# An Identity-Based Anonymous Three-Party Authenticated Protocol for IoT Infrastructure

Authors: Akasha Shafiq; Muhammad Faizan Ayub; Khalid Mahmood; Mazhar Sadiq; Saru Kumari; Chien-Ming Chen
Journal: Journal of Sensors
 (2020)

---

## Abstract

The rapid advancement in the field of wireless sensor and cellular networks have established a rigid foundation for the Internet of Things (IoT). IoT has become a novel standard that incorporates various physical objects by allowing them to collaborate with each other. A large number of services and applications emerging in the field of IoT that include healthcare, surveillance, industries, transportation, and security. A service provider (SP) offers several services that are accessible through smart applications from any time, anywhere, and any place via the Internet. Due to the open nature of mobile communication and the Internet, these services are extremely susceptible to various malicious attacks, e.g., unauthorized access from malicious intruders. Therefore, to overcome these susceptibilities, a robust authentication scheme is the finest solution. In this article, we introduce a lightweight identity-based remote user authentication and key agreement scheme for IoT environment that enables secure access to IoT services. Our introduced scheme utilizes lightweight elliptic curve cryptography (ECC), hash operations, and XOR operations. The theoretical analysis and formal proof are presented to demonstrate that our scheme provides resistance against several security attacks. Performance evaluation and comparison of our scheme with several related schemes for IoT environment are carried out using the PyCrypto library in Ubuntu and mobile devices. The performance analysis shows that our scheme has trivial storage and communication cost. Hence, the devised scheme is more efficient not only in terms of storage, communication, and computation overheads but also in terms of providing sufficient security against various malicious attacks.


---

## Body

## 1. Introduction

In the last few years, wireless networks have experienced tremendous growth. Nowadays, there are enormous networks associating from the cellular systems to noninfrastructure wireless systems such as sensor networks, mobile ad hoc networks, and the Internet of Things (IoT). The communication security is the key element for the success of wireless sensor applications [1, 2], especially for sensitive applications that work in mission-critical and hostile areas. Therefore, the provision of reliable and efficient security in wireless networks has always been a challenging task due to various malignant attacks and resource-constrained environment. The hasty development of wireless communication and information technologies leads to a dramatic evolution of the Internet of Things (IoT) which is the combination of smart services and technologies that renders mutual communication among devices and users through the Internet. Since all data is shared between sensing devices and remote users via a network, therefore, it is necessary to design an efficient, secure, and lightweight remote-user authentication-based solution for an IoT environment. As far as the privacy and security of the network are concerned, mutual authentication is considered as a key element for safely accessing various IoT services. Hence, remote-user authentication becomes a vital component of various valuable services in mobile networks.Besides confidentiality and authenticity, the exclusive features of the online valuable services raise various security questions for the remote authentication. In the environment of mobile networks where several invisible devices gather the client’s identity information, the anonymity of the client is necessarily required to make sure that the identity information of the requesting client is only known to the requested service provider (SP) and the client [3–5]. Simultaneously, when the anonymity of the client is provided, SP always wants the client’s nonrepudiation for preventing the clients from the denial of charges of their desired services. The efficiency in terms of both computation and communication is crucial for such kinds of remote-user authentication schemes, especially for IoT infrastructure.The earliest schemes employed conventional public key cryptography (PKC) [6–10]. In these schemes, clients authenticate themselves to service providers using their signature. For hiding the real identity of the clients from eavesdropping, the clients’ signature and clients’ identifier are encrypted using mutual secret keys between the SP and clients. The certificate of clients’ public key needs to be delivered to the SP that enables the signature’s verification. On the other hand, a considerable disadvantage of this approach is on-demand verification and transmission of public key certificates that cause authentication latency [11] as well as a waste of unfavorable bandwidth. In addition, to attain the clients’ anonymity, encryption is required that adds to the scheme’s complexity. In order to remove the drawbacks that are due to public key certificates, the modern remote-user authentication schemes employ an identity-based cryptosystem (IBC) [12–16].IBC is another form of PKC. The IBC concept was introduced by Shamir [17] in 1984 which is swiftly evolved after Franklin and Boneh’s first identity-based security-provable encryption using pairings [18]. In the IBC concept, the identity (ID) of the client serves as a client’s public key, and the private key generator (PKG) generates the private key. In IBC, a pair of predefined private or public keys are generated on the basis of the user’s credentials such as phone, name, or email. By using the user’s unique credential or identity, the public key can be determined easily, whereas the private key generator is responsible for the generation of private keys. For communicant entities, PKG generates identity-based certificates and forwards it to the other communicants. The users involved in communication can perform encryption, generate a signature, and communicate with other users when they receive their identity-based key certificates. IBC ensures the effortless production of public and private keys. IBC removes the verification and transmission of the public key certificates; therefore, it has become a compelling substitute to conventional PKC [19]. Thus, IBC is efficient in terms of storage and transfer of certificates/public keys in comparison with the classical public key infrastructure. That is why, for a resource-constraint environment, IBC is proved to be appealing. The main advantage of IBC is there is no need of certificates. There is no need of preenrollment. In the traditional public key cryptography system, if the key is compromised, then the keys need to be revoked. Also, for the decryption of messages for the future, it allows postdating.In identity-based remote-user authentication schemes, the client produces an authenticator by using his identity-based private key. The client is authorized by the SP only if verification of the client’s authenticator produces an absolute result. However, still, there are many issues that need to be resolved satisfactorily such as (i) some identity-based remote user authentication schemes consider the demand of the client’s anonymity; (ii) many of those schemes introduce identity-based signature (IBS) solution and further using it as an authenticator of the client, but it remains unclear why the introduced IBS is employed rather than employing other existing IBS schemes; and (iii) no thorough quantitative argument has been given about the performance merits of such identity-based schemes over the former PKC-based schemes. Aiming to resolve the abovementioned problems, in this article, we propose an identity-based remote-user authentication scheme that targets to deliver valuable services in mobile networks. The novelty of the proposed scheme yields in its way of realizing the client’s privacy without encryption operation.


### 1.1. Motivation

IoT serves the society with various opportunities in major fields of life, i.e., agriculture, warehousing, healthcare, and industry, that are accessible to everyone with flexibility and ease. However, this hasty development leads to the evolution of several challenges. Therefore, the fundamental motivational factors of our scheme are listed below:(i)
IoT-based sensing devices serve with limited resources like memory, power, and battery. Therefore, an authentication scheme should have low communication and computation overheads(ii)
Malicious attacks such as impersonation, replay, denial of services, and man-in-the-middle attacks have become enormous. Therefore, in order to resist against such attacks, the design of secure remote-user authentication scheme is the key necessity(iii)
Furthermore, due to some components of IoT devices like actuators and sensors that deal with the crucial data of users, IoT-based applications must provide more safety and security


### 1.2. Our Contribution

In this article, we have proposed an identity-based anonymous three-party authenticated protocol for IoT infrastructure. The main contributions of this article are as follows:(1)
We have presented a three-party identity-based authentication for the secure communications among users in an IoT infrastructure. The proposed identity-based scheme is designed using simple operations such as XOR, hash, and point multiplication(2)
The proposed protocol enables mutual authentication between users and gateway for establishing and sharing the session key(3)
User’s personal credentials such as email and phone are used to generate a public key(4)
The proposed scheme ensures the secrecy of identity such that the identity is only revealed to gateway for authentication purpose. No adversary can get the identity


### 1.3. Paper Organization

The rest of the paper is organized as follows. The related work is discussed in Section2. The preliminaries related to our paper are presented in Section 3. The generic security issues in IoT architecture are delineated in Section 4. Our introduced scheme and detailed description are given in Section 6. Section 7 presents the respective security analysis formally and informally. Thereafter, a performance comparison is highlighted in Section 8. In the end, concluding remarks are given in Section 9.


