# SKIA-SH: A Symmetric Key-Based Improved Lightweight Authentication Scheme for Smart Homes

Authors: Bander A. Alzahrani; Ahmed Barnawi; Abdullah Albarakati; Azeem Irshad; Muhammad Asghar Khan; Shehzad Ashraf Chaudhry
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

Being one of the finest applications of the IoT, smart homes (SHs) with an aim to improve quality of life are taking over the traditional lifestyles. The entities within a SH communicate with each other and with the environment including the users to transform daily life seamlessly enjoyable and easy. However, owing to the public communication infrastructure, the advantages of SH are subject to security and privacy issues. Recently, Yu et al. presented a privacy and security solution for SH environment. The scheme of Yu et al. is based on lightweight symmetric key functions. Although the scheme of Yu et al. exhibits the lightweight property, it is proven in this paper that their scheme cannot provide mutual authentication due to a crucial design fault. An improved scheme using symmetric key functions for SH (SKIA-SH) is proposed in this paper. The security of the proposed scheme is furnished through formal BAN logic followed by brief discussion on security attribute provision of the proposed SKIA-SH. The comparisons show that the proposed SKIA-SH provides the required security on the cost of slight increase in computation and communication costs. The simulation results show that the SKIA-SH completes an authentication round by exchanging 216 bytes in just 5.34 ms.


---

## Body

## 1. Introduction

The smart home (SH) is an emerging concept, and with the aid of 6G/IoT smart infrastructure, the SH concept is gradually overtaking traditional living styles. SH is a communication setup among the daily useable devices like lightbulbs, televisions, door lock, monitoring cameras, washing machines, and so on. The smart devices (SDs) within a SH interact with each other and with the users to provide seamless services and for transforming daily life more and more easy and enjoyable. The services include automatic door lock and unlock, switching on and off the lights and air conditioners, suspicious activity alarming, etc. In addition, the SH concept can be very useful for patients and elderly people through activity and health-related monitoring and support. The SDs in a SH communicate over the wireless insecure channel and the public Internet. Due to communication over insecure channels, the advantages of the SH are subject to several privacy and security issues [1, 2]. Such security and privacy issues can enable an entity with malicious intentions also called as an attacker to expose user-related sensitive data including the daily routines, habits, and so on, and this information can be used with wicked intentions. In addition, the SDs are lightweight devices, and deploying public key-based infrastructure (PKI) is not a viable solution for the SH environments as PKI can pose high computation and communication costs on the low powered SDs [3–5]. Therefore, symmetric key-based authentication schemes suit the SH environments [6–8].Recently, many authentication schemes were proposed using symmetric and PKI-based cryptographic primitives. Some of the recently proposed schemes were proposed to secure smart home (SH) environments [9, 10]. In 2021, Ali et al. explained the pitfalls of clogging attack and designed an elliptic curve-based authentication scheme to resist clogging attack. Physical capturing is also among the crucial class of attacks [11], and physical capturing of a smart device can lead to exposure of private information of the device and it can also lead to exposure of related and communicative devices present in the smart IoT environments. Irshad et al. [12] also proved that the authentication scheme of Tsai and Lo [13] lacks required security against server forgery and impersonation attack. Moreover, Maitra et al. [14] also proposed an improvement over Lee et al.’s ElGamal-based authentication method [15]. In 2020, Ali Khan et al. [16] and Wei et al. [17] proposed two separate methods to secure smart grid and USB mass storage communication, respectively. However, these schemes were proved insecure and impractical in [18, 19]. Using elliptic curve cryptography (ECC), Vaidya et al. [9] presented their designed authentication scheme for SH. Despite their claim of security and lightweight property, the scheme presented in [9] is prone to several attacks including user forgery, privileged insider (PI), and password guessing (PG) attacks. Santoso and Vun [10] also proposed an authentication scheme for smart devices in the SH environments. Yu et al. [20] in their recent study claimed that the scheme presented in [10] has weaknesses against PI and stolen verifier (SV) attacks. Wazid et al. [21] also proposed an authentication scheme, and in 2019, Lyu et al. [22] claimed that Wazid et al.’s scheme is prone to de-synchronization and related attacks. Another authentication scheme was also proposed by Lyu et al. [22]. After that, in the same year, Shuai et al. [23] presented another authentication scheme. The scheme of Shuai et al. was also structured upon ECC, and despite the claims presented in [23], in 2021, Kaur and Kumar [24] simulated the insecurity of the scheme of Shuai et al. against PI, replay, session key exposure, and related attacks. Kaur and Kumar [24] also presented an improved authentication scheme using ECC and claimed that their ECC-based scheme not only extends security but is also lightweight. However, in 2021, Yu et al. [20] proved that the scheme presented by Kaur and Kumar is prone to several weaknesses including exposure of session key and insecurity against impersonation attack. Moreover, Yu et al. also claimed that the scheme of Kaur and Kumar cannot provide mutual authentication.


### 1.1. Motivations and Contributions

Very recently in 2020, Yu et al. [20] presented their designed authentication scheme for smart home. The scheme of Yu et al. was built on lightweight symmetric key operations (SKOs). They claimed that due to avoidance of PKI and usage of only SKO, their scheme not only is lightweight but also provides privacy and security to the SH devices. In this study, we analyze that in contrast to the claims of Yu et al., the scheme of Yu et al. cannot extend authentication among SH devices due to a crucial design flaw of their scheme. Hence, their scheme is not practical, and to fill the gap, we proposed a symmetric key-based improved lightweight authentication scheme for smart homes (SKIA-SH).


### 1.2. System Architecture

A standard smart home (SH) as adopted from Yu et al.’s scheme [20] is depicted in Figure 1. The authentication entities in a SH network consist of user/s with mobile device/s, the gateway, and the smart devices (SDs). The users can control the SDs remotely, and before deployment, the registration authority registers users and SDs and deploys secret and public parameters on the memory of users and SDs. The user monitors the working of SDs, and SDs communicate with user/s through the facilitation of gateways. The entities (smart devices) of a SH network are equipped with Wi-Fi and connect with each other and with gateway through public wireless channel. Moreover, the user connects with smart devices through gateway, and the channel used between a user and a gateway is the public Internet, which allows the communication administered remotely and globally. The communication of the entities of a SH through public wireless and Internet channels calls for a secure channel through authentication and key establishment between user/s and the gateway. The authentication and key exchange protect the information exchange through public wireless channel.Figure 1
Smart home environment.


### 1.3. Adversarial Model

In a smart home (SH) communication architecture, one or more users communicate with smart devices (SDs) through facilitation of the gateway and on the public wireless channel. Therefore, SH is an attractive environment for malicious adversaries to launch several attacks including impersonation and forgery. As per the common adversary model DY [25], an adversary has the capabilities to listen to the channel and can read, modify, and jam a message exchanged between the entities of the SH [26, 27]. Moreover, the adversary can generate and send a fake message to any entity, whereas the current de facto adversary model CY [28] is adopted in this paper and in several other proposals [29, 30]. The CK adversary model considers a more strong attacker, where in addition to adversarial capabilities of DY model, the attacker can either compromise the long-term or short-term secrets both but not at the same time [31, 3232]. The CY model suggests to construct the session keys using both the long and short-term secrets and the session keys should be independent to each other.


## 1.1. Motivations and Contributions

Very recently in 2020, Yu et al. [20] presented their designed authentication scheme for smart home. The scheme of Yu et al. was built on lightweight symmetric key operations (SKOs). They claimed that due to avoidance of PKI and usage of only SKO, their scheme not only is lightweight but also provides privacy and security to the SH devices. In this study, we analyze that in contrast to the claims of Yu et al., the scheme of Yu et al. cannot extend authentication among SH devices due to a crucial design flaw of their scheme. Hence, their scheme is not practical, and to fill the gap, we proposed a symmetric key-based improved lightweight authentication scheme for smart homes (SKIA-SH).


## 1.2. System Architecture

A standard smart home (SH) as adopted from Yu et al.’s scheme [20] is depicted in Figure 1. The authentication entities in a SH network consist of user/s with mobile device/s, the gateway, and the smart devices (SDs). The users can control the SDs remotely, and before deployment, the registration authority registers users and SDs and deploys secret and public parameters on the memory of users and SDs. The user monitors the working of SDs, and SDs communicate with user/s through the facilitation of gateways. The entities (smart devices) of a SH network are equipped with Wi-Fi and connect with each other and with gateway through public wireless channel. Moreover, the user connects with smart devices through gateway, and the channel used between a user and a gateway is the public Internet, which allows the communication administered remotely and globally. The communication of the entities of a SH through public wireless and Internet channels calls for a secure channel through authentication and key establishment between user/s and the gateway. The authentication and key exchange protect the information exchange through public wireless channel.Figure 1
Smart home environment.


