# Cryptanalysis and Enhancement of an Authenticated Key Agreement Protocol for Dew-Assisted IoT Systems

Authors: Yuqian Ma; Yongliu Ma; Qingfeng Cheng
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Real-time and high-efficient communication becomes a vital property for IoT-enabled equipment, since the application range of the Internet of Things has extended widely. At the same time, the centralized characterization of the cloud computing is gradually unable to meet the demand for both low latency and high computing efficiency. To resolve these issues, new computing paradigms have been introduced, such as edge, dew, and fog computing. Recently, Saurabh et al. introduced a mutual authentication protocol, which was claimed to resist various attacks without the requirement of a trusted server, for dew-assisted IoT devices. However, this paper will show that Saurabh et al.’s scheme lacks forward security and user anonymity. Then, a new authenticated key agreement (AKA) protocol, named e-SMDAS, will be put forward and formally proven secure under the eCK security model. Further, the analysis results of BAN logic and Scyther tool will also confirm the security of e-SMDAS. Finally, the comparative analysis of security features and computation efficiency between e-SMDAS and several recent schemes will be demonstrated at the end of this paper.


---

## Body

## 1. Introduction

Cloud computing, developing swiftly and violently, is gradually unable to satisfy the growing needs in the Internet. Flavio et al. [1] introduced the idea of fog computing. However, with the rapid development of the Internet, fog computing alone could not satisfy the quality of cloud-assisted services. Some other computing paradigms were proposed to meet the growing demand for high-quality cloud services. Tian et al. [2] recently proposed a framework for blockchain-assisted edge services in the Industrial Internet of Things (IIoT). The paradigm of dew computing was put forward by Wang [3, 4] to fully make use of on-premises devices and cloud services. Defined as an on-premises device software-hardware organization paradigm in the cloud computing environment, the dew computing, in which dew servers are independent of cloud servers when offline and collaborative with cloud servers when online, provides the functionality of high information processing and low latency communication. The system architecture of cloud-fog-dew computing is demonstrated in Figure 1.Figure 1
Fog computing system architecture.To build a secure and flexible dew computing paradigm, many security features need to be considered. Besides the basic mutual authentication and session key confirmation features, protocols in this paradigm also require forward security which confirms the leakage of long-term secrets will not influence the session keys. Since communications between servers are closely related to users’ privacy, anonymity and untraceability are also vital.To achieve secure communication in the network driven by fog computing, Hameed et al. [5] proposed a scheme claiming that it could achieve mutual authentication, low consumption, and high efficiency in smart home case. In 2021, Liu et al. [6] proposed a distributed access control system based on the decentralized conception of fog computing and blockchain technology. A similar idea was also thought about by Shukla et al. [7], adopting a signature-based encryption algorithm to maximize the strength of fog computing and blockchain.The application field of the Internet of Things (IoT) has extended largely in recent years. Aiming at protecting the secrecy, integrity, and anonymity of IoT-assisted end devices, Singh and Chaurasiya [8] discussed a possible mutual authentication scheme for the vulnerable fog nodes. A combination of elliptic curve Diffie–Hellman ephemeral key exchange algorithm and preshared key was analyzed by Amanlou et al. [9] to achieve credible communication between the fog gateways and devices located in IoT.Our contributions in this paper mainly consist of the following four points.(i)
We analyze an authenticated key agreement (AKA) protocol designed for a dew-assisted system by Saurabh et al. [10], referred to as SMDAS protocol below, and point out that their scheme lacks forward security and user anonymity.(ii)
Upon the analysis, we design a new AKA protocol, called e-SMDAS protocol below, remedying SMDAS protocol to achieve the mutual authentication, session key establishment, forward security, user anonymity, and other security features.(iii)
The security of our protocol is formally proven under the eCK security model and also confirmed using the Scyther tool and BAN logic.(iv)
Finally, results of comparison between the enhanced protocol and several recent schemes demonstrate the advantages of our protocol in the aspects of security features and communication efficiency.The arrangement of this paper is as follows. Related works are first introduced in Section2. In Section 3, we present some preliminaries used in the analysis of the proposed protocol. After reviewing the process of SMDAS protocol in Section 4, we analyze the security flaws of SMDAS protocol in Section 5. Our newly proposed protocol is described explicitly in Section 6; its formal security proof and security analysis using Scyther tool and BAN logic are provided in Section 7. Comparisons between the proposed protocol and SMDAS protocol are demonstrated in Section 8. Finally, in Section 9, the conclusion is highlighted.


## 2. Related Work

So far, anonymity and privacy-preserving are vital security features required urgently not only in dew computing paradigm but also in many other applications. To sum up the applications, several relative schemes [11–16] are listed in Table 1. They have been paid much attention to because of the decentralized feature of dew-assisted paradigm [17].Table 1
The summary of schemes set in IoT systems.
SchemeSettings applied inLimitations[11]Wireless sensor networksVulnerable to insider attack[12]Vulnerable to secret key leakage and forgery attack[13]Telecare medicine information systemsVulnerable to reflection attack[14]Vulnerable to replay attack[15]Vulnerable to offline password attack[16]Vulnerable to impersonation attack and users’ identity leakageRecently, a lightweight anonymity client authentication scheme was proposed by Gaikwad et al. [18] adopting chaotic hash function. Moreover, Masud et al. [19] proposed a lightweight and physically secure mutual authentication and secret key establishment protocol preserving privacy for COVID-19 patients’ care in the Internet of Medical Things. Their protocol used physical unclonable functions to make the network devices distinguish the legitimacy of doctors before acquiring a session key. Xiong et al. [20] proposed a three-party data privacy-preserving mechanism with game theory and machine learning technology. Tian et al. [21] proposed a graph clustering method to protect data privacy sharing in the Social Internet of Things (SIoT).Besides, forward security is one of the main concerns for AKA protocols. In 2015, Chaudhry et al. [22] proposed a remote user authentication scheme. Regrettably, Ravanbakhsh et al. [23] claimed that Chaudhry et al.’s scheme was unable to achieve perfect forward security and proposed an authenticated communication scheme for Voice over Internet Protocol (VoIP). Later, Nikooghadam and Amintoosi [24] proved that Ravanbakhsh et al.’s scheme did not provide perfect forward security and put forward a two-factor AKA scheme with perfect forward security.Recently, Saurabh et al. [10] introduced a mutual AKA protocol for the dew-assisted devices. They applied bilinear parings to achieve the mutual authentication and establishment of secure session keys. Formal analysis was presented by the use of AVISPA and the theory of security reduction. However, in this paper, we analyze the security of this protocol and show that it lacks forward security and user anonymity.


