S4:S∣≡U∣≡IDc.Using A4, R3, and conclusion S4, the following can be obtained:S5:S∣≡IDc.According to conclusion S1, the following can be obtained:S6:S⊲αc,ycIDc.Using A6, R1, and conclusion S6, the following can be obtained:S7:S∣≡U∣∼αc,yc.Using A3, R2, and conclusion S7, the following can be obtained:S8:S∣≡U∣≡αc,yc.Using A7, R3, and conclusion S8, the following can be obtained:S9:S∣≡αc,yc.BecauseSK=hIDc⊕αc⊕yc⊕T1⊕T2, using S5 and S9, we obtainS10:S∣≡U↔SKS (G2).Using A3 and R4, we can obtainS11:S∣≡U∣≡U↔SKS (G4).In addition, considering the message M2, we obtainS12:U⊲αc,ycIDc,T2.By using A6, S1, and R1, we obtainS13:U∣≡S∣∼αc,yc.With conclusion S13, using A8 and applying R2, we obtainS14:U∣≡S∣≡αc,yc.Applying A9, S14, and R3, we obtainS15:U∣≡αc,yc.BecauseSK=hIDc⊕αc⊕yc⊕T1⊕T2, using S5 and S9, we obtainS16:U∣≡S↔SKS (G1).With conclusion S16, using A8 and R4, we can obtainS17:U∣≡S∣≡U↔SKS(G3).


## 5.1.1. BAN Logic Rules

(i)
Message-meaning rule (R1):U∣≡U↔KS,P⊲MK/U∣≡S∣∼M and U∣≡U⇌NS,U⊲MN/U∣≡S∣∼M(ii)
Nonce-verification rule (R2):U∣≡♯M,U∣≡S∣∼M/U∣≡S∣≡M(iii)
Jurisdiction rule (R3):U∣≡S∣⇒M,U∣≡S∣≡M/U∣≡M(iv)
Freshness rule (R4):U∣≡♯M/U∣≡♯M,N(v)
Belief rule (R5):U∣≡M,U∣≡N/U∣≡M,N(vi)
Session key rule (R6):U∣≡♯M,U∣≡S∣≡M/U∣≡U↔KS


## 5.1.2. Goals

(i)
G1:U∣≡U↔SKS(ii)
G2:S∣≡U↔SKS(iii)
G3:U∣≡S∣≡U↔SKS(iv)
G4:S∣≡U∣≡U↔SKS


## 5.1.3. Idealizing Communication

(i)
M1:U⟶S: DIDc,ωc,υc,T1(ii)
M2:S⟶U: μ2,T2


## 5.1.4. Initial State Assumptions

(i)
A1:U∣≡U⇌dsS(ii)
A2:S∣≡U⇌dsS(iii)
A3:S∣≡♯IDc,αc,yc,(iv)
A4:S∣≡U∣⇒IDc(v)
A5:S∣≡U⇌IDcS(vi)
A6:U∣≡U⇌IDcS(vii)
A7:S∣≡U∣⇒αc,yc(viii)
A8:S∣≡♯IDc,αc,yc,(ix)
A9:U∣≡S∣⇒αc,yc


## 5.1.5. Detailed Steps

By considering the message M1 and using the seeing rule, we getS1:S⊲IDcds,αc,ycds,T1.Using S1, we getS2:S⊲IDcds.Under the assumption of A2, using S2, R1 can be used to obtainS3:S∣≡U∣∼IDc.With conclusion S3, using A3 and R2, the following can be obtained:S4:S∣≡U∣≡IDc.Using A4, R3, and conclusion S4, the following can be obtained:S5:S∣≡IDc.According to conclusion S1, the following can be obtained:S6:S⊲αc,ycIDc.Using A6, R1, and conclusion S6, the following can be obtained:S7:S∣≡U∣∼αc,yc.Using A3, R2, and conclusion S7, the following can be obtained:S8:S∣≡U∣≡αc,yc.Using A7, R3, and conclusion S8, the following can be obtained:S9:S∣≡αc,yc.BecauseSK=hIDc⊕αc⊕yc⊕T1⊕T2, using S5 and S9, we obtainS10:S∣≡U↔SKS (G2).Using A3 and R4, we can obtainS11:S∣≡U∣≡U↔SKS (G4).In addition, considering the message M2, we obtainS12:U⊲αc,ycIDc,T2.By using A6, S1, and R1, we obtainS13:U∣≡S∣∼αc,yc.With conclusion S13, using A8 and applying R2, we obtainS14:U∣≡S∣≡αc,yc.Applying A9, S14, and R3, we obtainS15:U∣≡αc,yc.BecauseSK=hIDc⊕αc⊕yc⊕T1⊕T2, using S5 and S9, we obtainS16:U∣≡S↔SKS (G1).With conclusion S16, using A8 and R4, we can obtainS17:U∣≡S∣≡U↔SKS(G3).


