# Fog-Driven Secure Authentication and Key Exchange Scheme for Wearable Health Monitoring System

Authors: Tsu-Yang Wu; Lei Yang; Qian Meng; Xinglan Guo; Chien-Ming Chen
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Smart wearable devices, as a popular mobile device, have a broad market. Smart wearable medical devices implemented in wearable health monitoring systems can monitor the data pertaining to a patient’s body and let the patient know their own physical condition. In addition, these data can be stored, analyzed, and processed in the cloud to effectively prevent diseases. As an Internet-of-things technology, fog computing can process, store, and control data around devices in real time. However, the distributed attributes of fog nodes make the monitored body data and medical reports at risk of privacy disclosure. In this paper, we propose a fog-driven secure authentication and key exchange scheme for wearable health monitoring systems. Furthermore, we conduct a formal analysis using the Real-Oracle-Random model, Burrows–Abadi–Needham logic, and ProVerif tools and an informal analysis to perform security verification. Finally, a performance comparison with other related schemes shows that the proposed scheme has the best advantages in terms of security, computing overhead, and communication cost.


---

## Body

## 1. Introduction

The Internet of things (IoT) [1, 2] refers to the communication, transmission, analysis, and control between things through the Internet. In other words, the IoT is an expansion and extension of the Internet, providing various devices with the ability to communicate. Smart mobile devices, as popular IoT devices, have entered the stage of commercialization, and their development is relatively mature. Smart mobile devices, such as smart watches, smart glasses, and smart helmets, have been widely used in the fields of medical health and reasonable sports. Owing to the rapid development of mobile medical platforms and increasing attention to physical health, smart wearable medical devices (SWMDs) have a broad market in the field of artificial intelligence [3–6]. In addition, SWMDs have the advantages of simple operation, reduced treatment costs, and prevention of diseases. As a specific application of SWMDs, wearable health monitoring systems are of great significance to both doctors and patients. Patients can evaluate their health in real time without visiting a hospital. SWMDs can monitor blood pressure, heart rate, sleep status, and other indicators. Patients with hypertension, coronary heart disease, and other chronic diseases need not visit a hospital frequently for examinations, thereby saving a significant amount of time and reducing the cost of diagnosis. Doctors can provide timely feedback on the health status based on the SWMDs worn by patients. Furthermore, using the information uploaded by SWMDs, doctors can better understand the data pertaining to a patient’s body data to obtain more accurate diagnosis results. From the perspective of medical resources, the application of wearable health monitoring systems reduces the number of patients seeking medical treatment and alleviates problems regarding the lack of hospital beds.As a relatively mature IoT technology, fog computing can extend cloud services to the edge of a network. The principle of fog computing and cloud computing is to upload data for analysis, storage, and processing. The difference is that cloud computing uploads all data to the same center, and fog computing disperses the data to many central nodes. When the data load is too large, cloud computing cannot meet the application requirements of high mobility and low latency. For example, SWMDs are placed far from the cloud server, and transmission delays occur when patients need a real-time diagnosis. As an extension of cloud computing, fog computing can process, store, and control data around devices in real time. Fog nodes are deployed between the cloud and SWMDs, and these are located at a low position in the network topology and have less network delay. Figure1 shows the typical structure of a fog-based wearable health monitoring system.Figure 1
A typical structure of a fog-based wearable health monitoring system.In this structure, SWMDs and fog nodes need to register with the cloud server to obtain a legal identity before being used. Fog nodes are deployed between the cloud server and the users of SWMDs. These users send the data pertaining to their body to the fog node through the communication protocol. After filtering and aggregating the received information, fog nodes send it to the cloud server through a wireless network. The cloud server analyzes and stores the received body data and then returns the diagnosis results in real time through the fog node.


### 1.1. Related Work

Wearable health monitoring systems have significant practical value in medical health monitoring. SWMDs can monitor the basic information and health data of patients and transmit these data to medical staff. During the transmission process, if the health data or diagnostic records are intercepted or tampered with by an adversary, then the lives of patients can be directly impacted. Many authentication and key agreement (AKA) protocols for SWMDs have been proposed. In 2008, Venkatasubramanian et al. [7] designed an AKA scheme based on electrocardiogram (ECG) data transmission for patients with heart diseases in body sensor networks. In 2009, Sriram et al. [8] used a wearable ECG sensor to monitor biometric ECGs for verifying the identity of patients in remote health monitoring. Venkatasubramanian et al. [9] proposed an AKA scheme based on the physiological signal in the body area network, which can realize secure communication between sensors without initialization or pre-deployment. In 2013, Hu et al. [10] proposed an AKA scheme based on ordered physiological features in wireless body area networks. This scheme does not require initialization or the pre-deployment phase and can calculate the biological characteristics according to the physiological signals of different parts of the human body. In 2017, Masdari et al. [11] reported that the scheme proposed in [7] has a high time complexity and low security. During the process of message transmission, the scheme in [10] has a lower energy consumption and smaller storage space than the scheme in [9], but they have similar efficiency and time variance in generating keys.SWMDs are the key applications of IoT technology, in which identity AKA is of great significance in protecting the security of health data. Therefore, privacy protection [12–16] has become an important security attribute of the protocols proposed by researchers. In 2017, to ensure anonymity and low energy consumption, Zhang et al. [17] designed an AKA scheme based on dynamic authentication and three factors for an e-health system. In the same year, Li et al. [18] designed a lightweight, centralized, and two-hop anonymous AKA scheme for wireless body area networks. In 2018, Chen et al. [19] showed that the scheme proposed in [18] is vulnerable to offline identity guessing attacks, sensor node impersonation attacks, and hub node spoofing attacks. Subsequently, they improved Li et al.’s scheme. Koya and Deepthi [20] found that the scheme in [18] is vulnerable to sensor node impersonation attacks and that the assumption that hub nodes are trustworthy is not feasible. Therefore, they provided an anonymous two-way AKA scheme for wireless body area networks. In 2019, Kompara et al. [21] reported that the scheme in [18] does not provide untraceability for sensor nodes, and thus they proposed a robust and efficient AKA scheme with untraceability in wireless body area networks. In the same year, Aghili et al. [22] found that the scheme in [17] fails to resist user traceability attacks, desynchronization attacks, denial-of-service attacks, and internal attacks. Further, they proposed a new lightweight AKA and ownership transfer scheme for e-health systems in an IoT environment. In 2020, Sowjanya et al. [23] conducted cryptanalysis on the scheme proposed in [18] and found that it cannot support perfect forward security and key control and is vulnerable to desynchronous attacks. To overcome these limitations, an enhanced anonymous AKA protocol [23] in a wearable health monitoring system was proposed.SWMDs using IoT technologies, such as cloud computing and fog computing, also participate in the AKA process of wearable health monitoring systems. In 2019, Jia et al. [24] proposed a fog-driven AKA scheme for IoT medical systems. In the same year, Wazid et al. [25] designed a secure AKA scheme based on fog computing. In 2020, Chen et al. [26] showed that the scheme in [24] suffers from ephemeral secret leakage attacks and proposed a secure AKA scheme based on fog computing. In 2021, Shamshad et al. [27] reported that the scheme in [24] is vulnerable to impersonation attacks and cannot provide anonymity for users and fog nodes. Wu et al. [28] also reported that the scheme in [24] exhibits security vulnerabilities, such as known session-specific temporary information attacks and a lack of pre-verification. Thus, they proposed an improved fog-driven AKA scheme for IoT medical systems. In the same year, Ali et al. [29] analyzed and determined that the scheme in [25] is vulnerable to traceability and clogging attacks. Therefore, they proposed an anti-clogging AKA scheme based on fog computing. Some important related works are summarized in Table 1.Table 1
Cryptographic techniques and limitations.
SchemeCryptographic techniquesLimitationsZhang et al. [12](i) Utilized one-way hash function(ii) Dynamic string generating algorithm(i) Does not resist user traceability attacks(ii) Does not resist desynchronization attacks(iii) Does not resist denial-of-service attacks(iv) Does not resist internal attacksLi et al. [13](i) Utilized one-way hash function(i) Does not resist offline identity guessing attacks(ii) Does not resist sensor node impersonation attacks(iii) Does not resist hub node spoofing attacks(iv) Does not provide untraceability(v) Does not resist desynchronization attacks(vi) Does not provide perfect forward security(vii) Does not provide key controlJia et al. [19](i) Utilized one-way hash function(ii) Based on bilinear pairings(iii) Based on Diffie–Hellman problem(i) Does not resist ephemeral secret leakage attacks(ii) Does not resist impersonation attacks(iii) Does not resist known session-specific temporary information attacks(iv) Does not provide anonymity(v) Does not provide pre-verificationWazid et al. [20](i) Utilized one-way hash function(ii) Utilized ECC(i) Does not provide traceability(ii) Does not resist clogging attacks


### 1.2. Our Contribution

According to the earlier analysis, medical health monitoring systems based on fog computing need further improvement. We propose a fog-driven secure authentication and key exchange scheme for wearable health monitoring systems to ensure the security and privacy of the monitoring information and diagnostic reports of SWMDs.(1)
Our scheme can provide user device anonymity, fog node anonymity, and perfect forward security and resist replay attacks, impersonation attacks, known session-specific temporary information attacks, and insider attacks.(2)
Using the Real-Oracle-Random (ROR) model, we provide the probability of breaking the symmetric encryption and decryption algorithms and prove that our protocol has a secure authentication process and session key. By using the Burrows–Abadi–Needham (BAN) logic, ProVerif tools, and an informal analysis, we prove that the security of the proposed protocol can resist all known attacks.(3)
The proposed protocol and five related protocols are analyzed for performance evaluation. We find that the proposed protocol has advantages in terms of security, computing overhead, and communication cost.


### 1.3. Paper Organization

The remainder of this paper is organized as follows. Section2 describes the proposed security scheme in detail. Section 3 presents the verification of the security of the proposed scheme, including a formal analysis using the Real-Oracle-Random (ROR) model, BAN logic, and ProVerif tool and an informal analysis. In Section 4, the performance of the proposed scheme is analyzed and compared with those of five related schemes. The conclusions are presented in Section 5.


