# Attribute-Based Anonymous Handover Authentication Protocol for Wireless Networks

Authors: Yongbin Zeng; Hui Guang; Guangsong Li
Journal: Security and Communication Networks
 (2018)

---

## Abstract

Mobile wireless networks are widely used in our daily lives. Seamless handover occurs frequently and how to guarantee security and efficiency during handover procedure is a major challenge. A handover authentication protocol with nice properties can achieve goals. Protocols proposed in recent years more or less have some security vulnerability. In this paper, we outline security requirements for handover authentication protocols and then propose an anonymous protocol based on a new attribute-based signature scheme. The proposed protocol realizes conditional privacy preserving, user revocation, and session key update as well as mutual authentication and anonymity. Besides, it achieves fine-grained access control due to attributes representing real identity. What is more, experiment shows the proposed protocol has a superior performance.


---

## Body

## 1. Introduction

Nowadays, due to the wide use of mobile smart devices (e.g., PDA, smart phone pad, laptop PC, and vehicle) in our daily lives, we can enjoy Internet access services through mobile wireless networks such as mobile telecommunication networks, WLANs, and vehicular ad hoc networks. As a result, mobile wireless networks attract a lot of attention from both academia and industry [1–3]. Mobile nodes (MNs), access points (APs), and an authentication server (AS) are major entities in mobile wireless networks. Different types of entities have distinct features. For example, MNs have limited storage, computation, and communication capabilities; meanwhile APs have relatively formidable resources. MNs could move from one place to another one while APs have a limited geographical coverage. As a consequence, the handover occurs frequently. It needs an efficient security handover protocol when the handover occurs. An essential goal of the handover protocol is authentication. It aims to guarantee only valid MNs could access wireless networks and prevent illegal access request from adversaries. Mutual authentication is a basic requirement which a handover authentication protocol should meet. What is more, users’ privacy, such as ID information and location information, should be protected, so that anonymity is of importance in handover process. An anonymous handover authentication protocol could meet this requirement.Regardless of the technology implementation details, a typical handover authentication scenario is indicated in Figure1. An MN registers to AS firstly, then it could connect to an AP for accessing the network. Assume an MN, say M
N
i, enters in the geography coverage of a new access point A
P
j from current one A
P
j
-
1, handover authentication protocol should be executed by M
N
i and A
P
j. If it is performed successfully, A
P
j can recognize whether M
N
i is a legal user. Only if M
N
i is legal will A
P
j accept its access request. At the same time, a session key for protecting subsequent communication should be established between A
P
j and M
N
i.Figure 1
A typical scenario of handover.To design an anonymous handover authentication protocol is a hot issue for researchers. Generally, efficiency, security, and privacy should be considered carefully. First, an anonymous handover authentication protocol should have lightweight computation cost, especially on the MN side because of its limited resources. Further, the protocol should achieve good security such as data confidentiality and integrity for openness of wireless communication. At last, an anonymous handover authentication protocol should protect users’ privacy in case of serious crime caused by the leakage of private information.Attribute-based signature (ABS) is a type of public key signature. Different from ID-based public key signature, in attribute-based signature, each user is tagged with a set of attributions. Attributes only expose group characteristics and hide individual characteristics which can provide anonymity. Introducing ABS to handover authentication protocols is an innovative idea for it can address the anonymity issue. However, designing an attribute-based handover authentication also presents some challenges because of computation complexity of common ABS. The ABS scheme usually involves lots of pairing operation which is a type of cryptographic operation with high computation complexity. Only ABS with low computation complexity is suitable for handover authentication protocols in wireless networks.


### 1.1. Related Works

Protocols with cryptographic technology are very suitable for handover authentication goal. In recent years, a lot of authentication protocols [4–7] were proposed for access control in various networks. In particular, ID-based public key cryptography (PKC) protocols are common in the latest proposed protocols. But some proposed protocols are not satisfactory. Wang et al. [8] figured out the roots of the identified failures in existing schemes. They are inherently unable to achieve key compromise impersonation resistance for authentication protocols in which the authentication server also acts as the registration center. He et al. [9] proposed a handover authentication protocol called PairHand, which utilized ID-based PKC based on the bilinear pairing. Authors claimed PairHand had a better performance compared with previous protocols. However, He et al. [10] pointed out that PairHand had a risk of key compromise for an adversary could extract a private key from intercepted traffic. Although an improvement had been presented in [10], Yeo et al. [11] declared the new scheme also suffered from the compromised key problem. What a pity, Yeo et al. did not address this issue. Later, Tsai et al. [12] gave a security-enhanced handover authentication protocol.Later, an efficient attack [13] was given to show the vulnerability in PairHand [9] and the authors proposed an improved protocol also based on bilinear paring. At the same time, He et al. [14] did some improvement to enhance He et al.’s protocol [9]. Note that He et al. [15] and Liu et al. [16] independently presented two efficient handover authentication protocols without involving bilinear paring and map-to-point operation.Due to the computation complexity of bilinear pairing and map-to-point operation, to design handover authentication protocols without them is an attractive job. Some handover authentication protocols [17–20] using Elliptic Curve Cryptography (ECC) could achieve the security goal with smaller key length. Li et al. [17] proposed a protocol using ECC. Meanwhile Chaudhry et al. [18] pointed out that Li et al.’s protocol suffered from impersonation attack and gave an enhanced security protocol. Xie et al. [19] also presented the vulnerability in [17] and then proposed an improved handover authentication protocol to address it. Yang et al. [20] presented a handover authentication protocol using ECC to strengthen security too.Privacy protection requires handover authentication protocols to achieve anonymity. Some privacy-preserving protocols take advantage of pseudonyms to achieve anonymity [9–11, 17]. This type of method requires MNs to store a number of pseudonyms so that they can represent the true identifier to ensure privacy. Another type of method is using the group signature to provide anonymity [21]. In this way, any group member could produce a valid signature without involving private identity information. Therefore APs could verify the signature but could not determine which member did the signature. However, schemes based on the group signature usually have higher computation cost. Recently, attribute-based encryption was utilized to secure authentication [22]. However, the authors did not present concrete attribute-based encryption scheme and did not consider the high computation cost of common ABE scheme. Protocols with attribute-based encryption may not be suitable for confined devices in mobile wireless networks.


### 1.2. Our Contributions

To achieve security and efficiency as well as anonymity, we apply attribute-based signature to handover authentication protocols. We propose an attribute-based authentication protocol with light computation cost on the MN side. Compared with ID-based authentication protocols, attribute-based authentication protocols have a nice advantage due to their natural anonymity feature. To be specific, the major contributions of this paper are as follows.Firstly, we propose an ABS scheme with low computation complexity and give the security proof for it. Different from other ABS schemes, our ABS scheme is lightweight so that it is fit for handover authentication protocols in wireless networks.Secondly, we design a new handover authentication protocol based on our new lightweight ABS scheme. The new protocol meets requirements on security and efficiency. What is more, it provides anonymity inherently.Finally, we present detailed security analysis and performance analysis of our new protocol to demonstrate that it achieves security and efficiency indeed.


### 1.3. Organization

The rest of the paper is organized as follows. We introduce some preliminaries used in this paper in Section2. In Section 3, we describe our designed ABS scheme in detail and give its security proof. An attribute-based handover authentication protocol is proposed in Section 4. Security analysis and performance evaluation are given in Section 5. In Section 6, we conclude the whole paper.


