# Security Improvement on Biometric Based Authentication Scheme for Wireless Sensor Networks Using Fuzzy Extraction

Authors: Younsung Choi; Youngsook Lee; Dongho Won
Journal: International Journal of Distributed Sensor Networks
 (2016)

---

## Abstract

Wireless sensor networks are used to monitor physical or environmental conditions. However, authenticating a user or sensor in wireless sensor networks is more difficult than in traditional networks owing to sensor network characteristics such as unreliable communication networks, resource limitation, and unattended operation. As a result, various authentication schemes have been proposed to provide secure and efficient communication. He et al. suggested a robust biometrics-based user authentication scheme, but Yoon and Kim indicated that their scheme had several security vulnerabilities. The latter then proposed an advanced biometrics-based user authentication scheme; in this paper, we analyze this advanced scheme and perform a cryptanalysis. Our analysis shows that Yoon and Kim’s scheme has various security weaknesses such as a biometric recognition error, a user verification problem, lack of anonymity and perfect forward secrecy, session key exposure by the gateway node, vulnerability to denial of service attacks, and a revocation problem. Therefore, we suggest countermeasures that can be implemented to solve these problems and then propose a security-enhanced biometrics-based user authentication scheme using fuzzy extraction that conforms to the proposed countermeasures. Finally, we conduct a security analysis for the proposed biometrics-based user authentication scheme.


---

## Body

## 1. Introduction

Nowadays, numerous physical, chemical, and biological sensors are deployed in wireless sensor network (WSN) environments for various applications. These sensors can monitor a variety of conditions, including temperature, pressure, military surveillance, and real-time traffic conditions. One benefit of WSNs is that the sensors can be easily deployed in various kinds of harsh environments. Therefore, there has been a remarkable increase in the interest in WSNs [1]. WSNs generally consist of gateways, users, and sensors, and communication security is a momentous concern in real-world applications. Various authentication schemes for WSNs have been proposed for ensuring secure communication.To support confidentiality and authentication for sensor networks, Watro et al. introduced a user authentication scheme employing the RSA and DH algorithms for WSNs in 2004. Wong et al. proposed a dynamic user authentication scheme that used a hash function [2]. But Tseng et al. indicated that Wong et al.’s authentication scheme has vulnerability to replay, stolen-verifier, and forgery attacks [3–7]. Das proposed a two-factor user authentication scheme based on a password and smart card to improve the security in 2009. Das demonstrated his scheme to be secure against various real-time attacks [6]. However, He et al. indicated that Das’s scheme has vulnerability to insider attacks and impersonation attacks and that no provision was available for users to change their passwords. And also He et al. proposed an improved two-factor scheme to solve these security problems [8]. Khan and Alghathbar demonstrated that Das’s scheme did not provide mutual authentication, and it has vulnerability to gateway bypassing and privileged-insider attacks [9]. Chen and Shih indicated that Das’s scheme did not provide mutual authentication between the gateway and the sensor, and Chen and Shih proposed a robust mutual authentication scheme for WSNs and claimed that their scheme provides greater security than Das’s scheme [10]. In 2010, Yuan et al. [11] proposed a biometric-based user authentication scheme, but it was found to have various security problems. Yoon and Yoo pointed out that Yuan et al.’s scheme has vulnerability to insider, user impersonation, gateway node impersonation, and sensor node impersonation attacks. To address these problems, Yoon and Yoo proposed an improved user authentication scheme [12]. However, in 2012, He demonstrated that Yoon and Yoo scheme was still vulnerable to denial of service (DoS) and sensor impersonation attacks. The former then proposed an improved scheme to overcome these security problems [13].In 2013, Yoon and Kim [14] indicated that even He et al.’ scheme had various security vulnerabilities such as poor repair-ability and vulnerability to user and sensor node impersonation attacks. The former then proposed an advanced biometrics-based user authentication scheme for WSNs. They demonstrated that their scheme was more effective and had stronger security than other related schemes [13, 14]. To verify the security of Yoon and Kim’s advanced scheme, we analyzed their scheme and performed a security cryptanalysis. We found that it has various security problems, including a biometric recognition error, a user verification problem, lack of anonymity and perfect forward secrecy, session key exposure by the gateway node, vulnerability to DoS attacks, and a revocation problem. To solve these problems, we first suggest appropriate countermeasures and then propose a biometrics-based user authentication scheme using fuzzy extraction with improved security that conforms to the proposed countermeasures. Moreover, we also conduct a security analysis of 16 security properties for the proposed biometrics-based user authentication scheme.The remainder of this paper is organized as follows. Section2 describes some related work to understand this paper. Section 3 explains Yoon and Kim’s authentication scheme, and Section 4 analyzes their scheme to discuss the inherent security problems. Section 5 explains countermeasures to solve these problems. Section 6 proposes the biometric-based authentication using fuzzy extraction with improved security, and Section 7 presents a security analysis about 16 security properties for the proposed scheme. Section 8 concludes the paper.


## 2. Related Works

### 2.1. Attacker’s Capability

Throughout this paper, we make the following assumptions about the capabilities of a probabilistic, polynomial-time attackerA in order to properly capture the security requirements of the two-factor authentication scheme that uses smart cards in WSNs [15].(i)
A has complete control over all message exchanges between the protocol participants, including a user, a sensor, and the gateway. That is, A can eavesdrop, insert, modify, intercept, and delete messages exchanged among the three parties at will.(ii)
A is able to (1) extract sensitive information from the smart card of a user through a power analysis attack or (2) determine the user’s password possibly via shoulder-surfing or by employing a malicious card reader. However, it is assumed that A is unable to compromise both the information of the smart card and the password of the user. It is otherwise clear that there is no way to prevent A from impersonating the user if both factors have been compromised.


### 2.2. Elliptic Curves Cryptography

Elliptic Curves Cryptography (ECC) is a form of public-key cryptography that is based on the use of algebraic structures of elliptic curves over finite fields. Elliptic curves are also used in several integer factorization algorithms. The important benefit of ECC is that it provides a smaller key size, so ECC can maintain the same degree of security with a smaller key size than other public-key forms of cryptography, such as Rivest Shamir Adleman (RSA), Diffie-Hellman (DH), and Digital Signature Algorithm (DSA). Therefore, ECC is especially useful for wireless devices that are typically limited in terms of their computational ability, power, and network connectivity.ECC has three related mathematical problems: an Elliptic Curve Discrete Logarithm Problem (ECDLP), Elliptic Curve Computational Diffie-Hellman Problem (ECCDHP), and Elliptic Curve Decisional Diffie-Hellman Problem (ECDDHP). No polynomial time algorithm can solve the ECDLP, ECCDHP, and ECDDHP with nonnegligible probability.Letp>3 be a large prime and choose two field elements a,b∈Fp satisfying 4a3+27b2≠0mod⁡p to define the equation of a nonsuper-singular elliptic curve E:y2=x3+ax+bmod⁡p over Fp. Choose a generator point P=(x×P,y×P) whose order is a large prime number q over E(Fp). The subgroup G of the elliptic curve group E(Fp) with order q is constructed in the same way. Then, the three mathematical problems in ECC that are defined in several studies [16–18] are given as follows:(i)
ECDLP: given a point elementQ in G, find an integer x∈Zq∗ such that Q=x×P, where x×P indicates that point P is added to itself x times through an operation with elliptic curves.(ii)
ECCDHP: fora,b∈Zq∗, given two point elements a×P, b×P in G, compute a×b×P in G.(iii)
ECDDHP: fora,b,c∈Zq∗, given three point elements a×P, b×P, and c×P in G, decide whether c×P=a×b×P.In the proposed scheme, we use ECDLP for protectingri and rs. In detail, a user sends Xi=ri×P to the gateway, and the sensor node sends Yi=rs×P to the user for authentication and session key agreement. If an attacker knows ri and rs, he can attempt various attacks. However, the attacker cannot compute ri and rs due to ECDLP even if he steals Xi and Yi from public communication. And in proposed scheme, we use ECCDHP for protecting KUS=KSU=ri×rs×P. In other words, An attacker cannot compute KUS and KSU due to ECCDHP even thought he know Xi and Yi. Only legal user and sensor node can compute KUS and KSU, respectively, using Xi and Yi, and own random number. The user computes KUS=ri×Yi=ri×rs×P and the sensor node computes KSU=rs×Xi=rs×ri×P.


### 2.3. Fuzzy Extraction

The fuzzy extractor converts biometric information into a uniformly random string. Therefore, it is possible to apply cryptographic techniques for biometric security. The extractor consists of a pair of efficient randomized procedures,Gen (generate) and Rep (reproduce). Li et al.’s scheme uses Gen(Bi)=(Ri,Pi) and Ri=Rep(Bi′,Pi) are used. The fuzzy extractor Gen generates Ri and Pi by using a user’s biometric information during the registration phase. Ri is a uniform and random string, and Pi is the helper string; thus, Ri can be the same under the assistance of auxiliary information Pi even if the the biometric information that has been input changes, so long it maintains a reasonably similar status as the original biometric information. As a result, the fuzzy extraction is error-tolerant, and Rep reproduces the Ri using the biometric information that has been newly input Bi′ and Pi in the login phase. To reproduce the same Ri, the metric space distances between Bi and Bi′ have to meet the given verification threshold [19, 20].The basic notation that is used consistently throughout this paper is shown in “Notations.”


## 2.1. Attacker’s Capability

Throughout this paper, we make the following assumptions about the capabilities of a probabilistic, polynomial-time attackerA in order to properly capture the security requirements of the two-factor authentication scheme that uses smart cards in WSNs [15].(i)
A has complete control over all message exchanges between the protocol participants, including a user, a sensor, and the gateway. That is, A can eavesdrop, insert, modify, intercept, and delete messages exchanged among the three parties at will.(ii)
A is able to (1) extract sensitive information from the smart card of a user through a power analysis attack or (2) determine the user’s password possibly via shoulder-surfing or by employing a malicious card reader. However, it is assumed that A is unable to compromise both the information of the smart card and the password of the user. It is otherwise clear that there is no way to prevent A from impersonating the user if both factors have been compromised.


