# Trusted Authority Assisted Three-Factor Authentication and Key Agreement Protocol for the Implantable Medical System

Authors: Deming Mao; Ling Zhang; Xiaoyu Li; Dejun Mu
Journal: Wireless Communications and Mobile Computing
 (2018)

---

## Abstract

The application of implantable medical devices (IMDs), which solves the problems of geographical distance limitation and real-time health monitoring that plague patients and doctors, has caused great repercussions in the medical community. Despite the great potential of wide application, it also brings some security and privacy issues, such as the leakage of health data and unauthorized access to IMDs. Although a number of authentication and key agreement (AKA) schemes have been developed, we find that some subtle attacks still remain to be addressed. Then we propose an improved AKA scheme which achieves strong security features including user anonymity and known key security. It is formally proved to be secure under the Real-or-Random model. Moreover, a comprehensive security analysis shows that our scheme can resist various attacks and satisfy the desired requirements. Finally, the performance analysis shows the superiority of our protocol which is suitable for the implantable medical system.


---

## Body

## 1. Introduction

With the improvement of wireless communication technologies, the implantable medical devices (IMDs), such as pacemakers, cranial nerve stimulators, and cochlear implants, have been widely used in the medical services field [1, 2]. All these micro devices implanted in patients’ body can continuously monitor and collect data to reflect the patient’s health. Through controller node (CN), implantable medical devices are able to transmit the data to the remote attending physician or the medical institution, which greatly simplifies the treatment process of patients and breaks the limitation of region. Generally speaking, the combination of these advanced technologies improves health care practices, urgent care, and preventive health [3].A typical architecture of implantable medical system is shown in Figure1. CN and IMDs firstly register to the trusted authority (TA) before they are deployed into the system. Then, IMDs collect data such as body temperature, heart beats, and blood pressure, which can be derived by CN via wireless communication technologies, such as Bluetooth or ZigBee [4]. After the collection process, the CN needs to be plugged into the Internet via an access point to be accessible by the attending physician or the medical institution. In the meantime, cloud servers may be used for storing collected health data to ease the storage burden on mobile devices [5, 6].Figure 1
The network model of the implantable medical system.However, it is the application of wireless communication that makes the transmission of medical data face the potential security risks [7–9]. According to the Dolev-Yao threat model [10], the implantable medical system is facing a wide range of malicious attacks which may cause the leakage of health data and unauthorized access to IMDs. In response to the serious security threats, it is imperative to design a mutual authentication and key agreement (AKA) mechanism which can ensure the confidentiality of the transmitted sensor data and resist malicious attacks.


### 1.1. Related Work

With the wireless interface enabled, IMDs can be accessed by an authorized operator in physical proximity via the IMDs programmer. However, the wireless communication and networking capabilities of IMDs turn out to be the major sources of security vulnerabilities [11, 12]. For this purpose, access control for implantable medical system is highly desired and many schemes have also been put forward in this field.Initially, considering the scarce energy reserves and limited communication capacity of IMDs, some schemes based on symmetric key cryptography [15–19] were proposed, they realized high encryption speed and efficiency at the same time but showed weaknesses of resisting against certain attacks, and the complexity of key management will introduce large memory and communication overhead which contradicts their original intentions. This means that the symmetric key cryptography based schemes are difficult to provide a complete security guarantee for implantable medical system.Then, traditional public key cryptography (TPKC) based authentication schemes [20, 21] were implemented in IMDs. Unfortunately, the limited computing capability and battery capacity of the mobile device hinders the application of TPKC in implantable medical system. The concept of ECC (Elliptic curve cryptosystem) was then put forward [22] which provided the same security with a much smaller key size compare to the TPKC [23] so that many ECC-based protocols were proposed subsequently [13, 24]. In 2013, Liu et al. [25] put forward a scheme in which they used the bilinear pairing defined on the elliptic curve to design a new certificateless signature scheme, but later in 2014, Xiong [26] analyzed the Liu et al.’s authentication protocol and concluded that their scheme was prone to a kind of attack by a key replacement adversary [27]. In 2016, He et al. [28] also claimed that the Liu et al.’s scheme cannot resist the impersonation attack; meanwhile they put forward their own improved protocol. In 2018, Li et al. [29] analyzed the loopholes in each layer of the current implantable medical system and put forward a complete three-layer scheme.As we know, each authentication factor has its own advantages and disadvantages. Passwords are prone to dictionary attacks while smart cards may be lost. A number of two-factor protocols [30–38] have been put forward. In these schemes, two kinds of factors, i.e., passwords and smart cards, are combined to achieve user authentication. In 2015, He et al. came up with a scheme [35] where the smart card is used to store some private parameters about healthcare applications using wireless medical sensor networks. Wei et al. proposed an anonymous authentication scheme [33] for wireless body area networks in 2017 as well as gave a formal security analysis of the protocol.To further enhance the security strength of two-factor protocols, three-factor authentication (3FA) schemes which consolidate all three factors (i.e., passwords, smart cards, and biometrics) have attracted more and more attentions [14, 39–44]. In 2017, Wei applied the fuzzy extractor scheme into his newly proposed protocol [39] to handle the biometrics. Meanwhile Jiang et al. presented a scheme [41] where the biohashing is used to protect the biometrics. In 2016, Wu et al. proposed a 3FA scheme [43] aiming at summarizing the flaws that existed in previous typical protocols and came up with a more complete solution. In 2017, Li et al. [40] remedied flaws in Jiang et al.’s scheme [32] in which fuzzy commitment is used to protect biometrics. In 2017, Wazid et al. provided a 3FA scheme [14] for IMDs and claimed that their protocol could meet the known security, but we reveal that the protocol cannot achieve complete security.


### 1.2. Motivations and Contributions

With the popularity of the IMD, its safety and privacy protection have attracted great attention and a large number protocols in this field have emerged, but few of them can achieve the desired security guarantee. In such a situation, it is imperative to sum up the defects in previous protocols and propose new schemes to make the implantable medical system more secure and reliable. Among these protocols, we pick Wazid et al.’s scheme [14] as a typical case study to analyze some defects of the scheme. Then we propose a trusted authority assisted 3FA protocol which effectively solves the security vulnerabilities in the original protocol. Our contributions are summarized as follows:(i)
First, we find out three drawbacks of the most recent 3FA protocol of Wazid et al. To be specific, we find that the scheme cannot withstand offline password guessing attack, the CN impersonation attack, and the authentication phase of the protocol is problematic.(ii)
Second, we propose a trusted authority assisted 3FA protocol. Specifically, we introduce the fuzzy verifier [45] to effectively prevent offline password guessing attack during local login verification phase and adopt the widely used fuzzy vault [46] to protect the biometric template.(iii)
Third, we analyze the security of our protocol both formally and informally. Our protocol not only properly solves the shortcomings in the original scheme, but also achieves perfect forward security, user anonymity, know key security, and so forth. At the same time, our protocol can resist a variety of known attacks.


### 1.3. Organization of the Paper

The rest of the paper is organized as follows. In Section2, we briefly review some preliminaries used in this paper, including ECC and the fuzzy vault. Section 3 depicts the details of Wazid et al.’s scheme. Then in Section 4, we present the vulnerabilities in their scheme. In Section 5, we propose an improved scheme. In Section 6, we have an elaborate analysis from both formal and informal point of view. The comparisons of efficiency and features are listed in Section 7. In the end, this paper is concluded in Section 8.


## 1.1. Related Work

With the wireless interface enabled, IMDs can be accessed by an authorized operator in physical proximity via the IMDs programmer. However, the wireless communication and networking capabilities of IMDs turn out to be the major sources of security vulnerabilities [11, 12]. For this purpose, access control for implantable medical system is highly desired and many schemes have also been put forward in this field.Initially, considering the scarce energy reserves and limited communication capacity of IMDs, some schemes based on symmetric key cryptography [15–19] were proposed, they realized high encryption speed and efficiency at the same time but showed weaknesses of resisting against certain attacks, and the complexity of key management will introduce large memory and communication overhead which contradicts their original intentions. This means that the symmetric key cryptography based schemes are difficult to provide a complete security guarantee for implantable medical system.Then, traditional public key cryptography (TPKC) based authentication schemes [20, 21] were implemented in IMDs. Unfortunately, the limited computing capability and battery capacity of the mobile device hinders the application of TPKC in implantable medical system. The concept of ECC (Elliptic curve cryptosystem) was then put forward [22] which provided the same security with a much smaller key size compare to the TPKC [23] so that many ECC-based protocols were proposed subsequently [13, 24]. In 2013, Liu et al. [25] put forward a scheme in which they used the bilinear pairing defined on the elliptic curve to design a new certificateless signature scheme, but later in 2014, Xiong [26] analyzed the Liu et al.’s authentication protocol and concluded that their scheme was prone to a kind of attack by a key replacement adversary [27]. In 2016, He et al. [28] also claimed that the Liu et al.’s scheme cannot resist the impersonation attack; meanwhile they put forward their own improved protocol. In 2018, Li et al. [29] analyzed the loopholes in each layer of the current implantable medical system and put forward a complete three-layer scheme.As we know, each authentication factor has its own advantages and disadvantages. Passwords are prone to dictionary attacks while smart cards may be lost. A number of two-factor protocols [30–38] have been put forward. In these schemes, two kinds of factors, i.e., passwords and smart cards, are combined to achieve user authentication. In 2015, He et al. came up with a scheme [35] where the smart card is used to store some private parameters about healthcare applications using wireless medical sensor networks. Wei et al. proposed an anonymous authentication scheme [33] for wireless body area networks in 2017 as well as gave a formal security analysis of the protocol.To further enhance the security strength of two-factor protocols, three-factor authentication (3FA) schemes which consolidate all three factors (i.e., passwords, smart cards, and biometrics) have attracted more and more attentions [14, 39–44]. In 2017, Wei applied the fuzzy extractor scheme into his newly proposed protocol [39] to handle the biometrics. Meanwhile Jiang et al. presented a scheme [41] where the biohashing is used to protect the biometrics. In 2016, Wu et al. proposed a 3FA scheme [43] aiming at summarizing the flaws that existed in previous typical protocols and came up with a more complete solution. In 2017, Li et al. [40] remedied flaws in Jiang et al.’s scheme [32] in which fuzzy commitment is used to protect biometrics. In 2017, Wazid et al. provided a 3FA scheme [14] for IMDs and claimed that their protocol could meet the known security, but we reveal that the protocol cannot achieve complete security.


## 1.2. Motivations and Contributions

With the popularity of the IMD, its safety and privacy protection have attracted great attention and a large number protocols in this field have emerged, but few of them can achieve the desired security guarantee. In such a situation, it is imperative to sum up the defects in previous protocols and propose new schemes to make the implantable medical system more secure and reliable. Among these protocols, we pick Wazid et al.’s scheme [14] as a typical case study to analyze some defects of the scheme. Then we propose a trusted authority assisted 3FA protocol which effectively solves the security vulnerabilities in the original protocol. Our contributions are summarized as follows:(i)
First, we find out three drawbacks of the most recent 3FA protocol of Wazid et al. To be specific, we find that the scheme cannot withstand offline password guessing attack, the CN impersonation attack, and the authentication phase of the protocol is problematic.(ii)
Second, we propose a trusted authority assisted 3FA protocol. Specifically, we introduce the fuzzy verifier [45] to effectively prevent offline password guessing attack during local login verification phase and adopt the widely used fuzzy vault [46] to protect the biometric template.(iii)
Third, we analyze the security of our protocol both formally and informally. Our protocol not only properly solves the shortcomings in the original scheme, but also achieves perfect forward security, user anonymity, know key security, and so forth. At the same time, our protocol can resist a variety of known attacks.


## 1.3. Organization of the Paper

The rest of the paper is organized as follows. In Section2, we briefly review some preliminaries used in this paper, including ECC and the fuzzy vault. Section 3 depicts the details of Wazid et al.’s scheme. Then in Section 4, we present the vulnerabilities in their scheme. In Section 5, we propose an improved scheme. In Section 6, we have an elaborate analysis from both formal and informal point of view. The comparisons of efficiency and features are listed in Section 7. In the end, this paper is concluded in Section 8.


## 2. Preliminaries

### 2.1. Fuzzy Vault

The fuzzy vault is a constructor used to protect biometric templatesBIO with various built-in algorithms. Its security relies on the secret key K and BIO. It works in key binding mode where the biometric and the key are monolithically bound within a binding mechanism. Compared with fuzzy extractor [47], the Euclidean distance measurement used in fuzzy vault has been widely accepted in most biostatistical applications [48]. Therefore, in view of the value in practice, we will adopt the fuzzy vault to protect biometric features in our improved scheme.Specifically, the user selects a polynomialPol which is used to encode secret key K and be evaluated on all elements in BIO. Then the biometric BIO which is imprinted by user can be converted into a set of L points which lie on the Pol according to Gen(BIO,K,Pol)=L. Then, taking L and CP which is a large set of “chaff points” as inputs of Enc(·), we can get the final vault V which equals CP∪L, that is, Enc(CP,L)=V. Generally, we put the final vault V in the mobile device.When the user wants to recover the secret keyK, she/he can scan the biometric BIO∗ on terminal firstly, then taking the vault V and BIO∗ as the inputs of the algorithm Dec(·) which will output the Pol if and only if |BIO-BIO∗|<ε where ε is the fuzziness parameter. The secret key K can be recovered with the input Pol by the algorithmRec(·) finally.