## 5.2. ROR Formal Security Proof

### 5.2.1. ROR Model

This paper follows the ROR (Random Oracles) model under the proof of security, and two participantsU and S are mentioned in the paper. First, let HUx and HSy as the xth user and yth server, respectively. Then, let U=HUx,HSy and A can perform the following operations.ExecuteU: by executing this query, A can get the messages transmitted by U and S through the common channel.SendU,ℳ: with the help of send query, A can send messages to U and S. In addition, A can also receive response messages from two participants.CorruptU: with the help of this query, A can obtain the parameters information stored in the smart card as well as some temporary parameters information and long-term key.HashString: by performing this operation, A can obtain the value in the hash.TestU: this operation is mainly used to verify whether the session key between the user and the server is secure. By tossing a homogeneous coin C, the result of the coin is known only to A. If C=1, A can know the correct session key. If C=0, a null value is an output.Definition 1.
(one-way anticollision hash function): this is a common mathematical function that inputs a variable length field and then produces a fixed length output. IfAdvm=Prm,nεRA;hm=hn≤t for at most run time m, the hash function is considered hash collision proof.Definition 2.
Symmetric encryption method is used in the proposed protocol. SupposeEK1,Ek2,…,EKn are encryption methods based on different keys K. In the model, the probability that A can crack the correct session key is AdvAKη=2PrA⟵EK1;b0,b1⟵A;α⟵0,1;β⟵EK1bα:Aβ=α−1.Theorem 1.
IfA is a polynomial time η opponent executing our scheme under the ROR model and we choose to look at Zipf’s law [28] for the user’s password, the possibility of A damaging the session key is AdvAPη≤tsend+texe2/2u−1+2AdvAKη+thash2⋅2l−1+2maxD′⋅tsendX′,tsend/2l+ where l represents the length of the password.