## 1.3. Adversarial Model

In a smart home (SH) communication architecture, one or more users communicate with smart devices (SDs) through facilitation of the gateway and on the public wireless channel. Therefore, SH is an attractive environment for malicious adversaries to launch several attacks including impersonation and forgery. As per the common adversary model DY [25], an adversary has the capabilities to listen to the channel and can read, modify, and jam a message exchanged between the entities of the SH [26, 27]. Moreover, the adversary can generate and send a fake message to any entity, whereas the current de facto adversary model CY [28] is adopted in this paper and in several other proposals [29, 30]. The CK adversary model considers a more strong attacker, where in addition to adversarial capabilities of DY model, the attacker can either compromise the long-term or short-term secrets both but not at the same time [31, 3232]. The CY model suggests to construct the session keys using both the long and short-term secrets and the session keys should be independent to each other.


## 2. Revisiting Yu et al.’s Scheme

In the following subsections, we revisit the scheme of Yu et al. [20], which provides the authentication among the IoT-based smart devices and the user with the help of gateway. The scheme is based on lightweight symmetric key operations. Before moving to the description of the Yu et al.’ scheme, Table 1 is provided to explain the notations used throughout the whole paper.Table 1
Symbol guide.
SymbolsExplanationsGKrGatewaySDqIoT deviceUppth userTPTrusted third partyIDsqIdentity ofSDqIDupIdentity ofUpGIDgrIdentity ofGKrβup,γupFuzzy parametersKGRPrivate key ofGKrKUPPrivate key ofUpKSQPrivate key ofSDqXprShared secret key amongUp and GKrXqrShared secret key amongSDq and GKr⊕,H.XOR and hash operations


### 2.1. Initialization

During manufacturing, theTP generates a private key KGR and stores it in the memory of GKr. Moreover, all the IoT-based smart devices SDq:q=1,2,…,n are assigned unique identities IDsq:q=1,2…n. The TP also generates and stores the secret keys KSQ:q=1,2…n and stores it in the memory of each if SDq:q=1,2…n.


### 2.2. User Registration

To initiate a registration request, the userUp generates αup, selects IDup and PWup, computes GenBioup=γup,βup, RIDup=hIDup‖γup, and RPWup=hPWup‖γup, and sends RIDup,RPWup,αup to TP through a private channel. The TP computes Xpr=hRIDup‖KGR‖αup, A1=XPR⊕hαup‖RPWup and sends Xpr to GKr. The GKr now computes Lup=hGIDgr‖KGR⊕Xpr. The GKr stores Lup into its own memory and the TP sends A1 to Up. Up now computes KUP=hIDup‖PWup‖γup, A2=EKUPA1, A3=αup⊕hRIDup‖RPWup, and A4=hRIDup‖RPWup‖αup and deletes A1 and stores A2,A3,A4 in the memory of SDq.


### 2.3. Smart Device Registration

ASDq generates αsq, computes PIDsq=hSDq‖αsq, and sends the duo PIDsq,αsq to TP. The TP now computes Xpr=hPIDsq‖KGR‖αsq and stores PIDsq,αuq in GKr’s database and sends Xpr to SDq. The SDq now computes B1=hSIDsq‖KSQ⊕αsq and B2=hKSQ‖αsq⊕Xqr and stores B1,B2 in its own memory.


### 2.4. Authentication

As summarized in Figure2, the user Up initiates authentication phase by entering the pair of his own identity and password IDup,PWup. The user terminal device computes γup=RepBioup,βup, RIDup=hIDup‖γup, RPWup=hPWup‖γup, and KUP=hIDup‖PWup‖γup. Now Up extracts A2, using KUP decrypts A2, and gets A1=DKUPA2. Up further computes αup=A3⊕hRIDup‖RPWup and Xpr=A1⊕hαup‖RPWup. Now, Up checks the equality A4=?hRIDup‖RPWup‖αup, and if it holds, Up selects/generates T1,rup and proceeds with the authentication phase through execution of the following steps:AY 1:Up⟶GKr:R1=M1,M2,Mpr,T1.Up computes M1=SIDsq‖rup⊕Xpr⊕T1, M2=RIDup⊕hXpr‖rup‖T1, and Mpr=hRIDup‖Xpr\\Vert|rup‖T1 and sends request message R1=M1,M2,Mpr,T1 to GKr.AY 2:GKr⟶SDq:R2=M3,Mqr,T2.GKr on receiving R1=M1,M2,Mpr,T1 checks Tc−T1≤ΔT, where Tc is current timestamp recorded at GKr and ΔT is the allowable time delay. On the successful validation of timestamp, GKr extracts Lup and computes Xpr=hGIDgr‖KGR⊕Lup, SIDsq‖rup=M1⊕Xpr⊕T1, and RIDup=M2⊕hXpr‖rup‖T1. Now, GKr checks validity of Mpr=?hRIDup‖Xpr‖rup‖T1, and if it holds, GKr selects/generates T2,rgr. Now, GKr computes Xqr=hSIDsq‖KGR, M3=RIDup‖GIDgr‖rup‖rgr⊕hSIDsq‖Xqr‖T2, and Mqr=hRIDup‖GIDgr‖Xqr‖rup‖rgr‖T2. GKr completes this step by sending R2=M3,Mqr,T2 to SDq.AY 3:SDq⟶GKr:R3=M4,Mrq,T3.SDq on receiving R2=M3,Mqr,T2 checks Tc−T2≤ΔT, and on successful validation of timestamp, SDq extracts B1,B2 from its memory and computes αsq=B1⊕hSIDsq‖KSQ, Xqr=B2⊕hKSQ‖αsq, and RIDup‖GIDgr‖rup‖rgr‖=M3⊕hSIDsq‖Xqr‖T2. Now, SDq checks validity of Mqr=?hRIDup‖GIDgr‖Xqr‖rup‖rgr‖T2, and if it holds, SDq selects/generates T3,rsqM4=rsq⊕hXqr‖RIDsq‖GIDgr‖T3, SK=hrup‖rgr‖rsq‖RIDup‖GIDgr‖SIDsq, and Mrq=hSIDsq‖rsq‖Xqr‖SK‖T3. SDq now sends R3=M4,Mrq,T3 to GKr.AY 4:GKr⟶Up:R4=M5,Mrp,T4.GKr on receiving R3=M4,Mrq,T3 checks Tc−T3≤ΔT, and on successful validation of timestamp, GKr computes rsq=M4⊕hXqr‖RIDsq‖GIDgr‖T3 and SK=hrup‖rgr‖rsq‖RIDup‖GIDgr‖SIDsq. Now, GKr checks validity of Mrq=?hSIDsq‖rsq‖Xqr‖SK‖T3. On successful validation, GKr generates T4 and computes M5=GIDgr‖rgr‖rsq⊕hRIDup‖Xpr‖rup‖T4 and Mrp=hRIDup‖GIDgr‖rup‖rgr‖SK‖T4. Now, GKr sends R4=M5,Mrp,T4 to Up.AY 5:Up on receiving R4=M5,Mrp,T4 checks Tc−T4≤ΔT, and on successful validation of timestamp, Up computes GIDgr‖rgr‖rsq=M5⊕hRIDup‖Xpr‖rup‖T4 and session key SK=hrup‖rgr‖rsq‖RIDup‖GIDgr‖SIDsq. Up checks the validity of Mrp=?hRIDup‖GIDgr‖rup‖rgr‖SK‖T4. On successful validation, Up considers SDq and GKr authenticates and keeps SK as the session key for future secure communication.Figure 2
The scheme of Yu et al.


## 2.1. Initialization

During manufacturing, theTP generates a private key KGR and stores it in the memory of GKr. Moreover, all the IoT-based smart devices SDq:q=1,2,…,n are assigned unique identities IDsq:q=1,2…n. The TP also generates and stores the secret keys KSQ:q=1,2…n and stores it in the memory of each if SDq:q=1,2…n.


## 2.2. User Registration

To initiate a registration request, the userUp generates αup, selects IDup and PWup, computes GenBioup=γup,βup, RIDup=hIDup‖γup, and RPWup=hPWup‖γup, and sends RIDup,RPWup,αup to TP through a private channel. The TP computes Xpr=hRIDup‖KGR‖αup, A1=XPR⊕hαup‖RPWup and sends Xpr to GKr. The GKr now computes Lup=hGIDgr‖KGR⊕Xpr. The GKr stores Lup into its own memory and the TP sends A1 to Up. Up now computes KUP=hIDup‖PWup‖γup, A2=EKUPA1, A3=αup⊕hRIDup‖RPWup, and A4=hRIDup‖RPWup‖αup and deletes A1 and stores A2,A3,A4 in the memory of SDq.