### 2.2. Elliptic Curve Cryptosystem (ECC)

Compared with the traditional RSA algorithm, ECC achieves the same security strength with much smaller key size, so ECC is more efficient than RSA. Elliptic curve equation is defined in such a form: nonsingular elliptic curveEp(a,b):y2-x3+ax+b(modp) over a prime finite field Zp, where p is a large prime and a,b∈Zp∗ satisfies 4a3+27b2≠0(modp).Besides, there are two difficult problems in ECC, namely, Elliptic Curve Discrete Logarithm Problem (ECDLP) and Elliptic Curve Computational Diffie-Hellman Problem (ECCDHP). Specifically, the first one depicts that it is impossible to find an integerx∈Zp∗ that satisfies the formula Q=x·P with two given points P and Q over Ep(a,b). The other one describes that it is hard to calculate the value xy·P with the given points P, x·P and y·P, x,y∈Zp∗. These two hard problems guarantee the security of Elliptic Curve primitives, and an adversary still has a great deal of difficulty in getting the secret after obtaining the public values.


## 2.1. Fuzzy Vault

The fuzzy vault is a constructor used to protect biometric templatesBIO with various built-in algorithms. Its security relies on the secret key K and BIO. It works in key binding mode where the biometric and the key are monolithically bound within a binding mechanism. Compared with fuzzy extractor [47], the Euclidean distance measurement used in fuzzy vault has been widely accepted in most biostatistical applications [48]. Therefore, in view of the value in practice, we will adopt the fuzzy vault to protect biometric features in our improved scheme.Specifically, the user selects a polynomialPol which is used to encode secret key K and be evaluated on all elements in BIO. Then the biometric BIO which is imprinted by user can be converted into a set of L points which lie on the Pol according to Gen(BIO,K,Pol)=L. Then, taking L and CP which is a large set of “chaff points” as inputs of Enc(·), we can get the final vault V which equals CP∪L, that is, Enc(CP,L)=V. Generally, we put the final vault V in the mobile device.When the user wants to recover the secret keyK, she/he can scan the biometric BIO∗ on terminal firstly, then taking the vault V and BIO∗ as the inputs of the algorithm Dec(·) which will output the Pol if and only if |BIO-BIO∗|<ε where ε is the fuzziness parameter. The secret key K can be recovered with the input Pol by the algorithmRec(·) finally.


## 2.2. Elliptic Curve Cryptosystem (ECC)

Compared with the traditional RSA algorithm, ECC achieves the same security strength with much smaller key size, so ECC is more efficient than RSA. Elliptic curve equation is defined in such a form: nonsingular elliptic curveEp(a,b):y2-x3+ax+b(modp) over a prime finite field Zp, where p is a large prime and a,b∈Zp∗ satisfies 4a3+27b2≠0(modp).Besides, there are two difficult problems in ECC, namely, Elliptic Curve Discrete Logarithm Problem (ECDLP) and Elliptic Curve Computational Diffie-Hellman Problem (ECCDHP). Specifically, the first one depicts that it is impossible to find an integerx∈Zp∗ that satisfies the formula Q=x·P with two given points P and Q over Ep(a,b). The other one describes that it is hard to calculate the value xy·P with the given points P, x·P and y·P, x,y∈Zp∗. These two hard problems guarantee the security of Elliptic Curve primitives, and an adversary still has a great deal of difficulty in getting the secret after obtaining the public values.


## 3. Review of Wazid et al.’s Scheme

In this section, we review the details of Wazid et al.’s scheme, which consists of eight phases, i.e., predeployment, postdeployment, registration, login, authentication and key agreement, password and biometric update, and dynamic control node addition, as well as dynamic IMD addition. The scheme is for the purpose of mutual authentication and key agreement establishment between the mobile device and IMDs. The notations used in this paper are listed in Table1.Table 1
Notations.
Notations Description U i , M D i i t h user and his/her mobile device C N j j t h controller node I M D l l t h implantable medical device T A Trusted authority I D i , P W i , B I O i U i’s identity, password and biometric information I D T A , I D C N j Identities ofTA and controller node R I D i , R I D C N j , R T S C N j Pseudo identities ofUi and CNj, registration timestamp of CNj N 1024-bit secret number ofTA T i Current timestamp Δ T Maximum transmission delay associated with a message t Error tolerance threshold used in fuzzy extractor k ⋅ P Elliptic curve point multiplication,k∈Zp∗,P∈Ep(a,b) h ( ⋅ ) Collision-resistant cryptographic hash function ∥ Concatenation operation ⊕ Bitwise XOR operation


### 3.1. Predeployment Phase

Before deployment, a trusted authorityTA needs to complete the registration for each CNj as well as IMDl. TA first selects a secret 1024-bit number N for CNj and IMDl. Then TA picks the identity IDCNj for CNj and calculates RIDTA=h(IDTA∥N), RIDCNj=h(IDCNj∥N), TCCNj=h(IDTA∥RTSCNj∥N). Meanwhile, TA constructs the univariate polynomial P(RIDCNj,y) according to the polynomial-based key distribution P(x,y)=∑i=0n∑j=0ngi,jxiyj∈GF(p)[x,y] proposed in [49] where the prime p is chosen as a large number and n is also large to preserve unconditional security and n-collusion resistant property against IMD capture attack. Finally, TA stores {RIDTA,RIDCNj,TCCNj,P(RIDCNj,y)} in the memory of CNj. Similar to the above calculations, TA generates a unique identity IDIMDl and calculates RIDIMDl=h(IDIMDl∥N), P(RIDIMDl,y) and then stores the information {RIDIMDl,P(RIDIMDl,y)} in the memory of IDIMDl.


### 3.2. Postdeployment Phase

After the predeployment phase,CNj and IMDl establish a shared key using the information distributed during the predeployment phase. The details of the process are as follows. Firstly, IMDl sends the message RIDIMDl to CNj. Once CNj receives the message, CNj responds with the message RIDCNj. Then they calculate the same shared secret key SKIMDl,CNj=P(RIDIMDl,RIDCNj) and SKCNj,IMDl=P(RIDIMDl,RIDCNj) on each own for future use.


### 3.3. Registration Phase

This phase has 4 steps.Step 1.
The user selects his/her identityIDi at will and forwards it with registration request to TA in a secure channel.Step 2.
After accepting the request,TA computes the pseudo identity of Ui as RIDi=h(IDi∥N). Then TA continues to compute the value Ai as Ai=h(RIDTA∥IDi). TA sends the message RIDi,Ai,RIDTA to Ui.Step 3.
After receiving registration reply fromTA, Ui further selects a private key k∈Zp∗ and computes the corresponding public key Q=k·P.Step 4.
U i inputs his/her password PWi and imprints fingerprint BIOi in mobile device MDi, then MDi calculates Gen(BIOi)=(σi,τi), RIDi′=RIDi⊕h(PWi∥σi), RPWi=h(PWi∥k), Di=k⊕h(IDi∥PWi∥σi), RIDTA′=RIDTA⊕h(IDi∥k∥σi), Ai′=Ai⊕h(k∥σi), Bi=h(Ai∥RPWi), and Ci=h(IDi∥RIDTA∥Bi∥σi). At last, MDi keeps the data {RIDi′,RIDTA′,Ai′,Ci,Di,τi,Gen(·),Rep(·),h(·),t} in its memory.


### 3.4. Login Phase

As depicted in Figure2, to login to CNj, Ui executes the following steps.Figure 2
Login and authentication phase of Wazid et al.’s scheme.Step 1.
U i inputs his/her IDi, PWi and BIOi′, then MDi retrieves the biometric key σi′=Rep(BIOi′,τi). Then MDi computes k′=Di⊕h(IDi∥PWi∥σi′), RPWi′=h(PWi∥k′), Ai∗=Ai′⊕h(k′∥σi′), Bi∗=h(Ai∗∥RPWi′), RIDTA∗=RIDTA′⊕h(IDi∥k′∥σi′), RIDi∗=RIDi′⊕h(PWi∥σi′), and Ci∗=h(IDi∥RIDTA∗∥BI∗∥σi′). If Ci∗ equals the stored Ci, it means that Ui’s inputs are verified as correct; otherwise, the login phase will be terminated immediately.Step 2.
M D i picks the current timestamp T1 and a 160-bit random nonce ri. Then MDi computes ai=h(ri∥T1∥RIDi∗∥RPWi′∥σi′), bi=h(RIDTA∗∥T1), and M1=ai·P as well as the signature M2=ai+k′bi(modp). At last, MDi forwards the message M1,M2,T1 to CNj via a public channel.


### 3.5. Authentication and Key Agreement Phase

In this phase,Ui and CNj need to authenticate each other as well as establish a session key between them for future safe communications; see Figure 2.Step 1.
After obtaining the messageM1,M2,T1, CNj first checks |T1-T1∗|?<ΔT, if two values are equal, CNj calculates bi′=h(RIDTA∥T1), and then checks M2·P?=M1+bi′·Q. Similarly, if verification matches, it indicates that Ui is considered legitimate. Then CNj chooses T2 and a random number rj and continues to compute cj=h(rj∥T2∥RIDCNj∥TCCNj), M4=cj·P, kij=cj·M1=(aicj)·P, session key SKij=h(kij∥RIDTA∥T1∥T2), and M5=h(SKij∥T2). Finally, CNj sends the message M4,M5,T2 to Ui through the public channel.Step 2.
After receiving the message fromCNj, Ui first judges |T2-T2∗|?<ΔT, then computes kij∗=ai·M4=(aicj)·P, SKij∗=h(kij∗∥RIDTA∗∥T1∥T2), and M6=h(SKij∗∥T2). If M6=M5, it indicts that CNj passes the verification. With that, Ui calculates M7=h(SKij∗∥T3) and forwards the message M7,T3 to CNj.Step 3.
C N j checks |T3-T3∗|?<ΔT, then computes M8=h(SKij∥T3), and judges whether M8=M7.Finally, bothCNj and Ui complete the mutual authentication and agree on the same session key which will used for the secure communications in future.


### 3.6. Password and Biometric Update Phase

IfUi wants to change the password, he/she can execute ensuing procedure.Step 1.
Firstly,Ui inputs IDi, PWiold, and BIOiold. MDi computes σiold=Rep(BIOiold,τi), k=Di⊕h(IDi∥PWiold∥σiold), RPWiold=h(PWiold∥k), Aiold=Ai′⊕h(k∥σiold), Biold=h(Aiold∥RPWiold), and RIDTA=RIDTA′⊕h(IDi∥k∥σiold) and checks if Ciold equals h(IDi∥RIDTA∥Biold∥σiold). If it holds, MDi asks Ui for the new password PWinew.Step 2.
AfterUi inputs the PWinew and MDi calculates σinew=Rep(BIOinew,τinew), RPWinew=h(PWinew∥k), Ainew=Aiold⊕h(k∥σinew), Binew=h(Ainew∥RPWinew), RIDTA′′=RIDTA⊕h(IDi∥k∥σinew), Cinew=h(IDi∥RIDTA′′∥Binew∥σinew), and Di′′=k⊕h(IDi∥PWinew∥σinew). Finally, MDi replaces RIDi′, RIDTA′, Ai′, Ci, Di, and τi with RIDi′′, RIDTA′′, Ainew, Cinew, Di′′, and τinew, respectively.


### 3.7. Dynamic Controller Node Addition Phase

In this phase, a new controller nodeCNjnew can be deployed as follows.First,TA determines a new identity IDCNjnew for CNjnew and calculates RIDCNjnew=h(IDCNjnew∥N) and new polynomial P(RIDCNjnew,y) as well as TCCNjnew=h(IDTA∥RTSCNjnew∥N) in which the RTSCNjnew is the newly generated registration timestamp. Finally, TA stores the parameters {RIDCNjnew,TCCNjnew,RIDTA,P(RIDCNjnew,y)} into the memory of CNjnew before it is deployed into the system.


### 3.8. DynamicIMD Addition Phase

In this phase, we can deploy a newIMD (IMDlnew). Specifically, TA computes RIDIMDl′=h(IDIMDl′∥N) and P(RIDIMDl′,y) and then stores {RIDIMDl′new,P(RIDIMDl′new,y)} in the memory of IMDlnew.


## 3.1. Predeployment Phase

Before deployment, a trusted authorityTA needs to complete the registration for each CNj as well as IMDl. TA first selects a secret 1024-bit number N for CNj and IMDl. Then TA picks the identity IDCNj for CNj and calculates RIDTA=h(IDTA∥N), RIDCNj=h(IDCNj∥N), TCCNj=h(IDTA∥RTSCNj∥N). Meanwhile, TA constructs the univariate polynomial P(RIDCNj,y) according to the polynomial-based key distribution P(x,y)=∑i=0n∑j=0ngi,jxiyj∈GF(p)[x,y] proposed in [49] where the prime p is chosen as a large number and n is also large to preserve unconditional security and n-collusion resistant property against IMD capture attack. Finally, TA stores {RIDTA,RIDCNj,TCCNj,P(RIDCNj,y)} in the memory of CNj. Similar to the above calculations, TA generates a unique identity IDIMDl and calculates RIDIMDl=h(IDIMDl∥N), P(RIDIMDl,y) and then stores the information {RIDIMDl,P(RIDIMDl,y)} in the memory of IDIMDl.


## 3.2. Postdeployment Phase

After the predeployment phase,CNj and IMDl establish a shared key using the information distributed during the predeployment phase. The details of the process are as follows. Firstly, IMDl sends the message RIDIMDl to CNj. Once CNj receives the message, CNj responds with the message RIDCNj. Then they calculate the same shared secret key SKIMDl,CNj=P(RIDIMDl,RIDCNj) and SKCNj,IMDl=P(RIDIMDl,RIDCNj) on each own for future use.