## 1.1. Related Work

Wearable health monitoring systems have significant practical value in medical health monitoring. SWMDs can monitor the basic information and health data of patients and transmit these data to medical staff. During the transmission process, if the health data or diagnostic records are intercepted or tampered with by an adversary, then the lives of patients can be directly impacted. Many authentication and key agreement (AKA) protocols for SWMDs have been proposed. In 2008, Venkatasubramanian et al. [7] designed an AKA scheme based on electrocardiogram (ECG) data transmission for patients with heart diseases in body sensor networks. In 2009, Sriram et al. [8] used a wearable ECG sensor to monitor biometric ECGs for verifying the identity of patients in remote health monitoring. Venkatasubramanian et al. [9] proposed an AKA scheme based on the physiological signal in the body area network, which can realize secure communication between sensors without initialization or pre-deployment. In 2013, Hu et al. [10] proposed an AKA scheme based on ordered physiological features in wireless body area networks. This scheme does not require initialization or the pre-deployment phase and can calculate the biological characteristics according to the physiological signals of different parts of the human body. In 2017, Masdari et al. [11] reported that the scheme proposed in [7] has a high time complexity and low security. During the process of message transmission, the scheme in [10] has a lower energy consumption and smaller storage space than the scheme in [9], but they have similar efficiency and time variance in generating keys.SWMDs are the key applications of IoT technology, in which identity AKA is of great significance in protecting the security of health data. Therefore, privacy protection [12–16] has become an important security attribute of the protocols proposed by researchers. In 2017, to ensure anonymity and low energy consumption, Zhang et al. [17] designed an AKA scheme based on dynamic authentication and three factors for an e-health system. In the same year, Li et al. [18] designed a lightweight, centralized, and two-hop anonymous AKA scheme for wireless body area networks. In 2018, Chen et al. [19] showed that the scheme proposed in [18] is vulnerable to offline identity guessing attacks, sensor node impersonation attacks, and hub node spoofing attacks. Subsequently, they improved Li et al.’s scheme. Koya and Deepthi [20] found that the scheme in [18] is vulnerable to sensor node impersonation attacks and that the assumption that hub nodes are trustworthy is not feasible. Therefore, they provided an anonymous two-way AKA scheme for wireless body area networks. In 2019, Kompara et al. [21] reported that the scheme in [18] does not provide untraceability for sensor nodes, and thus they proposed a robust and efficient AKA scheme with untraceability in wireless body area networks. In the same year, Aghili et al. [22] found that the scheme in [17] fails to resist user traceability attacks, desynchronization attacks, denial-of-service attacks, and internal attacks. Further, they proposed a new lightweight AKA and ownership transfer scheme for e-health systems in an IoT environment. In 2020, Sowjanya et al. [23] conducted cryptanalysis on the scheme proposed in [18] and found that it cannot support perfect forward security and key control and is vulnerable to desynchronous attacks. To overcome these limitations, an enhanced anonymous AKA protocol [23] in a wearable health monitoring system was proposed.SWMDs using IoT technologies, such as cloud computing and fog computing, also participate in the AKA process of wearable health monitoring systems. In 2019, Jia et al. [24] proposed a fog-driven AKA scheme for IoT medical systems. In the same year, Wazid et al. [25] designed a secure AKA scheme based on fog computing. In 2020, Chen et al. [26] showed that the scheme in [24] suffers from ephemeral secret leakage attacks and proposed a secure AKA scheme based on fog computing. In 2021, Shamshad et al. [27] reported that the scheme in [24] is vulnerable to impersonation attacks and cannot provide anonymity for users and fog nodes. Wu et al. [28] also reported that the scheme in [24] exhibits security vulnerabilities, such as known session-specific temporary information attacks and a lack of pre-verification. Thus, they proposed an improved fog-driven AKA scheme for IoT medical systems. In the same year, Ali et al. [29] analyzed and determined that the scheme in [25] is vulnerable to traceability and clogging attacks. Therefore, they proposed an anti-clogging AKA scheme based on fog computing. Some important related works are summarized in Table 1.Table 1
Cryptographic techniques and limitations.
SchemeCryptographic techniquesLimitationsZhang et al. [12](i) Utilized one-way hash function(ii) Dynamic string generating algorithm(i) Does not resist user traceability attacks(ii) Does not resist desynchronization attacks(iii) Does not resist denial-of-service attacks(iv) Does not resist internal attacksLi et al. [13](i) Utilized one-way hash function(i) Does not resist offline identity guessing attacks(ii) Does not resist sensor node impersonation attacks(iii) Does not resist hub node spoofing attacks(iv) Does not provide untraceability(v) Does not resist desynchronization attacks(vi) Does not provide perfect forward security(vii) Does not provide key controlJia et al. [19](i) Utilized one-way hash function(ii) Based on bilinear pairings(iii) Based on Diffie–Hellman problem(i) Does not resist ephemeral secret leakage attacks(ii) Does not resist impersonation attacks(iii) Does not resist known session-specific temporary information attacks(iv) Does not provide anonymity(v) Does not provide pre-verificationWazid et al. [20](i) Utilized one-way hash function(ii) Utilized ECC(i) Does not provide traceability(ii) Does not resist clogging attacks


## 1.2. Our Contribution

According to the earlier analysis, medical health monitoring systems based on fog computing need further improvement. We propose a fog-driven secure authentication and key exchange scheme for wearable health monitoring systems to ensure the security and privacy of the monitoring information and diagnostic reports of SWMDs.(1)
Our scheme can provide user device anonymity, fog node anonymity, and perfect forward security and resist replay attacks, impersonation attacks, known session-specific temporary information attacks, and insider attacks.(2)
Using the Real-Oracle-Random (ROR) model, we provide the probability of breaking the symmetric encryption and decryption algorithms and prove that our protocol has a secure authentication process and session key. By using the Burrows–Abadi–Needham (BAN) logic, ProVerif tools, and an informal analysis, we prove that the security of the proposed protocol can resist all known attacks.(3)
The proposed protocol and five related protocols are analyzed for performance evaluation. We find that the proposed protocol has advantages in terms of security, computing overhead, and communication cost.


## 1.3. Paper Organization

The remainder of this paper is organized as follows. Section2 describes the proposed security scheme in detail. Section 3 presents the verification of the security of the proposed scheme, including a formal analysis using the Real-Oracle-Random (ROR) model, BAN logic, and ProVerif tool and an informal analysis. In Section 4, the performance of the proposed scheme is analyzed and compared with those of five related schemes. The conclusions are presented in Section 5.


## 2. Proposed Scheme

The proposed scheme involves three entities: wearable deviceWi, fog node Fj, and cloud server CS. The entire scheme consists of four phases: initialization, SWMD registration, fog node registration, and AKA. The symbols used are listed in Table 2.Table 2
Symbols and descriptions.
SymbolDescriptionWiSmart wearable medical deviceFjFog nodeCSCloud serverAAdversarysPrivate key ofCSEk⋅Symmetric encryption functionDk⋅Symmetric decryption functionh⋅Hash function‖Connect operation⊕Exclusive or operation


### 2.1. Initialization

CS completes the initialization of the functions and defines the required parameters involved in the scheme. CS chooses its own secret key, s, and defines the one-way hash function, h⋅, and the symmetric encryption and decryption function, Ek⋅/Dk⋅. Then, CS publishes h⋅,Ek⋅/Dk⋅.


### 2.2. SWMD Registration Phase

SWMDs worn by users must be registered with the cloud server before being used.Wi inputs identity IDW and password PWW, generates a random number, rW, and calculates RPWW=hIDWPWWrW. Wi sends IDW,RPWW to CS. After CS receives the request, it generates a random number, sW, and calculates RIDW=hIDWsWs⊕hIDW‖RPWW. Subsequently, CS stores RIDW,IDW,sW in the database and sends RIDW,sW to Wi. After receiving the response, Wi calculates PW=rW⊕hIDWPWWRIDW and RW=hRPWWPWsW‖RIDW and stores PW,RW,RIDW,sW in memory. The wearable device registration phase is shown in Figure 2.Figure 2
SWMD registration phase.


### 2.3. Fog Node Registration Phase

Fog nodes must register with the cloud service before collecting and transmitting user data.Fj inputs identity IDF, generates a random number, rF, and calculates QF=hIDF‖rF. Fj sends IDF,QF to CS. After CS receives the request, it generates a random number, sF, and calculates RIDF=hsF‖s⊕hIDF‖QF. Subsequently, CS stores RIDF,sF in the database and sends RIDF,sF to Fj. After receiving the response, Fj calculates PF=rF⊕hIDFsFRIDF and stores PF,RIDF,sF in memory. The fog node registration phase is shown in Figure 3.Figure 3
Fog node registration phase.


### 2.4. Authentication and Key Exchange Phase

The SWMD regularly uploads the data pertaining to the user’s physical condition to the nearby fog node, which pre-processes the data and then sends it to CS. After receiving the user’s body data, CS provides timely feedback to the SWMD through the fog node. The details are as follows.(1)
Wi inputs IDWandPWW, calculates rW=PW⊕hIDWPWWRIDW and RPWW=hIDWPWWrW, and checks RW=?hRPWWPWsW‖RIDW. If the equation does not hold, the session is terminated. Otherwise, Wi selects a, calculates V1=a⊕RIDW⊕hIDW‖RPWW and V2=haIDWRIDWRIDFV1, and sends M1=V1,V2,RIDW to Fj.(2)
After receivingM1, Fj selects b and calculates rF=PF⊕hIDFsFRIDF, QF=hIDF‖rF, V3=b⊕RIDF⊕hIDF‖QF, and V4=hbsFRIDWRIDFV3. Then, Fj sends M2=V1,V2,RIDW,V3,V4,RIDF to CS.(3)
After receivingM2, CS finds the corresponding IDW,sW and sF in the database according to RIDW and RIDF, respectively. CS calculates a=V1⊕hIDWsWs and b=V3⊕hsF‖s and checks V2=?haIDWRIDWRIDFV1 and V4=?hbIDWRIDWRIDFV3. If the equations do not hold, the session is terminated. Otherwise, CS selects c, calculates sW′=c⊕hRIDWsWa, sF′=c⊕hRIDFsFb, and RIDW′=hIDWsW′s, and updates RIDW′,IDW,sW′ and RIDF,sF′ in the database. Further, CS computes V5=hRIDWIDWsWand V6=hRIDF‖sF and encrypts E1=ERIDW⊕hIDWsWsb,c,sW′,RIDW′,RIDF,V5and E2=ERIDF⊕hsF‖sa,c,sF′,RIDW′,V6. Finally, CS computes the session key, SKc=habcRIDW′RIDF, and sends M3=E1,E2 to Fj.(4)
After receivingM3, Fj calculates VF′=hRIDF‖sF, decrypts (a,c,sF′,RIDW′,V6=DhIDF‖QFE2), and checks V6′=?V6. If the equation does not hold, the session is terminated. Otherwise, Fj updates RIDF,sF′ in the memory, computes SKf=habc‖RIDW′/parallelRIDF, and sends M4=E1 to Wi.(5)
After receivingM4, Wi calculates V5′=hRIDWIDWsW, decrypts b,c,sW′,RIDW′,RIDF,V5=DhIDW‖RPWWE1, and checks V5′=?V5. If the equation does not hold, the session is terminated. Otherwise, Wi updates RIDW′,sW′ in the memory and computes SKw=habcRIDW′RIDF.Wi and CS complete mutual AKA through Fj, and RIDW,sW,sF is updated simultaneously. The authentication and key exchange phase is shown in Figure 4.Figure 4
Authentication and key exchange phase.