## 1.1. Motivation

IoT serves the society with various opportunities in major fields of life, i.e., agriculture, warehousing, healthcare, and industry, that are accessible to everyone with flexibility and ease. However, this hasty development leads to the evolution of several challenges. Therefore, the fundamental motivational factors of our scheme are listed below:(i)
IoT-based sensing devices serve with limited resources like memory, power, and battery. Therefore, an authentication scheme should have low communication and computation overheads(ii)
Malicious attacks such as impersonation, replay, denial of services, and man-in-the-middle attacks have become enormous. Therefore, in order to resist against such attacks, the design of secure remote-user authentication scheme is the key necessity(iii)
Furthermore, due to some components of IoT devices like actuators and sensors that deal with the crucial data of users, IoT-based applications must provide more safety and security


## 1.2. Our Contribution

In this article, we have proposed an identity-based anonymous three-party authenticated protocol for IoT infrastructure. The main contributions of this article are as follows:(1)
We have presented a three-party identity-based authentication for the secure communications among users in an IoT infrastructure. The proposed identity-based scheme is designed using simple operations such as XOR, hash, and point multiplication(2)
The proposed protocol enables mutual authentication between users and gateway for establishing and sharing the session key(3)
User’s personal credentials such as email and phone are used to generate a public key(4)
The proposed scheme ensures the secrecy of identity such that the identity is only revealed to gateway for authentication purpose. No adversary can get the identity


## 1.3. Paper Organization

The rest of the paper is organized as follows. The related work is discussed in Section2. The preliminaries related to our paper are presented in Section 3. The generic security issues in IoT architecture are delineated in Section 4. Our introduced scheme and detailed description are given in Section 6. Section 7 presents the respective security analysis formally and informally. Thereafter, a performance comparison is highlighted in Section 8. In the end, concluding remarks are given in Section 9.


## 2. Related Work

The password-based authentication key exchange (PAKE) scheme [20–26] is one of the most generally known authentication key exchange (AKE) schemes, which can also be divided into three-party [27–30], two-party, and so on. In the AKE schemes, the three-party authentication key exchange (3PAKE) scheme based on password has the features of easy system maintenance, simple password, and strong expansibility. The 3PAKE scheme is extensively used in the network of modern communication. However, it is determined that the password has low entropy secret value and also prone to password guessing attack, due to the built-in issues related to the password. Therefore, due to the various problems faced by PAKE schemes, this paper reviews the identity-based schemes and introduces a three-party identity-based authentication key exchange scheme for enhancing the security.The identity-based cryptography (IBC) [17] was developed in order to mitigate various issues associated with the conventional public key cryptography and PAKE schemes. The IBC applies the attributes of the user such as phone numbers or email addresses as public keys in order to diminish the difficulty of digital certificates, while the private key generator (PKG) creates the private keys. Therefore, the identification of user keys is critical and does not require to be revoked. Since then, the utilization of IBC remains popular for designing remote user authentication schemes. So, we review various identity-based schemes in order to find the research gap and security issues in the different infrastructures of the Internet of Things (IoT) such as edge and fog computing.Roman et al. [31] presented the comparative summary of various security issues, challenges, and appropriate solutions for mobile edge computing (MEC) and fog computing. The readers who are interested in the details of privacy and security problems in the environment of fog computing for IoT, MEC, and mobile cloud computing (MCC) can consult [32–35], respectively. The literature emphasized the requirement of a secure mechanism for authentication. Yang and Chang [36] proposed an identity-based authentication key agreement (AKA) scheme using elliptic curve cryptosystem (ECC) for mobile devices. However, Yoon and Yoo [37] analyzed that the scheme [36] cannot resist masquerading attack and does not offer perfect forward secrecy. A pairing-free AKA scheme based on identity is introduced by Cao et al. [38] with a minimum exchange of messages. However, Cao et al. [38] fail to offer the user untraceability and anonymity like Yang and Chang’s scheme.Tsai and Lo [39] introduced another authentication scheme based on identity for the distributed services of MCC. Their scheme uses bilinear pairing which causes high computation, but bilinear computation is performed by the server, which has usually more computing power. However, Jiang et al. [40] analyzed that a server impersonation attack cannot be resisted by their scheme [39], and also, it does not offer an appropriate mechanism of mutual authentication. Jiang et al. did not propose any improved solution, although various solutions were proposed in [41, 42].Yang et al. [43] introduced an ECC-based scheme having the features of user untraceability and anonymity for the environment of MCC. In their scheme, a number of pseudo-IDs are assigned to a user, as well as each pseudo-ID is assigned a family of secret keys. The Access Service Network Gateway (ASN-GW) executes the predistribution process of keys. However, for each registered user, the ASN-GW requires to engender a large number of pseudo-IDs. So, the corresponding secret keys and many pseudo-IDs need to be stored by the mobile user which is impractical due to the constrained resources of mobile devices and also includes scalability issues.Ibrahim [44] introduced an authentication scheme for the environment of fog computing, in which fog node and fog user authenticate each other. In their scheme [44], the public key infrastructure (PKI) is used to establish the secure communication channel between mobile users and registration authority, while symmetric encryption is utilized to protect the communication between fog nodes and mobile users. In their scheme, all the fog users’ pregenerated secret keys are required to be stored by fog node which is also infeasible. Moreover, untraceability and anonymity are not guaranteed by their scheme. A mobile user authentication scheme is introduced by He et al. [45] for multiserver infrastructure. Their scheme uses self-certified public key cryptography which is basically identity-based cryptography. In 2017, a privacy-aware authentication scheme is introduced by Xiong et al. [46] for MCC services.In 2019, Zhu and Geng [47] presented a three-party dynamic identity-based key exchange scheme. In 2019, Renuka et al. [48] crypt analyzed and found some attacks such as node capture, user phishing, and denial of service attacks in a three-factor authentication scheme devised by Das et al. [49] and presented an enhanced three-factor authentication scheme. Many other three-party schemes for the IoT environment have been presented [50, 51] but still lack major security features and not suitable for resource constraint environment. In 2020, Ramadan et al. [52] presented an identity-based authentication scheme for 5G systems. Kumar et al. [53] proposed an identity-based authentication scheme for cloud computing in 2020. Recently, Farjana et al. [54] presented identity-based schemes; moreover, many other schemes [55–60] are presented recently. In general, the design of efficient and secure identity-based authentication schemes is still a challenging task. In this article, we propose the identity-based lightweight remote user authentication scheme for the IoT infrastructure in order to offer the secure and efficient communication, so that all the flaws in the discussed literature can be minimized.


## 3. Preliminaries

This section includes the basics of elliptic curve cryptography such as one-way hash function, collision resistance, and threat model. The common notations used throughout the research work in Table1 are also given in this section.Table 1
Common notations.
NotationDescriptionUiUith remote user of the systemIDiUi’s identityTPMiUi’s tamper proof on-board memory/storageGWNGateway nodeIDGWNGWN’s identityxGWN’s secret keyPub=xGGWN’s public keyEpe,fAn elliptic curveGBase-point of elliptic curveEpe,fh.One-way function⊕XoR operator∥Concatenation operator⇒Secure channel→Public channelUAadvAdversary


### 3.1. Elliptic Curve Cryptography (ECC)

There is a lot of public key cryptography techniques like Rivest Shamir Adleman (RSA), Diffie Hellman, and Digital Signature Algorithm (DSA). The majority of these techniques are heavy in computation. The ECC system’s robustness can be anticipated based on the complexity of ECDLP (Elliptic Curve Discrete Logarithm Problem). SupposeEpe,f:h2+eg+f mod p, ECC is based on random points chosen on an elliptic curve, whereas e,f∈Zp and 4e3+27f2 mod p≠0 for p (large prime number). The curve is defined by both the points e,f. The former equation must be verified by the points g,h over Epe,f. Through repetitive addition, scalar multiplication is achieved such as qS=S+S+S+S+S+⋯⋯+S (q times), where S is a point over Epe,f and q∈Fp. The field parameters p,e,f,S,q belongs to the field Fp.Definition 1.
Discrete logarithm problem aimed at ECDLP.Two specified random pointsS,R∈Epe,f, calculate a scalar q such that S=qR. During the polynomial time t, the benefits of UAadv is given as: AdvUAadvECDLPt=PrbUAadvS,R=x:x∈Zp. The supposition of ECDLP states that AdvUAadvECDLPt≤∈.


