# Improved Authenticated Key Agreement Scheme for Fog-Driven IoT Healthcare System

Authors: Tsu-Yang Wu; Tao Wang; Yu-Qi Lee; Weimin Zheng; Saru Kumari; Sachin Kumar
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The Internet of things (IoT) has been widely used for various applications including medical and transportation systems, among others. Smart medical systems have become the most effective and practical solutions to provide users with low-cost, noninvasive, and long-term continuous health monitoring. Recently, Jia et al. proposed an authentication and key agreement scheme for smart medical systems based on fog computing and indicated that it is safe and can withstand a variety of known attacks. Nevertheless, we found that it consists of several flaws, including known session-specific temporary information attacks and lack of per-verification. The opponent can readily recover the session key and user identity. In this paper, we propose a secure authentication and key agreement scheme, which compensates for the imperfections of the previously proposed. For a security evaluation of the proposed authentication scheme, informal security analysis and the Burrows–Abadi–Needham (BAN) logic analysis are implemented. In addition, the ProVerif tool is used to normalize the security verification of the scheme. Finally, the performance comparisons with the former schemes show that the proposed scheme is more applicable and secure.


---

## Body

## 1. Introduction

A wireless sensor network (WSN) [1–5] (also called sensor network) is a multihop self-organizing network system formed by several inexpensive minisensor nodes distributed in the detection region by wireless communication. The aim of WSN is to gather and process the information of the sensing objects in the network coverage area and transmit it to the observer. The WSN is a significant foundation of the Internet of things and has been used in several fields, such as smart healthcare. Wireless medical sensor networks (WMSNs) [6] can be used to build universal medical systems, which can immediately verify patient emergency situations through the remote monitoring function and can increase the quality of patient medical treatment. In a WSN-based healthcare system, medical sensors are physically applied on patients, and then the acquired data are forwarded to authorized entities in a secure manner. However, the sensors deployed in the wireless medical sensor network have limited storage and computing capabilities; therefore, when excessive data are collected, the real-time nature of all the data processing may not be guaranteed.To resolve the aforementioned critical problems, the concept of a fog-driven IoT healthcare system [7–9] (Figure 1) is proposed to move computing functions to users and devices at more remote locations. The fog-driven IoT healthcare system consists of the three following layers: healthcare device layer, medical fog layer, and medical cloud layer. In fog computing [10–16], fog nodes (including routers, gateways, switchers, and access points) are distributed at the margin of the network and approach terminal facilities in a geographic location. By expanding cloud services to the margin of the network, fog computing transforms cloud data centers into distributed platforms while preserving cloud services for users. Therefore, the waiting time for wireless medical sensor data processing is minimized [17–19], improving user experience and service quality.Figure 1
The concept of fog-driven IoT healthcare system.Generally, sensor nodes are resource-constrained devices with computing, communication, and storage functions. In addition, sensor nodes are usually distributed in a sparsely populated environment. Because the nodes are vulnerable to threats from adversaries, the security of the deployed equipment cannot be guaranteed. Hence, the security of wireless sensor networks has become a significant challenge for researchers, particularly in WMSN because medical data, security, and privacy issues are more serious considering key patient private information. A few challenges need to be overcome to exploit the entire mechanism and run it efficiently. Maintaining the integrity of the medical data gathered from sensor nodes, providing only legitimate users with secure access to these data, and preventing misuse of data transmitted through public channels are the main challenges that need to be addressed and must be handled carefully. The integrity and confidentiality of data transmitted between the parties must be guaranteed [20].To establish trust between communication parties and prevent counterfeiting, it is necessary to provide a unique identification [21] and authentication [22] to each user or fog node in the system. In addition, data transmitted through public channels and stored in fog nodes or cloud servers need to be encrypted to ensure data security and privacy [23–25]. However, owing to the mobility of deployed fog nodes and terminal devices, it is not practical to share session keys between them in advance. The authenticated key agreement (AKA) [26–29] is a sufficient scheme for user or node authentication and generating public session keys; however, it is rarely used for fog computing.Recently, numerous AKA protocols [28–41] have been proposed in WSN, fog computing, and IoT environments. Turkanovic et al. [31] proposed an effective AKA scheme for heterogeneous WSNs, in which the user authenticates through the sensor node without communicating with the gateway node. However, Farash et al. [33] found that their protocol is vulnerable to theft attacks of smart cards and does not provide the untraceability and anonymity of sensor nodes to the user. Wang and Wang [32] indicated that the realization of anonymous authentication cannot be accomplished only through a symmetric cryptographic system. Therefore, it has always focused on designing AKA schemes based on asymmetry. Hayajneh et al. [34] proposed a lightweight authentication scheme based on the Rabin signature, which is used for the remote monitoring of patients by wireless sensor networks. In 2018, Amin et al. [35] proposed a lightweight AKA protocol that is applied to IoT devices in a distributed cloud computing environment. The mutual authentication between the user, service provider, and control server is implemented in their protocol, and a common session key is shared between the user and the server provider. In the scheme indicated above, only a symmetric cryptographic system is used to make the scheme highly efficient. Yeh et al. [30] proposed the first AKA elliptic curve cryptography (ECC) wireless sensor network solution, leading to other researchers proposing an increasing number of ECC-based AKA protocols [36, 41–46].Although several AKA schemes have been proposed for IoT environments, these protocols are rarely suitable for directly deployed fog computing environments. Hamid et al. [45] proposed a third-party single-round AKA protocol with bilinear pairing for this feature and indicated that it can ensure the privacy of medical data of the fog-based medical system. However, because the session key generated by this scheme is static, it cannot provide forward privacy. The key exchange mechanism of this scheme is based on Joux’s three-party Diffie–Hellman key exchange algorithm [43]; thus, it is also vulnerable to man-in-the-middle attacks. Recently, Jia et al. [46] proposed an AKA scheme for a fog-driven IoT healthcare system using bilinear pairs, in which the cloud server authenticates the IoT device as well as the fog node and generates a shared common session key between them. Based on the Bellare–Rogaway–Pointcheval (BRP) security model [42], they claim that the proposed scheme can resist various known attacks. Informal security analysis also indicates that this scheme retains user anonymity and untractability. Some important related works are summarized in Table 1.Table 1
The summary of authentication schemes.
SchemeCryptographic techniquesLimitationsRef. [31]Smart cardVulnerable to smart card theft attacksOne-way hash functionDoes not support anonymityDoes not support untraceabilityRef. [35]Symmetric encryptionDoes not support anonymityOne-way hash functionVulnerable to impersonation attacksElliptic curve cryptographyRef. [36]Bilinear pairingVulnerable to replay attacksOne-way hash functionDoes not support mutual authenticationSmart cardRef. [46]Elliptic curve cryptographyInsecure session key establishmentBilinear pairingDoes not support anonymityIdentity-based cryptographyRef. [41]Bilinear pairingVulnerable to impersonation attacksOne-way hash functionIn this study, we first analyzed Jia et al.’s scheme and revealed that it is vulnerable to a random number impersonation attack and key compromise impersonation attack. Then, we proposed an enhancement based on their proposal and remedied the shortcomings of their scheme. In our proposed scheme, the mutual authentication and key agreement between the three entities can be achieved only by one round of communication. After the cloud server verifies the identity of the IoT devices and fog nodes, it generates shared common session keys between them. For a security analysis, we adopted the BAN logic, ProVerif, and an informal security analysis. These approaches can provide evidence indicating that our improvement can resist several well-known security threats.


## 2. Cryptanalysis of Jia et al.’s AKA Scheme

### 2.1. Review of Jia et al.’s AKA Scheme

Here, we briefly review the scheme proposed by Jia et al. [46], which mainly consists of the following four phases: system setup, user registration, and fog node registration, as well as authentication and key agreement.


#### 2.1.1. System Setup

The cloud service provider (CSP) selects a nonsingular elliptic curve on the finite fieldFp, where p is a large prime number, and l=log2p is the security parameter. Let G be a cyclic group of order n generated by a base point P. Then, CSP selects a random s∈Zn∗ and computes Ppub=s⋅P. (G, P, Ppub) are published as the public system parameters, while s remains hidden. Six secure hash functions h0,h1,h2,h3,h4,h5, are selected by CSP, where h0:G1⟶0,1∗, h1:0,1∗×0,1∗⟶Zp∗, h2:0,1∗×Zp∗×Zn∗⟶Zp∗, h3:G1×Zp∗×G1×0,1∗×0,1∗×0,1∗×0,1∗⟶Zp∗, h4:G1×G1×G1×G1×0,1∗×0,1∗⟶Zp∗, and h5:G2×G1×G1×G1⟶Zp∗. We assume that the CSP is fully trusted and also holds a database to record registered users and fog nodes.


#### 2.1.2. User Registration

Ui inputs respective identity IDi and password PWi, and then computes RIDi = h1IDi‖PWi⊕ri, where ri ∈ Zp∗ is a random number chosen by Ui. Then, Ui sends (IDi, RIDi) to CSP via a secure channel. After receiving the Ui request, CSP randomly chooses xi∈Zp∗ and computes Ri = h2IDisxi⊕RIDi. The CSP then stores Ri in the smart card and the (IDi, xi) in its database and finally sends the smart card to the user over a secure channel. After the user receives the smart card, Ui calculates Ri∗ = Ri⊕ri and replaces Ri on the card with Ri∗.


#### 2.1.3. Fog Node Registration

Each fog nodeFN must be registered with the CSP before deployment. FN transmits its identity IDj to CSP. Then, CSP randomly selects yj∈Zp∗ and computes Rj=h2IDjsyj; CSP sends Rj to the fog node over a secure channel and stores (IDj, yj) into its database.


#### 2.1.4. Authentication and Key Agreement

In this phase, CSP can helpUi and FN to authenticate each other and establish a session key SK after executing the following steps:(a)
Ui randomly chooses a∈Zn∗ and computes A=a⋅P, A¯=a⋅Ppub, PIDi=IDi⊕h0A¯, Mi=h1IDi‖PWi⊕R∗, |Ni=h3A¯‖Mi‖A‖IDi‖IDj‖Tu|, where Tu is the current timestamp. Ui sends Msg1 = {A, PIDi, Ni, Tu} to FN.(b)
Upon receiving Msg1, FN first checks that the freshness of the timestamp Tu meets the requirements. Then, FN randomly selects b∈Zn∗ and calculates B=b⋅P, B¯=b⋅Ppub, PIDj=IDj⊕h0B¯, | Lj=h3B¯‖Rj‖A‖PIDj‖IDj‖Tf, where Tf is the current timestamp. Finally, FN sends Msg2 = {A, B,PIDi, PIDj,Ni, Lj, Tu, Tf} to the CSP.(c)
After receiving Msg2, CSP first checks the validity of two timestamps Tu, Tf and then executes the following steps:(i)
CSP computesA¯′=sA, B¯′=sB,IDi′ = PIDi⊕h0A¯′, and IDj′ = PIDj⊕h0B¯′.(ii)
CSP searches its database to find entries that match (IDi′, xi) and (IDj′, yj). If there are no matching entries, CSP denies the request and immediately terminates the session. Otherwise, CSP computes Mi′ = h2IDi′sxi, Rj′ = h2IDj′syi, Ni′ = h3A¯′Mi′AIDi′IDj′‖Tu, and Lj′ = h3B¯′Ri′AIDi′IDj′‖Tf.(iii)
CSP checks whetherNi = Ni′ and Lj = Lj′. If one of these equations is not true, the CSP rejects the request and terminates. Otherwise, it randomly chooses c∈Zn∗ and computes C=c⋅PAuthi=h4A‖B‖C‖A¯′IDi′Tc|Authj=h4A‖B‖C‖B¯′IDj′Tc, Kc=eA,BC, and SKc=h5Kc‖A‖B‖C; note, the current timestamp is Tc. Finally, CSP forwards Msg3 = {C, Authi, Authj, Tc to FNj.(d)
Upon receiving Msg3, FN checks the freshness of Tc and verifies whether Authj=h4A‖B‖C‖B¯IDjTc. If the equation is not true, FN terminates the session. Otherwise, FN calculates SKf=h5Kf‖A‖B‖C, where Kf=eA,Cb. Then, FN sends Msg4 = {B, C, Authi, Tc} to Ui.(e)
Upon receiving Msg4, Ui checks the freshness of Tc and verifies whether Authi=h4A‖B‖C‖A¯IDiTc. If not, Ui aborts the session. Otherwise, Ui computes SKu=h5Ku‖A‖B‖C, where Ku=eB,Ca.


### 2.2. Security Weakness of Jia et al.’s Scheme

#### 2.2.1. Known Session-Specific Temporary Information Attack

Here, we demonstrate that Jia et al.’s scheme suffered from a known session-specific temporary information attack. This attack is indicated in Canetti and Krawczyk’s (CK) adversary model [47]. We allow an attacker E to fully control the communications over the user, fog node, and CSP for “authentication and key agreement phase.” Thus, E can intercept the messages and obtain the hidden information of a current session from either side over a public channel, which enabled the recovery of key information from the session, such as the session key and the entity’s identity.(a)
Session key recovery. Based on the CK adversarial model, we may assume that an attacker E can obtain a random number a of users Ui. Note, E can also be intercepted A,B,PIDi,PIDj,Ni,Lj,Tu,Tf,C,Authi,Authj in the open channel. Then, E can compute SKu=h5A‖B‖C‖Ku, where Ku=eB,Ca. Note, we may assume that E can obtain b or c from FN and CSP. The session key SK can also be computed by eA,Cb and eA,Bc because SK=eB,Ca=eA,Cb=eA,Bc in Jia et al.’s scheme; note, a, b, and c are random numbers chosen by Ui,FN, and CSP, respectively.(b)
Identity recovery (anonymity violation). By the same assumption in (a), E can recover the Ui identity IDi=PIDi⊕h0A∗¯, where A∗¯=a⋅Ppub. Similarly, E can recover IDj=PIDj⊕h0B∗¯, where B∗¯=b⋅Ppub, while E obtains the FN random value b.