## 3.3. Registration Phase

This phase has 4 steps.Step 1.
The user selects his/her identityIDi at will and forwards it with registration request to TA in a secure channel.Step 2.
After accepting the request,TA computes the pseudo identity of Ui as RIDi=h(IDi∥N). Then TA continues to compute the value Ai as Ai=h(RIDTA∥IDi). TA sends the message RIDi,Ai,RIDTA to Ui.Step 3.
After receiving registration reply fromTA, Ui further selects a private key k∈Zp∗ and computes the corresponding public key Q=k·P.Step 4.
U i inputs his/her password PWi and imprints fingerprint BIOi in mobile device MDi, then MDi calculates Gen(BIOi)=(σi,τi), RIDi′=RIDi⊕h(PWi∥σi), RPWi=h(PWi∥k), Di=k⊕h(IDi∥PWi∥σi), RIDTA′=RIDTA⊕h(IDi∥k∥σi), Ai′=Ai⊕h(k∥σi), Bi=h(Ai∥RPWi), and Ci=h(IDi∥RIDTA∥Bi∥σi). At last, MDi keeps the data {RIDi′,RIDTA′,Ai′,Ci,Di,τi,Gen(·),Rep(·),h(·),t} in its memory.


## 3.4. Login Phase

As depicted in Figure2, to login to CNj, Ui executes the following steps.Figure 2
Login and authentication phase of Wazid et al.’s scheme.Step 1.
U i inputs his/her IDi, PWi and BIOi′, then MDi retrieves the biometric key σi′=Rep(BIOi′,τi). Then MDi computes k′=Di⊕h(IDi∥PWi∥σi′), RPWi′=h(PWi∥k′), Ai∗=Ai′⊕h(k′∥σi′), Bi∗=h(Ai∗∥RPWi′), RIDTA∗=RIDTA′⊕h(IDi∥k′∥σi′), RIDi∗=RIDi′⊕h(PWi∥σi′), and Ci∗=h(IDi∥RIDTA∗∥BI∗∥σi′). If Ci∗ equals the stored Ci, it means that Ui’s inputs are verified as correct; otherwise, the login phase will be terminated immediately.Step 2.
M D i picks the current timestamp T1 and a 160-bit random nonce ri. Then MDi computes ai=h(ri∥T1∥RIDi∗∥RPWi′∥σi′), bi=h(RIDTA∗∥T1), and M1=ai·P as well as the signature M2=ai+k′bi(modp). At last, MDi forwards the message M1,M2,T1 to CNj via a public channel.


## 3.5. Authentication and Key Agreement Phase

In this phase,Ui and CNj need to authenticate each other as well as establish a session key between them for future safe communications; see Figure 2.Step 1.
After obtaining the messageM1,M2,T1, CNj first checks |T1-T1∗|?<ΔT, if two values are equal, CNj calculates bi′=h(RIDTA∥T1), and then checks M2·P?=M1+bi′·Q. Similarly, if verification matches, it indicates that Ui is considered legitimate. Then CNj chooses T2 and a random number rj and continues to compute cj=h(rj∥T2∥RIDCNj∥TCCNj), M4=cj·P, kij=cj·M1=(aicj)·P, session key SKij=h(kij∥RIDTA∥T1∥T2), and M5=h(SKij∥T2). Finally, CNj sends the message M4,M5,T2 to Ui through the public channel.Step 2.
After receiving the message fromCNj, Ui first judges |T2-T2∗|?<ΔT, then computes kij∗=ai·M4=(aicj)·P, SKij∗=h(kij∗∥RIDTA∗∥T1∥T2), and M6=h(SKij∗∥T2). If M6=M5, it indicts that CNj passes the verification. With that, Ui calculates M7=h(SKij∗∥T3) and forwards the message M7,T3 to CNj.Step 3.
C N j checks |T3-T3∗|?<ΔT, then computes M8=h(SKij∥T3), and judges whether M8=M7.Finally, bothCNj and Ui complete the mutual authentication and agree on the same session key which will used for the secure communications in future.


## 3.6. Password and Biometric Update Phase

IfUi wants to change the password, he/she can execute ensuing procedure.Step 1.
Firstly,Ui inputs IDi, PWiold, and BIOiold. MDi computes σiold=Rep(BIOiold,τi), k=Di⊕h(IDi∥PWiold∥σiold), RPWiold=h(PWiold∥k), Aiold=Ai′⊕h(k∥σiold), Biold=h(Aiold∥RPWiold), and RIDTA=RIDTA′⊕h(IDi∥k∥σiold) and checks if Ciold equals h(IDi∥RIDTA∥Biold∥σiold). If it holds, MDi asks Ui for the new password PWinew.Step 2.
AfterUi inputs the PWinew and MDi calculates σinew=Rep(BIOinew,τinew), RPWinew=h(PWinew∥k), Ainew=Aiold⊕h(k∥σinew), Binew=h(Ainew∥RPWinew), RIDTA′′=RIDTA⊕h(IDi∥k∥σinew), Cinew=h(IDi∥RIDTA′′∥Binew∥σinew), and Di′′=k⊕h(IDi∥PWinew∥σinew). Finally, MDi replaces RIDi′, RIDTA′, Ai′, Ci, Di, and τi with RIDi′′, RIDTA′′, Ainew, Cinew, Di′′, and τinew, respectively.


## 3.7. Dynamic Controller Node Addition Phase

In this phase, a new controller nodeCNjnew can be deployed as follows.First,TA determines a new identity IDCNjnew for CNjnew and calculates RIDCNjnew=h(IDCNjnew∥N) and new polynomial P(RIDCNjnew,y) as well as TCCNjnew=h(IDTA∥RTSCNjnew∥N) in which the RTSCNjnew is the newly generated registration timestamp. Finally, TA stores the parameters {RIDCNjnew,TCCNjnew,RIDTA,P(RIDCNjnew,y)} into the memory of CNjnew before it is deployed into the system.


## 3.8. DynamicIMD Addition Phase

In this phase, we can deploy a newIMD (IMDlnew). Specifically, TA computes RIDIMDl′=h(IDIMDl′∥N) and P(RIDIMDl′,y) and then stores {RIDIMDl′new,P(RIDIMDl′new,y)} in the memory of IMDlnew.


## 4. Weakness of the Wazid et al.’s Scheme

The widely accepted Dolev-Yao threat model (DY model) [10] demonstrates that the adversary A can fully control the public channel between communicators. That is, A is capable of eavesdropping, stealing, inserting, deleting, and modifying the messages in the open channel. Most recently, Wang et al. [45] have provided a complete summary of the adversary’s capabilities and present twelve evaluation criteria for a secure protocol, i.e., no password verifier-table, no smart card loss attack, mutual authentication, and so forth. According to above evaluation criteria, we make a reasonable analysis of Wazid et al.’s scheme and find that the protocol has the following three flaws, i.e., offline password guessing attack, controller node impersonation attack, and Incorrect authentication process. As a result, it cannot achieve mutual authentication; that is, the scheme fails to meet the security claimed by the authors.


### 4.1. Offline Password Guessing Attack

To achieve user friendliness, in registration phase, users are allowed to choose their own identities and passwords at will; the majority of users will choose easy-to-recallID and PW; the combination of these low entropy ID and PW are likely to be vulnerable to offline guessing attack. A probabilistic polynomial time (PPT) adversary can offline enumerate all (ID,PW) pairs in Cartesian product Did∗Dpw, where Did and Dpw represent ID space and PW space, respectively. In a 3FA protocol, we should ensure that even the MDi and biometric have been corrupted, and the whole scheme can still resist this type attack to protect the security of user’s secrets. Based on all above assumptions, the adversary can launch an offline password guessing attack through the following processes.Step 1.
We assume that the adversaryA has acquired MDi and biometric BIOi of the user and then obtains the secret parameters {RIDi′,RIDTA′,Ai′,Ci,Di,τi,Gen(·),Rep(·),h(·),t} stored in the MDi.Step 2.
The adversaryA picks a (IDi′,PWi′) pair and calculates σi=Rep(BIOi,τi), k∗=Di⊕h(IDi∗∥PWi∗∥σi), RPWi∗=h(PWi∗∥k∗), Ai∗=Ai′⊕h(k∗∥σi), Bi∗=h(Ai∗∥RPWi∗), RIDTA∗=RIDTA′⊕h(IDi∗∥k∗∥σi), RIDi∗=RIDi′⊕h(PWi∗∥σi), and Ci∗=h(IDi′∥RIDTA′∥Bi∗∥σi).Step 3.
Finally,A checks whether Ci∗=Ci, and if it holds, we can say that the (IDi′,PWi′) selected by the adversary is a legal one. Otherwise, A can choose another (IDi,PWi) pair to continue implementing above steps until success.


### 4.2. The Controller Node Impersonation Attack

In registration phase,TA picks a secret number N and calculates TA’s pseudo identifier RIDTA=h(IDTA∥N) which is a fixed value. What is more, in predeployment phase, both MDi and CNj have obtained RIDTA; for a malicious MDi, he/she can disguise himself/herself as CNj to communicate with another MDi′ as shown in Figure 3.Figure 3
The controller node impersonation attack in Wazid et al.’s scheme.Step 1.
The maliciousMDi intercepts the first authentication message M1′,M2′,T1′ sent by MDi′ which is ought to have been received by CNj.Step 2.
ThenMDi can impersonate CNj to communicate with MDi′, MDi selects time stamp T2∗, random value rj∗, and cj∗, Then MDi computes M4∗=cj∗·P, kij∗=cj∗·M1′, session key SKij∗=h(kij∗∥RIDTA∥T1′∥T2∗), and M5∗=h(SKij∗∥T2∗). Finally, MDi forwards the constructed false message M4∗,M5∗,T2∗ to MDi′.Step 3.
After receiving the message fromMDi, MDi′ will check |T2′-T2∗|?<ΔT and then calculate kij′=ai′·M4∗, session key SKij′=h(kij′∥RIDTA∥T1′∥T2∗) and M6′=h(SKij′∥T2∗), and obviously M6′ equals M5∗ which means that MDi passes the verification of MDi′. Then MDi′ computes M7′=h(SKij′∥T3′) and sends the message M7′,T3′ to MDi.Step 4.
OnceMDi receives the message, MDi checks |T3′-T3∗|?<ΔT and computes M8∗=h(SKij∗∥T3′), then he/she will successfully verify that M8∗ equals the received message M7′.At this point,MDi and MDi′ have completed mutual authentication and negotiated the same session key (SKij′=SKij∗) used in future sessions. In real life, this situation is manifested as the adversary (MDi, e.g., a doctor) successfully disguises as another patient and sends false health information to his/her attending doctor, which is easy to cause medical accident as well as being extremely harmful to the patient.


### 4.3. Incorrect Authentication Process

In authentication phase,Ui computes M1=ai·P and M2=ai+k′bi(modp) and then sends the message M1,M2,T1 to CNj. Normally, after CNj receiving the message, she/he computes bi′=h(RIDTA∥T1) and then judges the legality of M2 via checking M2·P?=M1+bi′·Q. But it is not hard to notice that the message M1,M2,T1 does not contain the public key Q. Without knowledge of Q, CNj cannot complete the judgement of signature, so that CNj fails to authenticate Ui.


## 4.1. Offline Password Guessing Attack

To achieve user friendliness, in registration phase, users are allowed to choose their own identities and passwords at will; the majority of users will choose easy-to-recallID and PW; the combination of these low entropy ID and PW are likely to be vulnerable to offline guessing attack. A probabilistic polynomial time (PPT) adversary can offline enumerate all (ID,PW) pairs in Cartesian product Did∗Dpw, where Did and Dpw represent ID space and PW space, respectively. In a 3FA protocol, we should ensure that even the MDi and biometric have been corrupted, and the whole scheme can still resist this type attack to protect the security of user’s secrets. Based on all above assumptions, the adversary can launch an offline password guessing attack through the following processes.Step 1.
We assume that the adversaryA has acquired MDi and biometric BIOi of the user and then obtains the secret parameters {RIDi′,RIDTA′,Ai′,Ci,Di,τi,Gen(·),Rep(·),h(·),t} stored in the MDi.Step 2.
The adversaryA picks a (IDi′,PWi′) pair and calculates σi=Rep(BIOi,τi), k∗=Di⊕h(IDi∗∥PWi∗∥σi), RPWi∗=h(PWi∗∥k∗), Ai∗=Ai′⊕h(k∗∥σi), Bi∗=h(Ai∗∥RPWi∗), RIDTA∗=RIDTA′⊕h(IDi∗∥k∗∥σi), RIDi∗=RIDi′⊕h(PWi∗∥σi), and Ci∗=h(IDi′∥RIDTA′∥Bi∗∥σi).Step 3.
Finally,A checks whether Ci∗=Ci, and if it holds, we can say that the (IDi′,PWi′) selected by the adversary is a legal one. Otherwise, A can choose another (IDi,PWi) pair to continue implementing above steps until success.


