# PUF-Assisted Lightweight Group Authentication and Key Agreement Protocol in Smart Home

Authors: Yandong Xia; Rongxin Qi; Sai Ji; Jian Shen; Tiantian Miao; Huaqun Wang
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

Various IoT-based applications such as smart home, intelligent medical, and VANETs have been put into practical utilization. The smart home is one of the most concerned environments, allowing users to access and control smart devices via the public network remotely. The smart home can provide many intelligent services for users through these smart devices. To securely access devices and obtain collected data over the public network, multifactor authentication protocols for smart home have gained wide attention. However, most of these protocols cannot withstand impersonation attack, smart device lost attack, privileged-insider attack, smart card lost attack, and so on. Besides, high communication and computational costs weaken the system performance, which leads to most authentication protocols are not suitable for resource-constrained smart devices. To mitigate the aforementioned drawbacks, we proposed a PUF-assisted lightweight group authentication and key agreement protocol to implement secure access to multiple devices in the smart home simultaneously using the Chinese Remainder Theorem and secret sharing technique. Our protocol also utilizes physical unclonable function (PUF) and fuzzy extractor technique to extract the digital fingerprint of the smart devices, which can uniquely validate smart devices and protect the secrets stored in their memory. Our protocol can support various security features and withstand the many well-known attacks in the smart home. The performance analysis indicates that the proposed protocol can efficiently reduce communication/computational costs when the user simultaneously accesses multiple devices.


---

## Body

## 1. Introduction

With the rapid development of the Internet of Things (IoT) technology, various IoT-based applications such as smart home, intelligent medical, and VANETs have emerged. In these applications, the smart home has gained wide attention in recent years due to its convenience, efficiency, and other properties, providing basic and practical home control services for users. The smart home is a dwelling that connects major appliances and services and permits them to be accessed via the public network [1]. In most existing schemes, the smart home is usually composed of user equipment (e.g., smartphone), home gateway (HG), and lots of smart devices (e.g., surveillance camera, lighting controller, and temperature sensors) [2]. The smart devices are interconnected to collect the data in the smart home and interact with users via the public network. HG acts as the communication medium between the user and smart devices.Smart devices are generally easy to suffer from various attacks such as impersonation attack, physical device lost attack, and privileged-insider attack during the execution of the protocol. Once these devices are broken, user privacy will be compromised. For example, unauthorized users may access the surveillance cameras and control them to monitor smart home residents. In addition, most of these IoT devices such as sensors have limited resources to execute complex computational operations [3, 4]. In recent years, many Elliptic Curve Cryptography- (ECC-) based schemes [5, 6] have been proposed to enhance authentication security. However, these schemes generally require to perform complex computational operations, which are not suitable for resource-constrained devices. Some schemes also cannot provide most security features and functionalities such as user anonymity, perfect forward secrecy, and dynamic device addition. To solve the security and privacy issues in IoT environments, a large number of authentication schemes have been proposed [7–9]. In most of the existing schemes, the computational and communication costs are too high to be suitable for resource-constrained [8] devices. If the user wants to access multiple smart devices simultaneously, it is necessary to verify the authenticity of user identity frequently and send access requests to correspond with smart devices in a short time, which may lead to network delay and even congestion. Therefore, it is crucial to design an efficient and lightweight authentication scheme to establish the secure session key between the user and smart devices in the smart home. Group authentication schemes are put forward to solve aforementioned issues. Group authentication schemes based on secret sharing can authenticate multiple smart devices belonging to the same group simultaneously.Besides, the traditional read-only memory- (ROM-) based authentication techniques have the characteristic of expensive power consumption and nonvolatile memory, which are vulnerable to external attacks [10]. Physical unclonable function is a promising hardware primitive that can be utilized for lightweight authentication and secret key storage, which extracts the unique physical property from the integrated circuits (IC) [11]. Each IC has different physical characteristics even if they are identical in function. The secrets derived from IC through PUF are actually different due to the variability in manufacturing. PUF can handle the inherent weaknesses successfully existing in the traditional ROM-based authentication techniques. PUF technique can be utilized to distinguish the smart devices and prevent them from being attacked, cloned, and forged by the adversary. However, changes in the environment around smart devices may affect the digital circuit, which leads to errors in the output of the PUF function. In order to improve the fault tolerance rate of the PUF function, the fuzzy extractor has been widely used to correct errors in the PUF function [12].Considering the security of the parameters stored in the smart devices, PUF is utilized to prevent stolen device attack. PUF can be utilized to assist smart devices to generate a biometric key, which efficiently protects the security smart devices [12]. Therefore, we propose a PUF-assisted lightweight group authentication and key agreement protocol in the smart home. Our protocol supports many well-known features such as untraceability, user anonymity, and forward secrecy. The smart devices are allowed to join or leave the group dynamically.


### 1.1. Our Contributions

(i)
A PUF-assisted lightweight group authentication and key agreement protocol in the smart home is presented in our paper. Our protocol is suitable for the resource-constrained smart devices only using lightweight operation and symmetric cryptography. The secret sharing technique and Chinese Remainder Theorem are utilized to establish the group session key between the user and smart devices(ii)
The security of our protocol is proved under the widespread ROR model [13]. The formal security analysis shows that our protocol is semantically secure. Other discussions on security show that the proposed protocol can guarantee many security features such as untraceability and user anonymity and also can withstand most known attacks(iii)
The dynamic joining and leaving of smart devices from deployed network are both supported by the proposed protocol. The illegitimate smart devices fail to attain the group key without the secret share. The new smart device just registers itself before joining the deployed network(iv)
The physical security of smart devices is guaranteed by physical unclonable function technology. The output of PUF depends on the physical fingerprint of the physical device. PUF has the characteristics of tamper-resistant, unclonability, and unpredictability(v)
The issue of repeated authentication of the same user who accesses the multiple smart devices simultaneously is solved. The performance analysis indicates that the protocol effectively reduces resource costs compared with other protocols


### 1.2. Related Work

#### 1.2.1. Authentication

Smart home allows the authorized users to remotely access devices and obtain information collected by these devices. To address security and privacy issues in IoT, a large number of researchers [14–16] have studied many authentication schemes for the smart home.In 2011, Vaidya et al. proposed a novel authentication and key establishment mechanism based on ECC. Although their scheme satisfies more security requirements compared to previous schemes, their scheme is not suitable for resource-constrained home area networks. Therefore, many schemes focus on providing more security features while they are not suitable for resource-constrained devices. To solve communication security issues in WSNs, Xue et al. [14] utilized temporary credentials to implement authentication between the user and sensing nodes for WSNs in 2013. Their scheme is lightweight to be suitable for the sensing nodes using hash function and bit-wise XOR operations. However, He et al. [15] thought their scheme fails to resist offline password guessing attack, impersonation attack, and tampering attack. In 2013, He et al. [17] proposed an improved authentication scheme that overcomes the security threats in Xue’s scheme and only increases little computational cost. In 2014, Turkanovic et al. [17] focused on a scenario where the user accessing a single targeted sensor in WSNs does not need to interact with HG. Meanwhile, Kalra and Sood [18] found that Xue’s scheme is vulnerable to smartcard lost attack. Kalra and Sood [18] proposed a novel authentication scheme based on password and smartcard, which can resist most known attacks and has a lower cost than other schemes. However, their scheme does not consider resisting sensing node capturing attack and privileged-insider attack. In 2018, Shen et al. [19] adopted the cloud to enhance the capabilities of devices and established a lightweight authentication scheme without certificates for WBANs.The devices in the IoT environment have similar features to the sensing nodes in traditional WSNs. Due to the heterogeneity and dynamics of IoT devices, the higher security and privacy requirements need to be satisfied in the IoT environment. Kumar et al. [16] proposed an anonymous authentication framework for smart home only using hash function and symmetric cryptography. Kumar et al. firstly considered the features of anonymity and unlinkability for smart home, and their scheme can resist many known attacks. Challa et al. [20] proposed a novel signature-based authenticated key establishment scheme for the generic IoT environment. The user can not only communicate with smart devices but also with other users through HG. In 2018, Srinivas et al. [21] proposed an anonymous three-factor authentication and key agreement scheme which supports credentials update, user revocation, and new devices addition. However, Gope et al. [22] thought the sensitive information stored in the memory of smart devices may be compromised to the adversary by the side-channel attack. The adversary then obtains the sensitive information and traces all the access users in previous communications. Besides, most smart devices are not tamper-evident so that the adversary can intercept the communication messages and impersonate legitimate devices.


#### 1.2.2. Group Authentication

The concept of group authentication is proposed to implement identity authentication among group members at a time. Many group-based authentication schemes are also proposed to improve the efficiency of group communication. In 2013, Harn [23] and Liu et al. [24] both proposed an improved group authentication protocol for group-oriented applications based on secret sharing. In 2016, Li et al. [25] thought that Harn’s protocol fails to support key agreement during the authentication process and cannot resist replay attack and man-in-middle attack. They proposed an improved group authentication and key agreement protocol for MTC in LTE-A networks, which supports dynamical policy updating and provides strong security properties compared to previous work. In 2019, Cui et al. [26] proposed an efficient signature-based group authentication scheme for vehicular ad hoc networks (VANETs). RSU can efficiently update the group key generated by two hash chains to exclude malicious vehicles from the group. In 2020, Zhang and Lee [27] provided an efficient group authentication scheme based on the group signature technique, which protects the integrity of blockchain-based mobile-edge computing (BMEC). In this paper, we propose a secure and efficient group authentication protocol for smart home based on the PUF and secret sharing technique. Currently, most of these protocols cannot withstand smart device lost attack and smart card lost attack. Besides, high communication and computational cost leads to most authentication protocols are not suitable for resource-constrained smart devices.


#### 1.2.3. PUF Technology

Recently, PUF technology is introduced to resist the aforesaid issues. Most existing authentication protocols are designed based on tamper-evident PUF [28–35] to prevent the physical attack. Wallrabenstein [28] proposed an ideal PUF-based authentication protocol to provide cost-effective tamper resistance for resource-constrained devices in IoT, which minimizes the probability of private key disclosure. To resist denial and masquerading attacks, Chatterjee et al. [31] used PUF’s response to replace the public identity string used for message encryption and disabled the public key generator in the scheme, allowing the receiving node to generate its own public and private keys and the server to verify the public key. In order to solve the problems of man-in-the middle attack and replay attack under DY security model, Braeken [32] used elliptic curve addition and multiplication to replace bilinear pair operation and realized identity-based authentication. Chatterjee et al. [33] combined IBE, PUF, and message authentication code to propose a low-power, low-latency authentication, and key agreement protocol that solves the database storage overhead and successfully defies man-in-the-middle attacks. Gope et al. [29] proposed a lightweight anonymous authentication protocol based on ideal PUF. They subsequently took the effects of noise on PUF into account and enhanced the authentication protocol to support noisy PUF. They utilized other prestored pseudo identities and challenge-response pairs to ensure the security of the protocol when suffering from DoS attacks. Furthermore, Tiplea and Hristea [30] pointed that most existing PUF-based authentication protocols cannot protect security and privacy in IoT under corruption with temporary state disclosure, while some important temporary variables are not protected by PUF. Therefore, they proposed a general method to protect the temporary variables and utilized it to fix the flaws existing in the previous PUF-based authentication protocols. Li and Liu [34] optimized the existing RFID authentication protocol based on double PUF. They proposed a protocol that can meet the untraceable, successfully resist desynchronization attacks and tag impersonation attacks, and has better security and privacy. PUF-based authentication schemes are threatened by powerful machine learning attacks. Chen et al. [35] show that the “availability” and “reliability” features of Shamir’s secret sharing (SSS) can be applied to address the security issue. They presented a mutual authentication protocol where no response is exposed to the adversary and can avoid the use of cryptographic algorithms and error correcting codes. The current PUF-based authentication protocol can resist internal attacks, but it is still affected by external environment, resulting in PUF function output errors. How to improve the fault tolerance rate is an urgent problem to be solved.


## 1.1. Our Contributions

(i)
A PUF-assisted lightweight group authentication and key agreement protocol in the smart home is presented in our paper. Our protocol is suitable for the resource-constrained smart devices only using lightweight operation and symmetric cryptography. The secret sharing technique and Chinese Remainder Theorem are utilized to establish the group session key between the user and smart devices(ii)
The security of our protocol is proved under the widespread ROR model [13]. The formal security analysis shows that our protocol is semantically secure. Other discussions on security show that the proposed protocol can guarantee many security features such as untraceability and user anonymity and also can withstand most known attacks(iii)
The dynamic joining and leaving of smart devices from deployed network are both supported by the proposed protocol. The illegitimate smart devices fail to attain the group key without the secret share. The new smart device just registers itself before joining the deployed network(iv)
The physical security of smart devices is guaranteed by physical unclonable function technology. The output of PUF depends on the physical fingerprint of the physical device. PUF has the characteristics of tamper-resistant, unclonability, and unpredictability(v)
The issue of repeated authentication of the same user who accesses the multiple smart devices simultaneously is solved. The performance analysis indicates that the protocol effectively reduces resource costs compared with other protocols


## 1.2. Related Work

### 1.2.1. Authentication

Smart home allows the authorized users to remotely access devices and obtain information collected by these devices. To address security and privacy issues in IoT, a large number of researchers [14–16] have studied many authentication schemes for the smart home.In 2011, Vaidya et al. proposed a novel authentication and key establishment mechanism based on ECC. Although their scheme satisfies more security requirements compared to previous schemes, their scheme is not suitable for resource-constrained home area networks. Therefore, many schemes focus on providing more security features while they are not suitable for resource-constrained devices. To solve communication security issues in WSNs, Xue et al. [14] utilized temporary credentials to implement authentication between the user and sensing nodes for WSNs in 2013. Their scheme is lightweight to be suitable for the sensing nodes using hash function and bit-wise XOR operations. However, He et al. [15] thought their scheme fails to resist offline password guessing attack, impersonation attack, and tampering attack. In 2013, He et al. [17] proposed an improved authentication scheme that overcomes the security threats in Xue’s scheme and only increases little computational cost. In 2014, Turkanovic et al. [17] focused on a scenario where the user accessing a single targeted sensor in WSNs does not need to interact with HG. Meanwhile, Kalra and Sood [18] found that Xue’s scheme is vulnerable to smartcard lost attack. Kalra and Sood [18] proposed a novel authentication scheme based on password and smartcard, which can resist most known attacks and has a lower cost than other schemes. However, their scheme does not consider resisting sensing node capturing attack and privileged-insider attack. In 2018, Shen et al. [19] adopted the cloud to enhance the capabilities of devices and established a lightweight authentication scheme without certificates for WBANs.The devices in the IoT environment have similar features to the sensing nodes in traditional WSNs. Due to the heterogeneity and dynamics of IoT devices, the higher security and privacy requirements need to be satisfied in the IoT environment. Kumar et al. [16] proposed an anonymous authentication framework for smart home only using hash function and symmetric cryptography. Kumar et al. firstly considered the features of anonymity and unlinkability for smart home, and their scheme can resist many known attacks. Challa et al. [20] proposed a novel signature-based authenticated key establishment scheme for the generic IoT environment. The user can not only communicate with smart devices but also with other users through HG. In 2018, Srinivas et al. [21] proposed an anonymous three-factor authentication and key agreement scheme which supports credentials update, user revocation, and new devices addition. However, Gope et al. [22] thought the sensitive information stored in the memory of smart devices may be compromised to the adversary by the side-channel attack. The adversary then obtains the sensitive information and traces all the access users in previous communications. Besides, most smart devices are not tamper-evident so that the adversary can intercept the communication messages and impersonate legitimate devices.