#### 2.2.2. Lack of Per-Verification

Step (a) of the authentication and key agreement phase lacks verifying the user inputIDi and PWi. This will increase the redundant computational cost, while the user inputs an incorrect IDi or PWi. The incorrect input will be identified by CSP in step (c) of the authentication and key agreement phase.


## 2.1. Review of Jia et al.’s AKA Scheme

Here, we briefly review the scheme proposed by Jia et al. [46], which mainly consists of the following four phases: system setup, user registration, and fog node registration, as well as authentication and key agreement.


### 2.1.1. System Setup

The cloud service provider (CSP) selects a nonsingular elliptic curve on the finite fieldFp, where p is a large prime number, and l=log2p is the security parameter. Let G be a cyclic group of order n generated by a base point P. Then, CSP selects a random s∈Zn∗ and computes Ppub=s⋅P. (G, P, Ppub) are published as the public system parameters, while s remains hidden. Six secure hash functions h0,h1,h2,h3,h4,h5, are selected by CSP, where h0:G1⟶0,1∗, h1:0,1∗×0,1∗⟶Zp∗, h2:0,1∗×Zp∗×Zn∗⟶Zp∗, h3:G1×Zp∗×G1×0,1∗×0,1∗×0,1∗×0,1∗⟶Zp∗, h4:G1×G1×G1×G1×0,1∗×0,1∗⟶Zp∗, and h5:G2×G1×G1×G1⟶Zp∗. We assume that the CSP is fully trusted and also holds a database to record registered users and fog nodes.


### 2.1.2. User Registration

Ui inputs respective identity IDi and password PWi, and then computes RIDi = h1IDi‖PWi⊕ri, where ri ∈ Zp∗ is a random number chosen by Ui. Then, Ui sends (IDi, RIDi) to CSP via a secure channel. After receiving the Ui request, CSP randomly chooses xi∈Zp∗ and computes Ri = h2IDisxi⊕RIDi. The CSP then stores Ri in the smart card and the (IDi, xi) in its database and finally sends the smart card to the user over a secure channel. After the user receives the smart card, Ui calculates Ri∗ = Ri⊕ri and replaces Ri on the card with Ri∗.


### 2.1.3. Fog Node Registration

Each fog nodeFN must be registered with the CSP before deployment. FN transmits its identity IDj to CSP. Then, CSP randomly selects yj∈Zp∗ and computes Rj=h2IDjsyj; CSP sends Rj to the fog node over a secure channel and stores (IDj, yj) into its database.


### 2.1.4. Authentication and Key Agreement

In this phase, CSP can helpUi and FN to authenticate each other and establish a session key SK after executing the following steps:(a)
Ui randomly chooses a∈Zn∗ and computes A=a⋅P, A¯=a⋅Ppub, PIDi=IDi⊕h0A¯, Mi=h1IDi‖PWi⊕R∗, |Ni=h3A¯‖Mi‖A‖IDi‖IDj‖Tu|, where Tu is the current timestamp. Ui sends Msg1 = {A, PIDi, Ni, Tu} to FN.(b)
Upon receiving Msg1, FN first checks that the freshness of the timestamp Tu meets the requirements. Then, FN randomly selects b∈Zn∗ and calculates B=b⋅P, B¯=b⋅Ppub, PIDj=IDj⊕h0B¯, | Lj=h3B¯‖Rj‖A‖PIDj‖IDj‖Tf, where Tf is the current timestamp. Finally, FN sends Msg2 = {A, B,PIDi, PIDj,Ni, Lj, Tu, Tf} to the CSP.(c)
After receiving Msg2, CSP first checks the validity of two timestamps Tu, Tf and then executes the following steps:(i)
CSP computesA¯′=sA, B¯′=sB,IDi′ = PIDi⊕h0A¯′, and IDj′ = PIDj⊕h0B¯′.(ii)
CSP searches its database to find entries that match (IDi′, xi) and (IDj′, yj). If there are no matching entries, CSP denies the request and immediately terminates the session. Otherwise, CSP computes Mi′ = h2IDi′sxi, Rj′ = h2IDj′syi, Ni′ = h3A¯′Mi′AIDi′IDj′‖Tu, and Lj′ = h3B¯′Ri′AIDi′IDj′‖Tf.(iii)
CSP checks whetherNi = Ni′ and Lj = Lj′. If one of these equations is not true, the CSP rejects the request and terminates. Otherwise, it randomly chooses c∈Zn∗ and computes C=c⋅PAuthi=h4A‖B‖C‖A¯′IDi′Tc|Authj=h4A‖B‖C‖B¯′IDj′Tc, Kc=eA,BC, and SKc=h5Kc‖A‖B‖C; note, the current timestamp is Tc. Finally, CSP forwards Msg3 = {C, Authi, Authj, Tc to FNj.(d)
Upon receiving Msg3, FN checks the freshness of Tc and verifies whether Authj=h4A‖B‖C‖B¯IDjTc. If the equation is not true, FN terminates the session. Otherwise, FN calculates SKf=h5Kf‖A‖B‖C, where Kf=eA,Cb. Then, FN sends Msg4 = {B, C, Authi, Tc} to Ui.(e)
Upon receiving Msg4, Ui checks the freshness of Tc and verifies whether Authi=h4A‖B‖C‖A¯IDiTc. If not, Ui aborts the session. Otherwise, Ui computes SKu=h5Ku‖A‖B‖C, where Ku=eB,Ca.


## 2.1.1. System Setup

The cloud service provider (CSP) selects a nonsingular elliptic curve on the finite fieldFp, where p is a large prime number, and l=log2p is the security parameter. Let G be a cyclic group of order n generated by a base point P. Then, CSP selects a random s∈Zn∗ and computes Ppub=s⋅P. (G, P, Ppub) are published as the public system parameters, while s remains hidden. Six secure hash functions h0,h1,h2,h3,h4,h5, are selected by CSP, where h0:G1⟶0,1∗, h1:0,1∗×0,1∗⟶Zp∗, h2:0,1∗×Zp∗×Zn∗⟶Zp∗, h3:G1×Zp∗×G1×0,1∗×0,1∗×0,1∗×0,1∗⟶Zp∗, h4:G1×G1×G1×G1×0,1∗×0,1∗⟶Zp∗, and h5:G2×G1×G1×G1⟶Zp∗. We assume that the CSP is fully trusted and also holds a database to record registered users and fog nodes.


## 2.1.2. User Registration

Ui inputs respective identity IDi and password PWi, and then computes RIDi = h1IDi‖PWi⊕ri, where ri ∈ Zp∗ is a random number chosen by Ui. Then, Ui sends (IDi, RIDi) to CSP via a secure channel. After receiving the Ui request, CSP randomly chooses xi∈Zp∗ and computes Ri = h2IDisxi⊕RIDi. The CSP then stores Ri in the smart card and the (IDi, xi) in its database and finally sends the smart card to the user over a secure channel. After the user receives the smart card, Ui calculates Ri∗ = Ri⊕ri and replaces Ri on the card with Ri∗.


## 2.1.3. Fog Node Registration

Each fog nodeFN must be registered with the CSP before deployment. FN transmits its identity IDj to CSP. Then, CSP randomly selects yj∈Zp∗ and computes Rj=h2IDjsyj; CSP sends Rj to the fog node over a secure channel and stores (IDj, yj) into its database.


## 2.1.4. Authentication and Key Agreement

In this phase, CSP can helpUi and FN to authenticate each other and establish a session key SK after executing the following steps:(a)
Ui randomly chooses a∈Zn∗ and computes A=a⋅P, A¯=a⋅Ppub, PIDi=IDi⊕h0A¯, Mi=h1IDi‖PWi⊕R∗, |Ni=h3A¯‖Mi‖A‖IDi‖IDj‖Tu|, where Tu is the current timestamp. Ui sends Msg1 = {A, PIDi, Ni, Tu} to FN.(b)
Upon receiving Msg1, FN first checks that the freshness of the timestamp Tu meets the requirements. Then, FN randomly selects b∈Zn∗ and calculates B=b⋅P, B¯=b⋅Ppub, PIDj=IDj⊕h0B¯, | Lj=h3B¯‖Rj‖A‖PIDj‖IDj‖Tf, where Tf is the current timestamp. Finally, FN sends Msg2 = {A, B,PIDi, PIDj,Ni, Lj, Tu, Tf} to the CSP.(c)
After receiving Msg2, CSP first checks the validity of two timestamps Tu, Tf and then executes the following steps:(i)
CSP computesA¯′=sA, B¯′=sB,IDi′ = PIDi⊕h0A¯′, and IDj′ = PIDj⊕h0B¯′.(ii)
CSP searches its database to find entries that match (IDi′, xi) and (IDj′, yj). If there are no matching entries, CSP denies the request and immediately terminates the session. Otherwise, CSP computes Mi′ = h2IDi′sxi, Rj′ = h2IDj′syi, Ni′ = h3A¯′Mi′AIDi′IDj′‖Tu, and Lj′ = h3B¯′Ri′AIDi′IDj′‖Tf.(iii)
CSP checks whetherNi = Ni′ and Lj = Lj′. If one of these equations is not true, the CSP rejects the request and terminates. Otherwise, it randomly chooses c∈Zn∗ and computes C=c⋅PAuthi=h4A‖B‖C‖A¯′IDi′Tc|Authj=h4A‖B‖C‖B¯′IDj′Tc, Kc=eA,BC, and SKc=h5Kc‖A‖B‖C; note, the current timestamp is Tc. Finally, CSP forwards Msg3 = {C, Authi, Authj, Tc to FNj.(d)
Upon receiving Msg3, FN checks the freshness of Tc and verifies whether Authj=h4A‖B‖C‖B¯IDjTc. If the equation is not true, FN terminates the session. Otherwise, FN calculates SKf=h5Kf‖A‖B‖C, where Kf=eA,Cb. Then, FN sends Msg4 = {B, C, Authi, Tc} to Ui.(e)
Upon receiving Msg4, Ui checks the freshness of Tc and verifies whether Authi=h4A‖B‖C‖A¯IDiTc. If not, Ui aborts the session. Otherwise, Ui computes SKu=h5Ku‖A‖B‖C, where Ku=eB,Ca.


## 2.2. Security Weakness of Jia et al.’s Scheme

### 2.2.1. Known Session-Specific Temporary Information Attack

Here, we demonstrate that Jia et al.’s scheme suffered from a known session-specific temporary information attack. This attack is indicated in Canetti and Krawczyk’s (CK) adversary model [47]. We allow an attacker E to fully control the communications over the user, fog node, and CSP for “authentication and key agreement phase.” Thus, E can intercept the messages and obtain the hidden information of a current session from either side over a public channel, which enabled the recovery of key information from the session, such as the session key and the entity’s identity.(a)
Session key recovery. Based on the CK adversarial model, we may assume that an attacker E can obtain a random number a of users Ui. Note, E can also be intercepted A,B,PIDi,PIDj,Ni,Lj,Tu,Tf,C,Authi,Authj in the open channel. Then, E can compute SKu=h5A‖B‖C‖Ku, where Ku=eB,Ca. Note, we may assume that E can obtain b or c from FN and CSP. The session key SK can also be computed by eA,Cb and eA,Bc because SK=eB,Ca=eA,Cb=eA,Bc in Jia et al.’s scheme; note, a, b, and c are random numbers chosen by Ui,FN, and CSP, respectively.(b)
Identity recovery (anonymity violation). By the same assumption in (a), E can recover the Ui identity IDi=PIDi⊕h0A∗¯, where A∗¯=a⋅Ppub. Similarly, E can recover IDj=PIDj⊕h0B∗¯, where B∗¯=b⋅Ppub, while E obtains the FN random value b.


### 2.2.2. Lack of Per-Verification

Step (a) of the authentication and key agreement phase lacks verifying the user inputIDi and PWi. This will increase the redundant computational cost, while the user inputs an incorrect IDi or PWi. The incorrect input will be identified by CSP in step (c) of the authentication and key agreement phase.


## 2.2.1. Known Session-Specific Temporary Information Attack

Here, we demonstrate that Jia et al.’s scheme suffered from a known session-specific temporary information attack. This attack is indicated in Canetti and Krawczyk’s (CK) adversary model [47]. We allow an attacker E to fully control the communications over the user, fog node, and CSP for “authentication and key agreement phase.” Thus, E can intercept the messages and obtain the hidden information of a current session from either side over a public channel, which enabled the recovery of key information from the session, such as the session key and the entity’s identity.(a)
Session key recovery. Based on the CK adversarial model, we may assume that an attacker E can obtain a random number a of users Ui. Note, E can also be intercepted A,B,PIDi,PIDj,Ni,Lj,Tu,Tf,C,Authi,Authj in the open channel. Then, E can compute SKu=h5A‖B‖C‖Ku, where Ku=eB,Ca. Note, we may assume that E can obtain b or c from FN and CSP. The session key SK can also be computed by eA,Cb and eA,Bc because SK=eB,Ca=eA,Cb=eA,Bc in Jia et al.’s scheme; note, a, b, and c are random numbers chosen by Ui,FN, and CSP, respectively.(b)
Identity recovery (anonymity violation). By the same assumption in (a), E can recover the Ui identity IDi=PIDi⊕h0A∗¯, where A∗¯=a⋅Ppub. Similarly, E can recover IDj=PIDj⊕h0B∗¯, where B∗¯=b⋅Ppub, while E obtains the FN random value b.