### 3.2. One-Way Hash Function

Hash functions are used to get an output (f) of fixed size. Hash functions can be applied to any random argument or string (y) of any size such as f=hy. A small change in y can make a huge difference in resultant f. Subsequent parameters should be found for a secure function of hash.
(1)
Ify is defined, then it is not difficult to calculate f=hy(2)
Iff=hy is defined, then it is impossible to find out y(3)
Ifhy1=hy2 is defined, then it is a tiresome task to know the specific input y1,y2. The defined property is also referred to as collision resistanceDefinition 2.
Collision resistance characteristics aimed at hash function.Hash functionh. is secured by predefined collision resistance. The chances that an adversary UAadv can find out a couple y1≠y2 as hy1=hy2 is defined as AdvUAadvhasht=Prb[y1,y2⇐rUAadv:y1≠y2 and hy1=hy2], whereas UAadv is allowed to select a couple y1,y2 randomly. UAadv’s advantage is determined over a random selection in polynomial time t. Collision resistance is stated as AdvUAadvhasht≤∈, whereas ∈>0 is an adequately small value.


### 3.3. Identity-Based Cryptography (IBC)

IBC was introduced by Shamir in 1984 [17]. It is one of the types of public key cryptography. IBC has the following properties:
(1)
Identity-based cryptosystems use user’s personal credentials such as email, name, or phone number for deriving public/private keys(2)
The public key is generated by predefined user’s identity or personal credentials(3)
Third parties or trusted authorities as PKG are responsible for the generation of private keys(4)
PKG generates identity-based certificates, and using these certificates, encryption, generation digital signatures, and mutual authentication are performed(5)
IBC is cost-efficient in terms of transfer and storage of keys as compared to other traditional PKI systems


### 3.4. Threat Model

In order to understand the capabilities of an adversary, we have used Dolev-Yao’s [61] threat model. The capabilities of UAadv are as follows:
(1)
UAadv has full control over the public channel(2)
UAadv can easily intercept the messages of all the participants during communication over the public channel(3)
UAadv can be trusted or deceitful user of the system(4)
UAadv can be an insider of the system(5)
The identities are publicly known(6)
UAadv cannot find or extract x (GWN’s private key)(7)
UAadv cannot access the messages that are being transmitted over a secure channel


## 3.1. Elliptic Curve Cryptography (ECC)

There is a lot of public key cryptography techniques like Rivest Shamir Adleman (RSA), Diffie Hellman, and Digital Signature Algorithm (DSA). The majority of these techniques are heavy in computation. The ECC system’s robustness can be anticipated based on the complexity of ECDLP (Elliptic Curve Discrete Logarithm Problem). SupposeEpe,f:h2+eg+f mod p, ECC is based on random points chosen on an elliptic curve, whereas e,f∈Zp and 4e3+27f2 mod p≠0 for p (large prime number). The curve is defined by both the points e,f. The former equation must be verified by the points g,h over Epe,f. Through repetitive addition, scalar multiplication is achieved such as qS=S+S+S+S+S+⋯⋯+S (q times), where S is a point over Epe,f and q∈Fp. The field parameters p,e,f,S,q belongs to the field Fp.Definition 1.
Discrete logarithm problem aimed at ECDLP.Two specified random pointsS,R∈Epe,f, calculate a scalar q such that S=qR. During the polynomial time t, the benefits of UAadv is given as: AdvUAadvECDLPt=PrbUAadvS,R=x:x∈Zp. The supposition of ECDLP states that AdvUAadvECDLPt≤∈.


## 3.2. One-Way Hash Function

Hash functions are used to get an output (f) of fixed size. Hash functions can be applied to any random argument or string (y) of any size such as f=hy. A small change in y can make a huge difference in resultant f. Subsequent parameters should be found for a secure function of hash.
(1)
Ify is defined, then it is not difficult to calculate f=hy(2)
Iff=hy is defined, then it is impossible to find out y(3)
Ifhy1=hy2 is defined, then it is a tiresome task to know the specific input y1,y2. The defined property is also referred to as collision resistanceDefinition 2.
Collision resistance characteristics aimed at hash function.Hash functionh. is secured by predefined collision resistance. The chances that an adversary UAadv can find out a couple y1≠y2 as hy1=hy2 is defined as AdvUAadvhasht=Prb[y1,y2⇐rUAadv:y1≠y2 and hy1=hy2], whereas UAadv is allowed to select a couple y1,y2 randomly. UAadv’s advantage is determined over a random selection in polynomial time t. Collision resistance is stated as AdvUAadvhasht≤∈, whereas ∈>0 is an adequately small value.


## 3.3. Identity-Based Cryptography (IBC)

IBC was introduced by Shamir in 1984 [17]. It is one of the types of public key cryptography. IBC has the following properties:
(1)
Identity-based cryptosystems use user’s personal credentials such as email, name, or phone number for deriving public/private keys(2)
The public key is generated by predefined user’s identity or personal credentials(3)
Third parties or trusted authorities as PKG are responsible for the generation of private keys(4)
PKG generates identity-based certificates, and using these certificates, encryption, generation digital signatures, and mutual authentication are performed(5)
IBC is cost-efficient in terms of transfer and storage of keys as compared to other traditional PKI systems


## 3.4. Threat Model

In order to understand the capabilities of an adversary, we have used Dolev-Yao’s [61] threat model. The capabilities of UAadv are as follows:
(1)
UAadv has full control over the public channel(2)
UAadv can easily intercept the messages of all the participants during communication over the public channel(3)
UAadv can be trusted or deceitful user of the system(4)
UAadv can be an insider of the system(5)
The identities are publicly known(6)
UAadv cannot find or extract x (GWN’s private key)(7)
UAadv cannot access the messages that are being transmitted over a secure channel


## 4. Security Issues in IoT

In the design of IoT applications, IoT’s security is the most important thing. Therefore, the major challenge which requires serious consideration is to provide strong security for IoT. In the Internet world, IoT has a very bright future. Thus, for the realization of services of modern technologies and their benefits, security requirements such as authentication and privacy are much important.Therefore, subsequent issues must be handled with consideration.


### 4.1. Common Vulnerabilities in IoT Architecture

The devices of IoT existing in an abandoned environment require active inspection of every feasible condition in which the attacker can attack on devices of IoT. As per detailed scrutiny, we can wrap up the vulnerabilities of IoT as follows:(i)
Impersonation Attack. A malignant hacker can masquerade as a service provider or a user by responding to an authentic request from old transmission between any two legal entities. Therefore, a malignant hacker can enjoy the same services as a legitimate user or service provider.(ii)
Denial of Service Attack. The attacker by flooding the network with previous login requests or information exchanged between two entities can reduce the network’s performance and can make the services unavailable.(iii)
Eavesdropping Attack. The attacker can listen to private communication on a public channel and can misuse it later to attack a user or server.(iv)
Man-in-Middle Attack (MITM). The adversary can forge the message exchanged between the gateway and user, later using this information can impersonate as a legal gateway/server and user using different techniques.(v)
Parallel Session Attack. An attacker can eavesdrop the messages between the system of IoT and then attempts to generate a session to get the old data.(vi)
Gateway Node Bypassing Attack. To obtain IoT sensitive information and services without authentication of a gateway, an attacker can try to access the system by bypassing the gateway.(vii)
Stolen Smart Device Attack. An attacker can derive the user’s personal data from smart devices and utilize it later to impersonate as a legitimate user of the network.(viii)
Offline Guessing Attack. Using an offline dictionary attack, the adversary can attempt to get access to the system of IoT by guessing all possible passwords.