## 4.2. The Controller Node Impersonation Attack

In registration phase,TA picks a secret number N and calculates TA’s pseudo identifier RIDTA=h(IDTA∥N) which is a fixed value. What is more, in predeployment phase, both MDi and CNj have obtained RIDTA; for a malicious MDi, he/she can disguise himself/herself as CNj to communicate with another MDi′ as shown in Figure 3.Figure 3
The controller node impersonation attack in Wazid et al.’s scheme.Step 1.
The maliciousMDi intercepts the first authentication message M1′,M2′,T1′ sent by MDi′ which is ought to have been received by CNj.Step 2.
ThenMDi can impersonate CNj to communicate with MDi′, MDi selects time stamp T2∗, random value rj∗, and cj∗, Then MDi computes M4∗=cj∗·P, kij∗=cj∗·M1′, session key SKij∗=h(kij∗∥RIDTA∥T1′∥T2∗), and M5∗=h(SKij∗∥T2∗). Finally, MDi forwards the constructed false message M4∗,M5∗,T2∗ to MDi′.Step 3.
After receiving the message fromMDi, MDi′ will check |T2′-T2∗|?<ΔT and then calculate kij′=ai′·M4∗, session key SKij′=h(kij′∥RIDTA∥T1′∥T2∗) and M6′=h(SKij′∥T2∗), and obviously M6′ equals M5∗ which means that MDi passes the verification of MDi′. Then MDi′ computes M7′=h(SKij′∥T3′) and sends the message M7′,T3′ to MDi.Step 4.
OnceMDi receives the message, MDi checks |T3′-T3∗|?<ΔT and computes M8∗=h(SKij∗∥T3′), then he/she will successfully verify that M8∗ equals the received message M7′.At this point,MDi and MDi′ have completed mutual authentication and negotiated the same session key (SKij′=SKij∗) used in future sessions. In real life, this situation is manifested as the adversary (MDi, e.g., a doctor) successfully disguises as another patient and sends false health information to his/her attending doctor, which is easy to cause medical accident as well as being extremely harmful to the patient.


## 4.3. Incorrect Authentication Process

In authentication phase,Ui computes M1=ai·P and M2=ai+k′bi(modp) and then sends the message M1,M2,T1 to CNj. Normally, after CNj receiving the message, she/he computes bi′=h(RIDTA∥T1) and then judges the legality of M2 via checking M2·P?=M1+bi′·Q. But it is not hard to notice that the message M1,M2,T1 does not contain the public key Q. Without knowledge of Q, CNj cannot complete the judgement of signature, so that CNj fails to authenticate Ui.


## 5. The Proposed Scheme

To correct these shortcomings in Section4, we remedy the protocol of Wazid et al. from the following aspects. (1) In the predeployment phase, TA chooses a random value x∈Zp as the private key and computes the corresponding public key QTA=x·P. (2) We add the fuzzy verifier to prevent the offline password guessing attack in login phase. (3) We adopt the more widely used fuzzy vault to protect biometric templates instead of fuzzy extractor.There are also eight phases in our proposed scheme: predeployment, postdeployment, registration, login, authentication and key agreement, password and biometric update, and dynamic control node addition as well as dynamic IMD addition.


### 5.1. Predeployment Phase

T A first selects a secret 1024-bit number N and chooses the finite cyclic additional group G generated by a point P with a large prime order n over a finite field Zp on an elliptic curve. Then TA selects the private key x∈Zp only known to itself, whose corresponding public key is QTA=x·P which is made public.T A computes the value TCCNj=h(IDCNj∥RTSCNj∥N) and stores {TCCNj,IDCNj} in the memory of TA as well as CNj and then adds the univariate polynomial P(TCCNj,y) to the memory of CNj.The computing processes in predeployment phase of theIMDl is the same as that of Wazid et al.’s scheme, so the details are omitted.


### 5.2. Postdeployment Phase

The specific process of this phase is as follows.Firstly,IMDl sends the message RIDIMDl to CNj; once CNj receives the message, CNj responds with the message TCCNj. At the same time, they calculate the same shared secret key SKIMDl,CNj=P(RIDIMDl,TCCNj) and SKCNj,IMDl=P(RIDIMDl,TCCNj) on each own for future use.


### 5.3. User Registration Phase

In this phase,Ui registers with TA by executing ensuing procedure as shown in Figure 4.Figure 4
User registration phase of our scheme.Step 1.
U i inputs the selected IDi and password PWi and imprints the biometric BIOi into the MDi. MDi chooses the private key k∈Zp and computes the corresponding public key Qu=k·P, as well as keeping the both secret. Finally, Ui submits the IDi and Qu to TA via the secure channel.Step 2.
After receiving the registration request fromUi, TA calculates RIDi=h(IDi∥x∥N) and stores specific {IDi,Qu} of Ui in the memory. Then TA forwards the value RIDi to Ui.Step 3.
Upon receiving the message,MDi chooses a random number K and calculates fuzzy vault parameters Gen(Pol,BIOi,K)=L and Enc(CP,L)=V as well as RPWi=h(PWi∥k) and Di=k⊕h(IDi∥PWi∥K). Then, MDi computes the verification value Ti=h(h(IDi∥RPWi∥K)modl) where 28≤l≤216 is a medium integer which represents the capacity of the pool of the IDi,PWi pair against the offline password guessing attack in the Wazid et al.’s scheme. After the calculation of RIDi′=RIDi⊕h(PWi∥K∥k), MDi stores the parameters {Ti,Di,RIDi′,V,Qu,l,h(·),Dec(·),Rec(·),Gen(·),Enc(·)}.


### 5.4. Login Phase

As showed in Figure5, in this phase, Ui inputs IDi, PWi, and the biometric BIOi′ on the MDi. Then Ui regains the fuzzy vault parameter K′ by computing the value Dec(BIOi′,V)=Pol′ andRec(Pol′)=K′. With K′,MDi continues to calculate k=Di⊕h(IDi∥PWi∥K′) and RPWi′=h(PWi∥k) and checks Ti?=h(h(IDi∥RPWi′∥K′)modl). If two values are not equal, MDi refuses the login request; otherwise, MDi believes that IDi, PWi, and BIOi′ are legitimate and continues to compute RIDi=RIDi′⊕h(PWi∥K∥k). Then, MDi generates the current timestamp T1 and random numbers ai and ci. With these numbers, MDi continues to calculate bi=h(RIDi∥T1∥IDi∥IDCNj), M1=ai·P, M2=ai+kbi(modp), M3=ai·QTA, UIDi=(IDi∥IDCNj)⊕h(M3), and PKSi=ci⊕h(RIDi∥M3∥T1). Finally, MDi sends the message {M1,M2,PKSi,T1,UIDi} to TA via a public channel.Figure 5
Login and authentication phase of our scheme.


### 5.5. Authentication and Key Agreement Phase

By executing following procedures, mutual authentication is established amongUi, TA, and CNj, and a secure session key is negotiated between Ui and CNj.Step 1.
After receiving the login request{M1,M2,PKSi,T1,UIDi}, TA first judges if |T1-T2|≤ΔT holds, where T2 is the current timestamp and ΔT is the maximum transmission delay. If it is invalid, TA terminates the session; otherwise, TA computes the value IDi∗∥IDCNj∗=UIDi⊕h(x·M1) and retrieves Qu∗ (i.e., the public key of Ui) corresponding to IDi∗. Then TA computes RIDi∗=h(IDi∗∥x∥N) and bi∗=h(RIDi∗∥T1∥IDi∗∥IDCNj∗) and checks the validation of the signature by checking if the equation M2·P=M1+bi∗·Qu∗ holds. Specifically, the equality means that TA certifies Ui’s legitimacy; otherwise, TA terminates the session. Then, TA continues to calculate ci=PKSi⊕h(RIDi∥x·M1∥T1), M4=h(IDi∥TCCNj∥ci), DIDTA=IDi⊕h(UIDi∥TCCNj∥T2), and PKSTA=ci⊕h(TCCNj∥IDi∥T2). Finally, TA sends the message {M1,DIDTA,PKSTA,UIDi,T2,M4} to CNj via the public channel.Step 2.
After receiving the message fromTA, CNj first checks the validation of the condition |T2-T3|≤ΔT where T3 is the current timestamp. If it does not hold, the session is terminated here; otherwise, CNj regains the value of IDi and ci by computing IDi∗=DIDTA⊕h(UIDi∥TCCNj∥T2) as well as ci∗=PKSTA⊕h(TCCNj∥IDi∗∥T2). Then, CNj checks if M4 equals the result of the computation of h(IDi∗∥TCCNj∥ci∗). If it does not hold, CNj terminates the session; otherwise, it means that CNj verifies TA’s legality. Then CNj selects a random number cj and goes on with the computation of M5=cj·P, M6=cj·M1, the session key SKji=h(IDi∥IDCNj∥M6), and M7=h(SKji∥ci∥T3). Finally, the massage {M5,T3,M7} will be sent to Ui for authentication.Step 3.
When receiving the massage{M5,T3,M7} from CNj, Ui will first check the validation of condition |T3-T4|?≤ΔT; if it holds, Ui continues to calculate the session key SKij=h(IDi∥IDCNj∥ai·M5) and judge if the value M7 equals h(SKij∥ci∥T3). The final verification shows that the mutual authentication among the Ui, TA, and CNj is accomplished and the session key SKij=h(IDi∥IDCNj∥ai·M5)=h(IDi∥IDCNj∥aj·M1)=SKji is established for future sessions.


### 5.6. Password and Biometric Update Phase

In this phase, we allowUi to update the password at will by the following process, which is executed locally without involving TA for security reasons.Step 1.
First,Ui inputs her/his IDi, PWiold, and BIOi′ on the terminal. Then MDi calculates fuzzy vault parameters Dec(BIOi′,V)=Pol′ and Rec(Pol′)=K′ and regains the private key k′=Di⊕h(IDi∥PWiold∥K′) and RPWi′=h(PWiold∥k′). MDi checks whether Ti equals h(h(IDi∥RPWi′∥K′)modl) or not. If it does not hold, MDi rejects the request; otherwise, MDi claims for the new PWinew.Step 2.
WhenUi inputs the new password PWinew, MDi computes RPWinew=h(PWinew∥k), Dinew=k⊕h(IDi∥PWinew∥K), Tinew=h(h(IDi∥RPWinew∥K)modl), and RIDi′new=RIDi′⊕h(PWinew∥K∥k)⊕h(PWinew∥K∥k).Step 3.
After the computation,MDi updates the value of Dinew, Tinew, and RIDi′new in the list. Above processes simulate the situation that user only wants to update the password and maintains original biometric where BIOinew=BIOi. The password and biometric update phase are summarized in Figure 6.Figure 6
Password and biometric update phase of our scheme.


### 5.7. Dynamic Controller Node Addition Phase

In this phase, we can deploy a new control node as follows.Step 1.
T A first picks a new identity for CNjnew, called IDCNjnew, then TA repeats the calculation TCCNjnew=h(IDCNjnew∥RTSCNjnew∥N) of CNjnew in the predeployment phase where RTSCNjnew is newly generated registration timestamp. Next, TA calculates the univariate polynomial P(TCCNjnew,y).Step 2.
Finally,TA stores the parameters {TCCNjnew,IDCNjnew} into its memory and stores the credentials {TCCNjnew,IDCNjnew,P(TCCNjnew,y)} into the memory of CNjnew prior to its deployment.


### 5.8. DynamicIMD Addition Phase

Depending on the real situation, the patient needs to check the state of the implantable device in time to ensure that accurate health data is conveyed, so we often need to replace an old IMD or add a new IMD. In the case that we use a newIMDlnew to replace the existing one, please refer to Wazid et al.’s scheme for the details.


## 5.1. Predeployment Phase

T A first selects a secret 1024-bit number N and chooses the finite cyclic additional group G generated by a point P with a large prime order n over a finite field Zp on an elliptic curve. Then TA selects the private key x∈Zp only known to itself, whose corresponding public key is QTA=x·P which is made public.T A computes the value TCCNj=h(IDCNj∥RTSCNj∥N) and stores {TCCNj,IDCNj} in the memory of TA as well as CNj and then adds the univariate polynomial P(TCCNj,y) to the memory of CNj.The computing processes in predeployment phase of theIMDl is the same as that of Wazid et al.’s scheme, so the details are omitted.


## 5.2. Postdeployment Phase

The specific process of this phase is as follows.Firstly,IMDl sends the message RIDIMDl to CNj; once CNj receives the message, CNj responds with the message TCCNj. At the same time, they calculate the same shared secret key SKIMDl,CNj=P(RIDIMDl,TCCNj) and SKCNj,IMDl=P(RIDIMDl,TCCNj) on each own for future use.


## 5.3. User Registration Phase

In this phase,Ui registers with TA by executing ensuing procedure as shown in Figure 4.Figure 4
User registration phase of our scheme.Step 1.
U i inputs the selected IDi and password PWi and imprints the biometric BIOi into the MDi. MDi chooses the private key k∈Zp and computes the corresponding public key Qu=k·P, as well as keeping the both secret. Finally, Ui submits the IDi and Qu to TA via the secure channel.Step 2.
After receiving the registration request fromUi, TA calculates RIDi=h(IDi∥x∥N) and stores specific {IDi,Qu} of Ui in the memory. Then TA forwards the value RIDi to Ui.Step 3.
Upon receiving the message,MDi chooses a random number K and calculates fuzzy vault parameters Gen(Pol,BIOi,K)=L and Enc(CP,L)=V as well as RPWi=h(PWi∥k) and Di=k⊕h(IDi∥PWi∥K). Then, MDi computes the verification value Ti=h(h(IDi∥RPWi∥K)modl) where 28≤l≤216 is a medium integer which represents the capacity of the pool of the IDi,PWi pair against the offline password guessing attack in the Wazid et al.’s scheme. After the calculation of RIDi′=RIDi⊕h(PWi∥K∥k), MDi stores the parameters {Ti,Di,RIDi′,V,Qu,l,h(·),Dec(·),Rec(·),Gen(·),Enc(·)}.