## 1.1. Related Works

Protocols with cryptographic technology are very suitable for handover authentication goal. In recent years, a lot of authentication protocols [4–7] were proposed for access control in various networks. In particular, ID-based public key cryptography (PKC) protocols are common in the latest proposed protocols. But some proposed protocols are not satisfactory. Wang et al. [8] figured out the roots of the identified failures in existing schemes. They are inherently unable to achieve key compromise impersonation resistance for authentication protocols in which the authentication server also acts as the registration center. He et al. [9] proposed a handover authentication protocol called PairHand, which utilized ID-based PKC based on the bilinear pairing. Authors claimed PairHand had a better performance compared with previous protocols. However, He et al. [10] pointed out that PairHand had a risk of key compromise for an adversary could extract a private key from intercepted traffic. Although an improvement had been presented in [10], Yeo et al. [11] declared the new scheme also suffered from the compromised key problem. What a pity, Yeo et al. did not address this issue. Later, Tsai et al. [12] gave a security-enhanced handover authentication protocol.Later, an efficient attack [13] was given to show the vulnerability in PairHand [9] and the authors proposed an improved protocol also based on bilinear paring. At the same time, He et al. [14] did some improvement to enhance He et al.’s protocol [9]. Note that He et al. [15] and Liu et al. [16] independently presented two efficient handover authentication protocols without involving bilinear paring and map-to-point operation.Due to the computation complexity of bilinear pairing and map-to-point operation, to design handover authentication protocols without them is an attractive job. Some handover authentication protocols [17–20] using Elliptic Curve Cryptography (ECC) could achieve the security goal with smaller key length. Li et al. [17] proposed a protocol using ECC. Meanwhile Chaudhry et al. [18] pointed out that Li et al.’s protocol suffered from impersonation attack and gave an enhanced security protocol. Xie et al. [19] also presented the vulnerability in [17] and then proposed an improved handover authentication protocol to address it. Yang et al. [20] presented a handover authentication protocol using ECC to strengthen security too.Privacy protection requires handover authentication protocols to achieve anonymity. Some privacy-preserving protocols take advantage of pseudonyms to achieve anonymity [9–11, 17]. This type of method requires MNs to store a number of pseudonyms so that they can represent the true identifier to ensure privacy. Another type of method is using the group signature to provide anonymity [21]. In this way, any group member could produce a valid signature without involving private identity information. Therefore APs could verify the signature but could not determine which member did the signature. However, schemes based on the group signature usually have higher computation cost. Recently, attribute-based encryption was utilized to secure authentication [22]. However, the authors did not present concrete attribute-based encryption scheme and did not consider the high computation cost of common ABE scheme. Protocols with attribute-based encryption may not be suitable for confined devices in mobile wireless networks.


## 1.2. Our Contributions

To achieve security and efficiency as well as anonymity, we apply attribute-based signature to handover authentication protocols. We propose an attribute-based authentication protocol with light computation cost on the MN side. Compared with ID-based authentication protocols, attribute-based authentication protocols have a nice advantage due to their natural anonymity feature. To be specific, the major contributions of this paper are as follows.Firstly, we propose an ABS scheme with low computation complexity and give the security proof for it. Different from other ABS schemes, our ABS scheme is lightweight so that it is fit for handover authentication protocols in wireless networks.Secondly, we design a new handover authentication protocol based on our new lightweight ABS scheme. The new protocol meets requirements on security and efficiency. What is more, it provides anonymity inherently.Finally, we present detailed security analysis and performance analysis of our new protocol to demonstrate that it achieves security and efficiency indeed.


## 1.3. Organization

The rest of the paper is organized as follows. We introduce some preliminaries used in this paper in Section2. In Section 3, we describe our designed ABS scheme in detail and give its security proof. An attribute-based handover authentication protocol is proposed in Section 4. Security analysis and performance evaluation are given in Section 5. In Section 6, we conclude the whole paper.


## 2. Preliminaries

### 2.1. Bilinear Pairings and Computational Assumptions

LetG, G
T be cyclic groups of prime order p and g be a generator of G. A map e
:
G
×
G
→
G
T is a bilinear pairing if it satisfies the following properties: (1) being bilinear: e
g
a
,
g
b
=
e
g
,
g
a
b, where a
,
b
∈
Z
p
∗; (2) nondegeneracy: e
g
,
g
≠
1
G
T; (3) computability: there is an efficient algorithm to compute e
g
,
h for any g
,
h
∈
G.It is well known that the following problems are hard for no probabilistic polynomial time algorithm can solve them.Discrete Logarithm (DL) Problem.Given g
x
∈
G with an unknown integer x
∈
Z
p
∗, the DL problem is computing x in polynomial time.Computational Diffie-Hellman (CDH) Problem.Given g
x
,
g
y
∈
G, the goal of CDH problem is computing g
x
y, where x, y are two unknown integers in Z
p
∗.The CDH assumption means there is no probabilistic polynomial time algorithm that can solve the CDH problem with nonnegligible probability.


### 2.2. Security Requirements

For wireless communication, an adversary could control the communication channel between the MN and the AP. To ensure security, handover authentication protocol should meet the following security requirements [12, 14, 15].(1)
Mutual authentication: to guarantee only a legal MN and AP could communicate in the wireless network, the protocol should provide mutual confirmation of the MN’s and AP’s legitimacy.
(2)
Session key establishment: the MN and AP should establish a unique random session key which guarantees confidentiality and integrity of the communication session.
(3)
User anonymity and nontraceability: to protect the user’s privacy, except for AS, no one include the AP could extract MN’s identity or link any messages to the same user through intercepted messages.
(4)
Provision of user revocation: service to the MN should be terminated once it comes to the expiration time.
(5)
Updating session key periodically: in order to ensure strong security, when MN always accesses the Internet through the same AP, the session key needs to be updated periodically. This technique could reduce the risk due to a compromised session key.
(6)
Attack resistance: due to the open environment of mobile wireless networks, a handover authentication protocol should prevent common attacks such as the replay attack, the impersonation attack, and the man-in-the-middle attack.


## 2.1. Bilinear Pairings and Computational Assumptions

LetG, G
T be cyclic groups of prime order p and g be a generator of G. A map e
:
G
×
G
→
G
T is a bilinear pairing if it satisfies the following properties: (1) being bilinear: e
g
a
,
g
b
=
e
g
,
g
a
b, where a
,
b
∈
Z
p
∗; (2) nondegeneracy: e
g
,
g
≠
1
G
T; (3) computability: there is an efficient algorithm to compute e
g
,
h for any g
,
h
∈
G.It is well known that the following problems are hard for no probabilistic polynomial time algorithm can solve them.Discrete Logarithm (DL) Problem.Given g
x
∈
G with an unknown integer x
∈
Z
p
∗, the DL problem is computing x in polynomial time.Computational Diffie-Hellman (CDH) Problem.Given g
x
,
g
y
∈
G, the goal of CDH problem is computing g
x
y, where x, y are two unknown integers in Z
p
∗.The CDH assumption means there is no probabilistic polynomial time algorithm that can solve the CDH problem with nonnegligible probability.


## 2.2. Security Requirements

For wireless communication, an adversary could control the communication channel between the MN and the AP. To ensure security, handover authentication protocol should meet the following security requirements [12, 14, 15].(1)
Mutual authentication: to guarantee only a legal MN and AP could communicate in the wireless network, the protocol should provide mutual confirmation of the MN’s and AP’s legitimacy.
(2)
Session key establishment: the MN and AP should establish a unique random session key which guarantees confidentiality and integrity of the communication session.
(3)
User anonymity and nontraceability: to protect the user’s privacy, except for AS, no one include the AP could extract MN’s identity or link any messages to the same user through intercepted messages.
(4)
Provision of user revocation: service to the MN should be terminated once it comes to the expiration time.
(5)
Updating session key periodically: in order to ensure strong security, when MN always accesses the Internet through the same AP, the session key needs to be updated periodically. This technique could reduce the risk due to a compromised session key.
(6)
Attack resistance: due to the open environment of mobile wireless networks, a handover authentication protocol should prevent common attacks such as the replay attack, the impersonation attack, and the man-in-the-middle attack.