## 2.1. Initialization

CS completes the initialization of the functions and defines the required parameters involved in the scheme. CS chooses its own secret key, s, and defines the one-way hash function, h⋅, and the symmetric encryption and decryption function, Ek⋅/Dk⋅. Then, CS publishes h⋅,Ek⋅/Dk⋅.


## 2.2. SWMD Registration Phase

SWMDs worn by users must be registered with the cloud server before being used.Wi inputs identity IDW and password PWW, generates a random number, rW, and calculates RPWW=hIDWPWWrW. Wi sends IDW,RPWW to CS. After CS receives the request, it generates a random number, sW, and calculates RIDW=hIDWsWs⊕hIDW‖RPWW. Subsequently, CS stores RIDW,IDW,sW in the database and sends RIDW,sW to Wi. After receiving the response, Wi calculates PW=rW⊕hIDWPWWRIDW and RW=hRPWWPWsW‖RIDW and stores PW,RW,RIDW,sW in memory. The wearable device registration phase is shown in Figure 2.Figure 2
SWMD registration phase.


## 2.3. Fog Node Registration Phase

Fog nodes must register with the cloud service before collecting and transmitting user data.Fj inputs identity IDF, generates a random number, rF, and calculates QF=hIDF‖rF. Fj sends IDF,QF to CS. After CS receives the request, it generates a random number, sF, and calculates RIDF=hsF‖s⊕hIDF‖QF. Subsequently, CS stores RIDF,sF in the database and sends RIDF,sF to Fj. After receiving the response, Fj calculates PF=rF⊕hIDFsFRIDF and stores PF,RIDF,sF in memory. The fog node registration phase is shown in Figure 3.Figure 3
Fog node registration phase.


## 2.4. Authentication and Key Exchange Phase

The SWMD regularly uploads the data pertaining to the user’s physical condition to the nearby fog node, which pre-processes the data and then sends it to CS. After receiving the user’s body data, CS provides timely feedback to the SWMD through the fog node. The details are as follows.(1)
Wi inputs IDWandPWW, calculates rW=PW⊕hIDWPWWRIDW and RPWW=hIDWPWWrW, and checks RW=?hRPWWPWsW‖RIDW. If the equation does not hold, the session is terminated. Otherwise, Wi selects a, calculates V1=a⊕RIDW⊕hIDW‖RPWW and V2=haIDWRIDWRIDFV1, and sends M1=V1,V2,RIDW to Fj.(2)
After receivingM1, Fj selects b and calculates rF=PF⊕hIDFsFRIDF, QF=hIDF‖rF, V3=b⊕RIDF⊕hIDF‖QF, and V4=hbsFRIDWRIDFV3. Then, Fj sends M2=V1,V2,RIDW,V3,V4,RIDF to CS.(3)
After receivingM2, CS finds the corresponding IDW,sW and sF in the database according to RIDW and RIDF, respectively. CS calculates a=V1⊕hIDWsWs and b=V3⊕hsF‖s and checks V2=?haIDWRIDWRIDFV1 and V4=?hbIDWRIDWRIDFV3. If the equations do not hold, the session is terminated. Otherwise, CS selects c, calculates sW′=c⊕hRIDWsWa, sF′=c⊕hRIDFsFb, and RIDW′=hIDWsW′s, and updates RIDW′,IDW,sW′ and RIDF,sF′ in the database. Further, CS computes V5=hRIDWIDWsWand V6=hRIDF‖sF and encrypts E1=ERIDW⊕hIDWsWsb,c,sW′,RIDW′,RIDF,V5and E2=ERIDF⊕hsF‖sa,c,sF′,RIDW′,V6. Finally, CS computes the session key, SKc=habcRIDW′RIDF, and sends M3=E1,E2 to Fj.(4)
After receivingM3, Fj calculates VF′=hRIDF‖sF, decrypts (a,c,sF′,RIDW′,V6=DhIDF‖QFE2), and checks V6′=?V6. If the equation does not hold, the session is terminated. Otherwise, Fj updates RIDF,sF′ in the memory, computes SKf=habc‖RIDW′/parallelRIDF, and sends M4=E1 to Wi.(5)
After receivingM4, Wi calculates V5′=hRIDWIDWsW, decrypts b,c,sW′,RIDW′,RIDF,V5=DhIDW‖RPWWE1, and checks V5′=?V5. If the equation does not hold, the session is terminated. Otherwise, Wi updates RIDW′,sW′ in the memory and computes SKw=habcRIDW′RIDF.Wi and CS complete mutual AKA through Fj, and RIDW,sW,sF is updated simultaneously. The authentication and key exchange phase is shown in Figure 4.Figure 4
Authentication and key exchange phase.


## 3. Security Analysis

### 3.1. Formal Proof

In the ROR model [30, 31], some queries are used to verify the security robustness of the proposed scheme. In the scheme, participants Wi, Fj, and CS generate many communication instances in the process of interaction. For the convenience of proof, we define ∏​Wx, ∏​Fy, and ∏​CSz as the x-th instance of Wi, y-th instance of Fj, and z-th instance of CS, respectively.


#### 3.1.1. Queries

In this model, the queries used by adversaryA are defined as follows.(1)
Execute∏​Wx,∏​Fy,∏​CSz: the query passively captures the information transmitted by entities in the public channel and outputs message records.(2)
Hashstr: the query inputs string str and outputs the corresponding hash value.(3)
Send∏​Wx,∏​Fy,∏​CSz,M: the query actively intercepts information transmitted between entities in the public channel and forges them as M. Then, A sends M to ∏​Wx,∏​Fy, or ∏​CSz and receives the corresponding response.(4)
Corrupt∏​Wx,∏​Fy,∏​CSz: the query can capture a private value in an entity, such as the private key of CS or a random number.(5)
Test∏​Wx,∏​Fy,∏​CSz: in this model, coin o is tossed randomly. If o = 1, the correct session key is returned; otherwise, a random string of the same length as the session key is returned.


#### 3.1.2. Definitions

Symmetric Encryption and Decryption Algorithm (Ω). Here, we specify the security key in the symmetric encryption and decryption algorithm as k, which includes k1, k2, …, kn. Each key corresponds to an independent encryption oracle: Ek1, Ek2, …, Ekn. Then, in polynomial time ξ, the advantage that A can break k is AdvAΩ,kξ=2PrA←Ek1;b0,b1←A;α←0,1;β←Ek1bα:Aβ=α−1. For a sufficiently small number, γ, we have AdvAΩ,kξ<γ.


#### 3.1.3. Theorem

A has the ability to operate Execute, Hash, Send, Corrupt, and Test queries. Then, in polynomial time ξ, the advantage that A can break the proposed scheme, S, is AdvASξ≤qhash2/2l−1+qsend/2l−1+2C′⋅qsends′+2AdvAΩ,kξ, where qhash and qsend are the times of Hash and Send queries, respectively, l is the length of the hash value, and C′ and s′ are constants.Proof.
The game sequence,GM0−GM6, is defined to verify the security robustness of S. Here, SuccAGMnξ is the event that A wins in GMn. The proof is as follows.
GM0: in this round of the game, A simulates a real attack and does not launch any query. We derive that(1)AdvASξ=2PrSuccAGM0ξ−1.
GM1: in this round of the game, A launches an Execute query. Because of the properties of the query itself, A only passively receives messages M1=V1,V2,RIDW, M2=V1,V2,RIDW,V3,V4,RIDF, M3=E1,E2, and M4=E1. Thus, we have(2)PrSuccAGM1ξ=PrSuccAGM0ξ.
GM2: in this round of the game, A launches a Hash query. According to the birthday paradox, the probability of a hash conflict occurring in a query is(3)PrSuccAGM2ξ−PrSuccAGM1ξ≤qhash22l+1,where l is the length of a hash value.
GM3: in this round of the game, A launches a Send query. According to Zipf’s law [32], the probability of a transmission text collision in the query is(4)PrSuccAGM3ξ−PrSuccAGM2ξ≤qsend2l.
GM4: in this round of the game, A attempts to make offline password-guessing attacks. A launches a Corrupt∏​Wx query to obtain parameters PW,RW,RIDW,sW in the memory of the wearable device, where PW=rW⊕hIDWPWWRIDW, RW=hRPWWPW‖sWRIDW, and RIDW=hIDWsWs⊕hIDW‖RPWW. In this calculation process, because rW and RPWW are unknown, A cannot calculate identity IDW and password PWW. According to Zipf’s law [32], it can be deduced that(5)PrSuccAGM4ξ−PrSuccAGM3ξ≤C′⋅qsends′,where C′ and s′ are constants.
GM5: the purpose of this game round is to verify the security of the session key. We divide it into the following two cases.(1)
Perfect Forward Security. A launches a Corrupt∏​CSz query to obtain the private key, s, of CS.(2)
Known Session-Specific Temporary Information Attacks. A launches a Corrupt∏​Wx, Corrupt∏​Fy, or Corrupt∏​CSz query to obtain one of the random numbers.
The session key ofS is SK=habcRIDW′RIDF. In the first case, A knows s and cannot calculate parameters a,b,c,RIDW′ needed in the session key. In the second case, based on the assumption that A obtains random number c, a,b,RIDW′ cannot be calculated. The same is true for a or b. To summarize, if A wants to calculate the session key, it must decrypt symmetrically on E1 or E2, that is,(6)PrSuccAGM5ξ−PrSuccAGM4ξ≤AdvAΩ,kξ.
GM6: in this round of game, A attempts to make impersonation attacks. A launches a habcRIDW′RIDF query, and the probability of successfully guessing the key is(7)PrSuccAGM6ξ−PrSuccAGM5ξ≤qhash22l+1.
Because the probability ofA guessing the key correctly and incorrectly is equal, we have(8)PrSuccAGM6ξ=12.
According to formulas (1)–(8), we have(9)12AdvASξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤∑i=05PrSuccAGMi+1ξ−PrSuccAGMiξ=qhash22l+qsend2l+C′⋅qsends′+AdvAΩ,kξ.
Further derivation yields the result asAdvASξ≤qhash2/2l−1+qsend/2l−1+2C′⋅qsends′+2AdvAΩ,kξ.


### 3.2. BAN Logic

BAN logic [33, 34] is often used to describe and prove the logic and correctness of cryptographic protocols. Before describing the logical reasoning of BAN, we define the symbols and idealize the interactive information. Furthermore, based on the concrete proof, the initial condition assumptions are made, and the set goals are finally obtained by reasoning.