## 2.3. Smart Device Registration

ASDq generates αsq, computes PIDsq=hSDq‖αsq, and sends the duo PIDsq,αsq to TP. The TP now computes Xpr=hPIDsq‖KGR‖αsq and stores PIDsq,αuq in GKr’s database and sends Xpr to SDq. The SDq now computes B1=hSIDsq‖KSQ⊕αsq and B2=hKSQ‖αsq⊕Xqr and stores B1,B2 in its own memory.


## 2.4. Authentication

As summarized in Figure2, the user Up initiates authentication phase by entering the pair of his own identity and password IDup,PWup. The user terminal device computes γup=RepBioup,βup, RIDup=hIDup‖γup, RPWup=hPWup‖γup, and KUP=hIDup‖PWup‖γup. Now Up extracts A2, using KUP decrypts A2, and gets A1=DKUPA2. Up further computes αup=A3⊕hRIDup‖RPWup and Xpr=A1⊕hαup‖RPWup. Now, Up checks the equality A4=?hRIDup‖RPWup‖αup, and if it holds, Up selects/generates T1,rup and proceeds with the authentication phase through execution of the following steps:AY 1:Up⟶GKr:R1=M1,M2,Mpr,T1.Up computes M1=SIDsq‖rup⊕Xpr⊕T1, M2=RIDup⊕hXpr‖rup‖T1, and Mpr=hRIDup‖Xpr\\Vert|rup‖T1 and sends request message R1=M1,M2,Mpr,T1 to GKr.AY 2:GKr⟶SDq:R2=M3,Mqr,T2.GKr on receiving R1=M1,M2,Mpr,T1 checks Tc−T1≤ΔT, where Tc is current timestamp recorded at GKr and ΔT is the allowable time delay. On the successful validation of timestamp, GKr extracts Lup and computes Xpr=hGIDgr‖KGR⊕Lup, SIDsq‖rup=M1⊕Xpr⊕T1, and RIDup=M2⊕hXpr‖rup‖T1. Now, GKr checks validity of Mpr=?hRIDup‖Xpr‖rup‖T1, and if it holds, GKr selects/generates T2,rgr. Now, GKr computes Xqr=hSIDsq‖KGR, M3=RIDup‖GIDgr‖rup‖rgr⊕hSIDsq‖Xqr‖T2, and Mqr=hRIDup‖GIDgr‖Xqr‖rup‖rgr‖T2. GKr completes this step by sending R2=M3,Mqr,T2 to SDq.AY 3:SDq⟶GKr:R3=M4,Mrq,T3.SDq on receiving R2=M3,Mqr,T2 checks Tc−T2≤ΔT, and on successful validation of timestamp, SDq extracts B1,B2 from its memory and computes αsq=B1⊕hSIDsq‖KSQ, Xqr=B2⊕hKSQ‖αsq, and RIDup‖GIDgr‖rup‖rgr‖=M3⊕hSIDsq‖Xqr‖T2. Now, SDq checks validity of Mqr=?hRIDup‖GIDgr‖Xqr‖rup‖rgr‖T2, and if it holds, SDq selects/generates T3,rsqM4=rsq⊕hXqr‖RIDsq‖GIDgr‖T3, SK=hrup‖rgr‖rsq‖RIDup‖GIDgr‖SIDsq, and Mrq=hSIDsq‖rsq‖Xqr‖SK‖T3. SDq now sends R3=M4,Mrq,T3 to GKr.AY 4:GKr⟶Up:R4=M5,Mrp,T4.GKr on receiving R3=M4,Mrq,T3 checks Tc−T3≤ΔT, and on successful validation of timestamp, GKr computes rsq=M4⊕hXqr‖RIDsq‖GIDgr‖T3 and SK=hrup‖rgr‖rsq‖RIDup‖GIDgr‖SIDsq. Now, GKr checks validity of Mrq=?hSIDsq‖rsq‖Xqr‖SK‖T3. On successful validation, GKr generates T4 and computes M5=GIDgr‖rgr‖rsq⊕hRIDup‖Xpr‖rup‖T4 and Mrp=hRIDup‖GIDgr‖rup‖rgr‖SK‖T4. Now, GKr sends R4=M5,Mrp,T4 to Up.AY 5:Up on receiving R4=M5,Mrp,T4 checks Tc−T4≤ΔT, and on successful validation of timestamp, Up computes GIDgr‖rgr‖rsq=M5⊕hRIDup‖Xpr‖rup‖T4 and session key SK=hrup‖rgr‖rsq‖RIDup‖GIDgr‖SIDsq. Up checks the validity of Mrp=?hRIDup‖GIDgr‖rup‖rgr‖SK‖T4. On successful validation, Up considers SDq and GKr authenticates and keeps SK as the session key for future secure communication.Figure 2
The scheme of Yu et al.


## 3. Weaknesses of Yu et al.’s Scheme

In this section, it is shown that the scheme of Yu et al. [20] cannot provide mutual authentication among the smart devices (SDs) of a smart home (SH). Specifically, in Yu et al.’s scheme, once GKr receives the authentication request, it cannot recognize the user requesting the authentication. Therefore, the process may stop here and the scheme of Yu et al. cannot complete a round of authentication process. The following explanation of an authentication round of the scheme of Yu et al. can clarify the scheme’s incorrectness:(1)
Up first completes a login by entering his password, identity, and biometrics, and the user device computes and sends request message R1=M1,M2,Mpr,T1 to GKr.(1)M1=SIDsq‖rup⊕Xpr⊕T1,M2=RIDup⊕hXpr‖rup‖T1,Mpr=hRIDup‖Xpr‖rup‖T1.Now,Up sends R1=M1,M2,Mpr,T1 to GKr.(2)
GKr on receiving R1=M1,M2,Mpr,T1, checks Tc−T1≤ΔT. On successful validation of T1, GKr extracts Lup from its database and computes(2)Xpr=hGIDgr‖KGR⊕Lup,(3)SIDsq‖rup=M1⊕Xpr⊕T1,(4)RIDup=M2⊕hXpr‖rup‖T1.(3)
GKr computes the shared key Xpr through equation (2), and for this, GKr needs to extract Lup, from the database stored on the memory of GKr. The database has the entries of the form IDup,Lup:p:1,2…m, if there are m users. To extract Lup from the database, GKr first needs to recognize the specific user Up with identity IDup. However, GKr does not recognize Up because it does not receive identity or any other user-related information in the request message R1. Therefore, GKr cannot extract Lup and equations (2), (3), and (4) cannot be resolved. Due to this incorrectness, the scheme of Yu et al. cannot complete even a round of authentication process.


## 4. SKIA-SH: Proposed Scheme

In this section, we present the improved scheme over Yu et al.’s scheme. For designing improved scheme, we take the initialization phase of Yu et al. as it was designed by Yu et al. Furthermore, the smart device registration phase is also taken as it is. The proposed scheme amends some steps in user registration and authentication phases to provide a scalable and correct mechanism for the provision of secure channel among a user and a smart device. The proposed symmetric key-based improved authentication scheme for smart homes (SKIA-SH) is described below.


### 4.1. SKIA-SH: User Registration

To initiate a registration request, the userUp generates αup, selects IDup and PWup, computes GenBioup=γup,βup, RIDup=hIDup‖γup, and RPWup=hPWup‖γup and sends RIDup,RPWup,αup to TP through a private channel. TP computes Xpr=hRIDup‖KGR‖αup and A1=XPR⊕hαup‖RPWup and sends Xpr to GKr. GKr now computes Lup=hGIDgr‖KGR⊕Xpr and PIDup=hIDup‖αup‖Xpr. GKr stores Lup and PIDup=hIDup‖αup‖Xpr into its own memory, and TP sends A1,PIDup to Up. Up now computes KUP=hIDup‖PWup‖γup, A2=EKUPA1, A3=αup⊕hRIDup‖RPWup, and A4=hRIDup‖RPWup‖αup, deletes A1, and stores A2,A3,A4,PIDup in the memory of SDq.