## 2.2.2. Lack of Per-Verification

Step (a) of the authentication and key agreement phase lacks verifying the user inputIDi and PWi. This will increase the redundant computational cost, while the user inputs an incorrect IDi or PWi. The incorrect input will be identified by CSP in step (c) of the authentication and key agreement phase.


## 3. Our Improved Scheme

In this section, we propose an improvement based on Jia et al.’s scheme to overcome the previously indicated security weaknesses in Section2. In our improvement, the system setup is the same as in Jia et al.’s scheme.


### 3.1. Modified User Registration

This phase is depicted in Figure2.(a)
Ui randomly chooses ri∈Zp∗, inputs the password PWi and the identity IDi to compute RIDi=h1IDi‖PWi⊕ri. Then, Ui sends (IDi, RIDi) to CSP via a secure channel.(b)
After receivingIDi,RIDi, CSP randomly chooses xi∈Zp∗ and computes qi=h2IDisxi, Ri=qi⊕RIDi,Di=h2qi‖IDi⊕RIDi. The CSP then stores (Ri, Di) in the smart card and the (IDi, xi) in its own database and finally sends the smart card to the user over a secure channel.(c)
After the user receives the smart card,Ui calculates Ri∗=Ri⊕ri, Vi=Di⊕ri, and replaces Ri, Di with Ri∗ and Vi.Figure 2
Modified user registration phase.


### 3.2. Modified Fog Node Registration

FN transmits its identity IDj to the CSP. It randomly selects yj∈Zp∗ and computes gj=h2IDjsyj. Then, CSP sends gj to the fog node via a secure channel and stores (IDj, yj) in its own database. This phase is shown in Figure 3.Figure 3
Modified fog node registration phase.


### 3.3. Modified Authentication and Key Agreement

This phase is depicted in Figure4.(a)
Ui inputs IDi and PWi and computes qi=Ri∗⊕h1IDi‖PWi, Vi∗=h2qi‖IDi⊕h1IDi‖PWi. Then, whether Vi∗=Vi is checked. If the equation is true, Ui randomly chooses a∈Zn∗ and computes vu=a⋅qi, A=vu⋅P, A¯=vu⋅Ppub,PIDi=IDi⊕h0A¯, Mi=qi=h1IDi‖PWi⊕R∗, Ni=h3A¯MiAIDiIDj‖Tu, where Tu is the current timestamp. Finally, Ui sends Msg1=A,PIDi,Ni,Tu to FN.(b)
Upon receivingMsg1, FN first checks that the freshness of the timestamp Tu meets the requirements. Then, it randomly selects b∈Zn∗ and calculates vf=b⋅gj, B=vf⋅P, B¯=vf⋅Ppub, PIDj=IDj⊕h0B¯, Lj=h3B¯RjAPIDjIDj‖Tf, where Tf is the current timestamp. Finally, FN forwards Msg2=A,B,PIDi,PIDj,Ni,Lj,Tu,Tf to the CSP.(c)
After receivingMsg2, CSP first checks the validity of two timestamps Tu, Tf and then executes the following steps:(i)
To computeA¯′=s⋅A, B¯′=s⋅B, IDi′=PIDi⊕h0A¯′, IDj′=PIDj⊕h0B¯′ and then searches for (IDi′, xi) and (IDj′, yj) in its database. If there are no matching entries, CSP denies the request and immediately terminates the session.(ii)
To computeMi′=h2IDi′sxi, Rj′=h2IDj′syi, Ni′=h3A¯′Mi′AIDi′IDj′‖Tu, and Lj′=h3B¯′Rj′APIDj′IDj′‖Tf. Then, it checks whether Ni=Ni′ and Lj=Lj′. If one of these equations is not true, the CSP rejects the request and terminates.(iii)
CSP randomly choosesc∈Zn∗ and computes zc=h2yisxi, vc=c⋅zc, C=vc⋅P, Authi=h4ABCA¯′IDi′‖Tc, Authj=h4ABCB¯′IDj′‖Tc, Kc=eA,Bvc, SKc=h5KcAB‖C, where Tc is the current timestamp. Finally, CSP sends Msg3=C,Authi,Authj,Tc to FN.(d)
Upon receivingMsg3=C,Authi,Authj,Tc, FN checks the freshness of Tc and verifies whether Authj=h4A‖B‖C‖B¯IDjTc. If the equation is not true, then FN immediately terminates the session. Otherwise,FN calculates Kf=eA,Cvf, SKf=h5KfAB‖C, and forwards Msg4=B,C,Authi,Tc to Ui.(e)
Upon receivingMsg4, Ui checks the freshness of Tc and verifies if Authi=h4A‖B‖C‖A¯IDiTc. If the equation is not true, Ui immediately terminates the session. Otherwise, Ui calculates Ku=eA,Cvu, SKu=h5KuAB‖C.Figure 4
Modified authentication and key agreement phase.


## 3.1. Modified User Registration

This phase is depicted in Figure2.(a)
Ui randomly chooses ri∈Zp∗, inputs the password PWi and the identity IDi to compute RIDi=h1IDi‖PWi⊕ri. Then, Ui sends (IDi, RIDi) to CSP via a secure channel.(b)
After receivingIDi,RIDi, CSP randomly chooses xi∈Zp∗ and computes qi=h2IDisxi, Ri=qi⊕RIDi,Di=h2qi‖IDi⊕RIDi. The CSP then stores (Ri, Di) in the smart card and the (IDi, xi) in its own database and finally sends the smart card to the user over a secure channel.(c)
After the user receives the smart card,Ui calculates Ri∗=Ri⊕ri, Vi=Di⊕ri, and replaces Ri, Di with Ri∗ and Vi.Figure 2
Modified user registration phase.


## 3.2. Modified Fog Node Registration

FN transmits its identity IDj to the CSP. It randomly selects yj∈Zp∗ and computes gj=h2IDjsyj. Then, CSP sends gj to the fog node via a secure channel and stores (IDj, yj) in its own database. This phase is shown in Figure 3.Figure 3
Modified fog node registration phase.


## 3.3. Modified Authentication and Key Agreement

This phase is depicted in Figure4.(a)
Ui inputs IDi and PWi and computes qi=Ri∗⊕h1IDi‖PWi, Vi∗=h2qi‖IDi⊕h1IDi‖PWi. Then, whether Vi∗=Vi is checked. If the equation is true, Ui randomly chooses a∈Zn∗ and computes vu=a⋅qi, A=vu⋅P, A¯=vu⋅Ppub,PIDi=IDi⊕h0A¯, Mi=qi=h1IDi‖PWi⊕R∗, Ni=h3A¯MiAIDiIDj‖Tu, where Tu is the current timestamp. Finally, Ui sends Msg1=A,PIDi,Ni,Tu to FN.(b)
Upon receivingMsg1, FN first checks that the freshness of the timestamp Tu meets the requirements. Then, it randomly selects b∈Zn∗ and calculates vf=b⋅gj, B=vf⋅P, B¯=vf⋅Ppub, PIDj=IDj⊕h0B¯, Lj=h3B¯RjAPIDjIDj‖Tf, where Tf is the current timestamp. Finally, FN forwards Msg2=A,B,PIDi,PIDj,Ni,Lj,Tu,Tf to the CSP.(c)
After receivingMsg2, CSP first checks the validity of two timestamps Tu, Tf and then executes the following steps:(i)
To computeA¯′=s⋅A, B¯′=s⋅B, IDi′=PIDi⊕h0A¯′, IDj′=PIDj⊕h0B¯′ and then searches for (IDi′, xi) and (IDj′, yj) in its database. If there are no matching entries, CSP denies the request and immediately terminates the session.(ii)
To computeMi′=h2IDi′sxi, Rj′=h2IDj′syi, Ni′=h3A¯′Mi′AIDi′IDj′‖Tu, and Lj′=h3B¯′Rj′APIDj′IDj′‖Tf. Then, it checks whether Ni=Ni′ and Lj=Lj′. If one of these equations is not true, the CSP rejects the request and terminates.(iii)
CSP randomly choosesc∈Zn∗ and computes zc=h2yisxi, vc=c⋅zc, C=vc⋅P, Authi=h4ABCA¯′IDi′‖Tc, Authj=h4ABCB¯′IDj′‖Tc, Kc=eA,Bvc, SKc=h5KcAB‖C, where Tc is the current timestamp. Finally, CSP sends Msg3=C,Authi,Authj,Tc to FN.(d)
Upon receivingMsg3=C,Authi,Authj,Tc, FN checks the freshness of Tc and verifies whether Authj=h4A‖B‖C‖B¯IDjTc. If the equation is not true, then FN immediately terminates the session. Otherwise,FN calculates Kf=eA,Cvf, SKf=h5KfAB‖C, and forwards Msg4=B,C,Authi,Tc to Ui.(e)
Upon receivingMsg4, Ui checks the freshness of Tc and verifies if Authi=h4A‖B‖C‖A¯IDiTc. If the equation is not true, Ui immediately terminates the session. Otherwise, Ui calculates Ku=eA,Cvu, SKu=h5KuAB‖C.Figure 4
Modified authentication and key agreement phase.


## 4. Security Analysis of Our Improved Scheme

In this section, the security of our scheme is illustrated by the BAN logic, ProVerif, and an informal security analysis.


### 4.1. Formal Security Analysis Using BAN Logic

In this subsection, the sharing sessionSK calculated by CSP between Ui, FN, and CSP is presented, which can be used to send request information to the server when the user wants to obtain data from the server. Note, the following notations and rules for the BAN logic can be found in previous studies [33, 35, 39, 48].


#### 4.1.1. Related Rules

Messages meaning ruleA|≡A↔KB,A⊲XK/A|≡B∼X: if principal A believes that hidden K value is shared between principals A and B, and A receives the message X enciphered with K and then A believes that B is the sender of X.Nonce verification ruleA|≡#X,A|≡B∼X/A|≡B|≡X: if A believes that message X is fresh and that B has sent X, then A believes that B also believes in message X.Jurisdiction ruleA|≡B|⇒X,A|≡B|≡X/A|≡X: if A believes that B has jurisdiction over X and that B believes on statement X, then A believes on X.Session key introduction ruleA|≡#X,A|≡B|≡X/A|≡A↔KB: if A believes that message X is fresh and that B also believes on X, then A believes they share the session key.Belief ruleA|≡B|≡XY/A|≡B|≡X: if A believes that B believes formula (X, Y), then A believes that B also believes the X or Y part of the formula.


#### 4.1.2. Goals

GOAL 1:Ui|≡Ui↔SKFNGOAL 2:Ui|≡FN|≡Ui↔SKFNGOAL 3:FN|≡Ui↔SKFNGOAL 4:FN|≡Ui|≡Ui↔SKFNGOAL 5:CSP|≡Ui↔SKFNGOAL 6:CSP|≡Ui|≡Ui↔SKFNGOAL 7:CSP|≡FN|≡Ui↔SKFN


#### 4.1.3. Idealize the Communication Messages

Msg1Ui⟶FN:A,PIDi,Ni,TuMsg2FN⟶CSP:B,PIDj,Lj,Tf,A,PIDi,Ni,TuMsg3Ui⟶CSP:A,PIDi,Ni,TuMsg4CSP⟶FN:Authj,C,TcMsg5CSP⟶Ui:Authi,C,TcMsg6FN⟶Ui:B,Authi,C,Tc


#### 4.1.4. Initial State Assumptions

A1:Ui|≡#aA2:Ui|≡#AA3:Ui|≡AA4:Ui|≡#BA5:Ui|≡#CA6:FN|≡#bA7:FN|≡#BA8:FN|≡BA9:FN|≡#AA10:FN|≡#CA11:CSP|≡#cA12:CSP|≡#CA13:CSP|≡CA14:CSP|≡#AA15:CSP|≡#BA16:Ui|≡Ui↔IDjFNA17:Ui|≡Ui↔IDi,PIDi,RiCSPA 18:Ui|≡FN=>BA 19:Ui|≡CSP=>CA 20:FN|≡Ui↔IDjFNA 21:FN|≡FN↔IDj,gjCSPA 22:FN|≡Ui=>AA 23:FN|≡CSP=>CA 24:CSP|≡Ui↔IDi,PIDi,RiCSPαA 25:CSP|≡FN↔IDj,gjCSPA 26:CSP|≡FN=>BA 27:CSP|≡Ui=>AIfa is a random number chosen by Ui, we can obtain A1and A2; when Msg1 sends form Ui to FN, A22 is obtained. From A22, we obtain A9; when Msg3 sends form Ui to CSP, we obtain A27. From A27, we obtain A14. Similarly, because b is a random number chosen by FN, we obtain A6 and A7; when Msg6 sends from FN to Ui, we obtain A18. From A18, we obtain A4; when Msg2 sends from FN to CSP, we obtain A26. From A26, we obtain A15. c is a random number chosen by CSP; we obtain A26 and A27; when Msg5 sends from CSP to Ui, we obtain A19. From A19, we obtain A5; when Msg4 sends from CSP to FN, we obtain A23. From A23, we obtain A10.