## 2.2. Elliptic Curves Cryptography

Elliptic Curves Cryptography (ECC) is a form of public-key cryptography that is based on the use of algebraic structures of elliptic curves over finite fields. Elliptic curves are also used in several integer factorization algorithms. The important benefit of ECC is that it provides a smaller key size, so ECC can maintain the same degree of security with a smaller key size than other public-key forms of cryptography, such as Rivest Shamir Adleman (RSA), Diffie-Hellman (DH), and Digital Signature Algorithm (DSA). Therefore, ECC is especially useful for wireless devices that are typically limited in terms of their computational ability, power, and network connectivity.ECC has three related mathematical problems: an Elliptic Curve Discrete Logarithm Problem (ECDLP), Elliptic Curve Computational Diffie-Hellman Problem (ECCDHP), and Elliptic Curve Decisional Diffie-Hellman Problem (ECDDHP). No polynomial time algorithm can solve the ECDLP, ECCDHP, and ECDDHP with nonnegligible probability.Letp>3 be a large prime and choose two field elements a,b∈Fp satisfying 4a3+27b2≠0mod⁡p to define the equation of a nonsuper-singular elliptic curve E:y2=x3+ax+bmod⁡p over Fp. Choose a generator point P=(x×P,y×P) whose order is a large prime number q over E(Fp). The subgroup G of the elliptic curve group E(Fp) with order q is constructed in the same way. Then, the three mathematical problems in ECC that are defined in several studies [16–18] are given as follows:(i)
ECDLP: given a point elementQ in G, find an integer x∈Zq∗ such that Q=x×P, where x×P indicates that point P is added to itself x times through an operation with elliptic curves.(ii)
ECCDHP: fora,b∈Zq∗, given two point elements a×P, b×P in G, compute a×b×P in G.(iii)
ECDDHP: fora,b,c∈Zq∗, given three point elements a×P, b×P, and c×P in G, decide whether c×P=a×b×P.In the proposed scheme, we use ECDLP for protectingri and rs. In detail, a user sends Xi=ri×P to the gateway, and the sensor node sends Yi=rs×P to the user for authentication and session key agreement. If an attacker knows ri and rs, he can attempt various attacks. However, the attacker cannot compute ri and rs due to ECDLP even if he steals Xi and Yi from public communication. And in proposed scheme, we use ECCDHP for protecting KUS=KSU=ri×rs×P. In other words, An attacker cannot compute KUS and KSU due to ECCDHP even thought he know Xi and Yi. Only legal user and sensor node can compute KUS and KSU, respectively, using Xi and Yi, and own random number. The user computes KUS=ri×Yi=ri×rs×P and the sensor node computes KSU=rs×Xi=rs×ri×P.


## 2.3. Fuzzy Extraction

The fuzzy extractor converts biometric information into a uniformly random string. Therefore, it is possible to apply cryptographic techniques for biometric security. The extractor consists of a pair of efficient randomized procedures,Gen (generate) and Rep (reproduce). Li et al.’s scheme uses Gen(Bi)=(Ri,Pi) and Ri=Rep(Bi′,Pi) are used. The fuzzy extractor Gen generates Ri and Pi by using a user’s biometric information during the registration phase. Ri is a uniform and random string, and Pi is the helper string; thus, Ri can be the same under the assistance of auxiliary information Pi even if the the biometric information that has been input changes, so long it maintains a reasonably similar status as the original biometric information. As a result, the fuzzy extraction is error-tolerant, and Rep reproduces the Ri using the biometric information that has been newly input Bi′ and Pi in the login phase. To reproduce the same Ri, the metric space distances between Bi and Bi′ have to meet the given verification threshold [19, 20].The basic notation that is used consistently throughout this paper is shown in “Notations.”


## 3. Review of Yoon and Kim’s Authentication Scheme

Yoon and Kim’s authentication scheme includes a registration phase and login and authentication phases. This scheme does not require making changes to a user’s password because this scheme only uses biometrics. The gateway node has two master keys(x and y) and before starting the system, the gateway issues a long-term secret key h(SIDj∥y) to sensor node Sj. x is then used for Ui. During the registration phase, the gateway issues a smart card stored as h(IDi∥x) to Ui [11].


### 3.1. Registration Phase

In the registration phase, a userUi communicates securely with the gateway. Ui sends important information regarding the user’s identification and biometrics. Figure 1 describes the registration phase, and detailed steps are given as follows. First, Ui chooses IDi and imprints his biometrics Bi on the specific sensor device. Then, Ui computes Ei=h(IDi,Ei) and sends IDi and Ei to GW node by using a secure channel. Then, GW node computes two values: Ri=h(IDi∥x)⊕Ei and Vi=h(IDi∥Ei). And the GW node inputs IDi,Ri,Vi,h·,d·,τ into a smart card and sends the smart card to user Ui. h(·) is a one-way hash function. d(·) is a symmetric parametric function and τ is a predetermined threshold for the biometric verification.Figure 1
Registration phase of Yoon and Kim’s scheme.


### 3.2. Login and Authentication Phases

During the login and authentication phases, whenUi enters IDi and Bi into a smart card terminal, the smart card must validate the legitimacy of Ui. Then, Ui, Sj, and GW authenticate each other. This scheme uses three messages M1,M2,M3 during authentication, as shown in Figure 2. Finally, Ui and Sj share the session key sk after the login and authentication phases; Ui and Sj communicate with each other using the session key sk.(1)
Ui inserts his smart card into the card reader and imprints his biometric Bi on a specific device to verify the user’s biometrics.(2)
The smart card computes two values:Ei∗=h(IDi,Bi) and Vi∗=h(IDi∥Ei∗).(3)
The smart card compares the computedVi∗ and the Vi that is stored in the smart card. If d(Vi,Vi∗)≤τ, the user’s smart card stops the login phase. Otherwise, the smart card generates a random number ri.(4)
The smart card computes three values:Di=Ri⊕Ei∗, ki=h(Di∥Ti), and Ci=Eki(IDi∥ri), where Ti is the current timestamps.(5)
Then, the smart card sends the login messageM1=IDi,Ci,Ti to the GW node.Figure 2
Login and authentication phase of Yoon and Kim’s scheme.G
W receives M1 and executes the following actions.(1)
TheGW node checks the freshness of Ti by using (T′-Ti)≤ΔT. ΔT is the expected time interval for the transmission delay. If Ti is not fresh, the GW node rejects the user’s request.(2)
TheGW node computes three values: Di′=h(IDi∥x), ki′=h(Di′∥Ti), and IDi′∥ri′=Dki′(Ci).(3)
TheGW node checks whether IDi and IDi′ are equal. If they are not equal, the GW node stops the session. Otherwise, the GW node picks up the current timestamps Tg.(4)
TheGW node computes two values: kg=h(h(SIDj∥y)∥Tg) and Cg=Ekg(IDi′∥ri′).(5)
TheGW node then computes M2=IDi,Cg,Tg and sends it to the sensor node Sj.S
j receives M2 and performs the following actions.(1)
Sj checks the freshness of Tg using (T′′-Tg)≤ΔT.(2)
Sj computes two values: kg′=h(h(SIDj∥y)∥Tg) and IDi′′∥ri′′=Dkg′(Cg).(3)
Sj checks whether IDi and IDi′′ are equal and Sj picks up the current timestamps Ts.(4)
Sj generates RM and computes Vs. RM is response to the query of Ui; Vs=h(IDi′′∥ri′′∥RM∥Ts).(5)
Sj computes M3=〈RM,Vs,Ts〉 and sends it to the user Ui.U
i receives M3 and executes the following actions.(1)
Ui checks the freshness of Ts using (T′′′-Ts)≤ΔT.(2)
Ui computes Vs′=h(IDi∥ri∥RM∥Ts) and checks whether Vs′ and Vs are the same.(3)
If the entire authentication phase finishes without any problems,Ui accepts RM.(4)
Ui and Sj communicate with each other securely using the session key sk, and Ui and Sj compute sk=h(IDi∥ri∥Ts).


## 3.1. Registration Phase

In the registration phase, a userUi communicates securely with the gateway. Ui sends important information regarding the user’s identification and biometrics. Figure 1 describes the registration phase, and detailed steps are given as follows. First, Ui chooses IDi and imprints his biometrics Bi on the specific sensor device. Then, Ui computes Ei=h(IDi,Ei) and sends IDi and Ei to GW node by using a secure channel. Then, GW node computes two values: Ri=h(IDi∥x)⊕Ei and Vi=h(IDi∥Ei). And the GW node inputs IDi,Ri,Vi,h·,d·,τ into a smart card and sends the smart card to user Ui. h(·) is a one-way hash function. d(·) is a symmetric parametric function and τ is a predetermined threshold for the biometric verification.Figure 1
Registration phase of Yoon and Kim’s scheme.


## 3.2. Login and Authentication Phases

During the login and authentication phases, whenUi enters IDi and Bi into a smart card terminal, the smart card must validate the legitimacy of Ui. Then, Ui, Sj, and GW authenticate each other. This scheme uses three messages M1,M2,M3 during authentication, as shown in Figure 2. Finally, Ui and Sj share the session key sk after the login and authentication phases; Ui and Sj communicate with each other using the session key sk.(1)
Ui inserts his smart card into the card reader and imprints his biometric Bi on a specific device to verify the user’s biometrics.(2)
The smart card computes two values:Ei∗=h(IDi,Bi) and Vi∗=h(IDi∥Ei∗).(3)
The smart card compares the computedVi∗ and the Vi that is stored in the smart card. If d(Vi,Vi∗)≤τ, the user’s smart card stops the login phase. Otherwise, the smart card generates a random number ri.(4)
The smart card computes three values:Di=Ri⊕Ei∗, ki=h(Di∥Ti), and Ci=Eki(IDi∥ri), where Ti is the current timestamps.(5)
Then, the smart card sends the login messageM1=IDi,Ci,Ti to the GW node.Figure 2
Login and authentication phase of Yoon and Kim’s scheme.G
W receives M1 and executes the following actions.(1)
TheGW node checks the freshness of Ti by using (T′-Ti)≤ΔT. ΔT is the expected time interval for the transmission delay. If Ti is not fresh, the GW node rejects the user’s request.(2)
TheGW node computes three values: Di′=h(IDi∥x), ki′=h(Di′∥Ti), and IDi′∥ri′=Dki′(Ci).(3)
TheGW node checks whether IDi and IDi′ are equal. If they are not equal, the GW node stops the session. Otherwise, the GW node picks up the current timestamps Tg.(4)
TheGW node computes two values: kg=h(h(SIDj∥y)∥Tg) and Cg=Ekg(IDi′∥ri′).(5)
TheGW node then computes M2=IDi,Cg,Tg and sends it to the sensor node Sj.S
j receives M2 and performs the following actions.(1)
Sj checks the freshness of Tg using (T′′-Tg)≤ΔT.(2)
Sj computes two values: kg′=h(h(SIDj∥y)∥Tg) and IDi′′∥ri′′=Dkg′(Cg).(3)
Sj checks whether IDi and IDi′′ are equal and Sj picks up the current timestamps Ts.(4)
Sj generates RM and computes Vs. RM is response to the query of Ui; Vs=h(IDi′′∥ri′′∥RM∥Ts).(5)
Sj computes M3=〈RM,Vs,Ts〉 and sends it to the user Ui.U
i receives M3 and executes the following actions.(1)
Ui checks the freshness of Ts using (T′′′-Ts)≤ΔT.(2)
Ui computes Vs′=h(IDi∥ri∥RM∥Ts) and checks whether Vs′ and Vs are the same.(3)
If the entire authentication phase finishes without any problems,Ui accepts RM.(4)
Ui and Sj communicate with each other securely using the session key sk, and Ui and Sj compute sk=h(IDi∥ri∥Ts).