## 3. Preliminaries and Security Model

In this section, we concisely introduce the mathematical definitions and security model used next.


### 3.1. Mathematical Hard Problems

(i)
Elliptic Curve Discrete Logarithm (ECDL) Problem: Given an elliptic curve Ep, an additive cyclic group G based on Ep, a generator P of G, and an element Q=aP from G, it is hard to extract a∈Zp∗ from Q and P.(ii)
Elliptic Curve Computational Diffie–Hellman (ECCDH) Problem: Given an elliptic curve Ep, an additive cyclic group G based on Ep, and a generator P of G, considering the elements S=aP and T=bP from G, it is hard to compute U=abP.


### 3.2. Security Model

LaMacchia et al. [25] proposed the eCK security model in 2007. In this model, each entity owns two secrets, a long-term key x and an ephemeral key r. Assume two entities are A and B; their long-term keys are xA, xB; and their ephemeral keys are rA, rB, respectively. Besides, each session under the eCK security model has its own identity, denoted as SIDA,Bi if this session’s owner is entity A. Then, the abilities of adversary, denoted as A, can be defined through the queries below:(i)
Send(A,M): Through this query, A can send message M to entity A and get the corresponding message according to the protocol.(ii)
Reveal(SIDA,Bi): Through this query, A can acquire the session key of SIDA,Bi if session SIDA,Bi has been completed. Otherwise, A will get nothing.(iii)
Ephemeral(SIDA,Bi): Through this query, A can obtain the ephemeral key of the session SIDA,Bi.(iv)
Longterm(A): Through this query, A can obtain the long-term key of entity A.(v)
Test(SIDA,Bi): If A launches this query, session SIDA,Bi will randomly choose b from 0,1. If b=0, SIDA,Bi will choose a random number from the set of keys and send it back to A. If b=1, SIDA,Bi will send the real session key back to A.To define a secure protocol in the eCK security model, a definition of freshness should be presented first since a secure game through Test(SIDA,Bi) is querying toward a fresh session.Definition 1.
A session with identitySIDA,Bi in the eCK model at entity A whose intended partner denoted as B is fresh if the following items are satisfied:(i)
The session has not been asked for a Reveal query.(ii)
If a matching session exists with session identitySIDB,Aj, then(i)
not both Ephemeral(SIDA,Bi) and Longterm(A) queries have been asked for;(ii)
not both Ephemeral(SIDB,Aj) and Longterm(B) queries have been asked for.(iii)
If no partner exists, then(i)
not both Ephemeral(SIDA,Bi) and Longterm(A) queries have been asked for;(ii)
Longterm(B) queries have not been asked for.
Based on this definition, we present the definition of a secure session in the eCK security model.Definition 2.
The advantage of the adversaryA in the secure game with AKA protocol Π is defined as AdvΠAKAA=PrAwins−1/2.
If the matching session ofΠ computes the same session key and no efficient adversary A has more than a negligible advantage in winning the secure game, then the protocol Π is secure under the eCK security model.


## 3.1. Mathematical Hard Problems

(i)
Elliptic Curve Discrete Logarithm (ECDL) Problem: Given an elliptic curve Ep, an additive cyclic group G based on Ep, a generator P of G, and an element Q=aP from G, it is hard to extract a∈Zp∗ from Q and P.(ii)
Elliptic Curve Computational Diffie–Hellman (ECCDH) Problem: Given an elliptic curve Ep, an additive cyclic group G based on Ep, and a generator P of G, considering the elements S=aP and T=bP from G, it is hard to compute U=abP.


## 3.2. Security Model

LaMacchia et al. [25] proposed the eCK security model in 2007. In this model, each entity owns two secrets, a long-term key x and an ephemeral key r. Assume two entities are A and B; their long-term keys are xA, xB; and their ephemeral keys are rA, rB, respectively. Besides, each session under the eCK security model has its own identity, denoted as SIDA,Bi if this session’s owner is entity A. Then, the abilities of adversary, denoted as A, can be defined through the queries below:(i)
Send(A,M): Through this query, A can send message M to entity A and get the corresponding message according to the protocol.(ii)
Reveal(SIDA,Bi): Through this query, A can acquire the session key of SIDA,Bi if session SIDA,Bi has been completed. Otherwise, A will get nothing.(iii)
Ephemeral(SIDA,Bi): Through this query, A can obtain the ephemeral key of the session SIDA,Bi.(iv)
Longterm(A): Through this query, A can obtain the long-term key of entity A.(v)
Test(SIDA,Bi): If A launches this query, session SIDA,Bi will randomly choose b from 0,1. If b=0, SIDA,Bi will choose a random number from the set of keys and send it back to A. If b=1, SIDA,Bi will send the real session key back to A.To define a secure protocol in the eCK security model, a definition of freshness should be presented first since a secure game through Test(SIDA,Bi) is querying toward a fresh session.Definition 1.
A session with identitySIDA,Bi in the eCK model at entity A whose intended partner denoted as B is fresh if the following items are satisfied:(i)
The session has not been asked for a Reveal query.(ii)
If a matching session exists with session identitySIDB,Aj, then(i)
not both Ephemeral(SIDA,Bi) and Longterm(A) queries have been asked for;(ii)
not both Ephemeral(SIDB,Aj) and Longterm(B) queries have been asked for.(iii)
If no partner exists, then(i)
not both Ephemeral(SIDA,Bi) and Longterm(A) queries have been asked for;(ii)
Longterm(B) queries have not been asked for.
Based on this definition, we present the definition of a secure session in the eCK security model.Definition 2.
The advantage of the adversaryA in the secure game with AKA protocol Π is defined as AdvΠAKAA=PrAwins−1/2.
If the matching session ofΠ computes the same session key and no efficient adversary A has more than a negligible advantage in winning the secure game, then the protocol Π is secure under the eCK security model.


## 4. Review of SMDAS Protocol

In this section, we review the registration and session key distribution phases of SMDAS protocol [10]. There are three types of entities participating in SMDAS protocol, namely, a sensor node SNi, a dew server DSj, and a cloud server S. Notations used in SMDAS protocol are listed in Table 2.Table 2
Notations applied in SMDAS protocol.
ParametersDescriptionSThe cloud/fog serverSNiThe sensor nodeiDSjThe dew serverjIDSNi,IDDSjThe identity ofSNi, DSj, respectivelySThe secret key ofSPWSNiThe password of sensor nodeiTi,TjTimestamp generated bySNi, DSj, respectivelyh( )One-way hash function defined fromZn∗ to Zn∗AThe adversary


### 4.1. Registration Phase

Firstly, the cloud serverS initializes this system according to the following steps.(i)
S selects an appropriate elliptic curve E over a finite field Fq and then selects G, a subgroup of E, whose order is n. P is a group generator of G.(ii)
S randomly chooses s∈Zn∗ and calculates X=sP,A=eP,Ps.(iii)
Finally,S publishes the public parameters E,G,A,n,P,X and keeps s as its own secret key securely.