## 3. A High Efficiency ABS Scheme

Different from ID-based signature scheme taking identity to generate the public key, attribute-based signature scheme utilizes attributes to produce the public key. It has a nice property that an adversary could not determine the identity according to user’s attributes. Attributes refer to some features a user may have, such as gender, job, and privilege. Let the universal set of attributes beA
t
t
=
a
t
t
1
,
a
t
t
2
,
…
,
a
t
t
n and for each a
t
t
i its value set be S
i
=
v
i
,
1
,
v
i
,
2
,
…
,
v
i
,
n
i, where S
i
=
n
i. A user’s attribute list is denoted as L
=
l
1
,
l
2
,
…
,
l
n, and the access structure is denoted as W
=
w
1
,
w
2
,
…
,
w
n, where w
i
,
l
i
∈
S
i. There are 4 algorithms in our proposed ABS scheme.ABS.Setup.The AS takes a security parameter τ with universal attribute set A
t
t and outputs system public parameters p
a
r
a
m
s and master key m
k.ABS.KeyGen.Upon receiving a register request with an attribute list L, the AS runs the algorithm to generate a secret key s
k
L with input L,params, and sends s
k
L to the user securely.ABS.Sign.To sign a messagemsg, the signer runs this algorithm with inputmsg, W, s
k
L and returns the signature σ.ABS.Verify.To verify a signature, the verifier runs the algorithm withmsg, W, and σ and outputs “reject” or “accept” according to the validity of the signature.


### 3.1. Security Model

Similar to security against existential forgery on adaptively chosen message attacks, we define the security model through a game between a challengerB and an attacker A. The game is defined below.Setup.The challenger B runs theABS.Setup algorithm and outputsparams and m
k. The challenger keeps m
k secret and sendsparams to A.Query.
A makes a series of queries to B adaptively, and B responses in the following way.(i) Key Query. Attacker A issues this query to acquire private key s
k
L related to attribute list L. B runsABS.KeyGen algorithm with input L
,
p
a
r
a
m
s and sends the output s
k
L to A.(ii) Signing Query. When A issues a signing query with a messagemsg, access structure W, B runsABS.Sign algorithm and returns a signature σ to A.Forgery.
A outputs a tuple msg
∗
,
L
∗
,
W
∗
,
σ
∗.If the following conditions hold, an attack is successful:(1)A
B
S
.
V
e
r
i
f
y
msg
∗
,
W
∗
,
σ
∗
=
a
c
c
e
p
t.(2)A does not issue the key query on L
∗.(3)A does not issue the signing query on msg
∗
,
W
∗.The probability of a successful attack is defined asA’s advantage A
d
v
A.Definition 1.
An attribute-based signature is existentially unforgeable against adaptive chosen message if there is no probabilistic polynomial time adversary that has a nonnegligible advantage in the game.


### 3.2. Construction

A
B
S
.
S
e
t
u
p
τ
,
A
t
t. The AS chooses two cyclic groups G, G
T of prime order p with a bilinear map e
:
G
×
G
→
G
T, random numbers α
∈
Z
p
∗, g
1
=
g
α, g
2
∈
G, where g is a generator of G and sets the value Y
1
=
e
g
1
,
g
2, Y
2
=
e
g
,
g
2. Then AS randomly selects u
′
∈
Z
p
∗, m
′
∈
G, ak-length vector γ
¯
=
u
i with elements chosen at random from Z
p
∗, and ak-length vector η
¯
=
m
i with elements chosen at random from G. So the public parameters set is(1)
p
a
r
a
m
s
=
p
,
g
,
g
0
,
g
1
,
g
2
,
u
′
,
m
′
,
Y
1
,
Y
2
,
γ
¯
,
η
¯
,
H
,where g
0 is a generator of G
T and H is a secure hash function H
:
0,1
∗
→
0,1
k. The master private key is α.ABS.KeyGen(L, params).A user sends its attribute list L and identity informationID to register at the AS. The AS computes ak-bit string v
=
H
L. Let v
i denote the ith bit of v and V be a subset of 1,2
,
…
,
k, where V
=
i
∣
v
i
=
1. Then the AS randomly chooses a number t
∈
Z
p
∗ and computes λ
=
u
′
+
∑
i
∈
V
u
i, d
0
=
g
2
α
·
g
2
λ
t, d
1
=
Y
2
t. Note that if λ
t
+
α
=
0
m
o
d
p, the AS selects a new t. Finally, the AS sends the generated private key s
k
L
=
d
0
,
d
1 to the user. For security, the user can verify whether the following equation holds: e
g
,
d
0
=
Y
1
·
d
1
λ
.ABS.Sign(msg,W, skL).If the user’s attribute list L satisfies the access structure, a messagemsg is signed by the user with its private key s
k
L
=
d
0
,
d
1 as follows. The user computes ak-bit string y
=
H
msg. let y
i denote the ith bits of y and M be a subset of 1,2
,
…
,
k, where M
=
i
∣
y
i
=
1. Then the signer selects random numbers t
′, s
∈
Z
p
∗, and computes(2)
σ
1
=
d
0
·
g
2
λ
·
t
′
·
m
′
·
∏
i
∈
M
m
i
s
,
σ
2
=
g
s
,
σ
3
=
d
1
t
′
,where λ
=
u
′
+
∑
i
∈
V
u
i. So the signature ofmsg is σ
=
σ
1
,
σ
2
,
σ
3.ABS.Verify(msg, W,σ).The verifier computes ak-bit string q
=
H
W. Let q
i denote the ith bit of q and Q be a subset of 1,2
,
…
,
k, where Q
=
i
∣
q
i
=
1. Then verifier computes λ
′
=
u
′
+
∑
i
∈
Q
u
i and checks whether the following equation holds: (3)
e
g
,
σ
1
=
Y
1
·
σ
3
λ
′
·
e
σ
2
,
m
′
∏
i
∈
M
m
i
.If it holds, the verifier outputs “accept”; namely, the signature is valid. Otherwise, the verifier outputs “reject”; namely, the signature is illegal.