## 4. Cryptanalysis of Yoon and Kim’s Authentication Scheme

### 4.1. Biometric Recognition Error

Yoon and Kim’s authentication scheme uses a one-way hash function to provide biometric verification. This hash function can be used to map the data of an arbitrary size to data of a fixed size with slight differences in the input data producing very large differences in the output data. Figure3 describes the biometric recognition error in Yoon and Kim’s scheme. Biometrics have general limitations such as false acceptance and false rejection. This means that the output of the imprinted biometrics is not always constant. Although Ui inputs its own biometrics to the scanning device, it is possible to output a different ~Bi∗. Therefore, the same biometrics can generate different output, such as the Bi∗ and ~Bi∗. A different ~Bi∗ causes slight differences in Ei∗ and ~Ei∗. Therefore, this difference produces a very large difference between Vi∗ and ~Vi∗ due to the property of hash function. The large difference between Vi∗ and ~Vi∗ causes a biometric recognition error, so a legal user can fail to accept the smart card verification. As a result, advanced techniques are needed to improve the success rate of a legal user’s verification [5].Figure 3
Biometric recognition error on Yoon and Kim’s scheme.


### 4.2. User Verification Problem

In Yoon and Kim’s authentication scheme,GW verifies a legal user by comparing IDi in M1 and IDi′ in the output of the decrypted Ci. Specifically, the user computes Ci using a symmetric encryption algorithm; Ci=Eki(IDi∥ri). IDi and ri do not matter but Eki has a problem in that there is a possibility to obtain unexpected results. This is the reason why Eki is made up by Di and Ti and Di consist of Ri, Ei∗:(1)Ei∗=hIDi,Bi,Di=Ri⊕Ei∗,ki=hDi∥Ti,Ci=EkiIDi∥ri.Even if biometrics are the same, the output of the scanning device is not constant. Therefore, the same biometrics can generate a different output, like ~Bi∗. The different output of the biometrics causes slight differences in Ei∗ and ~Ei∗. Due to these slight differences, different ~Di and ~ki are produced. As a result, the user and GW en/decrypt the Ci using different keys. GW cannot get a normal IDi from Ci so the user is not authenticated by GW even when the user uses its own normal IDi and Bi. This is the reason why the hash function and the symmetric key encryption algorithm have a property that results in large differences due to a slight difference of input. Figure 4 specifically describes the user verification problem in Yoon and Kim’s scheme.Figure 4
User verification problem on Yoon and Kim’s scheme.


### 4.3. Lack of Anonymity

Figure5 describes how Yoon and Kim’s scheme does not provide the anonymity. In this scheme, the user sends its own Ui to GW over public communication, and GW sends Ui to the sensor without any protection. Therefore, an attacker can easily acquire Ui from those communications. This results in an information exposure problem. For the GW’ incoming communication, an attacker can obtain information of the approximate number of registered users to GW. Also an attacker can acquire information on which user communicates with Sj. Therefore, the lack of anonymity in Yoon and Kim’s scheme raises some problems that need to be addressed by providing user anonymity through a protection technique. To solve this problem, it is necessary to use anonymity identification AIDi in the WSNs communication instead of sending a normal IDi [21–23].Figure 5
Lack of anonymity on Yoon and Kim’s scheme.


### 4.4. Lack of Perfect Forward Secrecy

Perfect forward secrecy means that a session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised at some point in the future [24]. Unfortunately, Yoon and Kim’s authentication scheme does not provide perfect forward secrecy. Therefore, an attacker can compute the session key sk between the Ui and Sj if the attacker knows one of the long-term keys Di in the future. The following list describes how Yoon and Kim’s scheme does not provide perfect forward secrecy [5]:(1)
Attacker gotCi, Ti, and Ts in previous public channel.(2)
Attacker knew one of user’s long-term secret:Di.
⇒
Attacker hasCi, Ti, Ts, and Di and computes ki and Dki as follows:⇒
ki=h(Di∥Ti),⇒
DkiCi=IDi∥ri.(3)
Attacker acquiresIDi and ri and then computes sk.
⇒
sk=hIDi∥ri∥Ts.(4)
Attacker can compute all of previous session key sk.In advance, the attacker obtains Ci, Ti, and Ts from previous communication between Ui and Sj. The attacker obtains one of the user’s long-term secrets Di. Then, the attacker can compute ki=h(Di∥Ti) and decrypt the Ci using the computed ki. So the attacker can figure out IDi and random number ri. Finally, the attacker can compute the session key sk using IDi, ri, and Ts.


### 4.5. Session Key Exposure by the Gateway Node

The session keysk is used to provide secure communications between Ui and Sj after the authentication phase is successfully finished. Even if the GW node is a trusted node, it is not necessary for the GW node to know sk because Ui usually wants to communicate secretly with Sj without the observation of the GW node. However, in Yoon and Kim’s authentication scheme, the GW node can compute sk without difficulty. GW node can collect previous IDi and ri in Ui’s authentication phase and thus can obtain all Ts over a public channel. Then, the GW node can compute all sk=h(IDi∥ri∥Ts) between Ui and Sj. Therefore, the GW node can decrypt the encrypted message between Ui and Sj, and can figure out all Ui’s secret messages that are protected by session key sk. The session key exposure by GW on Yoon and Kim’s scheme [5] is described as follows:(1)
GW knewIDi and ri in communication with Ui.(2)
GW gotTs in public channel:
⇒GW has IDi, ri and Ts,⇒sk=h(IDi∥ri∥Ts).(3)
GW can compute all session key sk betweenUi and Sj.(4)
GW can decrypt the secret messages betweenUi and Sj.(5)
GW can acquire important information betweenUi and Sj.


### 4.6. Vulnerability to Denial of Service Attack

Figure6 shows the potential for a DoS attack on Yoon and Kim’s authentication scheme. The attacker can send malicious messages 〈IDi,Ci,Tc〉 that have been generated to consume the battery power of the GW node and sensor node. The attacker obtains IDi and Ci from the previous public channel communication and generates a current timestamps Tc. When the GW node and the sensor node receive the malicious messages 〈IDi,Ci,Tc〉, they first check for the freshness of the timestamps Tc. However, the Tc generated by the attacker is current, and the GW node and sensor cannot determine that IDi and Ci are from previous messages. So they execute various functions, such as a hash function, decryption function, and verification function before checking whether the IDi sent by the attacker and the computed IDi are the same. Therefore, the attacker is able to execute a DoS attack without difficulty [5]. The GW node has sufficient resources that can be used in the system, but the sensors are different. The sensor nodes have a limited computational ability, low battery, low bandwidth, and a small amount of memory. The computational cost of a sensor node is a critical consideration in the design of WSNs since this increases the consumption of the battery power of the sensor [15]. Quite often it is economically preferable to discard a sensor rather than recharge it, and for this reason, the battery power of a sensor is usually important for wireless devices, with its lifetime determining the sensor lifetime. Therefore, it is significant issue for the sensor node to be protected from a DoS attack.Figure 6
Vulnerability to denial of service attack on Yoon and Kim’s scheme.


### 4.7. Revocation Problem

Yoon and Kim’s authentication scheme does use the user’s password but only uses the user’sIDi and biometrics Bi. Therefore, a password change phase is not necessary. For this reason, when an attacker steals or picks up the user’s smart card, a revocation problem occurs. When the GW node issues the user’s smart card, it always produces the same 〈IDi,Ri,Vi,h(·),d(·),τ〉 if the Ui sends the same IDi and Bi to the GW node. So even though Ui reissues a new smart card, Ui cannot discard the lost smart card because the reissued smart card and the lost smart card are the same. Therefore, the user Ui has to change his ID in order to reissue a different smart card. Figure 7 describes the potential problem due to lack of revocation phase on Yoon and Kim’s scheme [5].Figure 7
Revocation problem on Yoon and Kim’s scheme.


## 4.1. Biometric Recognition Error

Yoon and Kim’s authentication scheme uses a one-way hash function to provide biometric verification. This hash function can be used to map the data of an arbitrary size to data of a fixed size with slight differences in the input data producing very large differences in the output data. Figure3 describes the biometric recognition error in Yoon and Kim’s scheme. Biometrics have general limitations such as false acceptance and false rejection. This means that the output of the imprinted biometrics is not always constant. Although Ui inputs its own biometrics to the scanning device, it is possible to output a different ~Bi∗. Therefore, the same biometrics can generate different output, such as the Bi∗ and ~Bi∗. A different ~Bi∗ causes slight differences in Ei∗ and ~Ei∗. Therefore, this difference produces a very large difference between Vi∗ and ~Vi∗ due to the property of hash function. The large difference between Vi∗ and ~Vi∗ causes a biometric recognition error, so a legal user can fail to accept the smart card verification. As a result, advanced techniques are needed to improve the success rate of a legal user’s verification [5].Figure 3
Biometric recognition error on Yoon and Kim’s scheme.


## 4.2. User Verification Problem

In Yoon and Kim’s authentication scheme,GW verifies a legal user by comparing IDi in M1 and IDi′ in the output of the decrypted Ci. Specifically, the user computes Ci using a symmetric encryption algorithm; Ci=Eki(IDi∥ri). IDi and ri do not matter but Eki has a problem in that there is a possibility to obtain unexpected results. This is the reason why Eki is made up by Di and Ti and Di consist of Ri, Ei∗:(1)Ei∗=hIDi,Bi,Di=Ri⊕Ei∗,ki=hDi∥Ti,Ci=EkiIDi∥ri.Even if biometrics are the same, the output of the scanning device is not constant. Therefore, the same biometrics can generate a different output, like ~Bi∗. The different output of the biometrics causes slight differences in Ei∗ and ~Ei∗. Due to these slight differences, different ~Di and ~ki are produced. As a result, the user and GW en/decrypt the Ci using different keys. GW cannot get a normal IDi from Ci so the user is not authenticated by GW even when the user uses its own normal IDi and Bi. This is the reason why the hash function and the symmetric key encryption algorithm have a property that results in large differences due to a slight difference of input. Figure 4 specifically describes the user verification problem in Yoon and Kim’s scheme.Figure 4
User verification problem on Yoon and Kim’s scheme.