### 4.2. Security Feature Requirements in IoT

Many security features must be incorporated while designing the authentication schemes. The following is a list of important security features that can be exploited to design an efficient and secure scheme.(i)
User Anonymity. The participant’s identity must be secured such that if an attacker tries to eavesdrop the message and intercept message during the login and authentication stage. If the identity is revealed, then the attacker can misuse it and the user’s privacy is breached.(ii)
Mutual Authentication. Two participating entities must mutually authenticate each other to avoid security threats.(iii)
Availability. Whenever a user requires to access the system, all IoT resources should be available.(iv)
Confidentiality. The user’s personal and sensitive information must be protected and should be visible only to legitimate users.(v)
Scalability. The system of authentication must be responsive to the modification occurring in the network, and the system should be allowed to grow dynamically according to the modifications that are being happened.(vi)
Forward Secrecy. The access to entities in any authentication scheme is granted by sharing the session key. That is why the old session keys cannot be used to initiate a new session.(vii)
Resistance to Attacks. A secure authentication scheme must resist the major security threats such as the Distributed Denial of Services (DDoS), MITM, impersonation, and stolen verifier attack.


## 4.1. Common Vulnerabilities in IoT Architecture

The devices of IoT existing in an abandoned environment require active inspection of every feasible condition in which the attacker can attack on devices of IoT. As per detailed scrutiny, we can wrap up the vulnerabilities of IoT as follows:(i)
Impersonation Attack. A malignant hacker can masquerade as a service provider or a user by responding to an authentic request from old transmission between any two legal entities. Therefore, a malignant hacker can enjoy the same services as a legitimate user or service provider.(ii)
Denial of Service Attack. The attacker by flooding the network with previous login requests or information exchanged between two entities can reduce the network’s performance and can make the services unavailable.(iii)
Eavesdropping Attack. The attacker can listen to private communication on a public channel and can misuse it later to attack a user or server.(iv)
Man-in-Middle Attack (MITM). The adversary can forge the message exchanged between the gateway and user, later using this information can impersonate as a legal gateway/server and user using different techniques.(v)
Parallel Session Attack. An attacker can eavesdrop the messages between the system of IoT and then attempts to generate a session to get the old data.(vi)
Gateway Node Bypassing Attack. To obtain IoT sensitive information and services without authentication of a gateway, an attacker can try to access the system by bypassing the gateway.(vii)
Stolen Smart Device Attack. An attacker can derive the user’s personal data from smart devices and utilize it later to impersonate as a legitimate user of the network.(viii)
Offline Guessing Attack. Using an offline dictionary attack, the adversary can attempt to get access to the system of IoT by guessing all possible passwords.


## 4.2. Security Feature Requirements in IoT

Many security features must be incorporated while designing the authentication schemes. The following is a list of important security features that can be exploited to design an efficient and secure scheme.(i)
User Anonymity. The participant’s identity must be secured such that if an attacker tries to eavesdrop the message and intercept message during the login and authentication stage. If the identity is revealed, then the attacker can misuse it and the user’s privacy is breached.(ii)
Mutual Authentication. Two participating entities must mutually authenticate each other to avoid security threats.(iii)
Availability. Whenever a user requires to access the system, all IoT resources should be available.(iv)
Confidentiality. The user’s personal and sensitive information must be protected and should be visible only to legitimate users.(v)
Scalability. The system of authentication must be responsive to the modification occurring in the network, and the system should be allowed to grow dynamically according to the modifications that are being happened.(vi)
Forward Secrecy. The access to entities in any authentication scheme is granted by sharing the session key. That is why the old session keys cannot be used to initiate a new session.(vii)
Resistance to Attacks. A secure authentication scheme must resist the major security threats such as the Distributed Denial of Services (DDoS), MITM, impersonation, and stolen verifier attack.


## 5. System Setup

In an IoT infrastructure, gateway plays an important role to ensure the security in the network. Our presented model consists of two participants as shown in Figure1, such as IoT nodes and gateway. In general, IoT nodes have limited resources in terms of computation, communication, and power. The IoT nodes aimed to communicate with each other by authenticating via a trusted gateway. As in Figure 1, IoT node (1) and IoT node (a) initiate a session by sending a login request to the gateway. The gateway is responsible for establishing a secure communication between IoT nodes. Once the IoT nodes are authenticated by the gateway, the IoT nodes can then securely communicate with each other. Due to the public nature and limited resources, the IoT nodes face several security and privacy challenges. The generic three-party IoT infrastructure for remote-user authentication is demonstrated in Figure 1. Suppose a remote user wants to communicate with another remote user, then they both have to pass the authentication process. For this purpose of authentication, each entity will be verified through gateway node GWN. If both entities have been authenticated, then the GWN sends a challenge message to both entities. Upon receiving the challenge message, each entity authenticates the GWN and computes a session key. In the end, both users agreed on this common shared session key.Figure 1
System setup for the proposed scheme.


## 6. The Proposed Scheme

In this section, we elaborated on our proposed identity-based scheme which upholds user anonymity, user untraceability, perfect forward secrecy, key agreement, and mutual authentication. The introduced scheme comprises of these phases: Section6.1 the registration phase and Section 6.2 the login and authentication phase. These two phases are described below in detail.


### 6.1. Registration Phase

If a userUa wants to communicate with another user Ub, then they both have to pass the authentication process. For authentication, each entity will be verified by GWN. If both entities are authenticated, then they can share the session key. The complete registration process of the user Ui of the proposed scheme is described in detail in this subsection. Figure 2 shows the registration phase of the proposed scheme. The registration process consists of the following steps:Figure 2
Registration process ofUi.RG-Step 1.Ui chooses his/her IDi and the arbitrary number li1.RG-Step 2.GWN upon receiving the registration requests IDi,hIDi⊕li1 from Ui, then calculates the following values:
(1)MIDi=hIDi,Vi=hx∥MIDi,Yi=Vi⊕hID⊕li1RG-Step 3. On receivingYi from GWN, Ui calculates the following values:
(2)Vi=Yi⊕hIDi⊕li1,Zi=li1⊕IDi,Ai=hVi∥IDi∥li1After calculating these values, storesAi,Yi,Zi in TPMis.


### 6.2. Login and Authentication Phase

The complete process of login and authentication of the introduced scheme as presented in Figure3 is elaborated in this subsection which consists of the following steps:Figure 3
Login and authentication process ofUi.AT-Step 1. BothUa and Ub input their identity (IDa,IDb), respectively. Then, Ua calculates the following values on the basis of the credentials stored in tamper proof on-board memory TPMi of the mobile device [62, 63]:
(3)la1=Za⊕IDa,Va=Ya⊕hIDa⊕la1,Aa=?hVa∥IDa∥la1Further computation generates a random numberla2 and calculates the following values:
(4)Qa=la2G,PIDa=IDa∥MIDb⊕la2Pub,autha=hIDa∥MIDb∥IDGWN∥VawhereasUb calculates the following values on the basis of the credentials entered during the registration process.
(5)lb1=Zb⊕IDb,Vb=Yb⊕hIDb⊕lb1,Ab=?hVb∥IDb∥lbFurther,Ub generates a random number lb2 and computes the following values:
(6)Qb=lb2G,PIDb=IDb∥MIDa⊕lb2Pub,authb=hIDb∥MIDa∥IDGWN∥Yb⊕hIDb∥lb1After calculating these values,Ua and Ub send login request autha,Qa,PIDa and authb,Qb,PIDb, respectively, towards the gateway.AT-Step 2. After receiving login requests fromUa, the GWN calculates the following values for Ua:
(7)xQa=la2xG=la2Pub,IDa∥MIDb=PIDa⊕la2Pub,MIDa=hIDa,autha=?hIDa∥MIDb∥IDGWN∥hx∥MIDaAlso, calculate the following values forUb upon receiving the login request authb,Qb,PIDb(8)xQb=lb2xG=lb2Pub,IDb∥MIDa=PIDb⊕lb2Pub,MIDb=hIDb,authb=?hIDb∥MIDa∥IDGWN∥hx∥MIDbFurther, theGWN generates lGWN and calculate the following values as:
(9)MGWN=IDGWN∥x∥lGWN,NGWN1=MGWN⊕Va,NGWN2=MGWN⊕Vb,authGWN1=hIDa∥IDGWN∥Va∥MGWN,authGWN2=hIDb∥IDGWN∥Vb∥MGWNAT-Step 3. After the calculation of the above values,GWN sends authGWN1,Qb,NGWN1 and authGWN2,Qa,NGWN2 to Ua and Ub, respectively. Ua then calculates the following values along with the session key:
(10)MGWN=NGWN2⊕Va,authGWN1=?hIDa∥IDGWN∥Va∥MGWN,k=la2Qb,SKab=hMIDa∥MIDb∥IDGWN∥kAlso,Ub on the basis of the received parameters authGWN2,Qa,NGWN2 calculates the following values along with the session key:
(11)MGWN=NGWN2⊕Vb,authGWN2=?hIDb∥IDGWN∥Vb∥MGWN,k=lb2Qa,SKab=hMIDa∥MIDb∥IDGWN∥k,Finally,GWN computes a shared session key as:
(12)SKab=hMIDa∥MIDb∥IDGWN∥kHence, both the entitiesUa and Ua authenticate themselves via GWN and consequently shared a session key for subsequent communication.