### 4.2. Dew Server Registration Phase

Assume that there arem dew servers and each one is denoted as DSj, j∈1,2,…,m. These servers select their own identities IDDSj. When a dew server registers to the cloud server, it sends its identity IDDSj to S. After receiving DSj’s identity, S will compute SIDDSj for DSj, where SIDDSj=sX+P⋅hIDDSj.


### 4.3. Sensor Node Registration Phase

Every sensor node, denoted asSNi, has its own identity IDSNi and password PWSNi. When the sensor node needs to register to S, it firstly computes SH1=hIDSNi‖PWSNi and sends message IDSNi,H1 to S. Upon receiving the registration request from SNi, S verifies IDSNi to confirm SNi is an unregistered node. Then, S computes I=hIDSNi‖s, H2=I⊕H1, SIDSNi=sP+I. After computing, S stores SIDi and sends message H2,SIDSNi to SNi. When SNi receives message from S, it computes I=H2⊕H1 and stores SIDSNi,I.


### 4.4. Session Key Distribution Phase

AfterDSj and SNi register to S, they can establish a session with SIDSNi and SIDDSj. The detailed steps are described below.(i)
SNi randomly chooses ru∈Zn∗ and computes the corresponding public key Ru=ruP and Z=Aru. Then, SNi calculates the elements of message as follows: M=Ru+X+P⋅hIDDSj, N=hZ⊕IDSNi, Q=hZIDSNiX⊕Ru, S=SIDSNi⊕hRuIDSNiTSi‖Z, J=hSIDSNiSRuNQIDSNiTSi. SNi sends M,N,Q,SJ,TSi, where TSi is the current timestamp.(ii)
DSj computes Z′, IDSNi′, Ru′, and SIDi′. According to these parameters, DSj verifies whether J′ equals J. DSj randomly selects y∈Zn∗ and computes the public key Y=yP. Then, DSj calculates Tj=hIDSNi′IDDSjRu′YTSj, F=SIDSNi′⊕Tj, SK=hSIDSNi′TjTSj, Ve=hSK‖TjFTSj. DSj sends message TSj,Ve,F, where TSj is the current timestamp and stores the session key SK.(iii)
SNi computes Tj′, SK′, and Ve′. According to these parameters, SNi verifies whether Ve′ equals Ve. If it succeeds, SNi accepts SK′ as the session key.


## 4.1. Registration Phase

Firstly, the cloud serverS initializes this system according to the following steps.(i)
S selects an appropriate elliptic curve E over a finite field Fq and then selects G, a subgroup of E, whose order is n. P is a group generator of G.(ii)
S randomly chooses s∈Zn∗ and calculates X=sP,A=eP,Ps.(iii)
Finally,S publishes the public parameters E,G,A,n,P,X and keeps s as its own secret key securely.


## 4.2. Dew Server Registration Phase

Assume that there arem dew servers and each one is denoted as DSj, j∈1,2,…,m. These servers select their own identities IDDSj. When a dew server registers to the cloud server, it sends its identity IDDSj to S. After receiving DSj’s identity, S will compute SIDDSj for DSj, where SIDDSj=sX+P⋅hIDDSj.


## 4.3. Sensor Node Registration Phase

Every sensor node, denoted asSNi, has its own identity IDSNi and password PWSNi. When the sensor node needs to register to S, it firstly computes SH1=hIDSNi‖PWSNi and sends message IDSNi,H1 to S. Upon receiving the registration request from SNi, S verifies IDSNi to confirm SNi is an unregistered node. Then, S computes I=hIDSNi‖s, H2=I⊕H1, SIDSNi=sP+I. After computing, S stores SIDi and sends message H2,SIDSNi to SNi. When SNi receives message from S, it computes I=H2⊕H1 and stores SIDSNi,I.


## 4.4. Session Key Distribution Phase

AfterDSj and SNi register to S, they can establish a session with SIDSNi and SIDDSj. The detailed steps are described below.(i)
SNi randomly chooses ru∈Zn∗ and computes the corresponding public key Ru=ruP and Z=Aru. Then, SNi calculates the elements of message as follows: M=Ru+X+P⋅hIDDSj, N=hZ⊕IDSNi, Q=hZIDSNiX⊕Ru, S=SIDSNi⊕hRuIDSNiTSi‖Z, J=hSIDSNiSRuNQIDSNiTSi. SNi sends M,N,Q,SJ,TSi, where TSi is the current timestamp.(ii)
DSj computes Z′, IDSNi′, Ru′, and SIDi′. According to these parameters, DSj verifies whether J′ equals J. DSj randomly selects y∈Zn∗ and computes the public key Y=yP. Then, DSj calculates Tj=hIDSNi′IDDSjRu′YTSj, F=SIDSNi′⊕Tj, SK=hSIDSNi′TjTSj, Ve=hSK‖TjFTSj. DSj sends message TSj,Ve,F, where TSj is the current timestamp and stores the session key SK.(iii)
SNi computes Tj′, SK′, and Ve′. According to these parameters, SNi verifies whether Ve′ equals Ve. If it succeeds, SNi accepts SK′ as the session key.


## 5. Cryptanalysis of SMDAS Protocol

In this section, we present two security flaws of SMDAS protocol as the adversaryA can acquire private key of SNi and DSj through Extract(IDSNi) and Extract(IDDSj), respectively, mentioned in [10].


### 5.1. Lack of Forward Security

In this subsection, we demonstrate if the private key of sensor nodei is compromised; then, the session key will be easily recovered by the adversary A:(i)
In the session key distribution phase,A eavesdrops the message from dew server to sensor node, TSj,Ve,F.(ii)
A launches Extract query to the sensor node SNi and acquires SNi’s private secret keys SIDSNi.(iii)
After obtaining the parameters above,A can extract Tj′ by Tj′=F⊕SIDSNi and the session key according to the way generating SK=hSIDSNiTj′TSj.Thus, in this way, adversaryA can recover the session key. It can be concluded that the steps described are in accordance with the definition of weak forward security.