### 4.2. SKIA-SH: Authentication

The userUp initiates authentication phase as shown in Figure 3, by entering the pair of his own identity and password IDup,PWup. The user terminal device computes γup=RepBioup,βup, RIDup=hIDup‖γup, RPWup=hPWup‖γup, and KUP=hIDup‖PWup‖γup. Now Up extracts A2, using KUP decrypts A2, and gets A1=DKUPA2. Up further computes αup=A3⊕hRIDup‖RPWup and Xpr=A1⊕hαup‖RPWup. Now, Up checks the equality A4=?hRIDup‖RPWup‖αup, and if it holds, Up selects/generates T1,rup and proceeds with the authentication phase through execution of the following steps:AP 1:Up⟶GKr:R1=M1,M2,Mpr,T1.Up computes M1=SIDsq‖rup⊕Xpr⊕T1, M2=RIDup⊕hXpr‖rup‖T1, and Mpr=hRIDup‖Xpr\\Vert|rup‖T1 and sends request message R1=M1,M2,Mpr,PIDup,T1 to GKr.AP 2:GKr⟶SDq:R2=M3,Mqr,T2.GKr on receiving R1=M1,M2,Mpr,PIDup,T1 checks Tc−T1≤ΔT, where Tc is current timestamp recorded at GKr and ΔT is the allowable time delay. On successful validation of timestamp, GKr, extracts Lup as per the PIDup from its database where the entries are of the form PIDup,IDup,Lup and computes Xpr=hGIDgr‖KGR⊕Lup, SIDsq‖rup=M1⊕Xpr⊕T1, and RIDup=M2⊕hXpr‖rup‖T1. Now, GKr checks validity of Mpr=?hRIDup‖Xpr‖rup‖T1, and if it holds, GKr selects/generates T2,rgr. Now, GKr computes Xqr=hSIDsq‖KGR, M3=RIDup‖GIDgr‖rup‖rgr⊕hSIDsq‖Xqr‖T2, and Mqr=hRIDup‖GIDgr‖Xqr‖rup‖rgr‖T2. GKr completes this step by sending R2=M3,Mqr,T2 to SDq.AP 3:SDq⟶GKr:R3=M4,Mrq,T3.SDq on receiving R2=M3,Mqr,T2 checks Tc−T2≤ΔT, and on successful validation of timestamp, SDq extracts B1,B2 from its memory and computes αsq=B1⊕hSIDsq‖KSQ, Xqr=B2⊕hKSQ‖αsq, and RIDup‖GIDgr‖rup‖rgr=M3⊕hSIDsq‖Xqr‖T2. Now, SDq checks validity of Mqr=?hRIDup‖GIDgr‖Xqr‖rup‖rgr‖T2, and if it holds, SDq selects/generates T3,rsqM4=rsq⊕hXqr‖RIDsq‖GIDgr‖T3, SK=hrup‖rgr‖rsq‖RIDup‖GIDgr‖SIDsq, and Mrq=hSIDsq‖rsq‖Xqr‖SK‖T3. SDq now sends R3=M4,Mrq,T3 to GKr.AP 4:GKr⟶Up:R4=M5,Mrp,T4.GKr on receiving R3=M4,Mrq,T3 checks Tc−T3≤ΔT, and on successful validation of timestamp, GKr computes rsq=M4⊕hXqr‖RIDsq‖GIDgr‖T3 and SK=hrup‖rgr‖rsq‖RIDup‖GIDgr‖SIDsq. Now, GKr checks validity of Mrq=?hSIDsq‖rsq‖Xqr‖SK‖T3. On successful validation, GKr generates T4 and computes M5=GIDgr‖rgr‖rsq⊕hRIDup‖Xpr‖rup‖T4, Mrp=hRIDup‖GIDgr‖rup‖rgr‖SK‖T4 and PIDupnew=hIDup‖rgr‖Xpr. GKr stores PIDupnew in its database in some temporary variable alongside PIDup,IDup,Lup, where PIDup is the old identity. GKr keeps identity pair PIDup,PIDupnew until it receives next authentication to avoid any identity de-synchronization, and on next successful login, both identities are updated. Finally, GKr sends R4=M5,Mrp,T4 to Up.AP 5:Up on receiving R4=M5,Mrp,T4 checks Tc−T4≤ΔT, and on successful validation of timestamp, Up computes GIDgr‖rgr‖rsq=M5⊕hRIDup‖Xpr‖rup‖T4 and session key SK=hrup‖rgr‖rsq‖RIDup‖GIDgr‖SIDsq. Up checks the validity of Mrp=?hRIDup‖GIDgr‖rup‖rgr‖SK‖T4. On successful validation, Up computes PIDupnew=hIDup‖rgr‖Xpr and updates PIDup with PIDupnew and considers SDq and GKr authenticates and keeps SK as the session key for future secure communication.Figure 3
SKIA-SH: the proposed scheme.


## 4.1. SKIA-SH: User Registration

To initiate a registration request, the userUp generates αup, selects IDup and PWup, computes GenBioup=γup,βup, RIDup=hIDup‖γup, and RPWup=hPWup‖γup and sends RIDup,RPWup,αup to TP through a private channel. TP computes Xpr=hRIDup‖KGR‖αup and A1=XPR⊕hαup‖RPWup and sends Xpr to GKr. GKr now computes Lup=hGIDgr‖KGR⊕Xpr and PIDup=hIDup‖αup‖Xpr. GKr stores Lup and PIDup=hIDup‖αup‖Xpr into its own memory, and TP sends A1,PIDup to Up. Up now computes KUP=hIDup‖PWup‖γup, A2=EKUPA1, A3=αup⊕hRIDup‖RPWup, and A4=hRIDup‖RPWup‖αup, deletes A1, and stores A2,A3,A4,PIDup in the memory of SDq.


## 4.2. SKIA-SH: Authentication

The userUp initiates authentication phase as shown in Figure 3, by entering the pair of his own identity and password IDup,PWup. The user terminal device computes γup=RepBioup,βup, RIDup=hIDup‖γup, RPWup=hPWup‖γup, and KUP=hIDup‖PWup‖γup. Now Up extracts A2, using KUP decrypts A2, and gets A1=DKUPA2. Up further computes αup=A3⊕hRIDup‖RPWup and Xpr=A1⊕hαup‖RPWup. Now, Up checks the equality A4=?hRIDup‖RPWup‖αup, and if it holds, Up selects/generates T1,rup and proceeds with the authentication phase through execution of the following steps:AP 1:Up⟶GKr:R1=M1,M2,Mpr,T1.Up computes M1=SIDsq‖rup⊕Xpr⊕T1, M2=RIDup⊕hXpr‖rup‖T1, and Mpr=hRIDup‖Xpr\\Vert|rup‖T1 and sends request message R1=M1,M2,Mpr,PIDup,T1 to GKr.AP 2:GKr⟶SDq:R2=M3,Mqr,T2.GKr on receiving R1=M1,M2,Mpr,PIDup,T1 checks Tc−T1≤ΔT, where Tc is current timestamp recorded at GKr and ΔT is the allowable time delay. On successful validation of timestamp, GKr, extracts Lup as per the PIDup from its database where the entries are of the form PIDup,IDup,Lup and computes Xpr=hGIDgr‖KGR⊕Lup, SIDsq‖rup=M1⊕Xpr⊕T1, and RIDup=M2⊕hXpr‖rup‖T1. Now, GKr checks validity of Mpr=?hRIDup‖Xpr‖rup‖T1, and if it holds, GKr selects/generates T2,rgr. Now, GKr computes Xqr=hSIDsq‖KGR, M3=RIDup‖GIDgr‖rup‖rgr⊕hSIDsq‖Xqr‖T2, and Mqr=hRIDup‖GIDgr‖Xqr‖rup‖rgr‖T2. GKr completes this step by sending R2=M3,Mqr,T2 to SDq.AP 3:SDq⟶GKr:R3=M4,Mrq,T3.SDq on receiving R2=M3,Mqr,T2 checks Tc−T2≤ΔT, and on successful validation of timestamp, SDq extracts B1,B2 from its memory and computes αsq=B1⊕hSIDsq‖KSQ, Xqr=B2⊕hKSQ‖αsq, and RIDup‖GIDgr‖rup‖rgr=M3⊕hSIDsq‖Xqr‖T2. Now, SDq checks validity of Mqr=?hRIDup‖GIDgr‖Xqr‖rup‖rgr‖T2, and if it holds, SDq selects/generates T3,rsqM4=rsq⊕hXqr‖RIDsq‖GIDgr‖T3, SK=hrup‖rgr‖rsq‖RIDup‖GIDgr‖SIDsq, and Mrq=hSIDsq‖rsq‖Xqr‖SK‖T3. SDq now sends R3=M4,Mrq,T3 to GKr.AP 4:GKr⟶Up:R4=M5,Mrp,T4.GKr on receiving R3=M4,Mrq,T3 checks Tc−T3≤ΔT, and on successful validation of timestamp, GKr computes rsq=M4⊕hXqr‖RIDsq‖GIDgr‖T3 and SK=hrup‖rgr‖rsq‖RIDup‖GIDgr‖SIDsq. Now, GKr checks validity of Mrq=?hSIDsq‖rsq‖Xqr‖SK‖T3. On successful validation, GKr generates T4 and computes M5=GIDgr‖rgr‖rsq⊕hRIDup‖Xpr‖rup‖T4, Mrp=hRIDup‖GIDgr‖rup‖rgr‖SK‖T4 and PIDupnew=hIDup‖rgr‖Xpr. GKr stores PIDupnew in its database in some temporary variable alongside PIDup,IDup,Lup, where PIDup is the old identity. GKr keeps identity pair PIDup,PIDupnew until it receives next authentication to avoid any identity de-synchronization, and on next successful login, both identities are updated. Finally, GKr sends R4=M5,Mrp,T4 to Up.AP 5:Up on receiving R4=M5,Mrp,T4 checks Tc−T4≤ΔT, and on successful validation of timestamp, Up computes GIDgr‖rgr‖rsq=M5⊕hRIDup‖Xpr‖rup‖T4 and session key SK=hrup‖rgr‖rsq‖RIDup‖GIDgr‖SIDsq. Up checks the validity of Mrp=?hRIDup‖GIDgr‖rup‖rgr‖SK‖T4. On successful validation, Up computes PIDupnew=hIDup‖rgr‖Xpr and updates PIDup with PIDupnew and considers SDq and GKr authenticates and keeps SK as the session key for future secure communication.Figure 3
SKIA-SH: the proposed scheme.