### 5.2.2. Security Proof

Proof.
In the proof process, we define six gamesGM0 to GM5 and prove the theorem mentioned above according to the defined six game rules. SuccAGMiη represents the probability of A′s success in the game. The specific proof is as follows.GM0: in the initial game, A does not perform any query operations. According to the definition of security primitives, we can get AdvAPη=2PrSuccAGM0η.GM1: GM1 adds the execute operation on the basis of GM0, that is, A can intercept and tamper with the information transmitted on the public channel M1  =  DIDc,ωc,vc,T1 and M2  =  μc,T2. However, A cannot obtain the session keys of both parties according to the information obtained on the public channel, so the probability of GM1 is equal to that of GM0, PrSuccAGM1η=PrSuccAGM0η.GM2: GM2 adds Hash and Send query operations on the basis of GM1. According to the birthday paradox, it can be concluded that the maximum probability of hash collision is thash2/2l+1. Therefore, it can be concluded that the maximum probability of hash collision of text transmitted by both sides of the session is tsend+texe2/2u. Finally, we can draw a conclusion PrSuccAGM2η−PrSuccAGM1η≤thash2/2l+1+tsend+texe2/2u. The symbol l appearing in the formula represents the length of the hash value and u represents the length of the transmitted text.GM3: on the basis of the above game rules, we added the provision that A can obtain the parameters information stored in the smart card in the new round of game, that is, A can obtain the parameters βc,yc,γc,DIDc by executing the Corrupt operation. On this basis, we perform an offline password guessing attack. First, A calculates αc=βc⊕hIDc′⊕BRPW′, BRPW′=hRi⊕PWc′∥m, but U′s identity IDc and U′s biological information Ri are confidential to us, so they cannot be obtained. According to Zipf’s law [28], we can draw a conclusion: PrSuccAGM3η−PrSuccAGM2η≤maxD′⋅tsendX′,tsend/2l.GM4: in this game rule, we analyze the security of the communication session key between both sides. We mainly analyze it from the following three aspects. The first is to prove that the protocol has perfect forward security. The second is to prove that A can block the user impersonation attacks. The third is that A can block the known session-specific temporary information attacks.Perfect forward security:A obtains the value of the long-term key ds through Corrupt.Known session-specific temporary information attacks:A obtains the value of temporary information m or yc through Corrupt query.User impersonation attacks:A obtains the information DIDc,ωc.vc,T1 transmitted by both communication parties through the public channel through Exe query, but U′s identity IDc is obtained by symmetric encryption with the long-term key ds. However, the value of the long-term key ds cannot be obtained.The session keySK=hIDc⊕αc⊕yc⊕T1⊕T2 of both communication parties: in the first case, A must obtain the values of αc and yc in order to obtain the session key, but the value of αc needs U′s biological information. In the second case, A obtains the value of temporary information, but U′s identity IDc is obtained through symmetric encryption. In the third case, because U′s identity IDc is obtained through symmetric encryption, A cannot obtain U′s real identity, so it is impossible to carry out simulated attacks. Therefore, we can conclude that PrSuccAGM4η−PrSuccAGM3η≤ADVAKη.GM5: in the final rule of the game, A uses hash query hIDc⊕αc⊕yc⊕T1⊕T2; then, A can guess the possibility of the session key: PrSuccAGM5η−PrSuccAGM4η≤thash2/2l+1.
As we all know, the probability of guessing the session key correctly is|PrSuccAGM5η=1/2.
To sum up, we can get it according to the above formula:(27)12AdvAPη=PrSuccAGM0η−12=PrSuccAGM0η−PrSuccAGM5η=PrSuccAGM1η−PrSuccAGM5η≤PrSuccAGM5η−PrSuccAGM4η+PrSuccAGM4η−PrSuccAGM3η+PrSuccAGM3η−PrSuccAGM2η+PrSuccAGM2η−PrSuccAGM1η=tsend+texe22u+AdvAKη+thash22l+maxD′⋅tsendX′,tsend2l.
So, we come to the final conclusionAdvAPη≤tsend+texe2/2u−1+2AdvAKη+thash2⋅2l−1+2maxD′⋅tsendX′,tsend/2l.


## 5.2.1. ROR Model

This paper follows the ROR (Random Oracles) model under the proof of security, and two participantsU and S are mentioned in the paper. First, let HUx and HSy as the xth user and yth server, respectively. Then, let U=HUx,HSy and A can perform the following operations.ExecuteU: by executing this query, A can get the messages transmitted by U and S through the common channel.SendU,ℳ: with the help of send query, A can send messages to U and S. In addition, A can also receive response messages from two participants.CorruptU: with the help of this query, A can obtain the parameters information stored in the smart card as well as some temporary parameters information and long-term key.HashString: by performing this operation, A can obtain the value in the hash.TestU: this operation is mainly used to verify whether the session key between the user and the server is secure. By tossing a homogeneous coin C, the result of the coin is known only to A. If C=1, A can know the correct session key. If C=0, a null value is an output.Definition 1.
(one-way anticollision hash function): this is a common mathematical function that inputs a variable length field and then produces a fixed length output. IfAdvm=Prm,nεRA;hm=hn≤t for at most run time m, the hash function is considered hash collision proof.Definition 2.
Symmetric encryption method is used in the proposed protocol. SupposeEK1,Ek2,…,EKn are encryption methods based on different keys K. In the model, the probability that A can crack the correct session key is AdvAKη=2PrA⟵EK1;b0,b1⟵A;α⟵0,1;β⟵EK1bα:Aβ=α−1.Theorem 1.
IfA is a polynomial time η opponent executing our scheme under the ROR model and we choose to look at Zipf’s law [28] for the user’s password, the possibility of A damaging the session key is AdvAPη≤tsend+texe2/2u−1+2AdvAKη+thash2⋅2l−1+2maxD′⋅tsendX′,tsend/2l+ where l represents the length of the password.