### 3.3. Security Analysis

We analyze the security of above proposed ABS scheme according to the security model defined in Section3.1.Lemma 2.
If there is an adversary that makes at mostq
e, q
s queries for key query and signing query, respectively, and breaks the proposed signature scheme with nonnegligible probability ε, then there exists a challenger that can solve the CDH problem with advantage (4)
ε
′
≥
ε
16
q
e
+
q
s
q
s
k
+
1
2
.Proof.
SupposeA is an adversary that wins the attack game with advantage ε. We construct an algorithm B to act as a challenger for the adversary. Suppose B is given a CDH instance g
,
g
a
,
g
b, where g is a generator of a cyclic group G of order p and B does not know a, b. In order to compute g
a
b, the simulation communication is as follows.
Setup.Let l
v
=
2
q
e
+
q
s, l
y
=
2
q
s, and B randomly selects k
v
∈
Z
l
v, k
y
∈
Z
l
y, 0
≤
k
v
,
k
y
≤
k. And for given q
e
,
q
s
,
k, B ensures l
v
k
+
1
<
p, l
y
k
+
1
<
p. Then B randomly chooses numbers x
′
∈
Z
l
v
,
z
′
∈
Z
l
y
,
ω
′
∈
Z
p andk-length vectors X
=
x
i, Z
=
z
i, Φ
=
ω
i, where x
i
∈
Z
l
v, z
i
∈
Z
l
y, ω
i
∈
Z
p. 3 functions are defined as follows:(5)
F
v
=
x
′
+
∑
i
∈
V
x
i
-
l
v
k
v
,
K
y
=
z
′
+
∑
i
∈
M
z
i
-
l
y
k
y
,
L
y
=
ω
′
+
∑
i
∈
M
w
i
.
FinallyB calculates system parameters as follows:(6)
g
1
=
g
a
,
g
2
=
g
b
,
u
′
=
-
l
v
k
v
+
x
′
,
u
i
=
x
i
,
1
≤
i
≤
k
,
m
′
=
g
2
-
l
y
·
k
y
+
z
′
+
g
ω
′
x
′
,
m
i
=
g
2
z
i
+
g
ω
i
,
1
≤
i
≤
k
,
so(7)
g
2
α
=
g
2
a
=
g
a
b
,
u
′
+
∑
i
∈
V
u
i
=
F
v
,
m
′
∏
j
∈
M
m
j
=
g
2
K
y
g
L
y
.
Query.Algorithm B acts as a challenger to communicate with an adversary A as follows.
(i) Key Query. On receiving a key query on attribute list L, B could generate related private key if F
v
≠
0
m
o
d
p, although B does not know the master key. B randomly selects t
∈
Z
p and calculates (8)
s
k
L
=
d
0
,
d
1
=
g
1
-
1
g
g
2
t
λ
,
e
g
g
2
,
g
t
g
1
-
1
/
λ
,where λ
=
u
′
+
∑
i
∈
V
u
i. Then B sends s
k
L to A and A could verify it. For an attacker, the above private key and the one generated by a true challenger are undistinguishable, because(9)
s
k
L
=
d
0
,
d
1
=
g
2
a
g
2
λ
t
′
,
Y
2
t
′
,where(10)
t
′
=
1
+
1
b
t
-
a
F
v
.
IfF
v
=
0
m
o
d
p, B will abort.
In order to calculate probability simply, we setF
v
≠
0
m
o
d
l
v as the condition of generating valid private key. This is reasonable because F
v
≠
0
m
o
d
l
v indicates F
v
≠
0
m
o
d
p, due to 0
≤
l
v
k
+
1
<
p, 0
≤
k
v
≤
k.
Signing Query. When A issues a signing query on msg
,
W, if K
y
≠
0
m
o
d
p, B chooses s
,
t
∈
Z
p randomly and calculates (11)
σ
=
σ
1
,
σ
2
,
σ
3
=
g
2
t
λ
′
g
1
-
L
y
/
K
y
m
′
∏
j
∈
M
m
j
s
,
g
s
g
1
-
1
/
K
y
,
Y
2
t
=
g
2
t
λ
′
g
2
α
m
′
∏
j
∈
M
m
j
s
′
,
g
s
′
,
Y
2
t
,
where
s
′
=
s
-
a
K
y
.
B Sends σ to A, and A could verify the validity of the signature. Of course, for attacker A, the signature generated by B is undistinguishable from the one generated by a true challenger.
IfK
y
=
0
m
o
d
p, B will abort. Similar to key query, we set K
y
≠
0
m
o
d
l
y as the condition of generating a valid signature.
Forgery.Finally, if B does not abort during above queries, the adversary outputs a forgery σ
∗
=
σ
1
∗
,
σ
2
∗
,
σ
3
∗ on message msg
∗, access structure W
∗ with a probability ε. Here we assume σ
1
∗
=
g
2
a
g
2
λ
t
∗
·
m
′
∏
j
∈
M
m
j
s
∗,  σ
2
∗
=
g
s
∗,  σ
3
∗
=
Y
2
t
∗, and A does not issue a signing query on msg
∗ and key query on L
∗ which satisfies W
∗. If K
y
∗
≠
0
m
o
d
p or F
v
∗
≠
0
m
o
d
p, B will abort. If K
y
∗
=
0
m
o
d
p and F
v
∗
=
0
m
o
d
p, B computes and outputs(12)
σ
1
∗
σ
2
∗
L
y
∗
=
g
2
a
+
t
∗
λ
·
m
′
∏
j
∈
M
m
j
s
∗
g
L
y
∗
s
∗
=
g
2
a
=
g
a
b
,which is the solution to the given CDH problem.
We analyze the probability ofB outputting the solution to CDH problem, namely, B not aborting. For the case without aborting, we require that all key queries will have F
v
≠
0
m
o
d
p, and all signing queries will have K
y
≠
0
m
o
d
p and that K
y
∗
=
0
m
o
d
p and F
v
∗
=
0
m
o
d
p in forgery.
For convenience, we will define the eventsA
i
,
A
∗
,
B
i
,
B
∗ as follows: A
i: F
v
_
i
≠
0
m
o
d
l
v,  with i
=
1,2
,
…
,
q
e;
A
∗: F
v
∗
=
0
m
o
d
p;
B
i: K
y
_
i
≠
0
m
o
d
l
y,  with i
=
1,2
,
…
,
q
s;
B
∗: K
y
∗
=
0
m
o
d
p.
So the probability ofB not aborting is (13)
P
r
n
o
t
_
a
b
o
r
t
=
P
r
⋂
i
=
1
q
e
+
q
s
A
i
∧
A
∗
∧
⋂
i
=
1
q
e
B
i
∧
B
∗
.
We have(14)
P
r
A
∗
=
P
r
F
v
∗
=
0
m
o
d
p
∧
F
v
∗
=
0
m
o
d
l
v
=
P
r
F
v
∗
=
0
m
o
d
l
v
·
P
r
F
v
∗
=
0
m
o
d
p
∣
F
v
∗
=
0
m
o
d
l
v
=
1
l
v
k
+
1
,
(15)
P
r
⋂
i
=
1
q
e
+
q
s
A
i
=
P
r
1
-
⋃
i
=
1
q
e
+
q
s
A
i
¯
≥
1
-
q
e
+
q
s
l
v
.
Due tol
v
=
2
q
e
+
q
s, we have(16)
P
r
⋂
i
=
1
q
e
+
q
s
A
i
∧
A
∗
≥
1
4
q
e
+
q
s
k
+
1
.
Similarly, we haveP
r
⋂
i
=
1
q
s
B
i
∧
B
∗
≥
1
/
4
q
s
k
+
1, so that the probability of B not aborting is (17)
P
r
n
o
t
_
a
b
o
r
t
=
P
r
⋂
i
=
1
q
e
+
q
s
A
i
∧
A
∗
∧
⋂
i
=
1
q
e
B
i
∧
B
∗
=
P
r
⋂
i
=
1
q
e
+
q
s
A
i
∧
A
∗
∧
P
r
⋂
i
=
1
q
s
B
i
∧
B
∗
≥
1
16
q
e
+
q
s
q
s
k
+
1
2
.
In general, if simulation does not abort and an attacker breaks the proposed signature scheme with nonnegligible probabilityε, then B could give a solution to CDH problem with the probability ε
′, where(18)
ε
′
≥
ε
16
q
e
+
q
s
q
s
k
+
1
2
.So we have the following theorem.Theorem 3.
The proposed attribute-based signature scheme is existence unforgeable against adaptive chosen message and attribute list attack under CDH assumption.


## 3.1. Security Model

Similar to security against existential forgery on adaptively chosen message attacks, we define the security model through a game between a challengerB and an attacker A. The game is defined below.Setup.The challenger B runs theABS.Setup algorithm and outputsparams and m
k. The challenger keeps m
k secret and sendsparams to A.Query.
A makes a series of queries to B adaptively, and B responses in the following way.(i) Key Query. Attacker A issues this query to acquire private key s
k
L related to attribute list L. B runsABS.KeyGen algorithm with input L
,
p
a
r
a
m
s and sends the output s
k
L to A.(ii) Signing Query. When A issues a signing query with a messagemsg, access structure W, B runsABS.Sign algorithm and returns a signature σ to A.Forgery.
A outputs a tuple msg
∗
,
L
∗
,
W
∗
,
σ
∗.If the following conditions hold, an attack is successful:(1)A
B
S
.
V
e
r
i
f
y
msg
∗
,
W
∗
,
σ
∗
=
a
c
c
e
p
t.(2)A does not issue the key query on L
∗.(3)A does not issue the signing query on msg
∗
,
W
∗.The probability of a successful attack is defined asA’s advantage A
d
v
A.Definition 1.
An attribute-based signature is existentially unforgeable against adaptive chosen message if there is no probabilistic polynomial time adversary that has a nonnegligible advantage in the game.