#### 3.2.1. Rules

(1)
Message-meaning (M-M) rule:P|≡P⟶KQ,PXK/P≡Q∼X, P|≡P⇌YQ,P◁XY/P≡Q∼X.(2)
Nonce-verification (N-V) rule:P|≡#X,P≡Q∼X/P≡Q≡X.(3)
Jurisdiction rule:P≡Q⇒X,P|≡Q|≡X/P|≡X.(4)
Session key (S-K) rule:P|≡#X,P≡Q∣≡X/P|≡P↔KQ.(5)
Freshness rule:P|≡#X/P|≡#X,Y.


#### 3.2.2. Goals

(1)
G1: Wi|≡Wi⟶SKFj.(2)
G2: Fj|≡Wi⟶SKFj.(3)
G3: CS|≡Wi⟶SKFj.(4)
G4: Wi≡Fj≡Wi⟶SKFj.(5)
G5: Fj≡Wi≡Wi⟶SKFj.(6)
G6: CS≡Wi≡Wi⟶SKFj.(7)
G7: CS≡Fj≡Wi⟶SKFj.


#### 3.2.3. Idealizing the Communication Messages

(1)
M1: Wi⟶CS:V1,V2,RIDW.(2)
M2: Fj⟶CS:V3,V4,RIDF.(3)
M3: CS⟶Wi:E1.(4)
M4: CS⟶Fj:E2.


#### 3.2.4. Initial Assumptions

(1)
A1: CS|≡CS⇌RPWWWi.(2)
A2: CS|≡#a.(3)
A3: CS≡Wi⇒a.(4)
A4: CS|≡CS⇌QFFj.(5)
A5: CS|≡#b.(6)
A6: CS≡Fj⇒b.(7)
A7: CS|≡RIDW′.(8)
A8: CS|≡RIDF.(9)
A9: Wi|≡Wi⇌hIDW∥RPWWCS.(10)
A10: Wi|≡#c.(11)
A11: Wi≡CS⇒b,c,sW′,RIDW′,RIDF.(12)
A12: Fj|≡#b.(13)
A13: Fj|≡Fj⇌hIDF∥QFCS.(14)
A14: Fj|≡#c.(15)
A15: Fi≡CS⇒a,c,sF′,RIDW′.(16)
A16: Wi|≡#a.


#### 3.2.5. Detailed Proof

FromM1, we can obtain S1:CS◁V1:a,IDWRPWW,V2,RIDW. After simplification, it becomes S2:CS◁a,IDWRPWW. Based on A1 and S2, using the M-M rule, we obtain S3:CS|≡Wi∣∼a,IDW. Based on further derivation, we obtain S4:CS|≡Wi∣∼a. According to A2 and S4, using the N-V rule, we obtain S5:CS≡Wi≡a. Additionally, based on A3 and S5, using the jurisdiction rule, we obtain S6:CS|≡a.FromM2, we can obtain S7:CS◁V3:b,IDFQF,V4,RIDF. After simplification, it becomes S8:CS◁b,IDFQF. According to A4 and S8, using the M-M rule, we obtain S9:CS∣≡Fj∣∼b,IDF. Based on further derivation, we obtain S10:CS∣≡Fj∣∼b. Based on A5 and S10, using the N-V rule, we obtain S11:CS≡Fj≡b. Based on A6 and S11, using the jurisdiction rule, we have S12:CS|≡b. Because SK=habcRIDW′RIDF and based on A7,A8,S6,andS12, we have S13:CS|≡Wi↔SKFj (G3). Based on A2 and S13, using the S-K rule, we have S14:CS≡Wi≡Wi↔SKFj (G6). According to A5 and S14, using the S-K rule, we have S15:CS≡Fj≡Wi↔SKFj (G7).FromM3, we can obtain S16:Wi◁E1:b,c,sW′,RIDW′,RIDFhIDW∥RPWW. According to A9 and S16, using the M-M rule, we obtain S17:Wi≡CS∼b,c,sW′,RIDW′,RIDF. Based on A10 and using the freshness rule, we have S18:Wi|≡#b,c,sW′,RIDW′,RIDF. Based on S17 and S18, using the N-V rule, we obtain S19:Wi≡CS≡b,c,sW′,RIDW′,RIDF. Based on A11 and S19, using the jurisdiction rule, we have S20:Wi|≡b,c,sW′,RIDW′,RIDF. Based on further derivation, we obtain S21:Wi|≡b, S22:Wi|≡c, S23:Wi∣≡RIDW′, and S24:Wi|≡RIDF. Because SK=habcRIDW′RIDF and using S21−S24, we have S2:Wi|≡Wi↔SKFj (G1). Based on A12 and S25, using the S-K rule, we obtain S26:Wi≡Fj≡Wi↔SKFj (G4).FromM4, we can obtain S27:Fj◁E2:a,c,sF′,RIDF′IDF∥QF. Based on A13 and S27, using the M-M rule, we obtain S28:Fj≡CS∼a,c,sF′,RIDW′. According to A14, using the freshness rule, we have S29:Fj|≡#a,c,sF′,RIDW′. Based on S28 and S29, using the N-V rule, we obtain S30:Fj|≡#a,c,sF′,RIDW′. Based on A15 and S30, using the jurisdiction rule, we have S31:Fj|≡#a,c,sF′,RIDW′. Based on further derivation, we obtain S32:Fj|≡a, S33:Fj|≡c, and S34:Fj|≡RIDW′. Because SK=habcRIDW′RIDF and using S32−S34, we have S3:Fj|≡Wi↔SKFj (G2). According to A16 and S35, using the S-K rule, we obtain S36:Fj≡Wi≡Wi↔SKFj (G5).


### 3.3. ProVerif

The formal analysis method has become one of the main protocol analyses in cryptography. ProVerif [35, 36] is a common formal analysis tool that uses logic programming language rules and an automatic reasoning algorithm to determine whether a given event can occur. Therefore, ProVerif verifies protocol confidentiality and supports operations such as hashing, symmetric encryption, and decryption. According to the specific process of the proposed protocol, we use ProVerif for simulation reasoning. The entire simulation process is divided into the declaration, process, event, query, and main function parts.First, as shown in Figure5, we define the public channel, secure channel, constants, variables, and constituent functions. Second, as shown in Figure 6, we declare the queries and the events: Wearable Device Started, Wearable Device Authed, and Wearable Device AcCloud Server indicate that Wi starts authentication, Wi completes authentication, and Wi passes the authentication of CS, respectively. Fog Node AcCloud Server indicates that fog node Fj has passed the authentication of CS. Moreover, Cloud Server AcWearable Device and Cloud Server AcFog Node indicate that CS has passed the authentication of Wi and Fj, respectively.Figure 5
Definitions.Figure 6
Queries and events.Third, as shown in Figure7, we define the process and main function, which includes three processes: Wi, Fj, and CS. After all operations are completed, we run the ProVerif function and obtain the following results.(1)
Query not attacker (SKw) is true.(2)
Query not attacker (SKf) is true.(3)
Query not attacker (SKc) is true.(4)
Queryinj−eventWearableDeviceAuthed==>inj−eventWearable Device Started is true.(5)
Queryinj−eventCloud Server AcFog Node==>inj−eventCloud Server AcWearable Device is true.(6)
Queryinj−eventFog Node AcCloud Server==>inj−eventCloudServer AcFog Node is true.(7)
Queryinj−eventWearable Device AcCloud Sever==>inj−eventFog Node AcCloud Sever is true.Figure 7
Processes.Results (1)–(3) show that the security of the session key is not threatened. Results (4)–(7) show that each process of the three entities is successfully initiated and terminated, and they ensure the correctness of each step of the protocol. Therefore, the proposed protocol has complete authentication steps and good session-key security.


### 3.4. Informal Proof

#### 3.4.1. Insider Attacks

SupposeA obtains PW,RW,RIDW,sW in Wi’s memory and calculates the session key. Then, A needs to obtain the key, hIDW‖RPWW, used for symmetric decryption between Wi and CS, where RPWW=hIDWPWWrW. Because PWW and rW are unknown, A cannot calculate the session key. Suppose A obtains PF,RIDF,sF in Fj’s memory and calculates the session key. Then, A needs to obtain key hIDF‖QF used for symmetric decryption between Fj and CS, where QF=hIDF‖rF. Because rF is unknown, A cannot calculate the session key. Suppose A obtains RIDW,IDW,sW,RIDF,sF in CS’s database and calculates the session key. Then, A needs to obtain the master key s of CS, which is used to calculate the private information a=V1⊕hIDWsWs and the keyRIDW⊕hIDWsWs for symmetric decryption between Wi and CS and the private information b=V3⊕hsF‖s and the key RIDF⊕hsF‖s for symmetric decryption between Fj and CS. Because s is known only by CS and A cannot obtain it, the session key cannot be calculated. Therefore, the scheme is resistant to internal attacks.


#### 3.4.2. Man-in-the-Middle Attacks

SupposeA intercepts messages M1=V1,V2,RIDW and M2=V1,V2,RIDW,V3,V4,RIDF and forges them to pass the authentication of CS and then intercepts M3=E1,E2 and M4=E1 and forges CS to pass the authentication of Fj and Wi, respectively. First, assume that A forges the message from Wi. CS determines the identity of Wi by verifying V2=?haIDWRIDWRIDFV1, where IDW is stored in the registration phase, and A cannot be obtained in the authentication phase. Second, assume that A forges the message from Fj. CS determines the identity of Fj by verifying V4=?hbsFRIDWRIDFV3, where sF is stored in the registration phase, and A cannot be obtained in the authentication phase. In other words, A cannot pass the verification at the CS end and cannot continue to intercept M3 and M4. Therefore, the proposed scheme successfully resists man-in-the-middle attacks.


#### 3.4.3. Replay Attacks

A attempts to replay messages M1=V1,V2,RIDWM2=V1,V2,RIDW,V3,V4,RIDF, M3=E1,E2, and M4=E1 in the public channel. M1 and M2 are updated with random numbers a and b, respectively, and A cannot obtain a and b. M3 and M4 are updated by random numbers a,b,andc, and A cannot replay. Even if A replays these messages, it will cause the session to terminate. Therefore, the proposed scheme can resist replay attacks.


#### 3.4.4. Anonymity and Untraceability

In the proposed protocol, the identities ofWi and Fj are not transmitted directly to the public channel. Moreover, IDW and IDF are protected by hIDWPWWrW and hIDF‖rF, respectively. Therefore, A cannot know the real identities of Wi and Fj during the entire authentication process and cannot trace them by intercepting information. Therefore, the proposed scheme provides device anonymity and fog node anonymity.