## 4.3. Lack of Anonymity

Figure5 describes how Yoon and Kim’s scheme does not provide the anonymity. In this scheme, the user sends its own Ui to GW over public communication, and GW sends Ui to the sensor without any protection. Therefore, an attacker can easily acquire Ui from those communications. This results in an information exposure problem. For the GW’ incoming communication, an attacker can obtain information of the approximate number of registered users to GW. Also an attacker can acquire information on which user communicates with Sj. Therefore, the lack of anonymity in Yoon and Kim’s scheme raises some problems that need to be addressed by providing user anonymity through a protection technique. To solve this problem, it is necessary to use anonymity identification AIDi in the WSNs communication instead of sending a normal IDi [21–23].Figure 5
Lack of anonymity on Yoon and Kim’s scheme.


## 4.4. Lack of Perfect Forward Secrecy

Perfect forward secrecy means that a session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised at some point in the future [24]. Unfortunately, Yoon and Kim’s authentication scheme does not provide perfect forward secrecy. Therefore, an attacker can compute the session key sk between the Ui and Sj if the attacker knows one of the long-term keys Di in the future. The following list describes how Yoon and Kim’s scheme does not provide perfect forward secrecy [5]:(1)
Attacker gotCi, Ti, and Ts in previous public channel.(2)
Attacker knew one of user’s long-term secret:Di.
⇒
Attacker hasCi, Ti, Ts, and Di and computes ki and Dki as follows:⇒
ki=h(Di∥Ti),⇒
DkiCi=IDi∥ri.(3)
Attacker acquiresIDi and ri and then computes sk.
⇒
sk=hIDi∥ri∥Ts.(4)
Attacker can compute all of previous session key sk.In advance, the attacker obtains Ci, Ti, and Ts from previous communication between Ui and Sj. The attacker obtains one of the user’s long-term secrets Di. Then, the attacker can compute ki=h(Di∥Ti) and decrypt the Ci using the computed ki. So the attacker can figure out IDi and random number ri. Finally, the attacker can compute the session key sk using IDi, ri, and Ts.


## 4.5. Session Key Exposure by the Gateway Node

The session keysk is used to provide secure communications between Ui and Sj after the authentication phase is successfully finished. Even if the GW node is a trusted node, it is not necessary for the GW node to know sk because Ui usually wants to communicate secretly with Sj without the observation of the GW node. However, in Yoon and Kim’s authentication scheme, the GW node can compute sk without difficulty. GW node can collect previous IDi and ri in Ui’s authentication phase and thus can obtain all Ts over a public channel. Then, the GW node can compute all sk=h(IDi∥ri∥Ts) between Ui and Sj. Therefore, the GW node can decrypt the encrypted message between Ui and Sj, and can figure out all Ui’s secret messages that are protected by session key sk. The session key exposure by GW on Yoon and Kim’s scheme [5] is described as follows:(1)
GW knewIDi and ri in communication with Ui.(2)
GW gotTs in public channel:
⇒GW has IDi, ri and Ts,⇒sk=h(IDi∥ri∥Ts).(3)
GW can compute all session key sk betweenUi and Sj.(4)
GW can decrypt the secret messages betweenUi and Sj.(5)
GW can acquire important information betweenUi and Sj.


## 4.6. Vulnerability to Denial of Service Attack

Figure6 shows the potential for a DoS attack on Yoon and Kim’s authentication scheme. The attacker can send malicious messages 〈IDi,Ci,Tc〉 that have been generated to consume the battery power of the GW node and sensor node. The attacker obtains IDi and Ci from the previous public channel communication and generates a current timestamps Tc. When the GW node and the sensor node receive the malicious messages 〈IDi,Ci,Tc〉, they first check for the freshness of the timestamps Tc. However, the Tc generated by the attacker is current, and the GW node and sensor cannot determine that IDi and Ci are from previous messages. So they execute various functions, such as a hash function, decryption function, and verification function before checking whether the IDi sent by the attacker and the computed IDi are the same. Therefore, the attacker is able to execute a DoS attack without difficulty [5]. The GW node has sufficient resources that can be used in the system, but the sensors are different. The sensor nodes have a limited computational ability, low battery, low bandwidth, and a small amount of memory. The computational cost of a sensor node is a critical consideration in the design of WSNs since this increases the consumption of the battery power of the sensor [15]. Quite often it is economically preferable to discard a sensor rather than recharge it, and for this reason, the battery power of a sensor is usually important for wireless devices, with its lifetime determining the sensor lifetime. Therefore, it is significant issue for the sensor node to be protected from a DoS attack.Figure 6
Vulnerability to denial of service attack on Yoon and Kim’s scheme.


## 4.7. Revocation Problem

Yoon and Kim’s authentication scheme does use the user’s password but only uses the user’sIDi and biometrics Bi. Therefore, a password change phase is not necessary. For this reason, when an attacker steals or picks up the user’s smart card, a revocation problem occurs. When the GW node issues the user’s smart card, it always produces the same 〈IDi,Ri,Vi,h(·),d(·),τ〉 if the Ui sends the same IDi and Bi to the GW node. So even though Ui reissues a new smart card, Ui cannot discard the lost smart card because the reissued smart card and the lost smart card are the same. Therefore, the user Ui has to change his ID in order to reissue a different smart card. Figure 7 describes the potential problem due to lack of revocation phase on Yoon and Kim’s scheme [5].Figure 7
Revocation problem on Yoon and Kim’s scheme.


## 5. Countermeasures

The vulnerability of Yoon and Kim’s scheme to a biometric recognition error and a user verification problem is due to the fact that(i)
though the sameUi inputs its own biometrics to the scanning device, a different output can be generated;(ii)
the hash function makes slight differences in the input data by producing very large differences in the output data;(iii)
in a symmetric key encryption algorithmEki, small differences of ki produce large differences in the output.This design flaw causes normal users to fail the login phase using smart card. Therefore, we suggest modifying theEi∗=h(IDi,Bi∗), Vi∗=h(IDi∥Ei∗), and d(Vi,Vi∗)≤τ to prevent a biometric recognition error. Moreover, the difference in Bi and Bi∗ results in a different encryption key ki. So, this can cause a user verification problem because the differences in Ki and Ki′ produce a different Ci that is used for authentication between Ui and the GW node. To prevent an authentication error, we also suggest modifying Di=Ri⊕Ei∗ and ki=h(Di∥Ti). We thus improve Yoon and Kim’s scheme using fuzzy extraction as follows.During the registration phase, instead ofEi∗=h(IDi,Bi∗), the smart card computes Ri and Pi using a fuzzy extraction function Gen(Bi) such as 〈Ri,Pi〉=Gen(Bi). It also computes Fi=h(Ri) and sends both IDi and Fi to the GW node. The GW node modifies the computation of Ai and Vi from Ai=h(IDi∥x)⊕Ei and Vi=h(IDi∥Ei) to(2)Ai=hRi,Mi=hIDi∥x⊕Ai,Vi=hIDi∥Ai.During the login and authentication phase, instead ofEi∗=h(IDi,Bi∗), Vi∗=h(IDi∥Ei∗), d(Vi,Vi∗)≤τ, and Di=Ai⊕Ei∗, smart card computes the following: (3)Ri∗=RepBi∗,Pi,Ai∗=hRi∗,Vi∗=hIDi∥Ai∗,Vi=?Vi∗,Di=Mi⊕Ai∗.As a result of this modification carried out using a fuzzy extraction function, the accuracy of verification using biometrics improves. Consequently, the biometric recognition error and user verification problem can be solved.We next present a possible mechanism for eliminating the vulnerability in Yoon and Kim’s scheme due to the lack of anonymity. This vulnerability is due to the fact that(i)
IDi is used in public communication without any protection;(ii)
theattacker can know how many users are registered in GW and which user wants to access Sj.Using the user’sIDi, the attacker can acquire a variety of information on the user, GW, and the sensor. Therefore, we propose to use an anonymity AIDi to provide anonymity. Instead of sending a normal IDi, we suggest using AIDi in the communication as follows:(4)AIDi=IDi⊕hhx∥y∥Ti.GW sends h(x∥y) to a user using Ni = h(x∥y)⊕Ai in registration phase. h(x∥y) uses only a previous secret x and y so it does not need to add a new secret. The attacker and sensor cannot know h(x∥y) and AIDi changes every session due to Ti so we can provide user anonymity.To provide the perfect forward secrecy in our proposed scheme, we modify the computation ofsk from sk = h(IDi∥ri∥Ts) to(5)sk=hAIDi∥KUS∥Ts.AIDi=IDi⊕h(h(x∥y)∥Ti) has a secret h(x∥y). Therefore, sk has two secret h(x∥y) and KUS; moreover, they are independent on each other, and so the session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised in the future. KUS is thus important information between Ui and Sj:(6)KUS=ri×rs×P.Since KUS can be used to eliminate the vulnerability in Yoon and Kim’s scheme to session key exposure by the GW node, this vulnerability is due to the fact that(i)
theGW node can know all elements of sk including ri;(ii)
it is hard to share secret information betweenUi and Sj in advance.To prevent this problem, we suggest a key exchange using elliptic curve encryption. The user generatesri and computes Xi and KUS:(7)Xi=ri×P,KUS=ri×Yi=ri×rs×P.Then, the user sends Xi to the sensor through the GW and receives Yi from the sensor, so the sensor can compute sk as follows:(8)Yi=rs×P,KSU=rs×Xi=rs×ri×P.KUS and KSU can be used by the user and sensor to compute sk=h(AIDi∥KUS∥Ts) in a manner that is concealed from the GW node. Therefore, we resolve the session key exposure by the GW node.However, even after implementing the modifications described above, Yoon and Kim’s scheme is vulnerable to DoS attacks. This type of attack results from the fact that(i)
GW and the sensor perform all operations without checking the freshness of the incoming messages;(ii)
in particular, the sensor has limited energy but this scheme verifies messages after performing various operations.To prevent the vulnerability to DoS attack, we suggest adding verification toM1 and M2 to check incoming message. We modify the computations for M1 and M3 from M1=〈IDi,Ci,Ti〉 and M2=〈IDi,Cg,Tg〉 to(9)M1=AIDi,Xi,Ci,Ti,Wi,M2=AIDi,Cg,Tg,Wg.In advance, the GW node and sensor check Wi and Wg to verify an incoming message:(10)Wi=hhx∥y∥AIDi∥Xi∥Ci∥Ti,Wg=hhSIDj∥y∥AIDi∥Cg∥Tg.Wi and Wg are thus only computed for a legal user and the GW node. Due to this modification, the GW node and sensor can prevent a DoS attack by checking Wi and Wg in M1 and M2, respectively.Finally, the revocation problem is prevented by implementing a revocation and reissue phase. This phase should also be modified for consistency, particularly to induce a user to select identification different from previous identifications (see Section6.3 for details). All the modifications suggested above are combined to propose an improved authentication scheme that is described in the following section.