## 3.2. Construction

A
B
S
.
S
e
t
u
p
τ
,
A
t
t. The AS chooses two cyclic groups G, G
T of prime order p with a bilinear map e
:
G
×
G
→
G
T, random numbers α
∈
Z
p
∗, g
1
=
g
α, g
2
∈
G, where g is a generator of G and sets the value Y
1
=
e
g
1
,
g
2, Y
2
=
e
g
,
g
2. Then AS randomly selects u
′
∈
Z
p
∗, m
′
∈
G, ak-length vector γ
¯
=
u
i with elements chosen at random from Z
p
∗, and ak-length vector η
¯
=
m
i with elements chosen at random from G. So the public parameters set is(1)
p
a
r
a
m
s
=
p
,
g
,
g
0
,
g
1
,
g
2
,
u
′
,
m
′
,
Y
1
,
Y
2
,
γ
¯
,
η
¯
,
H
,where g
0 is a generator of G
T and H is a secure hash function H
:
0,1
∗
→
0,1
k. The master private key is α.ABS.KeyGen(L, params).A user sends its attribute list L and identity informationID to register at the AS. The AS computes ak-bit string v
=
H
L. Let v
i denote the ith bit of v and V be a subset of 1,2
,
…
,
k, where V
=
i
∣
v
i
=
1. Then the AS randomly chooses a number t
∈
Z
p
∗ and computes λ
=
u
′
+
∑
i
∈
V
u
i, d
0
=
g
2
α
·
g
2
λ
t, d
1
=
Y
2
t. Note that if λ
t
+
α
=
0
m
o
d
p, the AS selects a new t. Finally, the AS sends the generated private key s
k
L
=
d
0
,
d
1 to the user. For security, the user can verify whether the following equation holds: e
g
,
d
0
=
Y
1
·
d
1
λ
.ABS.Sign(msg,W, skL).If the user’s attribute list L satisfies the access structure, a messagemsg is signed by the user with its private key s
k
L
=
d
0
,
d
1 as follows. The user computes ak-bit string y
=
H
msg. let y
i denote the ith bits of y and M be a subset of 1,2
,
…
,
k, where M
=
i
∣
y
i
=
1. Then the signer selects random numbers t
′, s
∈
Z
p
∗, and computes(2)
σ
1
=
d
0
·
g
2
λ
·
t
′
·
m
′
·
∏
i
∈
M
m
i
s
,
σ
2
=
g
s
,
σ
3
=
d
1
t
′
,where λ
=
u
′
+
∑
i
∈
V
u
i. So the signature ofmsg is σ
=
σ
1
,
σ
2
,
σ
3.ABS.Verify(msg, W,σ).The verifier computes ak-bit string q
=
H
W. Let q
i denote the ith bit of q and Q be a subset of 1,2
,
…
,
k, where Q
=
i
∣
q
i
=
1. Then verifier computes λ
′
=
u
′
+
∑
i
∈
Q
u
i and checks whether the following equation holds: (3)
e
g
,
σ
1
=
Y
1
·
σ
3
λ
′
·
e
σ
2
,
m
′
∏
i
∈
M
m
i
.If it holds, the verifier outputs “accept”; namely, the signature is valid. Otherwise, the verifier outputs “reject”; namely, the signature is illegal.


## 3.3. Security Analysis

We analyze the security of above proposed ABS scheme according to the security model defined in Section3.1.Lemma 2.
If there is an adversary that makes at mostq
e, q
s queries for key query and signing query, respectively, and breaks the proposed signature scheme with nonnegligible probability ε, then there exists a challenger that can solve the CDH problem with advantage (4)
ε
′
≥
ε
16
q
e
+
q
s
q
s
k
+
1
2
.Proof.
SupposeA is an adversary that wins the attack game with advantage ε. We construct an algorithm B to act as a challenger for the adversary. Suppose B is given a CDH instance g
,
g
a
,
g
b, where g is a generator of a cyclic group G of order p and B does not know a, b. In order to compute g
a
b, the simulation communication is as follows.
Setup.Let l
v
=
2
q
e
+
q
s, l
y
=
2
q
s, and B randomly selects k
v
∈
Z
l
v, k
y
∈
Z
l
y, 0
≤
k
v
,
k
y
≤
k. And for given q
e
,
q
s
,
k, B ensures l
v
k
+
1
<
p, l
y
k
+
1
<
p. Then B randomly chooses numbers x
′
∈
Z
l
v
,
z
′
∈
Z
l
y
,
ω
′
∈
Z
p andk-length vectors X
=
x
i, Z
=
z
i, Φ
=
ω
i, where x
i
∈
Z
l
v, z
i
∈
Z
l
y, ω
i
∈
Z
p. 3 functions are defined as follows:(5)
F
v
=
x
′
+
∑
i
∈
V
x
i
-
l
v
k
v
,
K
y
=
z
′
+
∑
i
∈
M
z
i
-
l
y
k
y
,
L
y
=
ω
′
+
∑
i
∈
M
w
i
.
FinallyB calculates system parameters as follows:(6)
g
1
=
g
a
,
g
2
=
g
b
,
u
′
=
-
l
v
k
v
+
x
′
,
u
i
=
x
i
,
1
≤
i
≤
k
,
m
′
=
g
2
-
l
y
·
k
y
+
z
′
+
g
ω
′
x
′
,
m
i
=
g
2
z
i
+
g
ω
i
,
1
≤
i
≤
k
,
so(7)
g
2
α
=
g
2
a
=
g
a
b
,
u
′
+
∑
i
∈
V
u
i
=
F
v
,
m
′
∏
j
∈
M
m
j
=
g
2
K
y
g
L
y
.
Query.Algorithm B acts as a challenger to communicate with an adversary A as follows.
(i) Key Query. On receiving a key query on attribute list L, B could generate related private key if F
v
≠
0
m
o
d
p, although B does not know the master key. B randomly selects t
∈
Z
p and calculates (8)
s
k
L
=
d
0
,
d
1
=
g
1
-
1
g
g
2
t
λ
,
e
g
g
2
,
g
t
g
1
-
1
/
λ
,where λ
=
u
′
+
∑
i
∈
V
u
i. Then B sends s
k
L to A and A could verify it. For an attacker, the above private key and the one generated by a true challenger are undistinguishable, because(9)
s
k
L
=
d
0
,
d
1
=
g
2
a
g
2
λ
t
′
,
Y
2
t
′
,where(10)
t
′
=
1
+
1
b
t
-
a
F
v
.
IfF
v
=
0
m
o
d
p, B will abort.
In order to calculate probability simply, we setF
v
≠
0
m
o
d
l
v as the condition of generating valid private key. This is reasonable because F
v
≠
0
m
o
d
l
v indicates F
v
≠
0
m
o
d
p, due to 0
≤
l
v
k
+
1
<
p, 0
≤
k
v
≤
k.
Signing Query. When A issues a signing query on msg
,
W, if K
y
≠
0
m
o
d
p, B chooses s
,
t
∈
Z
p randomly and calculates (11)
σ
=
σ
1
,
σ
2
,
σ
3
=
g
2
t
λ
′
g
1
-
L
y
/
K
y
m
′
∏
j
∈
M
m
j
s
,
g
s
g
1
-
1
/
K
y
,
Y
2
t
=
g
2
t
λ
′
g
2
α
m
′
∏
j
∈
M
m
j
s
′
,
g
s
′
,
Y
2
t
,
where
s
′
=
s
-
a
K
y
.
B Sends σ to A, and A could verify the validity of the signature. Of course, for attacker A, the signature generated by B is undistinguishable from the one generated by a true challenger.
IfK
y
=
0
m
o
d
p, B will abort. Similar to key query, we set K
y
≠
0
m
o
d
l
y as the condition of generating a valid signature.
Forgery.Finally, if B does not abort during above queries, the adversary outputs a forgery σ
∗
=
σ
1
∗
,
σ
2
∗
,
σ
3
∗ on message msg
∗, access structure W
∗ with a probability ε. Here we assume σ
1
∗
=
g
2
a
g
2
λ
t
∗
·
m
′
∏
j
∈
M
m
j
s
∗,  σ
2
∗
=
g
s
∗,  σ
3
∗
=
Y
2
t
∗, and A does not issue a signing query on msg
∗ and key query on L
∗ which satisfies W
∗. If K
y
∗
≠
0
m
o
d
p or F
v
∗
≠
0
m
o
d
p, B will abort. If K
y
∗
=
0
m
o
d
p and F
v
∗
=
0
m
o
d
p, B computes and outputs(12)
σ
1
∗
σ
2
∗
L
y
∗
=
g
2
a
+
t
∗
λ
·
m
′
∏
j
∈
M
m
j
s
∗
g
L
y
∗
s
∗
=
g
2
a
=
g
a
b
,which is the solution to the given CDH problem.
We analyze the probability ofB outputting the solution to CDH problem, namely, B not aborting. For the case without aborting, we require that all key queries will have F
v
≠
0
m
o
d
p, and all signing queries will have K
y
≠
0
m
o
d
p and that K
y
∗
=
0
m
o
d
p and F
v
∗
=
0
m
o
d
p in forgery.
For convenience, we will define the eventsA
i
,
A
∗
,
B
i
,
B
∗ as follows: A
i: F
v
_
i
≠
0
m
o
d
l
v,  with i
=
1,2
,
…
,
q
e;
A
∗: F
v
∗
=
0
m
o
d
p;
B
i: K
y
_
i
≠
0
m
o
d
l
y,  with i
=
1,2
,
…
,
q
s;
B
∗: K
y
∗
=
0
m
o
d
p.
So the probability ofB not aborting is (13)
P
r
n
o
t
_
a
b
o
r
t
=
P
r
⋂
i
=
1
q
e
+
q
s
A
i
∧
A
∗
∧
⋂
i
=
1
q
e
B
i
∧
B
∗
.
We have(14)
P
r
A
∗
=
P
r
F
v
∗
=
0
m
o
d
p
∧
F
v
∗
=
0
m
o
d
l
v
=
P
r
F
v
∗
=
0
m
o
d
l
v
·
P
r
F
v
∗
=
0
m
o
d
p
∣
F
v
∗
=
0
m
o
d
l
v
=
1
l
v
k
+
1
,
(15)
P
r
⋂
i
=
1
q
e
+
q
s
A
i
=
P
r
1
-
⋃
i
=
1
q
e
+
q
s
A
i
¯
≥
1
-
q
e
+
q
s
l
v
.
Due tol
v
=
2
q
e
+
q
s, we have(16)
P
r
⋂
i
=
1
q
e
+
q
s
A
i
∧
A
∗
≥
1
4
q
e
+
q
s
k
+
1
.
Similarly, we haveP
r
⋂
i
=
1
q
s
B
i
∧
B
∗
≥
1
/
4
q
s
k
+
1, so that the probability of B not aborting is (17)
P
r
n
o
t
_
a
b
o
r
t
=
P
r
⋂
i
=
1
q
e
+
q
s
A
i
∧
A
∗
∧
⋂
i
=
1
q
e
B
i
∧
B
∗
=
P
r
⋂
i
=
1
q
e
+
q
s
A
i
∧
A
∗
∧
P
r
⋂
i
=
1
q
s
B
i
∧
B
∗
≥
1
16
q
e
+
q
s
q
s
k
+
1
2
.
In general, if simulation does not abort and an attacker breaks the proposed signature scheme with nonnegligible probabilityε, then B could give a solution to CDH problem with the probability ε
′, where(18)
ε
′
≥
ε
16
q
e
+
q
s
q
s
k
+
1
2
.So we have the following theorem.Theorem 3.
The proposed attribute-based signature scheme is existence unforgeable against adaptive chosen message and attribute list attack under CDH assumption.