#### 3.4.5. Clogging Attacks

A attempts to launch clogging attacks by forging request message M2=V1,V2,RIDW,V3,V4,RIDF. A can select random numbers a,b and calculate V1=a⊕RIDW⊕hIDW‖RPWW, V2=haIDWRIDWRIDFV1, V3=b⊕RIDF⊕hIDF‖QF, and V4=hbsFRIDWRIDFV3. To calculate these four verification values, A also needsIDW, RPWW, IDF, rF, and sF. However, the identity information (IDW,IDF) is confidential, and RPWW is only known by Wi, and rF,sF are updated in each communication. In other words, A cannot construct V1, V2, V3, V4 and make them pass the verification of CS. Therefore, our scheme can resist clogging attacks.


## 3.1. Formal Proof

In the ROR model [30, 31], some queries are used to verify the security robustness of the proposed scheme. In the scheme, participants Wi, Fj, and CS generate many communication instances in the process of interaction. For the convenience of proof, we define ∏​Wx, ∏​Fy, and ∏​CSz as the x-th instance of Wi, y-th instance of Fj, and z-th instance of CS, respectively.


### 3.1.1. Queries

In this model, the queries used by adversaryA are defined as follows.(1)
Execute∏​Wx,∏​Fy,∏​CSz: the query passively captures the information transmitted by entities in the public channel and outputs message records.(2)
Hashstr: the query inputs string str and outputs the corresponding hash value.(3)
Send∏​Wx,∏​Fy,∏​CSz,M: the query actively intercepts information transmitted between entities in the public channel and forges them as M. Then, A sends M to ∏​Wx,∏​Fy, or ∏​CSz and receives the corresponding response.(4)
Corrupt∏​Wx,∏​Fy,∏​CSz: the query can capture a private value in an entity, such as the private key of CS or a random number.(5)
Test∏​Wx,∏​Fy,∏​CSz: in this model, coin o is tossed randomly. If o = 1, the correct session key is returned; otherwise, a random string of the same length as the session key is returned.


### 3.1.2. Definitions

Symmetric Encryption and Decryption Algorithm (Ω). Here, we specify the security key in the symmetric encryption and decryption algorithm as k, which includes k1, k2, …, kn. Each key corresponds to an independent encryption oracle: Ek1, Ek2, …, Ekn. Then, in polynomial time ξ, the advantage that A can break k is AdvAΩ,kξ=2PrA←Ek1;b0,b1←A;α←0,1;β←Ek1bα:Aβ=α−1. For a sufficiently small number, γ, we have AdvAΩ,kξ<γ.


### 3.1.3. Theorem

A has the ability to operate Execute, Hash, Send, Corrupt, and Test queries. Then, in polynomial time ξ, the advantage that A can break the proposed scheme, S, is AdvASξ≤qhash2/2l−1+qsend/2l−1+2C′⋅qsends′+2AdvAΩ,kξ, where qhash and qsend are the times of Hash and Send queries, respectively, l is the length of the hash value, and C′ and s′ are constants.Proof.
The game sequence,GM0−GM6, is defined to verify the security robustness of S. Here, SuccAGMnξ is the event that A wins in GMn. The proof is as follows.
GM0: in this round of the game, A simulates a real attack and does not launch any query. We derive that(1)AdvASξ=2PrSuccAGM0ξ−1.
GM1: in this round of the game, A launches an Execute query. Because of the properties of the query itself, A only passively receives messages M1=V1,V2,RIDW, M2=V1,V2,RIDW,V3,V4,RIDF, M3=E1,E2, and M4=E1. Thus, we have(2)PrSuccAGM1ξ=PrSuccAGM0ξ.
GM2: in this round of the game, A launches a Hash query. According to the birthday paradox, the probability of a hash conflict occurring in a query is(3)PrSuccAGM2ξ−PrSuccAGM1ξ≤qhash22l+1,where l is the length of a hash value.
GM3: in this round of the game, A launches a Send query. According to Zipf’s law [32], the probability of a transmission text collision in the query is(4)PrSuccAGM3ξ−PrSuccAGM2ξ≤qsend2l.
GM4: in this round of the game, A attempts to make offline password-guessing attacks. A launches a Corrupt∏​Wx query to obtain parameters PW,RW,RIDW,sW in the memory of the wearable device, where PW=rW⊕hIDWPWWRIDW, RW=hRPWWPW‖sWRIDW, and RIDW=hIDWsWs⊕hIDW‖RPWW. In this calculation process, because rW and RPWW are unknown, A cannot calculate identity IDW and password PWW. According to Zipf’s law [32], it can be deduced that(5)PrSuccAGM4ξ−PrSuccAGM3ξ≤C′⋅qsends′,where C′ and s′ are constants.
GM5: the purpose of this game round is to verify the security of the session key. We divide it into the following two cases.(1)
Perfect Forward Security. A launches a Corrupt∏​CSz query to obtain the private key, s, of CS.(2)
Known Session-Specific Temporary Information Attacks. A launches a Corrupt∏​Wx, Corrupt∏​Fy, or Corrupt∏​CSz query to obtain one of the random numbers.
The session key ofS is SK=habcRIDW′RIDF. In the first case, A knows s and cannot calculate parameters a,b,c,RIDW′ needed in the session key. In the second case, based on the assumption that A obtains random number c, a,b,RIDW′ cannot be calculated. The same is true for a or b. To summarize, if A wants to calculate the session key, it must decrypt symmetrically on E1 or E2, that is,(6)PrSuccAGM5ξ−PrSuccAGM4ξ≤AdvAΩ,kξ.
GM6: in this round of game, A attempts to make impersonation attacks. A launches a habcRIDW′RIDF query, and the probability of successfully guessing the key is(7)PrSuccAGM6ξ−PrSuccAGM5ξ≤qhash22l+1.
Because the probability ofA guessing the key correctly and incorrectly is equal, we have(8)PrSuccAGM6ξ=12.
According to formulas (1)–(8), we have(9)12AdvASξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤∑i=05PrSuccAGMi+1ξ−PrSuccAGMiξ=qhash22l+qsend2l+C′⋅qsends′+AdvAΩ,kξ.
Further derivation yields the result asAdvASξ≤qhash2/2l−1+qsend/2l−1+2C′⋅qsends′+2AdvAΩ,kξ.


## 3.1.1. Queries

In this model, the queries used by adversaryA are defined as follows.(1)
Execute∏​Wx,∏​Fy,∏​CSz: the query passively captures the information transmitted by entities in the public channel and outputs message records.(2)
Hashstr: the query inputs string str and outputs the corresponding hash value.(3)
Send∏​Wx,∏​Fy,∏​CSz,M: the query actively intercepts information transmitted between entities in the public channel and forges them as M. Then, A sends M to ∏​Wx,∏​Fy, or ∏​CSz and receives the corresponding response.(4)
Corrupt∏​Wx,∏​Fy,∏​CSz: the query can capture a private value in an entity, such as the private key of CS or a random number.(5)
Test∏​Wx,∏​Fy,∏​CSz: in this model, coin o is tossed randomly. If o = 1, the correct session key is returned; otherwise, a random string of the same length as the session key is returned.


## 3.1.2. Definitions

Symmetric Encryption and Decryption Algorithm (Ω). Here, we specify the security key in the symmetric encryption and decryption algorithm as k, which includes k1, k2, …, kn. Each key corresponds to an independent encryption oracle: Ek1, Ek2, …, Ekn. Then, in polynomial time ξ, the advantage that A can break k is AdvAΩ,kξ=2PrA←Ek1;b0,b1←A;α←0,1;β←Ek1bα:Aβ=α−1. For a sufficiently small number, γ, we have AdvAΩ,kξ<γ.


## 3.1.3. Theorem

A has the ability to operate Execute, Hash, Send, Corrupt, and Test queries. Then, in polynomial time ξ, the advantage that A can break the proposed scheme, S, is AdvASξ≤qhash2/2l−1+qsend/2l−1+2C′⋅qsends′+2AdvAΩ,kξ, where qhash and qsend are the times of Hash and Send queries, respectively, l is the length of the hash value, and C′ and s′ are constants.Proof.
The game sequence,GM0−GM6, is defined to verify the security robustness of S. Here, SuccAGMnξ is the event that A wins in GMn. The proof is as follows.
GM0: in this round of the game, A simulates a real attack and does not launch any query. We derive that(1)AdvASξ=2PrSuccAGM0ξ−1.
GM1: in this round of the game, A launches an Execute query. Because of the properties of the query itself, A only passively receives messages M1=V1,V2,RIDW, M2=V1,V2,RIDW,V3,V4,RIDF, M3=E1,E2, and M4=E1. Thus, we have(2)PrSuccAGM1ξ=PrSuccAGM0ξ.
GM2: in this round of the game, A launches a Hash query. According to the birthday paradox, the probability of a hash conflict occurring in a query is(3)PrSuccAGM2ξ−PrSuccAGM1ξ≤qhash22l+1,where l is the length of a hash value.
GM3: in this round of the game, A launches a Send query. According to Zipf’s law [32], the probability of a transmission text collision in the query is(4)PrSuccAGM3ξ−PrSuccAGM2ξ≤qsend2l.
GM4: in this round of the game, A attempts to make offline password-guessing attacks. A launches a Corrupt∏​Wx query to obtain parameters PW,RW,RIDW,sW in the memory of the wearable device, where PW=rW⊕hIDWPWWRIDW, RW=hRPWWPW‖sWRIDW, and RIDW=hIDWsWs⊕hIDW‖RPWW. In this calculation process, because rW and RPWW are unknown, A cannot calculate identity IDW and password PWW. According to Zipf’s law [32], it can be deduced that(5)PrSuccAGM4ξ−PrSuccAGM3ξ≤C′⋅qsends′,where C′ and s′ are constants.
GM5: the purpose of this game round is to verify the security of the session key. We divide it into the following two cases.(1)
Perfect Forward Security. A launches a Corrupt∏​CSz query to obtain the private key, s, of CS.(2)
Known Session-Specific Temporary Information Attacks. A launches a Corrupt∏​Wx, Corrupt∏​Fy, or Corrupt∏​CSz query to obtain one of the random numbers.
The session key ofS is SK=habcRIDW′RIDF. In the first case, A knows s and cannot calculate parameters a,b,c,RIDW′ needed in the session key. In the second case, based on the assumption that A obtains random number c, a,b,RIDW′ cannot be calculated. The same is true for a or b. To summarize, if A wants to calculate the session key, it must decrypt symmetrically on E1 or E2, that is,(6)PrSuccAGM5ξ−PrSuccAGM4ξ≤AdvAΩ,kξ.
GM6: in this round of game, A attempts to make impersonation attacks. A launches a habcRIDW′RIDF query, and the probability of successfully guessing the key is(7)PrSuccAGM6ξ−PrSuccAGM5ξ≤qhash22l+1.
Because the probability ofA guessing the key correctly and incorrectly is equal, we have(8)PrSuccAGM6ξ=12.
According to formulas (1)–(8), we have(9)12AdvASξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM6ξ=PrSuccAGM1ξ−PrSuccAGM6ξ≤∑i=05PrSuccAGMi+1ξ−PrSuccAGMiξ=qhash22l+qsend2l+C′⋅qsends′+AdvAΩ,kξ.
Further derivation yields the result asAdvASξ≤qhash2/2l−1+qsend/2l−1+2C′⋅qsends′+2AdvAΩ,kξ.