## 6. Proposed Scheme

Our proposed scheme is divided into three phases: a user registration phase, login and authentication phase, and revocation and reissue phase. Before our scheme is executed,GW generates two master keys, x and y, and provides a long-term secret key h(SIDj∥y) to the sensor Sj.


### 6.1. Registration Phase

The registration phase of the proposed scheme is described in Figure8. The Ui perform a user registration phase with GW by using a secure channel. Ui computes Bi by using a biometrics scanning device and Ri and Pi using fuzzy extraction. Then, the user’s information is sent to the GW for registration. However, the GW cannot store the user’s biometrics information. The detailed steps are as follows.(1)
Ui selects IDi and scans its own biometrics to compute Bi.(2)
Ui computes 〈Ri,Pi〉=Gen(Bi) and Ai=h(Ri). And then Ui sends 〈IDi,Ai〉 to the GW node.(3)
After receiving〈IDi,Ai〉, the GW node computes the authentication parameters for Ui as follows:(11)Mi=hIDi∥x⊕Ai,Ni=hx∥y⊕Ai,Vi=hIDi∥Ai.(4)
GW stores IDi, h(·), and the authentication parameters; 〈IDi,Mi,Ni,Vi,h(·)〉 in a smart card. And GW issues the smart card to Ui through a secure channel.(5)
Ui receives the smart card and inputs Pi to the smart card.Figure 8
Registration phase of the proposed scheme.


### 6.2. Login and Authentication Phases

The login and authentication phase of the proposed scheme is described in Figure9. During the login phase, the smart card checks the user’s legality by using the user’s Ui and biometrics Bi∗. GW authenticates the user by checking IDi through the detailed steps of the login phase as follows:(1)
Ui inserts his smart card into a card reader. Then, Ui inputs his IDi and computes the biometric information Bi∗ using a scanning device. The smart card computes Ri∗, Ai∗, and Vi∗ using fuzzy extraction and compares Vi∗ with Vi stored in smart card as follows:(12)Ri∗=RepBi∗,Pi,Ai∗=hRi∗,Vi∗=hIDi∥Ai∗,verifiesVi=?Vi∗.(2)
The smart card generates a random numberri and computes Xi, Di, and h(x∥y). Xi is used for the session key between Ui and Sj. This scheme uses h(x∥y) to provide perfect forward secrecy:(13)Xi=ri×P,Di=Mi⊕Ai∗,hx∥y=Ni⊕Ai∗.(3)
Ui picks up the current timestamps Ti and computes ki, Ci, AIDi, and Wi for authentication with GW. Wi is used to prevent the DoS attack. Then, Ui sends the authentication message M1 to GW:(14)ki=hDi∥Ti,Ci=EkiIDi∥Xi,AIDi=IDi⊕hhx∥y∥Ti,Wi=hhx∥y∥AIDi∥Xi∥Ci∥Ti,M1=AIDi,Xi,Ci,Ti,Wi.(4)
Upon receivingM1 from Ui, GW retrieves the current timestamps T′ and verifies the freshness of the Ui’ timestamps Ti using (T′-Ti)≤ΔT. Then, GW verifies the received Wi using Wi=?h(h(x∥y)∥AIDi∥X∥Ci∥Ti).(5)
GW computes IDi′, Di′, and ki′ and decrypts the Ci in M1. The output of the decryption is used by GW to authenticate Ui by comparing IDi′ and IDi′′: (15)IDi′=AIDi⊕hhx∥y∥Ti,Di′=hIDi′∥x,ki′=hDi′∥Ti,IDi′′∥Xi′=Dki′Ci,verifiesIDi′=?IDi′′.(6)
GW picks up the current timestamps Tg and kg, Cg, and Wg to authenticate Sj. Then, GW sends an authentication message M2 to Sj:(16)kg=hhSIDj∥y∥Tg,Cg=EkgAIDi∥Xi′,Wg=hhSIDj∥y∥AIDi∥Cg∥Tg,M2=AIDi,Cg,Tg,Wg.(7)
WithM2 in hand, Sj retrieves the current timestamps T′′ and checks if T′′-Tg≤ΔT. If the freshness check for T′′ fails, Sj stops the authentication phase. Otherwise, Sj computes Wg and compares it with h(h(SIDj∥y)∥AIDi∥Cg∥Tg). After that, Sj computes kg′ and decrypts Cg using kg′. Then, Sj checks the sameness between the received AIDi and the computed AIDi′:(17)kg′=hhSIDj∥y∥Tg,AIDi′∥X′=Dkg′Cg,verifiesAIDi=?AIDi′.(8)
To computesk, Sj generates a random number rs and computes KSU, Yi. This sk is computed only by Ui and Sj due to a mathematical problem inherent to ECC. Then, Sj picks up the current timestamps Ts and computes RM, Vs for the authentication. After the operation is finished, Sj send M3 to Ui:(18)KSU=rs×Xi′,Yi=rs×P,computes  sk=hAIDi∥KSU∥Ts,RM=Response  to  the  query  ofUi,Vs=hAIDi′∥Xi′∥Yi∥RM∥Ts,M3=RM,Yi,Vs,Ts.(9)
First,Ui checks the freshness in Ts and the sameness of Vs. Then, Ui computes KUS using the received Yi, and sk by using AIDi, KUS, and Ts. Only a legal Ui computes KUS using Yi so anyone cannot compute sk including GW. Then, Ui accepts RM:(19)verifiesT′′′-Ts≤ΔT,verifiesVs=?hAIDi∥Xi∥Yi∥RM∥Ts,KUS=ri×Yi,computes  sk=hAIDi∥KUS∥Ts,accepts  RM.(10)
From now on,Ui can communicate securely with Sj using sk:(20)shared  sk=hAIDi∥ri×rs×P∥Ts,hAIDi∥rs×Xi∥Ts=hAIDi∥ri×Yi∥Ts.Figure 9
Login and authentication phase of the proposed scheme.


### 6.3. Revocation and Reissue Phase

The revocation problem can result in serious attacks, so a revocation phase should be provided whenUi wants to reissue a smart card due to loss. To prevent the same user identification from being selected, Ui inputs the previous IDi. Then, Ui selects a different identification IDi∗ and sends IDi, IDi∗ to the GW with hashed biometrics information Ai. After the GW receives these, GW revokes IDi and reissues the smart card using IDi∗. Then, GW continues into a phase that is equal to the registration phase. Revocation and reissue phase of the proposed scheme is described in Figure 10.Figure 10
Revocation and reissue phase of the proposed scheme.


## 6.1. Registration Phase

The registration phase of the proposed scheme is described in Figure8. The Ui perform a user registration phase with GW by using a secure channel. Ui computes Bi by using a biometrics scanning device and Ri and Pi using fuzzy extraction. Then, the user’s information is sent to the GW for registration. However, the GW cannot store the user’s biometrics information. The detailed steps are as follows.(1)
Ui selects IDi and scans its own biometrics to compute Bi.(2)
Ui computes 〈Ri,Pi〉=Gen(Bi) and Ai=h(Ri). And then Ui sends 〈IDi,Ai〉 to the GW node.(3)
After receiving〈IDi,Ai〉, the GW node computes the authentication parameters for Ui as follows:(11)Mi=hIDi∥x⊕Ai,Ni=hx∥y⊕Ai,Vi=hIDi∥Ai.(4)
GW stores IDi, h(·), and the authentication parameters; 〈IDi,Mi,Ni,Vi,h(·)〉 in a smart card. And GW issues the smart card to Ui through a secure channel.(5)
Ui receives the smart card and inputs Pi to the smart card.Figure 8
Registration phase of the proposed scheme.