## 4. The Proposed Handover Authentication Protocol

Based on our designed signature scheme, we propose a new handover authentication protocol. We consider that each AP has a signing/verification key pairp
k
,
s
k of a common digital signature scheme ECDSA [23]. To guarantee revocation check, we make some extension of the algorithm A
B
S
.
K
e
y
G
e
n
· in Section 3. The AS also generates extra revocation information for the user. For interval index t
s
j, the revocation information of the user is β
j
=
H
¯
r
k
j
I
D, where r
k is a random number selected for the user by AS and H
¯
r
k
j
· is a keyed hash chain.In the following, we describe the protocol in detail. Assume the handover authentication protocol is carried out betweenM
N
i and A
P
j. According to the signature algorithm, M
N
i acquires its private key s
k
L and revocation information β
i
,
j for each t
s
j. The protocol is illustrated in Figure 2. And the notations used to describe the protocol are listed as follows.(i)
W: specified access structure
(ii)
t
s: timestamp
(iii)
I
D
A
P
j: identity of A
P
j
(iv)
β
i
,
j: revocation information with time interval index t
s
j for M
N
i
(v)
L: attribute list owned by MN
(vi)
s
k
L: MN’s secret private key on attribute list L
(vii)
a,  b: random numbers in Z
p
∗
(viii)
σ
i,  σ
j: digital signature of M
N
i and A
P
j, respectively
(ix)
S
K: session key.Figure 2
Handover authentication procedure.(
1
)  M
N
i could obtain the access structure W from the beacon message from A
P
j. If its attribute list satisfies the access structure, then M
N
i firstly selects a random number a
∈
Z
p
∗ and generates σ
i
=
A
B
S
.
Sign
msg
,
L
,
s
k
L, where msg
=
I
D
A
P
j
∥
g
0
a
∥
t
s
∥
β
i
,
j. And then it sends msg
,
σ
i to A
P
j. Here a timestamp t
s is added for revocation check and replay attack prevention.(
2
) After receiving the signature message msg
,
σ
i from M
N
i, A
P
j checks the time t
s to prevent replay attack and executes the revocation check (the details in Revocation). If it passes the above check, then A
P
j verifies the signature. If the signature is invalid, A
P
j rejects it; otherwise, A
P
j selects a random number b
∈
Z
p
∗ and computes σ
j
=
E
C
D
S
A
.
Sig
rmsg
,
s
k
j, where rmsg
=
I
D
A
P
j
∥
g
0
a
∥
g
0
b. Then A
P
j sends rmsg
,
σ
j back to M
N
i. Finally, A
P
j computes the session key S
K
=
g
0
a
b and erases the random number b from its memory.(
3
) Upon receiving rmsg
,
σ
j, M
N
i verifies σ
j according to E
C
D
S
A
.
V
e
r
·. If the algorithm returns 1, M
N
i generates the session key S
K
=
g
0
b
a and erases the random number a from its memory. After that, M
N
i generates I
D
A
P
j
∥
g
0
a
∥
g
0
b
S
K and then sends it to A
P
j. Here X
K refers to using a symmetric key K to encrypt a message X. After receiving the encrypted message, A
P
j decrypts and verifies it with S
K. If the message is valid, A
P
j believes that they have established a session key S
K; otherwise, it rejects the access request.Session Key Update.When M
N
i is always connecting to the same AP, assume their current session key is S
K
j
. They establish a new session key as follows. (
1
)  M
N
i chooses a random number c
∈
Z
p
∗, computes g
0
c
,
A
u
t
1
=
H
S
K
j
∥
g
0
c, and sends g
0
c
,
A
u
t
1 to the AP. (
2
) Upon receipt of g
0
c
,
A
u
t
1, the AP uses current to S
K
j compute a verification code V
e
r
1
=
H
S
K
j
∥
g
0
c and compares it with A
u
t
1. If V
e
r
1 does not match A
u
t
1, the AP rejects session key update; otherwise, the AP concludes that the message is from M
N
i. Then the AP randomly picks d
∈
Z
p
∗, computes(19)
g
0
d
,
S
K
j
+
1
=
g
0
c
d
,
A
u
t
2
=
H
S
K
j
+
1
,
g
0
c
,
g
0
d
.and erases d from its memory. Finally, AP transmits g
0
d
,
A
u
t
2 to M
N
i. (
3
) Upon receiving the message from the AP, M
N
i computes S
K
j
+
1
′
=
g
0
d
c, generates a verification code V
e
r
2
=
H
S
K
j
+
1
′
,
g
0
c
,
g
0
d, and compares it with A
u
t
2. If V
e
r
2 matches A
u
t
2, M
N
i erases c from its memory and believes that they have established a new session key S
K
j
+
1; otherwise, M
N
i rejects session key update.Revocation.The detailed revocation check is described as follows. (
1
) The AS generates a revocation list R
L
j which consists of revocation information corresponding to t
s
j and transmits it to every AP along with secret key r
k
i corresponding to the revoked user. This can prevent the revoked user access to the network. (
2
) Upon acquiring R
L
j, each AP updates β
i
,
j
-
1 as follows: for any β
i
,
j
-
1
∈
R
L
j
-
1, β
i
,
j
=
H
¯
r
k
i
β
i
,
j
-
1. Then AP stores both R
L
j
-
1 and R
L
j in its database. (
3
) During the handover authentication procedure, upon receipt of msg
,
σ
i, the AP parses the revocation information β
i
,
j and checks whether it is in the revocation list R
L
j. If β
i
,
j is in R
L
j, the user is revoked. As a result, the handover request is rejected. Otherwise, the protocol performs next steps sequentially.