## 5.2.2. Security Proof

Proof.
In the proof process, we define six gamesGM0 to GM5 and prove the theorem mentioned above according to the defined six game rules. SuccAGMiη represents the probability of A′s success in the game. The specific proof is as follows.GM0: in the initial game, A does not perform any query operations. According to the definition of security primitives, we can get AdvAPη=2PrSuccAGM0η.GM1: GM1 adds the execute operation on the basis of GM0, that is, A can intercept and tamper with the information transmitted on the public channel M1  =  DIDc,ωc,vc,T1 and M2  =  μc,T2. However, A cannot obtain the session keys of both parties according to the information obtained on the public channel, so the probability of GM1 is equal to that of GM0, PrSuccAGM1η=PrSuccAGM0η.GM2: GM2 adds Hash and Send query operations on the basis of GM1. According to the birthday paradox, it can be concluded that the maximum probability of hash collision is thash2/2l+1. Therefore, it can be concluded that the maximum probability of hash collision of text transmitted by both sides of the session is tsend+texe2/2u. Finally, we can draw a conclusion PrSuccAGM2η−PrSuccAGM1η≤thash2/2l+1+tsend+texe2/2u. The symbol l appearing in the formula represents the length of the hash value and u represents the length of the transmitted text.GM3: on the basis of the above game rules, we added the provision that A can obtain the parameters information stored in the smart card in the new round of game, that is, A can obtain the parameters βc,yc,γc,DIDc by executing the Corrupt operation. On this basis, we perform an offline password guessing attack. First, A calculates αc=βc⊕hIDc′⊕BRPW′, BRPW′=hRi⊕PWc′∥m, but U′s identity IDc and U′s biological information Ri are confidential to us, so they cannot be obtained. According to Zipf’s law [28], we can draw a conclusion: PrSuccAGM3η−PrSuccAGM2η≤maxD′⋅tsendX′,tsend/2l.GM4: in this game rule, we analyze the security of the communication session key between both sides. We mainly analyze it from the following three aspects. The first is to prove that the protocol has perfect forward security. The second is to prove that A can block the user impersonation attacks. The third is that A can block the known session-specific temporary information attacks.Perfect forward security:A obtains the value of the long-term key ds through Corrupt.Known session-specific temporary information attacks:A obtains the value of temporary information m or yc through Corrupt query.User impersonation attacks:A obtains the information DIDc,ωc.vc,T1 transmitted by both communication parties through the public channel through Exe query, but U′s identity IDc is obtained by symmetric encryption with the long-term key ds. However, the value of the long-term key ds cannot be obtained.The session keySK=hIDc⊕αc⊕yc⊕T1⊕T2 of both communication parties: in the first case, A must obtain the values of αc and yc in order to obtain the session key, but the value of αc needs U′s biological information. In the second case, A obtains the value of temporary information, but U′s identity IDc is obtained through symmetric encryption. In the third case, because U′s identity IDc is obtained through symmetric encryption, A cannot obtain U′s real identity, so it is impossible to carry out simulated attacks. Therefore, we can conclude that PrSuccAGM4η−PrSuccAGM3η≤ADVAKη.GM5: in the final rule of the game, A uses hash query hIDc⊕αc⊕yc⊕T1⊕T2; then, A can guess the possibility of the session key: PrSuccAGM5η−PrSuccAGM4η≤thash2/2l+1.
As we all know, the probability of guessing the session key correctly is|PrSuccAGM5η=1/2.
To sum up, we can get it according to the above formula:(27)12AdvAPη=PrSuccAGM0η−12=PrSuccAGM0η−PrSuccAGM5η=PrSuccAGM1η−PrSuccAGM5η≤PrSuccAGM5η−PrSuccAGM4η+PrSuccAGM4η−PrSuccAGM3η+PrSuccAGM3η−PrSuccAGM2η+PrSuccAGM2η−PrSuccAGM1η=tsend+texe22u+AdvAKη+thash22l+maxD′⋅tsendX′,tsend2l.
So, we come to the final conclusionAdvAPη≤tsend+texe2/2u−1+2AdvAKη+thash2⋅2l−1+2maxD′⋅tsendX′,tsend/2l.