## 3.2. BAN Logic

BAN logic [33, 34] is often used to describe and prove the logic and correctness of cryptographic protocols. Before describing the logical reasoning of BAN, we define the symbols and idealize the interactive information. Furthermore, based on the concrete proof, the initial condition assumptions are made, and the set goals are finally obtained by reasoning.


### 3.2.1. Rules

(1)
Message-meaning (M-M) rule:P|≡P⟶KQ,PXK/P≡Q∼X, P|≡P⇌YQ,P◁XY/P≡Q∼X.(2)
Nonce-verification (N-V) rule:P|≡#X,P≡Q∼X/P≡Q≡X.(3)
Jurisdiction rule:P≡Q⇒X,P|≡Q|≡X/P|≡X.(4)
Session key (S-K) rule:P|≡#X,P≡Q∣≡X/P|≡P↔KQ.(5)
Freshness rule:P|≡#X/P|≡#X,Y.


### 3.2.2. Goals

(1)
G1: Wi|≡Wi⟶SKFj.(2)
G2: Fj|≡Wi⟶SKFj.(3)
G3: CS|≡Wi⟶SKFj.(4)
G4: Wi≡Fj≡Wi⟶SKFj.(5)
G5: Fj≡Wi≡Wi⟶SKFj.(6)
G6: CS≡Wi≡Wi⟶SKFj.(7)
G7: CS≡Fj≡Wi⟶SKFj.


### 3.2.3. Idealizing the Communication Messages

(1)
M1: Wi⟶CS:V1,V2,RIDW.(2)
M2: Fj⟶CS:V3,V4,RIDF.(3)
M3: CS⟶Wi:E1.(4)
M4: CS⟶Fj:E2.


### 3.2.4. Initial Assumptions

(1)
A1: CS|≡CS⇌RPWWWi.(2)
A2: CS|≡#a.(3)
A3: CS≡Wi⇒a.(4)
A4: CS|≡CS⇌QFFj.(5)
A5: CS|≡#b.(6)
A6: CS≡Fj⇒b.(7)
A7: CS|≡RIDW′.(8)
A8: CS|≡RIDF.(9)
A9: Wi|≡Wi⇌hIDW∥RPWWCS.(10)
A10: Wi|≡#c.(11)
A11: Wi≡CS⇒b,c,sW′,RIDW′,RIDF.(12)
A12: Fj|≡#b.(13)
A13: Fj|≡Fj⇌hIDF∥QFCS.(14)
A14: Fj|≡#c.(15)
A15: Fi≡CS⇒a,c,sF′,RIDW′.(16)
A16: Wi|≡#a.


### 3.2.5. Detailed Proof

FromM1, we can obtain S1:CS◁V1:a,IDWRPWW,V2,RIDW. After simplification, it becomes S2:CS◁a,IDWRPWW. Based on A1 and S2, using the M-M rule, we obtain S3:CS|≡Wi∣∼a,IDW. Based on further derivation, we obtain S4:CS|≡Wi∣∼a. According to A2 and S4, using the N-V rule, we obtain S5:CS≡Wi≡a. Additionally, based on A3 and S5, using the jurisdiction rule, we obtain S6:CS|≡a.FromM2, we can obtain S7:CS◁V3:b,IDFQF,V4,RIDF. After simplification, it becomes S8:CS◁b,IDFQF. According to A4 and S8, using the M-M rule, we obtain S9:CS∣≡Fj∣∼b,IDF. Based on further derivation, we obtain S10:CS∣≡Fj∣∼b. Based on A5 and S10, using the N-V rule, we obtain S11:CS≡Fj≡b. Based on A6 and S11, using the jurisdiction rule, we have S12:CS|≡b. Because SK=habcRIDW′RIDF and based on A7,A8,S6,andS12, we have S13:CS|≡Wi↔SKFj (G3). Based on A2 and S13, using the S-K rule, we have S14:CS≡Wi≡Wi↔SKFj (G6). According to A5 and S14, using the S-K rule, we have S15:CS≡Fj≡Wi↔SKFj (G7).FromM3, we can obtain S16:Wi◁E1:b,c,sW′,RIDW′,RIDFhIDW∥RPWW. According to A9 and S16, using the M-M rule, we obtain S17:Wi≡CS∼b,c,sW′,RIDW′,RIDF. Based on A10 and using the freshness rule, we have S18:Wi|≡#b,c,sW′,RIDW′,RIDF. Based on S17 and S18, using the N-V rule, we obtain S19:Wi≡CS≡b,c,sW′,RIDW′,RIDF. Based on A11 and S19, using the jurisdiction rule, we have S20:Wi|≡b,c,sW′,RIDW′,RIDF. Based on further derivation, we obtain S21:Wi|≡b, S22:Wi|≡c, S23:Wi∣≡RIDW′, and S24:Wi|≡RIDF. Because SK=habcRIDW′RIDF and using S21−S24, we have S2:Wi|≡Wi↔SKFj (G1). Based on A12 and S25, using the S-K rule, we obtain S26:Wi≡Fj≡Wi↔SKFj (G4).FromM4, we can obtain S27:Fj◁E2:a,c,sF′,RIDF′IDF∥QF. Based on A13 and S27, using the M-M rule, we obtain S28:Fj≡CS∼a,c,sF′,RIDW′. According to A14, using the freshness rule, we have S29:Fj|≡#a,c,sF′,RIDW′. Based on S28 and S29, using the N-V rule, we obtain S30:Fj|≡#a,c,sF′,RIDW′. Based on A15 and S30, using the jurisdiction rule, we have S31:Fj|≡#a,c,sF′,RIDW′. Based on further derivation, we obtain S32:Fj|≡a, S33:Fj|≡c, and S34:Fj|≡RIDW′. Because SK=habcRIDW′RIDF and using S32−S34, we have S3:Fj|≡Wi↔SKFj (G2). According to A16 and S35, using the S-K rule, we obtain S36:Fj≡Wi≡Wi↔SKFj (G5).


## 3.2.1. Rules

(1)
Message-meaning (M-M) rule:P|≡P⟶KQ,PXK/P≡Q∼X, P|≡P⇌YQ,P◁XY/P≡Q∼X.(2)
Nonce-verification (N-V) rule:P|≡#X,P≡Q∼X/P≡Q≡X.(3)
Jurisdiction rule:P≡Q⇒X,P|≡Q|≡X/P|≡X.(4)
Session key (S-K) rule:P|≡#X,P≡Q∣≡X/P|≡P↔KQ.(5)
Freshness rule:P|≡#X/P|≡#X,Y.


## 3.2.2. Goals

(1)
G1: Wi|≡Wi⟶SKFj.(2)
G2: Fj|≡Wi⟶SKFj.(3)
G3: CS|≡Wi⟶SKFj.(4)
G4: Wi≡Fj≡Wi⟶SKFj.(5)
G5: Fj≡Wi≡Wi⟶SKFj.(6)
G6: CS≡Wi≡Wi⟶SKFj.(7)
G7: CS≡Fj≡Wi⟶SKFj.


## 3.2.3. Idealizing the Communication Messages

(1)
M1: Wi⟶CS:V1,V2,RIDW.(2)
M2: Fj⟶CS:V3,V4,RIDF.(3)
M3: CS⟶Wi:E1.(4)
M4: CS⟶Fj:E2.


## 3.2.4. Initial Assumptions

(1)
A1: CS|≡CS⇌RPWWWi.(2)
A2: CS|≡#a.(3)
A3: CS≡Wi⇒a.(4)
A4: CS|≡CS⇌QFFj.(5)
A5: CS|≡#b.(6)
A6: CS≡Fj⇒b.(7)
A7: CS|≡RIDW′.(8)
A8: CS|≡RIDF.(9)
A9: Wi|≡Wi⇌hIDW∥RPWWCS.(10)
A10: Wi|≡#c.(11)
A11: Wi≡CS⇒b,c,sW′,RIDW′,RIDF.(12)
A12: Fj|≡#b.(13)
A13: Fj|≡Fj⇌hIDF∥QFCS.(14)
A14: Fj|≡#c.(15)
A15: Fi≡CS⇒a,c,sF′,RIDW′.(16)
A16: Wi|≡#a.


## 3.2.5. Detailed Proof

FromM1, we can obtain S1:CS◁V1:a,IDWRPWW,V2,RIDW. After simplification, it becomes S2:CS◁a,IDWRPWW. Based on A1 and S2, using the M-M rule, we obtain S3:CS|≡Wi∣∼a,IDW. Based on further derivation, we obtain S4:CS|≡Wi∣∼a. According to A2 and S4, using the N-V rule, we obtain S5:CS≡Wi≡a. Additionally, based on A3 and S5, using the jurisdiction rule, we obtain S6:CS|≡a.FromM2, we can obtain S7:CS◁V3:b,IDFQF,V4,RIDF. After simplification, it becomes S8:CS◁b,IDFQF. According to A4 and S8, using the M-M rule, we obtain S9:CS∣≡Fj∣∼b,IDF. Based on further derivation, we obtain S10:CS∣≡Fj∣∼b. Based on A5 and S10, using the N-V rule, we obtain S11:CS≡Fj≡b. Based on A6 and S11, using the jurisdiction rule, we have S12:CS|≡b. Because SK=habcRIDW′RIDF and based on A7,A8,S6,andS12, we have S13:CS|≡Wi↔SKFj (G3). Based on A2 and S13, using the S-K rule, we have S14:CS≡Wi≡Wi↔SKFj (G6). According to A5 and S14, using the S-K rule, we have S15:CS≡Fj≡Wi↔SKFj (G7).FromM3, we can obtain S16:Wi◁E1:b,c,sW′,RIDW′,RIDFhIDW∥RPWW. According to A9 and S16, using the M-M rule, we obtain S17:Wi≡CS∼b,c,sW′,RIDW′,RIDF. Based on A10 and using the freshness rule, we have S18:Wi|≡#b,c,sW′,RIDW′,RIDF. Based on S17 and S18, using the N-V rule, we obtain S19:Wi≡CS≡b,c,sW′,RIDW′,RIDF. Based on A11 and S19, using the jurisdiction rule, we have S20:Wi|≡b,c,sW′,RIDW′,RIDF. Based on further derivation, we obtain S21:Wi|≡b, S22:Wi|≡c, S23:Wi∣≡RIDW′, and S24:Wi|≡RIDF. Because SK=habcRIDW′RIDF and using S21−S24, we have S2:Wi|≡Wi↔SKFj (G1). Based on A12 and S25, using the S-K rule, we obtain S26:Wi≡Fj≡Wi↔SKFj (G4).FromM4, we can obtain S27:Fj◁E2:a,c,sF′,RIDF′IDF∥QF. Based on A13 and S27, using the M-M rule, we obtain S28:Fj≡CS∼a,c,sF′,RIDW′. According to A14, using the freshness rule, we have S29:Fj|≡#a,c,sF′,RIDW′. Based on S28 and S29, using the N-V rule, we obtain S30:Fj|≡#a,c,sF′,RIDW′. Based on A15 and S30, using the jurisdiction rule, we have S31:Fj|≡#a,c,sF′,RIDW′. Based on further derivation, we obtain S32:Fj|≡a, S33:Fj|≡c, and S34:Fj|≡RIDW′. Because SK=habcRIDW′RIDF and using S32−S34, we have S3:Fj|≡Wi↔SKFj (G2). According to A16 and S35, using the S-K rule, we obtain S36:Fj≡Wi≡Wi↔SKFj (G5).