### 1.2.2. Group Authentication

The concept of group authentication is proposed to implement identity authentication among group members at a time. Many group-based authentication schemes are also proposed to improve the efficiency of group communication. In 2013, Harn [23] and Liu et al. [24] both proposed an improved group authentication protocol for group-oriented applications based on secret sharing. In 2016, Li et al. [25] thought that Harn’s protocol fails to support key agreement during the authentication process and cannot resist replay attack and man-in-middle attack. They proposed an improved group authentication and key agreement protocol for MTC in LTE-A networks, which supports dynamical policy updating and provides strong security properties compared to previous work. In 2019, Cui et al. [26] proposed an efficient signature-based group authentication scheme for vehicular ad hoc networks (VANETs). RSU can efficiently update the group key generated by two hash chains to exclude malicious vehicles from the group. In 2020, Zhang and Lee [27] provided an efficient group authentication scheme based on the group signature technique, which protects the integrity of blockchain-based mobile-edge computing (BMEC). In this paper, we propose a secure and efficient group authentication protocol for smart home based on the PUF and secret sharing technique. Currently, most of these protocols cannot withstand smart device lost attack and smart card lost attack. Besides, high communication and computational cost leads to most authentication protocols are not suitable for resource-constrained smart devices.


### 1.2.3. PUF Technology

Recently, PUF technology is introduced to resist the aforesaid issues. Most existing authentication protocols are designed based on tamper-evident PUF [28–35] to prevent the physical attack. Wallrabenstein [28] proposed an ideal PUF-based authentication protocol to provide cost-effective tamper resistance for resource-constrained devices in IoT, which minimizes the probability of private key disclosure. To resist denial and masquerading attacks, Chatterjee et al. [31] used PUF’s response to replace the public identity string used for message encryption and disabled the public key generator in the scheme, allowing the receiving node to generate its own public and private keys and the server to verify the public key. In order to solve the problems of man-in-the middle attack and replay attack under DY security model, Braeken [32] used elliptic curve addition and multiplication to replace bilinear pair operation and realized identity-based authentication. Chatterjee et al. [33] combined IBE, PUF, and message authentication code to propose a low-power, low-latency authentication, and key agreement protocol that solves the database storage overhead and successfully defies man-in-the-middle attacks. Gope et al. [29] proposed a lightweight anonymous authentication protocol based on ideal PUF. They subsequently took the effects of noise on PUF into account and enhanced the authentication protocol to support noisy PUF. They utilized other prestored pseudo identities and challenge-response pairs to ensure the security of the protocol when suffering from DoS attacks. Furthermore, Tiplea and Hristea [30] pointed that most existing PUF-based authentication protocols cannot protect security and privacy in IoT under corruption with temporary state disclosure, while some important temporary variables are not protected by PUF. Therefore, they proposed a general method to protect the temporary variables and utilized it to fix the flaws existing in the previous PUF-based authentication protocols. Li and Liu [34] optimized the existing RFID authentication protocol based on double PUF. They proposed a protocol that can meet the untraceable, successfully resist desynchronization attacks and tag impersonation attacks, and has better security and privacy. PUF-based authentication schemes are threatened by powerful machine learning attacks. Chen et al. [35] show that the “availability” and “reliability” features of Shamir’s secret sharing (SSS) can be applied to address the security issue. They presented a mutual authentication protocol where no response is exposed to the adversary and can avoid the use of cryptographic algorithms and error correcting codes. The current PUF-based authentication protocol can resist internal attacks, but it is still affected by external environment, resulting in PUF function output errors. How to improve the fault tolerance rate is an urgent problem to be solved.


## 1.2.1. Authentication

Smart home allows the authorized users to remotely access devices and obtain information collected by these devices. To address security and privacy issues in IoT, a large number of researchers [14–16] have studied many authentication schemes for the smart home.In 2011, Vaidya et al. proposed a novel authentication and key establishment mechanism based on ECC. Although their scheme satisfies more security requirements compared to previous schemes, their scheme is not suitable for resource-constrained home area networks. Therefore, many schemes focus on providing more security features while they are not suitable for resource-constrained devices. To solve communication security issues in WSNs, Xue et al. [14] utilized temporary credentials to implement authentication between the user and sensing nodes for WSNs in 2013. Their scheme is lightweight to be suitable for the sensing nodes using hash function and bit-wise XOR operations. However, He et al. [15] thought their scheme fails to resist offline password guessing attack, impersonation attack, and tampering attack. In 2013, He et al. [17] proposed an improved authentication scheme that overcomes the security threats in Xue’s scheme and only increases little computational cost. In 2014, Turkanovic et al. [17] focused on a scenario where the user accessing a single targeted sensor in WSNs does not need to interact with HG. Meanwhile, Kalra and Sood [18] found that Xue’s scheme is vulnerable to smartcard lost attack. Kalra and Sood [18] proposed a novel authentication scheme based on password and smartcard, which can resist most known attacks and has a lower cost than other schemes. However, their scheme does not consider resisting sensing node capturing attack and privileged-insider attack. In 2018, Shen et al. [19] adopted the cloud to enhance the capabilities of devices and established a lightweight authentication scheme without certificates for WBANs.The devices in the IoT environment have similar features to the sensing nodes in traditional WSNs. Due to the heterogeneity and dynamics of IoT devices, the higher security and privacy requirements need to be satisfied in the IoT environment. Kumar et al. [16] proposed an anonymous authentication framework for smart home only using hash function and symmetric cryptography. Kumar et al. firstly considered the features of anonymity and unlinkability for smart home, and their scheme can resist many known attacks. Challa et al. [20] proposed a novel signature-based authenticated key establishment scheme for the generic IoT environment. The user can not only communicate with smart devices but also with other users through HG. In 2018, Srinivas et al. [21] proposed an anonymous three-factor authentication and key agreement scheme which supports credentials update, user revocation, and new devices addition. However, Gope et al. [22] thought the sensitive information stored in the memory of smart devices may be compromised to the adversary by the side-channel attack. The adversary then obtains the sensitive information and traces all the access users in previous communications. Besides, most smart devices are not tamper-evident so that the adversary can intercept the communication messages and impersonate legitimate devices.


## 1.2.2. Group Authentication

The concept of group authentication is proposed to implement identity authentication among group members at a time. Many group-based authentication schemes are also proposed to improve the efficiency of group communication. In 2013, Harn [23] and Liu et al. [24] both proposed an improved group authentication protocol for group-oriented applications based on secret sharing. In 2016, Li et al. [25] thought that Harn’s protocol fails to support key agreement during the authentication process and cannot resist replay attack and man-in-middle attack. They proposed an improved group authentication and key agreement protocol for MTC in LTE-A networks, which supports dynamical policy updating and provides strong security properties compared to previous work. In 2019, Cui et al. [26] proposed an efficient signature-based group authentication scheme for vehicular ad hoc networks (VANETs). RSU can efficiently update the group key generated by two hash chains to exclude malicious vehicles from the group. In 2020, Zhang and Lee [27] provided an efficient group authentication scheme based on the group signature technique, which protects the integrity of blockchain-based mobile-edge computing (BMEC). In this paper, we propose a secure and efficient group authentication protocol for smart home based on the PUF and secret sharing technique. Currently, most of these protocols cannot withstand smart device lost attack and smart card lost attack. Besides, high communication and computational cost leads to most authentication protocols are not suitable for resource-constrained smart devices.


## 1.2.3. PUF Technology

Recently, PUF technology is introduced to resist the aforesaid issues. Most existing authentication protocols are designed based on tamper-evident PUF [28–35] to prevent the physical attack. Wallrabenstein [28] proposed an ideal PUF-based authentication protocol to provide cost-effective tamper resistance for resource-constrained devices in IoT, which minimizes the probability of private key disclosure. To resist denial and masquerading attacks, Chatterjee et al. [31] used PUF’s response to replace the public identity string used for message encryption and disabled the public key generator in the scheme, allowing the receiving node to generate its own public and private keys and the server to verify the public key. In order to solve the problems of man-in-the middle attack and replay attack under DY security model, Braeken [32] used elliptic curve addition and multiplication to replace bilinear pair operation and realized identity-based authentication. Chatterjee et al. [33] combined IBE, PUF, and message authentication code to propose a low-power, low-latency authentication, and key agreement protocol that solves the database storage overhead and successfully defies man-in-the-middle attacks. Gope et al. [29] proposed a lightweight anonymous authentication protocol based on ideal PUF. They subsequently took the effects of noise on PUF into account and enhanced the authentication protocol to support noisy PUF. They utilized other prestored pseudo identities and challenge-response pairs to ensure the security of the protocol when suffering from DoS attacks. Furthermore, Tiplea and Hristea [30] pointed that most existing PUF-based authentication protocols cannot protect security and privacy in IoT under corruption with temporary state disclosure, while some important temporary variables are not protected by PUF. Therefore, they proposed a general method to protect the temporary variables and utilized it to fix the flaws existing in the previous PUF-based authentication protocols. Li and Liu [34] optimized the existing RFID authentication protocol based on double PUF. They proposed a protocol that can meet the untraceable, successfully resist desynchronization attacks and tag impersonation attacks, and has better security and privacy. PUF-based authentication schemes are threatened by powerful machine learning attacks. Chen et al. [35] show that the “availability” and “reliability” features of Shamir’s secret sharing (SSS) can be applied to address the security issue. They presented a mutual authentication protocol where no response is exposed to the adversary and can avoid the use of cryptographic algorithms and error correcting codes. The current PUF-based authentication protocol can resist internal attacks, but it is still affected by external environment, resulting in PUF function output errors. How to improve the fault tolerance rate is an urgent problem to be solved.


## 2. Preliminaries

### 2.1. Chinese Reminder Theorem [36]

It is assumed that there aren prime positive integers p1,p2,⋯,pn. Let P be the product of n prime positive integers as P=∏i=1npi and Pi=P/pi, where i=1,2,⋯n. Let Pi−1 be the modular multiplicative inverse of Pimodpi and satisfy PiPi−1≡1modpi. Then, let ai,i=1,2,⋯,n. be any n positive integers. Equation (1) has a unique general solution mod P.
(1)X≡a1modp1X≡a2modp2⋮X≡anmodpn.The general solution of Equation (1) is calculated in Equation (2).
(2)X=a1P1−1P1+a2P2−1P2+⋯+anPn−1PnmodP,=∑i=1naiPi−1PimodP,=a1+a2+⋯+anmodP.


### 2.2. Physical Unclonable Function [28]

PUF which is based on complex physical system is a functionF:C⟶R (C:0,1λ1,R:0,1λ2). The challenges and their corresponding responses are called challenge-response pairs. PUF has the following properties:
(1)
Unclonable. For all c∈C, there is no function F′ satisfying F′c=Fc. The probability of duplicating function F with a cloned function F′ in probabilistic polynomial time (PPT) is negligible(2)
Computable. It is feasible to compute ri=Fci in probabilistic polynomial time for all ci∈C(3)
Unpredictable. For all c∈C, the probability of the adversary A correctly guessing response r of the function F corresponding to challenge c in probabilistic polynomial time is negligible. The output of the function F is a random string uniformly chosen from 0,1λ1(4)
Tamper-Proofing. For all c,c′∈C, even the Hamming distance between c and c′ is equal to t (t is sufficiently small) or less; the probability of outputting the similar results is negligible. Therefore, PUF is able to resist tampering attacks


### 2.3. Fuzzy Extractor [5]

The fuzzy extractor takes a low-entropy value containing noise as inputs and outputs the same uniform random value as long as inputs values are close. The fuzzy extractor is utilized to extract the user’s biometric information and the smart device’s information. It is assumed that fuzzy extractor is composed of two algorithms defined in a tupleM,l,t.Gen(): it is a probabilistic algorithm. The user takes his/her biometrics BIOi from the metric space M as GenBIOi=σi,τi, and the algorithm outputs the biometric key σi∈0,1l and the public parameter τi.Rep(): it is a deterministic algorithm. Rep takes the biometrics BIOi′∈M, reproduction parameter τi, and t as the input (t is the fault tolerance value and sufficiently small). The algorithm Rep can reproduce the biometric key σi as RepBIOi′,τi=σi, where the Hamming distance between twice inputs is t or less.


## 2.1. Chinese Reminder Theorem [36]

It is assumed that there aren prime positive integers p1,p2,⋯,pn. Let P be the product of n prime positive integers as P=∏i=1npi and Pi=P/pi, where i=1,2,⋯n. Let Pi−1 be the modular multiplicative inverse of Pimodpi and satisfy PiPi−1≡1modpi. Then, let ai,i=1,2,⋯,n. be any n positive integers. Equation (1) has a unique general solution mod P.
(1)X≡a1modp1X≡a2modp2⋮X≡anmodpn.The general solution of Equation (1) is calculated in Equation (2).
(2)X=a1P1−1P1+a2P2−1P2+⋯+anPn−1PnmodP,=∑i=1naiPi−1PimodP,=a1+a2+⋯+anmodP.