## 5.3. Informal Security Analysis

In this section, we further show that the proposed scheme is secure against the following attacks.


### 5.3.1. Privileged-Insider Attack

In this protocol, even if the attacker obtains the informationDIDc,BRPWc of the user in the registration process and the information βc,γc,χc,ηc in the smart card, they cannot successfully obtain the session key. Because SK=hIDc⊕αc⊕yc⊕T1⊕T2 and the user’s IDc is encrypted by ds before being transmitted to the server, even if the attacker obtains the value of DIDc and BRPWc, the attack is futile. Therefore, this protocol can resist privileged-internal attacks.


### 5.3.2. Offline Password-Guessing Attacks

Suppose the attacker gets the message in the smart card; then, based on this message, they can guess the password offline. Even if theηc value in the smart card is obtained and the values of IDc and PWc are guessed, the offline password-guessing operation cannot be successful. This is because the calculation of m also involves the value of the user’s biological information Ri, and the value of Ri is difficult to obtain. Therefore, this protocol can effectively resist offline password-guessing attacks.


### 5.3.3. Replay Attack

Suppose that the malicious attacker intercepts the login informationDIDc,ωc,νc,T1 and authentication information μc,T2 and attempts to replay the login request. The request is invalid because we use the timestamp T1 in the protocol to verify whether the time difference is within the set time threshold. Similarly, if the attacker intercepts the authentication message and attempts to make the authentication request, the user will also test the validity of the timestamp. Therefore, the protocol can effectively resist replay attacks.


### 5.3.4. Forward Secrecy

Assuming that the attacker obtains the value of the long-term passwordds, they can only use this value to decrypt DIDc to obtain the value of the user’s IDc. However, because SK=hIDc⊕αc⊕yc⊕T1⊕T2, it is not sufficient to only know the value of the user’s IDc. The values of the parameters αc and yc cannot be obtained. Therefore, this protocol can provide perfect forward security.


### 5.3.5. Known Session-Specific Temporary Information Attacks

Assuming that the attacker obtains the value of temporary session informationm or yc, the session key cannot be obtained successfully. Because the session key calculation is composed of IDc, but IDc is encrypted by long-term key ds, the IDc cannot be obtained by the attacker. Therefore, this protocol can successfully resist known session-specific temporary information attacks.


### 5.3.6. User Impersonation Attacks

Suppose that the attacker wants to carry out a user impersonation attack. They must first obtain the value ofIDc, but IDc is encrypted by the long-term key ds, and so, it is difficult for the attacker to obtain its value. In addition, assuming that the attacker intercepts the message DIDc,ωc,νc,T1 from the public channel and sends it to the server for verification, the user needs a certain amount of time to decrypt DIDc. Therefore, when the server receives the message from the attacker for verification of the timestamp, it will find that the timestamp exceeds the set time domain and reject the login request. In this way, our protocol successfully resists user impersonation attacks.


### 5.3.7. Mutual Authentication

In this protocol, users and servers can successfully authenticate each other. First of all, the server authenticates the user through the value ofυc sent by the user. Similarly, the user can verify whether the server is legitimate through the value of μc sent by the server. Only legitimate users and servers can pass the authentication. Therefore, this protocol can effectively provide mutual authentication between users and servers.


## 5.3.1. Privileged-Insider Attack

In this protocol, even if the attacker obtains the informationDIDc,BRPWc of the user in the registration process and the information βc,γc,χc,ηc in the smart card, they cannot successfully obtain the session key. Because SK=hIDc⊕αc⊕yc⊕T1⊕T2 and the user’s IDc is encrypted by ds before being transmitted to the server, even if the attacker obtains the value of DIDc and BRPWc, the attack is futile. Therefore, this protocol can resist privileged-internal attacks.