## 6.1. Registration Phase

If a userUa wants to communicate with another user Ub, then they both have to pass the authentication process. For authentication, each entity will be verified by GWN. If both entities are authenticated, then they can share the session key. The complete registration process of the user Ui of the proposed scheme is described in detail in this subsection. Figure 2 shows the registration phase of the proposed scheme. The registration process consists of the following steps:Figure 2
Registration process ofUi.RG-Step 1.Ui chooses his/her IDi and the arbitrary number li1.RG-Step 2.GWN upon receiving the registration requests IDi,hIDi⊕li1 from Ui, then calculates the following values:
(1)MIDi=hIDi,Vi=hx∥MIDi,Yi=Vi⊕hID⊕li1RG-Step 3. On receivingYi from GWN, Ui calculates the following values:
(2)Vi=Yi⊕hIDi⊕li1,Zi=li1⊕IDi,Ai=hVi∥IDi∥li1After calculating these values, storesAi,Yi,Zi in TPMis.


## 6.2. Login and Authentication Phase

The complete process of login and authentication of the introduced scheme as presented in Figure3 is elaborated in this subsection which consists of the following steps:Figure 3
Login and authentication process ofUi.AT-Step 1. BothUa and Ub input their identity (IDa,IDb), respectively. Then, Ua calculates the following values on the basis of the credentials stored in tamper proof on-board memory TPMi of the mobile device [62, 63]:
(3)la1=Za⊕IDa,Va=Ya⊕hIDa⊕la1,Aa=?hVa∥IDa∥la1Further computation generates a random numberla2 and calculates the following values:
(4)Qa=la2G,PIDa=IDa∥MIDb⊕la2Pub,autha=hIDa∥MIDb∥IDGWN∥VawhereasUb calculates the following values on the basis of the credentials entered during the registration process.
(5)lb1=Zb⊕IDb,Vb=Yb⊕hIDb⊕lb1,Ab=?hVb∥IDb∥lbFurther,Ub generates a random number lb2 and computes the following values:
(6)Qb=lb2G,PIDb=IDb∥MIDa⊕lb2Pub,authb=hIDb∥MIDa∥IDGWN∥Yb⊕hIDb∥lb1After calculating these values,Ua and Ub send login request autha,Qa,PIDa and authb,Qb,PIDb, respectively, towards the gateway.AT-Step 2. After receiving login requests fromUa, the GWN calculates the following values for Ua:
(7)xQa=la2xG=la2Pub,IDa∥MIDb=PIDa⊕la2Pub,MIDa=hIDa,autha=?hIDa∥MIDb∥IDGWN∥hx∥MIDaAlso, calculate the following values forUb upon receiving the login request authb,Qb,PIDb(8)xQb=lb2xG=lb2Pub,IDb∥MIDa=PIDb⊕lb2Pub,MIDb=hIDb,authb=?hIDb∥MIDa∥IDGWN∥hx∥MIDbFurther, theGWN generates lGWN and calculate the following values as:
(9)MGWN=IDGWN∥x∥lGWN,NGWN1=MGWN⊕Va,NGWN2=MGWN⊕Vb,authGWN1=hIDa∥IDGWN∥Va∥MGWN,authGWN2=hIDb∥IDGWN∥Vb∥MGWNAT-Step 3. After the calculation of the above values,GWN sends authGWN1,Qb,NGWN1 and authGWN2,Qa,NGWN2 to Ua and Ub, respectively. Ua then calculates the following values along with the session key:
(10)MGWN=NGWN2⊕Va,authGWN1=?hIDa∥IDGWN∥Va∥MGWN,k=la2Qb,SKab=hMIDa∥MIDb∥IDGWN∥kAlso,Ub on the basis of the received parameters authGWN2,Qa,NGWN2 calculates the following values along with the session key:
(11)MGWN=NGWN2⊕Vb,authGWN2=?hIDb∥IDGWN∥Vb∥MGWN,k=lb2Qa,SKab=hMIDa∥MIDb∥IDGWN∥k,Finally,GWN computes a shared session key as:
(12)SKab=hMIDa∥MIDb∥IDGWN∥kHence, both the entitiesUa and Ua authenticate themselves via GWN and consequently shared a session key for subsequent communication.


## 7. Security Analysis

This section presents the formal and informal security analysis of the proposed scheme. We have used Real-Or-Random (ROR) [64] in order to prove the security of the proposed scheme. Furthermore, informal security analysis shows that the proposed scheme provides resilience against all known attacks.


### 7.1. Informal Security Analysis

The security of the proposed scheme is analyzed informally in this section. The informal security analysis represents the proposed scheme’s correctness and ensures that it resists various attacks.


#### 7.1.1. Identity Security

The abundance of resource-constrained devices among the advanced communication infrastructures has made the existing protocol incompatible for diverse real-time applications like IoT and smart grid. Therefore, the demand for lightweight solutions is on the peak, IBC is one of them. It is a new way to solve these problems without any complex computation. That is why it has grabbed the attention of the researchers. For achieving confidentiality, the personal information for identification should be sent via a secure channel. The respectiveUi has the private key corresponding to his/her own IDi. Also, identity security includes the availability of identity. If a Ui’s identity is revoked by GWN, even then, the Ui has control over his IDi and the relevant claims, which states that the Ui still can use his/her IDi in other applications.


#### 7.1.2. Key Agreement

After completing the successful process of mutual authentication, a common session keySK is shared between the users. This shared session key is established through SKab=hMIDakMIDbkIDGWNkk. Hence, our scheme offers a successful key agreement.


#### 7.1.3. Mutual Authentication

In our introduced scheme, theGWN can authenticate Ua by verifying autha=?hIDa∥MIDb∥IDGWN∥Va. The values IDa,MIDb,IDGWN,Va are only known to valid Ua, as an adversary cannot calculate all these values. So, only legitimate user Ua can be authenticated by GWN. Likewise, GWN authenticates the other user. Similarly, user Ua can also authenticate GWN by verifying authGWN=?hIDa∥IDGWN∥Va∥MGWN. The values IDa,IDGWN,Va,MGWN are only known to valid Ua. As adversary cannot calculate all these values, so only the legitimate GWN can be authenticated by Ua. Likewise, other users can authenticate GWN. Thus, it is proved that our introduced scheme offers mutual authentication between users and GWN.


#### 7.1.4. User Anonymity

During the login and authentication stage, the identity ofIDa of user Ua is not transmitted in plain text; instead, the pseudoidentity PIDa is sent over the public channel. Furthermore, the identity of Ua is not stored in temper proof onboard memory/storage. That is why adversary cannot retrieve the identity of Ua without having the private key. So, our proposed scheme provide user anonymity.


#### 7.1.5. User Untraceability

During the design of the authentication scheme, untraceability is considered as an important factor. The proposed scheme provides user’s untraceability because in each login sessionUa computes unique PIDa, it is clear that Ua does not transmit the same dynamic identity instead every time session-specific random number is used to calculate PIDa. So, it cannot be guessed by any adversary that two different sessions are established by the same or different users.