### 5.2. Lack of User Anonymity

We point out an efficient method to prove that SMDAS protocol lacks user anonymity in this subsection by compromising the private key of dew server following the steps below.(i)
A first eavesdrops the message M,N,Q,S,J,TSi.(ii)
Then,A launches Extract(IDDSj) to get the private key of DSj, SIDDSj.(iii)
In this way,A can compute Z′=eM,X/eSIDDSj,P.(iv)
Finally, the adversary can derive the identity ofSNi as IDSNi=N⊕hZ′.When the adversary implements the attack described above,A can easily get the identity of the sensor node. This means SMDAS protocol can hardly protect the anonymity of users.


## 5.1. Lack of Forward Security

In this subsection, we demonstrate if the private key of sensor nodei is compromised; then, the session key will be easily recovered by the adversary A:(i)
In the session key distribution phase,A eavesdrops the message from dew server to sensor node, TSj,Ve,F.(ii)
A launches Extract query to the sensor node SNi and acquires SNi’s private secret keys SIDSNi.(iii)
After obtaining the parameters above,A can extract Tj′ by Tj′=F⊕SIDSNi and the session key according to the way generating SK=hSIDSNiTj′TSj.Thus, in this way, adversaryA can recover the session key. It can be concluded that the steps described are in accordance with the definition of weak forward security.


## 5.2. Lack of User Anonymity

We point out an efficient method to prove that SMDAS protocol lacks user anonymity in this subsection by compromising the private key of dew server following the steps below.(i)
A first eavesdrops the message M,N,Q,S,J,TSi.(ii)
Then,A launches Extract(IDDSj) to get the private key of DSj, SIDDSj.(iii)
In this way,A can compute Z′=eM,X/eSIDDSj,P.(iv)
Finally, the adversary can derive the identity ofSNi as IDSNi=N⊕hZ′.When the adversary implements the attack described above,A can easily get the identity of the sensor node. This means SMDAS protocol can hardly protect the anonymity of users.


## 6. e-SMDAS Protocol

In this section, we propose a new anonymity and secure mutual AKA protocol remedying the flaws of SMDAS protocol, which we call e-SMDAS protocol.There are three main phases in the proposed protocol, namely, initialization phase, registration phase, and secure session key establishment phase. Particularly, the registration phase can be divided into two parts, the sensor node registration phase and the dew server registration phase. In Table3, the notations applied in the proposed protocol are presented.Table 3
Notations applied in e-SMDAS protocol.
ParametersDescriptionParametersDescriptionλThe security parametereSNi,eDSjThe ephemeral private keys ofSNi, DSj, respectivelySThe cloud/fog serverT1,T2The timestampsSNiThe sensor nodeih1One-way hash function defined from0,1∗ to Zp∗DSjThe dew serverjh2One-way hash function defined from0,1∗ to 0,1l, where l is the length of session keySThe secret key ofSh3One-way hash function defined from0,1∗ to 0,12λIDSNi,IDDSjThe identity ofSNi, DSj, respectivelyAThe adversary


### 6.1. Initialization Phase

The cloud server, also the registration server, acts as the trusted authority. It first selects a suitable cyclic groupG based on an elliptic curve E. The order of the group is the prime p and the generator of the group is P. Then, the server randomly selects s∈Zp∗ as its master key while it computes its public key X=sP accordingly and defines the three hash functions h1, h2, h3. Finally, the server publishes the public parameters E,G,P,X,p,h1,h2,h3 to initialize the system and keeps s secretly.


### 6.2. Registration Phase

Before sensor nodes and dew servers are put into usage, they must be registered in the cloud server first to acquire their long-term keys in the further communications. Both the sensor node registration phase and the dew server registration phase are described as follows.


#### 6.2.1. Sensor Node Registration Phase

BeforeSNi registers in the cloud server S, SNi should first choose its identity IDSNi and password PWSNi. Then, SNi can begin the registration phase as it first sends the registration request to the cloud server S.(i)
SNi first chooses its identity IDSNi and password PWSNi. It randomly selects lSNi in Zp∗ and computes H1=h1IDSNiPWSNilSNi. Finally, SNi sends message IDSNi,H1 to S.(ii)
After receivingIDSNi,H1 from SNi, S first checks if this identity has ever been registered. If it has not, then the server computes LSNi=sH1P. After finishing computation, S sends message LSNi back to SNi.(iii)
After gettingLSNi from S, SNi stores LSNi,H1 as its long-term key securely and deletes lSNi timely.


#### 6.2.2. Dew Server Registration Phase

Just as the sensor node registration phase, the dew serverDSj first registers in the cloud server S. DSj operates the following steps for registration:(i)
DSj randomly selects lDSj in Zp∗ and computes PDSj=lDSjP. Then, it sends its identity IDDSj and PDSj to S in a secure channel.(ii)
After receiving the message fromDSj, S first checks whether the IDDSj has been registered. If it has not, S generates the long-term key for the dew server. S computes H2=h1IDDSj‖PDSj, LDSj=sH2P and sends LDSj to DSj.(iii)
On receiving the message fromS, DSj stores LDSj,lDSj securely and publishes PDSj.


### 6.3. Secure Session Establishment Phase

After registering in the cloud server, both the sensor nodeSNi and the dew server DSj get their long-term keys. Then, they can establish their session key through the following steps, also illustrated in Figure 2.(i)
SNi randomly chooses eSNi∈Zp∗ and computes the corresponding public key ESNi=eSNiP. Then, SNi computes C1=h1LSNi‖IDSNi, A=IDSNi‖LSNi⊕h3eSNiPDSj‖T1. SNi sends message M1=A,ESNi,T1 to DSj as the request for service, where T1 is the present timestamp.(ii)
On receiving message fromSNi, DSj first checks the freshness of the timestamp T1. Then, it computes ESNilDSj and IDSNi‖LSNi=A⊕h3ESNilDSj‖T1. If it succeeds, DSj can obtain IDSNi‖LSNi, by utilizing which it can compute C1′. DSj randomly selects eDSj∈Zp∗ and computes EDSj=eDSjP, TDS=h3eDSjESNi‖T2 as well as the session key SKDtS=h2C1′TDST2. Finally, DSj computes C2=EDSj⊕LSNi⊕IDSNi, B=h1SKDtS‖T2 and sends message M2=B,C2,T2.(iii)
After receiving the message fromDSj, SNi computes EDSj=C2⊕LSNi⊕IDSNi, TSN=h3eSNiEDSj‖T2 and the session key SKStD=h2C1TSNT2. Finally, it verifies whether the equality B=h1SKStD‖T2 is right.Figure 2
Secure session establishment phase of e-SMDAS protocol.Hence, both the sensor nodeSNi and the dew server DSj get the same session key:(1)TDS=h3eDSjESNi‖T2=h3eDSjeSNiP‖T2=h3eSNiEDSj‖T2=TSN.In this way, if the dew server is the right potential partner, it can correctly calculateC1′. SNi and DSj can obtain the same session key apparently according to the equality bellow:(2)SKDtS=h2C1′TDST2=h2C1TSNT2=SKStD.