## 6.2. Login and Authentication Phases

The login and authentication phase of the proposed scheme is described in Figure9. During the login phase, the smart card checks the user’s legality by using the user’s Ui and biometrics Bi∗. GW authenticates the user by checking IDi through the detailed steps of the login phase as follows:(1)
Ui inserts his smart card into a card reader. Then, Ui inputs his IDi and computes the biometric information Bi∗ using a scanning device. The smart card computes Ri∗, Ai∗, and Vi∗ using fuzzy extraction and compares Vi∗ with Vi stored in smart card as follows:(12)Ri∗=RepBi∗,Pi,Ai∗=hRi∗,Vi∗=hIDi∥Ai∗,verifiesVi=?Vi∗.(2)
The smart card generates a random numberri and computes Xi, Di, and h(x∥y). Xi is used for the session key between Ui and Sj. This scheme uses h(x∥y) to provide perfect forward secrecy:(13)Xi=ri×P,Di=Mi⊕Ai∗,hx∥y=Ni⊕Ai∗.(3)
Ui picks up the current timestamps Ti and computes ki, Ci, AIDi, and Wi for authentication with GW. Wi is used to prevent the DoS attack. Then, Ui sends the authentication message M1 to GW:(14)ki=hDi∥Ti,Ci=EkiIDi∥Xi,AIDi=IDi⊕hhx∥y∥Ti,Wi=hhx∥y∥AIDi∥Xi∥Ci∥Ti,M1=AIDi,Xi,Ci,Ti,Wi.(4)
Upon receivingM1 from Ui, GW retrieves the current timestamps T′ and verifies the freshness of the Ui’ timestamps Ti using (T′-Ti)≤ΔT. Then, GW verifies the received Wi using Wi=?h(h(x∥y)∥AIDi∥X∥Ci∥Ti).(5)
GW computes IDi′, Di′, and ki′ and decrypts the Ci in M1. The output of the decryption is used by GW to authenticate Ui by comparing IDi′ and IDi′′: (15)IDi′=AIDi⊕hhx∥y∥Ti,Di′=hIDi′∥x,ki′=hDi′∥Ti,IDi′′∥Xi′=Dki′Ci,verifiesIDi′=?IDi′′.(6)
GW picks up the current timestamps Tg and kg, Cg, and Wg to authenticate Sj. Then, GW sends an authentication message M2 to Sj:(16)kg=hhSIDj∥y∥Tg,Cg=EkgAIDi∥Xi′,Wg=hhSIDj∥y∥AIDi∥Cg∥Tg,M2=AIDi,Cg,Tg,Wg.(7)
WithM2 in hand, Sj retrieves the current timestamps T′′ and checks if T′′-Tg≤ΔT. If the freshness check for T′′ fails, Sj stops the authentication phase. Otherwise, Sj computes Wg and compares it with h(h(SIDj∥y)∥AIDi∥Cg∥Tg). After that, Sj computes kg′ and decrypts Cg using kg′. Then, Sj checks the sameness between the received AIDi and the computed AIDi′:(17)kg′=hhSIDj∥y∥Tg,AIDi′∥X′=Dkg′Cg,verifiesAIDi=?AIDi′.(8)
To computesk, Sj generates a random number rs and computes KSU, Yi. This sk is computed only by Ui and Sj due to a mathematical problem inherent to ECC. Then, Sj picks up the current timestamps Ts and computes RM, Vs for the authentication. After the operation is finished, Sj send M3 to Ui:(18)KSU=rs×Xi′,Yi=rs×P,computes  sk=hAIDi∥KSU∥Ts,RM=Response  to  the  query  ofUi,Vs=hAIDi′∥Xi′∥Yi∥RM∥Ts,M3=RM,Yi,Vs,Ts.(9)
First,Ui checks the freshness in Ts and the sameness of Vs. Then, Ui computes KUS using the received Yi, and sk by using AIDi, KUS, and Ts. Only a legal Ui computes KUS using Yi so anyone cannot compute sk including GW. Then, Ui accepts RM:(19)verifiesT′′′-Ts≤ΔT,verifiesVs=?hAIDi∥Xi∥Yi∥RM∥Ts,KUS=ri×Yi,computes  sk=hAIDi∥KUS∥Ts,accepts  RM.(10)
From now on,Ui can communicate securely with Sj using sk:(20)shared  sk=hAIDi∥ri×rs×P∥Ts,hAIDi∥rs×Xi∥Ts=hAIDi∥ri×Yi∥Ts.Figure 9
Login and authentication phase of the proposed scheme.


## 6.3. Revocation and Reissue Phase

The revocation problem can result in serious attacks, so a revocation phase should be provided whenUi wants to reissue a smart card due to loss. To prevent the same user identification from being selected, Ui inputs the previous IDi. Then, Ui selects a different identification IDi∗ and sends IDi, IDi∗ to the GW with hashed biometrics information Ai. After the GW receives these, GW revokes IDi and reissues the smart card using IDi∗. Then, GW continues into a phase that is equal to the registration phase. Revocation and reissue phase of the proposed scheme is described in Figure 10.Figure 10
Revocation and reissue phase of the proposed scheme.


## 7. Security Analysis

This section describes the security analysis to confirm the security of the proposed scheme. We need to provide the following definitions to then compare the proposed scheme to other authentication schemes, including that proposed by Yoon and Kim.Definition 1.
A strong secret key(Bi,x,y) has a high value of entropy S(k) that cannot be guessed in polynomial time.Definition 2.
A secure one-way hash functiony=h(x) is the following. Given x to compute y is easy but y to compute x is hard.


### 7.1. Biometric Recognition Error

The proposed scheme prevents a biometric recognition error by using fuzzy extraction. Yoon and Kim’s scheme uses a hash function to check for conformity in the biometrics. Even if they use a thresholdτ, since the hash function makes slight differences in the input data that produces very large differences in the output data, it is possible for biometric recognition errors to occur. However, the proposed scheme using fuzzy extractor prevents biometric recognition errors.The fuzzy extractorGen() generates Ri and Pi using the user’s biometric Bi during the registration phase. Ri is a uniform and random string, and Pi is a helper string, so Ri can be the same with the assistance of auxiliary information Pi even if the user’s inputs slightly different biometrics Bi∗, which thus maintains a reasonably similar status as that of the original biometric information. Ui imprints Bi for registration and computes Ri, Pi, and Ai as follows:(21)Ri,Pi=GenBi,Ai=hRi.Ui imprints Bi∗ for login and computes Ri∗, Pi∗, and Vi∗ and compares Vi with Vi∗ as follows:(22)Ri∗=RepBi∗,Pi,Ai∗=hRi∗,Vi∗=hIDi∥Ai∗,verifiesVi=?Vi∗.With the assistance ofPi, the fuzzy extractor can compute a constant Vi∗ even if the user inputs slightly different biometrics, so the proposed scheme is secure against a biometric recognition error.


### 7.2. User Verification Problem

The proposed scheme checks for the sameness in theIDi to verify the status a legal user. Concretely, Ui makes Bi using the device and computes Ri and Pi. These values and information stored in smart card are used by Ui to compute Di,h(x∥y),ki,Ci,AIDi and send M1 to GW. GW computes IDi′ from AIDi and then computes Di′ and ki′. Ui decrypts Ci and confirms IDi′′. Finally, GW authenticates Ui as follows if IDi′ and IDi′′ are the same. Ui imprints Bi for authentication. And then GW computes M1 as follows:(23)Ri,Pi=GenBi,Ai=hRi,Di=Mi⊕Ai∗,hx∥y=Ni⊕Ai∗,ki=hDi∥Ti,Ci=EkiIDi∥Xi,AIDi=IDi⊕hhx∥y∥Ti,M1=AIDi,Xi,Ci,Ti,Wi.GW verifies sameness of ID as follows:(24)IDi′=AIDi⊕hhx∥y∥Ti,Di′=hIDi′∥x,ki′=hDi′∥Ti,IDi′′∥Xi′=Dki′Ci,verifiesIDi′=?IDi′′.Unlike in Yoon and Kim’s scheme,Ui can compute constant values including Ai as a result of the fuzzy extractor. Therefore, GW can authenticate a legal user even if the user inputs a slightly different biometric information Bi∗. Therefore, the proposed scheme can prevent a user verification problem.


### 7.3. Anonymity

In the proposed scheme, an attacker cannot compute a user’s real identificationIDi without h(x∥y) because the real identification of the user is always protected using AIDi=IDi⊕h(h(x∥y)∥Ti). Therefore, only the legal user Ui and GW can compute IDi from AIDi. GW stores x and y, so GW can easily compute h(x∥y). Ui can compute h(x∥y) from the Ni stored in the smart card as follows:(25)Ni=hx∥y⊕Ai,Ri,Pi=GenBi,Ai=hRi,hx∥y=Ni⊕Ai∗.To computeh(x∥y), the attacker has to obtain both the user’s smart card and Bi. However, even if the attacker can obtain a smart card, he cannot compute Bi. As a result, the attacker cannot obtain the user’s real identification IDi. Therefore, the proposed scheme provides user anonymity.


### 7.4. Perfect Forward Secrecy

Proposed scheme computes the session key betweenUi and Sj as follows:(26)sk=hAIDi∥KUS∥Ts,AIDi=IDi⊕hhx∥y∥Ti.Therefore, to compute all of the session keys of a user, an attacker has to know bothh(x∥y) and KUS. However, the attacker cannot compute two values using another long-term key because h(x∥y) and KUS are independent of each other. In other words, if an attacker knows one of h(x∥y) and KUS, he cannot compute the other one, so the session key that is derived from a set of long-term keys will not be compromised, even if one of the long-term keys is compromised in the future. Therefore, the proposed scheme achieves the perfect forward secrecy.


### 7.5. Session Key Exposure by the Gateway Node

In the proposed scheme,GW also knows most of the information related to the scheme but cannot compute sk between Ui and Sj. we suggest sk as follows:(27)sk=hAIDi∥ri×Yi∥Ts=hAIDi∥rs×Xi∥Ts=hAIDi∥ri×rs×P∥Ts.GW can know AIDi, Ts, Xi, and Yi but cannot acquire ri and rs. Even though Xi=ri×P and Yi=rs×P, GW cannot compute ri and rs from Xi and Yi because it is mathematical problem about ECC. Therefore, sk is not exposed by GW in proposed scheme.


### 7.6. Vulnerability to Denial of Service Attack

In the proposed scheme,Ui, GW, and Sj basically check for freshness in the message using timestamps. Therefore, the scheme is considered to be able to endure a DoS attack if an attacker sends a previous message to the server with previous timestamps. Moreover, the DoS attack can be better prevented since the proposed scheme uses Wi, Wg, Vs in M1, M2, and M3, respectively:(28)Wi=hhx∥y∥AIDi∥Xi∥Ci∥Ti,Wg=hhSIDj∥y∥AIDi∥Cg∥Tg,Vs=hAIDi′∥Xi′∥Yi∥RM∥Ts.W
i, Wg, and Vs include the current timestamps Ti. So, Ui, GW, and Sj can check for the freshness and legality of M1, M2, and M3 because the timestamps of Wi, Wg, and Vs do not match the timestamps of M1, M2, and M3 even if the attacker sends the previous Wi, Wg, and Vs with the current timestamps. Therefore, the proposed scheme is more secure against the DoS attack than Yoon and Kim’s scheme.


### 7.7. Revocation Problem

The proposed scheme does not use the user’s password but only uses the user’sIDi and biometrics Bi for registration. As a result, the proposed scheme needs to provide a revocation and reissue phase when the Ui wants to reissue a smart card due to loss. If a user reissues their own smart card with the same IDi as the previous IDi, the reissued smart card is going to be completely the same as the previous smart card. An attacker could thus make use of the lost smart card due to the sameness. Therefore, the proposed scheme suggests for the GW to check for differences between the previous IDi and new IDi∗ during the revocation and reissue phase. In other words, we induce a user to select a different identification from the previous identification, so the GW reissues a new smart card with different information when the user loses his smart card, and the revocation problem is solved in this manner.