## 2.2. Physical Unclonable Function [28]

PUF which is based on complex physical system is a functionF:C⟶R (C:0,1λ1,R:0,1λ2). The challenges and their corresponding responses are called challenge-response pairs. PUF has the following properties:
(1)
Unclonable. For all c∈C, there is no function F′ satisfying F′c=Fc. The probability of duplicating function F with a cloned function F′ in probabilistic polynomial time (PPT) is negligible(2)
Computable. It is feasible to compute ri=Fci in probabilistic polynomial time for all ci∈C(3)
Unpredictable. For all c∈C, the probability of the adversary A correctly guessing response r of the function F corresponding to challenge c in probabilistic polynomial time is negligible. The output of the function F is a random string uniformly chosen from 0,1λ1(4)
Tamper-Proofing. For all c,c′∈C, even the Hamming distance between c and c′ is equal to t (t is sufficiently small) or less; the probability of outputting the similar results is negligible. Therefore, PUF is able to resist tampering attacks


## 2.3. Fuzzy Extractor [5]

The fuzzy extractor takes a low-entropy value containing noise as inputs and outputs the same uniform random value as long as inputs values are close. The fuzzy extractor is utilized to extract the user’s biometric information and the smart device’s information. It is assumed that fuzzy extractor is composed of two algorithms defined in a tupleM,l,t.Gen(): it is a probabilistic algorithm. The user takes his/her biometrics BIOi from the metric space M as GenBIOi=σi,τi, and the algorithm outputs the biometric key σi∈0,1l and the public parameter τi.Rep(): it is a deterministic algorithm. Rep takes the biometrics BIOi′∈M, reproduction parameter τi, and t as the input (t is the fault tolerance value and sufficiently small). The algorithm Rep can reproduce the biometric key σi as RepBIOi′,τi=σi, where the Hamming distance between twice inputs is t or less.


## 3. System Model and Definitions

### 3.1. System Model

The authentication protocol in the smart home consists of the userUi, home gateway (HG), smart devices SDj, and registration center (RC). All the entities are defined as shown in Figure 1.
(i)
RC. RC is usually considered as a trusted registration center. It mainly has two functions including registering the user, HG, and smart devices and generating parameters for smart devices securely(ii)
HG. It is a trusted entity and cannot be compromised by the adversary A. It acts as the communication medium between the user and smart devices in the smart home and is responsible for reconstructing secrets for smart devices during the authentication phase(iii)
Ui. The user Ui utilizes a smartphone or other smart devices which are referred to as user equipment UEi. The user equipment has capability to extract Ui’s biometrics and verify the authenticity of Ui’s identity. Ui can access smart devices after registering at the RC(iv)
SDj. Smart devices can execute the commands and collect all kinds of information in the smart home. It is assumed that A may attain authentication credentials stored in the smart devices through side-channel attack [21]. PUF technique can be utilized to identify the smart device due to the inherent physical characteristic. All the smart devices have the PUF module which protects them from device capturing attack. Therefore, each smart device cannot be forged physically by the adversaryFigure 1
System model.


### 3.2. Threat Model

It is assumed that the adversaryA in our protocol has same capabilities as the adversary in Dolev-Yao (DY) threat model [37–39]. The capabilities of A in our protocol are enumerated as follows:
(i)
A can eavesdrop, intercept, modify, inject, and delete all the messages transmitted via the public network(ii)
A can store or resend all the messages which are intercepted or forged(iii)
A can impersonate as the legitimate user or the smart device to participate in the authentication process during the execution of the protocol(iv)
A can obtain the credentials stored in the user equipment and launch various types of attacks on the protocol. However, the group session key cannot be compromised to the adversary during the execution of the protocolIn addition, the adversaryA also has partial abilities in CK-adversary model proposed by Canetti and Krawczyk [40, 41]. Under the CK-adversary model, the reveal of ephemeral state information or other sensitive information has no influence on the security of sessions and long-term secrets. It is necessary to be guaranteed that the security of other sessions cannot be broken even though ephemeral secrets are compromised.


## 3.1. System Model

The authentication protocol in the smart home consists of the userUi, home gateway (HG), smart devices SDj, and registration center (RC). All the entities are defined as shown in Figure 1.
(i)
RC. RC is usually considered as a trusted registration center. It mainly has two functions including registering the user, HG, and smart devices and generating parameters for smart devices securely(ii)
HG. It is a trusted entity and cannot be compromised by the adversary A. It acts as the communication medium between the user and smart devices in the smart home and is responsible for reconstructing secrets for smart devices during the authentication phase(iii)
Ui. The user Ui utilizes a smartphone or other smart devices which are referred to as user equipment UEi. The user equipment has capability to extract Ui’s biometrics and verify the authenticity of Ui’s identity. Ui can access smart devices after registering at the RC(iv)
SDj. Smart devices can execute the commands and collect all kinds of information in the smart home. It is assumed that A may attain authentication credentials stored in the smart devices through side-channel attack [21]. PUF technique can be utilized to identify the smart device due to the inherent physical characteristic. All the smart devices have the PUF module which protects them from device capturing attack. Therefore, each smart device cannot be forged physically by the adversaryFigure 1
System model.


## 3.2. Threat Model

It is assumed that the adversaryA in our protocol has same capabilities as the adversary in Dolev-Yao (DY) threat model [37–39]. The capabilities of A in our protocol are enumerated as follows:
(i)
A can eavesdrop, intercept, modify, inject, and delete all the messages transmitted via the public network(ii)
A can store or resend all the messages which are intercepted or forged(iii)
A can impersonate as the legitimate user or the smart device to participate in the authentication process during the execution of the protocol(iv)
A can obtain the credentials stored in the user equipment and launch various types of attacks on the protocol. However, the group session key cannot be compromised to the adversary during the execution of the protocolIn addition, the adversaryA also has partial abilities in CK-adversary model proposed by Canetti and Krawczyk [40, 41]. Under the CK-adversary model, the reveal of ephemeral state information or other sensitive information has no influence on the security of sessions and long-term secrets. It is necessary to be guaranteed that the security of other sessions cannot be broken even though ephemeral secrets are compromised.


## 4. Our Proposed Protocol

We firstly introduce an overview of the protocol. A detailed description of the protocol is then presented in this section.


### 4.1. Overview of the Protocol

We propose a PUF-assisted lightweight group authentication and key agreement protocol in the smart home. The proposed protocol mainly includes four types of entities: RC, HG, user equipment, and smart devices.In our protocol, RC plays the role of registration center. RC is responsible for registering other devices. HG acts as an intermediate device between the user equipment and smart devices and reconstructs the secret for a group of smart devices. Each user has a smartphone or terminal equipment that can read and verify a user’s credential. During the login and authentication phase, the user sends the request to HG, and then, HG forwards the requests to a group of target smart devices. After a series of authentication, smart devices generate corresponding responses and send them to HG; HG encrypts the smart devices’ responses and forwards them to the user. The user’s shared group session key with a group of legal smart devices is securely established. Besides, the user has abilities to update personal password and biometrics locally. To resist replay attack, we assume that all the entities (i.e., users, HG, smart devices) are synchronized with the clock, and the maximum communication delay isΔT.The detailed notations and corresponding descriptions are summarized in Table1.Table 1
Notations and descriptions.
NotationsDescriptionsRCRegistration centerUi,SDj, and HGith user, jth smart device, and home gatewayUEiith user equipmentIDi, ISDj, and IDHGUi’s, SDj, and HG’s identityPWiUi’s passwordBIOiUi’s biometricsGen·, Rep·Generation and reproduction algorithm of fuzzy extractorσi,RjUi’s biometrics key, SDj’s physical keyτi,xi,hjPublic parametersTiCurrent timestampΔTMaximum communication delayKHGHG’s secret keyKiSymmetric key betweenUi and HGGSKGroup session key between the user and smart devicessSecret value utilized for secret sharingsjSDj’s secret sharePUFPhysical unclonable functionH·One-way hash function⊕,Concatenation and bit-wise XOR operation, respectively


### 4.2. Smart Device Registration Phase

The smart device registration is executed securely in the section. To prevent device capturing attack launched by the adversary, each smart device generates the physical fingerprint based on the physical unclonable function and fuzzy extractor to protect the credentials stored in its memory.


#### 4.2.1. SDRP1

The smart deviceSDj, j=1,2,⋯,n. utilizes the PUF and fuzzy extractor to extract the information to register itself. The smart device SDj firstly selects a random nonce cj and compute rj=Fcj. The digital circuits of the smart devices may be influenced by the changes in the external environment, which results in errors in the output of the PUF function. Therefore, the fuzzy extractor is utilized to reduce errors existing in the physical unclonable function. SDj computes Rj,hj=Genrj to generate secret Rj and sends Rj to RC securely.


#### 4.2.2. SDRP2

When receiving the registration request from smart deviceSDj, j∈1,2,⋯,n, RC chooses the identity ISDj for each smart device and randomly selects a polynomial fx of degree t−1: fx=a0+a1x+⋯+at−1xt−1modp, such that all the coefficients aj,j∈1,2,⋯,t−1., and s=f0 are in finite field GFp. RC computes Hs and sj=fxj (xj is public system information related to the smart device SDj). RC randomly selects a prime positive integer pj, j∈1,2,⋯,n corresponding to smart device SDj. Then, RC computes P=∏j=1npj, Pj=P/pj, j∈1,2,⋯,n., and χ=∑j=1nPjPj−1 (PjPj−1≡1modpj, χmodpj≡1). Finally, RC calculates RPj=Rj⊕pj, sharej=Rj⊕sj and sends ISDj,RPj,sharej to corresponding smart device SDj securely.


### 4.3. User Registration Phase

The userUi must register himself at RC when he wants to access the smart home remotely through HG. As shown in Figure 2, the detailed registration process is executed in the following steps.Figure 2
Summary of user registration phase.


#### 4.3.1. URP1

Ui firstly chooses an identity IDi and high entropy password PWi and imprints personal biometric information BIOi using the fuzzy extractor in user equipment UEi. UEi adopts key generation algorithm Gen· to generate corresponding biometric key σi which acts as an element of three-factor authentication and public parameter τi as GenBIOi=σi,τi. To protect the PWi and σi, UEi randomly generates a nonce a and takes personal credentials IDi,PWi,σi, and a as input to compute RPWi=HIDi∥PWi∥σi⊕a. Finally, UEi securely sends request IDi,RPWi to RC.


#### 4.3.2. URP2

When getting the requestIDi,RPWi from Ui, RC firstly generates a 1024-bit long-term secret value KHG and calculates Ki=HIDi∥KHG, TPWi=Ki⊕RPWi. Then, RC generates the anonymous identity TIDi corresponding to IDi and securely sends the information TIDi,TPWi to UEi. Finally, RC deletes the information RPWi and TPWi from its database.


#### 4.3.3. URP3

Upon receiving the responseTIDi,TPWi from RC, UEi computes Ai=HPWi∥σi∥a, Bi=HIDi∥σi⊕a, rPWi=TPWi⊕a, Vi=HHIDiσiAimodΩ. Ω is a medium integer that defines the ability to withstand online guessing attack using “fuzzy-verifier” [42]. Then, UEi stores TIDi,rPWi,Bi,Vi,τi,Gen·,Rep·,H·,t in its memory. Finally, UEi deletes TPWi,RPWi,Ai from UEi so as to prevent user equipment from compromising sensitive information.


### 4.4. Home Gateway Registration Phase

HG chooses an identityIDHG and sends the registration request to RC. Upon receiving the request from HG, RC issues a long-term secret key KHG, the user identity IDi, corresponding temporal identity TIDi, Hs, and other public parameters hj,xj,j∈1,2,⋯,n to HG securely.


### 4.5. Login and Authentication Phase

Figure3 gives the summary of login and authentication phase which could be divided into seven steps.Figure 3
Summary of login and authentication phase.


#### 4.5.1. LAP1

Ui firstly inputs IDi∗ and high entropy password PWi∗ and imprints personal biometrics BIOi∗ into UEi. UEi computes σi∗=RepBIOi∗,τi by the reproduction algorithm if the hamming distance between two biometrics is t or less. Then, UEi calculates a∗=Bi⊕HIDi∗∥σi∗, Ai∗=HPWi∗∥σi∗∥a∗, Vi∗=HHIDi∗∥σi∗∥Ai∗modΩ. UEi verifies the authenticity of the inputs IDi, PWi∗, and BIOi∗ by checking whether Vi∗ is equal to the stored Vi. After verifying the user’s identity successfully, UEi calculates symmetric key Ki=HIDi∗PWi∗σi∗⊕rPWi. UEi randomly generates a nonce ni and the current timestamp T1. UEi then calculates M1=Ki⊕ni, M2=HM1IDiTIDiniT1. UEi sends TIDi,M1,M2,T1 to HG via an open channel.


#### 4.5.2. LAP2

Upon receiving the login request, HG firstly checks the freshness of the timestampT1. If it is true, HG retrieves IDi and KHG; computes Ki∗=HIDi∥KHG=Ki, ni∗=Ki∗⊕M1, and M3=HM1IDiTIDini∗T1; and checks if M2=M3. If it is invalid, the session is terminated immediately. Then, HG randomly generates a nonce nHG and a timestamp T2 and computes mHG=nHG×χ. HG calculates M4=EncnHGIDi,IDHG,ni∗,HKi, M5=HIDinHGni∗HKiM4. Finally, HG broadcasts the message M4,M5,mHG,T2 to a group of smart devices via the open channel.


#### 4.5.3. LAP3

Upon receiving the message,SDj firstly checks the freshness of the message by timestamp T2. If it is valid, SDj calculates Fcj∗=rj∗, Rj∗=Reprj∗,hj, pj∗=RPj⊕Rj∗, sj∗=sharej⊕Rj∗, nHG∗=mHGmodpj∗ (χmodpj∗≡1, nHG∗ is called as a shared key of a group of legitimate smart devices). Then, SDj decrypts M4 as DecnHG∗M4=IDi,IDHG,ni∗,HKi using shared group key nHG∗ and computes M6=HIDi∥nHG∗∥ni∗∥HKi∥M4∥T2. Then, SDj checks whether M5=M6. If it is invalid, SDj terminates the session immediately. Otherwise, SDj generates a timestamp T3 and calculates M7j=EnHG∗sj,ISDj, M8j=Hsj∥M7j∥ISDj∥nHG∗∥T3. Finally, SDj sends message M7j,M8j,T3 to HG.


#### 4.5.4. LAP4

After receivingM7j,M8j,T3 from smart devices SDj,j∈1,2,⋯,m. HG checks the freshness of timestamp T3. If it is valid, HG can obtain sj∗,ISDj by decrypting DecnHG∗M7j=sj∗,ISDj and compute s′=∑j=1msj∗∏r=1,r≠jm−xr/xj−xr. HG also checks whether Hs′=Hs. If it is true, continues the session. Otherwise, HG computes M9j=Hsj∗∥M7j∥ISDj∥nHG∥T3 and verifies the authenticity of corresponding SDj by checking whether M8j=M9j. If it matches, the message is from valid SDj. Otherwise, HG marks SDj as invalid smart devices and terminates the session. Then, HG computes M10=HHs′∥nHG,M11=EnHGM10,M12=HM10∥M11. Finally, HG sends M11,M12 to all legitimate smart devices in the group.