#### 7.1.6. Perfect Forward Secrecy

In our introduced scheme, ifUAadv is able to know the secret parameters such as the secret key of GWN, even then, he cannot determine the former session keys. In the proposed scheme, arbitrary numbers la1,la2 are used to compute the valid value of k that is further used in the computation of SKab. Due to the usage of random numbers, different session keys are generated in each session. So, even after getting the secret parameter, the adversary cannot guess the previous session keys.


#### 7.1.7. Backward Secrecy

In the introduced scheme, ifUAadv is able to find the secret parameters of GWN, even then, he cannot find the future sessions. In the proposed scheme, the calculation of valid Skab requires arbitrary number la1,la2. Due to these random numbers, the session key is specific for every session; thus, UAadv cannot find future session keys.


#### 7.1.8. Privileged Insider and Stolen Verifier Attack

During the registration phase,Ui transmit IDi and li1 through the private channel to GWN, where arbitrary number li1 is generated by Ui. Furthermore, for Ui’s identity, no table is preserved, for authentication GWN uses x his secret key. Thus, no insider UAadv can get access to the user’s identity and credentials. Hence, the introduced scheme resists stolen verifiers and privileged insider attacks.


#### 7.1.9. User Masquerading Attack

SupposeUAadv tries to masquerade a legal Ua by means of sending a legal login request message on behalf of Ua to the GWN. In order to produce an original login message autha,Qa,PIDa, the adversary needs to calculate valid autha=hIDa∥MIDb∥IDGWN∥Va. It is not possible for the adversary to calculate autha because UAadv does not know IDa of Ua. Likewise, the other user is also secured from impersonating by an adversary. So, the proposed scheme has the ability to withstand the user masquerading attack.


#### 7.1.10.GWN Masquerading Attack

Suppose an attackerUAadv tries to impersonate a legal server GWN by means of sending a legal challenge message on the behalf of GWN to the user. In order to produce an original challenge message authGWN,Qa,NGWN, the adversary needs to calculate the valid authGWN1=?hIDa∥IDGWN∥Va∥MGWN. However, this operation is computationally expensive because for determining Va=hx∥MIDa, it needs a private key of GWN. So, the proposed scheme has the ability to withstand the user masquerading attack.


#### 7.1.11. Man-in-the-Middle Attack (MITM)

SupposeUAadv forges the login message autha,Qa,PIDa sent by Ua to GWN, still, any tampering in the login request message will easily be identified while determining autha=hIDa∥MIDb∥IDGWN∥Va. UAadv requires the user’s identity which is unknown to adversary. Likewise, the other user is also secure against this attack. So, the proposed scheme is secured against MITM.


#### 7.1.12. Replay Attack

IfUAadv intercepts the request message autha,Qa,PIDa of Ui and later replays the intercept message, the calculation of Qa and PIDa includes a random number la which is session specific. Because of the random number, the values of the entities will always be different for every session. Hence, a replay attack is not possible on the proposed scheme.


#### 7.1.13. Parallel Session Attack

Suppose the scheme’s parallel session is tried to be constructed byUAadv, but this scenario is not possible in the proposed scheme as a unique identity is utilized. Therefore, even one valid session cannot be run by UAadv to masquerade a legitimate user. Thus, a parallel session attack can be efficiently resisted by the proposed scheme.


#### 7.1.14. No Clock Synchronization

In the proposed scheme, session-specific random numbers are used in every session instead of a time stamp. So, no clock synchronization is required.


### 7.2. Formal Security Analysis

In this subsection, we prove that our scheme is AKA-Secure if the ECDHP is a hard problem. We present this proof under the (BRP) [64, 65] and Abdalla et al.’s [66] security model.Theorem 2.
Let the proposed scheme be denoted asPp. If UAadv is an attacker who builds at most qsendSend queries, qrvlReveal queries, qexeExecute queries, qhashHash queries and succeed the game having benefit AdvPpAKAUAadv, then an algorithm that should be existed, which can efficiently resolve ECDHP hard problem on group G having benefit AdvGECDHP, where
(13)AdvPpAKA≤qhash22l−1+qsend2l−2+qsend+qexe2P+qsend+qexe2P+2qhashAdvGpECDHPProof.
Suppose, for the base pointG and elliptic group Ep there exists an ECDHP instance P,aP,bP, we make a challenge Cr who wishes to calculate abp using UAadv as a function. The function that is taken as an arbitrary oracle in the proposed scheme is referred to as hash h(.). In order to record the hash queries and their answer, Cr maintains a hash list and is referred to as a Lhash. To make it simple, we use three transcripts between entities, which are as follows:
(14)mUa=autha,Qa,PIDa,mUb=authb,Qb,PIDb,mGWN=authGWN1,Qb,NGWN1,authGWN2,Qa,NGWN2
After simulating the scheme,Crs answers the queries questioned by UAadvs as follows:
(i)
Hash Query. after getting the hash query with input m from UAadv, Cr scans the LHash.Cr returns r to UAadv if entry m,r∈LHash; otherwise, Cr selects r randomly and gives r back to UAadv and adds m,r in to LHash(ii)
Send Query.
(1)
Cr simulates UAadv’s response in the following way after getting SendUAadv,Start: selects a random numbers la1,la2 and computes Qa=la2G, PIDa=IDa∥MIDb⊕la2.pub, autha=hIDa∥MIDb∥IDGWN∥Va and returns back autha,Qa,PIDa as response(2)
Upon the reception of querySendUb,autha,Qa,PIDa, assume that Ub is in accurate state. Ub′s response is simulated by Cr as follows: selects random numbers lb1,lb2 and computes Qb=lb2G, PIDb=IDb∥MIDa⊕lb2pub, authb=hIDb∥MIDb∥IDGWN∥Vb and returns back authb,Qb,PIDb as response(3)
Upon gettingSendGWNautha,Qa,PIDa, suppose that GWN is in true state, then the response of Send query is simulated by Cr as follows: computes xQa=la2xG=la2pub, IDa∥MIDb=PIDa⊕la2pub,MIDa=hIDa, and autha=hIDa∥MIDb∥IDGWN∥hx∥MIDa. Furthermore, GWN generates lGWN and computes NGWN1=MGWN⊕Va, authGWN1=hIDa∥IDGWN∥Va∥MGWN and response back with authGWN1,Qb,NGWN1.(4)
After receiving querySendGWN,authb,Qb,PIDb and assuming GWN as a correct state, Cr simulates GWN’s response as follows: computes xQb=lb2xG=lb2pub, IDb∥MIDa=PIDb⊕lb2pub,MIDb=hIDb and verifies authb=hIDb∥MIDa∥IDGWN∥hx∥MIDb. Furthermore, generate lGWN and compute NGWN2=MGWN⊕Vb, authGWN2=hIDb∥IDGWN∥Vb∥MGWN, and return authGWNa,Qa,NGWN2 as response(5)
In the end, the session key is shared among the participants if checksauthGWN1=?hIDa∥IDGWN∥Va∥MGWN and authGWN2=?hIDb∥IDGWN∥Vb∥MGWN are hold true. Otherwise, the session will be terminated(iii)
Execute Query. While getting execute query Ua,GWN,Ub, Cr simulates the send query as follows:(15)mUag=SendUa,Start,mUbg=SendUb,mUa,mgUaUb=SendGWN,mUag,mUbg
Cr returns mUag, mUbg and mgUaUb as an answer.
(iv)
Corrupt Query.
(1)
On getting a queryCorruptUi,IDi, Cr responds Vi=hx∥MIDi(2)
On receiving queryCorruptGWN,Vi, Cr responds all information stored in temper proof onboard storage/memory(v)
Reveal query: after getting a query RevealUi, Cr responds SKab if the instance is accepted; otherwise, ⊥ will be responded.(vi)
Test query: upon the reception of query TestUi, toss up a coin b∈0,1. The right session key SKab will be returned if b=1. Otherwise, an arbitrary value of the same size will be returned.A game sequenceGa0,Ga1..⋯Ga5 is defined next. For every game Gai, assume Si is an event that UAadv wins the game, which means UAadv predicted b successfully. The following is the description:GameGa0. This game is the original attack game constructed by (BRP) [64, 65] and Abdalla et al.’s [66] security model, where the hash functions are modeled as a random oracle. According to the definition, we got:
(16)AdvUAadv=∣2PrS0−1∣GameGa1. Ga1 is similar to Ga0, but the difference is that hash queries are entertained by scanning the Lhash by Cr. Ga1 remains indistinguishable from Ga0 until the queries are answered similarly in Ga0. Hence, we got
(17)PrS1=PrS0GameGa2. Ga2 is similar to Ga1. But, the difference is that Ga2’s simulation terminates if subsequent events occur:
(i)
Event_1. Collision of hash queries during simulation.(ii)
Event_2. Collision on the simulation of transcripts mUag,mUbg,mgUaUb.As per the concept of birthday paradox, we gotPrEvent1≤qhash2/2l+1. For transcript mgUaUb, the collision probability of Event2 is qsend+qexe2/2P2, while the probability of collision on the transcript mUa,mUb is qSend+qexe2/2p. We got:
(18)∣PrS2−PrS1∣≤qhash22l+1+qsend+qexe22p2+qsend+qexe22pGameGa3. Ga3 is almost similar to Ga2, but the difference is that, UAadv may know the authentication value autha,authb,authGWN1 and authGWN2 without knowing the hash oracle. Thus, we got
(19)∣PrS3−PrS2∣≤qSend2lGameGa4. In Ga4, Ga3 is modified as follows:
(i)
Ua scans LHash for IDa. If the entries exist, then calculate autha,Qa,PIDa(ii)
GWN verifies the legitimacy of Ua. If it holds, then GWN scans for autha,Qa,PIDa in the Send list. Otherwise, the session aborts. Ga4 will succeed if UAadv guess the authentication parameters without a hash oracle. So(20)∣PrS4−PrS3∣≤qsend2lGAMEGa5. In Ga5, the Ga4 is modified as follows:
(i)
Ua randomly chooses la2 and computes Qa=la2G, PIDa=IDa∥MIDa⊕la2pub, and autha=hIDa∥MIDa∥IDGWN∥Ya⊕hIDa∥la1 and stores autha,Qa,PIDa in LHash(ii)
Ub randomly selects lb2 and computes Qb2=lb2G, PIDb=IDb∥MIDa⊕lb2pub, and authb=h(IDb∥MIDa∥IDGWN∥Yb⊕hIDb∥lb1 and stores authb,Qb,PIDb in LHashNow, the updatedGa5 is indistinguishable from Ga4 until UAadv asks a hash oracle on abP, whose probability is 1/qhash. So
(21)∣PrS5−PrS4∣≤qhashAdvGECDHPGAMEGa6: In this game, if UAadv asks a hash query for abP then test query will be terminated.The probability of obtaining the session key here isqhash2/2l+1, So UAadv has no advantage in Ga6. The resultant of all equations that we got is:
(22)AdvtPpAKA≤qhash22l−1+qsend2l−2+qsend+qexe2P2+qsend+qexe2P+2qhashAdvGECDHP