## 5. Formal Security Analysis through BAN

We present the formal security analysis of the proposed scheme through employing the Burrows–Abadi–Needham logic (BAN) logic [33]. In this BAN logic analysis, we discuss the security evaluation with an emphasis on mutual authenticity among legal participants, protection of session key, and the key distribution among the participants.(i)
S|≡:Xthe principle S believes X.(ii)
S⊲X:S sees X.(iii)
S|∼X:S once said X and believes that X is true.(iv)
S|⇒X:S has jurisdiction over X.(v)
#X: X is not replayed and is fresh.(vi)
X,X′: X and X′ are parts of a hash digest message.(vii)
X,X′k: X and X′ are exchanged using mutually agreed key k.(viii)
S↔KS′: the communication among S and S′ is secured using K as the key.Some rules that are used in the analysis are given below:R1: message meaning rule:(5)S|≡S⟶KS′,S⊲XX′S|≡S′|∼X.R2: nonce verification rule:(6)S|≡#X,S|≡S′|∼XS|≡S′|≡X.Rule 3: jurisdiction rule:(7)S|≡S′⇒X,S|≡S′|≡XS|≡X.Rule 4: freshness conjunction rule:(8)S|≡#XS|≡#X,X′.Rule 5: belief rule:(9)S|≡X,S|≡X′S|≡X,X′.Rule 6: session key rule:(10)S|≡#X,S|≡S′≡XS|≡S↔KS′.(i)
G-1:GKr|≡GKr↔SKUp.(ii)
G-2:GKr|≡Up|≡GKr↔SKUp.(iii)
G-3:Up|≡GKr↔SKUp.(iv)
G-4:Up|≡GKr|≡GKr↔SKUp.(v)
G-5:SDq|≡SDq↔SKUp.(vi)
G-6:Up|≡SDq↔SKUp.The idealized form of the communication messages is given below:(vii)
R1: Up⟶GKr:M1,M2,Mpr,T1:SIDsq,rup,T1Xpr,RIDuphXpr,rup,T1,RIDup,\\rup,T1Xpr,T1.(viii)
R2: GKr⟶SDq:M3,Mqr,T2:RIDup,GIDgr,rup,rgrhSIDsq,Xqr,T2.(ix)
R3: SDq⟶GKr:M4,Mrq,T3:rsqhXqr,RIDsq,GIDgr,T3,SIDsq,rsq,Xqr,T3SK,T3.(x)
R4: GKr⟶Up:M5,Mrp,T4:GIDgr,rgr,rsqhRIDup,Xpr,rup,T4,RIDup,GIDgr,\\rup,rgr,T4SK,T4.To prove the model, we construct the following premises.(xi)
κ1:Up|≡#T1.(xii)
κ2:GKr|≡#T2.(xiii)
κ3:SDq|≡#T3.(xiv)
κ4:Up|≡Up↔XPrGKr.(xv)
κ5:Up|≡Up↔SKSDq.(xvi)
κ6:GKr|≡GKr↔LupUp.(xvii)
κ7:GKr|≡GKr↔XqrSDq.(xviii)
κ8:SDq|≡SDq↔SKUp.(xix)
κ9:SDq|≡SDq↔SKGKr.(xx)
κ10:Up|≡GKr|⇒Up↔MrpGKr.(xxi)
κ11:GKr|≡Up|⇒Up↔MprGKr.(xxii)
κ12:SDq|≡Up|⇒Up↔rupSDq.(xxiii)
κ13:GKr|≡SDq|⇒SDq↔MrqGKr.(xxiv)
κ14:SDq|≡GKr|⇒Up↔rgrGKr.(xxv)
κ15:Up|≡SDq|⇒Up↔rsqGKr.Next we use the designed idealizations in the following formulations. ConsideringR1 and R2 of the idealized formalization:(i)
R1: Up⟶GKr:M1,M2,Mpr,T1:SIDsq,rup,T1Xpr,RIDuphXpr,rup,T1,RIDup,rup,\\T1Xpr,T1.(ii)
R2: GKr⟶SDq:M3,Mqr,T2:RIDup,GIDgr,rup,rgrhSIDsq,Xqr,T2.Employing seeing rule forR1 and R2, we get(i)
F1:GKr\lhdM1,M2,Mpr,T1:SIDsq,rup,T1Xpr,\\RIDuphXpr,rup,T1,RIDup,rup,T1Xpr,T1.(ii)
F2:SDq\lhdM3,Mqr,T2:RIDup,GIDgr,rup,rgr\\_hSIDsq,Xqr,T2.According toF1,F2,κ8,κ9, and message meaning rule, we have(iii)
F3:GKr|≡Up∼SIDsq,rup,T1Xpr,RIDup\\_hXpr,rup,T1,RIDup,rup,T1Xpr,T1.(iv)
F4:SDq|≡GKr∼RIDup,GIDgr,rup,rgr\\_hSIDsq,Xqr,T2.(v)
EmployingF3,κ1, freshness conjucatenation, and nonce verification rules, we have(vi)
F5:GKr|≡Up≡SIDsq,rup,T1Xpr,RIDup\_hXpr,rup,T1,RIDup,rup,T1Xpr,T1.On applyingF4,κ2, freshness conjucatenation, and nonce verification rules, we get(i)
F6:SDq|≡GKr≡RIDup,GIDgr,rup,rgr\\_hSIDsq,Xqr,T2.After applyingF5,κ12, and jurisdiction rule,(ii)
F7:GKr|≡SIDsq,rup,T1Xpr,RIDuphXpr,rup,T1,\\RIDup,rup,T1Xpr,T1.UsingF6,κ14, and jurisdiction rule,(i)
F8:SDq|≡RIDup,GIDgr,rup,rgrhSIDsq,Xqr,T2.After applyingF5,F7, and session key rule, we get(i)
F9:GKr|≡GKr↔SKUp (G-1).UsingF5,F7,κ6,κ8, and nonce verification rule, we get(i)
F10:SDq|≡SDq↔SKUp (G-5).UsingR3 of the idealized form:(i)
R3: SDq⟶GKr:M4,Mrq,T3:rsqhXqr,RIDsq,GIDgr,T3,SIDsq,rsq,Xqr,T3SK,T3.By applying seeing rule forR3, we get(i)
F11:GKr⊲M4,Mrq,T3:rsqhXqr,RIDsq,GIDgr,T3,SIDsq,rsq,Xqr,T3SK,T3.EmployingF11,κ7, and message meaning rule, we get(i)
F12:GKr|≡SDq∼rsqhXqr,RIDsq,GIDgr,T3,\\SIDsq,rsq,Xqr,T3SK,T3.On applyingF12,κ3,κ13, freshness conjucatenation, and nonce verification rules, we have(i)
F13:GKr|≡SDq|≡rsqhXqr,RIDsq,GIDgr,T3,\\SIDsq,rsq,Xqr,T3SK,T3.(ii)
Up|≡GKr↔SPUp (G-3).(iii)
Up|≡GKr|≡GKr↔SPUp (G-4).Next, usingR4 idealized form:(i)
R4: GKr⟶Up:M5,Mrp,T4:GIDgr,rgr,rsqhRIDup,Xpr,rup,T4,RIDup,GIDgr,rup,\\rgr,T4SK,T4.By using seeing rule forR4, we get(i)
F14:Up⊲M5,Mrp,T4:GIDgr,rgr,rsq\\_hRIDup,Xpr,rup,T4,RIDup,GIDgr,rup,rgr,T4SK,T4.By usingF14,κ4,κ5,κ11, and message meaning rule, we have(i)
F15:Up|≡GKr∼GIDgr,rgr,rsqhRIDup,Xpr,rup,T4,\\RIDup,GIDgr,rup,rgr,T4SK,T4.By applyingF15,κ2,κ3, freshness conjucatenation, and nonce verification rules, we have(i)
F16:Up|≡GKr|≡GIDgr,rgr,rsqhRIDup,Xpr,rup,T4,\\RIDup,GIDgr,rup,rgr,T4SK,T4.By applyingF16,κ4,κ10,κ15, and jurisdiction rule, we get(i)
F17:Up|≡GIDgr,rgr,rsqhRIDup,Xpr,rup,T4,RIDup,\\GIDgr,rup,rgr,T4SK,T4.ThroughF17, we apply the session key rule as(i)
F18:GKr≡Up|≡GKr↔SKUp (G-2).By applyingF18,κ2,κ14, we use the session key rule as(i)
F19:Up|≡SDq↔SKUp (G-6).This BAN logic analysis proves sufficiently that our contributed model achieves the targeted goals by attaining mutual authenticity among the legal entities of the system.