#### 4.5.5. LAP5

Upon receiving the messageM11,M12, each smart device SDj firstly extracts M10∗ by decrypting the M11 using shared group key nHG∗, computes M13=HM10∗∥M11, and checks whether M12=M13. If it is valid, each SDj computes GSK=HnHG∗∥HKi∥ni∗∥IDi∥IDHG∥M10, M14=HnHG∗∥IDHG∥GSK. Finally, each SDj sends the message M14 to HG.


#### 4.5.6. LAP6

HG encrypts parameters asM15=EKi∗M10,nHG,ni∗,IDHG and generates a timestamp T4, a new anonymous identity TIDinew. HG calculates M16=HKi∗∥TIDi∥T4⊕TIDinew,M17=HM14∥M15∥ni∗∥T4. Finally, HG sends the message M15,M16,M17,T4 to UEi.


#### 4.5.7. LAP7

UEi firstly checks the freshness of timestamp T4 when receiving the message M15,M16,M17,T4. UEi then utilizes long-term secret key Ki to decrypt M15 and obtains M10∗,nHG∗,ni∗,IDHG. UEi verifies the consistency of the session by checking whether ni=ni∗. If it matches, Ui calculates GSK∗=HnHG∗∥HKi∥ni∥IDi∥IDHG∥M10∗,M18=HnHG∗∥IDHG∥GSK∗,M19=HM18∥M15∥ni∥T4. UEi checks if M17=M19. If it matches, the group session key is established successfully. Finally, UEi replaces temporal identity as TIDinew=HKi∗∥TIDi∥T4⊕M16.


### 4.6. Biometrics and Password Update Phase

In this section,Ui can update the password and biometrics in the following steps.


#### 4.6.1. BPUP1

Ui provides personal credentials IDi, PWiold, and BIOiold to UEi. UEi computes biometrics key σiold as GenBIOiold=σiold,τiold and calculates Diold=HIDi∥σiold, a∗=Bi⊕Diold, Aiold=HPWiold∥σiold∥a∗, and Viold=HDiold∥AioldmodΩ. UEi validates the authenticity of Ui by checking whether Viold=Vi. If it matches, the user Ui can update personal password and biometrics. Otherwise, UEi terminates the update phase.


#### 4.6.2. BPUP2

Ui enters new password PWinew and imprints biometrics BIOinew into the user equipment UEi. UEi computes σinew as GenBIOinew=σinew,τinew and calculates Dinew=HIDi∥σinew, Binew=Bi⊕Diold⊕Dinew, Ainew=HPWinew∥σinew∥a∗, rPWinew=rPWi⊕HIDi∥PWiold∥σiold⊕HIDi∥PWinew∥σinew, and Vinew=HDinew∥AinewmodΩ. Finally, UEi replaces Bi,Vi,rPWi, and τiold with Binew,Vinew,rPWinew, and τinew without the help of RC, respectively.


### 4.7. Dynamic Smart Devices Joining and Revoking Phase

Some new smart devices may be added to the smart home after the initial deployment or some deployed smart devices may leave the smart home for some reasons. Therefore, to revoke the defunct device or add the new device into the smart home, it is necessary to update the status of smart devices in real-time. The detailed joining and leaving process is executed in the following steps.


#### 4.7.1. Joining

When joining the smart home, a new smart deviceSDjnew must firstly register itself as RC. SDjnew randomly chooses a challenge value cjnew and generates its physical fingerprint Rjnew based on PUF and fuzzy extractor technique. Then, a new smart device sends Rjnew to RC securely. RC generates a unique identity ISDjnew and legitimate share sjnew,pjnew and computes Varjnew. Then, RC adds Varjnew=PjPj−1 to χ as χnew=χ+Varjnew. During the execution of authentication and key agreement phase, only the legitimate smart devices can calculate secret nHGnew as mHGnewmodsjnew=nHGnewmHGnew=nHGnew×χnew,χnewmodpjnew≡1,nHGnew<pjnew. Finally, the new smart devices can be accessed by user Ui.


#### 4.7.2. Revoking

To protect the session security, HG should update the status of smart devices. A smart device that wants to leave the group or is marked as an illegal device will be revoked by HG. The HG subtracts correspondingVarjrevoking from χ as χnew=χ−Varjrevoking. The HG generates a new temporal secret and broadcasts it to a group of smart devices. The revoked smart device will fail to compute secret and decrypt the message due to the update of χnew.


## 4.1. Overview of the Protocol

We propose a PUF-assisted lightweight group authentication and key agreement protocol in the smart home. The proposed protocol mainly includes four types of entities: RC, HG, user equipment, and smart devices.In our protocol, RC plays the role of registration center. RC is responsible for registering other devices. HG acts as an intermediate device between the user equipment and smart devices and reconstructs the secret for a group of smart devices. Each user has a smartphone or terminal equipment that can read and verify a user’s credential. During the login and authentication phase, the user sends the request to HG, and then, HG forwards the requests to a group of target smart devices. After a series of authentication, smart devices generate corresponding responses and send them to HG; HG encrypts the smart devices’ responses and forwards them to the user. The user’s shared group session key with a group of legal smart devices is securely established. Besides, the user has abilities to update personal password and biometrics locally. To resist replay attack, we assume that all the entities (i.e., users, HG, smart devices) are synchronized with the clock, and the maximum communication delay isΔT.The detailed notations and corresponding descriptions are summarized in Table1.Table 1
Notations and descriptions.
NotationsDescriptionsRCRegistration centerUi,SDj, and HGith user, jth smart device, and home gatewayUEiith user equipmentIDi, ISDj, and IDHGUi’s, SDj, and HG’s identityPWiUi’s passwordBIOiUi’s biometricsGen·, Rep·Generation and reproduction algorithm of fuzzy extractorσi,RjUi’s biometrics key, SDj’s physical keyτi,xi,hjPublic parametersTiCurrent timestampΔTMaximum communication delayKHGHG’s secret keyKiSymmetric key betweenUi and HGGSKGroup session key between the user and smart devicessSecret value utilized for secret sharingsjSDj’s secret sharePUFPhysical unclonable functionH·One-way hash function⊕,Concatenation and bit-wise XOR operation, respectively


## 4.2. Smart Device Registration Phase

The smart device registration is executed securely in the section. To prevent device capturing attack launched by the adversary, each smart device generates the physical fingerprint based on the physical unclonable function and fuzzy extractor to protect the credentials stored in its memory.


### 4.2.1. SDRP1

The smart deviceSDj, j=1,2,⋯,n. utilizes the PUF and fuzzy extractor to extract the information to register itself. The smart device SDj firstly selects a random nonce cj and compute rj=Fcj. The digital circuits of the smart devices may be influenced by the changes in the external environment, which results in errors in the output of the PUF function. Therefore, the fuzzy extractor is utilized to reduce errors existing in the physical unclonable function. SDj computes Rj,hj=Genrj to generate secret Rj and sends Rj to RC securely.


### 4.2.2. SDRP2

When receiving the registration request from smart deviceSDj, j∈1,2,⋯,n, RC chooses the identity ISDj for each smart device and randomly selects a polynomial fx of degree t−1: fx=a0+a1x+⋯+at−1xt−1modp, such that all the coefficients aj,j∈1,2,⋯,t−1., and s=f0 are in finite field GFp. RC computes Hs and sj=fxj (xj is public system information related to the smart device SDj). RC randomly selects a prime positive integer pj, j∈1,2,⋯,n corresponding to smart device SDj. Then, RC computes P=∏j=1npj, Pj=P/pj, j∈1,2,⋯,n., and χ=∑j=1nPjPj−1 (PjPj−1≡1modpj, χmodpj≡1). Finally, RC calculates RPj=Rj⊕pj, sharej=Rj⊕sj and sends ISDj,RPj,sharej to corresponding smart device SDj securely.


## 4.2.1. SDRP1

The smart deviceSDj, j=1,2,⋯,n. utilizes the PUF and fuzzy extractor to extract the information to register itself. The smart device SDj firstly selects a random nonce cj and compute rj=Fcj. The digital circuits of the smart devices may be influenced by the changes in the external environment, which results in errors in the output of the PUF function. Therefore, the fuzzy extractor is utilized to reduce errors existing in the physical unclonable function. SDj computes Rj,hj=Genrj to generate secret Rj and sends Rj to RC securely.


## 4.2.2. SDRP2

When receiving the registration request from smart deviceSDj, j∈1,2,⋯,n, RC chooses the identity ISDj for each smart device and randomly selects a polynomial fx of degree t−1: fx=a0+a1x+⋯+at−1xt−1modp, such that all the coefficients aj,j∈1,2,⋯,t−1., and s=f0 are in finite field GFp. RC computes Hs and sj=fxj (xj is public system information related to the smart device SDj). RC randomly selects a prime positive integer pj, j∈1,2,⋯,n corresponding to smart device SDj. Then, RC computes P=∏j=1npj, Pj=P/pj, j∈1,2,⋯,n., and χ=∑j=1nPjPj−1 (PjPj−1≡1modpj, χmodpj≡1). Finally, RC calculates RPj=Rj⊕pj, sharej=Rj⊕sj and sends ISDj,RPj,sharej to corresponding smart device SDj securely.


## 4.3. User Registration Phase

The userUi must register himself at RC when he wants to access the smart home remotely through HG. As shown in Figure 2, the detailed registration process is executed in the following steps.Figure 2
Summary of user registration phase.


### 4.3.1. URP1

Ui firstly chooses an identity IDi and high entropy password PWi and imprints personal biometric information BIOi using the fuzzy extractor in user equipment UEi. UEi adopts key generation algorithm Gen· to generate corresponding biometric key σi which acts as an element of three-factor authentication and public parameter τi as GenBIOi=σi,τi. To protect the PWi and σi, UEi randomly generates a nonce a and takes personal credentials IDi,PWi,σi, and a as input to compute RPWi=HIDi∥PWi∥σi⊕a. Finally, UEi securely sends request IDi,RPWi to RC.


### 4.3.2. URP2

When getting the requestIDi,RPWi from Ui, RC firstly generates a 1024-bit long-term secret value KHG and calculates Ki=HIDi∥KHG, TPWi=Ki⊕RPWi. Then, RC generates the anonymous identity TIDi corresponding to IDi and securely sends the information TIDi,TPWi to UEi. Finally, RC deletes the information RPWi and TPWi from its database.


### 4.3.3. URP3

Upon receiving the responseTIDi,TPWi from RC, UEi computes Ai=HPWi∥σi∥a, Bi=HIDi∥σi⊕a, rPWi=TPWi⊕a, Vi=HHIDiσiAimodΩ. Ω is a medium integer that defines the ability to withstand online guessing attack using “fuzzy-verifier” [42]. Then, UEi stores TIDi,rPWi,Bi,Vi,τi,Gen·,Rep·,H·,t in its memory. Finally, UEi deletes TPWi,RPWi,Ai from UEi so as to prevent user equipment from compromising sensitive information.


## 4.3.1. URP1

Ui firstly chooses an identity IDi and high entropy password PWi and imprints personal biometric information BIOi using the fuzzy extractor in user equipment UEi. UEi adopts key generation algorithm Gen· to generate corresponding biometric key σi which acts as an element of three-factor authentication and public parameter τi as GenBIOi=σi,τi. To protect the PWi and σi, UEi randomly generates a nonce a and takes personal credentials IDi,PWi,σi, and a as input to compute RPWi=HIDi∥PWi∥σi⊕a. Finally, UEi securely sends request IDi,RPWi to RC.


## 4.3.2. URP2

When getting the requestIDi,RPWi from Ui, RC firstly generates a 1024-bit long-term secret value KHG and calculates Ki=HIDi∥KHG, TPWi=Ki⊕RPWi. Then, RC generates the anonymous identity TIDi corresponding to IDi and securely sends the information TIDi,TPWi to UEi. Finally, RC deletes the information RPWi and TPWi from its database.


## 4.3.3. URP3

Upon receiving the responseTIDi,TPWi from RC, UEi computes Ai=HPWi∥σi∥a, Bi=HIDi∥σi⊕a, rPWi=TPWi⊕a, Vi=HHIDiσiAimodΩ. Ω is a medium integer that defines the ability to withstand online guessing attack using “fuzzy-verifier” [42]. Then, UEi stores TIDi,rPWi,Bi,Vi,τi,Gen·,Rep·,H·,t in its memory. Finally, UEi deletes TPWi,RPWi,Ai from UEi so as to prevent user equipment from compromising sensitive information.


## 4.4. Home Gateway Registration Phase

HG chooses an identityIDHG and sends the registration request to RC. Upon receiving the request from HG, RC issues a long-term secret key KHG, the user identity IDi, corresponding temporal identity TIDi, Hs, and other public parameters hj,xj,j∈1,2,⋯,n to HG securely.


## 4.5. Login and Authentication Phase

Figure3 gives the summary of login and authentication phase which could be divided into seven steps.Figure 3
Summary of login and authentication phase.


### 4.5.1. LAP1

Ui firstly inputs IDi∗ and high entropy password PWi∗ and imprints personal biometrics BIOi∗ into UEi. UEi computes σi∗=RepBIOi∗,τi by the reproduction algorithm if the hamming distance between two biometrics is t or less. Then, UEi calculates a∗=Bi⊕HIDi∗∥σi∗, Ai∗=HPWi∗∥σi∗∥a∗, Vi∗=HHIDi∗∥σi∗∥Ai∗modΩ. UEi verifies the authenticity of the inputs IDi, PWi∗, and BIOi∗ by checking whether Vi∗ is equal to the stored Vi. After verifying the user’s identity successfully, UEi calculates symmetric key Ki=HIDi∗PWi∗σi∗⊕rPWi. UEi randomly generates a nonce ni and the current timestamp T1. UEi then calculates M1=Ki⊕ni, M2=HM1IDiTIDiniT1. UEi sends TIDi,M1,M2,T1 to HG via an open channel.


### 4.5.2. LAP2

Upon receiving the login request, HG firstly checks the freshness of the timestampT1. If it is true, HG retrieves IDi and KHG; computes Ki∗=HIDi∥KHG=Ki, ni∗=Ki∗⊕M1, and M3=HM1IDiTIDini∗T1; and checks if M2=M3. If it is invalid, the session is terminated immediately. Then, HG randomly generates a nonce nHG and a timestamp T2 and computes mHG=nHG×χ. HG calculates M4=EncnHGIDi,IDHG,ni∗,HKi, M5=HIDinHGni∗HKiM4. Finally, HG broadcasts the message M4,M5,mHG,T2 to a group of smart devices via the open channel.