## 5. Security Analysis and Performance Evaluation

### 5.1. Security Analysis

We present the security analysis of the proposed protocol to check whether it achieves the security goal mentioned in Section2.Mutual Authentication.On one hand, AP authentication is ensured by the challenge-response pair msg
,
E
C
D
S
A
.
Sig
rmsg
,
s
k
j. Due to the security of digital signature, only A
P
j that has s
k
j can generate a valid signature on a fresh challenge g
0
a from M
N
i. If the signature passes the verification E
C
D
S
A
.
V
e
r
·, it will demonstrate the AP is a trusted valid entity. On the other hand, the designed ABS scheme provides user authentication. Only the user that has the right key on right attribute list (satisfying the access structure) could generate the valid signature. In other words, a malicious node could neither impersonate a valid node nor pass the authentication. Therefore, the proposed protocol achieves mutual authentication.Key Establishment.As described in protocol, M
N
i and A
P
j, respectively, use g
0
a and g
0
b to complete DH key establishment. On one hand, M
N
i figures out g
0
b
a. On the other hand, A
P
j figures out g
0
a
b. Obviously, g
0
b
a
=
g
0
a
b. As a result, both compute the session key S
K
=
g
0
a
b. Besides, any adversary could not calculate the secret session key due to the CDH problem.User Anonymity and Nontraceability.Due to the outstanding property of attribute-based signature, the identity information is not contained in the transmitted message in the whole handover authentication procedure. So except for the AS, nobody could tell the identity of the user including the AP. In addition, the request messagemsg does not contain any specific privacy information of the MN except for the revocation information β
i
,
j. Since β
i
,
j is a secure hash value, an adversary could not parse the identity of a user or trace the user. So user anonymity and nontraceability are guaranteed.User Revocation.Once the revocation hash value β
i
,
j of M
N
i exists in the revocation list R
L
j with t
s
j, it will exist in the database in the future due to update technique of the AP. If β
i
,
j exists in R
L
j, it means M
N
i is revoked since the time t
s
j, and as a result the authentication fails.Updating Session Key Periodically.As described in session key update phase, the MN and AP could establish a new session key successfully according to the current session key. In detail, The MN and AP leverage a new Diffie-Hellman key establishment procedure to generate a new session key. This is based on the hard DL problem and CDH problem. Once a new session key is established, the previous one is destroyed securely, so that adversaries could not reveal the new session key.Besides, the protocol could prevent replay attack due to timestamp. It is important that only the AS could find the real identity of a user according toβ
i
,
j
=
H
¯
r
k
i
I
D
i since r
k
i is selected for M
N
i by the AS. So the protocol achieves conditional privacy preservation too.For convenience, we let P1, P2, P3, P4, P5, and P6 denote mutual authentication, user anonymity with nontraceability, session key update, conditional privacy preserving, session key establishment, and user revocation, respectively. Security comparisons between our protocol and 3 other protocols are presented in Table1. In general, our protocol meets all the security requirements in the table while the other 3 protocols more or less have some security vulnerability. All protocols could guarantee session key establishment but only ours adds the session key update technique. Except for our protocol, the other 3 protocols do not meet the requirements of conditional privacy preserving and user revocation. Moreover, they neither achieve user anonymity nor achieve nontraceability, so that our protocol has an obvious advantage of security.Table 1
Security comparisons of four protocols.
P1
P2
P3
P4
P5
P6
He et al.’s protocol [9]
No
No
No
No
Yes
No
He et al.’s protocol [14]
Yes
No
No
No
Yes
No
Xie et al.’s protocol [19]
Yes
No
No
No
Yes
No
Our protocol
Yes
Yes
Yes
Yes
Yes
Yes
P1, P2, P3, P4, P5, and P6 denote mutual authentication, user anonymity with nontraceability, session key update, conditional privacy preserving, session key establishment, and user revocation, respectively.Note that our protocol has a nice exclusive property that it can achieve fine-grained access control due to the attribute-based cryptography. For example, the AP can provide better service for specific users by indicating a required access structure, so that only the user with right attribute list can enjoy the service.


### 5.2. Performance Evaluation

Although signal transmission also affects handover delay, in view of high speed rate of WLAN and only 3 interaction messages involved in our proposed protocol, we only discuss the authentication latency determined by the time of computation cost. We compare the computation cost of our protocol with that of some other protocols. For more reasonable simulation, we cross-compile the Pair-Based Cryptography (PBC) Library (version pbc-0.5.14) so that related cryptographic operations could be performed on mobile devices. We let a smart phone (HUAWEI honor 5C) and a personal computer (Acer) act as a MN and an AP, respectively, and select the type A pairing in PBC library as the bilinear pairing. Device information is listed in Table2 and Table 3 presents time consumption of different operations on MN and AP. Note that we ignore the light cryptographic operations such as general hash operations. But one type of hash operation, called map-to-point (denoted as MTP in Table 3) hash operation, is not a lightweight cryptographic operation. To some extent, its time consumption can be compared with the pairing operation. Table 4 gives the performance comparison between our protocol and related works, where the time data in parentheses is calculated on the basis of data in Table 3.Table 2
Device configurations.
Processor
Frequency
Memory
Operation system
HUAWEI
Kirin 650
2.0 GHz
2 GB
Android 6.0
Acer
Core I5 2430M
2.4 GHz
4 GB
Ubuntu 14.04Table 3
Time consumption of different operations (in ms).
BP
ME
ECSM
MTP
AP
3.778
0.465
3.180
7.254
MN
8.587
1.270
5.515
13.110
BP: bilinear pairing; ME: modular exponentiation; ECSM: elliptic curve scalar multiplication; MTP: map-to-point.Table 4
Evaluation of computation cost (in ms).
MN
AP
He et al.’s protocol [9]
2MTP + BP + ECSM = 40.322
MTP + 3BP + ECSM = 21.768
He et al.’s protocol [14]
MTP + BP + 3ECSM = 38.242
MTP + 4BP = 22.366
Xie et al.’s protocol [19]
3ECSM = 16.545
6ECSM = 19.080
Our protocol
5ME + ECSM = 11.865
2ME + 2BP + ECSM = 11.666As presented, our protocol does not have much computation cost which means it is feasible. There is no heavy cryptographic operation, such as pairing and map-to-point operation, on the MN side. Our protocol has lower computation cost on both the MN side and AP side.