### 7.8. Mutual Authentication

In the proposed scheme,Ui, GW, and Sj authenticate each other by checking the accuracy of IDi, AIDi, and Vs. Specifically, GW can authenticate whether the Ui that sent M1 is a legal user or not by checking the validity of IDi=?IDi∗. Only the legal case computes Ci using IDi and Bi, so GW can confirm the user’s legitimacy by decrypting Ci using ki. Sj can authenticate GW by checking if it sends a correct hash kg by verifying IDi=?IDi∗. kg can be computed within the current time only by a legal GW and Sj because kg=h(h(SIDj∥y)∥Tg). Finally, Ui can authenticate Sj and GW by checking Vs=?h(AIDi∥Xi∥Yi∥RM∥Ts). Only a legal Sj can compute Vs within the current time because only Sj can know Xi and Yi.


### 7.9. Message Confidentiality

The proposed scheme uses 3 messagesM1, M2, and M3 in the login and authentication phase as follows:(29)M1=AIDi,Xi,Ci,Ti,Wi,M2=AIDi,Cg,Tg,Wg,M3=RM,Yi,Vs,Ts.T
i, Tg, Ts, and RM are basically public information, so they do not need to be protected. Other information can provide confidentiality because an attacker cannot compute important information from AIDi, Xi, Ci, Wi, Cg, Wg, Yi, and Vs.


### 7.10. Password Change Phase

In a password-based authentication scheme, the user should be able to change his own password when he forgets his password or loses his smart card. In detail, to change a password freely, a smart card has to store information related to the user’s password, such ash(password). However, when an attacker steals a user’s smart card, he can gain all the information stored in the smart card by using a simple and differential power analysis. Therefore, the attacker can obtain a user’s password even when it is protected by h(password) because a few characters are necessary to use the password. Therefore, a password change phase is important but poses a serious risk in that information (such as the password) for login and authentication can be exposed. However, the proposed scheme uses only a user’s biometric information with high entropy; therefore, the attacker cannot obtain the original biometric information, even if h(biometrics) is known. Moreover, a user does not forget his biometric information and so does not need to change it.


### 7.11. Stolen Verifier Attack

If theGW or Sj stores verifier information, an attacker can attempt a stolen verifier attack. However, the proposed scheme is resistant to a stolen verifier attacker because GW and Sj do not store a user’s identification/password table and the user’s biometrics. In the proposed scheme, GW only stores the secret key x, y, and Sj store only h(SIDj∥y). Therefore, the GW cannot obtain authentication information from a legal user even if the attacker has the authority to access the database of the GW and Sj.


### 7.12. Guessing Attack

Since the proposed scheme does not use the user’s password, this scheme is not vulnerable to a guessing attack. Moreover, the user’s biometrics is always protected by the one-way hash function. Since the biometrics information has a high level of entropy, unlike a password, the attacker cannot calculate the user’s biometric information from the hashed value. When the attacker steals a user’s smart card, the attacker can obtainIDi, Mi, Ni, Vi, Pi, h(·) from the smart card. However, since Mi, Ni, Vi are hashed values, the attacker cannot obtain any secret information from them. IDi and Pi are not secret information, so the attacker cannot acquire secret information using a guessing attack. Therefore, the proposed scheme is not vulnerable to a guessing attack [25–27].


### 7.13. Replay Attack

The proposed scheme is secure against a replay attack by adding timestampsTi, Tg, Ts into authentication messages Wi, Wg, Vs in M1, M2, M3, respectively. Even if the attacker obtains M1, M2, M3 and sends them again with the current timestamps, the attacker cannot compute Wi, Wg, Vs using the current timestamps:(30)M1=AIDi,Xi,Ci,Ti,Wi,Wi=hhx∥y∥AIDi∥Xi∥Ci∥Ti,M2=AIDi,Cg,Tg,Wg,Wg=hhSIDj∥y∥AIDi∥Cg∥Tg,M3=RM,Yi,Vs,Ts,Vs=hAIDi′∥Xi′∥Yi∥RM∥Ts.


### 7.14. Impersonation Attack

Even if an attacker intercepts the authentication messageM1=〈AIDi,Xi,Ci,Ti,Wi〉 to impersonate a legitimate user, the attacker cannot normally extract Di and ki from AIDi, Ci, and Wi since the one-way hash function is implemented according to Definition 2. Without Di and ki, the attacker cannot produce a legitimate login and authentication message in the attacker’s current time. Therefore, the proposed scheme is secure from impersonation attacks. Likewise, the attacker cannot impersonate a legitimate GW and Sj. Even if the attacker obtains M2=〈AIDi,Cg,Tg,Wg〉, the attacker cannot compute ki or h(h(SIDj∥y)∥Tg) from such due to Definition 2.


### 7.15. Insider Attack

Typically, malicious insiders want to acquire private user information, such as their biometrics. In the proposed registration phase, a user’s smart card device imprints the biometric impressionBi and computes 〈Ri,Pi〉 using Gen(Bi) and then sends Ai to GW; Ai=h(Ri). Therefore, GW cannot obtain Bi using the incoming Ai because of the properties of the one-way hash function. Therefore, the proposed scheme is secure against insider attacks.


### 7.16. Security Factor

Two- or three-factor authentication methods are implemented by means of a combination of two or three different components. In WSNs, most authentication schemes use a user’s password, smart card, and biometric information as components. We propose a two-factor authentication scheme that uses the smart card and biometric information without a password but can provide a similar secure authentication environment comparable to those provided by three-factor authentication schemes.Table1 provides a summary and comparison of the security provided by the proposed scheme and that provided by other schemes, including the one by Yoon and Kim.Table 1
Security comparison.
Security property
Yuan et al.  [11]
He et al. [8]
Yoon and Kim  [14]
Proposed scheme
Biometric recognition error
Insecure
Secure
Insecure
Secure
User verification problem
Insecure
Secure
Insecure
Secure
Anonymity
Provide
Do not provide
Do not provide
Provide
Perfect forward secrecy
No sk
No sk
Do not provide
Provide
sk exposure by GW
No sk
No sk
Insecure
Secure
Vulnerable to DoS attack
Secure
Insecure
Insecure
Secure
Revocation problem
Secure
Secure
Insecure
Secure
Mutual authentication
Do not provide
Provide
Provide
Provide
Message confidentiality
Do not provide
Do not provide
Provide
Provide
Password change phase
Required
Required
Not required
Not required
Stolen verifier attack
Secure
Secure
Secure
Secure
Guessing attack
Secure
Insecure
Secure
Secure
Replay attack
Secure
Secure
Secure
Secure
Impersonation attack
Insecure
Insecure
Secure
Secure
Insider attack
Insecure
Insecure
Secure
Secure
Security factor
Three-factor
Two-factor
Two-factor
Two-factor


## 7.1. Biometric Recognition Error

The proposed scheme prevents a biometric recognition error by using fuzzy extraction. Yoon and Kim’s scheme uses a hash function to check for conformity in the biometrics. Even if they use a thresholdτ, since the hash function makes slight differences in the input data that produces very large differences in the output data, it is possible for biometric recognition errors to occur. However, the proposed scheme using fuzzy extractor prevents biometric recognition errors.The fuzzy extractorGen() generates Ri and Pi using the user’s biometric Bi during the registration phase. Ri is a uniform and random string, and Pi is a helper string, so Ri can be the same with the assistance of auxiliary information Pi even if the user’s inputs slightly different biometrics Bi∗, which thus maintains a reasonably similar status as that of the original biometric information. Ui imprints Bi for registration and computes Ri, Pi, and Ai as follows:(21)Ri,Pi=GenBi,Ai=hRi.Ui imprints Bi∗ for login and computes Ri∗, Pi∗, and Vi∗ and compares Vi with Vi∗ as follows:(22)Ri∗=RepBi∗,Pi,Ai∗=hRi∗,Vi∗=hIDi∥Ai∗,verifiesVi=?Vi∗.With the assistance ofPi, the fuzzy extractor can compute a constant Vi∗ even if the user inputs slightly different biometrics, so the proposed scheme is secure against a biometric recognition error.


## 7.2. User Verification Problem

The proposed scheme checks for the sameness in theIDi to verify the status a legal user. Concretely, Ui makes Bi using the device and computes Ri and Pi. These values and information stored in smart card are used by Ui to compute Di,h(x∥y),ki,Ci,AIDi and send M1 to GW. GW computes IDi′ from AIDi and then computes Di′ and ki′. Ui decrypts Ci and confirms IDi′′. Finally, GW authenticates Ui as follows if IDi′ and IDi′′ are the same. Ui imprints Bi for authentication. And then GW computes M1 as follows:(23)Ri,Pi=GenBi,Ai=hRi,Di=Mi⊕Ai∗,hx∥y=Ni⊕Ai∗,ki=hDi∥Ti,Ci=EkiIDi∥Xi,AIDi=IDi⊕hhx∥y∥Ti,M1=AIDi,Xi,Ci,Ti,Wi.GW verifies sameness of ID as follows:(24)IDi′=AIDi⊕hhx∥y∥Ti,Di′=hIDi′∥x,ki′=hDi′∥Ti,IDi′′∥Xi′=Dki′Ci,verifiesIDi′=?IDi′′.Unlike in Yoon and Kim’s scheme,Ui can compute constant values including Ai as a result of the fuzzy extractor. Therefore, GW can authenticate a legal user even if the user inputs a slightly different biometric information Bi∗. Therefore, the proposed scheme can prevent a user verification problem.


## 7.3. Anonymity

In the proposed scheme, an attacker cannot compute a user’s real identificationIDi without h(x∥y) because the real identification of the user is always protected using AIDi=IDi⊕h(h(x∥y)∥Ti). Therefore, only the legal user Ui and GW can compute IDi from AIDi. GW stores x and y, so GW can easily compute h(x∥y). Ui can compute h(x∥y) from the Ni stored in the smart card as follows:(25)Ni=hx∥y⊕Ai,Ri,Pi=GenBi,Ai=hRi,hx∥y=Ni⊕Ai∗.To computeh(x∥y), the attacker has to obtain both the user’s smart card and Bi. However, even if the attacker can obtain a smart card, he cannot compute Bi. As a result, the attacker cannot obtain the user’s real identification IDi. Therefore, the proposed scheme provides user anonymity.


## 7.4. Perfect Forward Secrecy

Proposed scheme computes the session key betweenUi and Sj as follows:(26)sk=hAIDi∥KUS∥Ts,AIDi=IDi⊕hhx∥y∥Ti.Therefore, to compute all of the session keys of a user, an attacker has to know bothh(x∥y) and KUS. However, the attacker cannot compute two values using another long-term key because h(x∥y) and KUS are independent of each other. In other words, if an attacker knows one of h(x∥y) and KUS, he cannot compute the other one, so the session key that is derived from a set of long-term keys will not be compromised, even if one of the long-term keys is compromised in the future. Therefore, the proposed scheme achieves the perfect forward secrecy.