### 5.1. Informal Security Analysis

An informal security discussion on the security features of the proposed scheme is provided in the following.


#### 5.1.1. Mutual Authentication

In the proposed scheme, all participating entities such asUp, GKr, and SDq mutually authenticate one another. GKr authenticates Up after extracting Lup, computing Xpr, and verifying Mpr factor with a fresh timestamp T1. Similarly, GKr authenticates SDq after computing and evaluating the correctness of Mrq parameter. No malicious entity may compute rsq factor without applying the shared secret Xqr. Likewise, Up authenticates GKr and SDq on account of verification of Mrp factor. Up knows that no adversary may calculate the constituent factors including SK, GIDgr, rgr, and rsq in further computing Mrp without using the shared secret Xpr. Finally, SDq endorses both Up and GKr entities after verification of Mqr parameter. SDq verifies the validity of RIDup, GIDgr, rup, and rgr factors due to the shared secret Xqr.


#### 5.1.2. Anonymity and Untraceability

The proposed scheme remains anonymous due to the fact thatUp does not send its real identity IDup in plaintext on insecure channel. To achieve this property, it computes RIDup by taking hash of real identity IDup along with high entropy random integer γup. Moreover, this hidden identity is submitted to GKr under the cover of shared secret Xpr. An adversary may eavesdrop M2 message from open channel; however, it may not extract either RIDup or the hidden identity IDup from M2. Similarly, our scheme is untraceable since no adversary can distinguish or trace the similarity among messages of various sessions of the same user. Thus, our scheme supports anonymity and untraceability for the user Up.


#### 5.1.3. Impersonation Attacks

Our scheme is resistant toUp as well as GKr impersonation attacks. The adversary may attempt to impersonate as Up and for this, it can replay R1=M1,M2,Mpr,T1 or can modify R1 and send the R1 to GKr, the later may come to know the possibility of the impersonation attack if the Mpr is not satisfied. Similarly, if an adversary attempts to initiate GKr impersonation attack towards Up by manipulating the R4 message, Up may come to know about any forgery on part of adversary by constructing session key SK and verifying the Mrp equation. Hence, the proposed scheme resists any possibility of impersonation attack.


#### 5.1.4. Replay Attack

The attacker may eavesdrop the contents exchanged on the public channel, and it can replay the eavesdroped contents. The proposed scheme may resist replay attack successfully since it employs timestampsT1−T4 to ensure the freshness of each constructed and submitted message R1−R4, respectively. An adversary may not compute fresh messages R1−R4 without accessing the shared secrets Xpr as well as Xqr which are possessed by the legitimate entities of the system.


#### 5.1.5. Stolen Verifier Attack

The proposed scheme is immune to stolen verifier attack by a possible malicious attacker. In our scheme, even if the adversary comes to know about the users’ verifiers such asLup, the adversary must need private key KGR to compute Xpr and recover further information. It is too hard to guess the private secret key KGR of GKr for polynomial time adversary. Thus, our scheme is resistant to stolen verifier attack.


#### 5.1.6. Man in the Middle Attack

In our scheme, if an attacker attempts to act as a malicious intermediary amongUp, GKr, and SDk entities by manipulating the messages R1−R4, it will be detected in the verification procedures such as Mpr, Mqr, Mrp, and Mrq of respective entities. It is obvious from the subsection related to resistance from impersonation attacks that if an attacker attempts to replay or modify the parameters of intermediate messages, it will not succeed in these malicious attempts. Hence, our scheme can resist man in the middle attack successfully.


#### 5.1.7. Perfect Forward Secrecy

The proposed scheme supports perfect forward secrecy because even if the private secret keyKGR of GKr is revealed to the adversary, the latter will not be able to compute Xpr without accessing the parameter Lup which is stored in the repository of GKr. Thus, the adversary may not compute current, previous, or future session keys, in case the long-term private secret of GKr is exposed to the adversary.


#### 5.1.8.SDq Physical Capture

In proposed scheme, if the deviceSDq is physically captured by the adversary while the latter extracts B1 and B2 from the memory of device, it will not be able to recover the shared secret Xqr for lacking access to the private key of SDq. Moreover, even if the adversary is able to access the SDq’s private key, it will only be able to compute the session key of a particular device while the rest of the smart devices SDq in the system will remain protected and the attacker will not be able to compute their session keys.


## 5.1. Informal Security Analysis

An informal security discussion on the security features of the proposed scheme is provided in the following.


### 5.1.1. Mutual Authentication

In the proposed scheme, all participating entities such asUp, GKr, and SDq mutually authenticate one another. GKr authenticates Up after extracting Lup, computing Xpr, and verifying Mpr factor with a fresh timestamp T1. Similarly, GKr authenticates SDq after computing and evaluating the correctness of Mrq parameter. No malicious entity may compute rsq factor without applying the shared secret Xqr. Likewise, Up authenticates GKr and SDq on account of verification of Mrp factor. Up knows that no adversary may calculate the constituent factors including SK, GIDgr, rgr, and rsq in further computing Mrp without using the shared secret Xpr. Finally, SDq endorses both Up and GKr entities after verification of Mqr parameter. SDq verifies the validity of RIDup, GIDgr, rup, and rgr factors due to the shared secret Xqr.


### 5.1.2. Anonymity and Untraceability

The proposed scheme remains anonymous due to the fact thatUp does not send its real identity IDup in plaintext on insecure channel. To achieve this property, it computes RIDup by taking hash of real identity IDup along with high entropy random integer γup. Moreover, this hidden identity is submitted to GKr under the cover of shared secret Xpr. An adversary may eavesdrop M2 message from open channel; however, it may not extract either RIDup or the hidden identity IDup from M2. Similarly, our scheme is untraceable since no adversary can distinguish or trace the similarity among messages of various sessions of the same user. Thus, our scheme supports anonymity and untraceability for the user Up.


### 5.1.3. Impersonation Attacks

Our scheme is resistant toUp as well as GKr impersonation attacks. The adversary may attempt to impersonate as Up and for this, it can replay R1=M1,M2,Mpr,T1 or can modify R1 and send the R1 to GKr, the later may come to know the possibility of the impersonation attack if the Mpr is not satisfied. Similarly, if an adversary attempts to initiate GKr impersonation attack towards Up by manipulating the R4 message, Up may come to know about any forgery on part of adversary by constructing session key SK and verifying the Mrp equation. Hence, the proposed scheme resists any possibility of impersonation attack.


### 5.1.4. Replay Attack

The attacker may eavesdrop the contents exchanged on the public channel, and it can replay the eavesdroped contents. The proposed scheme may resist replay attack successfully since it employs timestampsT1−T4 to ensure the freshness of each constructed and submitted message R1−R4, respectively. An adversary may not compute fresh messages R1−R4 without accessing the shared secrets Xpr as well as Xqr which are possessed by the legitimate entities of the system.


### 5.1.5. Stolen Verifier Attack

The proposed scheme is immune to stolen verifier attack by a possible malicious attacker. In our scheme, even if the adversary comes to know about the users’ verifiers such asLup, the adversary must need private key KGR to compute Xpr and recover further information. It is too hard to guess the private secret key KGR of GKr for polynomial time adversary. Thus, our scheme is resistant to stolen verifier attack.


### 5.1.6. Man in the Middle Attack

In our scheme, if an attacker attempts to act as a malicious intermediary amongUp, GKr, and SDk entities by manipulating the messages R1−R4, it will be detected in the verification procedures such as Mpr, Mqr, Mrp, and Mrq of respective entities. It is obvious from the subsection related to resistance from impersonation attacks that if an attacker attempts to replay or modify the parameters of intermediate messages, it will not succeed in these malicious attempts. Hence, our scheme can resist man in the middle attack successfully.


### 5.1.7. Perfect Forward Secrecy

The proposed scheme supports perfect forward secrecy because even if the private secret keyKGR of GKr is revealed to the adversary, the latter will not be able to compute Xpr without accessing the parameter Lup which is stored in the repository of GKr. Thus, the adversary may not compute current, previous, or future session keys, in case the long-term private secret of GKr is exposed to the adversary.


### 5.1.8.SDq Physical Capture

In proposed scheme, if the deviceSDq is physically captured by the adversary while the latter extracts B1 and B2 from the memory of device, it will not be able to recover the shared secret Xqr for lacking access to the private key of SDq. Moreover, even if the adversary is able to access the SDq’s private key, it will only be able to compute the session key of a particular device while the rest of the smart devices SDq in the system will remain protected and the attacker will not be able to compute their session keys.