## 7.1. Informal Security Analysis

The security of the proposed scheme is analyzed informally in this section. The informal security analysis represents the proposed scheme’s correctness and ensures that it resists various attacks.


### 7.1.1. Identity Security

The abundance of resource-constrained devices among the advanced communication infrastructures has made the existing protocol incompatible for diverse real-time applications like IoT and smart grid. Therefore, the demand for lightweight solutions is on the peak, IBC is one of them. It is a new way to solve these problems without any complex computation. That is why it has grabbed the attention of the researchers. For achieving confidentiality, the personal information for identification should be sent via a secure channel. The respectiveUi has the private key corresponding to his/her own IDi. Also, identity security includes the availability of identity. If a Ui’s identity is revoked by GWN, even then, the Ui has control over his IDi and the relevant claims, which states that the Ui still can use his/her IDi in other applications.


### 7.1.2. Key Agreement

After completing the successful process of mutual authentication, a common session keySK is shared between the users. This shared session key is established through SKab=hMIDakMIDbkIDGWNkk. Hence, our scheme offers a successful key agreement.


### 7.1.3. Mutual Authentication

In our introduced scheme, theGWN can authenticate Ua by verifying autha=?hIDa∥MIDb∥IDGWN∥Va. The values IDa,MIDb,IDGWN,Va are only known to valid Ua, as an adversary cannot calculate all these values. So, only legitimate user Ua can be authenticated by GWN. Likewise, GWN authenticates the other user. Similarly, user Ua can also authenticate GWN by verifying authGWN=?hIDa∥IDGWN∥Va∥MGWN. The values IDa,IDGWN,Va,MGWN are only known to valid Ua. As adversary cannot calculate all these values, so only the legitimate GWN can be authenticated by Ua. Likewise, other users can authenticate GWN. Thus, it is proved that our introduced scheme offers mutual authentication between users and GWN.


### 7.1.4. User Anonymity

During the login and authentication stage, the identity ofIDa of user Ua is not transmitted in plain text; instead, the pseudoidentity PIDa is sent over the public channel. Furthermore, the identity of Ua is not stored in temper proof onboard memory/storage. That is why adversary cannot retrieve the identity of Ua without having the private key. So, our proposed scheme provide user anonymity.


### 7.1.5. User Untraceability

During the design of the authentication scheme, untraceability is considered as an important factor. The proposed scheme provides user’s untraceability because in each login sessionUa computes unique PIDa, it is clear that Ua does not transmit the same dynamic identity instead every time session-specific random number is used to calculate PIDa. So, it cannot be guessed by any adversary that two different sessions are established by the same or different users.


### 7.1.6. Perfect Forward Secrecy

In our introduced scheme, ifUAadv is able to know the secret parameters such as the secret key of GWN, even then, he cannot determine the former session keys. In the proposed scheme, arbitrary numbers la1,la2 are used to compute the valid value of k that is further used in the computation of SKab. Due to the usage of random numbers, different session keys are generated in each session. So, even after getting the secret parameter, the adversary cannot guess the previous session keys.


### 7.1.7. Backward Secrecy

In the introduced scheme, ifUAadv is able to find the secret parameters of GWN, even then, he cannot find the future sessions. In the proposed scheme, the calculation of valid Skab requires arbitrary number la1,la2. Due to these random numbers, the session key is specific for every session; thus, UAadv cannot find future session keys.


### 7.1.8. Privileged Insider and Stolen Verifier Attack

During the registration phase,Ui transmit IDi and li1 through the private channel to GWN, where arbitrary number li1 is generated by Ui. Furthermore, for Ui’s identity, no table is preserved, for authentication GWN uses x his secret key. Thus, no insider UAadv can get access to the user’s identity and credentials. Hence, the introduced scheme resists stolen verifiers and privileged insider attacks.


### 7.1.9. User Masquerading Attack

SupposeUAadv tries to masquerade a legal Ua by means of sending a legal login request message on behalf of Ua to the GWN. In order to produce an original login message autha,Qa,PIDa, the adversary needs to calculate valid autha=hIDa∥MIDb∥IDGWN∥Va. It is not possible for the adversary to calculate autha because UAadv does not know IDa of Ua. Likewise, the other user is also secured from impersonating by an adversary. So, the proposed scheme has the ability to withstand the user masquerading attack.


### 7.1.10.GWN Masquerading Attack

Suppose an attackerUAadv tries to impersonate a legal server GWN by means of sending a legal challenge message on the behalf of GWN to the user. In order to produce an original challenge message authGWN,Qa,NGWN, the adversary needs to calculate the valid authGWN1=?hIDa∥IDGWN∥Va∥MGWN. However, this operation is computationally expensive because for determining Va=hx∥MIDa, it needs a private key of GWN. So, the proposed scheme has the ability to withstand the user masquerading attack.