#### 4.1.5. Main Proofs Using BAN Rules and Assumptions

(1) For GOAL 1 and GOAL 2. From message Msg6 and using the seeing rule, we obtain S1: Ui⊲B,Authi,C,Tc. Using the seeing rule, we obtain S2: Ui⊲B. Using A16, S2, and the message meaning rule, we obtain S3: Ui≡FN∼B. Using A4, S3, and the nonce verification rule, we obtain S4: Ui|≡FN|≡B. Using A18, S4, and the jurisdiction rule, we obtain S5: Ui|≡B. Based on message Msg5 and the seeing rule, we obtain S6: Ui⊲Authi,C,Tc. Using the seeing rule, we obtain S7: Ui⊲C. According to A17, S7, and the message meaning rule, we have S8: Ui|≡CSP|∼C. Using A5, S8, and the nonce verification rule, we obtain S9: Ui|≡CSP|≡C. Using A19, S9, and the jurisdiction rule, we obtain S10: Ui|≡C. Based on A2, A4, A5, A3, S5, S10, and the belief rule, we obtain S11: Ui|≡#A,B,C and S12: Ui|≡A,B,C. Because A=vuP,B=vfP,C=vcP, we can obtain S13: Ui|≡vu,vf,vc. Because Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, SKu=SKf=SKc=h5KuAB‖C=h5KfAB‖C=h5KcAB‖C. Using A2, A16, S12, S13, and the belief rule, we obtain S14: Ui|≡Ui↔SKFN (GOAL 1).Using A2, S14, and the session key introduction rule, we obtain S15:Ui|≡FN|≡Ui↔SKFN (GOAL 2).(2) For GOAL 3 and GOAL 4. From message Msg1 and using the seeing rule, we obtain S16: FN⊲A,PIDi,Ni,Tu. Using the seeing rule, we obtain S17: FN⊲A. According to A20, S17, and the message meaning rule, we have S18: FN|≡Ui|∼A. Employing A9, S18, and the nonce verification rule, we obtain S19: FN|≡Ui|≡A. Using A22, S19, and the jurisdiction rule, we have S20: FN|≡A. From message Msg4 and using the seeing rule, we have S21: FN⊲Authj,C,Tc. We obtain S22: FN⊲C via the seeing rule. According to A21, S22, and the message meaning rule, we obtain S23: FN|≡CSP|∼C. Using A10, S23, and the nonce verification rule, we obtain S24: FN|≡CSP|≡C. According to A23, S24, and the jurisdiction rule, we have S25: FN|≡C. According to A7, A10, A9, A8, S20, S25, and the belief rule, we obtain S26: FN|≡#A,B,C and S27: FN|≡A,B,C. Because A=vuP,B=vfP,C=vcP, we can obtain S28: FN|≡vu,vf,vc. Using A7, A20, S27, S28, and the belief rule, we obtain S29: FN|≡Ui↔SKFN (GOAL 3).By using A7, S29, and the session key introduction rule, we obtain S30:FN|≡Ui|≡Ui↔SKFN (GOAL 4).(3) For GOAL 5, GOAL 6, and GOAL 7. According to Msg2 and using the seeing rule, we obtain S31: CSP⊲B,PIDj,Lj,Tf,A,PIDi,Ni,Tu. Using the seeing rule, we obtain S32: CSP⊲B. Using A25, S32, and the message meaning rule, we obtain S33: CSP|≡FN|∼B. Using A15, S33, and the nonce verification rule, we obtain S34: CSP|≡FN|≡B. Using A26, S34, and the jurisdiction rule, we obtain S35: CSP|≡B. Based on Msg3 and the seeing rule, we obtain S36: CSP⊲A,PIDi,Ni,Tu. We have S37: CSP⊲A via the seeing rule. According to A24, S37, and the message meaning rule, we obtain S38: CSP|≡Ui|∼A. Using A14, S38, and the nonce verification rule, we obtain S39: CSP|≡Ui|≡A. According to A27, S39, and the jurisdiction rule, we obtain S40: CSP|≡A. According to A14, A12, A15, A13, S35, S40, and the belief rule, we obtain S41: CSP|≡#A,B,C and S42: CSP|≡A,B,C. Because A=vuP,B=vfP,A=vcP, we can obtain S43: Ui|≡vu,vf,vc. Using A12, S42, S43, and the belief rule, we obtain S44: CSP|≡Ui↔SKFN (GOAL 5).Using A14, S44, and the session key introduction rule, we obtain S45:CSP|≡Ui|≡Ui↔SKFN (GOAL 6).Using A15, S44, and the session key introduction rule, we obtain S46:CSP|≡FN|≡Ui↔SKFN (GOAL 7).


### 4.2. Informal Security Analysis

In this section, we demonstrate that our improved scheme can achieve the following well-known security requirements.


#### 4.2.1. Known Session-Specific Temporary Information Attacks

The session keySKu=SKf=SKc=h5KuAB‖C=h5KfAB‖C=h5KcAB‖C is generated utilizing the hidden values of Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, and vu=aqi, vf=bgj, vc=czc; (A, B, C) can be intercepted on an open channel, but adversaries do not know (qi, gj, zc) because they are the hidden values of Ui, FN, and CSP, respectively, and, thus, cannot calculate (vu, vf, vc). Therefore, despite adversaries determining (a, b, c), they cannot calculate (Ku,Kf,Kc) without (qi, gj, zc). Therefore, an opponent cannot recover SK using temporarily leaked session-specific information {a, b, c}.(qi, gj) are the hidden values of Ui, and FN, respectively; if only (a, b) is found, but not (qi, gj), the adversaries cannot calculate vu=aqi, vf=bgj. A¯=vuPpub, B¯=vfPpub, PIDi=IDi⊕h0A¯, PIDj=IDj⊕h0B¯; PIDi,PIDj can be intercepted on an open channel, but adversaries cannot retrieve IDi=PIDi⊕h0A¯ and IDj=PIDj⊕h0B¯ without (vu, vf). If adversaries intercept (A, B) on an open channel, they do not know the key s of the CSP and, thus, cannot calculate A¯′=sA and B¯′=sB, or retrieve IDi=PIDi⊕h0A¯′, IDj=PIDj⊕h0B¯′ without s.


#### 4.2.2. Mutual Authentication

CSP authenticatesUi by verifying whether IDi′ equals to the IDi saved in the CSP database and whether Ni′ equals to Ni, Ni sent from Ui. Ui authenticates CSP by verifying whether Authi′ equals to Authi=h4A‖B‖C‖A¯′IDi′Tc, which includes C calculated by CSP.Similarly, CSP authenticatesFN by verifying whether IDj′ equals to the IDj saved in the CSP database and whether Lj′ equals Lj, Lj sent from FN. FN authenticates CSP by verifying whether Authj′ equals to Authj=h4A‖B‖C‖B¯′IDj′Tc, which includes C calculated by CSP.FN authenticates Ui by verifying whether Authj′ equals to Authj which includes A calculated by Ui, and Ui authenticates FN by verifying whether Authi′ equals to Authi=h4A‖B‖C‖A¯′IDi′Tc, which includes B calculated by FN.


#### 4.2.3. Impersonation Attack

To impersonate a legitimate user, the adversary has to obtain the identityIDi, password PWi, and qi=h2IDisxi of Ui or construct A=vuP, PIDi=IDi⊕h0A¯, and Ni=h3A¯‖Mi‖A‖IDi‖IDj‖Tu‖. First, the opponent is unable to guess the correct identity and password of Ui through “password-guessing attack.” Second, to construct {A, PIDi,Ni}, the adversary has to obtain the key s and parameter xi. However, it cannot compute qi without IDi, s, and xi, which are crucial for computing {A,PIDi,Ni}. Thus, the adversary cannot impersonate a legitimate user.Similarly, to mimic a legitimate fog node, the opponent must obtain the identityIDj and qj=h2IDjsxj of FN or construct B=vfP,PIDj=IDj⊕h0B¯, and Lj=h3B¯‖gj‖A‖IDj‖IDj‖Tf‖; the adversary can obtain the identity IDj, but it is impossible for the adversary to determine gj=h2IDjsyj, which is computed and assigned by CSP in FN registration. gj cannot be computed without s and yj, which are crucial for computing {B, PIDj,Lj}. Thus, the adversary cannot impersonate a legitimate FN.The adversary is also unable to impersonate CSP. To computeC=vcP, Authi=h4A‖B‖C‖A¯′IDi′Tc, and Authj=h4A‖B‖C‖B¯′IDj′Tc, s, xi, and yj are required to compute C=vcP=h2yisxicP. However, the adversary cannot obtain C unless it obtains all three factors at the same time. This is beyond the capacity of an adversary. Thus, the adversary cannot impersonate CSP.


#### 4.2.4. Man-in-the-Middle Attacks

If the adversary obtains Msg1 or Msg2 from the public channel and modifies Msg1 or Msg2 to launch a man-in-the-middle attack, the identity authentication of CSP cannot be passed; the premise of the authentication of CSP is to determine the identity ofUi and FN. From “(2),”we know that CSP will compute IDi′ and IDj′ and compare the values with IDi and IDj saved in the CSP database; if it is not equal, the session will immediately be terminated. From “(1),” we know that the adversary cannot obtain IDi and IDj. Meanwhile, from “(3),” we also know that the adversary cannot obtain the values of s,xi, and yj. Thus, the modified messages cannot pass the verification of Ni′ = Ni and Lj′ = Lj from CSP.If the adversary obtains Msg3 or Msg4 from the open channel and modifies Msg3 or Msg4 to launch the man-in-the-middle attack, the authentication fromUi and FN will still not be passed. As indicated by “(2),” we can see that if the messages are modified by the adversary, they cannot pass the verification of Authi′ = Authi and Authj′ = Authj from Ui and FN.


#### 4.2.5. Known Session Key Attacks

A scheme is considered vulnerable to known session key attacks if an adversary wants to use the old compromised session key to obtain sensitive parameters and keys for subsequent communication sessions. In our scheme,SKu=SKf=SKc=h5KuAB‖C=h5KfAB‖C=h5KcAB‖C, Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, A=vuP,B=vfP,C=vcP, vu=aqi, vf=bgj, vc=czc, is refreshed using random numbers {a, b, c} and the attacker does not know {qi, gj, zc}. Thus, owing to the computational difficulty of the elliptic curve Diffie–Hellman problem, it is impossible for the attacker to obtain the new SK information from the old SK and extract {a, b, c} from {A, B, C}; thus, the scheme we proposed can withstand the known session key attack.


#### 4.2.6. Compromise Impersonation Attacks

If the CSP long-term keys is compromised, the adversary may use s to impersonate a legitimate user to determine FN and CSP. However, all attack sessions are terminated immediately, as follows. In a worst case scenario, the adversary may have access to the data Ri∗ = h2IDisxi⊕h1IDi‖PWi,Vi=h2h2IDisxi‖IDi⊕h1IDi‖PWi, in the stolen smart card SC. Despite knowing s, the adversary does not know the hidden values of {IDi, xi,PWi} to compute h2IDisxi = Ri∗⊕h1IDi‖PWi or qi=h2IDisxi directly. Thus, the adversary cannot generate Msg1 = A,PIDi,Ni,Tu to masquerade Ui to launch a new session.The adversary may intercept messages sent byUi during authentication and key negotiation and attempt to impersonate the initiator of the session. However, the session will terminate immediately because the attacker cannot calculate Ku=eB,Cvu correctly without knowing the hidden values of a,qi, despite knowing s.


#### 4.2.7. Parallel Session Attacks

When the entity is in session, the adversary may try to replay the old messages to launch a new session attack; however, this is impossible. When an attacker replays {M1, M2} to CSP, it can pass the verification ofNi′=h3A¯′‖Mi′‖AIDi′IDj′‖Tu, Lj′=h3B¯′‖Rj′‖AIDi′IDj′‖Tf. However, because the attacker does not know {a, b} and {qi, gj}, it cannot compute one of Ku=h5KuAB‖C, Kf=h5KfAB‖C, Ku=Kf=eB,Cvu=eA,Cvf, and vu=aqi, vf=bgj, and the attacker session is immediately aborted.


#### 4.2.8. Stolen Smart Card Attacks

If an attacker steals the smart card and extractsRi∗ = h2IDisxi⊕h1IDi‖PWi, Vi=h2h2IDisxi‖IDi⊕h1IDi‖PWi, he/she may impersonate Ui to FN and CSP. However, the attacker does not know the sensitive parameter {IDi, PWi, xi, s} to generate the initiator message PIDi=IDi⊕h0A¯, Ni=h3A¯‖Mi‖AIDiIDj‖Tu, thus cannot impersonate Ui to FN and CSP. Hence, the proposed scheme can withstand stolen smart card attacks.


#### 4.2.9. Password-Guessing Attacks

If an adversary obtains information regarding {A, B, PIDi, PIDj, Ni, Lj, C, Authi, Authj, Tu, Tf,Tc} from the open channel, online password-guessing attacks may be launched. However, the adversary will fail because A=vuP, PIDi=IDi⊕h0A¯, Ni=h3A¯‖Mi‖AIDiIDj‖Tu, B=vfP, PIDj=IDj⊕h0B¯, Lj=h3B¯‖gj‖A‖PIDj‖IDj‖Tf‖, C=vcP, Authi=h4A‖B‖C‖A¯′IDi′Tc, Authj=h4A‖B‖C‖B¯′IDj′Tc, and PWi are not included in these values. Therefore, PWi remains secure.If the smart card is compromised by an opponent, the parameter {Ri∗,Vi} in the SC can be obtained through the power analysis attack method, and then off-line dictionary attacks can be made based on the relevant parameter Ri∗=h2IDisxi⊕h1IDi‖PWi, Vi=h2h2IDisxi‖IDi⊕h1IDi‖PWi, to guess the user password. However, because the values {xi, s} are only known by the CSP, the opponent cannot verify the accuracy of the guess value; therefore, all sensitive parameters are safe.