## 6.1. Initialization Phase

The cloud server, also the registration server, acts as the trusted authority. It first selects a suitable cyclic groupG based on an elliptic curve E. The order of the group is the prime p and the generator of the group is P. Then, the server randomly selects s∈Zp∗ as its master key while it computes its public key X=sP accordingly and defines the three hash functions h1, h2, h3. Finally, the server publishes the public parameters E,G,P,X,p,h1,h2,h3 to initialize the system and keeps s secretly.


## 6.2. Registration Phase

Before sensor nodes and dew servers are put into usage, they must be registered in the cloud server first to acquire their long-term keys in the further communications. Both the sensor node registration phase and the dew server registration phase are described as follows.


### 6.2.1. Sensor Node Registration Phase

BeforeSNi registers in the cloud server S, SNi should first choose its identity IDSNi and password PWSNi. Then, SNi can begin the registration phase as it first sends the registration request to the cloud server S.(i)
SNi first chooses its identity IDSNi and password PWSNi. It randomly selects lSNi in Zp∗ and computes H1=h1IDSNiPWSNilSNi. Finally, SNi sends message IDSNi,H1 to S.(ii)
After receivingIDSNi,H1 from SNi, S first checks if this identity has ever been registered. If it has not, then the server computes LSNi=sH1P. After finishing computation, S sends message LSNi back to SNi.(iii)
After gettingLSNi from S, SNi stores LSNi,H1 as its long-term key securely and deletes lSNi timely.


### 6.2.2. Dew Server Registration Phase

Just as the sensor node registration phase, the dew serverDSj first registers in the cloud server S. DSj operates the following steps for registration:(i)
DSj randomly selects lDSj in Zp∗ and computes PDSj=lDSjP. Then, it sends its identity IDDSj and PDSj to S in a secure channel.(ii)
After receiving the message fromDSj, S first checks whether the IDDSj has been registered. If it has not, S generates the long-term key for the dew server. S computes H2=h1IDDSj‖PDSj, LDSj=sH2P and sends LDSj to DSj.(iii)
On receiving the message fromS, DSj stores LDSj,lDSj securely and publishes PDSj.


## 6.2.1. Sensor Node Registration Phase

BeforeSNi registers in the cloud server S, SNi should first choose its identity IDSNi and password PWSNi. Then, SNi can begin the registration phase as it first sends the registration request to the cloud server S.(i)
SNi first chooses its identity IDSNi and password PWSNi. It randomly selects lSNi in Zp∗ and computes H1=h1IDSNiPWSNilSNi. Finally, SNi sends message IDSNi,H1 to S.(ii)
After receivingIDSNi,H1 from SNi, S first checks if this identity has ever been registered. If it has not, then the server computes LSNi=sH1P. After finishing computation, S sends message LSNi back to SNi.(iii)
After gettingLSNi from S, SNi stores LSNi,H1 as its long-term key securely and deletes lSNi timely.


## 6.2.2. Dew Server Registration Phase

Just as the sensor node registration phase, the dew serverDSj first registers in the cloud server S. DSj operates the following steps for registration:(i)
DSj randomly selects lDSj in Zp∗ and computes PDSj=lDSjP. Then, it sends its identity IDDSj and PDSj to S in a secure channel.(ii)
After receiving the message fromDSj, S first checks whether the IDDSj has been registered. If it has not, S generates the long-term key for the dew server. S computes H2=h1IDDSj‖PDSj, LDSj=sH2P and sends LDSj to DSj.(iii)
On receiving the message fromS, DSj stores LDSj,lDSj securely and publishes PDSj.


## 6.3. Secure Session Establishment Phase

After registering in the cloud server, both the sensor nodeSNi and the dew server DSj get their long-term keys. Then, they can establish their session key through the following steps, also illustrated in Figure 2.(i)
SNi randomly chooses eSNi∈Zp∗ and computes the corresponding public key ESNi=eSNiP. Then, SNi computes C1=h1LSNi‖IDSNi, A=IDSNi‖LSNi⊕h3eSNiPDSj‖T1. SNi sends message M1=A,ESNi,T1 to DSj as the request for service, where T1 is the present timestamp.(ii)
On receiving message fromSNi, DSj first checks the freshness of the timestamp T1. Then, it computes ESNilDSj and IDSNi‖LSNi=A⊕h3ESNilDSj‖T1. If it succeeds, DSj can obtain IDSNi‖LSNi, by utilizing which it can compute C1′. DSj randomly selects eDSj∈Zp∗ and computes EDSj=eDSjP, TDS=h3eDSjESNi‖T2 as well as the session key SKDtS=h2C1′TDST2. Finally, DSj computes C2=EDSj⊕LSNi⊕IDSNi, B=h1SKDtS‖T2 and sends message M2=B,C2,T2.(iii)
After receiving the message fromDSj, SNi computes EDSj=C2⊕LSNi⊕IDSNi, TSN=h3eSNiEDSj‖T2 and the session key SKStD=h2C1TSNT2. Finally, it verifies whether the equality B=h1SKStD‖T2 is right.Figure 2
Secure session establishment phase of e-SMDAS protocol.Hence, both the sensor nodeSNi and the dew server DSj get the same session key:(1)TDS=h3eDSjESNi‖T2=h3eDSjeSNiP‖T2=h3eSNiEDSj‖T2=TSN.In this way, if the dew server is the right potential partner, it can correctly calculateC1′. SNi and DSj can obtain the same session key apparently according to the equality bellow:(2)SKDtS=h2C1′TDST2=h2C1TSNT2=SKStD.


## 7. Security Proof

This section provides the proof of the security of e-SMDAS protocol by three methods. Firstly, we prove the proposed protocol security under the eCK security model. Then, we present a further security attribute analysis using the Scyther tool. Finally, by using BAN logic, we deduce the final security goals.