## 5.3.2. Offline Password-Guessing Attacks

Suppose the attacker gets the message in the smart card; then, based on this message, they can guess the password offline. Even if theηc value in the smart card is obtained and the values of IDc and PWc are guessed, the offline password-guessing operation cannot be successful. This is because the calculation of m also involves the value of the user’s biological information Ri, and the value of Ri is difficult to obtain. Therefore, this protocol can effectively resist offline password-guessing attacks.


## 5.3.3. Replay Attack

Suppose that the malicious attacker intercepts the login informationDIDc,ωc,νc,T1 and authentication information μc,T2 and attempts to replay the login request. The request is invalid because we use the timestamp T1 in the protocol to verify whether the time difference is within the set time threshold. Similarly, if the attacker intercepts the authentication message and attempts to make the authentication request, the user will also test the validity of the timestamp. Therefore, the protocol can effectively resist replay attacks.


## 5.3.4. Forward Secrecy

Assuming that the attacker obtains the value of the long-term passwordds, they can only use this value to decrypt DIDc to obtain the value of the user’s IDc. However, because SK=hIDc⊕αc⊕yc⊕T1⊕T2, it is not sufficient to only know the value of the user’s IDc. The values of the parameters αc and yc cannot be obtained. Therefore, this protocol can provide perfect forward security.


## 5.3.5. Known Session-Specific Temporary Information Attacks

Assuming that the attacker obtains the value of temporary session informationm or yc, the session key cannot be obtained successfully. Because the session key calculation is composed of IDc, but IDc is encrypted by long-term key ds, the IDc cannot be obtained by the attacker. Therefore, this protocol can successfully resist known session-specific temporary information attacks.


## 5.3.6. User Impersonation Attacks

Suppose that the attacker wants to carry out a user impersonation attack. They must first obtain the value ofIDc, but IDc is encrypted by the long-term key ds, and so, it is difficult for the attacker to obtain its value. In addition, assuming that the attacker intercepts the message DIDc,ωc,νc,T1 from the public channel and sends it to the server for verification, the user needs a certain amount of time to decrypt DIDc. Therefore, when the server receives the message from the attacker for verification of the timestamp, it will find that the timestamp exceeds the set time domain and reject the login request. In this way, our protocol successfully resists user impersonation attacks.


## 5.3.7. Mutual Authentication

In this protocol, users and servers can successfully authenticate each other. First of all, the server authenticates the user through the value ofυc sent by the user. Similarly, the user can verify whether the server is legitimate through the value of μc sent by the server. Only legitimate users and servers can pass the authentication. Therefore, this protocol can effectively provide mutual authentication between users and servers.


## 6. Security and Performance Comparisons

This section discusses the security and performance analysis of the proposed protocol. Security analysis is mainly conducted through a comparison with other proposed protocols in the resistance of some common attacks, and performance analysis is mainly performed through a comparison with the time and communication costs of other protocols.


### 6.1. Security Comparisons

In this section, the protocol proposed in this study is compared with recent related protocols. Owing to the development of different types of attack technology and methods, previous protocols are now incapable of resisting some common attacks. At present, the common network attacks include A1: privileged-internal attack, A2: offline password-guessing attack, A3: replay attack, A4: perfect forward secrecy, A5: known session-specific temporary information attacks, and A6: user impersonation attacks. The comparison results are presented in Table2. A “Yes” means that the protocol can resist the attack, whereas a “No” means that it cannot.Table 2
Comparisons of security.
ProtocolsA1A2A3A4A5A6Rana et al. [19]NoNoYesYesYesYesKaul and Awasthi [18]YesYesYesYesYesNoXue et al. [29]YesNoYesYesYesYesLin et al. [30]YesYesYesYesYesNoChang et al. [17]NoNoNoYesYesNoKumari et al. [16]NoYesNoYesYesYesOursYesYesYesYesYesYesWhile the other related protocols each fail in some of the security attacks mentioned above, our proposed protocol can resist all the attacks, making our proposed protocol more secure and reliable.