### 4.5.3. LAP3

Upon receiving the message,SDj firstly checks the freshness of the message by timestamp T2. If it is valid, SDj calculates Fcj∗=rj∗, Rj∗=Reprj∗,hj, pj∗=RPj⊕Rj∗, sj∗=sharej⊕Rj∗, nHG∗=mHGmodpj∗ (χmodpj∗≡1, nHG∗ is called as a shared key of a group of legitimate smart devices). Then, SDj decrypts M4 as DecnHG∗M4=IDi,IDHG,ni∗,HKi using shared group key nHG∗ and computes M6=HIDi∥nHG∗∥ni∗∥HKi∥M4∥T2. Then, SDj checks whether M5=M6. If it is invalid, SDj terminates the session immediately. Otherwise, SDj generates a timestamp T3 and calculates M7j=EnHG∗sj,ISDj, M8j=Hsj∥M7j∥ISDj∥nHG∗∥T3. Finally, SDj sends message M7j,M8j,T3 to HG.


### 4.5.4. LAP4

After receivingM7j,M8j,T3 from smart devices SDj,j∈1,2,⋯,m. HG checks the freshness of timestamp T3. If it is valid, HG can obtain sj∗,ISDj by decrypting DecnHG∗M7j=sj∗,ISDj and compute s′=∑j=1msj∗∏r=1,r≠jm−xr/xj−xr. HG also checks whether Hs′=Hs. If it is true, continues the session. Otherwise, HG computes M9j=Hsj∗∥M7j∥ISDj∥nHG∥T3 and verifies the authenticity of corresponding SDj by checking whether M8j=M9j. If it matches, the message is from valid SDj. Otherwise, HG marks SDj as invalid smart devices and terminates the session. Then, HG computes M10=HHs′∥nHG,M11=EnHGM10,M12=HM10∥M11. Finally, HG sends M11,M12 to all legitimate smart devices in the group.


### 4.5.5. LAP5

Upon receiving the messageM11,M12, each smart device SDj firstly extracts M10∗ by decrypting the M11 using shared group key nHG∗, computes M13=HM10∗∥M11, and checks whether M12=M13. If it is valid, each SDj computes GSK=HnHG∗∥HKi∥ni∗∥IDi∥IDHG∥M10, M14=HnHG∗∥IDHG∥GSK. Finally, each SDj sends the message M14 to HG.


### 4.5.6. LAP6

HG encrypts parameters asM15=EKi∗M10,nHG,ni∗,IDHG and generates a timestamp T4, a new anonymous identity TIDinew. HG calculates M16=HKi∗∥TIDi∥T4⊕TIDinew,M17=HM14∥M15∥ni∗∥T4. Finally, HG sends the message M15,M16,M17,T4 to UEi.


### 4.5.7. LAP7

UEi firstly checks the freshness of timestamp T4 when receiving the message M15,M16,M17,T4. UEi then utilizes long-term secret key Ki to decrypt M15 and obtains M10∗,nHG∗,ni∗,IDHG. UEi verifies the consistency of the session by checking whether ni=ni∗. If it matches, Ui calculates GSK∗=HnHG∗∥HKi∥ni∥IDi∥IDHG∥M10∗,M18=HnHG∗∥IDHG∥GSK∗,M19=HM18∥M15∥ni∥T4. UEi checks if M17=M19. If it matches, the group session key is established successfully. Finally, UEi replaces temporal identity as TIDinew=HKi∗∥TIDi∥T4⊕M16.


## 4.5.1. LAP1

Ui firstly inputs IDi∗ and high entropy password PWi∗ and imprints personal biometrics BIOi∗ into UEi. UEi computes σi∗=RepBIOi∗,τi by the reproduction algorithm if the hamming distance between two biometrics is t or less. Then, UEi calculates a∗=Bi⊕HIDi∗∥σi∗, Ai∗=HPWi∗∥σi∗∥a∗, Vi∗=HHIDi∗∥σi∗∥Ai∗modΩ. UEi verifies the authenticity of the inputs IDi, PWi∗, and BIOi∗ by checking whether Vi∗ is equal to the stored Vi. After verifying the user’s identity successfully, UEi calculates symmetric key Ki=HIDi∗PWi∗σi∗⊕rPWi. UEi randomly generates a nonce ni and the current timestamp T1. UEi then calculates M1=Ki⊕ni, M2=HM1IDiTIDiniT1. UEi sends TIDi,M1,M2,T1 to HG via an open channel.


## 4.5.2. LAP2

Upon receiving the login request, HG firstly checks the freshness of the timestampT1. If it is true, HG retrieves IDi and KHG; computes Ki∗=HIDi∥KHG=Ki, ni∗=Ki∗⊕M1, and M3=HM1IDiTIDini∗T1; and checks if M2=M3. If it is invalid, the session is terminated immediately. Then, HG randomly generates a nonce nHG and a timestamp T2 and computes mHG=nHG×χ. HG calculates M4=EncnHGIDi,IDHG,ni∗,HKi, M5=HIDinHGni∗HKiM4. Finally, HG broadcasts the message M4,M5,mHG,T2 to a group of smart devices via the open channel.


## 4.5.3. LAP3

Upon receiving the message,SDj firstly checks the freshness of the message by timestamp T2. If it is valid, SDj calculates Fcj∗=rj∗, Rj∗=Reprj∗,hj, pj∗=RPj⊕Rj∗, sj∗=sharej⊕Rj∗, nHG∗=mHGmodpj∗ (χmodpj∗≡1, nHG∗ is called as a shared key of a group of legitimate smart devices). Then, SDj decrypts M4 as DecnHG∗M4=IDi,IDHG,ni∗,HKi using shared group key nHG∗ and computes M6=HIDi∥nHG∗∥ni∗∥HKi∥M4∥T2. Then, SDj checks whether M5=M6. If it is invalid, SDj terminates the session immediately. Otherwise, SDj generates a timestamp T3 and calculates M7j=EnHG∗sj,ISDj, M8j=Hsj∥M7j∥ISDj∥nHG∗∥T3. Finally, SDj sends message M7j,M8j,T3 to HG.


## 4.5.4. LAP4

After receivingM7j,M8j,T3 from smart devices SDj,j∈1,2,⋯,m. HG checks the freshness of timestamp T3. If it is valid, HG can obtain sj∗,ISDj by decrypting DecnHG∗M7j=sj∗,ISDj and compute s′=∑j=1msj∗∏r=1,r≠jm−xr/xj−xr. HG also checks whether Hs′=Hs. If it is true, continues the session. Otherwise, HG computes M9j=Hsj∗∥M7j∥ISDj∥nHG∥T3 and verifies the authenticity of corresponding SDj by checking whether M8j=M9j. If it matches, the message is from valid SDj. Otherwise, HG marks SDj as invalid smart devices and terminates the session. Then, HG computes M10=HHs′∥nHG,M11=EnHGM10,M12=HM10∥M11. Finally, HG sends M11,M12 to all legitimate smart devices in the group.


## 4.5.5. LAP5

Upon receiving the messageM11,M12, each smart device SDj firstly extracts M10∗ by decrypting the M11 using shared group key nHG∗, computes M13=HM10∗∥M11, and checks whether M12=M13. If it is valid, each SDj computes GSK=HnHG∗∥HKi∥ni∗∥IDi∥IDHG∥M10, M14=HnHG∗∥IDHG∥GSK. Finally, each SDj sends the message M14 to HG.


## 4.5.6. LAP6

HG encrypts parameters asM15=EKi∗M10,nHG,ni∗,IDHG and generates a timestamp T4, a new anonymous identity TIDinew. HG calculates M16=HKi∗∥TIDi∥T4⊕TIDinew,M17=HM14∥M15∥ni∗∥T4. Finally, HG sends the message M15,M16,M17,T4 to UEi.


## 4.5.7. LAP7

UEi firstly checks the freshness of timestamp T4 when receiving the message M15,M16,M17,T4. UEi then utilizes long-term secret key Ki to decrypt M15 and obtains M10∗,nHG∗,ni∗,IDHG. UEi verifies the consistency of the session by checking whether ni=ni∗. If it matches, Ui calculates GSK∗=HnHG∗∥HKi∥ni∥IDi∥IDHG∥M10∗,M18=HnHG∗∥IDHG∥GSK∗,M19=HM18∥M15∥ni∥T4. UEi checks if M17=M19. If it matches, the group session key is established successfully. Finally, UEi replaces temporal identity as TIDinew=HKi∗∥TIDi∥T4⊕M16.


## 4.6. Biometrics and Password Update Phase

In this section,Ui can update the password and biometrics in the following steps.


### 4.6.1. BPUP1

Ui provides personal credentials IDi, PWiold, and BIOiold to UEi. UEi computes biometrics key σiold as GenBIOiold=σiold,τiold and calculates Diold=HIDi∥σiold, a∗=Bi⊕Diold, Aiold=HPWiold∥σiold∥a∗, and Viold=HDiold∥AioldmodΩ. UEi validates the authenticity of Ui by checking whether Viold=Vi. If it matches, the user Ui can update personal password and biometrics. Otherwise, UEi terminates the update phase.


### 4.6.2. BPUP2

Ui enters new password PWinew and imprints biometrics BIOinew into the user equipment UEi. UEi computes σinew as GenBIOinew=σinew,τinew and calculates Dinew=HIDi∥σinew, Binew=Bi⊕Diold⊕Dinew, Ainew=HPWinew∥σinew∥a∗, rPWinew=rPWi⊕HIDi∥PWiold∥σiold⊕HIDi∥PWinew∥σinew, and Vinew=HDinew∥AinewmodΩ. Finally, UEi replaces Bi,Vi,rPWi, and τiold with Binew,Vinew,rPWinew, and τinew without the help of RC, respectively.


## 4.6.1. BPUP1

Ui provides personal credentials IDi, PWiold, and BIOiold to UEi. UEi computes biometrics key σiold as GenBIOiold=σiold,τiold and calculates Diold=HIDi∥σiold, a∗=Bi⊕Diold, Aiold=HPWiold∥σiold∥a∗, and Viold=HDiold∥AioldmodΩ. UEi validates the authenticity of Ui by checking whether Viold=Vi. If it matches, the user Ui can update personal password and biometrics. Otherwise, UEi terminates the update phase.


## 4.6.2. BPUP2

Ui enters new password PWinew and imprints biometrics BIOinew into the user equipment UEi. UEi computes σinew as GenBIOinew=σinew,τinew and calculates Dinew=HIDi∥σinew, Binew=Bi⊕Diold⊕Dinew, Ainew=HPWinew∥σinew∥a∗, rPWinew=rPWi⊕HIDi∥PWiold∥σiold⊕HIDi∥PWinew∥σinew, and Vinew=HDinew∥AinewmodΩ. Finally, UEi replaces Bi,Vi,rPWi, and τiold with Binew,Vinew,rPWinew, and τinew without the help of RC, respectively.


## 4.7. Dynamic Smart Devices Joining and Revoking Phase

Some new smart devices may be added to the smart home after the initial deployment or some deployed smart devices may leave the smart home for some reasons. Therefore, to revoke the defunct device or add the new device into the smart home, it is necessary to update the status of smart devices in real-time. The detailed joining and leaving process is executed in the following steps.


### 4.7.1. Joining

When joining the smart home, a new smart deviceSDjnew must firstly register itself as RC. SDjnew randomly chooses a challenge value cjnew and generates its physical fingerprint Rjnew based on PUF and fuzzy extractor technique. Then, a new smart device sends Rjnew to RC securely. RC generates a unique identity ISDjnew and legitimate share sjnew,pjnew and computes Varjnew. Then, RC adds Varjnew=PjPj−1 to χ as χnew=χ+Varjnew. During the execution of authentication and key agreement phase, only the legitimate smart devices can calculate secret nHGnew as mHGnewmodsjnew=nHGnewmHGnew=nHGnew×χnew,χnewmodpjnew≡1,nHGnew<pjnew. Finally, the new smart devices can be accessed by user Ui.


### 4.7.2. Revoking

To protect the session security, HG should update the status of smart devices. A smart device that wants to leave the group or is marked as an illegal device will be revoked by HG. The HG subtracts correspondingVarjrevoking from χ as χnew=χ−Varjrevoking. The HG generates a new temporal secret and broadcasts it to a group of smart devices. The revoked smart device will fail to compute secret and decrypt the message due to the update of χnew.


## 4.7.1. Joining

When joining the smart home, a new smart deviceSDjnew must firstly register itself as RC. SDjnew randomly chooses a challenge value cjnew and generates its physical fingerprint Rjnew based on PUF and fuzzy extractor technique. Then, a new smart device sends Rjnew to RC securely. RC generates a unique identity ISDjnew and legitimate share sjnew,pjnew and computes Varjnew. Then, RC adds Varjnew=PjPj−1 to χ as χnew=χ+Varjnew. During the execution of authentication and key agreement phase, only the legitimate smart devices can calculate secret nHGnew as mHGnewmodsjnew=nHGnewmHGnew=nHGnew×χnew,χnewmodpjnew≡1,nHGnew<pjnew. Finally, the new smart devices can be accessed by user Ui.


## 4.7.2. Revoking

To protect the session security, HG should update the status of smart devices. A smart device that wants to leave the group or is marked as an illegal device will be revoked by HG. The HG subtracts correspondingVarjrevoking from χ as χnew=χ−Varjrevoking. The HG generates a new temporal secret and broadcasts it to a group of smart devices. The revoked smart device will fail to compute secret and decrypt the message due to the update of χnew.


## 5. Security Analysis

The widespread Real-or-Random (ROR) model proposed by Abdalla et al. [13] is adopted to establish our security model in this section.