### 7.1. Security Theorem

We have proven the correctness of the proposed protocol above; in this subsection, we will prove the security of e-SMDAS protocol.Theorem 1.
LetA be a probabilistic polynomial time adversary against the proposed protocol Π with a time bound t, making at most qs. Send queries qh1, qh2, qh3 random oracle queries. Then,(3)AdvΠA≤qs2λ−2+qs22λ−2+2λ⋅qh12+qh3222λ+qh222l+2qh2qs2AdvECCDHS,where AdvECCDHS means the success probability of solving an instance of ECCDH problem by an algorithm S.Proof.
of Theorem 1: Next, we will prove the security of the proposed protocol through defining a sequence of hybrid experiments whereA correctly guesses the random bit b in the Test query. Specifically, each experiment has a definition of Succi to illustrate the advantage.(i)
Experiment 0: This experiment simulates the situation of the attacks against the real protocols in the random oracle model. According to the definition, there exists AdvA=2PrSucc0−1, which means the origin advantage of adversary.(ii)
Experiment 1: In this experiment, S simulates the random oracles h1, h2, and h3 by keeping hash lists Lh1, Lh2, Lh3 as follows:(i)
If there exists a record of messageM as M,H in the list Lh1, it returns H. Otherwise, it selects an element H, adds the record M,H to the list Lh1, and then returns H.(ii)
If there exists a record of messageM as M,K in the list Lh2, it returns K. Otherwise, it selects an element K in the key set, adds the record M,K to the list Lh2, and then returns K.(iii)
If there exists a record of messageM as M,J in the list Lh3, it returns J. Otherwise, it selects an element J in the key set, adds the record M,J to the list Lh3, and then returns J.
The Send, Reveal, Longterm, Ephemeral, and Test queries are also simulated as the real attack. Thus, this experiment is same as the real experiment, which means that the equationPrSucc1=PrSucc0 holds.(i)
Experiment 2: In this experiment, we simulate all oracles the same as Experiment 1 except that a collision occurs in the output of the oracle h1 or the session transcripts. According to the birthday paradox, the probability of collisions in the output of the oracle h1 is at most qh12/2λ+1, where qh1 is the maximum times of queries to h1. The same deduction can be applied to h2 and h3. Therefore, the successful probability of Experiment 2 satisfies PrSucc2−PrSucc1≤qh12/2λ+1+qh32/22⋅λ+1+qh22/2l+1.(ii)
Experiment 3: In this experiment, the protocol will not halt except that A successfully guesses C1 or TDS (TSN) without querying h1 or h3. Therefore, there exists PrSucc3−PrSucc2≤2⋅qs/2λ+2⋅qs/22⋅λ.(iii)
Experiment 4: In this experiment, we only consider the situation where A exactly chooses a random session as the test session. Besides, the computation of the test session key is modified to select a random key from the key set. Consequently, the difference between Experiment 3 and Experiment 4 is in the event when A queries the tuple C1TSNT2 or C1TDST2 to h2 in the test session. To describe this difference, the following four cases may be considered:(i)
Longterm(SNi) and Longterm(DSj) are queried, from which A can obtain the long-term key LSNi of SNi and lDSj, LDSj of DSj. To calculate the session key, either eSNi or eDSj is required.(ii)
Longterm(SNi) and Ephemeral(DSj) are queried, from which A can obtain the long-term key LSNi of SNi and eDSj of DSj. To calculate the session key, eSNi is required.(iii)
Ephemeral(SNi) and Longterm(DSj) are queried, from which A can obtain the long-term key eSNi of SNi and lDSj, LDSj of DSj. To calculate the session key, eDSj is required.(iv)
Ephemeral(SNi) and Ephemeral(DSj) are queried, from which A can obtain the long-term key eSNi of SNi and eDSj of DSj. To calculate the session key, LSNi and lDSj are required.
If any of these four cases happens, then referring to the method proposed in [26], we can construct an algorithm S to solve an instance of ECCDH problem, and there exists(4)PrSucc4−PrSucc3≤qh2qs2AdvECCDHS.
Besides, inExperiment 4, to guess the bit b in the Test query is random, and other sessions do not matter. Therefore, there exists PrSucc4=1/2.


### 7.2. Scyther Security Analysis

Besides proving the security of the proposed model formally, we also use Scyther tool to show the proposed protocol is secure against various attacks. The setting used is presented in Figure3 to achieve highly strong security, including perfect forward security, resistance to session key reveal attack, and resistance to ephemeral key leakage attack.Figure 3
The setting of Scyther.The result of analysis is demonstrated in Figure4. According to Figure 4, we can clearly infer that under the setting predefined, the session key is secure against various attacks.Figure 4
The analysis result by Scyther tool.


### 7.3. BAN Logic Formalized Security Proof

In this subsection, we provide another method to analyze the security of e-SMDAS protocol.Next, we will prove that the proposed protocol can achieve the mutual authentication and two participants can obtain the same session key. We first present the security goals using BAN logic followed. We simplify the sensor nodeSNi as N, and the dew server DSj as D.(i)
G1NbelievesN↔SKD.(ii)
G2DbelievesN↔SKD.(iii)
G3NbelievesDbelievesN↔SKD.(iv)
G4DbelievesNbelievesN↔SKD.Then, we formalize the original messages into the idealized ones as follows:(i)
M1N⟶D:N,LN,T1eN⋅PD,⟶K2N,T1.(ii)
M2D⟶N:T2KND,⟶K2DLN,T2.Thirdly, we make the initial assumptions.(i)
A1DbelievesfreshT1.(ii)
A2NbelievesfreshT2.(iii)
A3DbelievesN⇔END.(iv)
A4NbelievesD⇔EDN.(v)
A5DbelievesNcontrolsN↔KNDD.(vi)
A6NbelievesDcontrolsN↔KNDD.Finally, following the idealized messages, we utilize the predefined notations, rules, and assumptions to deduce the goals of the proposed protocol. The proof process is presented as follows:(i)
FromM1, we can derive the formula F1 as follows:(1)
F1DseesN,LN,T1eN⋅PD,⟶K2N,T1.(ii)
According toR4 and F1, we can deduce the formula F2∼F4 as follows:(1)
F3DseesT1.(2)
F4Dsees⟶K2N.(iii)
According toR1, A3, and F2, we can deduce the formula F5 as follows:(1)
F5DbelievesNsaidN,KN,T1.(iv)
According toF5, A1, and R2, we can deduce the formula F6∼F8 as follows:(1)
F6DbelievesNbelievesN,KN,T1.(2)
F7DbelievesNbelievesN,KN.(3)
F8DbelievesNbelievesC1.(v)
FromM2, we can derive the formula F9 below:(1)
F9NseesT2KND,⟶K1N,NED,T2.(vi)
According toR4, A2 and F9, we can deduce the formula F10, F11, and F12:(1)
F10NseesT2KND.(2)
F11Nsees⟶K1N,NED.(3)
F12Nbelievesfresh0⟶K1N,NED.(vii)
According toF11, A4, and R1, we can deduce the formula F13:(1)
F14NbelievesDsaid⟶K1N,N.(viii)
According toF13, F12, and R2, we can deduce the formula F14∼F15:(1)
F14NbelievesDbelievesLN,N.(2)
F15NbelievesDbelievesC1.(ix)
SinceKND=h2C1h3eNeDP‖T2T2, we can deduce the formula F16 according to F15, A2, and A4, which is also G3:(1)
F16NbelievesDbelievesN↔SKD.(x)
SinceKND=h2C1h3eNeDP‖T2T2, we can deduce the formula F17 according to F8, A1, and A3, which is also G4:(1)
F17DbelievesNbelievesN↔SKD.(xi)
According toF16, A5, and R3, we deduce the formula F18, which is also G1:(1)
F18NbelievesN↔SKD.(xii)
Similarly, according toF17, A6, and R3, we deduce the formula F19, which is also G2:(1)
F19DbelievesN↔SKD.According toF16 to F19, the secure goals G1 to G4 of e-SMDAS protocol are achieved. The sensor node SNi and the dew server DSj can achieve the mutual authentication and the same session key securely.