### 6.2. Performance Comparisons

To better analyze the performance of this protocol, we compared it with a previous protocol. To obtain more convincing results, we analyzed the protocol using the same tools and under the same conditions and used the data provided by Rana et al. [19] The results show that different protocols have different execution times in the same execution environment. The time required for the connection operation and the noncollision hash function was 0.00014 ms and 0.00089 ms, respectively. The time required for the exception and encryption and decryption operations was extremely small, and so, it was not calculated. In addition, the number of bits required for the user name, password, arbitrary number, and integer was 160; the number of bits required for the private key and public key of the server was 256; the number of bits required for encryption and decryption was 512; and, the number of bits required for the exclusive or operation and noncollision hash function was 160 and 256, respectively. The symbols for each encryption operation are as follows:T∥: time required for connection operationT⊕: time required for XOR operationTEnc/Dec: time required for encryption/decryptionTh: time required for hash operationFirst, we compared the communication cost of our proposed protocol with that of previous protocols. In particular, our protocol was compared with those proposed by Rana et al. [19], Kaul and Awasthi [18], Khan et al. [31], Chang et al. [17], and Kumari et al. [16]. The communication overhead of our protocol is 3136 bits, whereas that of the protocols proposed by Rana et al. [19], Kaul and Awasthi [18], Khan et al. [31], Chang et al. [17], and Kumari et al. [16] are 3296, 2668, 3744, 2336, and 3296 bits, respectively. As shown in Figure 4, the communication cost of our protocol is lower than that of Rana et al. and Khan et al., but slightly higher than that of Kaul and Awasthi [18]. Although the communication cost of Chang et al. is small, the protocol proposed by them cannot effectively resist privilege internal attacks, offline password guessing attacks, and replay attacks.Figure 4
Communication cost.Next, we compare the running time cost of our proposed protocol with those of the three protocols mentioned above. The operating cost of our protocol is 0.01512 ms, whereas that of the protocols proposed by Rana et al. [19], Kaul and Awasthi [18], Khan et al. [31], Chang et al. [17], and Kumari et al. [16] are 0.0215 ms, 0.021 ms, 0.01965 ms, 0.01318 ms, and 0.02191 ms, respectively. As shown in Figure 5, the running time of our proposed protocol is shorter than that of the four protocols mentioned above. Although the time consumption of the protocol proposed by us is a little higher than that proposed by Chang et al., the protocol proposed by Chang et al. has the problem of security. It can be said that our protocol has better performance than the ones mentioned above.Figure 5
Running time.Through the analysis of Tables2 and 3, our protocol is slightly higher than Kaul and Awasthi’s [18] protocol in terms of communication cost, but Kaul and Awasthi’s [18] protocol cannot resist user simulation attacks. Because our proposed protocol can more effectively resist various security attacks, our protocol is more applicable in future works.Table 3
Proposed protocol comparison with related protocols.
Running cost (ms)Communication cost (bits)Ours14Th+31T⊕+19T∥+1TEnc/Dec3136Rana et al. [19]20Th+29T⊕+27T∥+3TEnc/Dec3296Kaul and Awasthi [18]20Th+28T⊕+23T∥2668Khan et al. [31]15Th+11T⊕+45T∥+4TEnc/Dec3744Chang et al. [17]12Th+7T⊕+18T∥2336Kumari et al. [16]19Th+18T⊕+36T∥3296


## 6.1. Security Comparisons

In this section, the protocol proposed in this study is compared with recent related protocols. Owing to the development of different types of attack technology and methods, previous protocols are now incapable of resisting some common attacks. At present, the common network attacks include A1: privileged-internal attack, A2: offline password-guessing attack, A3: replay attack, A4: perfect forward secrecy, A5: known session-specific temporary information attacks, and A6: user impersonation attacks. The comparison results are presented in Table2. A “Yes” means that the protocol can resist the attack, whereas a “No” means that it cannot.Table 2
Comparisons of security.
ProtocolsA1A2A3A4A5A6Rana et al. [19]NoNoYesYesYesYesKaul and Awasthi [18]YesYesYesYesYesNoXue et al. [29]YesNoYesYesYesYesLin et al. [30]YesYesYesYesYesNoChang et al. [17]NoNoNoYesYesNoKumari et al. [16]NoYesNoYesYesYesOursYesYesYesYesYesYesWhile the other related protocols each fail in some of the security attacks mentioned above, our proposed protocol can resist all the attacks, making our proposed protocol more secure and reliable.