## 3.3. ProVerif

The formal analysis method has become one of the main protocol analyses in cryptography. ProVerif [35, 36] is a common formal analysis tool that uses logic programming language rules and an automatic reasoning algorithm to determine whether a given event can occur. Therefore, ProVerif verifies protocol confidentiality and supports operations such as hashing, symmetric encryption, and decryption. According to the specific process of the proposed protocol, we use ProVerif for simulation reasoning. The entire simulation process is divided into the declaration, process, event, query, and main function parts.First, as shown in Figure5, we define the public channel, secure channel, constants, variables, and constituent functions. Second, as shown in Figure 6, we declare the queries and the events: Wearable Device Started, Wearable Device Authed, and Wearable Device AcCloud Server indicate that Wi starts authentication, Wi completes authentication, and Wi passes the authentication of CS, respectively. Fog Node AcCloud Server indicates that fog node Fj has passed the authentication of CS. Moreover, Cloud Server AcWearable Device and Cloud Server AcFog Node indicate that CS has passed the authentication of Wi and Fj, respectively.Figure 5
Definitions.Figure 6
Queries and events.Third, as shown in Figure7, we define the process and main function, which includes three processes: Wi, Fj, and CS. After all operations are completed, we run the ProVerif function and obtain the following results.(1)
Query not attacker (SKw) is true.(2)
Query not attacker (SKf) is true.(3)
Query not attacker (SKc) is true.(4)
Queryinj−eventWearableDeviceAuthed==>inj−eventWearable Device Started is true.(5)
Queryinj−eventCloud Server AcFog Node==>inj−eventCloud Server AcWearable Device is true.(6)
Queryinj−eventFog Node AcCloud Server==>inj−eventCloudServer AcFog Node is true.(7)
Queryinj−eventWearable Device AcCloud Sever==>inj−eventFog Node AcCloud Sever is true.Figure 7
Processes.Results (1)–(3) show that the security of the session key is not threatened. Results (4)–(7) show that each process of the three entities is successfully initiated and terminated, and they ensure the correctness of each step of the protocol. Therefore, the proposed protocol has complete authentication steps and good session-key security.


## 3.4. Informal Proof

### 3.4.1. Insider Attacks

SupposeA obtains PW,RW,RIDW,sW in Wi’s memory and calculates the session key. Then, A needs to obtain the key, hIDW‖RPWW, used for symmetric decryption between Wi and CS, where RPWW=hIDWPWWrW. Because PWW and rW are unknown, A cannot calculate the session key. Suppose A obtains PF,RIDF,sF in Fj’s memory and calculates the session key. Then, A needs to obtain key hIDF‖QF used for symmetric decryption between Fj and CS, where QF=hIDF‖rF. Because rF is unknown, A cannot calculate the session key. Suppose A obtains RIDW,IDW,sW,RIDF,sF in CS’s database and calculates the session key. Then, A needs to obtain the master key s of CS, which is used to calculate the private information a=V1⊕hIDWsWs and the keyRIDW⊕hIDWsWs for symmetric decryption between Wi and CS and the private information b=V3⊕hsF‖s and the key RIDF⊕hsF‖s for symmetric decryption between Fj and CS. Because s is known only by CS and A cannot obtain it, the session key cannot be calculated. Therefore, the scheme is resistant to internal attacks.


### 3.4.2. Man-in-the-Middle Attacks

SupposeA intercepts messages M1=V1,V2,RIDW and M2=V1,V2,RIDW,V3,V4,RIDF and forges them to pass the authentication of CS and then intercepts M3=E1,E2 and M4=E1 and forges CS to pass the authentication of Fj and Wi, respectively. First, assume that A forges the message from Wi. CS determines the identity of Wi by verifying V2=?haIDWRIDWRIDFV1, where IDW is stored in the registration phase, and A cannot be obtained in the authentication phase. Second, assume that A forges the message from Fj. CS determines the identity of Fj by verifying V4=?hbsFRIDWRIDFV3, where sF is stored in the registration phase, and A cannot be obtained in the authentication phase. In other words, A cannot pass the verification at the CS end and cannot continue to intercept M3 and M4. Therefore, the proposed scheme successfully resists man-in-the-middle attacks.


### 3.4.3. Replay Attacks

A attempts to replay messages M1=V1,V2,RIDWM2=V1,V2,RIDW,V3,V4,RIDF, M3=E1,E2, and M4=E1 in the public channel. M1 and M2 are updated with random numbers a and b, respectively, and A cannot obtain a and b. M3 and M4 are updated by random numbers a,b,andc, and A cannot replay. Even if A replays these messages, it will cause the session to terminate. Therefore, the proposed scheme can resist replay attacks.


### 3.4.4. Anonymity and Untraceability

In the proposed protocol, the identities ofWi and Fj are not transmitted directly to the public channel. Moreover, IDW and IDF are protected by hIDWPWWrW and hIDF‖rF, respectively. Therefore, A cannot know the real identities of Wi and Fj during the entire authentication process and cannot trace them by intercepting information. Therefore, the proposed scheme provides device anonymity and fog node anonymity.


### 3.4.5. Clogging Attacks

A attempts to launch clogging attacks by forging request message M2=V1,V2,RIDW,V3,V4,RIDF. A can select random numbers a,b and calculate V1=a⊕RIDW⊕hIDW‖RPWW, V2=haIDWRIDWRIDFV1, V3=b⊕RIDF⊕hIDF‖QF, and V4=hbsFRIDWRIDFV3. To calculate these four verification values, A also needsIDW, RPWW, IDF, rF, and sF. However, the identity information (IDW,IDF) is confidential, and RPWW is only known by Wi, and rF,sF are updated in each communication. In other words, A cannot construct V1, V2, V3, V4 and make them pass the verification of CS. Therefore, our scheme can resist clogging attacks.


## 3.4.1. Insider Attacks

SupposeA obtains PW,RW,RIDW,sW in Wi’s memory and calculates the session key. Then, A needs to obtain the key, hIDW‖RPWW, used for symmetric decryption between Wi and CS, where RPWW=hIDWPWWrW. Because PWW and rW are unknown, A cannot calculate the session key. Suppose A obtains PF,RIDF,sF in Fj’s memory and calculates the session key. Then, A needs to obtain key hIDF‖QF used for symmetric decryption between Fj and CS, where QF=hIDF‖rF. Because rF is unknown, A cannot calculate the session key. Suppose A obtains RIDW,IDW,sW,RIDF,sF in CS’s database and calculates the session key. Then, A needs to obtain the master key s of CS, which is used to calculate the private information a=V1⊕hIDWsWs and the keyRIDW⊕hIDWsWs for symmetric decryption between Wi and CS and the private information b=V3⊕hsF‖s and the key RIDF⊕hsF‖s for symmetric decryption between Fj and CS. Because s is known only by CS and A cannot obtain it, the session key cannot be calculated. Therefore, the scheme is resistant to internal attacks.


## 3.4.2. Man-in-the-Middle Attacks

SupposeA intercepts messages M1=V1,V2,RIDW and M2=V1,V2,RIDW,V3,V4,RIDF and forges them to pass the authentication of CS and then intercepts M3=E1,E2 and M4=E1 and forges CS to pass the authentication of Fj and Wi, respectively. First, assume that A forges the message from Wi. CS determines the identity of Wi by verifying V2=?haIDWRIDWRIDFV1, where IDW is stored in the registration phase, and A cannot be obtained in the authentication phase. Second, assume that A forges the message from Fj. CS determines the identity of Fj by verifying V4=?hbsFRIDWRIDFV3, where sF is stored in the registration phase, and A cannot be obtained in the authentication phase. In other words, A cannot pass the verification at the CS end and cannot continue to intercept M3 and M4. Therefore, the proposed scheme successfully resists man-in-the-middle attacks.


## 3.4.3. Replay Attacks

A attempts to replay messages M1=V1,V2,RIDWM2=V1,V2,RIDW,V3,V4,RIDF, M3=E1,E2, and M4=E1 in the public channel. M1 and M2 are updated with random numbers a and b, respectively, and A cannot obtain a and b. M3 and M4 are updated by random numbers a,b,andc, and A cannot replay. Even if A replays these messages, it will cause the session to terminate. Therefore, the proposed scheme can resist replay attacks.


## 3.4.4. Anonymity and Untraceability

In the proposed protocol, the identities ofWi and Fj are not transmitted directly to the public channel. Moreover, IDW and IDF are protected by hIDWPWWrW and hIDF‖rF, respectively. Therefore, A cannot know the real identities of Wi and Fj during the entire authentication process and cannot trace them by intercepting information. Therefore, the proposed scheme provides device anonymity and fog node anonymity.


## 3.4.5. Clogging Attacks

A attempts to launch clogging attacks by forging request message M2=V1,V2,RIDW,V3,V4,RIDF. A can select random numbers a,b and calculate V1=a⊕RIDW⊕hIDW‖RPWW, V2=haIDWRIDWRIDFV1, V3=b⊕RIDF⊕hIDF‖QF, and V4=hbsFRIDWRIDFV3. To calculate these four verification values, A also needsIDW, RPWW, IDF, rF, and sF. However, the identity information (IDW,IDF) is confidential, and RPWW is only known by Wi, and rF,sF are updated in each communication. In other words, A cannot construct V1, V2, V3, V4 and make them pass the verification of CS. Therefore, our scheme can resist clogging attacks.


## 4. Performance Evaluation

The proposed scheme and five related protocols are analyzed for performance evaluation. These five schemes were proposed by Jia et al. [24], Wazid et al. [25], Chen et al. [26], Wu et al. [28], and Ali et al. [29].