## 7.1. Security Theorem

We have proven the correctness of the proposed protocol above; in this subsection, we will prove the security of e-SMDAS protocol.Theorem 1.
LetA be a probabilistic polynomial time adversary against the proposed protocol Π with a time bound t, making at most qs. Send queries qh1, qh2, qh3 random oracle queries. Then,(3)AdvΠA≤qs2λ−2+qs22λ−2+2λ⋅qh12+qh3222λ+qh222l+2qh2qs2AdvECCDHS,where AdvECCDHS means the success probability of solving an instance of ECCDH problem by an algorithm S.Proof.
of Theorem 1: Next, we will prove the security of the proposed protocol through defining a sequence of hybrid experiments whereA correctly guesses the random bit b in the Test query. Specifically, each experiment has a definition of Succi to illustrate the advantage.(i)
Experiment 0: This experiment simulates the situation of the attacks against the real protocols in the random oracle model. According to the definition, there exists AdvA=2PrSucc0−1, which means the origin advantage of adversary.(ii)
Experiment 1: In this experiment, S simulates the random oracles h1, h2, and h3 by keeping hash lists Lh1, Lh2, Lh3 as follows:(i)
If there exists a record of messageM as M,H in the list Lh1, it returns H. Otherwise, it selects an element H, adds the record M,H to the list Lh1, and then returns H.(ii)
If there exists a record of messageM as M,K in the list Lh2, it returns K. Otherwise, it selects an element K in the key set, adds the record M,K to the list Lh2, and then returns K.(iii)
If there exists a record of messageM as M,J in the list Lh3, it returns J. Otherwise, it selects an element J in the key set, adds the record M,J to the list Lh3, and then returns J.
The Send, Reveal, Longterm, Ephemeral, and Test queries are also simulated as the real attack. Thus, this experiment is same as the real experiment, which means that the equationPrSucc1=PrSucc0 holds.(i)
Experiment 2: In this experiment, we simulate all oracles the same as Experiment 1 except that a collision occurs in the output of the oracle h1 or the session transcripts. According to the birthday paradox, the probability of collisions in the output of the oracle h1 is at most qh12/2λ+1, where qh1 is the maximum times of queries to h1. The same deduction can be applied to h2 and h3. Therefore, the successful probability of Experiment 2 satisfies PrSucc2−PrSucc1≤qh12/2λ+1+qh32/22⋅λ+1+qh22/2l+1.(ii)
Experiment 3: In this experiment, the protocol will not halt except that A successfully guesses C1 or TDS (TSN) without querying h1 or h3. Therefore, there exists PrSucc3−PrSucc2≤2⋅qs/2λ+2⋅qs/22⋅λ.(iii)
Experiment 4: In this experiment, we only consider the situation where A exactly chooses a random session as the test session. Besides, the computation of the test session key is modified to select a random key from the key set. Consequently, the difference between Experiment 3 and Experiment 4 is in the event when A queries the tuple C1TSNT2 or C1TDST2 to h2 in the test session. To describe this difference, the following four cases may be considered:(i)
Longterm(SNi) and Longterm(DSj) are queried, from which A can obtain the long-term key LSNi of SNi and lDSj, LDSj of DSj. To calculate the session key, either eSNi or eDSj is required.(ii)
Longterm(SNi) and Ephemeral(DSj) are queried, from which A can obtain the long-term key LSNi of SNi and eDSj of DSj. To calculate the session key, eSNi is required.(iii)
Ephemeral(SNi) and Longterm(DSj) are queried, from which A can obtain the long-term key eSNi of SNi and lDSj, LDSj of DSj. To calculate the session key, eDSj is required.(iv)
Ephemeral(SNi) and Ephemeral(DSj) are queried, from which A can obtain the long-term key eSNi of SNi and eDSj of DSj. To calculate the session key, LSNi and lDSj are required.
If any of these four cases happens, then referring to the method proposed in [26], we can construct an algorithm S to solve an instance of ECCDH problem, and there exists(4)PrSucc4−PrSucc3≤qh2qs2AdvECCDHS.
Besides, inExperiment 4, to guess the bit b in the Test query is random, and other sessions do not matter. Therefore, there exists PrSucc4=1/2.


## 7.2. Scyther Security Analysis

Besides proving the security of the proposed model formally, we also use Scyther tool to show the proposed protocol is secure against various attacks. The setting used is presented in Figure3 to achieve highly strong security, including perfect forward security, resistance to session key reveal attack, and resistance to ephemeral key leakage attack.Figure 3
The setting of Scyther.The result of analysis is demonstrated in Figure4. According to Figure 4, we can clearly infer that under the setting predefined, the session key is secure against various attacks.Figure 4
The analysis result by Scyther tool.