### 5.1. Formal Security Analysis

(1)
Participants. Let ∏Uiu, ∏SDjv, and ∏HGt represent instances u, v, and t of participant Ui, SDj, and HG, respectively(2)
Partnering. If the following conditions are satisfied, the instances ∏Uiu and ∏SDjv are said to be partners [37].
(i)
Both instances∏Uiu and ∏SDjv are accepted(ii)
Both instances∏Uiu and ∏SDjv authenticate each other(iii)
The instance∏Uiu and the instance ∏SDjv are only partners each other(3)
Freshness. The instance ∏Uiu or ∏SDjv is fresh if the session key SK is not compromised to A(4)
Adversary. A has all the capabilities as the adversary in Dolev-Yao (DY) threat model [37–39] and also has some capabilities defined in CK-adversary model [40, 41]. Moreover, A can make queries as Execute∏u,∏v, Reveal∏, Send∏,m, CorruptUserEquipment∏Uit, CorruptSmartDevice∏SDjt, and Test∏ to challenger to obtain the sensitive information. These queries are utilized to construct a series of games. After games, A guesses a bit b′ and wins the game only if b′=b. Succ represents that A wins the game. The advantage of A in breaking the IND-CPA of our protocol P in probabilistic polynomial time is AdvP,AIND−CCAK=2·PrSucc−1. The proposed protocol P is secure under the ROR model when AdvP,AIND−CPAK is negligibleTheorem 1.
LetA be the adversary running in the polynomial time t against our authentication protocol P in the random oracle. Let Dic, qh, qsend, qe, Hash, Dic, m, and lr represent the a uniformly distributed password dictionary, the number of Hash oracles, the number of Send oracle, the number of Execute oracles, the space of hash function, the size of Dic, the bit length of biometrics key σi, and the bit length of the random nonce, respectively. The advantage of A in breaking protocol P in probabilistic polynomial time is defined as follows:
(3)AdvP,AAKAK≤qh2Hash+qsend+qe22lr+2maxqsend2m,C′·qsends′+2q·AdvP,AIND−CPAK.Proof.
The gamesGamei, where i=0,4 is defined in this section. Let Succi represent the event that A succeeds in guessing b in the Gamei.
Game0: the game Game0 simulates the real attack in our protocol by A in ROR sense. At the beginning of Game0, A guesses b. By definition, it follows
(4)AdvP,AAKAK=2PrSucc0−1.
Game1: the game Game1 simulates the adversary’s eavesdropping attack by asking Execute∏,∏ oracle. At the end of the game, A queries Test oracle and then distinguishes whether the output of Test oracle is either a real session key SK or a random string in the same domain. The group session key is calculated as GSK=HnHG∥HKi∥ni∥IDi∥IDHG∥HHs∥nHG in our protocol. To calculate the GSK, A has to obtain HKi and HHs∥nHG. Additionally, IDi,IDHG,ni, and nHG are not compromised to A. Therefore, the probability of winning Game1 for A is not increased by launching eavesdropping attacks. It is clear that
(5)PrSucc0=PrSucc1.
Game2: there exists some differences between Game2 and Game1; the simulations of Send and Hash oracles are added to the Game2. The game simulates an active attack in which A tries to fool the participant into accepting the forged messages. A is able to query Hash oracle many times to find collisions. Since all the exchanged messages are associated with participant’s identity, random nonce, and timestamps, the probability of finding the collision of secret key for symmetric cryptography is qh2/2·Hash according to the birthday paradox. Besides, the probability of finding the collision of random nonce is defined as qsend+qe2/2lr+1. It is clear that
(6)PrSucc1−PrSucc2≤qh22·Hash+qsend+qe22lr+1.
Game3: by adding the simulation of querying the CorruptSmartPhone oracle and smartphone lost attack, the Game2 is transformed into Game3. A may obtain password PWi and the biometrics key σi using online, offline dictionary attack, and physical device attack, respectively. The fuzzy extractor is utilized to extract the b bits of biometric information, and the probability of guessing the σi∈0,1m for A is approximately 1/2m. Additionally, it is supposed that the number of password inputs is strictly limited. The user-chosen passwords tend to be low entropy and are far different distribution from uniform distribution. The size of the password space is limited in practical, and users usually only use a part of the password space. The probability of guessing the password is defined as C′·qsends′ [43]; C′ and s′ are the parameters of the Zipf model. Therefore, it is clear that
(7)PrSucc2−PrSucc3≤maxqsend2m,C′·qsends′.
Game4: this game adds the simulation of CorruptSmartDevice oracle compared to Game3. A can physically capture the smart devices and obtain the information prestored into the memory of smart device in the registration phase. However, this information is encrypted by the physical fingerprint Rj based on PUF and fuzzy extractor technique. It is hard to obtain the secret share sj and forge the device even if A grabs the device. Let A can eavesdrop all the exchanged messages. A tries to obtain the sensitive information IDi,IDHG,ni,M10,HKi by decrypting the message M4. Due to the Chinese Remainder Theorem, any illegitimate participant is unable to obtain the temporary group key nHG and HKi without the secret share sj. Even if A wants to reconstruct secret, it is hard for A to capture at least t legal smart devices. The probability of forging the appropriate pair of values is 1/q. Additionally, it is difficult for A to decrypt the M15 as A is unknown to Ki. A can not compute GSK=HnHG∥HKi∥ni∥IDi∥IDHG∥HHs∥nHG due to the lacking of HHs∥nHG and HKi. The proposed protocol is IND−CPA secure. It is concluded that
(8)PrSucc3−PrSucc4≤1q·AdvP,AIND−CPAK.
All the oracles have been simulated in the game.A guesses b after querying Test oracle. It is clear that PrSucc4=1/2.
Therefore, from formulas (4) to (8), we have
(9)AdvP,AAKAK=2·PrSucc0−12=2·PrSucc1−PrSucc4≤2·PrSucc1−PrSucc2+PrSucc2−PrSucc4≤2·PrSucc1−PrSucc2+PrSucc2−PrSucc3+PrSucc3−PrSucc4≤2·qh22·Hash+qsend+qe22lr+1+maxqsend2m,C′·qsends′+1q·AdvP,AIND−CPAK≤qh2Hash+qsend+qe22lr+2maxqsend2m,C′·qsends′+2q·AdvP,AIND−CPAK.


### 5.2. Other Discussions on Security Features

#### 5.2.1. Untraceability and User Anonymity

It is assumed thatA has capability of intercepting all the messages during the execution of the authentication phase over the public channel. The user’s identity IDi is protected by hash function H· and symmetric cryptography. It is computationally infeasible for A to attain identity without secret parameters nHG,ni,Vi,σi. Therefore, our protocol guarantees the feature of user anonymity. Moreover, the transmitted message generally involves the current timestamp and random nonce, and Ui temporary identity TIDi is updated when the session is completed successfully. Therefore, it is also computationally infeasible for A to track the user’s activity in each session. In conclusion, the untraceability and user anonymity are both guaranteed in our protocol.


#### 5.2.2. Replay Attack

It is assumed thatA is capable of intercepting all the messages between the user, HG, and smart devices. The transmitted messages usually involve random nonces and timestamps. Even if A intercepts the messages and replays these messages shortly after, they can not pass the verification of timestamps due to maximum communication delay ΔT. Thus, our protocol can resist replay attack.


#### 5.2.3. Smart Device Impersonation Attack

It is supposed thatA intercepts the transmitted message during the execution of the protocol. A needs to generate valid information. However, A does not know the sensitive parameters to obtain the authentication parameters. Furthermore, the smart device is protected by PUF, which cannot be forged on hardware. It is computationally infeasible to impersonate the smart device in probabilistic polynomial time. Therefore, our protocol can withstand smart device impersonation attack.


#### 5.2.4. HG Impersonation Attack

It is supposed thatA intercepts the message during the execution of the protocol and tries to generate other messages to impersonate HG. However, without the knowledge of the secret parameters χ,ni,IDi,KHG, it is computationally infeasible to impersonate HG in probabilistic polynomial time. Thus, our protocol can withstand HG impersonation attack.


#### 5.2.5. Smartphone Lost Attack

Supposed that theUi’s smartphone is lost or stolen by A. By the threat model, A is capable of extracting all the information TIDi,rPWi,Bi,Vi,τi,Gen·,Rep·,H·,t stored in the memory of UEi using the power analysis attack [44]. In order to retrieve IDi,PWi from the extracted information A needs to attain the secrets Ki,σi,ni. The possibility of guessing the user’s biometrics key σi as well as ni,Ki is negligible. The adversary A may launch the password guessing attack. The password guessing attack is mainly divided into online and offline password guessing attack [45]. The online password guessing attack can be effectively prevented by limiting the number of illegal requests from users. In our paper, the “fuzzy verifier” is utilized to guarantee the security under offline password guessing attack. The password verifier Vi is computed Vi=HHIDiσiHPWiσiamodΩ. Even if other two authentication factors are compromised, the adversary A has to guess IDi, PWi, and a. Furthermore, it is assumed that A has got the IDi∗, PWi∗, and a∗ which satisfying Vi=Vi∗; the login request will be rejected due to the “fuzzy verifier.” Therefore, our protocol can effectively withstand online and offline guessing attack. The user’s identity credentials IDi,PWi are not compromised to A. So, our protocol can resist smartphone lost attack.


#### 5.2.6. Privileged-Insider Attack

It is assumed thatA is a privileged-insider user of trusted RC. A tries to attain the credentials of the authorized user and all the information from UEi. A obtains the registration information IDi,RPWi of Ui which is sent to RC. Meanwhile, A is able to extract all the information TIDi,rPWi,Bi,Vi,τi,Gen·,Rep·,H·,t stored in the UEi. Without knowing of random nonce a and biometrics key σi, it is computationally infeasible to retrieve PWi in probabilistic polynomial time due to RPWi=HIDi∥PWi∥σi. Thus, our protocol can withstand privileged-insider attack.


#### 5.2.7. Ephemeral Secret Leakage Attack

In our protocol, a secure group session keyGSK∗=HnHG∗∥HKi∥ni∥IDi∥IDHG∥M10 is established between a user and smart devices during the login and authentication phase. M10 is composed of long-term secret Hs and short-term secret nHG. In particular, the secret s is computed by secret reconstruction algorithm of secret sharing technology. In addition, IDHG,IDi,HKi are the long-term secrets, and ni is a short-term secret. On the one hand, it is assumed that the short-term secrets nHG,ni are revealed to A. However, it is computationally infeasible to compute the GSK due to the lack of long-term secrets. On the other hand, it is assumed that A can obtain the long-term secrets. Even though A obtains some secret shares sj from the smart devices, it is computationally infeasible to construct the secret S and then calculate the message M10. The short-term secrets nHG,ni are randomly generated by the HG and Ui. It is also hard for A to compute GSK without the short-term secrets nHG,ni. Therefore, A cannot compute the current session key unless both all the long-term secrets and short-term secrets are compromised simultaneously. Our protocol can thwart the ephemeral secret leakage attack.


#### 5.2.8. Perfect Forward Secrecy

It is supposed that the adversary obtains the secret keys of a user and the smart devices. Furthermore, the adversary intercepts all the messages transmitted among them during the group authentication process. The adversary computesGSK=HnHG∥HKi∥ni∥IDi∥IDHG∥M10=HnHG∥HIDi∥KHG∥ni∥IDi∥IDHG∥HHs∥nHG to get the group session key. However, the adversary cannot obtain the parameters nHG,KHG and reconstruct correctly the secret s with given shares to compute the group session key. Therefore, the proposed protocol can provide the perfect forward secrecy.


#### 5.2.9. Session Key Security

The session key GSK is calculated by both all the authenticated smart devices and the userUi. The message M14 contains the session key. Supposed that A intercepts the message and tries to forge GSK′ by random nonces ni′,nHG′. However, A does not know the parameters IDi,HKi,M10; it is impossible for A to compute GSK due to the collision resistance property of H·. Thus, our protocol guarantees session key security successfully.


## 5.1. Formal Security Analysis

(1)
Participants. Let ∏Uiu, ∏SDjv, and ∏HGt represent instances u, v, and t of participant Ui, SDj, and HG, respectively(2)
Partnering. If the following conditions are satisfied, the instances ∏Uiu and ∏SDjv are said to be partners [37].
(i)
Both instances∏Uiu and ∏SDjv are accepted(ii)
Both instances∏Uiu and ∏SDjv authenticate each other(iii)
The instance∏Uiu and the instance ∏SDjv are only partners each other(3)
Freshness. The instance ∏Uiu or ∏SDjv is fresh if the session key SK is not compromised to A(4)
Adversary. A has all the capabilities as the adversary in Dolev-Yao (DY) threat model [37–39] and also has some capabilities defined in CK-adversary model [40, 41]. Moreover, A can make queries as Execute∏u,∏v, Reveal∏, Send∏,m, CorruptUserEquipment∏Uit, CorruptSmartDevice∏SDjt, and Test∏ to challenger to obtain the sensitive information. These queries are utilized to construct a series of games. After games, A guesses a bit b′ and wins the game only if b′=b. Succ represents that A wins the game. The advantage of A in breaking the IND-CPA of our protocol P in probabilistic polynomial time is AdvP,AIND−CCAK=2·PrSucc−1. The proposed protocol P is secure under the ROR model when AdvP,AIND−CPAK is negligibleTheorem 1.
LetA be the adversary running in the polynomial time t against our authentication protocol P in the random oracle. Let Dic, qh, qsend, qe, Hash, Dic, m, and lr represent the a uniformly distributed password dictionary, the number of Hash oracles, the number of Send oracle, the number of Execute oracles, the space of hash function, the size of Dic, the bit length of biometrics key σi, and the bit length of the random nonce, respectively. The advantage of A in breaking protocol P in probabilistic polynomial time is defined as follows:
(3)AdvP,AAKAK≤qh2Hash+qsend+qe22lr+2maxqsend2m,C′·qsends′+2q·AdvP,AIND−CPAK.Proof.
The gamesGamei, where i=0,4 is defined in this section. Let Succi represent the event that A succeeds in guessing b in the Gamei.
Game0: the game Game0 simulates the real attack in our protocol by A in ROR sense. At the beginning of Game0, A guesses b. By definition, it follows
(4)AdvP,AAKAK=2PrSucc0−1.
Game1: the game Game1 simulates the adversary’s eavesdropping attack by asking Execute∏,∏ oracle. At the end of the game, A queries Test oracle and then distinguishes whether the output of Test oracle is either a real session key SK or a random string in the same domain. The group session key is calculated as GSK=HnHG∥HKi∥ni∥IDi∥IDHG∥HHs∥nHG in our protocol. To calculate the GSK, A has to obtain HKi and HHs∥nHG. Additionally, IDi,IDHG,ni, and nHG are not compromised to A. Therefore, the probability of winning Game1 for A is not increased by launching eavesdropping attacks. It is clear that
(5)PrSucc0=PrSucc1.
Game2: there exists some differences between Game2 and Game1; the simulations of Send and Hash oracles are added to the Game2. The game simulates an active attack in which A tries to fool the participant into accepting the forged messages. A is able to query Hash oracle many times to find collisions. Since all the exchanged messages are associated with participant’s identity, random nonce, and timestamps, the probability of finding the collision of secret key for symmetric cryptography is qh2/2·Hash according to the birthday paradox. Besides, the probability of finding the collision of random nonce is defined as qsend+qe2/2lr+1. It is clear that
(6)PrSucc1−PrSucc2≤qh22·Hash+qsend+qe22lr+1.
Game3: by adding the simulation of querying the CorruptSmartPhone oracle and smartphone lost attack, the Game2 is transformed into Game3. A may obtain password PWi and the biometrics key σi using online, offline dictionary attack, and physical device attack, respectively. The fuzzy extractor is utilized to extract the b bits of biometric information, and the probability of guessing the σi∈0,1m for A is approximately 1/2m. Additionally, it is supposed that the number of password inputs is strictly limited. The user-chosen passwords tend to be low entropy and are far different distribution from uniform distribution. The size of the password space is limited in practical, and users usually only use a part of the password space. The probability of guessing the password is defined as C′·qsends′ [43]; C′ and s′ are the parameters of the Zipf model. Therefore, it is clear that
(7)PrSucc2−PrSucc3≤maxqsend2m,C′·qsends′.
Game4: this game adds the simulation of CorruptSmartDevice oracle compared to Game3. A can physically capture the smart devices and obtain the information prestored into the memory of smart device in the registration phase. However, this information is encrypted by the physical fingerprint Rj based on PUF and fuzzy extractor technique. It is hard to obtain the secret share sj and forge the device even if A grabs the device. Let A can eavesdrop all the exchanged messages. A tries to obtain the sensitive information IDi,IDHG,ni,M10,HKi by decrypting the message M4. Due to the Chinese Remainder Theorem, any illegitimate participant is unable to obtain the temporary group key nHG and HKi without the secret share sj. Even if A wants to reconstruct secret, it is hard for A to capture at least t legal smart devices. The probability of forging the appropriate pair of values is 1/q. Additionally, it is difficult for A to decrypt the M15 as A is unknown to Ki. A can not compute GSK=HnHG∥HKi∥ni∥IDi∥IDHG∥HHs∥nHG due to the lacking of HHs∥nHG and HKi. The proposed protocol is IND−CPA secure. It is concluded that
(8)PrSucc3−PrSucc4≤1q·AdvP,AIND−CPAK.
All the oracles have been simulated in the game.A guesses b after querying Test oracle. It is clear that PrSucc4=1/2.
Therefore, from formulas (4) to (8), we have
(9)AdvP,AAKAK=2·PrSucc0−12=2·PrSucc1−PrSucc4≤2·PrSucc1−PrSucc2+PrSucc2−PrSucc4≤2·PrSucc1−PrSucc2+PrSucc2−PrSucc3+PrSucc3−PrSucc4≤2·qh22·Hash+qsend+qe22lr+1+maxqsend2m,C′·qsends′+1q·AdvP,AIND−CPAK≤qh2Hash+qsend+qe22lr+2maxqsend2m,C′·qsends′+2q·AdvP,AIND−CPAK.