#### 4.2.10. Privileged-Insider Attacks

When the attacker obtainsUi′ registration information (IDi, RIDi, xi) and the key s of CSP, the intent is to compute the session key SKu=SKf=SKc=h5Ku‖A‖B‖C=h5Kf‖A‖B‖C=h5Kc‖A‖B‖C, which is randomized using {a, b, c} and {qi, gj, zc}. By Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc and vu=aqi, vf=bgj, vc=czc, the attacker can compute qi=h2IDisxi and obtain (A, B, C) from the public channel. However, (a, b, c) are random numbers independently selected by Ui, FN, and CSP, respectively, and are not available to the attacker; therefore, vu and SKu cannot be computed.Similarly, when the attacker obtains theFN registration information (IDj, yj) and the key s of CSP, the intent is to compute the session key SKf; the attacker can compute gj=h2IDjsyj and obtain (A, B, C) from the public channel. However, (a, b, c) are random numbers independently selected by Ui, FN, and CSP, respectively, and are not available to the attacker; therefore, vf and SKf cannot be computed.The attacker also cannot computeSKc; zc=h2yisxi can be computed, but vc=czc cannot be computed without the c selected by CSP. Thus, the modified scheme can withstand privileged-insider attacks.


#### 4.2.11. Replay Attacks

The adversary may attempt to replay old messages {Msg1, Msg2, Msg3, and Msg4}. However, all communicated messages are refreshed and rely on the timestamp {Tu, Tf, Tc} as well as random numbers {a, b, c}. Upon receiving the authentication request from the sender, the receiver first checks the freshness of the timestamp. If the timestamp is not fresh, the session is terminated immediately.


#### 4.2.12. Perfect Forward Secrecy

Perfect forward secrecy indicates that if a long-term key is revealed to an attacker, the SK betweenUi, FN, and CSP, cannot be computed and remains secure. If an attacker attempts to calculate the session key, SKu=SKf=SKc=h5Ku‖A‖B‖C‖=h5Kf‖A‖B‖C‖=h5Kc‖A‖B‖C‖, which is randomized using numbers {a, b, c} and {qi, gj, zc}; Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, vu=aqi, vf=bgj, vc=czc. The attacker obtains (A, B, C) from the public channel; however, the attacker needs to compute one of the parameters vu, vf, vc, which cannot be obtained, thus SK cannot be calculated. Therefore, the improved scheme can provide perfect forward secrecy.


#### 4.2.13. No Key Control

Each entity cannot control the key agreement process to calculateSK individually, where SKu=SKf=SKc=h5Ku‖A‖B‖C‖=h5Kf‖A‖B‖C‖=h5Kc‖A‖B‖C‖, Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, and vu=aqi, vf=bgj, vc=czc, A=vuP,B=vfP,C=vcP. The details are as follows:(a, b, c) are random numbers independently selected by Ui, FN, and CSP, respectively, and (A, B, C) are computed independently by each entity. If Ui does not know the values of B and C, which are contributed by FN and CSP, SKu cannot be computed. Similarly, FN and CSP cannot compute SKf and SKc without the values of (A, C) and (A, B).


#### 4.2.14. Unknown Key-Share

From “‘(2),” we know that all three entities are mutually identifiable. IfUi and entity-1 establish the session key and send the request message of entity-1 by mistake to entity-2, it is impossible to pass the validation IDi′=IDi, IDj′=IDj, Ni=h3A¯‖Mi‖AIDiIDj‖Tu=Ni′=h3A¯′‖Mi′‖AIDi′IDj′‖Tu, and Lj=h3B¯‖gj‖A‖PIDj‖IDj‖Tf‖=Lj′=h3B¯′‖Rj′‖AIDi′IDj′‖Tf, thus the session terminates immediately. Therefore, the proposed scheme can resist unknown key-share attacks.


### 4.3. Evaluation by ProVerif

In this section, we choose the widely accepted software tool ProVerif [49–53] to perform security simulation and testing of the scheme, which can fully guarantee the characteristics of confidentiality and authenticity.The complete scheme shown in Figure4 is implemented and validated in ProVerif. During the simulation, we assumed the two channels shown in Figure 5(a). The ch is a common channel used for the transmission of messages between entities in the authentication phase. The sch is a secure channel for user and fog node registration. Variables and constants are also defined in Figure 5(a). IDi and IDj are the identities of users and fog nodes, respectively, SKu, SKf, and SKc are the keys negotiated between the three entities, respectively.Figure 5
ProVerif simulation. (a) Declarations. (b) User’s process. (c) Fog node’s process. (d) CSP’s process and main.
(a)(b)(c)(d)User and fog node are described by starting and ending events, and scheme authenticity is achieved by exposing the respective relationships between the start and end intervals of related events initiated by a particular participant. If no end event is reached, it means the scheme failed to terminate and the scheme is incorrect. Figures5(b)–5(d) represent the user, fog node, and CSP implementation simulation processes, respectively, which are described in detail in Section 3 and executed in parallel.The necessary queries are defined in Figure5(a) to verify the security and correctness of the scheme. The query attacker simulates an actual attack to obtain the session key and secret random numbers, while the other three query in-events correspond to the start and end events of the three processes. If any of these queries result in false, it means that the scheme is incorrect. The results of the discussion query are shown in Figure 6.Figure 6
Verification result. (a) Query results for SK. (b) Query results for secrecy. (c) Query results for events.
(a)(b)(c)It can be seen from the results in Figures6(a) and 6(b) that the session key negotiated between entities and the secret random number selected by each entity are secure when dealing with security threats, which proves that the authenticity and confidentiality of our scheme are guaranteed during the execution process. The results in Figure 6(c) show that each process started and ended successfully, which proves the correctness of our scheme.


## 4.1. Formal Security Analysis Using BAN Logic

In this subsection, the sharing sessionSK calculated by CSP between Ui, FN, and CSP is presented, which can be used to send request information to the server when the user wants to obtain data from the server. Note, the following notations and rules for the BAN logic can be found in previous studies [33, 35, 39, 48].


### 4.1.1. Related Rules

Messages meaning ruleA|≡A↔KB,A⊲XK/A|≡B∼X: if principal A believes that hidden K value is shared between principals A and B, and A receives the message X enciphered with K and then A believes that B is the sender of X.Nonce verification ruleA|≡#X,A|≡B∼X/A|≡B|≡X: if A believes that message X is fresh and that B has sent X, then A believes that B also believes in message X.Jurisdiction ruleA|≡B|⇒X,A|≡B|≡X/A|≡X: if A believes that B has jurisdiction over X and that B believes on statement X, then A believes on X.Session key introduction ruleA|≡#X,A|≡B|≡X/A|≡A↔KB: if A believes that message X is fresh and that B also believes on X, then A believes they share the session key.Belief ruleA|≡B|≡XY/A|≡B|≡X: if A believes that B believes formula (X, Y), then A believes that B also believes the X or Y part of the formula.


### 4.1.2. Goals

GOAL 1:Ui|≡Ui↔SKFNGOAL 2:Ui|≡FN|≡Ui↔SKFNGOAL 3:FN|≡Ui↔SKFNGOAL 4:FN|≡Ui|≡Ui↔SKFNGOAL 5:CSP|≡Ui↔SKFNGOAL 6:CSP|≡Ui|≡Ui↔SKFNGOAL 7:CSP|≡FN|≡Ui↔SKFN


### 4.1.3. Idealize the Communication Messages

Msg1Ui⟶FN:A,PIDi,Ni,TuMsg2FN⟶CSP:B,PIDj,Lj,Tf,A,PIDi,Ni,TuMsg3Ui⟶CSP:A,PIDi,Ni,TuMsg4CSP⟶FN:Authj,C,TcMsg5CSP⟶Ui:Authi,C,TcMsg6FN⟶Ui:B,Authi,C,Tc


### 4.1.4. Initial State Assumptions

A1:Ui|≡#aA2:Ui|≡#AA3:Ui|≡AA4:Ui|≡#BA5:Ui|≡#CA6:FN|≡#bA7:FN|≡#BA8:FN|≡BA9:FN|≡#AA10:FN|≡#CA11:CSP|≡#cA12:CSP|≡#CA13:CSP|≡CA14:CSP|≡#AA15:CSP|≡#BA16:Ui|≡Ui↔IDjFNA17:Ui|≡Ui↔IDi,PIDi,RiCSPA 18:Ui|≡FN=>BA 19:Ui|≡CSP=>CA 20:FN|≡Ui↔IDjFNA 21:FN|≡FN↔IDj,gjCSPA 22:FN|≡Ui=>AA 23:FN|≡CSP=>CA 24:CSP|≡Ui↔IDi,PIDi,RiCSPαA 25:CSP|≡FN↔IDj,gjCSPA 26:CSP|≡FN=>BA 27:CSP|≡Ui=>AIfa is a random number chosen by Ui, we can obtain A1and A2; when Msg1 sends form Ui to FN, A22 is obtained. From A22, we obtain A9; when Msg3 sends form Ui to CSP, we obtain A27. From A27, we obtain A14. Similarly, because b is a random number chosen by FN, we obtain A6 and A7; when Msg6 sends from FN to Ui, we obtain A18. From A18, we obtain A4; when Msg2 sends from FN to CSP, we obtain A26. From A26, we obtain A15. c is a random number chosen by CSP; we obtain A26 and A27; when Msg5 sends from CSP to Ui, we obtain A19. From A19, we obtain A5; when Msg4 sends from CSP to FN, we obtain A23. From A23, we obtain A10.


### 4.1.5. Main Proofs Using BAN Rules and Assumptions

(1) For GOAL 1 and GOAL 2. From message Msg6 and using the seeing rule, we obtain S1: Ui⊲B,Authi,C,Tc. Using the seeing rule, we obtain S2: Ui⊲B. Using A16, S2, and the message meaning rule, we obtain S3: Ui≡FN∼B. Using A4, S3, and the nonce verification rule, we obtain S4: Ui|≡FN|≡B. Using A18, S4, and the jurisdiction rule, we obtain S5: Ui|≡B. Based on message Msg5 and the seeing rule, we obtain S6: Ui⊲Authi,C,Tc. Using the seeing rule, we obtain S7: Ui⊲C. According to A17, S7, and the message meaning rule, we have S8: Ui|≡CSP|∼C. Using A5, S8, and the nonce verification rule, we obtain S9: Ui|≡CSP|≡C. Using A19, S9, and the jurisdiction rule, we obtain S10: Ui|≡C. Based on A2, A4, A5, A3, S5, S10, and the belief rule, we obtain S11: Ui|≡#A,B,C and S12: Ui|≡A,B,C. Because A=vuP,B=vfP,C=vcP, we can obtain S13: Ui|≡vu,vf,vc. Because Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, SKu=SKf=SKc=h5KuAB‖C=h5KfAB‖C=h5KcAB‖C. Using A2, A16, S12, S13, and the belief rule, we obtain S14: Ui|≡Ui↔SKFN (GOAL 1).Using A2, S14, and the session key introduction rule, we obtain S15:Ui|≡FN|≡Ui↔SKFN (GOAL 2).(2) For GOAL 3 and GOAL 4. From message Msg1 and using the seeing rule, we obtain S16: FN⊲A,PIDi,Ni,Tu. Using the seeing rule, we obtain S17: FN⊲A. According to A20, S17, and the message meaning rule, we have S18: FN|≡Ui|∼A. Employing A9, S18, and the nonce verification rule, we obtain S19: FN|≡Ui|≡A. Using A22, S19, and the jurisdiction rule, we have S20: FN|≡A. From message Msg4 and using the seeing rule, we have S21: FN⊲Authj,C,Tc. We obtain S22: FN⊲C via the seeing rule. According to A21, S22, and the message meaning rule, we obtain S23: FN|≡CSP|∼C. Using A10, S23, and the nonce verification rule, we obtain S24: FN|≡CSP|≡C. According to A23, S24, and the jurisdiction rule, we have S25: FN|≡C. According to A7, A10, A9, A8, S20, S25, and the belief rule, we obtain S26: FN|≡#A,B,C and S27: FN|≡A,B,C. Because A=vuP,B=vfP,C=vcP, we can obtain S28: FN|≡vu,vf,vc. Using A7, A20, S27, S28, and the belief rule, we obtain S29: FN|≡Ui↔SKFN (GOAL 3).By using A7, S29, and the session key introduction rule, we obtain S30:FN|≡Ui|≡Ui↔SKFN (GOAL 4).(3) For GOAL 5, GOAL 6, and GOAL 7. According to Msg2 and using the seeing rule, we obtain S31: CSP⊲B,PIDj,Lj,Tf,A,PIDi,Ni,Tu. Using the seeing rule, we obtain S32: CSP⊲B. Using A25, S32, and the message meaning rule, we obtain S33: CSP|≡FN|∼B. Using A15, S33, and the nonce verification rule, we obtain S34: CSP|≡FN|≡B. Using A26, S34, and the jurisdiction rule, we obtain S35: CSP|≡B. Based on Msg3 and the seeing rule, we obtain S36: CSP⊲A,PIDi,Ni,Tu. We have S37: CSP⊲A via the seeing rule. According to A24, S37, and the message meaning rule, we obtain S38: CSP|≡Ui|∼A. Using A14, S38, and the nonce verification rule, we obtain S39: CSP|≡Ui|≡A. According to A27, S39, and the jurisdiction rule, we obtain S40: CSP|≡A. According to A14, A12, A15, A13, S35, S40, and the belief rule, we obtain S41: CSP|≡#A,B,C and S42: CSP|≡A,B,C. Because A=vuP,B=vfP,A=vcP, we can obtain S43: Ui|≡vu,vf,vc. Using A12, S42, S43, and the belief rule, we obtain S44: CSP|≡Ui↔SKFN (GOAL 5).Using A14, S44, and the session key introduction rule, we obtain S45:CSP|≡Ui|≡Ui↔SKFN (GOAL 6).Using A15, S44, and the session key introduction rule, we obtain S46:CSP|≡FN|≡Ui↔SKFN (GOAL 7).