## 7.3. BAN Logic Formalized Security Proof

In this subsection, we provide another method to analyze the security of e-SMDAS protocol.Next, we will prove that the proposed protocol can achieve the mutual authentication and two participants can obtain the same session key. We first present the security goals using BAN logic followed. We simplify the sensor nodeSNi as N, and the dew server DSj as D.(i)
G1NbelievesN↔SKD.(ii)
G2DbelievesN↔SKD.(iii)
G3NbelievesDbelievesN↔SKD.(iv)
G4DbelievesNbelievesN↔SKD.Then, we formalize the original messages into the idealized ones as follows:(i)
M1N⟶D:N,LN,T1eN⋅PD,⟶K2N,T1.(ii)
M2D⟶N:T2KND,⟶K2DLN,T2.Thirdly, we make the initial assumptions.(i)
A1DbelievesfreshT1.(ii)
A2NbelievesfreshT2.(iii)
A3DbelievesN⇔END.(iv)
A4NbelievesD⇔EDN.(v)
A5DbelievesNcontrolsN↔KNDD.(vi)
A6NbelievesDcontrolsN↔KNDD.Finally, following the idealized messages, we utilize the predefined notations, rules, and assumptions to deduce the goals of the proposed protocol. The proof process is presented as follows:(i)
FromM1, we can derive the formula F1 as follows:(1)
F1DseesN,LN,T1eN⋅PD,⟶K2N,T1.(ii)
According toR4 and F1, we can deduce the formula F2∼F4 as follows:(1)
F3DseesT1.(2)
F4Dsees⟶K2N.(iii)
According toR1, A3, and F2, we can deduce the formula F5 as follows:(1)
F5DbelievesNsaidN,KN,T1.(iv)
According toF5, A1, and R2, we can deduce the formula F6∼F8 as follows:(1)
F6DbelievesNbelievesN,KN,T1.(2)
F7DbelievesNbelievesN,KN.(3)
F8DbelievesNbelievesC1.(v)
FromM2, we can derive the formula F9 below:(1)
F9NseesT2KND,⟶K1N,NED,T2.(vi)
According toR4, A2 and F9, we can deduce the formula F10, F11, and F12:(1)
F10NseesT2KND.(2)
F11Nsees⟶K1N,NED.(3)
F12Nbelievesfresh0⟶K1N,NED.(vii)
According toF11, A4, and R1, we can deduce the formula F13:(1)
F14NbelievesDsaid⟶K1N,N.(viii)
According toF13, F12, and R2, we can deduce the formula F14∼F15:(1)
F14NbelievesDbelievesLN,N.(2)
F15NbelievesDbelievesC1.(ix)
SinceKND=h2C1h3eNeDP‖T2T2, we can deduce the formula F16 according to F15, A2, and A4, which is also G3:(1)
F16NbelievesDbelievesN↔SKD.(x)
SinceKND=h2C1h3eNeDP‖T2T2, we can deduce the formula F17 according to F8, A1, and A3, which is also G4:(1)
F17DbelievesNbelievesN↔SKD.(xi)
According toF16, A5, and R3, we deduce the formula F18, which is also G1:(1)
F18NbelievesN↔SKD.(xii)
Similarly, according toF17, A6, and R3, we deduce the formula F19, which is also G2:(1)
F19DbelievesN↔SKD.According toF16 to F19, the secure goals G1 to G4 of e-SMDAS protocol are achieved. The sensor node SNi and the dew server DSj can achieve the mutual authentication and the same session key securely.


## 8. Performance Analysis

In this section, we present the performance analysis of e-SMDAS protocol, compared with several recent works, namely, SMDAS [10], He et al.’s scheme [27], and Ying et al.’s scheme [28], from the aspects of security features and computational efficiency.Table4 demonstrates the result of security feature comparison with several similar works. According to the work of [29, 30], the comparative result of security features is clear. It is shown in the table that the proposed protocol remedies the flaws of SMDAS protocol. As Table 4 shows, the e-SMDAS protocol can resist replay attack as well as user impersonation attack and satisfy the secure requirements for anonymity and forward security. Generally, our e-SMDAS protocol performs better than the previous one.Table 4
Comparison of security features with SMDAS protocol.
Security featuresScheme[27][28]SMDASe-SMDASMutual authenticationNoYesYesYesSession key agreementYesYesYesYesReplay attack resistanceYesNoYesYesUser impersonation attack resistanceNoNoYesYesUser anonymityNoYesNoYesForward securityYesYesNoYesBefore presenting the analysis, we first denote the notations used in the estimation of the computation efficiency. To be concise, the meanings ofTpa, Te, Th, Tb, Teb, Tma, and Tenc/dec are time of performing a point addition in elliptic curve group, time of performing an exponentiation operation in cyclic group, time of performing a hash function, time of performing a bilinear map, time of performing an exponentiation over bilinear pairing, time of performing a modular addition in cyclic group, and time of performing an encryption or decryption operation, respectively. Besides, the time of XOR can be negligible. In Table 5, we compare the computation efficiency of the related works with that of ours. For the sensor node in the proposed protocol, the computation cost is 5Th+Te. On the other hand, dew server operates at the cost of 5Th+Te.Table 5
Comparison of the communication efficiency.
SchemeCommunication efficiencyComputation costCommunication cost (bits)SMDAS10Th+Tb+Tpa1184He et al. [27]4Te+5Tpa+2Tb+5Th3296Ying et al. [28]7Te+10Th+4Tenc/dec3840e-SMDAS10Th+2Te1024Note.Tpa: point addition in elliptic curve group; Te: exponentiation operation in cyclic group; Th: hash function; Tb: bilinear map; Teb: exponentiation operation over bilinear pairing; Tma: modular addition in cyclic group; Tenc/dec: encryption/decryption operation.To compare the efficiency of communication precisely, we simulate the schemes under the following assumptions. The output length of hash function is 160 bits while that of symmetric encryption tool is 1024 bits. The size of timestamp is 32 bits, while the output of elliptic curve is 160 bit. The comparative result is demonstrated in both Table5 and Figure 5, in which e-SMDAS appears to be more efficient.Figure 5
The comparison of the communication cost.


## 9. Conclusion

The dew-assisted IoT framework is an essential approach developing rapidly in the communication systems, which can provide high efficiency and low latency. In this paper, we first analyze SMDAS protocol showing that this protocol lacks forward security and user anonymity. Then, based on ECCDH problem, we propose an enhancement of the original one, called e-SMDAS protocol. We present the formal security proof of the proposed protocol. Moreover, the test of security by the usage of formalization tool Scyther and BAN logic shows that e-SMDAS can satisfy more security features than the former protocol. Furthermore, the performance analysis is presented at last showing that the enhancement does not affect the running time and computation efficiency.



---

*Source: 7125491-2022-06-15.xml*