## 5.2. Other Discussions on Security Features

### 5.2.1. Untraceability and User Anonymity

It is assumed thatA has capability of intercepting all the messages during the execution of the authentication phase over the public channel. The user’s identity IDi is protected by hash function H· and symmetric cryptography. It is computationally infeasible for A to attain identity without secret parameters nHG,ni,Vi,σi. Therefore, our protocol guarantees the feature of user anonymity. Moreover, the transmitted message generally involves the current timestamp and random nonce, and Ui temporary identity TIDi is updated when the session is completed successfully. Therefore, it is also computationally infeasible for A to track the user’s activity in each session. In conclusion, the untraceability and user anonymity are both guaranteed in our protocol.


### 5.2.2. Replay Attack

It is assumed thatA is capable of intercepting all the messages between the user, HG, and smart devices. The transmitted messages usually involve random nonces and timestamps. Even if A intercepts the messages and replays these messages shortly after, they can not pass the verification of timestamps due to maximum communication delay ΔT. Thus, our protocol can resist replay attack.


### 5.2.3. Smart Device Impersonation Attack

It is supposed thatA intercepts the transmitted message during the execution of the protocol. A needs to generate valid information. However, A does not know the sensitive parameters to obtain the authentication parameters. Furthermore, the smart device is protected by PUF, which cannot be forged on hardware. It is computationally infeasible to impersonate the smart device in probabilistic polynomial time. Therefore, our protocol can withstand smart device impersonation attack.


### 5.2.4. HG Impersonation Attack

It is supposed thatA intercepts the message during the execution of the protocol and tries to generate other messages to impersonate HG. However, without the knowledge of the secret parameters χ,ni,IDi,KHG, it is computationally infeasible to impersonate HG in probabilistic polynomial time. Thus, our protocol can withstand HG impersonation attack.


### 5.2.5. Smartphone Lost Attack

Supposed that theUi’s smartphone is lost or stolen by A. By the threat model, A is capable of extracting all the information TIDi,rPWi,Bi,Vi,τi,Gen·,Rep·,H·,t stored in the memory of UEi using the power analysis attack [44]. In order to retrieve IDi,PWi from the extracted information A needs to attain the secrets Ki,σi,ni. The possibility of guessing the user’s biometrics key σi as well as ni,Ki is negligible. The adversary A may launch the password guessing attack. The password guessing attack is mainly divided into online and offline password guessing attack [45]. The online password guessing attack can be effectively prevented by limiting the number of illegal requests from users. In our paper, the “fuzzy verifier” is utilized to guarantee the security under offline password guessing attack. The password verifier Vi is computed Vi=HHIDiσiHPWiσiamodΩ. Even if other two authentication factors are compromised, the adversary A has to guess IDi, PWi, and a. Furthermore, it is assumed that A has got the IDi∗, PWi∗, and a∗ which satisfying Vi=Vi∗; the login request will be rejected due to the “fuzzy verifier.” Therefore, our protocol can effectively withstand online and offline guessing attack. The user’s identity credentials IDi,PWi are not compromised to A. So, our protocol can resist smartphone lost attack.


### 5.2.6. Privileged-Insider Attack

It is assumed thatA is a privileged-insider user of trusted RC. A tries to attain the credentials of the authorized user and all the information from UEi. A obtains the registration information IDi,RPWi of Ui which is sent to RC. Meanwhile, A is able to extract all the information TIDi,rPWi,Bi,Vi,τi,Gen·,Rep·,H·,t stored in the UEi. Without knowing of random nonce a and biometrics key σi, it is computationally infeasible to retrieve PWi in probabilistic polynomial time due to RPWi=HIDi∥PWi∥σi. Thus, our protocol can withstand privileged-insider attack.


### 5.2.7. Ephemeral Secret Leakage Attack

In our protocol, a secure group session keyGSK∗=HnHG∗∥HKi∥ni∥IDi∥IDHG∥M10 is established between a user and smart devices during the login and authentication phase. M10 is composed of long-term secret Hs and short-term secret nHG. In particular, the secret s is computed by secret reconstruction algorithm of secret sharing technology. In addition, IDHG,IDi,HKi are the long-term secrets, and ni is a short-term secret. On the one hand, it is assumed that the short-term secrets nHG,ni are revealed to A. However, it is computationally infeasible to compute the GSK due to the lack of long-term secrets. On the other hand, it is assumed that A can obtain the long-term secrets. Even though A obtains some secret shares sj from the smart devices, it is computationally infeasible to construct the secret S and then calculate the message M10. The short-term secrets nHG,ni are randomly generated by the HG and Ui. It is also hard for A to compute GSK without the short-term secrets nHG,ni. Therefore, A cannot compute the current session key unless both all the long-term secrets and short-term secrets are compromised simultaneously. Our protocol can thwart the ephemeral secret leakage attack.


### 5.2.8. Perfect Forward Secrecy

It is supposed that the adversary obtains the secret keys of a user and the smart devices. Furthermore, the adversary intercepts all the messages transmitted among them during the group authentication process. The adversary computesGSK=HnHG∥HKi∥ni∥IDi∥IDHG∥M10=HnHG∥HIDi∥KHG∥ni∥IDi∥IDHG∥HHs∥nHG to get the group session key. However, the adversary cannot obtain the parameters nHG,KHG and reconstruct correctly the secret s with given shares to compute the group session key. Therefore, the proposed protocol can provide the perfect forward secrecy.


### 5.2.9. Session Key Security

The session key GSK is calculated by both all the authenticated smart devices and the userUi. The message M14 contains the session key. Supposed that A intercepts the message and tries to forge GSK′ by random nonces ni′,nHG′. However, A does not know the parameters IDi,HKi,M10; it is impossible for A to compute GSK due to the collision resistance property of H·. Thus, our protocol guarantees session key security successfully.


## 5.2.1. Untraceability and User Anonymity

It is assumed thatA has capability of intercepting all the messages during the execution of the authentication phase over the public channel. The user’s identity IDi is protected by hash function H· and symmetric cryptography. It is computationally infeasible for A to attain identity without secret parameters nHG,ni,Vi,σi. Therefore, our protocol guarantees the feature of user anonymity. Moreover, the transmitted message generally involves the current timestamp and random nonce, and Ui temporary identity TIDi is updated when the session is completed successfully. Therefore, it is also computationally infeasible for A to track the user’s activity in each session. In conclusion, the untraceability and user anonymity are both guaranteed in our protocol.


## 5.2.2. Replay Attack

It is assumed thatA is capable of intercepting all the messages between the user, HG, and smart devices. The transmitted messages usually involve random nonces and timestamps. Even if A intercepts the messages and replays these messages shortly after, they can not pass the verification of timestamps due to maximum communication delay ΔT. Thus, our protocol can resist replay attack.


## 5.2.3. Smart Device Impersonation Attack

It is supposed thatA intercepts the transmitted message during the execution of the protocol. A needs to generate valid information. However, A does not know the sensitive parameters to obtain the authentication parameters. Furthermore, the smart device is protected by PUF, which cannot be forged on hardware. It is computationally infeasible to impersonate the smart device in probabilistic polynomial time. Therefore, our protocol can withstand smart device impersonation attack.


## 5.2.4. HG Impersonation Attack

It is supposed thatA intercepts the message during the execution of the protocol and tries to generate other messages to impersonate HG. However, without the knowledge of the secret parameters χ,ni,IDi,KHG, it is computationally infeasible to impersonate HG in probabilistic polynomial time. Thus, our protocol can withstand HG impersonation attack.


## 5.2.5. Smartphone Lost Attack

Supposed that theUi’s smartphone is lost or stolen by A. By the threat model, A is capable of extracting all the information TIDi,rPWi,Bi,Vi,τi,Gen·,Rep·,H·,t stored in the memory of UEi using the power analysis attack [44]. In order to retrieve IDi,PWi from the extracted information A needs to attain the secrets Ki,σi,ni. The possibility of guessing the user’s biometrics key σi as well as ni,Ki is negligible. The adversary A may launch the password guessing attack. The password guessing attack is mainly divided into online and offline password guessing attack [45]. The online password guessing attack can be effectively prevented by limiting the number of illegal requests from users. In our paper, the “fuzzy verifier” is utilized to guarantee the security under offline password guessing attack. The password verifier Vi is computed Vi=HHIDiσiHPWiσiamodΩ. Even if other two authentication factors are compromised, the adversary A has to guess IDi, PWi, and a. Furthermore, it is assumed that A has got the IDi∗, PWi∗, and a∗ which satisfying Vi=Vi∗; the login request will be rejected due to the “fuzzy verifier.” Therefore, our protocol can effectively withstand online and offline guessing attack. The user’s identity credentials IDi,PWi are not compromised to A. So, our protocol can resist smartphone lost attack.


## 5.2.6. Privileged-Insider Attack

It is assumed thatA is a privileged-insider user of trusted RC. A tries to attain the credentials of the authorized user and all the information from UEi. A obtains the registration information IDi,RPWi of Ui which is sent to RC. Meanwhile, A is able to extract all the information TIDi,rPWi,Bi,Vi,τi,Gen·,Rep·,H·,t stored in the UEi. Without knowing of random nonce a and biometrics key σi, it is computationally infeasible to retrieve PWi in probabilistic polynomial time due to RPWi=HIDi∥PWi∥σi. Thus, our protocol can withstand privileged-insider attack.


## 5.2.7. Ephemeral Secret Leakage Attack

In our protocol, a secure group session keyGSK∗=HnHG∗∥HKi∥ni∥IDi∥IDHG∥M10 is established between a user and smart devices during the login and authentication phase. M10 is composed of long-term secret Hs and short-term secret nHG. In particular, the secret s is computed by secret reconstruction algorithm of secret sharing technology. In addition, IDHG,IDi,HKi are the long-term secrets, and ni is a short-term secret. On the one hand, it is assumed that the short-term secrets nHG,ni are revealed to A. However, it is computationally infeasible to compute the GSK due to the lack of long-term secrets. On the other hand, it is assumed that A can obtain the long-term secrets. Even though A obtains some secret shares sj from the smart devices, it is computationally infeasible to construct the secret S and then calculate the message M10. The short-term secrets nHG,ni are randomly generated by the HG and Ui. It is also hard for A to compute GSK without the short-term secrets nHG,ni. Therefore, A cannot compute the current session key unless both all the long-term secrets and short-term secrets are compromised simultaneously. Our protocol can thwart the ephemeral secret leakage attack.


## 5.2.8. Perfect Forward Secrecy

It is supposed that the adversary obtains the secret keys of a user and the smart devices. Furthermore, the adversary intercepts all the messages transmitted among them during the group authentication process. The adversary computesGSK=HnHG∥HKi∥ni∥IDi∥IDHG∥M10=HnHG∥HIDi∥KHG∥ni∥IDi∥IDHG∥HHs∥nHG to get the group session key. However, the adversary cannot obtain the parameters nHG,KHG and reconstruct correctly the secret s with given shares to compute the group session key. Therefore, the proposed protocol can provide the perfect forward secrecy.


## 5.2.9. Session Key Security

The session key GSK is calculated by both all the authenticated smart devices and the userUi. The message M14 contains the session key. Supposed that A intercepts the message and tries to forge GSK′ by random nonces ni′,nHG′. However, A does not know the parameters IDi,HKi,M10; it is impossible for A to compute GSK due to the collision resistance property of H·. Thus, our protocol guarantees session key security successfully.


## 6. Performance Analysis

We analyze the performance of our protocol from three aspects, including computational cost, communication cost, functionality, and security features, respectively. We also compare our protocols with other related protocols in the section.