## 4.1.1. Related Rules

Messages meaning ruleA|≡A↔KB,A⊲XK/A|≡B∼X: if principal A believes that hidden K value is shared between principals A and B, and A receives the message X enciphered with K and then A believes that B is the sender of X.Nonce verification ruleA|≡#X,A|≡B∼X/A|≡B|≡X: if A believes that message X is fresh and that B has sent X, then A believes that B also believes in message X.Jurisdiction ruleA|≡B|⇒X,A|≡B|≡X/A|≡X: if A believes that B has jurisdiction over X and that B believes on statement X, then A believes on X.Session key introduction ruleA|≡#X,A|≡B|≡X/A|≡A↔KB: if A believes that message X is fresh and that B also believes on X, then A believes they share the session key.Belief ruleA|≡B|≡XY/A|≡B|≡X: if A believes that B believes formula (X, Y), then A believes that B also believes the X or Y part of the formula.


## 4.1.2. Goals

GOAL 1:Ui|≡Ui↔SKFNGOAL 2:Ui|≡FN|≡Ui↔SKFNGOAL 3:FN|≡Ui↔SKFNGOAL 4:FN|≡Ui|≡Ui↔SKFNGOAL 5:CSP|≡Ui↔SKFNGOAL 6:CSP|≡Ui|≡Ui↔SKFNGOAL 7:CSP|≡FN|≡Ui↔SKFN


## 4.1.3. Idealize the Communication Messages

Msg1Ui⟶FN:A,PIDi,Ni,TuMsg2FN⟶CSP:B,PIDj,Lj,Tf,A,PIDi,Ni,TuMsg3Ui⟶CSP:A,PIDi,Ni,TuMsg4CSP⟶FN:Authj,C,TcMsg5CSP⟶Ui:Authi,C,TcMsg6FN⟶Ui:B,Authi,C,Tc


## 4.1.4. Initial State Assumptions

A1:Ui|≡#aA2:Ui|≡#AA3:Ui|≡AA4:Ui|≡#BA5:Ui|≡#CA6:FN|≡#bA7:FN|≡#BA8:FN|≡BA9:FN|≡#AA10:FN|≡#CA11:CSP|≡#cA12:CSP|≡#CA13:CSP|≡CA14:CSP|≡#AA15:CSP|≡#BA16:Ui|≡Ui↔IDjFNA17:Ui|≡Ui↔IDi,PIDi,RiCSPA 18:Ui|≡FN=>BA 19:Ui|≡CSP=>CA 20:FN|≡Ui↔IDjFNA 21:FN|≡FN↔IDj,gjCSPA 22:FN|≡Ui=>AA 23:FN|≡CSP=>CA 24:CSP|≡Ui↔IDi,PIDi,RiCSPαA 25:CSP|≡FN↔IDj,gjCSPA 26:CSP|≡FN=>BA 27:CSP|≡Ui=>AIfa is a random number chosen by Ui, we can obtain A1and A2; when Msg1 sends form Ui to FN, A22 is obtained. From A22, we obtain A9; when Msg3 sends form Ui to CSP, we obtain A27. From A27, we obtain A14. Similarly, because b is a random number chosen by FN, we obtain A6 and A7; when Msg6 sends from FN to Ui, we obtain A18. From A18, we obtain A4; when Msg2 sends from FN to CSP, we obtain A26. From A26, we obtain A15. c is a random number chosen by CSP; we obtain A26 and A27; when Msg5 sends from CSP to Ui, we obtain A19. From A19, we obtain A5; when Msg4 sends from CSP to FN, we obtain A23. From A23, we obtain A10.


## 4.1.5. Main Proofs Using BAN Rules and Assumptions

(1) For GOAL 1 and GOAL 2. From message Msg6 and using the seeing rule, we obtain S1: Ui⊲B,Authi,C,Tc. Using the seeing rule, we obtain S2: Ui⊲B. Using A16, S2, and the message meaning rule, we obtain S3: Ui≡FN∼B. Using A4, S3, and the nonce verification rule, we obtain S4: Ui|≡FN|≡B. Using A18, S4, and the jurisdiction rule, we obtain S5: Ui|≡B. Based on message Msg5 and the seeing rule, we obtain S6: Ui⊲Authi,C,Tc. Using the seeing rule, we obtain S7: Ui⊲C. According to A17, S7, and the message meaning rule, we have S8: Ui|≡CSP|∼C. Using A5, S8, and the nonce verification rule, we obtain S9: Ui|≡CSP|≡C. Using A19, S9, and the jurisdiction rule, we obtain S10: Ui|≡C. Based on A2, A4, A5, A3, S5, S10, and the belief rule, we obtain S11: Ui|≡#A,B,C and S12: Ui|≡A,B,C. Because A=vuP,B=vfP,C=vcP, we can obtain S13: Ui|≡vu,vf,vc. Because Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, SKu=SKf=SKc=h5KuAB‖C=h5KfAB‖C=h5KcAB‖C. Using A2, A16, S12, S13, and the belief rule, we obtain S14: Ui|≡Ui↔SKFN (GOAL 1).Using A2, S14, and the session key introduction rule, we obtain S15:Ui|≡FN|≡Ui↔SKFN (GOAL 2).(2) For GOAL 3 and GOAL 4. From message Msg1 and using the seeing rule, we obtain S16: FN⊲A,PIDi,Ni,Tu. Using the seeing rule, we obtain S17: FN⊲A. According to A20, S17, and the message meaning rule, we have S18: FN|≡Ui|∼A. Employing A9, S18, and the nonce verification rule, we obtain S19: FN|≡Ui|≡A. Using A22, S19, and the jurisdiction rule, we have S20: FN|≡A. From message Msg4 and using the seeing rule, we have S21: FN⊲Authj,C,Tc. We obtain S22: FN⊲C via the seeing rule. According to A21, S22, and the message meaning rule, we obtain S23: FN|≡CSP|∼C. Using A10, S23, and the nonce verification rule, we obtain S24: FN|≡CSP|≡C. According to A23, S24, and the jurisdiction rule, we have S25: FN|≡C. According to A7, A10, A9, A8, S20, S25, and the belief rule, we obtain S26: FN|≡#A,B,C and S27: FN|≡A,B,C. Because A=vuP,B=vfP,C=vcP, we can obtain S28: FN|≡vu,vf,vc. Using A7, A20, S27, S28, and the belief rule, we obtain S29: FN|≡Ui↔SKFN (GOAL 3).By using A7, S29, and the session key introduction rule, we obtain S30:FN|≡Ui|≡Ui↔SKFN (GOAL 4).(3) For GOAL 5, GOAL 6, and GOAL 7. According to Msg2 and using the seeing rule, we obtain S31: CSP⊲B,PIDj,Lj,Tf,A,PIDi,Ni,Tu. Using the seeing rule, we obtain S32: CSP⊲B. Using A25, S32, and the message meaning rule, we obtain S33: CSP|≡FN|∼B. Using A15, S33, and the nonce verification rule, we obtain S34: CSP|≡FN|≡B. Using A26, S34, and the jurisdiction rule, we obtain S35: CSP|≡B. Based on Msg3 and the seeing rule, we obtain S36: CSP⊲A,PIDi,Ni,Tu. We have S37: CSP⊲A via the seeing rule. According to A24, S37, and the message meaning rule, we obtain S38: CSP|≡Ui|∼A. Using A14, S38, and the nonce verification rule, we obtain S39: CSP|≡Ui|≡A. According to A27, S39, and the jurisdiction rule, we obtain S40: CSP|≡A. According to A14, A12, A15, A13, S35, S40, and the belief rule, we obtain S41: CSP|≡#A,B,C and S42: CSP|≡A,B,C. Because A=vuP,B=vfP,A=vcP, we can obtain S43: Ui|≡vu,vf,vc. Using A12, S42, S43, and the belief rule, we obtain S44: CSP|≡Ui↔SKFN (GOAL 5).Using A14, S44, and the session key introduction rule, we obtain S45:CSP|≡Ui|≡Ui↔SKFN (GOAL 6).Using A15, S44, and the session key introduction rule, we obtain S46:CSP|≡FN|≡Ui↔SKFN (GOAL 7).


## 4.2. Informal Security Analysis

In this section, we demonstrate that our improved scheme can achieve the following well-known security requirements.


### 4.2.1. Known Session-Specific Temporary Information Attacks

The session keySKu=SKf=SKc=h5KuAB‖C=h5KfAB‖C=h5KcAB‖C is generated utilizing the hidden values of Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, and vu=aqi, vf=bgj, vc=czc; (A, B, C) can be intercepted on an open channel, but adversaries do not know (qi, gj, zc) because they are the hidden values of Ui, FN, and CSP, respectively, and, thus, cannot calculate (vu, vf, vc). Therefore, despite adversaries determining (a, b, c), they cannot calculate (Ku,Kf,Kc) without (qi, gj, zc). Therefore, an opponent cannot recover SK using temporarily leaked session-specific information {a, b, c}.(qi, gj) are the hidden values of Ui, and FN, respectively; if only (a, b) is found, but not (qi, gj), the adversaries cannot calculate vu=aqi, vf=bgj. A¯=vuPpub, B¯=vfPpub, PIDi=IDi⊕h0A¯, PIDj=IDj⊕h0B¯; PIDi,PIDj can be intercepted on an open channel, but adversaries cannot retrieve IDi=PIDi⊕h0A¯ and IDj=PIDj⊕h0B¯ without (vu, vf). If adversaries intercept (A, B) on an open channel, they do not know the key s of the CSP and, thus, cannot calculate A¯′=sA and B¯′=sB, or retrieve IDi=PIDi⊕h0A¯′, IDj=PIDj⊕h0B¯′ without s.


### 4.2.2. Mutual Authentication

CSP authenticatesUi by verifying whether IDi′ equals to the IDi saved in the CSP database and whether Ni′ equals to Ni, Ni sent from Ui. Ui authenticates CSP by verifying whether Authi′ equals to Authi=h4A‖B‖C‖A¯′IDi′Tc, which includes C calculated by CSP.Similarly, CSP authenticatesFN by verifying whether IDj′ equals to the IDj saved in the CSP database and whether Lj′ equals Lj, Lj sent from FN. FN authenticates CSP by verifying whether Authj′ equals to Authj=h4A‖B‖C‖B¯′IDj′Tc, which includes C calculated by CSP.FN authenticates Ui by verifying whether Authj′ equals to Authj which includes A calculated by Ui, and Ui authenticates FN by verifying whether Authi′ equals to Authi=h4A‖B‖C‖A¯′IDi′Tc, which includes B calculated by FN.


### 4.2.3. Impersonation Attack

To impersonate a legitimate user, the adversary has to obtain the identityIDi, password PWi, and qi=h2IDisxi of Ui or construct A=vuP, PIDi=IDi⊕h0A¯, and Ni=h3A¯‖Mi‖A‖IDi‖IDj‖Tu‖. First, the opponent is unable to guess the correct identity and password of Ui through “password-guessing attack.” Second, to construct {A, PIDi,Ni}, the adversary has to obtain the key s and parameter xi. However, it cannot compute qi without IDi, s, and xi, which are crucial for computing {A,PIDi,Ni}. Thus, the adversary cannot impersonate a legitimate user.Similarly, to mimic a legitimate fog node, the opponent must obtain the identityIDj and qj=h2IDjsxj of FN or construct B=vfP,PIDj=IDj⊕h0B¯, and Lj=h3B¯‖gj‖A‖IDj‖IDj‖Tf‖; the adversary can obtain the identity IDj, but it is impossible for the adversary to determine gj=h2IDjsyj, which is computed and assigned by CSP in FN registration. gj cannot be computed without s and yj, which are crucial for computing {B, PIDj,Lj}. Thus, the adversary cannot impersonate a legitimate FN.The adversary is also unable to impersonate CSP. To computeC=vcP, Authi=h4A‖B‖C‖A¯′IDi′Tc, and Authj=h4A‖B‖C‖B¯′IDj′Tc, s, xi, and yj are required to compute C=vcP=h2yisxicP. However, the adversary cannot obtain C unless it obtains all three factors at the same time. This is beyond the capacity of an adversary. Thus, the adversary cannot impersonate CSP.


### 4.2.4. Man-in-the-Middle Attacks

If the adversary obtains Msg1 or Msg2 from the public channel and modifies Msg1 or Msg2 to launch a man-in-the-middle attack, the identity authentication of CSP cannot be passed; the premise of the authentication of CSP is to determine the identity ofUi and FN. From “(2),”we know that CSP will compute IDi′ and IDj′ and compare the values with IDi and IDj saved in the CSP database; if it is not equal, the session will immediately be terminated. From “(1),” we know that the adversary cannot obtain IDi and IDj. Meanwhile, from “(3),” we also know that the adversary cannot obtain the values of s,xi, and yj. Thus, the modified messages cannot pass the verification of Ni′ = Ni and Lj′ = Lj from CSP.If the adversary obtains Msg3 or Msg4 from the open channel and modifies Msg3 or Msg4 to launch the man-in-the-middle attack, the authentication fromUi and FN will still not be passed. As indicated by “(2),” we can see that if the messages are modified by the adversary, they cannot pass the verification of Authi′ = Authi and Authj′ = Authj from Ui and FN.


### 4.2.5. Known Session Key Attacks

A scheme is considered vulnerable to known session key attacks if an adversary wants to use the old compromised session key to obtain sensitive parameters and keys for subsequent communication sessions. In our scheme,SKu=SKf=SKc=h5KuAB‖C=h5KfAB‖C=h5KcAB‖C, Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, A=vuP,B=vfP,C=vcP, vu=aqi, vf=bgj, vc=czc, is refreshed using random numbers {a, b, c} and the attacker does not know {qi, gj, zc}. Thus, owing to the computational difficulty of the elliptic curve Diffie–Hellman problem, it is impossible for the attacker to obtain the new SK information from the old SK and extract {a, b, c} from {A, B, C}; thus, the scheme we proposed can withstand the known session key attack.