### 4.1. Security Evaluation

Table3 presents the security evaluation. SA1−SA11, respectively, represent insider attacks, offline password-guessing attacks, impersonation attacks, clogging attacks, user anonymity, user untraceability, fog node anonymity, replay attacks, man-in-the-middle attacks, perfect forward security, and known session-specific temporary information attacks. Note that clogging attacks [26] mean that an adversary can force a legitimate user to process a fake request sent by him disguised as a legitimate user, resulting in resource clogging. “√” indicates that it can resist this attack. “χ” indicates that the attack cannot be resisted. According to Table 3, we can see that Jia et al.’s scheme [24] and Wazid et al.’s scheme [25] cannot provide user anonymity and user untraceability. In addition, the scheme in [24] cannot resist impersonation attacks and known session-specific temporary information attacks and cannot provide fog-node anonymity. The scheme in [25] cannot resist clogging attacks. The schemes in [26, 28, 29] and our scheme have good security.Table 3
Security evaluation.
[24][25][26][28][29]Our schemeSA1√√√√√√SA2√√√√√√SA3χ [28]√√√√√SA4√χ [29]√√√√SA5χ [28]χ [29]√√√√SA6χ [28]χ [29]√√√√SA7χ [28]√√√√√SA8√√√√√√SA9√√√√√√SA10√√√√√√SA11χ [28]√√√√√


### 4.2. Computation Cost Evaluation

The evaluation environment was a Windows 10 operating system with an Intel (R) Core (TM) i5-8500 CPU at 3.00 Hz, and the memory was 8G. The development software is IntelliJ idea version 2019.3, which is based on the calls of the Java pairing library, signature library, and symmetric encryption/decryption function. Table4 presents the computation cost evaluation of the AKA phase. Th represents the time of general hash operation, Ta represents the operation time of point addition, Tm represents the operation time of scalar multiplication of elliptic curve, Tfe represents the operation time of fuzzy function, Ts represents the operation time of symmetric encryption and decryption, Tmap represents the operation time of bilinear pair, and Tex represents the operation time of exponential operation. It should be noted that Th=0.004ms, Ta=0.05ms, Tm=8.6ms, Tfe=Tm, Ts=8.2ms, Tmap=10.6ms, and Tex=10.8ms. According to Table 4, it is evident that the computational cost of our proposed scheme is far less than that of the other five schemes. Figure 8 shows the advantages of the proposed scheme in terms of computational cost.Table 4
Computation cost evaluation.
[24][25][26][28][29]Our schemeUser/WD5Th+2Tm+Tmap+Tex≈38.6221Th+Ta+2Tm+Tfe≈25.9348Th+2Tm+Tfe≈25.8327Th+3Tm+Tmap+Tex≈47.22812Th+Ta+4Tm+Tfe≈43.0987Th+Ts≈8.228Fog node4Th+2Tm+Tmap+Tex≈38.61616Th+Ta+3Tm≈25.9146Th+4Tm≈34.4244Th+3Tm+Tmap+Tex≈47.21610Th+Ta+5Tm≈43.096Th+Ts≈8.224CS9Th+3Tm+Tmap+Tex≈47.236—12Th+3Tm≈25.84810Th+4Tm+Tmap+Tex≈55.84—10Th+2Ts≈16.44Device—17Th≈0.068——10Th≈0.04—Total124.472ms51.916ms86.104ms150.284ms86.218ms32.892msFigure 8
Computation cost comparison.


### 4.3. Communication Cost Evaluation

Assume that the point of the elliptic curve occupies 512 bits, the hash operation and symmetric encryption and decryption operation occupy 256 bits, and the timestamp occupies 64 bits. Table5 presents the communication cost evaluation of the AKA phase, where Cp, Ch, Cs, and Ct represent the point, hash operation, symmetric encryption and decryption operation, and timestamp, respectively. According to Table 5, the proposed protocol has the lowest communication cost. Figure 9 shows the advantages of the proposed scheme in terms of communication cost.Table 5
Communication cost evaluation.
RoundsCost (bits)[24]46Cp+9Ch+5Ct = 5696[25]34Cp+10Ch+3Ct = 4800[26]410Cp+9Ch+5Ct = 7744[28]46Cp+9Ch+5Ct = 5696[29]34Ca+10Ch+3Ct = 4800Our scheme49Ch+3Cs = 3072Figure 9
Communication cost comparison.After evaluating our scheme and the other four related schemes in terms of security, computation cost, and communication cost, it is obvious that our scheme has great advantages in these three aspects at the same time. Our scheme not only ensures security but also has the least computation cost and communication cost. Table6 shows the ratio of other related schemes and the proposed scheme in terms of computational performance and communication performance. According to Table 6, [24–26, 28, 29] are, respectively, 378.4%, 157.8%, 261.8%, 456.9%, and 262.1% of the proposed scheme in terms of computational performance and 185.4%, 156.3%, 252.1%, 185.4%, and 156.3% of the proposed scheme in terms of communication performance. Therefore, our scheme has good advantages in performance.Table 6
Performance optimization ratio.
Computational performance speed (times)Communication performance speed (times)Our scheme11[24]3.7841.854[25]1.5781.563[26]2.6182.521[28]4.5691.854[29]2.6211.563


## 4.1. Security Evaluation

Table3 presents the security evaluation. SA1−SA11, respectively, represent insider attacks, offline password-guessing attacks, impersonation attacks, clogging attacks, user anonymity, user untraceability, fog node anonymity, replay attacks, man-in-the-middle attacks, perfect forward security, and known session-specific temporary information attacks. Note that clogging attacks [26] mean that an adversary can force a legitimate user to process a fake request sent by him disguised as a legitimate user, resulting in resource clogging. “√” indicates that it can resist this attack. “χ” indicates that the attack cannot be resisted. According to Table 3, we can see that Jia et al.’s scheme [24] and Wazid et al.’s scheme [25] cannot provide user anonymity and user untraceability. In addition, the scheme in [24] cannot resist impersonation attacks and known session-specific temporary information attacks and cannot provide fog-node anonymity. The scheme in [25] cannot resist clogging attacks. The schemes in [26, 28, 29] and our scheme have good security.Table 3
Security evaluation.
[24][25][26][28][29]Our schemeSA1√√√√√√SA2√√√√√√SA3χ [28]√√√√√SA4√χ [29]√√√√SA5χ [28]χ [29]√√√√SA6χ [28]χ [29]√√√√SA7χ [28]√√√√√SA8√√√√√√SA9√√√√√√SA10√√√√√√SA11χ [28]√√√√√


## 4.2. Computation Cost Evaluation

The evaluation environment was a Windows 10 operating system with an Intel (R) Core (TM) i5-8500 CPU at 3.00 Hz, and the memory was 8G. The development software is IntelliJ idea version 2019.3, which is based on the calls of the Java pairing library, signature library, and symmetric encryption/decryption function. Table4 presents the computation cost evaluation of the AKA phase. Th represents the time of general hash operation, Ta represents the operation time of point addition, Tm represents the operation time of scalar multiplication of elliptic curve, Tfe represents the operation time of fuzzy function, Ts represents the operation time of symmetric encryption and decryption, Tmap represents the operation time of bilinear pair, and Tex represents the operation time of exponential operation. It should be noted that Th=0.004ms, Ta=0.05ms, Tm=8.6ms, Tfe=Tm, Ts=8.2ms, Tmap=10.6ms, and Tex=10.8ms. According to Table 4, it is evident that the computational cost of our proposed scheme is far less than that of the other five schemes. Figure 8 shows the advantages of the proposed scheme in terms of computational cost.Table 4
Computation cost evaluation.
[24][25][26][28][29]Our schemeUser/WD5Th+2Tm+Tmap+Tex≈38.6221Th+Ta+2Tm+Tfe≈25.9348Th+2Tm+Tfe≈25.8327Th+3Tm+Tmap+Tex≈47.22812Th+Ta+4Tm+Tfe≈43.0987Th+Ts≈8.228Fog node4Th+2Tm+Tmap+Tex≈38.61616Th+Ta+3Tm≈25.9146Th+4Tm≈34.4244Th+3Tm+Tmap+Tex≈47.21610Th+Ta+5Tm≈43.096Th+Ts≈8.224CS9Th+3Tm+Tmap+Tex≈47.236—12Th+3Tm≈25.84810Th+4Tm+Tmap+Tex≈55.84—10Th+2Ts≈16.44Device—17Th≈0.068——10Th≈0.04—Total124.472ms51.916ms86.104ms150.284ms86.218ms32.892msFigure 8
Computation cost comparison.


## 4.3. Communication Cost Evaluation

Assume that the point of the elliptic curve occupies 512 bits, the hash operation and symmetric encryption and decryption operation occupy 256 bits, and the timestamp occupies 64 bits. Table5 presents the communication cost evaluation of the AKA phase, where Cp, Ch, Cs, and Ct represent the point, hash operation, symmetric encryption and decryption operation, and timestamp, respectively. According to Table 5, the proposed protocol has the lowest communication cost. Figure 9 shows the advantages of the proposed scheme in terms of communication cost.Table 5
Communication cost evaluation.
RoundsCost (bits)[24]46Cp+9Ch+5Ct = 5696[25]34Cp+10Ch+3Ct = 4800[26]410Cp+9Ch+5Ct = 7744[28]46Cp+9Ch+5Ct = 5696[29]34Ca+10Ch+3Ct = 4800Our scheme49Ch+3Cs = 3072Figure 9
Communication cost comparison.After evaluating our scheme and the other four related schemes in terms of security, computation cost, and communication cost, it is obvious that our scheme has great advantages in these three aspects at the same time. Our scheme not only ensures security but also has the least computation cost and communication cost. Table6 shows the ratio of other related schemes and the proposed scheme in terms of computational performance and communication performance. According to Table 6, [24–26, 28, 29] are, respectively, 378.4%, 157.8%, 261.8%, 456.9%, and 262.1% of the proposed scheme in terms of computational performance and 185.4%, 156.3%, 252.1%, 185.4%, and 156.3% of the proposed scheme in terms of communication performance. Therefore, our scheme has good advantages in performance.Table 6
Performance optimization ratio.
Computational performance speed (times)Communication performance speed (times)Our scheme11[24]3.7841.854[25]1.5781.563[26]2.6182.521[28]4.5691.854[29]2.6211.563


## 5. Conclusion

Researchers have proposed many AKA schemes based on fog computing. Some of these schemes are for the healthcare environment; however, these have low security and high cost consumption. Therefore, we propose a fog-driven secure authentication and key exchange scheme for wearable health monitoring systems. Using a formal analysis, BAN logic, ProVerif tools, and an informal analysis, we find that our scheme can resist known attack methods. The performance comparison with related protocols shows that the proposed scheme has significant advantages in terms of both computational and communication costs. Therefore, our scheme is more suitable for a wearable health monitoring system.



---

*Source: 8368646-2021-10-06.xml*