### 6.1. Functionality and Features

We compare the functionality and security features of our protocol with other related protocols in Table2. From Table 2, most protocols generally adopt a multifactor authentication mechanism to verify the authenticity of the user. Challa et al. [20] and Li et al. [9]’s protocol are insecure against HG impersonation attack and do not provide perfect forward secrecy. Although most authentication and key agreement protocols for the smart home declare they can resist many known attacks such as replay attack, privileged-insider attack, and man-in-the-middle attack, most protocols do not support all above features. It is obvious that the proposed protocol still provides more security functionalities and security features than other related protocols [46–48]. Yu and Li [46], Shuai et al. [47], and Banerjee et al. [48] all lack the security protection for the smart devices. The sensitive information stored in the smart devices may be compromised to the adversary while the adversary launch attacks on smart devices. Additionally, Yu and Li [46] and Shuai et al. [47] utilize pairing-based cryptography and ECC-based to implement authentication and establish session key between users and devices, respectively, which are not great for resource-constrained devices.Table 2
Security feature comparison.
Feature[20][8][9][46][47][48]Our protocolUser anonymity√√√√√√√Untraceability√√√√√√√Mutual authentication√√√√√√√Perfect forward secrecy××√√√√√Dynamically devices joining√√××√√√Device revocation√×××√√√The number of factors usedThreeThreeTwoN/ATwoThreeTwoPassword/biometrics update√√√××√√Smartphone/smartcard lost attack√√√N/A×√√Smart device lost attack√√√N/A√×√User impersonation attack√√√√√√√Device impersonation attack√√√N/A√√√HG impersonation attackN/A√N/A√√√√Session key security√√√√√√√Replay attack√√√√√√√Privileged-insider attack√√√√√√√Ephemeral secret leakage attackN/AN/AN/A××√√1N/A means not considered. 2√ means the scheme supports the functionality/security feature. 3× means the scheme does not support the functionality/security feature.


### 6.2. Communication Cost

We evaluate the communication and computational cost in our authentication protocol compared to other protocols [8, 9, 20, 46–48].It is defined that the length of identity, random nonces, timestamps, and hash function operation is 128 bits, 128 bits, 32 bits, and 160 bits, respectively. It is also assumed thatλ1=128 bits, λ2=160 bits, and AES-128 are adopted for symmetric cryptography, where λ1,λ2 denote the length of input and output of physical unclonable function, respectively. The messages in our protocol include msg1=TIDi,M1,M2,T1, msg2=M4,M5,mHG,T2, msg3=M7−SDj,M8−SDj,T3, msg4=M11,M12, msg5=M14, and msg6=M15,M16,M17,T4; the corresponding bit length of messages is 480 bits, 864 bits, 576 bits, 320 bits, 160 bits, and 896 bits, respectively. Table 3 summarizes the proposed protocol and other existing authentication protocols in terms of communication cost. The proposed protocol requires second highest communication cost among all the protocols when users launch the access request to single device in the smart home. However, it is obvious that the proposed protocol effectively reduces the communication cost when accessing multiple devices compared to other protocols.Table 3
Communication cost comparison.
SchemeSingle device costn devices costThe no. of messageChalla et al. [20]20162016n4Wazid et al. [8]25922592n4Li et al. [9]20482048n4Yu and Li [46]40964096n8Shuai et al. [47]22722272n4Banerjee et al. [48]20482048n4Our protocol32961376+1920n6


### 6.3. Computational Cost

The proposed protocol is simulated using Pair-Based Cryptography (PBC) library and GNU Multiple Precision Arithmetic (GMP) library. C language is utilized on Ubuntu 16.04 with 2.50 GHz Intel(R) Core(TM) i5-4200M CPU and 8 GB of RAM.We compare the total execution time with other protocols [8, 9, 20, 46–48] during the login and authentication phase. It is assumed that TB, TH, TE/D, Tfe, Txor, Tecm, Tmm, Tpuf, Tmac, and Thmac denote the computational cost required for a bilinear pairing, hash function, a symmetric cryptography using AES-128, a fuzzy extraction operation, a XOR operation, a point multiplication operation using ECC, a modular multiplication operation, a physical unclonable function operation, a message authentication code (MAC) operation, and a hashed MAC operation, respectively. As the computational cost of bit-wise XOR operation is much less than other operations, it is not considered in the evaluation. Besides, it is assumed that TH≈Tmac≈Thmac, Tfe≈Tecm in our experiment according to [8]. The above operations are performed one hundred times and take its average value. Based on the experimental results reported in [49], we have the computational cost of TB, TH, TE/D, Tfe, Tmm, Tecm, and Tpuf which is 0.544 ms, 0.0026 ms, 0.00325 ms, 1.989 ms, 0.171 ms, 1.989 ms, and 0.12 ms (ms is the abbreviation of milliseconds), respectively. The computational cost of accessing single and multiple devices for the related protocol and our protocol is described in Table 4. It is clear that the proposed protocol has significantly reduced the computational cost compared to Challa et al. [20] and Shuai et al. [47]. By introducing the Chinese residual theorem and secret sharing, although the copu is performance in the case of single device access, the performance is significantly better in the case of multiple devices access.Table 4
Computational cost comparison.
ProtocolSingle device accessing cost (ms)n devices accessing cost (ms)Challa et al. [20]Tfe+16TH+13TecmTfe+16TH+13TecmnWazid et al. [8]Tfe+21TH+8TE/DTfe+21TH+8TE/DnLi et al. [9]Tfe+19TH+8TE/D+3TecmTfe+19TH+8TE/D+3TecmnYu and Li [46]4TB+26TH+47Tecm4TB+26TH+47TecmnShuai et al. [47]16TH+8Tecm16TH+8TecmnBanerjee et al. [48]Tfe+24THTfe+24THnOur protocolTpuf+2Tfe+22TH+8TE/DTfe+9TH+4TE/D+Tpuf+Tfe+4TE/D+13THnFigure4 shows the comparison of computational cost in the login and authentication phase. Viewed from Figure 4, the X-axis represents the numbers of smart devices that users access simultaneously. The Y-axis represents the time cost to establish session key with n smart devices, simultaneously. It is obvious that the computational cost of Yu and Li [46] is much more than that of other protocols. Compared to protocols of Challa et al. [20], Li et al. [9], and Shuai et al. [47], the protocols of Wazid et al. [8] and Banerjee et al. [48] and our proposed protocol have the similar computational cost when accessing smart devices. Obviously, according to Table 4, the computational complexity of previous schemes increases linearly according to the number of devices. In this scenario, the computation cost is Tfe+9TH+4TE/D+Tpuf+Tfe+4TE/D+13THn. When n is large, we believe that the constant term can be ignored, so our computation time also increases linearly with the number of devices. However, our protocol effectively supports more functionalities and security features at the cost of slightly increasing the communication and computational cost compared to Wazid et al. [8] and Banerjee et al. [48]’s protocols.Figure 4
Computational cost comparison.


## 6.1. Functionality and Features

We compare the functionality and security features of our protocol with other related protocols in Table2. From Table 2, most protocols generally adopt a multifactor authentication mechanism to verify the authenticity of the user. Challa et al. [20] and Li et al. [9]’s protocol are insecure against HG impersonation attack and do not provide perfect forward secrecy. Although most authentication and key agreement protocols for the smart home declare they can resist many known attacks such as replay attack, privileged-insider attack, and man-in-the-middle attack, most protocols do not support all above features. It is obvious that the proposed protocol still provides more security functionalities and security features than other related protocols [46–48]. Yu and Li [46], Shuai et al. [47], and Banerjee et al. [48] all lack the security protection for the smart devices. The sensitive information stored in the smart devices may be compromised to the adversary while the adversary launch attacks on smart devices. Additionally, Yu and Li [46] and Shuai et al. [47] utilize pairing-based cryptography and ECC-based to implement authentication and establish session key between users and devices, respectively, which are not great for resource-constrained devices.Table 2
Security feature comparison.
Feature[20][8][9][46][47][48]Our protocolUser anonymity√√√√√√√Untraceability√√√√√√√Mutual authentication√√√√√√√Perfect forward secrecy××√√√√√Dynamically devices joining√√××√√√Device revocation√×××√√√The number of factors usedThreeThreeTwoN/ATwoThreeTwoPassword/biometrics update√√√××√√Smartphone/smartcard lost attack√√√N/A×√√Smart device lost attack√√√N/A√×√User impersonation attack√√√√√√√Device impersonation attack√√√N/A√√√HG impersonation attackN/A√N/A√√√√Session key security√√√√√√√Replay attack√√√√√√√Privileged-insider attack√√√√√√√Ephemeral secret leakage attackN/AN/AN/A××√√1N/A means not considered. 2√ means the scheme supports the functionality/security feature. 3× means the scheme does not support the functionality/security feature.


## 6.2. Communication Cost

We evaluate the communication and computational cost in our authentication protocol compared to other protocols [8, 9, 20, 46–48].It is defined that the length of identity, random nonces, timestamps, and hash function operation is 128 bits, 128 bits, 32 bits, and 160 bits, respectively. It is also assumed thatλ1=128 bits, λ2=160 bits, and AES-128 are adopted for symmetric cryptography, where λ1,λ2 denote the length of input and output of physical unclonable function, respectively. The messages in our protocol include msg1=TIDi,M1,M2,T1, msg2=M4,M5,mHG,T2, msg3=M7−SDj,M8−SDj,T3, msg4=M11,M12, msg5=M14, and msg6=M15,M16,M17,T4; the corresponding bit length of messages is 480 bits, 864 bits, 576 bits, 320 bits, 160 bits, and 896 bits, respectively. Table 3 summarizes the proposed protocol and other existing authentication protocols in terms of communication cost. The proposed protocol requires second highest communication cost among all the protocols when users launch the access request to single device in the smart home. However, it is obvious that the proposed protocol effectively reduces the communication cost when accessing multiple devices compared to other protocols.Table 3
Communication cost comparison.
SchemeSingle device costn devices costThe no. of messageChalla et al. [20]20162016n4Wazid et al. [8]25922592n4Li et al. [9]20482048n4Yu and Li [46]40964096n8Shuai et al. [47]22722272n4Banerjee et al. [48]20482048n4Our protocol32961376+1920n6


## 6.3. Computational Cost

The proposed protocol is simulated using Pair-Based Cryptography (PBC) library and GNU Multiple Precision Arithmetic (GMP) library. C language is utilized on Ubuntu 16.04 with 2.50 GHz Intel(R) Core(TM) i5-4200M CPU and 8 GB of RAM.We compare the total execution time with other protocols [8, 9, 20, 46–48] during the login and authentication phase. It is assumed that TB, TH, TE/D, Tfe, Txor, Tecm, Tmm, Tpuf, Tmac, and Thmac denote the computational cost required for a bilinear pairing, hash function, a symmetric cryptography using AES-128, a fuzzy extraction operation, a XOR operation, a point multiplication operation using ECC, a modular multiplication operation, a physical unclonable function operation, a message authentication code (MAC) operation, and a hashed MAC operation, respectively. As the computational cost of bit-wise XOR operation is much less than other operations, it is not considered in the evaluation. Besides, it is assumed that TH≈Tmac≈Thmac, Tfe≈Tecm in our experiment according to [8]. The above operations are performed one hundred times and take its average value. Based on the experimental results reported in [49], we have the computational cost of TB, TH, TE/D, Tfe, Tmm, Tecm, and Tpuf which is 0.544 ms, 0.0026 ms, 0.00325 ms, 1.989 ms, 0.171 ms, 1.989 ms, and 0.12 ms (ms is the abbreviation of milliseconds), respectively. The computational cost of accessing single and multiple devices for the related protocol and our protocol is described in Table 4. It is clear that the proposed protocol has significantly reduced the computational cost compared to Challa et al. [20] and Shuai et al. [47]. By introducing the Chinese residual theorem and secret sharing, although the copu is performance in the case of single device access, the performance is significantly better in the case of multiple devices access.Table 4
Computational cost comparison.
ProtocolSingle device accessing cost (ms)n devices accessing cost (ms)Challa et al. [20]Tfe+16TH+13TecmTfe+16TH+13TecmnWazid et al. [8]Tfe+21TH+8TE/DTfe+21TH+8TE/DnLi et al. [9]Tfe+19TH+8TE/D+3TecmTfe+19TH+8TE/D+3TecmnYu and Li [46]4TB+26TH+47Tecm4TB+26TH+47TecmnShuai et al. [47]16TH+8Tecm16TH+8TecmnBanerjee et al. [48]Tfe+24THTfe+24THnOur protocolTpuf+2Tfe+22TH+8TE/DTfe+9TH+4TE/D+Tpuf+Tfe+4TE/D+13THnFigure4 shows the comparison of computational cost in the login and authentication phase. Viewed from Figure 4, the X-axis represents the numbers of smart devices that users access simultaneously. The Y-axis represents the time cost to establish session key with n smart devices, simultaneously. It is obvious that the computational cost of Yu and Li [46] is much more than that of other protocols. Compared to protocols of Challa et al. [20], Li et al. [9], and Shuai et al. [47], the protocols of Wazid et al. [8] and Banerjee et al. [48] and our proposed protocol have the similar computational cost when accessing smart devices. Obviously, according to Table 4, the computational complexity of previous schemes increases linearly according to the number of devices. In this scenario, the computation cost is Tfe+9TH+4TE/D+Tpuf+Tfe+4TE/D+13THn. When n is large, we believe that the constant term can be ignored, so our computation time also increases linearly with the number of devices. However, our protocol effectively supports more functionalities and security features at the cost of slightly increasing the communication and computational cost compared to Wazid et al. [8] and Banerjee et al. [48]’s protocols.Figure 4
Computational cost comparison.


## 7. Conclusion

In this paper, we proposed a PUF-assisted lightweight group authentication and key agreement protocol in the smart home based on secret sharing technique and Chinese Remainder Theorem. The proposed protocol can withstand most of several known attacks, which is proved under the ROR model and other security discussions. Compared with other related protocols, our protocol can effectively reduce the resource cost during the login and authentication phase. In addition, our smart devices protected by the physical unclonable function are secure against smart device lost attack. Our protocol supports dynamic smart device joining and leaving, password, and biometrics update without the involvement of HG. Overall, the performance of our authentication protocol is better than other related protocols only using lightweight operations. Therefore, our protocol is more suitable for resource-constrained smart devices in the smart home. In future work, we will take tools such as AVISPA for further security analysis and verify the performance of the protocol in the smart home.



---

*Source: 8865158-2022-03-24.xml*