### 4.2.6. Compromise Impersonation Attacks

If the CSP long-term keys is compromised, the adversary may use s to impersonate a legitimate user to determine FN and CSP. However, all attack sessions are terminated immediately, as follows. In a worst case scenario, the adversary may have access to the data Ri∗ = h2IDisxi⊕h1IDi‖PWi,Vi=h2h2IDisxi‖IDi⊕h1IDi‖PWi, in the stolen smart card SC. Despite knowing s, the adversary does not know the hidden values of {IDi, xi,PWi} to compute h2IDisxi = Ri∗⊕h1IDi‖PWi or qi=h2IDisxi directly. Thus, the adversary cannot generate Msg1 = A,PIDi,Ni,Tu to masquerade Ui to launch a new session.The adversary may intercept messages sent byUi during authentication and key negotiation and attempt to impersonate the initiator of the session. However, the session will terminate immediately because the attacker cannot calculate Ku=eB,Cvu correctly without knowing the hidden values of a,qi, despite knowing s.


### 4.2.7. Parallel Session Attacks

When the entity is in session, the adversary may try to replay the old messages to launch a new session attack; however, this is impossible. When an attacker replays {M1, M2} to CSP, it can pass the verification ofNi′=h3A¯′‖Mi′‖AIDi′IDj′‖Tu, Lj′=h3B¯′‖Rj′‖AIDi′IDj′‖Tf. However, because the attacker does not know {a, b} and {qi, gj}, it cannot compute one of Ku=h5KuAB‖C, Kf=h5KfAB‖C, Ku=Kf=eB,Cvu=eA,Cvf, and vu=aqi, vf=bgj, and the attacker session is immediately aborted.


### 4.2.8. Stolen Smart Card Attacks

If an attacker steals the smart card and extractsRi∗ = h2IDisxi⊕h1IDi‖PWi, Vi=h2h2IDisxi‖IDi⊕h1IDi‖PWi, he/she may impersonate Ui to FN and CSP. However, the attacker does not know the sensitive parameter {IDi, PWi, xi, s} to generate the initiator message PIDi=IDi⊕h0A¯, Ni=h3A¯‖Mi‖AIDiIDj‖Tu, thus cannot impersonate Ui to FN and CSP. Hence, the proposed scheme can withstand stolen smart card attacks.


### 4.2.9. Password-Guessing Attacks

If an adversary obtains information regarding {A, B, PIDi, PIDj, Ni, Lj, C, Authi, Authj, Tu, Tf,Tc} from the open channel, online password-guessing attacks may be launched. However, the adversary will fail because A=vuP, PIDi=IDi⊕h0A¯, Ni=h3A¯‖Mi‖AIDiIDj‖Tu, B=vfP, PIDj=IDj⊕h0B¯, Lj=h3B¯‖gj‖A‖PIDj‖IDj‖Tf‖, C=vcP, Authi=h4A‖B‖C‖A¯′IDi′Tc, Authj=h4A‖B‖C‖B¯′IDj′Tc, and PWi are not included in these values. Therefore, PWi remains secure.If the smart card is compromised by an opponent, the parameter {Ri∗,Vi} in the SC can be obtained through the power analysis attack method, and then off-line dictionary attacks can be made based on the relevant parameter Ri∗=h2IDisxi⊕h1IDi‖PWi, Vi=h2h2IDisxi‖IDi⊕h1IDi‖PWi, to guess the user password. However, because the values {xi, s} are only known by the CSP, the opponent cannot verify the accuracy of the guess value; therefore, all sensitive parameters are safe.


### 4.2.10. Privileged-Insider Attacks

When the attacker obtainsUi′ registration information (IDi, RIDi, xi) and the key s of CSP, the intent is to compute the session key SKu=SKf=SKc=h5Ku‖A‖B‖C=h5Kf‖A‖B‖C=h5Kc‖A‖B‖C, which is randomized using {a, b, c} and {qi, gj, zc}. By Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc and vu=aqi, vf=bgj, vc=czc, the attacker can compute qi=h2IDisxi and obtain (A, B, C) from the public channel. However, (a, b, c) are random numbers independently selected by Ui, FN, and CSP, respectively, and are not available to the attacker; therefore, vu and SKu cannot be computed.Similarly, when the attacker obtains theFN registration information (IDj, yj) and the key s of CSP, the intent is to compute the session key SKf; the attacker can compute gj=h2IDjsyj and obtain (A, B, C) from the public channel. However, (a, b, c) are random numbers independently selected by Ui, FN, and CSP, respectively, and are not available to the attacker; therefore, vf and SKf cannot be computed.The attacker also cannot computeSKc; zc=h2yisxi can be computed, but vc=czc cannot be computed without the c selected by CSP. Thus, the modified scheme can withstand privileged-insider attacks.


### 4.2.11. Replay Attacks

The adversary may attempt to replay old messages {Msg1, Msg2, Msg3, and Msg4}. However, all communicated messages are refreshed and rely on the timestamp {Tu, Tf, Tc} as well as random numbers {a, b, c}. Upon receiving the authentication request from the sender, the receiver first checks the freshness of the timestamp. If the timestamp is not fresh, the session is terminated immediately.


### 4.2.12. Perfect Forward Secrecy

Perfect forward secrecy indicates that if a long-term key is revealed to an attacker, the SK betweenUi, FN, and CSP, cannot be computed and remains secure. If an attacker attempts to calculate the session key, SKu=SKf=SKc=h5Ku‖A‖B‖C‖=h5Kf‖A‖B‖C‖=h5Kc‖A‖B‖C‖, which is randomized using numbers {a, b, c} and {qi, gj, zc}; Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, vu=aqi, vf=bgj, vc=czc. The attacker obtains (A, B, C) from the public channel; however, the attacker needs to compute one of the parameters vu, vf, vc, which cannot be obtained, thus SK cannot be calculated. Therefore, the improved scheme can provide perfect forward secrecy.


### 4.2.13. No Key Control

Each entity cannot control the key agreement process to calculateSK individually, where SKu=SKf=SKc=h5Ku‖A‖B‖C‖=h5Kf‖A‖B‖C‖=h5Kc‖A‖B‖C‖, Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, and vu=aqi, vf=bgj, vc=czc, A=vuP,B=vfP,C=vcP. The details are as follows:(a, b, c) are random numbers independently selected by Ui, FN, and CSP, respectively, and (A, B, C) are computed independently by each entity. If Ui does not know the values of B and C, which are contributed by FN and CSP, SKu cannot be computed. Similarly, FN and CSP cannot compute SKf and SKc without the values of (A, C) and (A, B).


### 4.2.14. Unknown Key-Share

From “‘(2),” we know that all three entities are mutually identifiable. IfUi and entity-1 establish the session key and send the request message of entity-1 by mistake to entity-2, it is impossible to pass the validation IDi′=IDi, IDj′=IDj, Ni=h3A¯‖Mi‖AIDiIDj‖Tu=Ni′=h3A¯′‖Mi′‖AIDi′IDj′‖Tu, and Lj=h3B¯‖gj‖A‖PIDj‖IDj‖Tf‖=Lj′=h3B¯′‖Rj′‖AIDi′IDj′‖Tf, thus the session terminates immediately. Therefore, the proposed scheme can resist unknown key-share attacks.


## 4.2.1. Known Session-Specific Temporary Information Attacks

The session keySKu=SKf=SKc=h5KuAB‖C=h5KfAB‖C=h5KcAB‖C is generated utilizing the hidden values of Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, and vu=aqi, vf=bgj, vc=czc; (A, B, C) can be intercepted on an open channel, but adversaries do not know (qi, gj, zc) because they are the hidden values of Ui, FN, and CSP, respectively, and, thus, cannot calculate (vu, vf, vc). Therefore, despite adversaries determining (a, b, c), they cannot calculate (Ku,Kf,Kc) without (qi, gj, zc). Therefore, an opponent cannot recover SK using temporarily leaked session-specific information {a, b, c}.(qi, gj) are the hidden values of Ui, and FN, respectively; if only (a, b) is found, but not (qi, gj), the adversaries cannot calculate vu=aqi, vf=bgj. A¯=vuPpub, B¯=vfPpub, PIDi=IDi⊕h0A¯, PIDj=IDj⊕h0B¯; PIDi,PIDj can be intercepted on an open channel, but adversaries cannot retrieve IDi=PIDi⊕h0A¯ and IDj=PIDj⊕h0B¯ without (vu, vf). If adversaries intercept (A, B) on an open channel, they do not know the key s of the CSP and, thus, cannot calculate A¯′=sA and B¯′=sB, or retrieve IDi=PIDi⊕h0A¯′, IDj=PIDj⊕h0B¯′ without s.


## 4.2.2. Mutual Authentication

CSP authenticatesUi by verifying whether IDi′ equals to the IDi saved in the CSP database and whether Ni′ equals to Ni, Ni sent from Ui. Ui authenticates CSP by verifying whether Authi′ equals to Authi=h4A‖B‖C‖A¯′IDi′Tc, which includes C calculated by CSP.Similarly, CSP authenticatesFN by verifying whether IDj′ equals to the IDj saved in the CSP database and whether Lj′ equals Lj, Lj sent from FN. FN authenticates CSP by verifying whether Authj′ equals to Authj=h4A‖B‖C‖B¯′IDj′Tc, which includes C calculated by CSP.FN authenticates Ui by verifying whether Authj′ equals to Authj which includes A calculated by Ui, and Ui authenticates FN by verifying whether Authi′ equals to Authi=h4A‖B‖C‖A¯′IDi′Tc, which includes B calculated by FN.


## 4.2.3. Impersonation Attack

To impersonate a legitimate user, the adversary has to obtain the identityIDi, password PWi, and qi=h2IDisxi of Ui or construct A=vuP, PIDi=IDi⊕h0A¯, and Ni=h3A¯‖Mi‖A‖IDi‖IDj‖Tu‖. First, the opponent is unable to guess the correct identity and password of Ui through “password-guessing attack.” Second, to construct {A, PIDi,Ni}, the adversary has to obtain the key s and parameter xi. However, it cannot compute qi without IDi, s, and xi, which are crucial for computing {A,PIDi,Ni}. Thus, the adversary cannot impersonate a legitimate user.Similarly, to mimic a legitimate fog node, the opponent must obtain the identityIDj and qj=h2IDjsxj of FN or construct B=vfP,PIDj=IDj⊕h0B¯, and Lj=h3B¯‖gj‖A‖IDj‖IDj‖Tf‖; the adversary can obtain the identity IDj, but it is impossible for the adversary to determine gj=h2IDjsyj, which is computed and assigned by CSP in FN registration. gj cannot be computed without s and yj, which are crucial for computing {B, PIDj,Lj}. Thus, the adversary cannot impersonate a legitimate FN.The adversary is also unable to impersonate CSP. To computeC=vcP, Authi=h4A‖B‖C‖A¯′IDi′Tc, and Authj=h4A‖B‖C‖B¯′IDj′Tc, s, xi, and yj are required to compute C=vcP=h2yisxicP. However, the adversary cannot obtain C unless it obtains all three factors at the same time. This is beyond the capacity of an adversary. Thus, the adversary cannot impersonate CSP.


## 4.2.4. Man-in-the-Middle Attacks

If the adversary obtains Msg1 or Msg2 from the public channel and modifies Msg1 or Msg2 to launch a man-in-the-middle attack, the identity authentication of CSP cannot be passed; the premise of the authentication of CSP is to determine the identity ofUi and FN. From “(2),”we know that CSP will compute IDi′ and IDj′ and compare the values with IDi and IDj saved in the CSP database; if it is not equal, the session will immediately be terminated. From “(1),” we know that the adversary cannot obtain IDi and IDj. Meanwhile, from “(3),” we also know that the adversary cannot obtain the values of s,xi, and yj. Thus, the modified messages cannot pass the verification of Ni′ = Ni and Lj′ = Lj from CSP.If the adversary obtains Msg3 or Msg4 from the open channel and modifies Msg3 or Msg4 to launch the man-in-the-middle attack, the authentication fromUi and FN will still not be passed. As indicated by “(2),” we can see that if the messages are modified by the adversary, they cannot pass the verification of Authi′ = Authi and Authj′ = Authj from Ui and FN.


## 4.2.5. Known Session Key Attacks

A scheme is considered vulnerable to known session key attacks if an adversary wants to use the old compromised session key to obtain sensitive parameters and keys for subsequent communication sessions. In our scheme,SKu=SKf=SKc=h5KuAB‖C=h5KfAB‖C=h5KcAB‖C, Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, A=vuP,B=vfP,C=vcP, vu=aqi, vf=bgj, vc=czc, is refreshed using random numbers {a, b, c} and the attacker does not know {qi, gj, zc}. Thus, owing to the computational difficulty of the elliptic curve Diffie–Hellman problem, it is impossible for the attacker to obtain the new SK information from the old SK and extract {a, b, c} from {A, B, C}; thus, the scheme we proposed can withstand the known session key attack.