## 5.4. Login Phase

As showed in Figure5, in this phase, Ui inputs IDi, PWi, and the biometric BIOi′ on the MDi. Then Ui regains the fuzzy vault parameter K′ by computing the value Dec(BIOi′,V)=Pol′ andRec(Pol′)=K′. With K′,MDi continues to calculate k=Di⊕h(IDi∥PWi∥K′) and RPWi′=h(PWi∥k) and checks Ti?=h(h(IDi∥RPWi′∥K′)modl). If two values are not equal, MDi refuses the login request; otherwise, MDi believes that IDi, PWi, and BIOi′ are legitimate and continues to compute RIDi=RIDi′⊕h(PWi∥K∥k). Then, MDi generates the current timestamp T1 and random numbers ai and ci. With these numbers, MDi continues to calculate bi=h(RIDi∥T1∥IDi∥IDCNj), M1=ai·P, M2=ai+kbi(modp), M3=ai·QTA, UIDi=(IDi∥IDCNj)⊕h(M3), and PKSi=ci⊕h(RIDi∥M3∥T1). Finally, MDi sends the message {M1,M2,PKSi,T1,UIDi} to TA via a public channel.Figure 5
Login and authentication phase of our scheme.


## 5.5. Authentication and Key Agreement Phase

By executing following procedures, mutual authentication is established amongUi, TA, and CNj, and a secure session key is negotiated between Ui and CNj.Step 1.
After receiving the login request{M1,M2,PKSi,T1,UIDi}, TA first judges if |T1-T2|≤ΔT holds, where T2 is the current timestamp and ΔT is the maximum transmission delay. If it is invalid, TA terminates the session; otherwise, TA computes the value IDi∗∥IDCNj∗=UIDi⊕h(x·M1) and retrieves Qu∗ (i.e., the public key of Ui) corresponding to IDi∗. Then TA computes RIDi∗=h(IDi∗∥x∥N) and bi∗=h(RIDi∗∥T1∥IDi∗∥IDCNj∗) and checks the validation of the signature by checking if the equation M2·P=M1+bi∗·Qu∗ holds. Specifically, the equality means that TA certifies Ui’s legitimacy; otherwise, TA terminates the session. Then, TA continues to calculate ci=PKSi⊕h(RIDi∥x·M1∥T1), M4=h(IDi∥TCCNj∥ci), DIDTA=IDi⊕h(UIDi∥TCCNj∥T2), and PKSTA=ci⊕h(TCCNj∥IDi∥T2). Finally, TA sends the message {M1,DIDTA,PKSTA,UIDi,T2,M4} to CNj via the public channel.Step 2.
After receiving the message fromTA, CNj first checks the validation of the condition |T2-T3|≤ΔT where T3 is the current timestamp. If it does not hold, the session is terminated here; otherwise, CNj regains the value of IDi and ci by computing IDi∗=DIDTA⊕h(UIDi∥TCCNj∥T2) as well as ci∗=PKSTA⊕h(TCCNj∥IDi∗∥T2). Then, CNj checks if M4 equals the result of the computation of h(IDi∗∥TCCNj∥ci∗). If it does not hold, CNj terminates the session; otherwise, it means that CNj verifies TA’s legality. Then CNj selects a random number cj and goes on with the computation of M5=cj·P, M6=cj·M1, the session key SKji=h(IDi∥IDCNj∥M6), and M7=h(SKji∥ci∥T3). Finally, the massage {M5,T3,M7} will be sent to Ui for authentication.Step 3.
When receiving the massage{M5,T3,M7} from CNj, Ui will first check the validation of condition |T3-T4|?≤ΔT; if it holds, Ui continues to calculate the session key SKij=h(IDi∥IDCNj∥ai·M5) and judge if the value M7 equals h(SKij∥ci∥T3). The final verification shows that the mutual authentication among the Ui, TA, and CNj is accomplished and the session key SKij=h(IDi∥IDCNj∥ai·M5)=h(IDi∥IDCNj∥aj·M1)=SKji is established for future sessions.


## 5.6. Password and Biometric Update Phase

In this phase, we allowUi to update the password at will by the following process, which is executed locally without involving TA for security reasons.Step 1.
First,Ui inputs her/his IDi, PWiold, and BIOi′ on the terminal. Then MDi calculates fuzzy vault parameters Dec(BIOi′,V)=Pol′ and Rec(Pol′)=K′ and regains the private key k′=Di⊕h(IDi∥PWiold∥K′) and RPWi′=h(PWiold∥k′). MDi checks whether Ti equals h(h(IDi∥RPWi′∥K′)modl) or not. If it does not hold, MDi rejects the request; otherwise, MDi claims for the new PWinew.Step 2.
WhenUi inputs the new password PWinew, MDi computes RPWinew=h(PWinew∥k), Dinew=k⊕h(IDi∥PWinew∥K), Tinew=h(h(IDi∥RPWinew∥K)modl), and RIDi′new=RIDi′⊕h(PWinew∥K∥k)⊕h(PWinew∥K∥k).Step 3.
After the computation,MDi updates the value of Dinew, Tinew, and RIDi′new in the list. Above processes simulate the situation that user only wants to update the password and maintains original biometric where BIOinew=BIOi. The password and biometric update phase are summarized in Figure 6.Figure 6
Password and biometric update phase of our scheme.


## 5.7. Dynamic Controller Node Addition Phase

In this phase, we can deploy a new control node as follows.Step 1.
T A first picks a new identity for CNjnew, called IDCNjnew, then TA repeats the calculation TCCNjnew=h(IDCNjnew∥RTSCNjnew∥N) of CNjnew in the predeployment phase where RTSCNjnew is newly generated registration timestamp. Next, TA calculates the univariate polynomial P(TCCNjnew,y).Step 2.
Finally,TA stores the parameters {TCCNjnew,IDCNjnew} into its memory and stores the credentials {TCCNjnew,IDCNjnew,P(TCCNjnew,y)} into the memory of CNjnew prior to its deployment.


## 5.8. DynamicIMD Addition Phase

Depending on the real situation, the patient needs to check the state of the implantable device in time to ensure that accurate health data is conveyed, so we often need to replace an old IMD or add a new IMD. In the case that we use a newIMDlnew to replace the existing one, please refer to Wazid et al.’s scheme for the details.


## 6. Security Analysis

We analyze the security of our proposed scheme in this section; it fully proves that our scheme can solve the shortcomings of Wazid et al.’s scheme and resist all kinds of known attacks. The security features such as user anonymity and forward secrecy are guaranteed in our protocol.


### 6.1. Security Model

Our scheme involves three interacting entities, such asUi with {PWi,BIOi,MDi,k}, CNj with TCCNj, and TA which keeps his/her private key x. Each participant can activate multiple protocol instances and run multiple session instances in parallel. The Uith is defined as the ith instance of Ui, and the same rules apply to CNjth and TAa. All of these instances can be seen as oracles which have three states below.(i)
Accept state: when the oracle has received the last valid message of the protocol, we can say the oracle accepts the message.(ii)
Reject state: when the oracle has received any incorrect message, the oracle will reject the received message.(iii)
⊥ state: when the oracle outputs no answer of the queries, we say that the oracle is in an unresponsive state which is defined as ⊥ state.We give the security model of our scheme, which combines the security models of [33, 45].Definition 1 (partnering).
If the instances ofUith and CNjth satisfy the following three conditions meanwhile, we determine that they are partnered to each other. (1) One of the instances is the target object of session for the other instances in the protocol, that is, the partner identification of Uith is CNjth and vice versa. (2) Both instances accept the messages mutually and negotiate the same secure session key. (3) Both instances share the same session identifier.Definition 2 (freshness).
An instance called fresh must meet the following conditions. (1) Before the instanceUith accepts the protocol run and generates the session key, neither the participants Uith nor the partners of the instance Uith are completely corrupted. (2) Neither Uith nor his/her partner instances are queried of Reveal(Uith/CNjth) by the adversary or disclose the session key.Definition 3 (correctness).
WhenUith and CNjth are partnered as well as accepted, they will agree on the same session key.Definition 4 (adversary capabilities).
Interaction between the adversaryA and participants in the protocol is implemented via oracle queries to simulate the abilities of attackers in reality. All oracle queries are listed as follows.(i)
Execute(Uith,CNjth,TAa): this oracle simulates the passive attacks (such as eavesdropping, tracking) where the adversary can get all response messages Msg1,Msg2,Msg3 exchanged during the honest execution of authentication process.(ii)
Send(Uith/CNjth/TAa,m): this oracle models the active attacks where the adversary can forward a modified message m to Uith/CNjth/TAa. Then he/she will get the response generated from Uith/CNjth/TAa who executes the procedure of honest protocol after receiving m. Additionally, the query Send(Uith,start) initials the protocol.(iii)
Test(Uith/CNjth): this query does not model the actual attack capabilities of adversary A but rather measures the semantic security of the session key SK. For a participant instance Uith/CNjth, if the instance does not generate the session key, an undefined symbol ⊥ will be returned. Otherwise, a uniform coin is thrown, if the result is 1, the true session key of the instance Uith/CNjth is returned; otherwise, a random number of the same length as the session key is returned. The adversary needs to guess the result of the toss to see whether he/she gets a real session key or a random number. Notice that the Test(Uith/CNjth) oracle query can only be used for fresh instance and up to once.(iv)
Reveal(Uith/CNjth): this oracle simulates the reveal of session key SK to adversary if Uith/CNjth really holds SK and has not been queried by a Test(Uith/CNjth) before. Otherwise the ⊥ will be returned.(v)
Corrupt(Uith,a): this oracle query is used to model the corruption ability of the adversary; we assume A can get any one factor of Uith but not all.Ifa=1, it responses A with the password PWi of Uith.Ifa=2, it responses A with all the security parameters stored in the MDi of Uith.Ifa=3, it responses A with the biometric BIOi of Uith.Ifa=4, it responses A with the private key k of Uith.(vi)
Corrupt(CNjth/TAa): the adversary can get the long-term secret values of CNjth/TAa, such as TCCNjof CNjth or the private key x of TAa.Definition 5 (random oracle).
We determine the cryptographic one-way hash functionH which can be accessed by all participants including A as a random oracle.A 3FA protocol should guarantee the semantic security which is defined from Test-query. In the process run of the protocolP, A can ask the Test-query just once while other queries; i.e., Execute-query, Reveal-query, or Send-query can be asked multiple times in polynomial time. Besides, A can only make Test-query on a fresh instance. The adversary’s operation is to guess the result of the coin toss in the Test-query, then we treat the event in which the adversary correctly guesses the result as a successful attack, credited as Succ(A). Only after the participants have completed the strict mutual authentication can a common session key be negotiated. The advantage of an adversaryA breaking the session key security of protocol P is defined as AdvP,Dake(A)=2Pr[Succ(A)]-1 where D denotes the password space whose distribution follows a Zipf’s law [50].Theorem 6 (semantic security).
Given a 3FA protocolP, if the advantage AdvP,Dake(A) of an arbitrary PPT adversary breaking the session key security of the protocol is at most a negligible amount n(l) larger than C′·qsends′, then we believe that the P satisfies the semantic security, where the qsend denotes the number of active attacks by the PPT adversary and n(l) represents a negligible function for the security parameter l.(1)AdvP,DakeA≤C′·qsends′+nlAs shown above,C′=0.062239 and s′=0.155478 represent the Zipf parameters put forward by Wang et al. [50].


### 6.2. Security Proof

Assuming that DDH holds in a cyclic group, the public key encryption algorithm used in the protocol is CCA secure, and the signature algorithm is unforgeable for adaptively chosen messages. Here we prove Theorem6 by simulating several mixing games. The mixing games start with a real attack game, and then we gradually modify the simulation rules in each game until the adversary’s attack advantage to distinguish the correct session key from a random key of the same length becomes zero and then the game ends. For two adjacent mixing games, we will calculate the upper bound of the attacker’s advantage gap and finally calculate the upper bound of adversary’s attack on this 3FA protocol. We use Δi to indicate the difference between mixing games Gi and Gi+1 and use Advi(A) to denote the advantage of A in hybrid games Gi.(i)
G0: this experiment is the start game which simulates the real attack mode of the adversary we demonstrate in Section 6. So, we can get(2)AdvP,DakeA=Adv0A(ii)
G1: in this game, we simulate all random oracles H in the protocol by maintaining a hash query list lhash. Besides, we also simulate a private hash oracle H′ by holding another list lhash′ which records the Hash-query directly implemented by the adversary. Obviously, the game is indistinguishable from a real one, so we have(3)Δ1=Adv1A-Adv1A≤nl(iii)
G2: we exclude some impossible collisions in the G2, i.e., the collisions of messages Msg1,Msg2,Msg3 in sessions and the collisions in the outputs of Hash-query. According to the birthday paradox, we have(4)Δ2=Adv2A-Adv1A≤nl(iv)
G3: we will revise the session simulation rules for the passive attacks that the adversary asks through the Execute-query. We suppose that Ui constructs the Msg1 using another (IDi∗,PWi∗) pair chosen from Cartesian product Did∗Dpw instead of the real one. That is, parameters k∗=Di⊕h(IDi∗∥PWi∗∥K), RIDi∗=RIDi′⊕h(PWi∗∥K∥k), and bi=h(RIDi∥T1∥IDi∗∥IDCNj) are calculated and so that the signature can be calculated as M2=ai+k∗bi∗(modp). Upon receiving the message Msg1, TA continues to simulate session with the false identity. If TA is lucky enough to guess the real (IDi,PWi), the game is terminated. The real (IDi,PWi) and the pseudo (IDi∗,PWi∗) can be seen as two challenge messages for the encryption algorithm, so the difference between the games G3 and G2 is at most the advantage of A breaking the encryption algorithm’s CPA security of the signature. And the CPA security of the signature can be reduced to the DDH hypothesis. So, we can conclude(5)Δ3=Adv3A-Adv2A≤nl(v)
G 4: in this game, we continue to revise the simulation session rules in passive attacks. We use the private hashing function H′ to compute the session key SKij without the Diffie-Hellman parameters ai and cj, that is, SKij=H′(IDi∥IDCNj). Since we have excluded the collisions in the previous game, only A computes the valid Diffie-Hellman parameters aicj·P and sends the query (IDi,IDCNj,aicj·P) to H and can A distinguish the difference between G4 and the previous one. But the capability of A is limited by the hardness of DDH security where given ga, gb, gab and ga, gb, gc, A cannot tell gab from gc. Based on the intractability of the DDH problem, we have(6)Δ4=Adv4A-Adv3A≤nl (vi)
G 5: in this game, we start to revise the simulation session rules by active attacks. We take the Send(TA,(Msg1)) as the example, and if Ui is not corrupted and A correctly constructs the signature, then we say that A wins the game and terminate the simulation. Based on the unforgeability security of the signature, then we have(7)Δ5=Adv5A-Adv4A≤nl (vii)
G 6: we continue to revise the simulation session rules in active sessions. We acknowledge that A wins the game when A has successfully fabricated the message Msg{M1,DIDTA,PKSTA,UIDTA,M4} and sent it to TA. We use the private hash function H′ to simulate the active sessions. The authenticator M4 is calculated as M4=H′(IDi∥TCCNj∥ci) where the ci is randomly selected from a cyclic group. When the ci corresponds to a fake PWi∗, the distribution of ci is indistinguishable from the uniform distribution on a cyclic group. Then we have(8)Δ6=Adv6A-Adv5A≤nl (viii)
G 7: we change the simulation rules in active sessions for the last time in this game. If A correctly forge the message Msg3{M5,M7,T3}, then we say A wins the game and terminate the game. The authenticator M7 contains the random number ci which is unknown to A. We have eliminated this situation in previous game. So, we have(9)Δ7=Adv7A-Adv6A≤nlThe only way to succeed in this game is to obtain the parameters inMDi and guess Ui’s real password. A is unable to get any information of PWi from simulation, according to the Zipf law, we get(10)Adv8A≤nl≤C′·qsends′Therefore, Theorem6 is proved.


### 6.3. Other Discussions

In this aspect, we demonstrate that our protocol can resist various known attacks as well as achieve security characteristics such as user anonymity, forward security, and key security.


#### 6.3.1. Privileged Insider Attack

In the registration phase of our protocol,Ui sends the message consisting of the identity IDi and corresponding public key Qu without any knowledge of the password PWi, so that TA has no approach to derive PWi. Obviously, our scheme can withstand the privileged insider attack.


#### 6.3.2. Stolen-Verifier Attack

In this attack mode, an attacker can steal the verification parameters stored byTA to cheat Ui, while we just put IDi and Qu in the verification table which contains no knowledge about password PWi. Therefore, our scheme is immune to the stolen-verifier attack.


#### 6.3.3. Offline Password Guessing Attack with Stolen Mobile Device

For this situation, we usually suppose that theA has gained the security parameters {Ti,Di,RIDi′,Qu,V,l} stored in the MDi and the biometric BIOi simultaneously; A can eavesdrop authentication messages Msg1,Msg2,Msg3 transmitted via the public channel.A picks a candidate IDi∗,PWi∗ pair in the Cartesian product Did∗Dpw and computes Dec(BIOi,V)=Pol, Rec(Pol)=K, k∗=Di⊕h(IDi∗∥PWi∗∥K), and RPWi∗=h(PWi∗∥k) as well as the verification value Ti∗=h(h(IDi∗∥RPWi∗∥K)modl). In general, A can determine the chosen IDi∗,PWi∗ pair’s validation by checking if Ti∗ equals the stored value Ti. If it holds, it means that A has guessed the correct IDi∗,PWi∗ of Ui successfully; otherwise, he/she can pick another IDi∗,PWi∗ pair continuing to attack. However, we introduce the fuzzy-verifier Ti=h(h(IDi∥RPWi∥K)modl) which is effective in leaving adequate candidates for A to identify and thus making it impossible for a PPT adversary to successfully guess the password.Hence, the offline password guessing attack can not damageUi’s security.


#### 6.3.4. Undetectable Online Password Guessing Attack

In the proposed scheme, onceA tries initialing the protocol, he/she needs to make sure that the chosen password PWi∗ is valid to construct the verification signature M2=ai+kbi(modp) which will pass authentication of TA. Otherwise, the wrong PWi∗ will be observed easily by TA. So, our scheme can withstand the undetectable online password guessing attack.


#### 6.3.5. Modification Attack

In our protocol, evenA intercepts the messages transmitted in the channel, it is still impossible for A to construct Msg1{M1,M2,PKSi,T1,UIDi}, Msg2{M1,DIDTA,PKSTA,UIDi,T2,M4}, and Msg3{M5,T3,M7} which are protected by the secret value, private key or hash functions to pass the message verification. For example, in Msg1  A is unable to calculate the value M2=ai+kbi(modp), since bi=h(RIDi∥T1∥IDi∥IDCNj) where RIDi=RIDi′⊕h(PWi∥K∥k)=h(IDi∥x∥N) consists of secret values only known to Ui or TA such as PWi, private key k, and x, so that A’s login request will be rejected by TA. Similarly, A cannot construct the valid verification parameters M4 without knowledge of TCCNj or M7 due to the hardness of ECCDH problem introduced in Section 2.2. Thus, all modified messages will be detected and rejected by receiver simultaneously.In conclusion, modification attack is impossible in our scheme.


#### 6.3.6. User Impersonation Attack

We suppose thatA plans to impersonate as a legitimate user Ui to interact with TA. The key step is to construct a valid value M2 to pass the verification of TA. However, A is unable to calculate M2=ai+kbi(modp) without bi. To get bi=h(RIDi∥T1∥IDi∥IDCNj), he/she needs to know the most of long-term values. Therefore, our proposed scheme is immune to the user impersonation attack.


#### 6.3.7. Control Node Impersonation Attack

We have analyzed that the maliciousMDi may successfully impersonate CNj to cheat another MDi∗ in Wazid et al.’s scheme. On the one hand, both MDi and CNj hold the same parameter RIDTA which composes the correct verification value M5=h(SKij∥T2) and SKij=h(kij∥RIDTA∥T1∥T2). On the other hand, in Wazid et al.’s scheme, the essential parameter cj is not verified when it is sent to MDi. But in our scheme, this attack mode cannot be implemented, and the malicious MDi is unable to fabricate M7 without knowing ci of MDi∗, so we solve the potential pitfall in Wazid et al.’s scheme.From another point of view, an adversaryA cannot construct the verification value M7 due to the hardness of ECCDH, so A fails to impersonate a CNj. In a word, the control node impersonation attack has no threat to our protocol.


#### 6.3.8. TA Impersonation Attack

ForA, it is computationally infeasible to get the value M4=h(IDi∥TCCNj∥ci) which is protected by hash function and critical parameters TCCNj as well as nonce ci. The ci can be derived from two functions as ci=PKSTA⊕h(TCCNj∥IDi∥T2)=PKSi⊕h(RIDi∥M5∥T1), but even A has intercepted the parameters PKSTA, UIDi, and PKSi; he/she still cannot calculate ci without RIDCNj, RIDi, or M3, and then M4 cannot be computed. In short, our scheme is immune to the TA impersonation attack.


#### 6.3.9. Denial-of-Service (DoS) Attack

BeforeUi’s login request is sent to TA, the password PWi∗, identity IDi∗, and biometric BIOi∗ input in the terminal by Ui will be determined locally by verifying the value of Ti∗. According to the protocol, only when Ti∗=Ti, the process will continue. Hence, our protocol can withstand such an attack.


#### 6.3.10. Replay Attack

When an adversaryA wants to send the intercepted messages Msg1,Msg2,Msg3 to receiver again, it will fail to pass the protection of timestamp T1,T2,T3,T4. All these intercepted messages will be seen overdue. So, our scheme can withstand this attack effectively.


#### 6.3.11. Mutual Authentication

Mutual authentication means that before the doctor gets health information fromCNj, Ui, TA, and CNj have confirmed the legitimacy of the other two parties. In our protocol, TA holds the public key Qu to verify the signature M2, and then Ui is authenticated. In the same way, we take the verification values M4 and M7 which consist of some parameters only known to them just like private key or nonce to accomplish mutual authentication. That is, when they affirm that each other is legal, a secure session key is negotiated between Ui and CNj.


#### 6.3.12. Known Key Security

Our entire protocol’s purpose is to ensure the safety of subsequent medical information delivery after mutual authentication is completed. The session keySKij=h(IDi∥IDCNj∥aicj·P) which depends on random numbers ai and cj can be different and independent in every key agreement phase. Even some session keys are disclosed, in the next session, the SKij will maintain secure. Hence, our protocol guarantees the security of the session key.


#### 6.3.13. Perfect forward Secrecy

At the final step of authentication phase,Ui and CNj negotiate a session key SKij=h(IDi∥IDCNj∥aicj·P)=h(IDi∥IDCNj∥ai·M5)=h(IDi∥IDCNj∥cj·M1). To calculate the session key with M1=ai·P, A has to solve the ECCDH problem as we showed before. It follows that even long-term keys of Ui and CNj are disclosed, the session key still maintains secure. Hence, the proposed protocol achieves perfect forward secrecy.


#### 6.3.14. User Anonymity

In the proposed protocol, we conceal the identityIDi in the bi=h(RIDi∥T1∥IDi∥IDCNj), UIDi=(IDi∥IDCNj)⊕h(M3), and DIDTA=IDi⊕h(UIDi∥TCCNj∥T2). It shows that IDi is protected by private key x in RIDi=h(IDi∥x∥N), nonce ai in M3=ai·QTA. That means in addition to the Ui, TA, and CNj, no one knows the IDi. So, our scheme achieves user anonymity.


#### 6.3.15. User Untraceability

In the proposed protocol, messagesMsg1{M1,M2,PKSi,T1,UIDi}, Msg2{M1,DIDTA,PKSTA,UIDi,T2,M4}, and Msg3{M5,T3,M7} transmitted among Ui, TA, and CNj are dynamic and different from before ones because the sender randomly selects a number to compose messages. For instance, in Msg1, the introductions of ai and cj make the parameters different for each login phase to prevent A from using static values to track user. In short, it is impossible for A to track Ui in our scheme.


#### 6.3.16. Biometric Template Privacy

Our scheme can effectively maintain the privacy of biometricBIOi. On the one hand, user does not offer CNj the biometric template, and there is no knowledge about Ui’s biometric template in the memory of CNj. On the other hand, we firstly use fuzzy vault to convert the form of biometric template to V. Even A obtains the V form MDi, he/she still cannot recover the biometric template because the algorithms of fuzzy vault are one-way operations. Moreover, the biometric template itself is difficult to lose or falsify. In short, our protocol guarantees the privacy of biometric template.


## 6.1. Security Model

Our scheme involves three interacting entities, such asUi with {PWi,BIOi,MDi,k}, CNj with TCCNj, and TA which keeps his/her private key x. Each participant can activate multiple protocol instances and run multiple session instances in parallel. The Uith is defined as the ith instance of Ui, and the same rules apply to CNjth and TAa. All of these instances can be seen as oracles which have three states below.(i)
Accept state: when the oracle has received the last valid message of the protocol, we can say the oracle accepts the message.(ii)
Reject state: when the oracle has received any incorrect message, the oracle will reject the received message.(iii)
⊥ state: when the oracle outputs no answer of the queries, we say that the oracle is in an unresponsive state which is defined as ⊥ state.We give the security model of our scheme, which combines the security models of [33, 45].Definition 1 (partnering).
If the instances ofUith and CNjth satisfy the following three conditions meanwhile, we determine that they are partnered to each other. (1) One of the instances is the target object of session for the other instances in the protocol, that is, the partner identification of Uith is CNjth and vice versa. (2) Both instances accept the messages mutually and negotiate the same secure session key. (3) Both instances share the same session identifier.Definition 2 (freshness).
An instance called fresh must meet the following conditions. (1) Before the instanceUith accepts the protocol run and generates the session key, neither the participants Uith nor the partners of the instance Uith are completely corrupted. (2) Neither Uith nor his/her partner instances are queried of Reveal(Uith/CNjth) by the adversary or disclose the session key.Definition 3 (correctness).
WhenUith and CNjth are partnered as well as accepted, they will agree on the same session key.Definition 4 (adversary capabilities).
Interaction between the adversaryA and participants in the protocol is implemented via oracle queries to simulate the abilities of attackers in reality. All oracle queries are listed as follows.(i)
Execute(Uith,CNjth,TAa): this oracle simulates the passive attacks (such as eavesdropping, tracking) where the adversary can get all response messages Msg1,Msg2,Msg3 exchanged during the honest execution of authentication process.(ii)
Send(Uith/CNjth/TAa,m): this oracle models the active attacks where the adversary can forward a modified message m to Uith/CNjth/TAa. Then he/she will get the response generated from Uith/CNjth/TAa who executes the procedure of honest protocol after receiving m. Additionally, the query Send(Uith,start) initials the protocol.(iii)
Test(Uith/CNjth): this query does not model the actual attack capabilities of adversary A but rather measures the semantic security of the session key SK. For a participant instance Uith/CNjth, if the instance does not generate the session key, an undefined symbol ⊥ will be returned. Otherwise, a uniform coin is thrown, if the result is 1, the true session key of the instance Uith/CNjth is returned; otherwise, a random number of the same length as the session key is returned. The adversary needs to guess the result of the toss to see whether he/she gets a real session key or a random number. Notice that the Test(Uith/CNjth) oracle query can only be used for fresh instance and up to once.(iv)
Reveal(Uith/CNjth): this oracle simulates the reveal of session key SK to adversary if Uith/CNjth really holds SK and has not been queried by a Test(Uith/CNjth) before. Otherwise the ⊥ will be returned.(v)
Corrupt(Uith,a): this oracle query is used to model the corruption ability of the adversary; we assume A can get any one factor of Uith but not all.Ifa=1, it responses A with the password PWi of Uith.Ifa=2, it responses A with all the security parameters stored in the MDi of Uith.Ifa=3, it responses A with the biometric BIOi of Uith.Ifa=4, it responses A with the private key k of Uith.(vi)
Corrupt(CNjth/TAa): the adversary can get the long-term secret values of CNjth/TAa, such as TCCNjof CNjth or the private key x of TAa.Definition 5 (random oracle).
We determine the cryptographic one-way hash functionH which can be accessed by all participants including A as a random oracle.A 3FA protocol should guarantee the semantic security which is defined from Test-query. In the process run of the protocolP, A can ask the Test-query just once while other queries; i.e., Execute-query, Reveal-query, or Send-query can be asked multiple times in polynomial time. Besides, A can only make Test-query on a fresh instance. The adversary’s operation is to guess the result of the coin toss in the Test-query, then we treat the event in which the adversary correctly guesses the result as a successful attack, credited as Succ(A). Only after the participants have completed the strict mutual authentication can a common session key be negotiated. The advantage of an adversaryA breaking the session key security of protocol P is defined as AdvP,Dake(A)=2Pr[Succ(A)]-1 where D denotes the password space whose distribution follows a Zipf’s law [50].Theorem 6 (semantic security).
Given a 3FA protocolP, if the advantage AdvP,Dake(A) of an arbitrary PPT adversary breaking the session key security of the protocol is at most a negligible amount n(l) larger than C′·qsends′, then we believe that the P satisfies the semantic security, where the qsend denotes the number of active attacks by the PPT adversary and n(l) represents a negligible function for the security parameter l.(1)AdvP,DakeA≤C′·qsends′+nlAs shown above,C′=0.062239 and s′=0.155478 represent the Zipf parameters put forward by Wang et al. [50].


## 6.2. Security Proof

Assuming that DDH holds in a cyclic group, the public key encryption algorithm used in the protocol is CCA secure, and the signature algorithm is unforgeable for adaptively chosen messages. Here we prove Theorem6 by simulating several mixing games. The mixing games start with a real attack game, and then we gradually modify the simulation rules in each game until the adversary’s attack advantage to distinguish the correct session key from a random key of the same length becomes zero and then the game ends. For two adjacent mixing games, we will calculate the upper bound of the attacker’s advantage gap and finally calculate the upper bound of adversary’s attack on this 3FA protocol. We use Δi to indicate the difference between mixing games Gi and Gi+1 and use Advi(A) to denote the advantage of A in hybrid games Gi.(i)
G0: this experiment is the start game which simulates the real attack mode of the adversary we demonstrate in Section 6. So, we can get(2)AdvP,DakeA=Adv0A(ii)
G1: in this game, we simulate all random oracles H in the protocol by maintaining a hash query list lhash. Besides, we also simulate a private hash oracle H′ by holding another list lhash′ which records the Hash-query directly implemented by the adversary. Obviously, the game is indistinguishable from a real one, so we have(3)Δ1=Adv1A-Adv1A≤nl(iii)
G2: we exclude some impossible collisions in the G2, i.e., the collisions of messages Msg1,Msg2,Msg3 in sessions and the collisions in the outputs of Hash-query. According to the birthday paradox, we have(4)Δ2=Adv2A-Adv1A≤nl(iv)
G3: we will revise the session simulation rules for the passive attacks that the adversary asks through the Execute-query. We suppose that Ui constructs the Msg1 using another (IDi∗,PWi∗) pair chosen from Cartesian product Did∗Dpw instead of the real one. That is, parameters k∗=Di⊕h(IDi∗∥PWi∗∥K), RIDi∗=RIDi′⊕h(PWi∗∥K∥k), and bi=h(RIDi∥T1∥IDi∗∥IDCNj) are calculated and so that the signature can be calculated as M2=ai+k∗bi∗(modp). Upon receiving the message Msg1, TA continues to simulate session with the false identity. If TA is lucky enough to guess the real (IDi,PWi), the game is terminated. The real (IDi,PWi) and the pseudo (IDi∗,PWi∗) can be seen as two challenge messages for the encryption algorithm, so the difference between the games G3 and G2 is at most the advantage of A breaking the encryption algorithm’s CPA security of the signature. And the CPA security of the signature can be reduced to the DDH hypothesis. So, we can conclude(5)Δ3=Adv3A-Adv2A≤nl(v)
G 4: in this game, we continue to revise the simulation session rules in passive attacks. We use the private hashing function H′ to compute the session key SKij without the Diffie-Hellman parameters ai and cj, that is, SKij=H′(IDi∥IDCNj). Since we have excluded the collisions in the previous game, only A computes the valid Diffie-Hellman parameters aicj·P and sends the query (IDi,IDCNj,aicj·P) to H and can A distinguish the difference between G4 and the previous one. But the capability of A is limited by the hardness of DDH security where given ga, gb, gab and ga, gb, gc, A cannot tell gab from gc. Based on the intractability of the DDH problem, we have(6)Δ4=Adv4A-Adv3A≤nl (vi)
G 5: in this game, we start to revise the simulation session rules by active attacks. We take the Send(TA,(Msg1)) as the example, and if Ui is not corrupted and A correctly constructs the signature, then we say that A wins the game and terminate the simulation. Based on the unforgeability security of the signature, then we have(7)Δ5=Adv5A-Adv4A≤nl (vii)
G 6: we continue to revise the simulation session rules in active sessions. We acknowledge that A wins the game when A has successfully fabricated the message Msg{M1,DIDTA,PKSTA,UIDTA,M4} and sent it to TA. We use the private hash function H′ to simulate the active sessions. The authenticator M4 is calculated as M4=H′(IDi∥TCCNj∥ci) where the ci is randomly selected from a cyclic group. When the ci corresponds to a fake PWi∗, the distribution of ci is indistinguishable from the uniform distribution on a cyclic group. Then we have(8)Δ6=Adv6A-Adv5A≤nl (viii)
G 7: we change the simulation rules in active sessions for the last time in this game. If A correctly forge the message Msg3{M5,M7,T3}, then we say A wins the game and terminate the game. The authenticator M7 contains the random number ci which is unknown to A. We have eliminated this situation in previous game. So, we have(9)Δ7=Adv7A-Adv6A≤nlThe only way to succeed in this game is to obtain the parameters inMDi and guess Ui’s real password. A is unable to get any information of PWi from simulation, according to the Zipf law, we get(10)Adv8A≤nl≤C′·qsends′Therefore, Theorem6 is proved.


## 6.3. Other Discussions

In this aspect, we demonstrate that our protocol can resist various known attacks as well as achieve security characteristics such as user anonymity, forward security, and key security.


### 6.3.1. Privileged Insider Attack

In the registration phase of our protocol,Ui sends the message consisting of the identity IDi and corresponding public key Qu without any knowledge of the password PWi, so that TA has no approach to derive PWi. Obviously, our scheme can withstand the privileged insider attack.


### 6.3.2. Stolen-Verifier Attack

In this attack mode, an attacker can steal the verification parameters stored byTA to cheat Ui, while we just put IDi and Qu in the verification table which contains no knowledge about password PWi. Therefore, our scheme is immune to the stolen-verifier attack.


### 6.3.3. Offline Password Guessing Attack with Stolen Mobile Device

For this situation, we usually suppose that theA has gained the security parameters {Ti,Di,RIDi′,Qu,V,l} stored in the MDi and the biometric BIOi simultaneously; A can eavesdrop authentication messages Msg1,Msg2,Msg3 transmitted via the public channel.A picks a candidate IDi∗,PWi∗ pair in the Cartesian product Did∗Dpw and computes Dec(BIOi,V)=Pol, Rec(Pol)=K, k∗=Di⊕h(IDi∗∥PWi∗∥K), and RPWi∗=h(PWi∗∥k) as well as the verification value Ti∗=h(h(IDi∗∥RPWi∗∥K)modl). In general, A can determine the chosen IDi∗,PWi∗ pair’s validation by checking if Ti∗ equals the stored value Ti. If it holds, it means that A has guessed the correct IDi∗,PWi∗ of Ui successfully; otherwise, he/she can pick another IDi∗,PWi∗ pair continuing to attack. However, we introduce the fuzzy-verifier Ti=h(h(IDi∥RPWi∥K)modl) which is effective in leaving adequate candidates for A to identify and thus making it impossible for a PPT adversary to successfully guess the password.Hence, the offline password guessing attack can not damageUi’s security.


### 6.3.4. Undetectable Online Password Guessing Attack

In the proposed scheme, onceA tries initialing the protocol, he/she needs to make sure that the chosen password PWi∗ is valid to construct the verification signature M2=ai+kbi(modp) which will pass authentication of TA. Otherwise, the wrong PWi∗ will be observed easily by TA. So, our scheme can withstand the undetectable online password guessing attack.


### 6.3.5. Modification Attack

In our protocol, evenA intercepts the messages transmitted in the channel, it is still impossible for A to construct Msg1{M1,M2,PKSi,T1,UIDi}, Msg2{M1,DIDTA,PKSTA,UIDi,T2,M4}, and Msg3{M5,T3,M7} which are protected by the secret value, private key or hash functions to pass the message verification. For example, in Msg1  A is unable to calculate the value M2=ai+kbi(modp), since bi=h(RIDi∥T1∥IDi∥IDCNj) where RIDi=RIDi′⊕h(PWi∥K∥k)=h(IDi∥x∥N) consists of secret values only known to Ui or TA such as PWi, private key k, and x, so that A’s login request will be rejected by TA. Similarly, A cannot construct the valid verification parameters M4 without knowledge of TCCNj or M7 due to the hardness of ECCDH problem introduced in Section 2.2. Thus, all modified messages will be detected and rejected by receiver simultaneously.In conclusion, modification attack is impossible in our scheme.


### 6.3.6. User Impersonation Attack

We suppose thatA plans to impersonate as a legitimate user Ui to interact with TA. The key step is to construct a valid value M2 to pass the verification of TA. However, A is unable to calculate M2=ai+kbi(modp) without bi. To get bi=h(RIDi∥T1∥IDi∥IDCNj), he/she needs to know the most of long-term values. Therefore, our proposed scheme is immune to the user impersonation attack.


### 6.3.7. Control Node Impersonation Attack

We have analyzed that the maliciousMDi may successfully impersonate CNj to cheat another MDi∗ in Wazid et al.’s scheme. On the one hand, both MDi and CNj hold the same parameter RIDTA which composes the correct verification value M5=h(SKij∥T2) and SKij=h(kij∥RIDTA∥T1∥T2). On the other hand, in Wazid et al.’s scheme, the essential parameter cj is not verified when it is sent to MDi. But in our scheme, this attack mode cannot be implemented, and the malicious MDi is unable to fabricate M7 without knowing ci of MDi∗, so we solve the potential pitfall in Wazid et al.’s scheme.From another point of view, an adversaryA cannot construct the verification value M7 due to the hardness of ECCDH, so A fails to impersonate a CNj. In a word, the control node impersonation attack has no threat to our protocol.


### 6.3.8. TA Impersonation Attack

ForA, it is computationally infeasible to get the value M4=h(IDi∥TCCNj∥ci) which is protected by hash function and critical parameters TCCNj as well as nonce ci. The ci can be derived from two functions as ci=PKSTA⊕h(TCCNj∥IDi∥T2)=PKSi⊕h(RIDi∥M5∥T1), but even A has intercepted the parameters PKSTA, UIDi, and PKSi; he/she still cannot calculate ci without RIDCNj, RIDi, or M3, and then M4 cannot be computed. In short, our scheme is immune to the TA impersonation attack.


### 6.3.9. Denial-of-Service (DoS) Attack

BeforeUi’s login request is sent to TA, the password PWi∗, identity IDi∗, and biometric BIOi∗ input in the terminal by Ui will be determined locally by verifying the value of Ti∗. According to the protocol, only when Ti∗=Ti, the process will continue. Hence, our protocol can withstand such an attack.


### 6.3.10. Replay Attack

When an adversaryA wants to send the intercepted messages Msg1,Msg2,Msg3 to receiver again, it will fail to pass the protection of timestamp T1,T2,T3,T4. All these intercepted messages will be seen overdue. So, our scheme can withstand this attack effectively.


### 6.3.11. Mutual Authentication

Mutual authentication means that before the doctor gets health information fromCNj, Ui, TA, and CNj have confirmed the legitimacy of the other two parties. In our protocol, TA holds the public key Qu to verify the signature M2, and then Ui is authenticated. In the same way, we take the verification values M4 and M7 which consist of some parameters only known to them just like private key or nonce to accomplish mutual authentication. That is, when they affirm that each other is legal, a secure session key is negotiated between Ui and CNj.


### 6.3.12. Known Key Security

Our entire protocol’s purpose is to ensure the safety of subsequent medical information delivery after mutual authentication is completed. The session keySKij=h(IDi∥IDCNj∥aicj·P) which depends on random numbers ai and cj can be different and independent in every key agreement phase. Even some session keys are disclosed, in the next session, the SKij will maintain secure. Hence, our protocol guarantees the security of the session key.


### 6.3.13. Perfect forward Secrecy

At the final step of authentication phase,Ui and CNj negotiate a session key SKij=h(IDi∥IDCNj∥aicj·P)=h(IDi∥IDCNj∥ai·M5)=h(IDi∥IDCNj∥cj·M1). To calculate the session key with M1=ai·P, A has to solve the ECCDH problem as we showed before. It follows that even long-term keys of Ui and CNj are disclosed, the session key still maintains secure. Hence, the proposed protocol achieves perfect forward secrecy.


### 6.3.14. User Anonymity

In the proposed protocol, we conceal the identityIDi in the bi=h(RIDi∥T1∥IDi∥IDCNj), UIDi=(IDi∥IDCNj)⊕h(M3), and DIDTA=IDi⊕h(UIDi∥TCCNj∥T2). It shows that IDi is protected by private key x in RIDi=h(IDi∥x∥N), nonce ai in M3=ai·QTA. That means in addition to the Ui, TA, and CNj, no one knows the IDi. So, our scheme achieves user anonymity.


### 6.3.15. User Untraceability

In the proposed protocol, messagesMsg1{M1,M2,PKSi,T1,UIDi}, Msg2{M1,DIDTA,PKSTA,UIDi,T2,M4}, and Msg3{M5,T3,M7} transmitted among Ui, TA, and CNj are dynamic and different from before ones because the sender randomly selects a number to compose messages. For instance, in Msg1, the introductions of ai and cj make the parameters different for each login phase to prevent A from using static values to track user. In short, it is impossible for A to track Ui in our scheme.


### 6.3.16. Biometric Template Privacy

Our scheme can effectively maintain the privacy of biometricBIOi. On the one hand, user does not offer CNj the biometric template, and there is no knowledge about Ui’s biometric template in the memory of CNj. On the other hand, we firstly use fuzzy vault to convert the form of biometric template to V. Even A obtains the V form MDi, he/she still cannot recover the biometric template because the algorithms of fuzzy vault are one-way operations. Moreover, the biometric template itself is difficult to lose or falsify. In short, our protocol guarantees the privacy of biometric template.


## 6.3.1. Privileged Insider Attack

In the registration phase of our protocol,Ui sends the message consisting of the identity IDi and corresponding public key Qu without any knowledge of the password PWi, so that TA has no approach to derive PWi. Obviously, our scheme can withstand the privileged insider attack.


## 6.3.2. Stolen-Verifier Attack

In this attack mode, an attacker can steal the verification parameters stored byTA to cheat Ui, while we just put IDi and Qu in the verification table which contains no knowledge about password PWi. Therefore, our scheme is immune to the stolen-verifier attack.


## 6.3.3. Offline Password Guessing Attack with Stolen Mobile Device

For this situation, we usually suppose that theA has gained the security parameters {Ti,Di,RIDi′,Qu,V,l} stored in the MDi and the biometric BIOi simultaneously; A can eavesdrop authentication messages Msg1,Msg2,Msg3 transmitted via the public channel.A picks a candidate IDi∗,PWi∗ pair in the Cartesian product Did∗Dpw and computes Dec(BIOi,V)=Pol, Rec(Pol)=K, k∗=Di⊕h(IDi∗∥PWi∗∥K), and RPWi∗=h(PWi∗∥k) as well as the verification value Ti∗=h(h(IDi∗∥RPWi∗∥K)modl). In general, A can determine the chosen IDi∗,PWi∗ pair’s validation by checking if Ti∗ equals the stored value Ti. If it holds, it means that A has guessed the correct IDi∗,PWi∗ of Ui successfully; otherwise, he/she can pick another IDi∗,PWi∗ pair continuing to attack. However, we introduce the fuzzy-verifier Ti=h(h(IDi∥RPWi∥K)modl) which is effective in leaving adequate candidates for A to identify and thus making it impossible for a PPT adversary to successfully guess the password.Hence, the offline password guessing attack can not damageUi’s security.


## 6.3.4. Undetectable Online Password Guessing Attack

In the proposed scheme, onceA tries initialing the protocol, he/she needs to make sure that the chosen password PWi∗ is valid to construct the verification signature M2=ai+kbi(modp) which will pass authentication of TA. Otherwise, the wrong PWi∗ will be observed easily by TA. So, our scheme can withstand the undetectable online password guessing attack.


## 6.3.5. Modification Attack

In our protocol, evenA intercepts the messages transmitted in the channel, it is still impossible for A to construct Msg1{M1,M2,PKSi,T1,UIDi}, Msg2{M1,DIDTA,PKSTA,UIDi,T2,M4}, and Msg3{M5,T3,M7} which are protected by the secret value, private key or hash functions to pass the message verification. For example, in Msg1  A is unable to calculate the value M2=ai+kbi(modp), since bi=h(RIDi∥T1∥IDi∥IDCNj) where RIDi=RIDi′⊕h(PWi∥K∥k)=h(IDi∥x∥N) consists of secret values only known to Ui or TA such as PWi, private key k, and x, so that A’s login request will be rejected by TA. Similarly, A cannot construct the valid verification parameters M4 without knowledge of TCCNj or M7 due to the hardness of ECCDH problem introduced in Section 2.2. Thus, all modified messages will be detected and rejected by receiver simultaneously.In conclusion, modification attack is impossible in our scheme.


## 6.3.6. User Impersonation Attack

We suppose thatA plans to impersonate as a legitimate user Ui to interact with TA. The key step is to construct a valid value M2 to pass the verification of TA. However, A is unable to calculate M2=ai+kbi(modp) without bi. To get bi=h(RIDi∥T1∥IDi∥IDCNj), he/she needs to know the most of long-term values. Therefore, our proposed scheme is immune to the user impersonation attack.


## 6.3.7. Control Node Impersonation Attack

We have analyzed that the maliciousMDi may successfully impersonate CNj to cheat another MDi∗ in Wazid et al.’s scheme. On the one hand, both MDi and CNj hold the same parameter RIDTA which composes the correct verification value M5=h(SKij∥T2) and SKij=h(kij∥RIDTA∥T1∥T2). On the other hand, in Wazid et al.’s scheme, the essential parameter cj is not verified when it is sent to MDi. But in our scheme, this attack mode cannot be implemented, and the malicious MDi is unable to fabricate M7 without knowing ci of MDi∗, so we solve the potential pitfall in Wazid et al.’s scheme.From another point of view, an adversaryA cannot construct the verification value M7 due to the hardness of ECCDH, so A fails to impersonate a CNj. In a word, the control node impersonation attack has no threat to our protocol.


## 6.3.8. TA Impersonation Attack

ForA, it is computationally infeasible to get the value M4=h(IDi∥TCCNj∥ci) which is protected by hash function and critical parameters TCCNj as well as nonce ci. The ci can be derived from two functions as ci=PKSTA⊕h(TCCNj∥IDi∥T2)=PKSi⊕h(RIDi∥M5∥T1), but even A has intercepted the parameters PKSTA, UIDi, and PKSi; he/she still cannot calculate ci without RIDCNj, RIDi, or M3, and then M4 cannot be computed. In short, our scheme is immune to the TA impersonation attack.


## 6.3.9. Denial-of-Service (DoS) Attack

BeforeUi’s login request is sent to TA, the password PWi∗, identity IDi∗, and biometric BIOi∗ input in the terminal by Ui will be determined locally by verifying the value of Ti∗. According to the protocol, only when Ti∗=Ti, the process will continue. Hence, our protocol can withstand such an attack.


## 6.3.10. Replay Attack

When an adversaryA wants to send the intercepted messages Msg1,Msg2,Msg3 to receiver again, it will fail to pass the protection of timestamp T1,T2,T3,T4. All these intercepted messages will be seen overdue. So, our scheme can withstand this attack effectively.


## 6.3.11. Mutual Authentication

Mutual authentication means that before the doctor gets health information fromCNj, Ui, TA, and CNj have confirmed the legitimacy of the other two parties. In our protocol, TA holds the public key Qu to verify the signature M2, and then Ui is authenticated. In the same way, we take the verification values M4 and M7 which consist of some parameters only known to them just like private key or nonce to accomplish mutual authentication. That is, when they affirm that each other is legal, a secure session key is negotiated between Ui and CNj.


## 6.3.12. Known Key Security

Our entire protocol’s purpose is to ensure the safety of subsequent medical information delivery after mutual authentication is completed. The session keySKij=h(IDi∥IDCNj∥aicj·P) which depends on random numbers ai and cj can be different and independent in every key agreement phase. Even some session keys are disclosed, in the next session, the SKij will maintain secure. Hence, our protocol guarantees the security of the session key.


## 6.3.13. Perfect forward Secrecy

At the final step of authentication phase,Ui and CNj negotiate a session key SKij=h(IDi∥IDCNj∥aicj·P)=h(IDi∥IDCNj∥ai·M5)=h(IDi∥IDCNj∥cj·M1). To calculate the session key with M1=ai·P, A has to solve the ECCDH problem as we showed before. It follows that even long-term keys of Ui and CNj are disclosed, the session key still maintains secure. Hence, the proposed protocol achieves perfect forward secrecy.


## 6.3.14. User Anonymity

In the proposed protocol, we conceal the identityIDi in the bi=h(RIDi∥T1∥IDi∥IDCNj), UIDi=(IDi∥IDCNj)⊕h(M3), and DIDTA=IDi⊕h(UIDi∥TCCNj∥T2). It shows that IDi is protected by private key x in RIDi=h(IDi∥x∥N), nonce ai in M3=ai·QTA. That means in addition to the Ui, TA, and CNj, no one knows the IDi. So, our scheme achieves user anonymity.


## 6.3.15. User Untraceability

In the proposed protocol, messagesMsg1{M1,M2,PKSi,T1,UIDi}, Msg2{M1,DIDTA,PKSTA,UIDi,T2,M4}, and Msg3{M5,T3,M7} transmitted among Ui, TA, and CNj are dynamic and different from before ones because the sender randomly selects a number to compose messages. For instance, in Msg1, the introductions of ai and cj make the parameters different for each login phase to prevent A from using static values to track user. In short, it is impossible for A to track Ui in our scheme.


## 6.3.16. Biometric Template Privacy

Our scheme can effectively maintain the privacy of biometricBIOi. On the one hand, user does not offer CNj the biometric template, and there is no knowledge about Ui’s biometric template in the memory of CNj. On the other hand, we firstly use fuzzy vault to convert the form of biometric template to V. Even A obtains the V form MDi, he/she still cannot recover the biometric template because the algorithms of fuzzy vault are one-way operations. Moreover, the biometric template itself is difficult to lose or falsify. In short, our protocol guarantees the privacy of biometric template.


## 7. Features and Efficiency Comparison

This section shows the comparisons of our scheme and other two related works (Wang et al. [13], Wazid et al. [14]) in efficiency and the advantages/disadvantages showed in Tables 3 and 2, respectively. Specifically, we analyze the computation cost from the point of time complexity to compare the efficiency. What needs to be explained is that we only focus on the login and authentication phases and ignore the bit-XOR operation due to its low computation consumption. Besides, we use the symbols of Tem, TH, Tbp, Tse, Tme, and Tas to represent the time cost of elliptic curve point multiplication, hash function, bilinear pairing, symmetric key encryption/decryption, modular exponentiation, and asymmetric key encryption/decryption, respectively.Table 2
Comparison of security features.
Wang et al.’s scheme [13] Wazid et al.’s scheme [14] Our scheme Mutual authentication × √ √ Known key security √ √ √ Perfect forward secrecy √ √ √ User anonymity √ √ √ Biometric template privacy √ √ √ Resisting modification attack √ √ √ Resisting user impersonation attack × √ √ Resisting server(CN) impersonation attack √ × √ Resisting man-in-the-middle attack √ √ √ Resisting stolen-verifier attack √ √ √ Resisting privileged insider attack √ √ √ Resisting replay attack √ √ √ Resisting modification attack √ √ √ Resisting password guessing attack √ × √ Resisting secure key agreement × × √Table 3
Comparison of computation cost.
scheme Wang et al.’s [13] Wazid et al.’s [14] Ours U i ( M D i ) T b p + 3 T e m + 5 T H + T s e 3 T e m + 12 T H + T a s + T m e 3 T e m + 10 T H + T a s + T m e T A - - 4 T e m + 7 T H + T a s C N j T b p + 2 T e m + 5 T H + T s e 4 T e m + 5 T H + T a s 2 T e m + 5 T H Overall 2 T b p + 5 T e m + 10 T H + 2 T s e 7 T e m + 17 T H + 2 T a s + T m e 9 T e m + 22 T H + 2 T a s + T m eFrom Tables2 and 3, it could be seen that although the calculation cost of our scheme is a little higher than the other two solutions, we have greatly satisfied various security standards in terms of security, which is superior to Wang et al.’s protocol [13] in resisting impersonation attack and achieving mutual authentication. And our scheme makes up for the flaws we analyzed in Wazid et al.’s protocol [14]. In general, our protocol is more suitable for use in implantable medical system, within the acceptable computational energy consumption of the devices.


## 8. Conclusion

We take the most recent scheme of Wazid et al. as a typical example to show the subtlety of the design of 3FA for the implantable medical system. We have found that the scheme cannot resist three types of drawbacks, i.e., password guessing attack, controller node impersonation attack, and the incorrect authentication process. Then we have presented a trusted authority assisted 3FA protocol for the implantable medical system. Specifically, we have made the following amendments.TA is introduced in the authentication phase of the newly proposed solution. We have also replaced fuzzy extractor with the more widely applied fuzzy vault to the biometrics. The new protocol is provably secure under DDH assumption; the efficiency comparison and features analysis indicate that while a little efficiency is sacrificed, our protocol satisfies all the required security features. Overall, our new protocol is suitable for use in the implantable medical system.



---

*Source: 7579161-2018-07-29.xml*