## 7.5. Session Key Exposure by the Gateway Node

In the proposed scheme,GW also knows most of the information related to the scheme but cannot compute sk between Ui and Sj. we suggest sk as follows:(27)sk=hAIDi∥ri×Yi∥Ts=hAIDi∥rs×Xi∥Ts=hAIDi∥ri×rs×P∥Ts.GW can know AIDi, Ts, Xi, and Yi but cannot acquire ri and rs. Even though Xi=ri×P and Yi=rs×P, GW cannot compute ri and rs from Xi and Yi because it is mathematical problem about ECC. Therefore, sk is not exposed by GW in proposed scheme.


## 7.6. Vulnerability to Denial of Service Attack

In the proposed scheme,Ui, GW, and Sj basically check for freshness in the message using timestamps. Therefore, the scheme is considered to be able to endure a DoS attack if an attacker sends a previous message to the server with previous timestamps. Moreover, the DoS attack can be better prevented since the proposed scheme uses Wi, Wg, Vs in M1, M2, and M3, respectively:(28)Wi=hhx∥y∥AIDi∥Xi∥Ci∥Ti,Wg=hhSIDj∥y∥AIDi∥Cg∥Tg,Vs=hAIDi′∥Xi′∥Yi∥RM∥Ts.W
i, Wg, and Vs include the current timestamps Ti. So, Ui, GW, and Sj can check for the freshness and legality of M1, M2, and M3 because the timestamps of Wi, Wg, and Vs do not match the timestamps of M1, M2, and M3 even if the attacker sends the previous Wi, Wg, and Vs with the current timestamps. Therefore, the proposed scheme is more secure against the DoS attack than Yoon and Kim’s scheme.


## 7.7. Revocation Problem

The proposed scheme does not use the user’s password but only uses the user’sIDi and biometrics Bi for registration. As a result, the proposed scheme needs to provide a revocation and reissue phase when the Ui wants to reissue a smart card due to loss. If a user reissues their own smart card with the same IDi as the previous IDi, the reissued smart card is going to be completely the same as the previous smart card. An attacker could thus make use of the lost smart card due to the sameness. Therefore, the proposed scheme suggests for the GW to check for differences between the previous IDi and new IDi∗ during the revocation and reissue phase. In other words, we induce a user to select a different identification from the previous identification, so the GW reissues a new smart card with different information when the user loses his smart card, and the revocation problem is solved in this manner.


## 7.8. Mutual Authentication

In the proposed scheme,Ui, GW, and Sj authenticate each other by checking the accuracy of IDi, AIDi, and Vs. Specifically, GW can authenticate whether the Ui that sent M1 is a legal user or not by checking the validity of IDi=?IDi∗. Only the legal case computes Ci using IDi and Bi, so GW can confirm the user’s legitimacy by decrypting Ci using ki. Sj can authenticate GW by checking if it sends a correct hash kg by verifying IDi=?IDi∗. kg can be computed within the current time only by a legal GW and Sj because kg=h(h(SIDj∥y)∥Tg). Finally, Ui can authenticate Sj and GW by checking Vs=?h(AIDi∥Xi∥Yi∥RM∥Ts). Only a legal Sj can compute Vs within the current time because only Sj can know Xi and Yi.


## 7.9. Message Confidentiality

The proposed scheme uses 3 messagesM1, M2, and M3 in the login and authentication phase as follows:(29)M1=AIDi,Xi,Ci,Ti,Wi,M2=AIDi,Cg,Tg,Wg,M3=RM,Yi,Vs,Ts.T
i, Tg, Ts, and RM are basically public information, so they do not need to be protected. Other information can provide confidentiality because an attacker cannot compute important information from AIDi, Xi, Ci, Wi, Cg, Wg, Yi, and Vs.


## 7.10. Password Change Phase

In a password-based authentication scheme, the user should be able to change his own password when he forgets his password or loses his smart card. In detail, to change a password freely, a smart card has to store information related to the user’s password, such ash(password). However, when an attacker steals a user’s smart card, he can gain all the information stored in the smart card by using a simple and differential power analysis. Therefore, the attacker can obtain a user’s password even when it is protected by h(password) because a few characters are necessary to use the password. Therefore, a password change phase is important but poses a serious risk in that information (such as the password) for login and authentication can be exposed. However, the proposed scheme uses only a user’s biometric information with high entropy; therefore, the attacker cannot obtain the original biometric information, even if h(biometrics) is known. Moreover, a user does not forget his biometric information and so does not need to change it.


## 7.11. Stolen Verifier Attack

If theGW or Sj stores verifier information, an attacker can attempt a stolen verifier attack. However, the proposed scheme is resistant to a stolen verifier attacker because GW and Sj do not store a user’s identification/password table and the user’s biometrics. In the proposed scheme, GW only stores the secret key x, y, and Sj store only h(SIDj∥y). Therefore, the GW cannot obtain authentication information from a legal user even if the attacker has the authority to access the database of the GW and Sj.


## 7.12. Guessing Attack

Since the proposed scheme does not use the user’s password, this scheme is not vulnerable to a guessing attack. Moreover, the user’s biometrics is always protected by the one-way hash function. Since the biometrics information has a high level of entropy, unlike a password, the attacker cannot calculate the user’s biometric information from the hashed value. When the attacker steals a user’s smart card, the attacker can obtainIDi, Mi, Ni, Vi, Pi, h(·) from the smart card. However, since Mi, Ni, Vi are hashed values, the attacker cannot obtain any secret information from them. IDi and Pi are not secret information, so the attacker cannot acquire secret information using a guessing attack. Therefore, the proposed scheme is not vulnerable to a guessing attack [25–27].


## 7.13. Replay Attack

The proposed scheme is secure against a replay attack by adding timestampsTi, Tg, Ts into authentication messages Wi, Wg, Vs in M1, M2, M3, respectively. Even if the attacker obtains M1, M2, M3 and sends them again with the current timestamps, the attacker cannot compute Wi, Wg, Vs using the current timestamps:(30)M1=AIDi,Xi,Ci,Ti,Wi,Wi=hhx∥y∥AIDi∥Xi∥Ci∥Ti,M2=AIDi,Cg,Tg,Wg,Wg=hhSIDj∥y∥AIDi∥Cg∥Tg,M3=RM,Yi,Vs,Ts,Vs=hAIDi′∥Xi′∥Yi∥RM∥Ts.


## 7.14. Impersonation Attack

Even if an attacker intercepts the authentication messageM1=〈AIDi,Xi,Ci,Ti,Wi〉 to impersonate a legitimate user, the attacker cannot normally extract Di and ki from AIDi, Ci, and Wi since the one-way hash function is implemented according to Definition 2. Without Di and ki, the attacker cannot produce a legitimate login and authentication message in the attacker’s current time. Therefore, the proposed scheme is secure from impersonation attacks. Likewise, the attacker cannot impersonate a legitimate GW and Sj. Even if the attacker obtains M2=〈AIDi,Cg,Tg,Wg〉, the attacker cannot compute ki or h(h(SIDj∥y)∥Tg) from such due to Definition 2.


## 7.15. Insider Attack

Typically, malicious insiders want to acquire private user information, such as their biometrics. In the proposed registration phase, a user’s smart card device imprints the biometric impressionBi and computes 〈Ri,Pi〉 using Gen(Bi) and then sends Ai to GW; Ai=h(Ri). Therefore, GW cannot obtain Bi using the incoming Ai because of the properties of the one-way hash function. Therefore, the proposed scheme is secure against insider attacks.


## 7.16. Security Factor

Two- or three-factor authentication methods are implemented by means of a combination of two or three different components. In WSNs, most authentication schemes use a user’s password, smart card, and biometric information as components. We propose a two-factor authentication scheme that uses the smart card and biometric information without a password but can provide a similar secure authentication environment comparable to those provided by three-factor authentication schemes.Table1 provides a summary and comparison of the security provided by the proposed scheme and that provided by other schemes, including the one by Yoon and Kim.Table 1
Security comparison.
Security property
Yuan et al.  [11]
He et al. [8]
Yoon and Kim  [14]
Proposed scheme
Biometric recognition error
Insecure
Secure
Insecure
Secure
User verification problem
Insecure
Secure
Insecure
Secure
Anonymity
Provide
Do not provide
Do not provide
Provide
Perfect forward secrecy
No sk
No sk
Do not provide
Provide
sk exposure by GW
No sk
No sk
Insecure
Secure
Vulnerable to DoS attack
Secure
Insecure
Insecure
Secure
Revocation problem
Secure
Secure
Insecure
Secure
Mutual authentication
Do not provide
Provide
Provide
Provide
Message confidentiality
Do not provide
Do not provide
Provide
Provide
Password change phase
Required
Required
Not required
Not required
Stolen verifier attack
Secure
Secure
Secure
Secure
Guessing attack
Secure
Insecure
Secure
Secure
Replay attack
Secure
Secure
Secure
Secure
Impersonation attack
Insecure
Insecure
Secure
Secure
Insider attack
Insecure
Insecure
Secure
Secure
Security factor
Three-factor
Two-factor
Two-factor
Two-factor


## 8. Conclusions

To provide security to wireless sensors and users, various authentication schemes for WSNs have been proposed recently. The security problem in He et al.’s scheme was addressed by Yoon and Kim, who proposed an advanced biometrics-based user authentication scheme for WSNs. In this paper, we have identified vulnerabilities in Yoon and Kim’s scheme in terms of a biometric recognition error, a user verification problem, lack of anonymity and perfect forward secrecy, session key exposure by the GW node, vulnerability to a DoS attack, and a revocation problem. To solve these security vulnerabilities, we have suggested specific countermeasures, including the use of fuzzy extraction to imprint biometrics during the registration phase consisting of error-tolerant cryptographic primitives for biometric security. We recommend the use of the sensor node’s random number and ECC to exchange a random number between a user and the sensor node during the authentication phase. ECC can maintain the same degree of security with a smaller key size than other forms of public-key cryptography. Therefore, ECC is suitable for use with wireless devices that have limited resources. In accordance with these countermeasures, we propose a biometrics-based authentication scheme based on fuzzy extraction with improved security. In addition, we conduct a security analysis to show that the proposed scheme is more secure than other authentication schemes.



---

*Source: 8572410-2016-01-05.xml*