### 7.1.11. Man-in-the-Middle Attack (MITM)

SupposeUAadv forges the login message autha,Qa,PIDa sent by Ua to GWN, still, any tampering in the login request message will easily be identified while determining autha=hIDa∥MIDb∥IDGWN∥Va. UAadv requires the user’s identity which is unknown to adversary. Likewise, the other user is also secure against this attack. So, the proposed scheme is secured against MITM.


### 7.1.12. Replay Attack

IfUAadv intercepts the request message autha,Qa,PIDa of Ui and later replays the intercept message, the calculation of Qa and PIDa includes a random number la which is session specific. Because of the random number, the values of the entities will always be different for every session. Hence, a replay attack is not possible on the proposed scheme.


### 7.1.13. Parallel Session Attack

Suppose the scheme’s parallel session is tried to be constructed byUAadv, but this scenario is not possible in the proposed scheme as a unique identity is utilized. Therefore, even one valid session cannot be run by UAadv to masquerade a legitimate user. Thus, a parallel session attack can be efficiently resisted by the proposed scheme.


### 7.1.14. No Clock Synchronization

In the proposed scheme, session-specific random numbers are used in every session instead of a time stamp. So, no clock synchronization is required.


## 7.1.1. Identity Security

The abundance of resource-constrained devices among the advanced communication infrastructures has made the existing protocol incompatible for diverse real-time applications like IoT and smart grid. Therefore, the demand for lightweight solutions is on the peak, IBC is one of them. It is a new way to solve these problems without any complex computation. That is why it has grabbed the attention of the researchers. For achieving confidentiality, the personal information for identification should be sent via a secure channel. The respectiveUi has the private key corresponding to his/her own IDi. Also, identity security includes the availability of identity. If a Ui’s identity is revoked by GWN, even then, the Ui has control over his IDi and the relevant claims, which states that the Ui still can use his/her IDi in other applications.


## 7.1.2. Key Agreement

After completing the successful process of mutual authentication, a common session keySK is shared between the users. This shared session key is established through SKab=hMIDakMIDbkIDGWNkk. Hence, our scheme offers a successful key agreement.


## 7.1.3. Mutual Authentication

In our introduced scheme, theGWN can authenticate Ua by verifying autha=?hIDa∥MIDb∥IDGWN∥Va. The values IDa,MIDb,IDGWN,Va are only known to valid Ua, as an adversary cannot calculate all these values. So, only legitimate user Ua can be authenticated by GWN. Likewise, GWN authenticates the other user. Similarly, user Ua can also authenticate GWN by verifying authGWN=?hIDa∥IDGWN∥Va∥MGWN. The values IDa,IDGWN,Va,MGWN are only known to valid Ua. As adversary cannot calculate all these values, so only the legitimate GWN can be authenticated by Ua. Likewise, other users can authenticate GWN. Thus, it is proved that our introduced scheme offers mutual authentication between users and GWN.


## 7.1.4. User Anonymity

During the login and authentication stage, the identity ofIDa of user Ua is not transmitted in plain text; instead, the pseudoidentity PIDa is sent over the public channel. Furthermore, the identity of Ua is not stored in temper proof onboard memory/storage. That is why adversary cannot retrieve the identity of Ua without having the private key. So, our proposed scheme provide user anonymity.


## 7.1.5. User Untraceability

During the design of the authentication scheme, untraceability is considered as an important factor. The proposed scheme provides user’s untraceability because in each login sessionUa computes unique PIDa, it is clear that Ua does not transmit the same dynamic identity instead every time session-specific random number is used to calculate PIDa. So, it cannot be guessed by any adversary that two different sessions are established by the same or different users.


## 7.1.6. Perfect Forward Secrecy

In our introduced scheme, ifUAadv is able to know the secret parameters such as the secret key of GWN, even then, he cannot determine the former session keys. In the proposed scheme, arbitrary numbers la1,la2 are used to compute the valid value of k that is further used in the computation of SKab. Due to the usage of random numbers, different session keys are generated in each session. So, even after getting the secret parameter, the adversary cannot guess the previous session keys.


## 7.1.7. Backward Secrecy

In the introduced scheme, ifUAadv is able to find the secret parameters of GWN, even then, he cannot find the future sessions. In the proposed scheme, the calculation of valid Skab requires arbitrary number la1,la2. Due to these random numbers, the session key is specific for every session; thus, UAadv cannot find future session keys.


## 7.1.8. Privileged Insider and Stolen Verifier Attack

During the registration phase,Ui transmit IDi and li1 through the private channel to GWN, where arbitrary number li1 is generated by Ui. Furthermore, for Ui’s identity, no table is preserved, for authentication GWN uses x his secret key. Thus, no insider UAadv can get access to the user’s identity and credentials. Hence, the introduced scheme resists stolen verifiers and privileged insider attacks.


## 7.1.9. User Masquerading Attack

SupposeUAadv tries to masquerade a legal Ua by means of sending a legal login request message on behalf of Ua to the GWN. In order to produce an original login message autha,Qa,PIDa, the adversary needs to calculate valid autha=hIDa∥MIDb∥IDGWN∥Va. It is not possible for the adversary to calculate autha because UAadv does not know IDa of Ua. Likewise, the other user is also secured from impersonating by an adversary. So, the proposed scheme has the ability to withstand the user masquerading attack.


## 7.1.10.GWN Masquerading Attack

Suppose an attackerUAadv tries to impersonate a legal server GWN by means of sending a legal challenge message on the behalf of GWN to the user. In order to produce an original challenge message authGWN,Qa,NGWN, the adversary needs to calculate the valid authGWN1=?hIDa∥IDGWN∥Va∥MGWN. However, this operation is computationally expensive because for determining Va=hx∥MIDa, it needs a private key of GWN. So, the proposed scheme has the ability to withstand the user masquerading attack.


## 7.1.11. Man-in-the-Middle Attack (MITM)

SupposeUAadv forges the login message autha,Qa,PIDa sent by Ua to GWN, still, any tampering in the login request message will easily be identified while determining autha=hIDa∥MIDb∥IDGWN∥Va. UAadv requires the user’s identity which is unknown to adversary. Likewise, the other user is also secure against this attack. So, the proposed scheme is secured against MITM.


## 7.1.12. Replay Attack

IfUAadv intercepts the request message autha,Qa,PIDa of Ui and later replays the intercept message, the calculation of Qa and PIDa includes a random number la which is session specific. Because of the random number, the values of the entities will always be different for every session. Hence, a replay attack is not possible on the proposed scheme.


## 7.1.13. Parallel Session Attack

Suppose the scheme’s parallel session is tried to be constructed byUAadv, but this scenario is not possible in the proposed scheme as a unique identity is utilized. Therefore, even one valid session cannot be run by UAadv to masquerade a legitimate user. Thus, a parallel session attack can be efficiently resisted by the proposed scheme.


## 7.1.14. No Clock Synchronization

In the proposed scheme, session-specific random numbers are used in every session instead of a time stamp. So, no clock synchronization is required.


## 7.2. Formal Security Analysis

In this subsection, we prove that our scheme is AKA-Secure if the ECDHP is a hard problem. We present this proof under the (BRP) [64, 65] and Abdalla et al.’s [66] security model.Theorem 2.
Let the proposed scheme be denoted asPp. If UAadv is an attacker who builds at most qsendSend queries, qrvlReveal queries, qexeExecute queries, qhashHash queries and succeed the game having benefit AdvPpAKAUAadv, then an algorithm that should be existed, which can efficiently resolve ECDHP hard problem on group G having benefit AdvGECDHP, where
(13)AdvPpAKA≤qhash22l−1+qsend2l−2+qsend+qexe2P+qsend+qexe2P+2qhashAdvGpECDHPProof.
Suppose, for the base pointG and elliptic group Ep there exists an ECDHP instance P,aP,bP, we make a challenge Cr who wishes to calculate abp using UAadv as a function. The function that is taken as an arbitrary oracle in the proposed scheme is referred to as hash h(.). In order to record the hash queries and their answer, