# Lightweight and Secure Three-Factor Authentication Scheme for Remote Patient Monitoring Using On-Body Wireless Networks

Authors: Mengxia Shuai; Bin Liu; Nenghai Yu; Ling Xiong
Journal: Security and Communication Networks
 (2019)

---

## Abstract

On-body wireless networks (oBWNs) play a crucial role in improving the ubiquitous healthcare services. Using oBWNs, the vital physiological information of the patient can be gathered from the wearable sensor nodes and accessed by the authorized user like the health professional or the doctor. Since the open nature of wireless communication and the sensitivity of physiological information, secure communication has always been the vital issue in oBWNs-based systems. In recent years, several authentication schemes have been proposed for remote patient monitoring. However, most of these schemes are so susceptible to security threats and not suitable for practical use. Specifically, all these schemes using lightweight cryptographic primitives fail to provide forward secrecy and suffer from the desynchronization attack. To overcome the historical security problems, in this paper, we present a lightweight and secure three-factor authentication scheme for remote patient monitoring using oBWNs. The proposed scheme adopts one-time hash chain technique to ensure forward secrecy, and the pseudonym identity method is employed to provide user anonymity and resist against desynchronization attack. The formal and informal security analyses demonstrate that the proposed scheme not only overcomes the security weaknesses in previous schemes but also provides more excellent security and functional features. The comparisons with six state-of-the-art schemes indicate that the proposed scheme is practical with acceptable computational and communication efficiency.


---

## Body

## 1. Introduction

With the improvement of living standards and the rapid development of public health, the life expectancy of humans has increased rapidly over the past decades. For example, the average life expectancy of Australian is 70.8 years old in 1960, but it has risen to 81.7 years old in 2010 [1]. With increasing age, lots of elderly people may suffer from various types of chronic diseases and unable to take care of themselves, and these will lead to a heavy burden to the next generations and the healthcare system. To handle this challenge, remote monitoring has emerged as an effective solution for the healthcare system [2, 3]. On-body wireless networks (oBWNs), as an important part of remote monitoring system, have received a great deal of attention from researchers in the academic and industrial field because of its potential to improve the quality of healthcare services.A typical architecture for remote patient monitoring using oBWNs is demonstrated in Figure1, which is adapted from the schemes [4–6]. In this scenario, there are four kinds of participants: registration authority (RA), the user, gateway node (GWN), and wearable sensor nodes. The RA is a trusted third party, who is in charge of generating system parameters and the registration of all the users, GWN, and wearable sensor nodes. The user, such as health professional or the doctor, can access the life-critical data of target patient and provide real-time support and interventions. GWN, which has high computation and communication capabilities, is the critical intermediary between the user and the wearable sensor nodes. The wearable sensor nodes, such as blood pressure sensor, cardiosensor, and pulse sensor, deploy around/on the patient’s body and collect vital physiological information of target patient. Using oBWNs, it is possible to provide the continue and real-time monitoring of the patient, regardless of the patient’s location.Figure 1
The communication architecture for remote patient monitoring using oBWNs.Although oBWNs greatly improve the health outcomes and quality of life, the open wireless network environment makes the application of oBWNs face many security risks and threats. A malicious adversary can intercept, modify, insert, and delete the transmitted messages over insecure public communication channel easily [7]. In addition, it is extremely dangerous if the unauthorized users send instructions to stop the function of the wearable devices, especially the wearable devices that are critical to the life of the patient, like heart bumps. What is more, the sensitivity of the physiological data collected by wearable sensor nodes let privacy become a significant concern in oBWNs. Therefore, there is a great need to satisfy the requirements of confidentiality, integrity, and availability. Authentication is one of the efficient mechanisms to deal with trustworthy and authentic users. In the past several years, a large number of authentication schemes have been proposed to provide secure and effective healthcare monitoring of the patients using oBWNs. Since the wearable sensor nodes have weak energy and computation ability, authentication schemes based on public key encryption, such as elliptic curve cryptography (ECC) [8] and Rabin cryptosystem [9], have heavy computation burdens, and they are not suitable for realistic scenarios. Therefore, the method of using the lightweight operations, liking symmetric encryption/decryption and hash functions, is an effective way to deal with the weaknesses of public key encryption. However, after careful analysis, we find that most of these existed schemes using lightweight cryptographic primitives are so susceptible to security threats and not suitable for practical use. Specifically, all these schemes fail to provide forward secrecy and suffer from the desynchronization attack.


### 1.1. Related Work

Authentication is an essential security measure for the authorized user to access the patient’s sensitive information collected by wearable sensor nodes. Until now, lots of lightweight and effective authentication schemes had been proposed for healthcare applications. In 2012, an efficient and lightweight authentication scheme, named E-SAP, was proposed by Kumar et al. [10] for healthcare applications using wireless medical sensor networks (WMSNs). They claimed that the scheme was secure and resisted multiple types of attacks. Unfortunately, He et al. in 2013 [11] indicated that the scheme in [10] failed to provide user anonymity. Moreover, their scheme was vulnerable to the privileged-insider attack and the off-line password guessing attack. To conquer the mentioned weaknesses, they presented a robust and efficient authentication scheme for healthcare applications using WMSNs. However, a series of articles [12–14] pointed out that the scheme in He et al. [11] still had some drawbacks and flaws, such as user impersonation attack, sensor node capture attack, off-line password guessing attack, forward secrecy attack, and lack of wrong password detection mechanism. Later, Srinivas et al. in 2017 [15] pointed out that the scheme in [12] suffered from stolen smart card attack, insider attack and user impersonation attack. To handle these drawbacks, an authentication scheme using only computationally efficient operations was proposed for WMSNs. Later, Das et al. in 2017 [16] indicated that user anonymity was not provided in the scheme [14]. In addition, the scheme in [14] could not withstand sensor node capture attack and privileged-insider attack. To overcome the security weaknesses, they presented an efficient and secure authentication scheme for WMSNs and claimed that the enhanced scheme was secure against possible known attacks and offered additional functionality features. In 2017, Wu et al. [4] deemed that the scheme in [15] had weaknesses such as off-line password guessing attacks, and they were impractical if running. To overcome the historical security problems, a novel and lightweight two-factor authentication scheme for WMSNs was proposed, which provided user untraceability and met the desired security requirements. To ensure secure and authorized communication, Amin et al. in 2018 [5] presented an architecture for patient monitoring, and an anonymity and robust mutual authentication scheme was proposed. They claimed that their scheme was more robust and cost-effective than the existing schemes. But unluckily, Ali et al. in 2018 [6] showed that the scheme in [5] was vulnerable to user impersonation attack, off-line password guessing attack, and known session key temporary information attack. In addition, they proposed an enhanced three-factor authentication scheme for healthcare monitoring. In 2019, Chandrakar [17] presented a lightweight and robust two-factor authentication protocol for healthcare monitoring. Their scheme was efficient because only the hash function and bit XOR operations were used. Similar to some previous schemes, their scheme could not provide user anonymity and forward secrecy.Many authentication schemes based on asymmetric cryptographic techniques were also proposed for patient monitoring in the past few years. In 2015, He et al. [18] discussed the overall system architecture and associated security requirements of a typical ambient assisted living system, and an efficient authentication protocol based on ECC was proposed subsequently. In order to provide secure communication for WMSNs, Hayajneh et al. [19] in 2016 presented a lightweight authentication scheme based on public key technology, and the Rabin cryptosystem was implemented with different hardware settings using a Tmote sky mote to prove its efficiency. In 2017, Liu and Chung [20] proposed a user authentication scheme and data transmission mechanism for medical monitoring based on wireless sensor networks, in which the cryptosystem based on bilinear pairing was used. Unfortunately, Challa et al. [8] in 2017 showed that the scheme in [20] was suspected to some desirable attributes, such as inappropriate mutual authentication and lacking of user anonymity. Besides, their scheme was vulnerable to many known attacks like stolen smart card attack, off-line password guessing attack, privileged-insider attack, and user impersonation attack. To counter these limitations and improve efficiency, they presented a three-factor authentication and key agreement scheme with provably secure for healthcare, in which the lightweight ECC point multiplications was used. In the same year, Jiang et al. [9] put forward an efficient and end-to-end authentication scheme based on quadratic residues for wearable health monitoring. In 2018, Jangirala et al. [21] proposed a new cloud based user authentication scheme for wearable healthcare monitoring system, in which the Rabin cryptosystem was used. Although these public key schemes improved the security of authentication in the IoT environment, these schemes should be avoided because the asymmetric-based solutions were highly computational and had memory overheads.From the above analysis, we can see that though researchers proposed many lightweight authentication schemes for patient monitoring in the past, however, none of them provides both lightweight functionality and high security. The authentication schemes only using lightweight cryptographic primitives, such as the schemes in [4–6, 14, 15, 17], failed to provide forward secrecy and suffered from the desynchronization attack. This motivates us to design a lightweight authentication scheme for patient monitoring, which provides more security and functionality attributes.


### 1.2. Motivation and Contributions

In order to provide user anonymity and untraceability, the method of using pseudonym identity has been adopted in the schemes [4–6]. In this way, a randomly generated pseudonym identity, which is updated after each successful session, is stored in both the user and the GWN side, respectively. Owing to the difference of the pseudonym identity at each session, the specific user cannot be tracked. Unfortunately, Wang and Wang in 2015 [22] indicated that the use of pseudonym identity may lead to the problem of desynchronization attack, which may make the authentication scheme unusable unless the user or the wearable sensor node reregisters. On the other hand, the hash chain technology can be used to ensure forward secrecy for lightweight cryptographic schemes [23]. However, this technique can also lead to the desynchronization attack because both parties need to update their shared one-time hash chain value after the completion of each session.Motivated by these insights and our previous research work [24], we presented a lightweight and secure three-factor authentication scheme for remote patient monitoring using oBWNs. Our contributions lie in the following aspects:(1)
We briefly review the authentication schemes for healthcare monitoring, and the security drawbacks of the schemes are pointed out. Specifically, we find that all the schemes using lightweight cryptographic primitives fail to provide forward secrecy and suffer from the desynchronization attack.(2)
We present a lightweight and secure three-factor authentication scheme for remote patient monitoring using oBWNs. The proposed scheme adopts the pseudonym identity method to achieve user anonymity, and one-time hash chain technique is employed to ensure forward secrecy. In order to resist against desynchronization attack on the communication between the user and theGWN, two pseudonym identities MIDi0 and MIDi1 are stored in the back-end of GWN, respectively. Specifically, the value of the new pseudonym identity is stored in MIDi0, and MIDi1 has two functions: the first one is to store the identity of the old pseudonym, and the second one is using as a tag to update the hash chain. If MIDi1 is NULL, it means that the value of the hash chain has been updated in the previous session. Otherwise, the value of hash chain has not been changed. In order to resist against desynchronization attack on the communication between the GWN and the wearable sensor node, serial number technique is used in our scheme. Finally, a symmetric session key SK is established between the user and the wearable sensor node, which is used for future secure communications.(3)
We give the formal security analysis under the widely accepted Burrows-Abadi-Needham (BAN) logic [25], and it proves that the proposed scheme achieves mutual authentication and the session key SK is mutually established between the user and the wearable sensor node with the assistance of GWN. In addition, the informal security analysis shows that the proposed scheme can not only achieve some excellent function features, but also resist various malicious attacks, such as desynchronization attack, mobile device loss attack, replay attack, and wrong password login attack. Furthermore, we evaluate the performance of the proposed scheme with six state-of-the-art schemes, and the results demonstrate that the proposed scheme is practical with acceptable computational and communication efficiency.


### 1.3. Organization of the Paper

The reminder of this paper is organized as follows. Section2 briefly introduces the preliminary knowledge of authentication schemes for remote patient monitoring. Our proposed authentication scheme for remote patient monitoring is described in Section 3, followed by its security analysis in Section 4. The performance of the proposed scheme is evaluated with the state-of-the-art schemes in Section 5. Finally, Section 6 concludes this paper.


## 1.1. Related Work

Authentication is an essential security measure for the authorized user to access the patient’s sensitive information collected by wearable sensor nodes. Until now, lots of lightweight and effective authentication schemes had been proposed for healthcare applications. In 2012, an efficient and lightweight authentication scheme, named E-SAP, was proposed by Kumar et al. [10] for healthcare applications using wireless medical sensor networks (WMSNs). They claimed that the scheme was secure and resisted multiple types of attacks. Unfortunately, He et al. in 2013 [11] indicated that the scheme in [10] failed to provide user anonymity. Moreover, their scheme was vulnerable to the privileged-insider attack and the off-line password guessing attack. To conquer the mentioned weaknesses, they presented a robust and efficient authentication scheme for healthcare applications using WMSNs. However, a series of articles [12–14] pointed out that the scheme in He et al. [11] still had some drawbacks and flaws, such as user impersonation attack, sensor node capture attack, off-line password guessing attack, forward secrecy attack, and lack of wrong password detection mechanism. Later, Srinivas et al. in 2017 [15] pointed out that the scheme in [12] suffered from stolen smart card attack, insider attack and user impersonation attack. To handle these drawbacks, an authentication scheme using only computationally efficient operations was proposed for WMSNs. Later, Das et al. in 2017 [16] indicated that user anonymity was not provided in the scheme [14]. In addition, the scheme in [14] could not withstand sensor node capture attack and privileged-insider attack. To overcome the security weaknesses, they presented an efficient and secure authentication scheme for WMSNs and claimed that the enhanced scheme was secure against possible known attacks and offered additional functionality features. In 2017, Wu et al. [4] deemed that the scheme in [15] had weaknesses such as off-line password guessing attacks, and they were impractical if running. To overcome the historical security problems, a novel and lightweight two-factor authentication scheme for WMSNs was proposed, which provided user untraceability and met the desired security requirements. To ensure secure and authorized communication, Amin et al. in 2018 [5] presented an architecture for patient monitoring, and an anonymity and robust mutual authentication scheme was proposed. They claimed that their scheme was more robust and cost-effective than the existing schemes. But unluckily, Ali et al. in 2018 [6] showed that the scheme in [5] was vulnerable to user impersonation attack, off-line password guessing attack, and known session key temporary information attack. In addition, they proposed an enhanced three-factor authentication scheme for healthcare monitoring. In 2019, Chandrakar [17] presented a lightweight and robust two-factor authentication protocol for healthcare monitoring. Their scheme was efficient because only the hash function and bit XOR operations were used. Similar to some previous schemes, their scheme could not provide user anonymity and forward secrecy.Many authentication schemes based on asymmetric cryptographic techniques were also proposed for patient monitoring in the past few years. In 2015, He et al. [18] discussed the overall system architecture and associated security requirements of a typical ambient assisted living system, and an efficient authentication protocol based on ECC was proposed subsequently. In order to provide secure communication for WMSNs, Hayajneh et al. [19] in 2016 presented a lightweight authentication scheme based on public key technology, and the Rabin cryptosystem was implemented with different hardware settings using a Tmote sky mote to prove its efficiency. In 2017, Liu and Chung [20] proposed a user authentication scheme and data transmission mechanism for medical monitoring based on wireless sensor networks, in which the cryptosystem based on bilinear pairing was used. Unfortunately, Challa et al. [8] in 2017 showed that the scheme in [20] was suspected to some desirable attributes, such as inappropriate mutual authentication and lacking of user anonymity. Besides, their scheme was vulnerable to many known attacks like stolen smart card attack, off-line password guessing attack, privileged-insider attack, and user impersonation attack. To counter these limitations and improve efficiency, they presented a three-factor authentication and key agreement scheme with provably secure for healthcare, in which the lightweight ECC point multiplications was used. In the same year, Jiang et al. [9] put forward an efficient and end-to-end authentication scheme based on quadratic residues for wearable health monitoring. In 2018, Jangirala et al. [21] proposed a new cloud based user authentication scheme for wearable healthcare monitoring system, in which the Rabin cryptosystem was used. Although these public key schemes improved the security of authentication in the IoT environment, these schemes should be avoided because the asymmetric-based solutions were highly computational and had memory overheads.From the above analysis, we can see that though researchers proposed many lightweight authentication schemes for patient monitoring in the past, however, none of them provides both lightweight functionality and high security. The authentication schemes only using lightweight cryptographic primitives, such as the schemes in [4–6, 14, 15, 17], failed to provide forward secrecy and suffered from the desynchronization attack. This motivates us to design a lightweight authentication scheme for patient monitoring, which provides more security and functionality attributes.


## 1.2. Motivation and Contributions

In order to provide user anonymity and untraceability, the method of using pseudonym identity has been adopted in the schemes [4–6]. In this way, a randomly generated pseudonym identity, which is updated after each successful session, is stored in both the user and the GWN side, respectively. Owing to the difference of the pseudonym identity at each session, the specific user cannot be tracked. Unfortunately, Wang and Wang in 2015 [22] indicated that the use of pseudonym identity may lead to the problem of desynchronization attack, which may make the authentication scheme unusable unless the user or the wearable sensor node reregisters. On the other hand, the hash chain technology can be used to ensure forward secrecy for lightweight cryptographic schemes [23]. However, this technique can also lead to the desynchronization attack because both parties need to update their shared one-time hash chain value after the completion of each session.Motivated by these insights and our previous research work [24], we presented a lightweight and secure three-factor authentication scheme for remote patient monitoring using oBWNs. Our contributions lie in the following aspects:(1)
We briefly review the authentication schemes for healthcare monitoring, and the security drawbacks of the schemes are pointed out. Specifically, we find that all the schemes using lightweight cryptographic primitives fail to provide forward secrecy and suffer from the desynchronization attack.(2)
We present a lightweight and secure three-factor authentication scheme for remote patient monitoring using oBWNs. The proposed scheme adopts the pseudonym identity method to achieve user anonymity, and one-time hash chain technique is employed to ensure forward secrecy. In order to resist against desynchronization attack on the communication between the user and theGWN, two pseudonym identities MIDi0 and MIDi1 are stored in the back-end of GWN, respectively. Specifically, the value of the new pseudonym identity is stored in MIDi0, and MIDi1 has two functions: the first one is to store the identity of the old pseudonym, and the second one is using as a tag to update the hash chain. If MIDi1 is NULL, it means that the value of the hash chain has been updated in the previous session. Otherwise, the value of hash chain has not been changed. In order to resist against desynchronization attack on the communication between the GWN and the wearable sensor node, serial number technique is used in our scheme. Finally, a symmetric session key SK is established between the user and the wearable sensor node, which is used for future secure communications.(3)
We give the formal security analysis under the widely accepted Burrows-Abadi-Needham (BAN) logic [25], and it proves that the proposed scheme achieves mutual authentication and the session key SK is mutually established between the user and the wearable sensor node with the assistance of GWN. In addition, the informal security analysis shows that the proposed scheme can not only achieve some excellent function features, but also resist various malicious attacks, such as desynchronization attack, mobile device loss attack, replay attack, and wrong password login attack. Furthermore, we evaluate the performance of the proposed scheme with six state-of-the-art schemes, and the results demonstrate that the proposed scheme is practical with acceptable computational and communication efficiency.


## 1.3. Organization of the Paper

The reminder of this paper is organized as follows. Section2 briefly introduces the preliminary knowledge of authentication schemes for remote patient monitoring. Our proposed authentication scheme for remote patient monitoring is described in Section 3, followed by its security analysis in Section 4. The performance of the proposed scheme is evaluated with the state-of-the-art schemes in Section 5. Finally, Section 6 concludes this paper.


## 2. Preliminaries

This section introduces some basic knowledge, containing notations and abbreviations used in this paper, security requirements of user authentication scheme for remote patient monitoring using oBWNs, threat model, and basic information about biometrics fuzzy extractor.


### 2.1. Notations and Abbreviations

For convenience, all the notations and abbreviations mentioned in the proposed scheme are defined in Table1.Table 1
Notations and abbreviations.
Notation Descriptions RA Registration authority Ui User MD Mobile device ofUi GWNj Gateway node SNk Wearable sensor node IDi Unique identity ofUi PWi Password ofUi BIOi Biometric information ofUi MIDi Temporary identity ofUi GIDj Unique identity ofGWNj SIDk Unique identity ofSNk R1,R2,R3 Random number NCk0 Serial number inGWNj side NCk Serial number inSNk side K Master secret key ofGWNj SK Session key T1 Time stamp values Δ T The maximum of the transmission delay time h(⋅) One-way hash function X||Y Concatenate operation ⊕ XOR operation


### 2.2. Security Requirements

Ali et al. in 2018 [6] pointed out that the authentication scheme for remote patient monitoring should satisfy many security requirements, including strong user authentication, mutual authentication, confidentiality, session key establishment, low communication and computation cost, data freshness, and secure against different kinds of popular attacks, such as impersonation attack, replay attack, and password guessing attack. Due to the sensitivity of physiological data, we believe that an authentication scheme for remote patient monitoring should also meet the following security properties.Forward Secrecy. The authentication scheme provides forward secrecy, which means that if an adversary acquires the long-term keys of the user, GWN, and the wearable sensor node, he/she cannot access the session keys generated in previous sessions. Conversely, if authentication scheme fails to provide forward secrecy, it may cause the disclosure of the session keys used in previous communications and the disclosure of the patient’s sensitive information. To ensure the secure transmission of sensitive information, authentication scheme for remote patient monitoring should achieve forward secrecy.Resistance to Desynchronization Attack. To the best of our knowledge, desynchronization attack has attracted little attention in the previous authentication schemes, and the damaging threat is ignored. However, the practicality and seriousness of desynchronization attack have been intensively discussed in the cryptography community [26]. Therefore, the proposed scheme should need an effective synchronization method to maintain the consistency of several one-time values among the user, GWN, and the wearable sensor node.Quick Detection of Wrong Password. In network applications, user usually needs to manage lots of identity and password pairs. Therefore, a wrong password detection mechanism is required for user authentication. With the help of this mechanism, the MD can reject session initiated by wrong password quickly, and this process will save a lot of computational and communication cost.


### 2.3. Threat Model

When considering cryptanalysis of the user authentication schemes, Dolev-Yao threat model [27] is widely used. Under this model, the communications between any two communicating parties are over an insecure channel, and the endpoint entities should not be considered as trusted entities. Based on this threat model, an adversary A is supposed to have the following abilities:(i)
A can fully control the open communication channel, i.e., A can intercept, modify, insert, and delete the transmitted messages over insecure public communication channels easily.(ii)
When theMD of user was stolen or obtained by an attacker A, then the secret values stored in the MD can be revealed by A using side-channel attacks [28].(iii)
A is a probabilistic polynomial time attacker. In other words, A can guess the low-entropy password and identity information within polynomial time.(iv)
A can get the long-term secret keys when forward secrecy is evaluated.(v)
During the registration phase of authentication scheme, the privileged-insider inGWN being an adversary knows the parameters submitted by the user.(vi)
A may be a legitimate but malicious user.(vii)
A may be a legitimate but malicious wearable sensor node.


### 2.4. Basic Knowledge of Fuzzy Extractor

Fuzzy extractor [29] is capable of extracting the uniformly distributed random key Ri from biometric input BIOi in an error-tolerant way. If another biometric input BIOi∗ remains reasonably similar to BIOi, the extracted random key Ri remains unchanged with the help of an auxiliary string Pi. An fuzzy extractor contains two procedures (Gen,Rep).G e n ( B I O i ) = ( R i , P i ). Gen is a probabilistic generation procedure allowing to extract random key Ri and an auxiliary string Pi from biometric input BIOi.R i ∗ = R e p ( B I O i ∗ , P i ). Rep is a deterministic reproduction procedure allowing to reproduce random key Ri from any biometric input BIOi∗ close to BIOi with the help of auxiliary string Pi.


## 2.1. Notations and Abbreviations

For convenience, all the notations and abbreviations mentioned in the proposed scheme are defined in Table1.Table 1
Notations and abbreviations.
Notation Descriptions RA Registration authority Ui User MD Mobile device ofUi GWNj Gateway node SNk Wearable sensor node IDi Unique identity ofUi PWi Password ofUi BIOi Biometric information ofUi MIDi Temporary identity ofUi GIDj Unique identity ofGWNj SIDk Unique identity ofSNk R1,R2,R3 Random number NCk0 Serial number inGWNj side NCk Serial number inSNk side K Master secret key ofGWNj SK Session key T1 Time stamp values Δ T The maximum of the transmission delay time h(⋅) One-way hash function X||Y Concatenate operation ⊕ XOR operation


## 2.2. Security Requirements

Ali et al. in 2018 [6] pointed out that the authentication scheme for remote patient monitoring should satisfy many security requirements, including strong user authentication, mutual authentication, confidentiality, session key establishment, low communication and computation cost, data freshness, and secure against different kinds of popular attacks, such as impersonation attack, replay attack, and password guessing attack. Due to the sensitivity of physiological data, we believe that an authentication scheme for remote patient monitoring should also meet the following security properties.Forward Secrecy. The authentication scheme provides forward secrecy, which means that if an adversary acquires the long-term keys of the user, GWN, and the wearable sensor node, he/she cannot access the session keys generated in previous sessions. Conversely, if authentication scheme fails to provide forward secrecy, it may cause the disclosure of the session keys used in previous communications and the disclosure of the patient’s sensitive information. To ensure the secure transmission of sensitive information, authentication scheme for remote patient monitoring should achieve forward secrecy.Resistance to Desynchronization Attack. To the best of our knowledge, desynchronization attack has attracted little attention in the previous authentication schemes, and the damaging threat is ignored. However, the practicality and seriousness of desynchronization attack have been intensively discussed in the cryptography community [26]. Therefore, the proposed scheme should need an effective synchronization method to maintain the consistency of several one-time values among the user, GWN, and the wearable sensor node.Quick Detection of Wrong Password. In network applications, user usually needs to manage lots of identity and password pairs. Therefore, a wrong password detection mechanism is required for user authentication. With the help of this mechanism, the MD can reject session initiated by wrong password quickly, and this process will save a lot of computational and communication cost.


## 2.3. Threat Model

When considering cryptanalysis of the user authentication schemes, Dolev-Yao threat model [27] is widely used. Under this model, the communications between any two communicating parties are over an insecure channel, and the endpoint entities should not be considered as trusted entities. Based on this threat model, an adversary A is supposed to have the following abilities:(i)
A can fully control the open communication channel, i.e., A can intercept, modify, insert, and delete the transmitted messages over insecure public communication channels easily.(ii)
When theMD of user was stolen or obtained by an attacker A, then the secret values stored in the MD can be revealed by A using side-channel attacks [28].(iii)
A is a probabilistic polynomial time attacker. In other words, A can guess the low-entropy password and identity information within polynomial time.(iv)
A can get the long-term secret keys when forward secrecy is evaluated.(v)
During the registration phase of authentication scheme, the privileged-insider inGWN being an adversary knows the parameters submitted by the user.(vi)
A may be a legitimate but malicious user.(vii)
A may be a legitimate but malicious wearable sensor node.


## 2.4. Basic Knowledge of Fuzzy Extractor

Fuzzy extractor [29] is capable of extracting the uniformly distributed random key Ri from biometric input BIOi in an error-tolerant way. If another biometric input BIOi∗ remains reasonably similar to BIOi, the extracted random key Ri remains unchanged with the help of an auxiliary string Pi. An fuzzy extractor contains two procedures (Gen,Rep).G e n ( B I O i ) = ( R i , P i ). Gen is a probabilistic generation procedure allowing to extract random key Ri and an auxiliary string Pi from biometric input BIOi.R i ∗ = R e p ( B I O i ∗ , P i ). Rep is a deterministic reproduction procedure allowing to reproduce random key Ri from any biometric input BIOi∗ close to BIOi with the help of auxiliary string Pi.


## 3. The Proposed Scheme

In this section, a lightweight and secure three-factor authentication scheme for remote patient monitoring using oBWNs is presented, which not only withstands all know passive and active attacks, but also achieves more security attributes. The proposed scheme includes five phases, i.e., initialization phase, registration phase, login phase, authentication and key agreement phase, password change phase.


### 3.1. Initialization Phase

The initialization phase is done by theRA in off-line securely. First of all, RA selects two random numbers GIDj and K as the unique identity and master secret key of the GWN. After that, RA selects a collision-resistant cryptographic hash function h(·):{0,1}∗→{0,1}l, where l denotes the bit length of function output (e.g., l=160). For each wearable sensor node SNk, RA selects an unique identity SIDk and stores it into the memory of SNk.


### 3.2. Registration Phase

The registration phase of the proposed scheme contains two parts, i.e., user registration phase and wearable sensor node registration phase.


#### 3.2.1. User Registration Phase

When a new user such as a health professional wants to access the data collected by the wearable sensor node in oBWNs, the user must register inRA firstly. As shown in Figure 2, the procedure of user registration is described as follows:(1)
A new userUi first chooses an unique identity IDi, a password PWi, and imprints his/her biometrics BIOi to the sensor of mobile device MD. After that, the MD generates the secret biometric key Ri and public parameter Pi using the fuzzy extractor probabilistic generation function Gen(BIOi)=(Ri,Pi). Then, Ui generates a 128-bit random secret value ai and computes Ai=h(PWi∥Ri∥ai). Finally, Ui submits {IDi,Ai} to RA via a secure channel.(2)
Upon receipt the registration information,RA first checks whether the identity IDi exists in the user information table. If it does, RA rejects the registration request. Otherwise, RA generates three random integers bi, r1, and r2 and sets KGU=r1, MIDi=MIDi0=r2, and MIDi1=NULL. After that, RA computes Bi=Ai⊕h(IDi∥K∥bi) and Ci=h(h(IDi∥K∥bi)∥Ai) and stores {IDi,MIDi0,MIDi1,bi,KGU} into the user information table. Finally, RA copies the user information table to GWN and transmits the registration reply with information {MIDi,Bi,Ci,KGU} to Ui securely.(3)
When receiving the information fromRA, Ui computes Di=h(IDi∥PWi∥Ri)⊕ai. After that, Ui stores Di and Pi in the memory of MD and finishes the registration. At last, the MD contains the parameters {MIDi,Bi,Ci,Di,KGU,Pi}.Figure 2
The user registration phase of the proposed scheme.


#### 3.2.2. Wearable Sensor Node Registration Phase

When a new wearable sensor nodeSNk is deployed, it should register in RA.(1)
A new wearable sensor nodeSNk sends the identity SIDk to RA via a secure channel.(2)
After receiving the identitySIDk and RA first checks whether SIDk exists in the wearable sensor node information table. If it exists, RA refuses the wearable sensor node registration request. Otherwise, RA generates a random integer KGS and sets the initial sequence numbers NCk=NCk0=0. Then, RA stores {SIDk,KGS,NCk0} into the sensor node information table and copies it to GWN. After that, RA sends the parameters {KGS,NCk} to SNk via a secure channel.(3)
After receiving the message fromRA, SNk stores {KGS,NCk} into its memory secretly.


### 3.3. Login Phase

When a userUi wants to access a wearable sensor node, he/she needs to login in GWN first.(1)
Ui first provides his/her identity IDi and password PWi into the interface of the MD. Ui also provides his/her biometrics BIOi∗ to the sensor of MD. After that, MD extracts the biometric key Ri∗ with Ri∗=Rep(BIOi∗,Pi). Then, the MD computes ai∗=Di⊕h(IDi∥PWi∥Ri∗), Ai∗=h(PWi∥Ri∥ai∗), h(IDi∥K∥bi)=Bi⊕Ai∗, and Ci∗=h(h(IDi∥K∥bi)∥Ai∗) and compares Ci∗ with the stored value Ci. If they are not equal, the MD terminates the session. Otherwise, the MD proceeds to the next step.(2)
After verifying the legitimacy of the userUi, the MD generates a random number R1 and gets the current time stamp T1. After that, the user Ui selects the wearable sensor node SNk that he/she wants to access, and the MD computes MS1=(R1∥SIDk)⊕h(MIDi∥h(IDi∥K∥bi)∥KGU) and V1=h(IDi∥R1∥h(IDi∥K∥bi)∥MIDi∥KGU∥T1). Then Ui sends the login request {MIDi,MS1,V1,T1} to GWN through a public channel.


### 3.4. Authentication and Key Agreement Phase

On receiving the login request fromUi, following steps are performed by Ui, GWN, and a wearable sensor node SNk to establish a session key SK between Ui and SNk for future secure communication:(1)
Upon receipt of the login request,GWN first checks the validity of the time stamp. GWN gets the current time T1∗ and compares with the received time T1. If the matching score |T1∗-T1| is beyond a predefined threshold value ΔT, GWN terminates the session. Then, GWN searches whether the pseudo identity MIDi exist in the user information table and operates as follows:
(a)
IfMIDi=MIDi0, it demonstrates that the pseudonym identities of Ui and GWN are updated in the previous session. After that, GWN extracts IDi, bi, KGU, and MIDi1 from the user information table corresponding to pseudonym identity MIDi. Then, GWN checks whether the one-time hash chain value KGU is updated.
(i)
IfMIDi1=NULL, it means that the hash chain value KGU in GWN side is updated in the previous session. Then, GWN computes (R1∗∥SIDk)=MS1⊕h(MIDi0∥h(IDi∥K∥bi)∥KGU) and V1∗=h(IDi∥R1∗∥h(IDi∥K∥bi)∥MIDi0∥KGU∥T1) and checks whether V1∗ matches with the received V1. If it does not hold, GWN terminates the session. Otherwise, GWN generates a random pseudonym identity MIDi0∗ and sets MIDi1=MIDi0; MIDi0=MIDi0∗.(ii)
IfMIDi1≠NULL, it means that the hash chain value KGU in GWN side is not updated in the previous session. Therefore, the hash chain value should be updated. Then, GWN computes KGU∗=h(KGU) and (R1∗∥SIDk)=MS1⊕h(MIDi0∥h(IDi∥K∥bi)∥KGU∗) and V1∗=h(IDi∥R1∗∥h(IDi∥K∥bi)∥MIDi0∥KGU∗∥T1) and checks whether V1∗ matches with the received value V1. If it does not hold, GWN terminates the session. Otherwise, GWN generates a new random pseudonym identity MIDi0∗ and sets MIDi1=MIDi0, MIDi0=MIDi0∗, and KGU=KGU∗.(b)
IfMIDi=MIDi1, it demonstrates that the pseudonym identity of the user and the hash chain value are not updated in the previous session. Then, GWN extracts the corresponding secret values IDi, bi, and KGU and computes (R1∗∥SIDk)=MS1⊕h(MIDi1∥h(IDi∥K∥bi)∥KGU) and V1∗=h(IDi∥R1∗∥h(IDi∥K∥bi)∥MIDi1∥KGU∥T1). Thereafter, GWN compares V1∗?=V1. If it holds, GWN generates a random pseudonym identity MIDi0∗ and sets MIDi0=MIDi0∗. Otherwise, GWN terminates the session.(c)
IfMIDi≠MIDi0 and MIDi≠MIDi1, GWN terminates the session directly.(2)
After that, the gateway nodeGWN generates a random number R2 of 128-bit and computes MS2=(R1∥R2∥IDi∥GIDj)⊕h(KGS∥SIDk∥NCk0) and V2=h(IDi∥GIDj∥R1∥R2∥KGS∥NCk0). Then, GWN updates KGS and NCk0 with KGS=h(KGS∥SIDk) and NCk0=NCk0+1, respectively. Finally, GWN transmits the message {MS2,V2,NCk0} to the wearable sensor node SNk via open channel.(3)
After receiving the message fromGWN, SNk first checks whether 1≤NCk0-NCk≤N. In the latter inequality, the parameter N is a threshold which sets according to specific application environment. If the inequality does not hold, SNk terminates the session. Otherwise, SNk sets KGS∗=KGS and computes N-1 times KGS∗=h(KGS∗∥SIDk). It is noted that if N satisfies N-1=0, the above hash operation will not be executed. Then, SNk computes (R1∥R2∥IDi∥GIDj)=MS2⊕h(KGS∗∥SIDk∥(NCk0-1)) and V2∗=h(IDi∥GIDj∥R1∥R2∥KGS∗∥(NCk0-1))) and compares V2∗ with the received value V2. If it is satisfied, SNk updates KGS and NCk0 with KGS=h(KGS∗∥SIDk) and NCk=NCk0, respectively. After that, SNk generates a random number R3 and computes SK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3), MS3=R3⊕h(KGS∥SIDk∥NCk), and V3=h(SIDk∥IDi∥SK∥R3∥NCk). At last, the wearable sensor node SNk sends the message {MS3,V3} to GWN through a public channel.(4)
After getting the message fromSNk, the gateway node GWN computes R3∗=MS3⊕h(KGS∥SIDk∥NCk0), SK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3∗), and V3∗=h(SIDk∥IDi∥SK∥R3∗∥NCk0). Then, GWN checks whether V3∗ matches with V3. If it is failed, GWN terminates the session. Otherwise, GWN computes MS4=(R2∥R3∥GIDj∥MIDi0)⊕h(R1∥h(IDi∥K∥bi)∥KGU∥MIDi1) and V4=h(IDi∥SIDk∥SK∥R2∥MIDi0). Finally, GWN sends the message {MS4,V4} to Ui through a public channel.(5)
After receiving the message,Ui computes (R2∥R3∥GIDj∥MIDi0)=MS4⊕h(R1∥h(IDi∥K∥bi)∥KGU∥MIDi), SK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3), and V4∗=h(IDi∥SIDk∥SK∥R2∥MIDi0). After that, Ui checks whether V4∗ matches with the received value V4. If it does not hold, Ui terminates the session. Otherwise, Ui computes V5=h(IDi∥GIDj∥SIDk∥MIDi0∥SK) and updates KGU and MIDi with KGU=h(KGU) and MIDi=MIDi0, respectively. Then, Ui sends the message {V5} to GWN through a public channel.(6)
After receiving{V5}, GWN computes V5∗=h(IDi∥GIDj∥SIDk∥MIDi0∥SK) and checks whether V5∗ matches with the received value V5. If it does not hold, GWN terminates the session. Otherwise, GWN updates KGU and MIDi1 with KGU=h(KGU) and MIDi1=NULL, respectively. Then, a symmetric session key SK is established between the user and the wearable sensor node for future secure communications.The procedure of login, authentication, and key agreement phases are summarized in Figure3.Figure 3
Login, authentication, and key agreement phase of the proposed scheme.


### 3.5. Password Change Phase

In this phase,Ui can change his/her password without contacting the RA. For this purpose, he/she must perform the following steps:(1)
Ui first provides his/her identity IDi and password PWi into the interface of the MD. After that, Ui also provides his/her biometrics BIOi∗ to the sensor of MD. Then, the MD computes Ri∗ with Ri∗=Rep(BIOi∗,Pi), ai∗=Di⊕h(IDi∥PWi∥Ri∗), Ai∗=h(PWi∥Ri∥ai∗), h(IDi∥K∥bi)=Bi⊕Ai∗, and Ci∗=h(h(IDi∥K∥bi)∥Ai∗). MD compares Ci∗ with the stored value Ci. If they are not equal, the MD rejects the password change request. Otherwise, the MD believes the legitimacy of the user and allows Ui to input a new password PWinew.(2)
TheMD computes Ainew=h(PWinew∥Ri∥ai), Binew=h(IDi∥K∥bi)⊕Ainew=Bi⊕Ai⊕Ainew, and Cinew=h(h(IDi∥K∥bi)∥Ainew).(3)
At last,Binew and Cinew are stored in the MD to replace Bi and Ci, respectively.


## 3.1. Initialization Phase

The initialization phase is done by theRA in off-line securely. First of all, RA selects two random numbers GIDj and K as the unique identity and master secret key of the GWN. After that, RA selects a collision-resistant cryptographic hash function h(·):{0,1}∗→{0,1}l, where l denotes the bit length of function output (e.g., l=160). For each wearable sensor node SNk, RA selects an unique identity SIDk and stores it into the memory of SNk.


## 3.2. Registration Phase

The registration phase of the proposed scheme contains two parts, i.e., user registration phase and wearable sensor node registration phase.


### 3.2.1. User Registration Phase

When a new user such as a health professional wants to access the data collected by the wearable sensor node in oBWNs, the user must register inRA firstly. As shown in Figure 2, the procedure of user registration is described as follows:(1)
A new userUi first chooses an unique identity IDi, a password PWi, and imprints his/her biometrics BIOi to the sensor of mobile device MD. After that, the MD generates the secret biometric key Ri and public parameter Pi using the fuzzy extractor probabilistic generation function Gen(BIOi)=(Ri,Pi). Then, Ui generates a 128-bit random secret value ai and computes Ai=h(PWi∥Ri∥ai). Finally, Ui submits {IDi,Ai} to RA via a secure channel.(2)
Upon receipt the registration information,RA first checks whether the identity IDi exists in the user information table. If it does, RA rejects the registration request. Otherwise, RA generates three random integers bi, r1, and r2 and sets KGU=r1, MIDi=MIDi0=r2, and MIDi1=NULL. After that, RA computes Bi=Ai⊕h(IDi∥K∥bi) and Ci=h(h(IDi∥K∥bi)∥Ai) and stores {IDi,MIDi0,MIDi1,bi,KGU} into the user information table. Finally, RA copies the user information table to GWN and transmits the registration reply with information {MIDi,Bi,Ci,KGU} to Ui securely.(3)
When receiving the information fromRA, Ui computes Di=h(IDi∥PWi∥Ri)⊕ai. After that, Ui stores Di and Pi in the memory of MD and finishes the registration. At last, the MD contains the parameters {MIDi,Bi,Ci,Di,KGU,Pi}.Figure 2
The user registration phase of the proposed scheme.


### 3.2.2. Wearable Sensor Node Registration Phase

When a new wearable sensor nodeSNk is deployed, it should register in RA.(1)
A new wearable sensor nodeSNk sends the identity SIDk to RA via a secure channel.(2)
After receiving the identitySIDk and RA first checks whether SIDk exists in the wearable sensor node information table. If it exists, RA refuses the wearable sensor node registration request. Otherwise, RA generates a random integer KGS and sets the initial sequence numbers NCk=NCk0=0. Then, RA stores {SIDk,KGS,NCk0} into the sensor node information table and copies it to GWN. After that, RA sends the parameters {KGS,NCk} to SNk via a secure channel.(3)
After receiving the message fromRA, SNk stores {KGS,NCk} into its memory secretly.


## 3.2.1. User Registration Phase

When a new user such as a health professional wants to access the data collected by the wearable sensor node in oBWNs, the user must register inRA firstly. As shown in Figure 2, the procedure of user registration is described as follows:(1)
A new userUi first chooses an unique identity IDi, a password PWi, and imprints his/her biometrics BIOi to the sensor of mobile device MD. After that, the MD generates the secret biometric key Ri and public parameter Pi using the fuzzy extractor probabilistic generation function Gen(BIOi)=(Ri,Pi). Then, Ui generates a 128-bit random secret value ai and computes Ai=h(PWi∥Ri∥ai). Finally, Ui submits {IDi,Ai} to RA via a secure channel.(2)
Upon receipt the registration information,RA first checks whether the identity IDi exists in the user information table. If it does, RA rejects the registration request. Otherwise, RA generates three random integers bi, r1, and r2 and sets KGU=r1, MIDi=MIDi0=r2, and MIDi1=NULL. After that, RA computes Bi=Ai⊕h(IDi∥K∥bi) and Ci=h(h(IDi∥K∥bi)∥Ai) and stores {IDi,MIDi0,MIDi1,bi,KGU} into the user information table. Finally, RA copies the user information table to GWN and transmits the registration reply with information {MIDi,Bi,Ci,KGU} to Ui securely.(3)
When receiving the information fromRA, Ui computes Di=h(IDi∥PWi∥Ri)⊕ai. After that, Ui stores Di and Pi in the memory of MD and finishes the registration. At last, the MD contains the parameters {MIDi,Bi,Ci,Di,KGU,Pi}.Figure 2
The user registration phase of the proposed scheme.


## 3.2.2. Wearable Sensor Node Registration Phase

When a new wearable sensor nodeSNk is deployed, it should register in RA.(1)
A new wearable sensor nodeSNk sends the identity SIDk to RA via a secure channel.(2)
After receiving the identitySIDk and RA first checks whether SIDk exists in the wearable sensor node information table. If it exists, RA refuses the wearable sensor node registration request. Otherwise, RA generates a random integer KGS and sets the initial sequence numbers NCk=NCk0=0. Then, RA stores {SIDk,KGS,NCk0} into the sensor node information table and copies it to GWN. After that, RA sends the parameters {KGS,NCk} to SNk via a secure channel.(3)
After receiving the message fromRA, SNk stores {KGS,NCk} into its memory secretly.


## 3.3. Login Phase

When a userUi wants to access a wearable sensor node, he/she needs to login in GWN first.(1)
Ui first provides his/her identity IDi and password PWi into the interface of the MD. Ui also provides his/her biometrics BIOi∗ to the sensor of MD. After that, MD extracts the biometric key Ri∗ with Ri∗=Rep(BIOi∗,Pi). Then, the MD computes ai∗=Di⊕h(IDi∥PWi∥Ri∗), Ai∗=h(PWi∥Ri∥ai∗), h(IDi∥K∥bi)=Bi⊕Ai∗, and Ci∗=h(h(IDi∥K∥bi)∥Ai∗) and compares Ci∗ with the stored value Ci. If they are not equal, the MD terminates the session. Otherwise, the MD proceeds to the next step.(2)
After verifying the legitimacy of the userUi, the MD generates a random number R1 and gets the current time stamp T1. After that, the user Ui selects the wearable sensor node SNk that he/she wants to access, and the MD computes MS1=(R1∥SIDk)⊕h(MIDi∥h(IDi∥K∥bi)∥KGU) and V1=h(IDi∥R1∥h(IDi∥K∥bi)∥MIDi∥KGU∥T1). Then Ui sends the login request {MIDi,MS1,V1,T1} to GWN through a public channel.


## 3.4. Authentication and Key Agreement Phase

On receiving the login request fromUi, following steps are performed by Ui, GWN, and a wearable sensor node SNk to establish a session key SK between Ui and SNk for future secure communication:(1)
Upon receipt of the login request,GWN first checks the validity of the time stamp. GWN gets the current time T1∗ and compares with the received time T1. If the matching score |T1∗-T1| is beyond a predefined threshold value ΔT, GWN terminates the session. Then, GWN searches whether the pseudo identity MIDi exist in the user information table and operates as follows:
(a)
IfMIDi=MIDi0, it demonstrates that the pseudonym identities of Ui and GWN are updated in the previous session. After that, GWN extracts IDi, bi, KGU, and MIDi1 from the user information table corresponding to pseudonym identity MIDi. Then, GWN checks whether the one-time hash chain value KGU is updated.
(i)
IfMIDi1=NULL, it means that the hash chain value KGU in GWN side is updated in the previous session. Then, GWN computes (R1∗∥SIDk)=MS1⊕h(MIDi0∥h(IDi∥K∥bi)∥KGU) and V1∗=h(IDi∥R1∗∥h(IDi∥K∥bi)∥MIDi0∥KGU∥T1) and checks whether V1∗ matches with the received V1. If it does not hold, GWN terminates the session. Otherwise, GWN generates a random pseudonym identity MIDi0∗ and sets MIDi1=MIDi0; MIDi0=MIDi0∗.(ii)
IfMIDi1≠NULL, it means that the hash chain value KGU in GWN side is not updated in the previous session. Therefore, the hash chain value should be updated. Then, GWN computes KGU∗=h(KGU) and (R1∗∥SIDk)=MS1⊕h(MIDi0∥h(IDi∥K∥bi)∥KGU∗) and V1∗=h(IDi∥R1∗∥h(IDi∥K∥bi)∥MIDi0∥KGU∗∥T1) and checks whether V1∗ matches with the received value V1. If it does not hold, GWN terminates the session. Otherwise, GWN generates a new random pseudonym identity MIDi0∗ and sets MIDi1=MIDi0, MIDi0=MIDi0∗, and KGU=KGU∗.(b)
IfMIDi=MIDi1, it demonstrates that the pseudonym identity of the user and the hash chain value are not updated in the previous session. Then, GWN extracts the corresponding secret values IDi, bi, and KGU and computes (R1∗∥SIDk)=MS1⊕h(MIDi1∥h(IDi∥K∥bi)∥KGU) and V1∗=h(IDi∥R1∗∥h(IDi∥K∥bi)∥MIDi1∥KGU∥T1). Thereafter, GWN compares V1∗?=V1. If it holds, GWN generates a random pseudonym identity MIDi0∗ and sets MIDi0=MIDi0∗. Otherwise, GWN terminates the session.(c)
IfMIDi≠MIDi0 and MIDi≠MIDi1, GWN terminates the session directly.(2)
After that, the gateway nodeGWN generates a random number R2 of 128-bit and computes MS2=(R1∥R2∥IDi∥GIDj)⊕h(KGS∥SIDk∥NCk0) and V2=h(IDi∥GIDj∥R1∥R2∥KGS∥NCk0). Then, GWN updates KGS and NCk0 with KGS=h(KGS∥SIDk) and NCk0=NCk0+1, respectively. Finally, GWN transmits the message {MS2,V2,NCk0} to the wearable sensor node SNk via open channel.(3)
After receiving the message fromGWN, SNk first checks whether 1≤NCk0-NCk≤N. In the latter inequality, the parameter N is a threshold which sets according to specific application environment. If the inequality does not hold, SNk terminates the session. Otherwise, SNk sets KGS∗=KGS and computes N-1 times KGS∗=h(KGS∗∥SIDk). It is noted that if N satisfies N-1=0, the above hash operation will not be executed. Then, SNk computes (R1∥R2∥IDi∥GIDj)=MS2⊕h(KGS∗∥SIDk∥(NCk0-1)) and V2∗=h(IDi∥GIDj∥R1∥R2∥KGS∗∥(NCk0-1))) and compares V2∗ with the received value V2. If it is satisfied, SNk updates KGS and NCk0 with KGS=h(KGS∗∥SIDk) and NCk=NCk0, respectively. After that, SNk generates a random number R3 and computes SK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3), MS3=R3⊕h(KGS∥SIDk∥NCk), and V3=h(SIDk∥IDi∥SK∥R3∥NCk). At last, the wearable sensor node SNk sends the message {MS3,V3} to GWN through a public channel.(4)
After getting the message fromSNk, the gateway node GWN computes R3∗=MS3⊕h(KGS∥SIDk∥NCk0), SK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3∗), and V3∗=h(SIDk∥IDi∥SK∥R3∗∥NCk0). Then, GWN checks whether V3∗ matches with V3. If it is failed, GWN terminates the session. Otherwise, GWN computes MS4=(R2∥R3∥GIDj∥MIDi0)⊕h(R1∥h(IDi∥K∥bi)∥KGU∥MIDi1) and V4=h(IDi∥SIDk∥SK∥R2∥MIDi0). Finally, GWN sends the message {MS4,V4} to Ui through a public channel.(5)
After receiving the message,Ui computes (R2∥R3∥GIDj∥MIDi0)=MS4⊕h(R1∥h(IDi∥K∥bi)∥KGU∥MIDi), SK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3), and V4∗=h(IDi∥SIDk∥SK∥R2∥MIDi0). After that, Ui checks whether V4∗ matches with the received value V4. If it does not hold, Ui terminates the session. Otherwise, Ui computes V5=h(IDi∥GIDj∥SIDk∥MIDi0∥SK) and updates KGU and MIDi with KGU=h(KGU) and MIDi=MIDi0, respectively. Then, Ui sends the message {V5} to GWN through a public channel.(6)
After receiving{V5}, GWN computes V5∗=h(IDi∥GIDj∥SIDk∥MIDi0∥SK) and checks whether V5∗ matches with the received value V5. If it does not hold, GWN terminates the session. Otherwise, GWN updates KGU and MIDi1 with KGU=h(KGU) and MIDi1=NULL, respectively. Then, a symmetric session key SK is established between the user and the wearable sensor node for future secure communications.The procedure of login, authentication, and key agreement phases are summarized in Figure3.Figure 3
Login, authentication, and key agreement phase of the proposed scheme.


## 3.5. Password Change Phase

In this phase,Ui can change his/her password without contacting the RA. For this purpose, he/she must perform the following steps:(1)
Ui first provides his/her identity IDi and password PWi into the interface of the MD. After that, Ui also provides his/her biometrics BIOi∗ to the sensor of MD. Then, the MD computes Ri∗ with Ri∗=Rep(BIOi∗,Pi), ai∗=Di⊕h(IDi∥PWi∥Ri∗), Ai∗=h(PWi∥Ri∥ai∗), h(IDi∥K∥bi)=Bi⊕Ai∗, and Ci∗=h(h(IDi∥K∥bi)∥Ai∗). MD compares Ci∗ with the stored value Ci. If they are not equal, the MD rejects the password change request. Otherwise, the MD believes the legitimacy of the user and allows Ui to input a new password PWinew.(2)
TheMD computes Ainew=h(PWinew∥Ri∥ai), Binew=h(IDi∥K∥bi)⊕Ainew=Bi⊕Ai⊕Ainew, and Cinew=h(h(IDi∥K∥bi)∥Ainew).(3)
At last,Binew and Cinew are stored in the MD to replace Bi and Ci, respectively.


## 4. Security Analysis

In this section, the security of the proposed scheme has been analyzed. First of all, we conduct a formal security analysis using BAN logic [25] to demonstrate that the proposed scheme achieves mutual authentication successfully. After that, we indicate that the proposed scheme can resist all known attacks and provide the desired security features.


### 4.1. Formal Security Analysis Using BAN Logic

BAN logic is a set of rules for defining and analyzing authentication protocols, which is widely used in many works, such as the schemes in [5, 6, 30, 31]. For convenience, all the notations used in the BAN logic are given in Table 2:Table 2
Notations in BAN logic.
Notation Implications P⊲X PrincipalP sees a statement X P|≡X PrincipalP believes a statement X P|⇒X PrincipalP has jurisdiction over statement X P|~X PrincipalP once said a statement X #(X) StatementX is fresh (X,Y) StatementX or Y is one part of statement (X,Y) XK StatementX is encrypted with the key K <X>Y StatementX is combined with statement Y (X)K StatementX is hashed with the key K P↔KQ PrincipalP and principal Q communicate with the shared key KBasic rules of BAN logic are given in Table3.Table 3
Basic rules of BAN logic.
Rule Description Message-meaning rule P | ≡ P ↔ K Q , P ⊲ X K P | ≡ Q | ~ X Nonce-verification rule P | ≡ # ( X ) , P | ≡ Q | ~ X P | ≡ Q | ≡ X Jurisdiction rule P | ≡ Q | ⇒ X , P | ≡ Q | ≡ X P | ≡ X Freshness rule P | ≡ # ( X ) P | ≡ # ( X , Y )The proposed scheme should accomplish the following four goals:Goal1:Ui|≡(Ui↔SKSNk)Goal2:Ui|≡SNk|≡(Ui↔SKSNk)Goal3:SNk|≡(Ui↔SKSNk)Goal4:SNk|≡Ui|≡(Ui↔SKSNk)First, the messages exchanged in the proposed scheme can be transformed into idealized forms as follows:Msg1:Ui→GWNj:<IDi,R1,MIDi,SIDk,T1,Ui↔h(IDi∥K∥bi)GWNj>Ui↔KGUGWNjMsg2:GWNj→SNk:<IDi,GIDj,SIDk,R1,R2,NCk0>GWNj↔KGSSNkMsg3:SNk→GWNj:<IDi,SIDk,R3>SNk↔KGSGWNjMsg4:GWNj→Ui:<IDi,GIDj,SIDk,MIDi,R1,R2,R3, GWNj↔h(IDi∥K∥bi)Ui>GWNj↔KGUUiMsg5:Ui→GWNj:<IDi,GIDj,SIDk,MIDi,R1,R2,R3,Ui↔h(IDi∥K∥bi)GWNj>Ui↔KGUGWNjSecond, some initial assumptions about the proposed scheme are listed below:A1:GWNj|≡#(T1)A2:GWNj|≡#(R1,R2,R3)A3:SNk|≡#(R1,R2,R3)A4:Ui|≡#(R1,R2,R3)A5:Ui|≡Ui↔KGUGWNjA6:GWNj|≡Ui↔KGUGWNjA7:SNk|≡SNk↔KGSGWNjA8:GWNj|≡SNk↔KGSGWNjA9:Ui|≡SNk|⇒Ui↔SKSNkA10:SNk|≡Ui|⇒Ui↔SKSNkThird, based on the BAN logic rules and assumptions, the main proofs are performed as follows.According to the Msg1, we getS1:GWNj⊲<IDi,R1,MIDi,SIDk,T1,Ui↔h(IDi∥K∥bi)GWNj>Ui↔KGUGWNjBased on Assumption A6, S1, and message-meaning rule, we haveS2:GWNj|≡Ui|~(IDi,R1,MIDi,SIDk,T1,Ui↔h(IDi∥K∥bi)GWNj)From A1, A2, and freshness rule, we getS3:GWNj|≡#(IDi,R1,MIDi,SIDk,T1, Ui↔h(IDi∥K∥bi)GWNj)From S3, S2, and nonce-verification rule, we getS4:GWNj|≡Ui|≡(IDi,R1,MIDi,SIDk,T1,Ui↔h(IDi∥K∥bi)GWNj)According to the Msg2, we getS5:SNk⊲<IDi,GIDj,SIDk,R1,R2, NCk0>GWNj↔KGSSNkFrom A7, S5, and message-meaning rule, we haveS6:SNk|≡GWNj|~(IDi,GIDj,SIDk,R1,R2,NCk0)From A3 and freshness rule, we getS7:SNk|≡#(IDi,GIDj,SIDk,R1,R2,NCk0)From S7, S6, and nonce-verification rule, we getS8:SNk|≡GWNj|≡(IDi,GIDj,SIDk,R1,R2,NCk0)According to the Msg3, we getS9:GWNj⊲<IDi,SIDk,R3>SNk↔KGSGWNjFrom A8, S9, and message-meaning rule, we haveS10:GWNj|≡SNk|~(IDi,SIDk,R3)From A2 and freshness rule, we getS11:GWNj|≡#(IDi,SIDk,R3)From S11, S10, and nonce-verification rule, we getS12:GWNj|≡SNk|≡(IDi,SIDk,R3)According to the Msg4, we getS13:Ui⊲<IDi,GIDj,SIDk,MIDi,R1,R2,R3, GWNj↔h(IDi∥K∥bi)Ui>GWNj↔KGUUiFrom A5, S13, and message-meaning rule, we haveS14:Ui|≡GWNj|~(IDi,GIDj,SIDk,MIDi,R1,R2,R3,GWNj↔h(IDi∥K∥bi)Ui)From A4 and freshness rule, we getS15:Ui|≡#(IDi,GIDj,SIDk,MIDi,R1,R2,R3, GWNj↔h(IDi∥K∥bi)Ui)From S15, S14, and nonce-verification rule, we getS16:Ui|≡GWNj|≡(IDi,GIDj,SIDk,MIDi,R1,R2,R3, GWNj↔h(IDi∥K∥bi)Ui)According to the Msg5, we getS17:GWNj⊲<IDi,GIDj,SIDk,MIDi,R1,R2,R3, Ui↔h(IDi∥K∥bi)GWNj>Ui↔KGUGWNjFrom A6, S17, and message-meaning rule, we haveS18:GWNj|≡Ui|~(IDi,GIDj,SIDk,MIDi,R1,R2,R3,Ui↔h(IDi∥K∥bi)GWNj)From A2 and freshness rule, we getS19:GWNj|≡#(IDi,GIDj,SIDk,MIDi,R1,R2,R3, Ui↔h(IDi∥K∥bi)GWNj)From S18, S19, and nonce-verification rule, we getS20:GWNj|≡Ui|≡(IDi,GIDj,SIDk,MIDi,R1,R2,R3,Ui↔h(IDi∥K∥bi)GWNj)From S12, S16, andSK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3), we haveS21:Ui|≡SNk|≡(Ui↔SKSNk) (Goal2)From S4, S8, S20, andSK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3), we haveS22:SNk|≡Ui|≡(Ui↔SKSNk) (Goal4)From S21, A9, and jurisdiction rule, we haveS23:Ui|≡(Ui↔SKSNk) (Goal1)From S22, A10, and jurisdiction rule, we haveS24:SNk|≡(Ui↔SKSNk) (Goal3)Therefore, the security of the proposed scheme is proved strictly. In other words, the proposed scheme can achieve mutual authentication successfully.


### 4.2. Further Security Analysis of the Proposed Scheme

In this section, the security and functional features of the proposed scheme are discussed.


#### 4.2.1. Mutual Authentication

In the execution of the proposed scheme, the usersUi and GWNj authenticate each other by checking V1, V4, and V5, respectively. Similarly, GWNj and the wearable sensor node SNk authenticate each other by checking V2 and V3, respectively. In addition, as demonstrated in Section 4.1, the security of the proposed scheme has been proved strictly based on the BAN logic. Therefore, the proposed scheme achieves mutual authentication successfully.


#### 4.2.2. Session Key Agreement

After mutual authentication has been achieved successfully, a shared session keySK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3) is established between the user Ui and the wearable sensor node SNk to protect future communications. The session key SK contains Ui’s contribution IDi, R1, GWNj’s contribution GIDj, R2, and SNk’s contribution SIDk, R3. Any third party can not predetermine the session key. Therefore, the proposed scheme provides session key agreement.


#### 4.2.3. User Anonymity

In the proposed scheme, pseudonym identity technique is adopted to protect the real identity of the user. In particular, a pseudonym identityMIDi, instead of the user’s real identity IDi, is generated randomly and sent to GWN. In order to resist tracking attack, the pseudonym identity MIDi is updated after every session. Since one-way hash function is used, it is almost impossible to get the real identity of the user if the transmitted messages are intercepted by an adversary. To be more important, the transmitted messages in current session are also different from other sessions. Therefore, the proposed scheme can provide user anonymity and untraceability.


#### 4.2.4. Forward Secrecy

Forward secrecy means that the encrypted communications and session keys in the past cannot be retrieved and decrypted even if the long-term secret keys are compromised. In the proposed scheme, if the long-term keysKGU and KGS are compromised by an attacker, the confidentiality of past communications are not affected. The reason is that the long-term keys are updated successfully by one-way hash function after each session. Specifically, the long-term keys KGU and KGS are updated by KGU∗=h(KGU) and KGS∗=h(KGS∥SIDk), and the attacker can not get KGU and KGS from KGU∗ and KGS∗. Therefore, the proposed scheme provides forward secrecy.


#### 4.2.5. Resist Desynchronization Attack

As discussed in Sections4.2.3 and 4.2.4, pseudonym identity and one-time hash chain techniques are employed to provide user anonymity and forward secrecy in the proposed scheme. However, the incorrect use of pseudonym identity may lead to the problem of desynchronization attack, such as the schemes in [4–6]. In order to ensure the consistency of the pseudonym identity and the value of hash chain, two pseudonym identities MIDi0 and MIDi1, and serial numbers NCk0, NCk are used, respectively. To perform a comprehensive analysis of this attack, an adversary A is assumed to launch the following malicious scenarios.Scenario 1.
This scenario indicates that the message{MIDi,MS1,V1,T1} has been blocked by an adversary A. However, it is ineffective because all the participants have not even started updating.Scenario 2.
This scenario demonstrates that the message{MS2,V2,NCk0} has been blocked and the communication between GWN and the wearable sensor node SNk will be jammed. At this time, the hash chain values of two participants will not match each other. However, the proposed scheme is still usable. The reason is that the proposed scheme uses two serial numbers NCk0 and NCk to record the number of hash chain updated, where NCk0 represents the serial number in GWN side and NCk denotes the serial number in the wearable sensor node side. When the GWN transfers the message {MS2,V2,NCk0}, the hash chain value KGS and sequence number NCk0 in GWN side are updated. After receiving the message {MS2,V2,NCk0}, the value of hash chain in SNk side can be synchronized through performing NCk0-NCk times hash operations. Therefore, this scenario will not have any impact on the future session.Scenario 3.
IfA blocks the message {MS3,V3}, the desynchronization attack will not work because the hash chain values have been updated and they are equal to each other. Therefore, this scenario will be omitted.Scenario 4.
If the message{MS4,V4} is blocked, the communication between Ui and GWN will be jammed, and the pseudonym identity values of two participants will not match each other. However, this scenario has no effect on our scheme. In this scenario, both the hash chain values in two participants and the value of pseudonym identity MIDi in the Ui side are not changed, and the value of pseudonym identity MIDi0 in the GWN side has been a new value generated randomly. Fortunately, the GWN stores the user’s old pseudonym identity in MIDi1 with MIDi1=MIDi, and mutual authentication can still be completed successfully even if Ui initiates a new session using unchanged MIDi. Therefore, this scenario may cause the problem of asynchronous, but it will not have any impact on the future session.Scenario 5.
IfA blocks the message {V5}, the communication between Ui and GWN will be jammed, and the hash chain values of two participants will not match each other. However, this scenario has no effect on our scheme. In this scenario, the values of two participants’ pseudonym identities and the hash chain in the Ui side have been updated, but the value of hash chain in the GWN side has unchanged. When a new session has been initiated by the Ui using changed hash chain value, the GWN will update the hash chain value by checking whether the value of MIDi1 is nonnull. Therefore, this scenario may cause the problem of asynchronous between Ui and GWN, but the two pseudonym identities MIDi0 and MIDi1 will make the hash chain values synchronize again.Therefore, the proposed scheme is resilient to desynchronization attack.


#### 4.2.6. Resist User Impersonation Attack

In the proposed scheme, without knowing the passwordPWi, the fingerprint information BIOi, and the secret key KGU, the adversary is infeasible to forge a legal user and generate a valid message {MIDi,MS1,V1,T1}. Therefore, the proposed scheme is resilient to user impersonation attack.


#### 4.2.7. Resist Mobile Device Loss Attack

If theMD of the user has been stolen or picked up by a malicious user, the stored secret messages {MIDi,Bi,Ci,Di,KGU,Pi} can be revealed using side-channel attacks [28], where Ci∗=h(h(IDi∥K∥bi)∥Ai∗), h(IDi∥K∥bi)=Bi⊕Ai∗, Ai∗=h(PWi∥Ri∥ai∗), ai∗=Di⊕h(IDi∥PWi∥Ri∗), and Ri∗=Rep(BIOi∗,Pi). In addition, as discussed in Section 2.3, the attacker can intercept, modify, insert, and delete the transmitted messages over insecure public communication channels easily. Using this sensitive information, the attacker can launch the mobile device loss attack and try to guess the identity IDi and password PWi of the user. However, without knowing the secret random value ai and biometric input BIOi of the user, the secret key K, and the high entropy random integer bi of the GWN, the attacker can not obtain the correct identity and password of the user. Therefore, the proposed scheme can resist against mobile device loss attack.


#### 4.2.8. Resist Replay Attack

In the proposed scheme, the time stamp, serial number method, and challenge-response mechanism are used to prevent the replay attack. In detail, the method of using time stamp is used to prevent the replay attack for the first message betweenUi and GWN, and the rest messages between Ui and GWN adopt the challenge-response mechanism. At the same time, the messages between GWN and SNk adopt the serial number method to prevent the replay attack. Therefore, the proposed scheme can resist the replay attack.


#### 4.2.9. Resist Privileged-Insider Attack

In the phase of user registration,Ui sends {IDi,Ai} to GWN through a secure channel, where Ai=h(PWi∥Ri∥ai). The three secret values PWi, Ri, and ai, generated by Ui, are high entropy random numbers which is unknown to GWN. A malicious privileged-insider attacker can not guess the Ui’s password PWi from Ai since it is protected by the one-way hash function. Therefore, the proposed scheme is secure in the privileged-insider attack.


#### 4.2.10. Resist Stolen Verifier Table Attack

In the proposed scheme, theGWN maintains the secret values {IDi,MIDi0,MIDi1,bi,KGU} for authentication purpose, which has no any password-verifier information of the user. Besides, if an adversary steals the secret values {IDi,MIDi0,MIDi1,bi,KGU}, he/she still fails to compute MS1=(R1∥SIDk)⊕h(MIDi∥h(IDi∥K∥bi)∥KGU), V1=h(IDi∥R1∥h(IDi∥K∥bi)∥MIDi∥KGU∥T1), h(IDi∥K∥bi)=Bi⊕Ai, Ai=h(PWi∥Ri∥ai), ai=Di⊕h(IDi∥PWi∥Ri), and Ri=Rep(BIOi,Pi) without the knowledge of the user’s IDi, PWi, and BIOi and the secret values {MIDi,Bi,Ci,Di,KGU,Pi} in the MD. The adversary fails to send the authentication request {MIDi,MS1,V1,T1} to GWN, and a failure login is detected by GWN. Therefore, the proposed scheme can resist stolen verifier table attack.


#### 4.2.11. Quick Detection for Unauthorized Login

Quick detection mechanism for unauthorized login is essential for the authentication scheme. In the phase of user login, the valueCi stored in the mobile device is used to verify the legitimacy of the user Ui, where Ci∗=h(h(IDi∥K∥bi)∥Ai∗), h(IDi∥K∥bi)=Bi⊕Ai∗, Ai∗=h(PWi∥Ri∥ai∗), ai∗=Di⊕h(IDi∥PWi∥Ri∗), and Ri∗=Rep(BIOi∗,Pi). If an attacker inputs the wrong password PWi∗ and the wrong fingerprint information BIOi, the values Ci∗ and Ci are not equal, and the MD rejects the Ui’s login request. Therefore, the proposed scheme can provide the quick detection mechanism for unauthorized login.


### 4.3. Security Comparisons

In this subsection, the comparison of security and functional features with six state-of-the-art schemes [4–6, 8, 14, 15] will be described. As shown in Table 4, the six lightweight state-of-the-art schemes fail to provide forward secrecy, and the schemes in [4–6, 14, 15] suffer from the desynchronization attack. In addition, the scheme in [5] is also vulnerable to user impersonation attack, off-line password guessing attack and privileged-insider attack. The scheme in [14] has weaknesses such as sensor node capture attack and privileged-insider attack, and user anonymity is not provided. Besides, the scheme in [15] fails to provide untraceability of the user, and the scheme in [4] lacks the detection mechanism for unauthorized login, and it can lead to unnecessary computational and communication costs. Compared with the state-of-the-art schemes [4–6, 8, 14, 15], the proposed scheme achieves more ideal functional features and resists various malicious attacks.Table 4
Security attributes comparison with state-of-the-art schemes.
Schemes Security attributes A 1 A 2 A 3 A 4 A 5 A 6 A 7 A 8 A 9 A 10 A 11 Scheme [4] N N Y Y Y Y Y Y Y Y Y Scheme [5] N N Y N Y Y Y Y N N N Scheme [6] N N Y Y Y Y Y Y Y Y Y Scheme [8] N Y Y Y Y Y Y Y Y Y Y Scheme [14] N N Y Y N Y Y Y N Y Y Scheme [15] N N Y Y N Y Y Y Y Y Y Our scheme Y Y Y Y Y Y Y Y Y Y Y Y, yes; N, no;A1, forward security; A2, resist desynchronization attack; A3, mutual authentication; A4, session key security; A5, user anonymity; A6, resist mobile device loss attack; A7, resist replay attack; A8, resist wrong password attack; A9, resist privileged insider attack; A10, resist user impersonation attack; A11, resist off-line password guessing attack.


## 4.1. Formal Security Analysis Using BAN Logic

BAN logic is a set of rules for defining and analyzing authentication protocols, which is widely used in many works, such as the schemes in [5, 6, 30, 31]. For convenience, all the notations used in the BAN logic are given in Table 2:Table 2
Notations in BAN logic.
Notation Implications P⊲X PrincipalP sees a statement X P|≡X PrincipalP believes a statement X P|⇒X PrincipalP has jurisdiction over statement X P|~X PrincipalP once said a statement X #(X) StatementX is fresh (X,Y) StatementX or Y is one part of statement (X,Y) XK StatementX is encrypted with the key K <X>Y StatementX is combined with statement Y (X)K StatementX is hashed with the key K P↔KQ PrincipalP and principal Q communicate with the shared key KBasic rules of BAN logic are given in Table3.Table 3
Basic rules of BAN logic.
Rule Description Message-meaning rule P | ≡ P ↔ K Q , P ⊲ X K P | ≡ Q | ~ X Nonce-verification rule P | ≡ # ( X ) , P | ≡ Q | ~ X P | ≡ Q | ≡ X Jurisdiction rule P | ≡ Q | ⇒ X , P | ≡ Q | ≡ X P | ≡ X Freshness rule P | ≡ # ( X ) P | ≡ # ( X , Y )The proposed scheme should accomplish the following four goals:Goal1:Ui|≡(Ui↔SKSNk)Goal2:Ui|≡SNk|≡(Ui↔SKSNk)Goal3:SNk|≡(Ui↔SKSNk)Goal4:SNk|≡Ui|≡(Ui↔SKSNk)First, the messages exchanged in the proposed scheme can be transformed into idealized forms as follows:Msg1:Ui→GWNj:<IDi,R1,MIDi,SIDk,T1,Ui↔h(IDi∥K∥bi)GWNj>Ui↔KGUGWNjMsg2:GWNj→SNk:<IDi,GIDj,SIDk,R1,R2,NCk0>GWNj↔KGSSNkMsg3:SNk→GWNj:<IDi,SIDk,R3>SNk↔KGSGWNjMsg4:GWNj→Ui:<IDi,GIDj,SIDk,MIDi,R1,R2,R3, GWNj↔h(IDi∥K∥bi)Ui>GWNj↔KGUUiMsg5:Ui→GWNj:<IDi,GIDj,SIDk,MIDi,R1,R2,R3,Ui↔h(IDi∥K∥bi)GWNj>Ui↔KGUGWNjSecond, some initial assumptions about the proposed scheme are listed below:A1:GWNj|≡#(T1)A2:GWNj|≡#(R1,R2,R3)A3:SNk|≡#(R1,R2,R3)A4:Ui|≡#(R1,R2,R3)A5:Ui|≡Ui↔KGUGWNjA6:GWNj|≡Ui↔KGUGWNjA7:SNk|≡SNk↔KGSGWNjA8:GWNj|≡SNk↔KGSGWNjA9:Ui|≡SNk|⇒Ui↔SKSNkA10:SNk|≡Ui|⇒Ui↔SKSNkThird, based on the BAN logic rules and assumptions, the main proofs are performed as follows.According to the Msg1, we getS1:GWNj⊲<IDi,R1,MIDi,SIDk,T1,Ui↔h(IDi∥K∥bi)GWNj>Ui↔KGUGWNjBased on Assumption A6, S1, and message-meaning rule, we haveS2:GWNj|≡Ui|~(IDi,R1,MIDi,SIDk,T1,Ui↔h(IDi∥K∥bi)GWNj)From A1, A2, and freshness rule, we getS3:GWNj|≡#(IDi,R1,MIDi,SIDk,T1, Ui↔h(IDi∥K∥bi)GWNj)From S3, S2, and nonce-verification rule, we getS4:GWNj|≡Ui|≡(IDi,R1,MIDi,SIDk,T1,Ui↔h(IDi∥K∥bi)GWNj)According to the Msg2, we getS5:SNk⊲<IDi,GIDj,SIDk,R1,R2, NCk0>GWNj↔KGSSNkFrom A7, S5, and message-meaning rule, we haveS6:SNk|≡GWNj|~(IDi,GIDj,SIDk,R1,R2,NCk0)From A3 and freshness rule, we getS7:SNk|≡#(IDi,GIDj,SIDk,R1,R2,NCk0)From S7, S6, and nonce-verification rule, we getS8:SNk|≡GWNj|≡(IDi,GIDj,SIDk,R1,R2,NCk0)According to the Msg3, we getS9:GWNj⊲<IDi,SIDk,R3>SNk↔KGSGWNjFrom A8, S9, and message-meaning rule, we haveS10:GWNj|≡SNk|~(IDi,SIDk,R3)From A2 and freshness rule, we getS11:GWNj|≡#(IDi,SIDk,R3)From S11, S10, and nonce-verification rule, we getS12:GWNj|≡SNk|≡(IDi,SIDk,R3)According to the Msg4, we getS13:Ui⊲<IDi,GIDj,SIDk,MIDi,R1,R2,R3, GWNj↔h(IDi∥K∥bi)Ui>GWNj↔KGUUiFrom A5, S13, and message-meaning rule, we haveS14:Ui|≡GWNj|~(IDi,GIDj,SIDk,MIDi,R1,R2,R3,GWNj↔h(IDi∥K∥bi)Ui)From A4 and freshness rule, we getS15:Ui|≡#(IDi,GIDj,SIDk,MIDi,R1,R2,R3, GWNj↔h(IDi∥K∥bi)Ui)From S15, S14, and nonce-verification rule, we getS16:Ui|≡GWNj|≡(IDi,GIDj,SIDk,MIDi,R1,R2,R3, GWNj↔h(IDi∥K∥bi)Ui)According to the Msg5, we getS17:GWNj⊲<IDi,GIDj,SIDk,MIDi,R1,R2,R3, Ui↔h(IDi∥K∥bi)GWNj>Ui↔KGUGWNjFrom A6, S17, and message-meaning rule, we haveS18:GWNj|≡Ui|~(IDi,GIDj,SIDk,MIDi,R1,R2,R3,Ui↔h(IDi∥K∥bi)GWNj)From A2 and freshness rule, we getS19:GWNj|≡#(IDi,GIDj,SIDk,MIDi,R1,R2,R3, Ui↔h(IDi∥K∥bi)GWNj)From S18, S19, and nonce-verification rule, we getS20:GWNj|≡Ui|≡(IDi,GIDj,SIDk,MIDi,R1,R2,R3,Ui↔h(IDi∥K∥bi)GWNj)From S12, S16, andSK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3), we haveS21:Ui|≡SNk|≡(Ui↔SKSNk) (Goal2)From S4, S8, S20, andSK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3), we haveS22:SNk|≡Ui|≡(Ui↔SKSNk) (Goal4)From S21, A9, and jurisdiction rule, we haveS23:Ui|≡(Ui↔SKSNk) (Goal1)From S22, A10, and jurisdiction rule, we haveS24:SNk|≡(Ui↔SKSNk) (Goal3)Therefore, the security of the proposed scheme is proved strictly. In other words, the proposed scheme can achieve mutual authentication successfully.


## 4.2. Further Security Analysis of the Proposed Scheme

In this section, the security and functional features of the proposed scheme are discussed.


### 4.2.1. Mutual Authentication

In the execution of the proposed scheme, the usersUi and GWNj authenticate each other by checking V1, V4, and V5, respectively. Similarly, GWNj and the wearable sensor node SNk authenticate each other by checking V2 and V3, respectively. In addition, as demonstrated in Section 4.1, the security of the proposed scheme has been proved strictly based on the BAN logic. Therefore, the proposed scheme achieves mutual authentication successfully.


### 4.2.2. Session Key Agreement

After mutual authentication has been achieved successfully, a shared session keySK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3) is established between the user Ui and the wearable sensor node SNk to protect future communications. The session key SK contains Ui’s contribution IDi, R1, GWNj’s contribution GIDj, R2, and SNk’s contribution SIDk, R3. Any third party can not predetermine the session key. Therefore, the proposed scheme provides session key agreement.


### 4.2.3. User Anonymity

In the proposed scheme, pseudonym identity technique is adopted to protect the real identity of the user. In particular, a pseudonym identityMIDi, instead of the user’s real identity IDi, is generated randomly and sent to GWN. In order to resist tracking attack, the pseudonym identity MIDi is updated after every session. Since one-way hash function is used, it is almost impossible to get the real identity of the user if the transmitted messages are intercepted by an adversary. To be more important, the transmitted messages in current session are also different from other sessions. Therefore, the proposed scheme can provide user anonymity and untraceability.


### 4.2.4. Forward Secrecy

Forward secrecy means that the encrypted communications and session keys in the past cannot be retrieved and decrypted even if the long-term secret keys are compromised. In the proposed scheme, if the long-term keysKGU and KGS are compromised by an attacker, the confidentiality of past communications are not affected. The reason is that the long-term keys are updated successfully by one-way hash function after each session. Specifically, the long-term keys KGU and KGS are updated by KGU∗=h(KGU) and KGS∗=h(KGS∥SIDk), and the attacker can not get KGU and KGS from KGU∗ and KGS∗. Therefore, the proposed scheme provides forward secrecy.


### 4.2.5. Resist Desynchronization Attack

As discussed in Sections4.2.3 and 4.2.4, pseudonym identity and one-time hash chain techniques are employed to provide user anonymity and forward secrecy in the proposed scheme. However, the incorrect use of pseudonym identity may lead to the problem of desynchronization attack, such as the schemes in [4–6]. In order to ensure the consistency of the pseudonym identity and the value of hash chain, two pseudonym identities MIDi0 and MIDi1, and serial numbers NCk0, NCk are used, respectively. To perform a comprehensive analysis of this attack, an adversary A is assumed to launch the following malicious scenarios.Scenario 1.
This scenario indicates that the message{MIDi,MS1,V1,T1} has been blocked by an adversary A. However, it is ineffective because all the participants have not even started updating.Scenario 2.
This scenario demonstrates that the message{MS2,V2,NCk0} has been blocked and the communication between GWN and the wearable sensor node SNk will be jammed. At this time, the hash chain values of two participants will not match each other. However, the proposed scheme is still usable. The reason is that the proposed scheme uses two serial numbers NCk0 and NCk to record the number of hash chain updated, where NCk0 represents the serial number in GWN side and NCk denotes the serial number in the wearable sensor node side. When the GWN transfers the message {MS2,V2,NCk0}, the hash chain value KGS and sequence number NCk0 in GWN side are updated. After receiving the message {MS2,V2,NCk0}, the value of hash chain in SNk side can be synchronized through performing NCk0-NCk times hash operations. Therefore, this scenario will not have any impact on the future session.Scenario 3.
IfA blocks the message {MS3,V3}, the desynchronization attack will not work because the hash chain values have been updated and they are equal to each other. Therefore, this scenario will be omitted.Scenario 4.
If the message{MS4,V4} is blocked, the communication between Ui and GWN will be jammed, and the pseudonym identity values of two participants will not match each other. However, this scenario has no effect on our scheme. In this scenario, both the hash chain values in two participants and the value of pseudonym identity MIDi in the Ui side are not changed, and the value of pseudonym identity MIDi0 in the GWN side has been a new value generated randomly. Fortunately, the GWN stores the user’s old pseudonym identity in MIDi1 with MIDi1=MIDi, and mutual authentication can still be completed successfully even if Ui initiates a new session using unchanged MIDi. Therefore, this scenario may cause the problem of asynchronous, but it will not have any impact on the future session.Scenario 5.
IfA blocks the message {V5}, the communication between Ui and GWN will be jammed, and the hash chain values of two participants will not match each other. However, this scenario has no effect on our scheme. In this scenario, the values of two participants’ pseudonym identities and the hash chain in the Ui side have been updated, but the value of hash chain in the GWN side has unchanged. When a new session has been initiated by the Ui using changed hash chain value, the GWN will update the hash chain value by checking whether the value of MIDi1 is nonnull. Therefore, this scenario may cause the problem of asynchronous between Ui and GWN, but the two pseudonym identities MIDi0 and MIDi1 will make the hash chain values synchronize again.Therefore, the proposed scheme is resilient to desynchronization attack.


### 4.2.6. Resist User Impersonation Attack

In the proposed scheme, without knowing the passwordPWi, the fingerprint information BIOi, and the secret key KGU, the adversary is infeasible to forge a legal user and generate a valid message {MIDi,MS1,V1,T1}. Therefore, the proposed scheme is resilient to user impersonation attack.


### 4.2.7. Resist Mobile Device Loss Attack

If theMD of the user has been stolen or picked up by a malicious user, the stored secret messages {MIDi,Bi,Ci,Di,KGU,Pi} can be revealed using side-channel attacks [28], where Ci∗=h(h(IDi∥K∥bi)∥Ai∗), h(IDi∥K∥bi)=Bi⊕Ai∗, Ai∗=h(PWi∥Ri∥ai∗), ai∗=Di⊕h(IDi∥PWi∥Ri∗), and Ri∗=Rep(BIOi∗,Pi). In addition, as discussed in Section 2.3, the attacker can intercept, modify, insert, and delete the transmitted messages over insecure public communication channels easily. Using this sensitive information, the attacker can launch the mobile device loss attack and try to guess the identity IDi and password PWi of the user. However, without knowing the secret random value ai and biometric input BIOi of the user, the secret key K, and the high entropy random integer bi of the GWN, the attacker can not obtain the correct identity and password of the user. Therefore, the proposed scheme can resist against mobile device loss attack.


### 4.2.8. Resist Replay Attack

In the proposed scheme, the time stamp, serial number method, and challenge-response mechanism are used to prevent the replay attack. In detail, the method of using time stamp is used to prevent the replay attack for the first message betweenUi and GWN, and the rest messages between Ui and GWN adopt the challenge-response mechanism. At the same time, the messages between GWN and SNk adopt the serial number method to prevent the replay attack. Therefore, the proposed scheme can resist the replay attack.


### 4.2.9. Resist Privileged-Insider Attack

In the phase of user registration,Ui sends {IDi,Ai} to GWN through a secure channel, where Ai=h(PWi∥Ri∥ai). The three secret values PWi, Ri, and ai, generated by Ui, are high entropy random numbers which is unknown to GWN. A malicious privileged-insider attacker can not guess the Ui’s password PWi from Ai since it is protected by the one-way hash function. Therefore, the proposed scheme is secure in the privileged-insider attack.


### 4.2.10. Resist Stolen Verifier Table Attack

In the proposed scheme, theGWN maintains the secret values {IDi,MIDi0,MIDi1,bi,KGU} for authentication purpose, which has no any password-verifier information of the user. Besides, if an adversary steals the secret values {IDi,MIDi0,MIDi1,bi,KGU}, he/she still fails to compute MS1=(R1∥SIDk)⊕h(MIDi∥h(IDi∥K∥bi)∥KGU), V1=h(IDi∥R1∥h(IDi∥K∥bi)∥MIDi∥KGU∥T1), h(IDi∥K∥bi)=Bi⊕Ai, Ai=h(PWi∥Ri∥ai), ai=Di⊕h(IDi∥PWi∥Ri), and Ri=Rep(BIOi,Pi) without the knowledge of the user’s IDi, PWi, and BIOi and the secret values {MIDi,Bi,Ci,Di,KGU,Pi} in the MD. The adversary fails to send the authentication request {MIDi,MS1,V1,T1} to GWN, and a failure login is detected by GWN. Therefore, the proposed scheme can resist stolen verifier table attack.


### 4.2.11. Quick Detection for Unauthorized Login

Quick detection mechanism for unauthorized login is essential for the authentication scheme. In the phase of user login, the valueCi stored in the mobile device is used to verify the legitimacy of the user Ui, where Ci∗=h(h(IDi∥K∥bi)∥Ai∗), h(IDi∥K∥bi)=Bi⊕Ai∗, Ai∗=h(PWi∥Ri∥ai∗), ai∗=Di⊕h(IDi∥PWi∥Ri∗), and Ri∗=Rep(BIOi∗,Pi). If an attacker inputs the wrong password PWi∗ and the wrong fingerprint information BIOi, the values Ci∗ and Ci are not equal, and the MD rejects the Ui’s login request. Therefore, the proposed scheme can provide the quick detection mechanism for unauthorized login.


## 4.2.1. Mutual Authentication

In the execution of the proposed scheme, the usersUi and GWNj authenticate each other by checking V1, V4, and V5, respectively. Similarly, GWNj and the wearable sensor node SNk authenticate each other by checking V2 and V3, respectively. In addition, as demonstrated in Section 4.1, the security of the proposed scheme has been proved strictly based on the BAN logic. Therefore, the proposed scheme achieves mutual authentication successfully.


## 4.2.2. Session Key Agreement

After mutual authentication has been achieved successfully, a shared session keySK=h(IDi∥GIDj∥SIDk∥R1∥R2∥R3) is established between the user Ui and the wearable sensor node SNk to protect future communications. The session key SK contains Ui’s contribution IDi, R1, GWNj’s contribution GIDj, R2, and SNk’s contribution SIDk, R3. Any third party can not predetermine the session key. Therefore, the proposed scheme provides session key agreement.


## 4.2.3. User Anonymity

In the proposed scheme, pseudonym identity technique is adopted to protect the real identity of the user. In particular, a pseudonym identityMIDi, instead of the user’s real identity IDi, is generated randomly and sent to GWN. In order to resist tracking attack, the pseudonym identity MIDi is updated after every session. Since one-way hash function is used, it is almost impossible to get the real identity of the user if the transmitted messages are intercepted by an adversary. To be more important, the transmitted messages in current session are also different from other sessions. Therefore, the proposed scheme can provide user anonymity and untraceability.


## 4.2.4. Forward Secrecy

Forward secrecy means that the encrypted communications and session keys in the past cannot be retrieved and decrypted even if the long-term secret keys are compromised. In the proposed scheme, if the long-term keysKGU and KGS are compromised by an attacker, the confidentiality of past communications are not affected. The reason is that the long-term keys are updated successfully by one-way hash function after each session. Specifically, the long-term keys KGU and KGS are updated by KGU∗=h(KGU) and KGS∗=h(KGS∥SIDk), and the attacker can not get KGU and KGS from KGU∗ and KGS∗. Therefore, the proposed scheme provides forward secrecy.


## 4.2.5. Resist Desynchronization Attack

As discussed in Sections4.2.3 and 4.2.4, pseudonym identity and one-time hash chain techniques are employed to provide user anonymity and forward secrecy in the proposed scheme. However, the incorrect use of pseudonym identity may lead to the problem of desynchronization attack, such as the schemes in [4–6]. In order to ensure the consistency of the pseudonym identity and the value of hash chain, two pseudonym identities MIDi0 and MIDi1, and serial numbers NCk0, NCk are used, respectively. To perform a comprehensive analysis of this attack, an adversary A is assumed to launch the following malicious scenarios.Scenario 1.
This scenario indicates that the message{MIDi,MS1,V1,T1} has been blocked by an adversary A. However, it is ineffective because all the participants have not even started updating.Scenario 2.
This scenario demonstrates that the message{MS2,V2,NCk0} has been blocked and the communication between GWN and the wearable sensor node SNk will be jammed. At this time, the hash chain values of two participants will not match each other. However, the proposed scheme is still usable. The reason is that the proposed scheme uses two serial numbers NCk0 and NCk to record the number of hash chain updated, where NCk0 represents the serial number in GWN side and NCk denotes the serial number in the wearable sensor node side. When the GWN transfers the message {MS2,V2,NCk0}, the hash chain value KGS and sequence number NCk0 in GWN side are updated. After receiving the message {MS2,V2,NCk0}, the value of hash chain in SNk side can be synchronized through performing NCk0-NCk times hash operations. Therefore, this scenario will not have any impact on the future session.Scenario 3.
IfA blocks the message {MS3,V3}, the desynchronization attack will not work because the hash chain values have been updated and they are equal to each other. Therefore, this scenario will be omitted.Scenario 4.
If the message{MS4,V4} is blocked, the communication between Ui and GWN will be jammed, and the pseudonym identity values of two participants will not match each other. However, this scenario has no effect on our scheme. In this scenario, both the hash chain values in two participants and the value of pseudonym identity MIDi in the Ui side are not changed, and the value of pseudonym identity MIDi0 in the GWN side has been a new value generated randomly. Fortunately, the GWN stores the user’s old pseudonym identity in MIDi1 with MIDi1=MIDi, and mutual authentication can still be completed successfully even if Ui initiates a new session using unchanged MIDi. Therefore, this scenario may cause the problem of asynchronous, but it will not have any impact on the future session.Scenario 5.
IfA blocks the message {V5}, the communication between Ui and GWN will be jammed, and the hash chain values of two participants will not match each other. However, this scenario has no effect on our scheme. In this scenario, the values of two participants’ pseudonym identities and the hash chain in the Ui side have been updated, but the value of hash chain in the GWN side has unchanged. When a new session has been initiated by the Ui using changed hash chain value, the GWN will update the hash chain value by checking whether the value of MIDi1 is nonnull. Therefore, this scenario may cause the problem of asynchronous between Ui and GWN, but the two pseudonym identities MIDi0 and MIDi1 will make the hash chain values synchronize again.Therefore, the proposed scheme is resilient to desynchronization attack.


## 4.2.6. Resist User Impersonation Attack

In the proposed scheme, without knowing the passwordPWi, the fingerprint information BIOi, and the secret key KGU, the adversary is infeasible to forge a legal user and generate a valid message {MIDi,MS1,V1,T1}. Therefore, the proposed scheme is resilient to user impersonation attack.


## 4.2.7. Resist Mobile Device Loss Attack

If theMD of the user has been stolen or picked up by a malicious user, the stored secret messages {MIDi,Bi,Ci,Di,KGU,Pi} can be revealed using side-channel attacks [28], where Ci∗=h(h(IDi∥K∥bi)∥Ai∗), h(IDi∥K∥bi)=Bi⊕Ai∗, Ai∗=h(PWi∥Ri∥ai∗), ai∗=Di⊕h(IDi∥PWi∥Ri∗), and Ri∗=Rep(BIOi∗,Pi). In addition, as discussed in Section 2.3, the attacker can intercept, modify, insert, and delete the transmitted messages over insecure public communication channels easily. Using this sensitive information, the attacker can launch the mobile device loss attack and try to guess the identity IDi and password PWi of the user. However, without knowing the secret random value ai and biometric input BIOi of the user, the secret key K, and the high entropy random integer bi of the GWN, the attacker can not obtain the correct identity and password of the user. Therefore, the proposed scheme can resist against mobile device loss attack.


## 4.2.8. Resist Replay Attack

In the proposed scheme, the time stamp, serial number method, and challenge-response mechanism are used to prevent the replay attack. In detail, the method of using time stamp is used to prevent the replay attack for the first message betweenUi and GWN, and the rest messages between Ui and GWN adopt the challenge-response mechanism. At the same time, the messages between GWN and SNk adopt the serial number method to prevent the replay attack. Therefore, the proposed scheme can resist the replay attack.


## 4.2.9. Resist Privileged-Insider Attack

In the phase of user registration,Ui sends {IDi,Ai} to GWN through a secure channel, where Ai=h(PWi∥Ri∥ai). The three secret values PWi, Ri, and ai, generated by Ui, are high entropy random numbers which is unknown to GWN. A malicious privileged-insider attacker can not guess the Ui’s password PWi from Ai since it is protected by the one-way hash function. Therefore, the proposed scheme is secure in the privileged-insider attack.


## 4.2.10. Resist Stolen Verifier Table Attack

In the proposed scheme, theGWN maintains the secret values {IDi,MIDi0,MIDi1,bi,KGU} for authentication purpose, which has no any password-verifier information of the user. Besides, if an adversary steals the secret values {IDi,MIDi0,MIDi1,bi,KGU}, he/she still fails to compute MS1=(R1∥SIDk)⊕h(MIDi∥h(IDi∥K∥bi)∥KGU), V1=h(IDi∥R1∥h(IDi∥K∥bi)∥MIDi∥KGU∥T1), h(IDi∥K∥bi)=Bi⊕Ai, Ai=h(PWi∥Ri∥ai), ai=Di⊕h(IDi∥PWi∥Ri), and Ri=Rep(BIOi,Pi) without the knowledge of the user’s IDi, PWi, and BIOi and the secret values {MIDi,Bi,Ci,Di,KGU,Pi} in the MD. The adversary fails to send the authentication request {MIDi,MS1,V1,T1} to GWN, and a failure login is detected by GWN. Therefore, the proposed scheme can resist stolen verifier table attack.


## 4.2.11. Quick Detection for Unauthorized Login

Quick detection mechanism for unauthorized login is essential for the authentication scheme. In the phase of user login, the valueCi stored in the mobile device is used to verify the legitimacy of the user Ui, where Ci∗=h(h(IDi∥K∥bi)∥Ai∗), h(IDi∥K∥bi)=Bi⊕Ai∗, Ai∗=h(PWi∥Ri∥ai∗), ai∗=Di⊕h(IDi∥PWi∥Ri∗), and Ri∗=Rep(BIOi∗,Pi). If an attacker inputs the wrong password PWi∗ and the wrong fingerprint information BIOi, the values Ci∗ and Ci are not equal, and the MD rejects the Ui’s login request. Therefore, the proposed scheme can provide the quick detection mechanism for unauthorized login.


## 4.3. Security Comparisons

In this subsection, the comparison of security and functional features with six state-of-the-art schemes [4–6, 8, 14, 15] will be described. As shown in Table 4, the six lightweight state-of-the-art schemes fail to provide forward secrecy, and the schemes in [4–6, 14, 15] suffer from the desynchronization attack. In addition, the scheme in [5] is also vulnerable to user impersonation attack, off-line password guessing attack and privileged-insider attack. The scheme in [14] has weaknesses such as sensor node capture attack and privileged-insider attack, and user anonymity is not provided. Besides, the scheme in [15] fails to provide untraceability of the user, and the scheme in [4] lacks the detection mechanism for unauthorized login, and it can lead to unnecessary computational and communication costs. Compared with the state-of-the-art schemes [4–6, 8, 14, 15], the proposed scheme achieves more ideal functional features and resists various malicious attacks.Table 4
Security attributes comparison with state-of-the-art schemes.
Schemes Security attributes A 1 A 2 A 3 A 4 A 5 A 6 A 7 A 8 A 9 A 10 A 11 Scheme [4] N N Y Y Y Y Y Y Y Y Y Scheme [5] N N Y N Y Y Y Y N N N Scheme [6] N N Y Y Y Y Y Y Y Y Y Scheme [8] N Y Y Y Y Y Y Y Y Y Y Scheme [14] N N Y Y N Y Y Y N Y Y Scheme [15] N N Y Y N Y Y Y Y Y Y Our scheme Y Y Y Y Y Y Y Y Y Y Y Y, yes; N, no;A1, forward security; A2, resist desynchronization attack; A3, mutual authentication; A4, session key security; A5, user anonymity; A6, resist mobile device loss attack; A7, resist replay attack; A8, resist wrong password attack; A9, resist privileged insider attack; A10, resist user impersonation attack; A11, resist off-line password guessing attack.


## 5. Performance Evaluation

To demonstrate the superiority of the proposed scheme, in this section, six state-of-the-art schemes [4–6, 8, 14, 15] are selected for comparison. All these schemes are efficient and lightweight, and they are the most representative authentication schemes for remote patient monitoring. In detail, we first compare the computational costs of the proposed scheme with these schemes. Then, the comparisons of communication overheads are presented.


### 5.1. Computation Analysis

This section will compare the computational efficiency of the proposed scheme with six state-of-the-art schemes [4–6, 8, 14, 15]. We focus only on the login and authentication phase of the proposed scheme, and the costs involved in registration and password change phases are not discussed because these phases are not used frequently. For the convenience of analysis, we define four computational notations Th, TED, Tfe, and TECM as the time cost of one-way hash function operation (using SHA-1 hashing algorithm), a general symmetric-key encryption/decryption operation, fuzzy extractor, and an elliptic curve point relative multiplication operation, respectively. The bit XOR operation is ignored here because it requires very low computation. According to the experimental results in [32, 33], Th, TED, Tfe, and TECM are 0.00032s, 0.0056s, 0.0171s, and 0.0171s, respectively. Table 5 shows the comparison results of computational costs between the proposed scheme and other related schemes.Table 5
Comparison of computational costs between our scheme and other related schemes.
Scheme U i G W N j S N k Total cost Scheme [4] 11 T h 17 T h 6 T h 34 T h ≈ 0.0109 s Scheme [5] 12 T h 16 T h 6 T h 34 T h ≈ 0.0109 s Scheme [6] 2 T E D + 11 T h 3 T E D + 16 T h T E D + 6 T h 6TED+33Th≈0.0442s Scheme [8] 2 T E C M + 10 T h + T f e T E C M + 4 T h 5 T h 3TECM+19Th+Tfe≈0.0749s Scheme [14] T f e + 2 T E D + 5 T h 6TED+6Th 2 T E D + 5 T h Tfe+10TED+16Th≈0.0782s Scheme [15] 3 T E D + 8 T h 2 T E D + 5 T h 2 T E D + 5 T h 7TED+18Th≈0.0449s Our scheme T f e + 11 T h 12 T h 7 T h Tfe+30Th≈0.0267sAs shown in Table5, the total computational cost of the proposed scheme is Tfe+30Th≈0.0267s, and it is more efficient than the schemes in [6, 8, 14, 15]. Compared with the schemes in [4, 5], the proposed scheme requires little more computational cost because the fuzzy extractor has been used to provide additional security level of the system. Besides, the proposed scheme provides the desired security features and resists against all the possible attacks.


### 5.2. Communication Analysis

The communication overheads of our schemes and six state-of-the-art schemes [4–6, 8, 14, 15] are compared in Table 6. In order to achieve a convincing comparison, we have made a reasonable assumption that the length of user’s identity, user’s temporary identity, user’s password, sensor node’s identity, the time stamp, sequence number, the ECC point multiplication, the secret key, the random number, and the output of hash function are 128 bits, 128 bits, 128 bits, 128 bits, 128 bits, 128 bits, 320 bits, 160 bits, 160 bits, and 160 bits, respectively. In the proposed scheme, the transmitted messages {MIDi,MS1,V1,T1}, {M2,V2,NCk0}, {M3,V3}, {M4,V4}, and {V5} require (128+160+160+128)=576 bits, (160+160+128)=448 bits, (160+160)=320 bits, and (160+160)=320 bits and 160 bits, respectively. As a result, the total communication overhead of the proposed scheme is (576+448+320+320+160)=1824 bits. Similarly, the total communication overheads of the schemes in [4–6, 8, 14, 15] are 2592 bits, 2272 bits, 2016 bits, 1728 bits, 1312 bits, and 1504 bits, respectively. From Table 6, it is clear that the proposed scheme is more efficient than Wu et al.’s scheme [4], Amin et al.’ scheme [5], and Ali et al.’s scheme [6] in communication overhead. Although the schemes in [8, 15] have slightly advantage in the communication overhead, their schemes are not suitable for realistic environments because the user in their schemes contacts the wearable sensor node directly, and the distance between the user and the wearable sensor node would be higher than the communication radius of sensor node. Besides, the schemes in [4–6, 8, 14, 15] are not secure as they claimed and susceptible to security threats. Therefore, the proposed scheme is more suitable for realistic environments.Table 6
Comparison of communication overheads between our scheme and other schemes.
Scheme Messages required Total Bits Scheme [4] 4 messages 2592 bits Scheme [5] 4 messages 2272 bits Scheme [6] 4 messages 2016 bits Scheme [8] 3 messages 1728 bits Scheme [14] 4 messages 1312 bits Scheme [15] 3 messages 1504 bits our scheme 5 messages 1824 bits


## 5.1. Computation Analysis

This section will compare the computational efficiency of the proposed scheme with six state-of-the-art schemes [4–6, 8, 14, 15]. We focus only on the login and authentication phase of the proposed scheme, and the costs involved in registration and password change phases are not discussed because these phases are not used frequently. For the convenience of analysis, we define four computational notations Th, TED, Tfe, and TECM as the time cost of one-way hash function operation (using SHA-1 hashing algorithm), a general symmetric-key encryption/decryption operation, fuzzy extractor, and an elliptic curve point relative multiplication operation, respectively. The bit XOR operation is ignored here because it requires very low computation. According to the experimental results in [32, 33], Th, TED, Tfe, and TECM are 0.00032s, 0.0056s, 0.0171s, and 0.0171s, respectively. Table 5 shows the comparison results of computational costs between the proposed scheme and other related schemes.Table 5
Comparison of computational costs between our scheme and other related schemes.
Scheme U i G W N j S N k Total cost Scheme [4] 11 T h 17 T h 6 T h 34 T h ≈ 0.0109 s Scheme [5] 12 T h 16 T h 6 T h 34 T h ≈ 0.0109 s Scheme [6] 2 T E D + 11 T h 3 T E D + 16 T h T E D + 6 T h 6TED+33Th≈0.0442s Scheme [8] 2 T E C M + 10 T h + T f e T E C M + 4 T h 5 T h 3TECM+19Th+Tfe≈0.0749s Scheme [14] T f e + 2 T E D + 5 T h 6TED+6Th 2 T E D + 5 T h Tfe+10TED+16Th≈0.0782s Scheme [15] 3 T E D + 8 T h 2 T E D + 5 T h 2 T E D + 5 T h 7TED+18Th≈0.0449s Our scheme T f e + 11 T h 12 T h 7 T h Tfe+30Th≈0.0267sAs shown in Table5, the total computational cost of the proposed scheme is Tfe+30Th≈0.0267s, and it is more efficient than the schemes in [6, 8, 14, 15]. Compared with the schemes in [4, 5], the proposed scheme requires little more computational cost because the fuzzy extractor has been used to provide additional security level of the system. Besides, the proposed scheme provides the desired security features and resists against all the possible attacks.


## 5.2. Communication Analysis

The communication overheads of our schemes and six state-of-the-art schemes [4–6, 8, 14, 15] are compared in Table 6. In order to achieve a convincing comparison, we have made a reasonable assumption that the length of user’s identity, user’s temporary identity, user’s password, sensor node’s identity, the time stamp, sequence number, the ECC point multiplication, the secret key, the random number, and the output of hash function are 128 bits, 128 bits, 128 bits, 128 bits, 128 bits, 128 bits, 320 bits, 160 bits, 160 bits, and 160 bits, respectively. In the proposed scheme, the transmitted messages {MIDi,MS1,V1,T1}, {M2,V2,NCk0}, {M3,V3}, {M4,V4}, and {V5} require (128+160+160+128)=576 bits, (160+160+128)=448 bits, (160+160)=320 bits, and (160+160)=320 bits and 160 bits, respectively. As a result, the total communication overhead of the proposed scheme is (576+448+320+320+160)=1824 bits. Similarly, the total communication overheads of the schemes in [4–6, 8, 14, 15] are 2592 bits, 2272 bits, 2016 bits, 1728 bits, 1312 bits, and 1504 bits, respectively. From Table 6, it is clear that the proposed scheme is more efficient than Wu et al.’s scheme [4], Amin et al.’ scheme [5], and Ali et al.’s scheme [6] in communication overhead. Although the schemes in [8, 15] have slightly advantage in the communication overhead, their schemes are not suitable for realistic environments because the user in their schemes contacts the wearable sensor node directly, and the distance between the user and the wearable sensor node would be higher than the communication radius of sensor node. Besides, the schemes in [4–6, 8, 14, 15] are not secure as they claimed and susceptible to security threats. Therefore, the proposed scheme is more suitable for realistic environments.Table 6
Comparison of communication overheads between our scheme and other schemes.
Scheme Messages required Total Bits Scheme [4] 4 messages 2592 bits Scheme [5] 4 messages 2272 bits Scheme [6] 4 messages 2016 bits Scheme [8] 3 messages 1728 bits Scheme [14] 4 messages 1312 bits Scheme [15] 3 messages 1504 bits our scheme 5 messages 1824 bits


## 6. Conclusion

In this paper, we first briefly review the related authentication schemes for healthcare monitoring, and the security drawbacks of these schemes are pointed out. Specifically, all the schemes using lightweight cryptographic primitives fail to provide forward secrecy and suffer from the desynchronization attack. To overcome the historical security problems, a lightweight and secure three-factor authentication scheme using oBWNs is proposed. The security of the proposed scheme is proved by rigorous formal proof using the BAN logic model. Through the heuristic way, we have proven that the proposed scheme can not only provide some excellent security and functional features, but also resist various malicious attacks, such as desynchronization attack and mobile device loss attack. Comparing with the state-of-the-art schemes, the low computation and communication costs as well as high security make the proposed scheme more suitable for remote patient monitoring in oBWNs-based systems.



---

*Source: 8145087-2019-06-02.xml*