## 5.1.1. Mutual Authentication

In the proposed scheme, all participating entities such asUp, GKr, and SDq mutually authenticate one another. GKr authenticates Up after extracting Lup, computing Xpr, and verifying Mpr factor with a fresh timestamp T1. Similarly, GKr authenticates SDq after computing and evaluating the correctness of Mrq parameter. No malicious entity may compute rsq factor without applying the shared secret Xqr. Likewise, Up authenticates GKr and SDq on account of verification of Mrp factor. Up knows that no adversary may calculate the constituent factors including SK, GIDgr, rgr, and rsq in further computing Mrp without using the shared secret Xpr. Finally, SDq endorses both Up and GKr entities after verification of Mqr parameter. SDq verifies the validity of RIDup, GIDgr, rup, and rgr factors due to the shared secret Xqr.


## 5.1.2. Anonymity and Untraceability

The proposed scheme remains anonymous due to the fact thatUp does not send its real identity IDup in plaintext on insecure channel. To achieve this property, it computes RIDup by taking hash of real identity IDup along with high entropy random integer γup. Moreover, this hidden identity is submitted to GKr under the cover of shared secret Xpr. An adversary may eavesdrop M2 message from open channel; however, it may not extract either RIDup or the hidden identity IDup from M2. Similarly, our scheme is untraceable since no adversary can distinguish or trace the similarity among messages of various sessions of the same user. Thus, our scheme supports anonymity and untraceability for the user Up.


## 5.1.3. Impersonation Attacks

Our scheme is resistant toUp as well as GKr impersonation attacks. The adversary may attempt to impersonate as Up and for this, it can replay R1=M1,M2,Mpr,T1 or can modify R1 and send the R1 to GKr, the later may come to know the possibility of the impersonation attack if the Mpr is not satisfied. Similarly, if an adversary attempts to initiate GKr impersonation attack towards Up by manipulating the R4 message, Up may come to know about any forgery on part of adversary by constructing session key SK and verifying the Mrp equation. Hence, the proposed scheme resists any possibility of impersonation attack.


## 5.1.4. Replay Attack

The attacker may eavesdrop the contents exchanged on the public channel, and it can replay the eavesdroped contents. The proposed scheme may resist replay attack successfully since it employs timestampsT1−T4 to ensure the freshness of each constructed and submitted message R1−R4, respectively. An adversary may not compute fresh messages R1−R4 without accessing the shared secrets Xpr as well as Xqr which are possessed by the legitimate entities of the system.


## 5.1.5. Stolen Verifier Attack

The proposed scheme is immune to stolen verifier attack by a possible malicious attacker. In our scheme, even if the adversary comes to know about the users’ verifiers such asLup, the adversary must need private key KGR to compute Xpr and recover further information. It is too hard to guess the private secret key KGR of GKr for polynomial time adversary. Thus, our scheme is resistant to stolen verifier attack.


## 5.1.6. Man in the Middle Attack

In our scheme, if an attacker attempts to act as a malicious intermediary amongUp, GKr, and SDk entities by manipulating the messages R1−R4, it will be detected in the verification procedures such as Mpr, Mqr, Mrp, and Mrq of respective entities. It is obvious from the subsection related to resistance from impersonation attacks that if an attacker attempts to replay or modify the parameters of intermediate messages, it will not succeed in these malicious attempts. Hence, our scheme can resist man in the middle attack successfully.


## 5.1.7. Perfect Forward Secrecy

The proposed scheme supports perfect forward secrecy because even if the private secret keyKGR of GKr is revealed to the adversary, the latter will not be able to compute Xpr without accessing the parameter Lup which is stored in the repository of GKr. Thus, the adversary may not compute current, previous, or future session keys, in case the long-term private secret of GKr is exposed to the adversary.


## 5.1.8.SDq Physical Capture

In proposed scheme, if the deviceSDq is physically captured by the adversary while the latter extracts B1 and B2 from the memory of device, it will not be able to recover the shared secret Xqr for lacking access to the private key of SDq. Moreover, even if the adversary is able to access the SDq’s private key, it will only be able to compute the session key of a particular device while the rest of the smart devices SDq in the system will remain protected and the attacker will not be able to compute their session keys.


## 6. Comparisons

In the following subsections, we provide the comparisons of the proposed SKIA-SH and relevant schemes of Wazid et al. [21], Shuai et al. [23], Kaur and Kumar [24], and Yu et al. [20].


### 6.1. Security Features

The security attribute provision of the proposed SKIA-SH and related schemes [20, 21, 23, 24] is shown in Table 2. Referring to Table 2, except the proposed SKIA-SH scheme, all the related schemes presented in [20, 21, 23, 24] entail one or more weaknesses: the scheme of Yu et al. [20] has a faulty design and it cannot provide mutual authentication between a user and smart devices (SDs), which is proved in Section 3 of this paper. The scheme of Kaur and Kumar [24] has weaknesses against session key disclosure attack and it cannot provide mutual authentication between a user and SDs. The scheme of Shuai et al. [23] cannot resist offline password guessing, insider, replay, and session disclosure attacks, whereas, the scheme of Wazid et al. cannot provide forward secrecy and it cannot resist replay and de-synchronization attacks. Only proposed SKIA-SH provides requisite security attributes and is well suited for smart home (SH) environments.Table 2
Security features.
SchemesOur scheme[20][24][23][21]MAP✓✕✕✓✓UAP✓✓✓✓✓SVP✓✓✓✓✓DSN✓✓✓✓✕UIA✓✓✓✓✓RAP✓✓✓✕✕SKD✓✓✕✕✓PCA✓✓✓✓✓FSP✓✓✓✓✕IAP✓✓✓✕✓MMP✓✓✓✓✓OPG✓✓✓✕✓Note. MAP: mutual authentication provision; UAP: user anonymity and privacy; PSV: stolen verifier protection; DSN: resistance to de-synchronization attack; UIA: user impersonation attack; RAP: replay attack protection; SKD: session key disclosure attack; PCA: protection from physical capture of smart device; FSP: forward secrecy provision; IAP: insider attack protection; MMP: man in middle attack; OPG: offline password guessing attack; ✓: attribute provision; ✕: attribute non-provision.


### 6.2. Computation Cost

In this section, using a real-time experiment, we provide a comparative computation cost of our SKIA-SH and some of the recent schemes [20, 21, 23, 24]. We conducted the experiment using three devices and corresponding underneath hardware and softwares: ① A Xiaomi Redmi-Note-8 equipped with 4 GB RAM and with an Octa-core 2.01-GHz mprocessor and v-9 andriod MUI-V.11.0.7 operating system, the smart phone simulates a user/mobile-device, ② for GKr, we adopted an Elite-Book HP 8460P equipped with 4 GB RAM and intel ③ 2.7 GHz mprocessor and th OS used is Ubuntune V.LTS-16, ④ the smart device SDq is simulated through a Cortex:A53-ARMv8, Pi-B+, 64 bit: SoC, 1 GB: LPDDR2 SDRAM and 1.4 GHz mprocessor. Among other operations, the biohashing/fuzzy extraction Tfb is approximated with an elliptic-curve point multiplication Tem. The notations and their corresponding running times on each device according to the conducted experiment are shown in Table 3. To furnish a round of authentication, Up executes 1Tfb+13Th+1Te operations, in addition to 12Th and 7Th executed by GKr and SDq. The total running time (RT) on Up side is ≈5.25 ms, the RT on GKr is ≈0.048 ms, and the RT on SDq through the experiment is ≈0.042 ms. Therefore, total RT of the proposed SKIA-SH is ≈5.34 ms. The RT to execute an authentication round of Yu et al.’s scheme is ≈5.327. Similarly, the RT of the schemes of Shuai et al., Kaur and Kumar, and Wazid et al. is ≈16.374, ≈16.378, and ≈5.493, respectively.Table 3
Running time.
Entity⟶UpGKrSDq↓ OperationTem/Tfb5.1160.9264.107Te0.0170.0080.013Th0.0090.0040.006Note.Tem: point multiplication over ECC; Tfb: fuzzy extraction/biohashing; Te: AES-128 block encryption/decryption operation; Th: secure one-way hash operation.