## 4.2.6. Compromise Impersonation Attacks

If the CSP long-term keys is compromised, the adversary may use s to impersonate a legitimate user to determine FN and CSP. However, all attack sessions are terminated immediately, as follows. In a worst case scenario, the adversary may have access to the data Ri∗ = h2IDisxi⊕h1IDi‖PWi,Vi=h2h2IDisxi‖IDi⊕h1IDi‖PWi, in the stolen smart card SC. Despite knowing s, the adversary does not know the hidden values of {IDi, xi,PWi} to compute h2IDisxi = Ri∗⊕h1IDi‖PWi or qi=h2IDisxi directly. Thus, the adversary cannot generate Msg1 = A,PIDi,Ni,Tu to masquerade Ui to launch a new session.The adversary may intercept messages sent byUi during authentication and key negotiation and attempt to impersonate the initiator of the session. However, the session will terminate immediately because the attacker cannot calculate Ku=eB,Cvu correctly without knowing the hidden values of a,qi, despite knowing s.


## 4.2.7. Parallel Session Attacks

When the entity is in session, the adversary may try to replay the old messages to launch a new session attack; however, this is impossible. When an attacker replays {M1, M2} to CSP, it can pass the verification ofNi′=h3A¯′‖Mi′‖AIDi′IDj′‖Tu, Lj′=h3B¯′‖Rj′‖AIDi′IDj′‖Tf. However, because the attacker does not know {a, b} and {qi, gj}, it cannot compute one of Ku=h5KuAB‖C, Kf=h5KfAB‖C, Ku=Kf=eB,Cvu=eA,Cvf, and vu=aqi, vf=bgj, and the attacker session is immediately aborted.


## 4.2.8. Stolen Smart Card Attacks

If an attacker steals the smart card and extractsRi∗ = h2IDisxi⊕h1IDi‖PWi, Vi=h2h2IDisxi‖IDi⊕h1IDi‖PWi, he/she may impersonate Ui to FN and CSP. However, the attacker does not know the sensitive parameter {IDi, PWi, xi, s} to generate the initiator message PIDi=IDi⊕h0A¯, Ni=h3A¯‖Mi‖AIDiIDj‖Tu, thus cannot impersonate Ui to FN and CSP. Hence, the proposed scheme can withstand stolen smart card attacks.


## 4.2.9. Password-Guessing Attacks

If an adversary obtains information regarding {A, B, PIDi, PIDj, Ni, Lj, C, Authi, Authj, Tu, Tf,Tc} from the open channel, online password-guessing attacks may be launched. However, the adversary will fail because A=vuP, PIDi=IDi⊕h0A¯, Ni=h3A¯‖Mi‖AIDiIDj‖Tu, B=vfP, PIDj=IDj⊕h0B¯, Lj=h3B¯‖gj‖A‖PIDj‖IDj‖Tf‖, C=vcP, Authi=h4A‖B‖C‖A¯′IDi′Tc, Authj=h4A‖B‖C‖B¯′IDj′Tc, and PWi are not included in these values. Therefore, PWi remains secure.If the smart card is compromised by an opponent, the parameter {Ri∗,Vi} in the SC can be obtained through the power analysis attack method, and then off-line dictionary attacks can be made based on the relevant parameter Ri∗=h2IDisxi⊕h1IDi‖PWi, Vi=h2h2IDisxi‖IDi⊕h1IDi‖PWi, to guess the user password. However, because the values {xi, s} are only known by the CSP, the opponent cannot verify the accuracy of the guess value; therefore, all sensitive parameters are safe.


## 4.2.10. Privileged-Insider Attacks

When the attacker obtainsUi′ registration information (IDi, RIDi, xi) and the key s of CSP, the intent is to compute the session key SKu=SKf=SKc=h5Ku‖A‖B‖C=h5Kf‖A‖B‖C=h5Kc‖A‖B‖C, which is randomized using {a, b, c} and {qi, gj, zc}. By Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc and vu=aqi, vf=bgj, vc=czc, the attacker can compute qi=h2IDisxi and obtain (A, B, C) from the public channel. However, (a, b, c) are random numbers independently selected by Ui, FN, and CSP, respectively, and are not available to the attacker; therefore, vu and SKu cannot be computed.Similarly, when the attacker obtains theFN registration information (IDj, yj) and the key s of CSP, the intent is to compute the session key SKf; the attacker can compute gj=h2IDjsyj and obtain (A, B, C) from the public channel. However, (a, b, c) are random numbers independently selected by Ui, FN, and CSP, respectively, and are not available to the attacker; therefore, vf and SKf cannot be computed.The attacker also cannot computeSKc; zc=h2yisxi can be computed, but vc=czc cannot be computed without the c selected by CSP. Thus, the modified scheme can withstand privileged-insider attacks.


## 4.2.11. Replay Attacks

The adversary may attempt to replay old messages {Msg1, Msg2, Msg3, and Msg4}. However, all communicated messages are refreshed and rely on the timestamp {Tu, Tf, Tc} as well as random numbers {a, b, c}. Upon receiving the authentication request from the sender, the receiver first checks the freshness of the timestamp. If the timestamp is not fresh, the session is terminated immediately.


## 4.2.12. Perfect Forward Secrecy

Perfect forward secrecy indicates that if a long-term key is revealed to an attacker, the SK betweenUi, FN, and CSP, cannot be computed and remains secure. If an attacker attempts to calculate the session key, SKu=SKf=SKc=h5Ku‖A‖B‖C‖=h5Kf‖A‖B‖C‖=h5Kc‖A‖B‖C‖, which is randomized using numbers {a, b, c} and {qi, gj, zc}; Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, vu=aqi, vf=bgj, vc=czc. The attacker obtains (A, B, C) from the public channel; however, the attacker needs to compute one of the parameters vu, vf, vc, which cannot be obtained, thus SK cannot be calculated. Therefore, the improved scheme can provide perfect forward secrecy.


## 4.2.13. No Key Control

Each entity cannot control the key agreement process to calculateSK individually, where SKu=SKf=SKc=h5Ku‖A‖B‖C‖=h5Kf‖A‖B‖C‖=h5Kc‖A‖B‖C‖, Ku=Kf=Kc=eB,Cvu=eA,Cvf=eA,Bvc, and vu=aqi, vf=bgj, vc=czc, A=vuP,B=vfP,C=vcP. The details are as follows:(a, b, c) are random numbers independently selected by Ui, FN, and CSP, respectively, and (A, B, C) are computed independently by each entity. If Ui does not know the values of B and C, which are contributed by FN and CSP, SKu cannot be computed. Similarly, FN and CSP cannot compute SKf and SKc without the values of (A, C) and (A, B).


## 4.2.14. Unknown Key-Share

From “‘(2),” we know that all three entities are mutually identifiable. IfUi and entity-1 establish the session key and send the request message of entity-1 by mistake to entity-2, it is impossible to pass the validation IDi′=IDi, IDj′=IDj, Ni=h3A¯‖Mi‖AIDiIDj‖Tu=Ni′=h3A¯′‖Mi′‖AIDi′IDj′‖Tu, and Lj=h3B¯‖gj‖A‖PIDj‖IDj‖Tf‖=Lj′=h3B¯′‖Rj′‖AIDi′IDj′‖Tf, thus the session terminates immediately. Therefore, the proposed scheme can resist unknown key-share attacks.


## 4.3. Evaluation by ProVerif

In this section, we choose the widely accepted software tool ProVerif [49–53] to perform security simulation and testing of the scheme, which can fully guarantee the characteristics of confidentiality and authenticity.The complete scheme shown in Figure4 is implemented and validated in ProVerif. During the simulation, we assumed the two channels shown in Figure 5(a). The ch is a common channel used for the transmission of messages between entities in the authentication phase. The sch is a secure channel for user and fog node registration. Variables and constants are also defined in Figure 5(a). IDi and IDj are the identities of users and fog nodes, respectively, SKu, SKf, and SKc are the keys negotiated between the three entities, respectively.Figure 5
ProVerif simulation. (a) Declarations. (b) User’s process. (c) Fog node’s process. (d) CSP’s process and main.
(a)(b)(c)(d)User and fog node are described by starting and ending events, and scheme authenticity is achieved by exposing the respective relationships between the start and end intervals of related events initiated by a particular participant. If no end event is reached, it means the scheme failed to terminate and the scheme is incorrect. Figures5(b)–5(d) represent the user, fog node, and CSP implementation simulation processes, respectively, which are described in detail in Section 3 and executed in parallel.The necessary queries are defined in Figure5(a) to verify the security and correctness of the scheme. The query attacker simulates an actual attack to obtain the session key and secret random numbers, while the other three query in-events correspond to the start and end events of the three processes. If any of these queries result in false, it means that the scheme is incorrect. The results of the discussion query are shown in Figure 6.Figure 6
Verification result. (a) Query results for SK. (b) Query results for secrecy. (c) Query results for events.
(a)(b)(c)It can be seen from the results in Figures6(a) and 6(b) that the session key negotiated between entities and the secret random number selected by each entity are secure when dealing with security threats, which proves that the authenticity and confidentiality of our scheme are guaranteed during the execution process. The results in Figure 6(c) show that each process started and ended successfully, which proves the correctness of our scheme.


## 5. Performance Evaluation

In this section, the security features and defense against various attacks are compared between our scheme and the previous schemes [36, 41, 46] in Table 2. We can conclude that our scheme is more secure than the compared schemes. Note that “Yes” represents that the scheme can resist the indicated attack, whereas “No” represents that the scheme cannot, and “−” represents that the attack method indicated is not in the scope of the scheme.Table 2
Comparison of security.
Security propertiesRef. [36]Ref. [46]Ref. [41]Our schemeKnown session-specific temporary information attackYesNoYesYesUser anonymity and untraceabilityYesNoYesYesMutual authenticationNo [55]—YesYesImpersonation attacksNo [55]—No [56]YesMan-in-the-middle attacksYesYesYesYesKnown session key attacksYesYesYesYesCompromise impersonation attacks——YesYesParallel session attacks———YesStolen smart card attacksYesYesYesYesPassword-guessing attacksYesYesYesYesPrivileged-insider attacksYes——YesReplay attacksNo [55]YesYesYesPerfect forward privacyYesYesYesYesNo key control—Yes—YesUnknown key-share———YesSubsequently, we evaluate the performance of the proposed scheme from the perspective of computational and communication costs. The improved scheme was implemented in JAVA with JDK version 1.3, and the simulation of the scheme was based on the JAVA paired cryptography library (JPBC) [54], version JPBC-2.0.0. A Windows 10 computer system was used as the experimental platform, which was configured with a quad-core 2.3 GHz Intel(R) Core i5-8300H processor and 16 GB memory. The software developed is the community version of IntelliJ IDEA 2020.2.1 and uses the widely accepted type A pairing, which is based on the curve y2=x3+x structure in the field Fq of a specific q=3mod4. We have listed the symbols (TGe^,TGm,Th,TGa) and time used in the performance comparison in Table 3. Table 4 presents the calculation costs for the different phases of the scheme.Table 3
Computation time of basic operations.
OperationDescriptionTimes (ms)TGe^Bilinear pairing17.4TGmScalar multiplication13.5TGaPoint addition0.48ThHash function0.42TfeFuzzy extractor function [36]17.1Table 4
Performance comparisons (computation costs).
Ref. [36]Ref. [46]Ref. [41]Our schemeAuthentication and key agreement3TGm+19Th+1Tfe3TGe^+7TGm+18Th4TGe^+10TGm+25Th3TGe^+10TGm+21ThTotal65.58 ms154.26 ms215.1 ms196.02 msAs shown by the analysis in Table4, the computing cost for our scheme is slightly higher than that of schemes [36, 46]; however, our scheme provides auxiliary security features, and the mandatory security objectives achieved by this scheme are greater than those achieved by other schemes [36, 41, 46]. Our solution provides security features that other solutions do not have, such as being able to resist replay attacks and impersonation attacks and providing user anonymity, mutual authentication, etc.To calculate the communication and storage costs, we present that the length of the random nonce, password, and identity is 160 bits, and the length of a point in theG1 group is 1024 bits, denoted as |G1|. The output length of the hash functions h0, h1,h2, h3, and h4 in ZP∗ is 160 bits, denoted as |q|. The output length of h5 and the key length are both 256 bits. The length of the timestamp is 32 bits, denoted as |T|. The communication and storage costs of our scheme and related schemes are listed in Tables 5 and 6.Table 5
Performance comparisons (communication costs).
Ref. [36]Ref. [46]Ref. [41]Our schemeAuthentication and key agreement5|G1| + 4|q|6|G1| + 9|q| + 5|T|3|G1| + 4|q| + 4|T|6|G1| + 9|q| + 5|T|Total5760 bit7744 bit3840 bit7744 bitTable 6
Performance comparisons (storage cost).
SchemeStorage cost (bits)Ref. [36]320Ref. [46]640Ref. [41]736Ours640As shown in Tables5 and 6, the communication and the storage overhead of our scheme are slightly higher. The slightly higher cost of our scheme is mainly due to the increase in computing overhead while providing stronger security. However, because the primary purpose of a scheme is to ensure the security and privacy of data, it is acceptable to have a slightly higher communication cost but stronger security. After analyzing Tables 4 and 5, our scheme is concluded to be better than the other schemes [36, 41, 46], which can provide stronger security and withstand various known attacks.


## 6. Conclusion

The usage of fog-driven IoT healthcare systems has brought significant convenience to people. The authentication of the healthcare system is also the most important. Recently, a growing number of scholars have taken a closer look at healthcare systems and developed stronger authentication protocols for their certification environments. In this study, we proposed a secure authenticated and key agreement scheme in fog-driven IoT healthcare systems; the defects of the original scheme were analyzed and security improvements were proposed. An analysis of the performance evaluation and informal security in comparison to other related schemes is also presented in this study, which indicates that our scheme provides more security features. Our solution uses pairing technology, and the time cost is slightly higher than other solutions. Future studies can improve on this limitation, but our solution provides security features that other solutions do not have, which is more suitable for the practical application of medical system based on the IoT.



---

*Source: 6658041-2021-01-31.xml*