## 5.1. Security Analysis

We present the security analysis of the proposed protocol to check whether it achieves the security goal mentioned in Section2.Mutual Authentication.On one hand, AP authentication is ensured by the challenge-response pair msg
,
E
C
D
S
A
.
Sig
rmsg
,
s
k
j. Due to the security of digital signature, only A
P
j that has s
k
j can generate a valid signature on a fresh challenge g
0
a from M
N
i. If the signature passes the verification E
C
D
S
A
.
V
e
r
·, it will demonstrate the AP is a trusted valid entity. On the other hand, the designed ABS scheme provides user authentication. Only the user that has the right key on right attribute list (satisfying the access structure) could generate the valid signature. In other words, a malicious node could neither impersonate a valid node nor pass the authentication. Therefore, the proposed protocol achieves mutual authentication.Key Establishment.As described in protocol, M
N
i and A
P
j, respectively, use g
0
a and g
0
b to complete DH key establishment. On one hand, M
N
i figures out g
0
b
a. On the other hand, A
P
j figures out g
0
a
b. Obviously, g
0
b
a
=
g
0
a
b. As a result, both compute the session key S
K
=
g
0
a
b. Besides, any adversary could not calculate the secret session key due to the CDH problem.User Anonymity and Nontraceability.Due to the outstanding property of attribute-based signature, the identity information is not contained in the transmitted message in the whole handover authentication procedure. So except for the AS, nobody could tell the identity of the user including the AP. In addition, the request messagemsg does not contain any specific privacy information of the MN except for the revocation information β
i
,
j. Since β
i
,
j is a secure hash value, an adversary could not parse the identity of a user or trace the user. So user anonymity and nontraceability are guaranteed.User Revocation.Once the revocation hash value β
i
,
j of M
N
i exists in the revocation list R
L
j with t
s
j, it will exist in the database in the future due to update technique of the AP. If β
i
,
j exists in R
L
j, it means M
N
i is revoked since the time t
s
j, and as a result the authentication fails.Updating Session Key Periodically.As described in session key update phase, the MN and AP could establish a new session key successfully according to the current session key. In detail, The MN and AP leverage a new Diffie-Hellman key establishment procedure to generate a new session key. This is based on the hard DL problem and CDH problem. Once a new session key is established, the previous one is destroyed securely, so that adversaries could not reveal the new session key.Besides, the protocol could prevent replay attack due to timestamp. It is important that only the AS could find the real identity of a user according toβ
i
,
j
=
H
¯
r
k
i
I
D
i since r
k
i is selected for M
N
i by the AS. So the protocol achieves conditional privacy preservation too.For convenience, we let P1, P2, P3, P4, P5, and P6 denote mutual authentication, user anonymity with nontraceability, session key update, conditional privacy preserving, session key establishment, and user revocation, respectively. Security comparisons between our protocol and 3 other protocols are presented in Table1. In general, our protocol meets all the security requirements in the table while the other 3 protocols more or less have some security vulnerability. All protocols could guarantee session key establishment but only ours adds the session key update technique. Except for our protocol, the other 3 protocols do not meet the requirements of conditional privacy preserving and user revocation. Moreover, they neither achieve user anonymity nor achieve nontraceability, so that our protocol has an obvious advantage of security.Table 1
Security comparisons of four protocols.
P1
P2
P3
P4
P5
P6
He et al.’s protocol [9]
No
No
No
No
Yes
No
He et al.’s protocol [14]
Yes
No
No
No
Yes
No
Xie et al.’s protocol [19]
Yes
No
No
No
Yes
No
Our protocol
Yes
Yes
Yes
Yes
Yes
Yes
P1, P2, P3, P4, P5, and P6 denote mutual authentication, user anonymity with nontraceability, session key update, conditional privacy preserving, session key establishment, and user revocation, respectively.Note that our protocol has a nice exclusive property that it can achieve fine-grained access control due to the attribute-based cryptography. For example, the AP can provide better service for specific users by indicating a required access structure, so that only the user with right attribute list can enjoy the service.


## 5.2. Performance Evaluation

Although signal transmission also affects handover delay, in view of high speed rate of WLAN and only 3 interaction messages involved in our proposed protocol, we only discuss the authentication latency determined by the time of computation cost. We compare the computation cost of our protocol with that of some other protocols. For more reasonable simulation, we cross-compile the Pair-Based Cryptography (PBC) Library (version pbc-0.5.14) so that related cryptographic operations could be performed on mobile devices. We let a smart phone (HUAWEI honor 5C) and a personal computer (Acer) act as a MN and an AP, respectively, and select the type A pairing in PBC library as the bilinear pairing. Device information is listed in Table2 and Table 3 presents time consumption of different operations on MN and AP. Note that we ignore the light cryptographic operations such as general hash operations. But one type of hash operation, called map-to-point (denoted as MTP in Table 3) hash operation, is not a lightweight cryptographic operation. To some extent, its time consumption can be compared with the pairing operation. Table 4 gives the performance comparison between our protocol and related works, where the time data in parentheses is calculated on the basis of data in Table 3.Table 2
Device configurations.
Processor
Frequency
Memory
Operation system
HUAWEI
Kirin 650
2.0 GHz
2 GB
Android 6.0
Acer
Core I5 2430M
2.4 GHz
4 GB
Ubuntu 14.04Table 3
Time consumption of different operations (in ms).
BP
ME
ECSM
MTP
AP
3.778
0.465
3.180
7.254
MN
8.587
1.270
5.515
13.110
BP: bilinear pairing; ME: modular exponentiation; ECSM: elliptic curve scalar multiplication; MTP: map-to-point.Table 4
Evaluation of computation cost (in ms).
MN
AP
He et al.’s protocol [9]
2MTP + BP + ECSM = 40.322
MTP + 3BP + ECSM = 21.768
He et al.’s protocol [14]
MTP + BP + 3ECSM = 38.242
MTP + 4BP = 22.366
Xie et al.’s protocol [19]
3ECSM = 16.545
6ECSM = 19.080
Our protocol
5ME + ECSM = 11.865
2ME + 2BP + ECSM = 11.666As presented, our protocol does not have much computation cost which means it is feasible. There is no heavy cryptographic operation, such as pairing and map-to-point operation, on the MN side. Our protocol has lower computation cost on both the MN side and AP side.


## 6. Conclusions and Future works

In this paper, we summarize the security requirements a handover authentication protocol should meet. After reviewing previous ID-based protocols in recent years, we point out that they have some vulnerability to some extent. We design an ABS scheme based on which we present an anonymous handover authentication protocol. Security analysis demonstrates our proposed protocol meets various security requirements, especially inherent anonymity with attribute-based cryptography. What is more, concrete experiments on a smart phone and a personal computer show that our proposed protocol is practical in mobile wireless networks.Our proposed protocol achieves user revocation property. Besides, attribute revocation could provide more flexible access control. If an attribute is revoked, the secret key corresponding to it is no longer valid. What a pity, to achieve attribute revocation, computation cost will be high. The new protocol does not involve this property. Therefore, our work focus is to achieve attribute revocation with light computation cost. Note that access structure in our proposed protocol is as simple as a single AND gate. It is also our future work to introduce more complex access structure into authentication protocols in order to realize more fine-grained access control.



---

*Source: 8470949-2018-04-18.xml*