### 6.3. Communication Cost

This section shows the comparisons of our SKIA-SH and the schemes of [20, 21, 23, 24], and for computation cost (CC) comparisons, we adopted SHA-1 with 20-byte output size. The identities and time stamps are kept 8 bytes and 4 bytes, respectively. The random numbers are taken 20 bytes long, and the adopted encryption/decryption algorithm AES-128 also takes 16-byte input and 16-byte output. The size of a coordinate of elliptic curve point (ECP) is 20 bytes and the total length of an ECP is 20 + 20 = 40 bytes. The SKIA-SH (proposed scheme) completes an authentication round by exchanging four (4) messages: ① message sent by Up to GKr is R1=M1,M2,Mpr,PIDup,T1. R1 costs 20+20+20+20+4=84 bytes. ② Message sent by GKr to SQq is R2=M3,Mqr,T2. R2 costs 20+20+4=44 bytes. ③ Message sent by SQq to GKr is R3=M4,Mrq,T3, and R3 costs 20+20+4=44 bytes. ④ Likewise, the message sent by GKr to Up is R4=M5,Mrp,T4, and R4 costs 20+20+4=44 bytes. Therefore, total bytes exchanged during a round of authentication cycle are 84+44+44+44=216 bytes. The communication cost of the Yu et al.’s scheme is 64+44+44+44=196 bytes. Similarly, the communication cost of the scheme of Shuai et al., Kaur and Kumar, and Wazid et al. is 208 bytes, 224 bytes, and 376 bytes, respectively. The computation and communication cost comparisons are also depicted in Table 4.Table 4
Comparisons of computation and communication costs.
ProtocolUpGKrSDqRTBytes ex.Wazid et al. [21]1Tfb+8Th+6Te7Th+11Te5Th+11Te≈5.493ms376Shuai et al. [23]1Tfb+6Th+2Tem7Th+1Tem3Th≈16.374ms208Kaur and Kumar [24]1Tfb+6Th+2Tem8Th+1Tem3Th≈16.378ms224Yu et al. [20]1Tfb+12Th+1Te11Th7Th≈5.327ms196Proposed1Tfb+13Th+1Te12Th7Th≈5.34ms216Note. RT: running time (ms); ex: exchange.


## 6.1. Security Features

The security attribute provision of the proposed SKIA-SH and related schemes [20, 21, 23, 24] is shown in Table 2. Referring to Table 2, except the proposed SKIA-SH scheme, all the related schemes presented in [20, 21, 23, 24] entail one or more weaknesses: the scheme of Yu et al. [20] has a faulty design and it cannot provide mutual authentication between a user and smart devices (SDs), which is proved in Section 3 of this paper. The scheme of Kaur and Kumar [24] has weaknesses against session key disclosure attack and it cannot provide mutual authentication between a user and SDs. The scheme of Shuai et al. [23] cannot resist offline password guessing, insider, replay, and session disclosure attacks, whereas, the scheme of Wazid et al. cannot provide forward secrecy and it cannot resist replay and de-synchronization attacks. Only proposed SKIA-SH provides requisite security attributes and is well suited for smart home (SH) environments.Table 2
Security features.
SchemesOur scheme[20][24][23][21]MAP✓✕✕✓✓UAP✓✓✓✓✓SVP✓✓✓✓✓DSN✓✓✓✓✕UIA✓✓✓✓✓RAP✓✓✓✕✕SKD✓✓✕✕✓PCA✓✓✓✓✓FSP✓✓✓✓✕IAP✓✓✓✕✓MMP✓✓✓✓✓OPG✓✓✓✕✓Note. MAP: mutual authentication provision; UAP: user anonymity and privacy; PSV: stolen verifier protection; DSN: resistance to de-synchronization attack; UIA: user impersonation attack; RAP: replay attack protection; SKD: session key disclosure attack; PCA: protection from physical capture of smart device; FSP: forward secrecy provision; IAP: insider attack protection; MMP: man in middle attack; OPG: offline password guessing attack; ✓: attribute provision; ✕: attribute non-provision.


## 6.2. Computation Cost

In this section, using a real-time experiment, we provide a comparative computation cost of our SKIA-SH and some of the recent schemes [20, 21, 23, 24]. We conducted the experiment using three devices and corresponding underneath hardware and softwares: ① A Xiaomi Redmi-Note-8 equipped with 4 GB RAM and with an Octa-core 2.01-GHz mprocessor and v-9 andriod MUI-V.11.0.7 operating system, the smart phone simulates a user/mobile-device, ② for GKr, we adopted an Elite-Book HP 8460P equipped with 4 GB RAM and intel ③ 2.7 GHz mprocessor and th OS used is Ubuntune V.LTS-16, ④ the smart device SDq is simulated through a Cortex:A53-ARMv8, Pi-B+, 64 bit: SoC, 1 GB: LPDDR2 SDRAM and 1.4 GHz mprocessor. Among other operations, the biohashing/fuzzy extraction Tfb is approximated with an elliptic-curve point multiplication Tem. The notations and their corresponding running times on each device according to the conducted experiment are shown in Table 3. To furnish a round of authentication, Up executes 1Tfb+13Th+1Te operations, in addition to 12Th and 7Th executed by GKr and SDq. The total running time (RT) on Up side is ≈5.25 ms, the RT on GKr is ≈0.048 ms, and the RT on SDq through the experiment is ≈0.042 ms. Therefore, total RT of the proposed SKIA-SH is ≈5.34 ms. The RT to execute an authentication round of Yu et al.’s scheme is ≈5.327. Similarly, the RT of the schemes of Shuai et al., Kaur and Kumar, and Wazid et al. is ≈16.374, ≈16.378, and ≈5.493, respectively.Table 3
Running time.
Entity⟶UpGKrSDq↓ OperationTem/Tfb5.1160.9264.107Te0.0170.0080.013Th0.0090.0040.006Note.Tem: point multiplication over ECC; Tfb: fuzzy extraction/biohashing; Te: AES-128 block encryption/decryption operation; Th: secure one-way hash operation.


## 6.3. Communication Cost

This section shows the comparisons of our SKIA-SH and the schemes of [20, 21, 23, 24], and for computation cost (CC) comparisons, we adopted SHA-1 with 20-byte output size. The identities and time stamps are kept 8 bytes and 4 bytes, respectively. The random numbers are taken 20 bytes long, and the adopted encryption/decryption algorithm AES-128 also takes 16-byte input and 16-byte output. The size of a coordinate of elliptic curve point (ECP) is 20 bytes and the total length of an ECP is 20 + 20 = 40 bytes. The SKIA-SH (proposed scheme) completes an authentication round by exchanging four (4) messages: ① message sent by Up to GKr is R1=M1,M2,Mpr,PIDup,T1. R1 costs 20+20+20+20+4=84 bytes. ② Message sent by GKr to SQq is R2=M3,Mqr,T2. R2 costs 20+20+4=44 bytes. ③ Message sent by SQq to GKr is R3=M4,Mrq,T3, and R3 costs 20+20+4=44 bytes. ④ Likewise, the message sent by GKr to Up is R4=M5,Mrp,T4, and R4 costs 20+20+4=44 bytes. Therefore, total bytes exchanged during a round of authentication cycle are 84+44+44+44=216 bytes. The communication cost of the Yu et al.’s scheme is 64+44+44+44=196 bytes. Similarly, the communication cost of the scheme of Shuai et al., Kaur and Kumar, and Wazid et al. is 208 bytes, 224 bytes, and 376 bytes, respectively. The computation and communication cost comparisons are also depicted in Table 4.Table 4
Comparisons of computation and communication costs.
ProtocolUpGKrSDqRTBytes ex.Wazid et al. [21]1Tfb+8Th+6Te7Th+11Te5Th+11Te≈5.493ms376Shuai et al. [23]1Tfb+6Th+2Tem7Th+1Tem3Th≈16.374ms208Kaur and Kumar [24]1Tfb+6Th+2Tem8Th+1Tem3Th≈16.378ms224Yu et al. [20]1Tfb+12Th+1Te11Th7Th≈5.327ms196Proposed1Tfb+13Th+1Te12Th7Th≈5.34ms216Note. RT: running time (ms); ex: exchange.


## 7. Conclusion

In this article, we highlighted the need of secure and communication between the smart devices and users through the facilitation of the gateway in the smart home (SH) settings of the IoT. We then reviewed a very recent authentication scheme of Yu et al. We proved that the symmetric key-based efficient and secure authentication scheme entails a critical design flaw, and owing to the explored design flaw, the scheme of Yu et al. cannot complete a cycle of authentication process. An improved scheme free of design flaws and based on only symmetric key function for SH (SKIA-SH) is proposed to mitigate the security and efficiency issues of the SH environments. The security of the SKIA-SH is substantiated through BAN logic. Moreover, we provided a brief discussion of the security attribute provision of the proposed SKIA-SH. To measure the performance, we set up a real-time experiment, and the results show that the SKIA-SH is more secure while it has slight over computation and communication costs when compared with original scheme of Yu et al. The SKIA-SH accomplishes the authentication among a user and a smart device involving gateway in5.34ms and by exchanging 216 bytes. As a future work, we intend to extend the proposed method to work in a building area network to provide central and apartment-based services.



---

*Source: 8669941-2022-02-12.xml*