## 6.2. Performance Comparisons

To better analyze the performance of this protocol, we compared it with a previous protocol. To obtain more convincing results, we analyzed the protocol using the same tools and under the same conditions and used the data provided by Rana et al. [19] The results show that different protocols have different execution times in the same execution environment. The time required for the connection operation and the noncollision hash function was 0.00014 ms and 0.00089 ms, respectively. The time required for the exception and encryption and decryption operations was extremely small, and so, it was not calculated. In addition, the number of bits required for the user name, password, arbitrary number, and integer was 160; the number of bits required for the private key and public key of the server was 256; the number of bits required for encryption and decryption was 512; and, the number of bits required for the exclusive or operation and noncollision hash function was 160 and 256, respectively. The symbols for each encryption operation are as follows:T∥: time required for connection operationT⊕: time required for XOR operationTEnc/Dec: time required for encryption/decryptionTh: time required for hash operationFirst, we compared the communication cost of our proposed protocol with that of previous protocols. In particular, our protocol was compared with those proposed by Rana et al. [19], Kaul and Awasthi [18], Khan et al. [31], Chang et al. [17], and Kumari et al. [16]. The communication overhead of our protocol is 3136 bits, whereas that of the protocols proposed by Rana et al. [19], Kaul and Awasthi [18], Khan et al. [31], Chang et al. [17], and Kumari et al. [16] are 3296, 2668, 3744, 2336, and 3296 bits, respectively. As shown in Figure 4, the communication cost of our protocol is lower than that of Rana et al. and Khan et al., but slightly higher than that of Kaul and Awasthi [18]. Although the communication cost of Chang et al. is small, the protocol proposed by them cannot effectively resist privilege internal attacks, offline password guessing attacks, and replay attacks.Figure 4
Communication cost.Next, we compare the running time cost of our proposed protocol with those of the three protocols mentioned above. The operating cost of our protocol is 0.01512 ms, whereas that of the protocols proposed by Rana et al. [19], Kaul and Awasthi [18], Khan et al. [31], Chang et al. [17], and Kumari et al. [16] are 0.0215 ms, 0.021 ms, 0.01965 ms, 0.01318 ms, and 0.02191 ms, respectively. As shown in Figure 5, the running time of our proposed protocol is shorter than that of the four protocols mentioned above. Although the time consumption of the protocol proposed by us is a little higher than that proposed by Chang et al., the protocol proposed by Chang et al. has the problem of security. It can be said that our protocol has better performance than the ones mentioned above.Figure 5
Running time.Through the analysis of Tables2 and 3, our protocol is slightly higher than Kaul and Awasthi’s [18] protocol in terms of communication cost, but Kaul and Awasthi’s [18] protocol cannot resist user simulation attacks. Because our proposed protocol can more effectively resist various security attacks, our protocol is more applicable in future works.Table 3
Proposed protocol comparison with related protocols.
Running cost (ms)Communication cost (bits)Ours14Th+31T⊕+19T∥+1TEnc/Dec3136Rana et al. [19]20Th+29T⊕+27T∥+3TEnc/Dec3296Kaul and Awasthi [18]20Th+28T⊕+23T∥2668Khan et al. [31]15Th+11T⊕+45T∥+4TEnc/Dec3744Chang et al. [17]12Th+7T⊕+18T∥2336Kumari et al. [16]19Th+18T⊕+36T∥3296


## 7. Conclusions

In this study, we analyzed the next generation Internet of Things remote protocol proposed by Rana et al., and found that their protocol cannot resist all kinds of security attacks as they claim. Specifically, we found that their protocols are vulnerable to offline password-guessing attacks and privileged-insider attacks. To solve these problems, we introduced a three-factor security protocol utilizing biological information. In addition, we proved the security and reliability of the protocol through BAN logic and ROR analysis. Finally, we compared the proposed protocol with the previous related protocols and found that our protocol is better in terms of both communication cost and time cost. Therefore, our proposed protocol is more applicable and referential for the development of the future work.



---

*Source: 6537678-2021-09-30.xml*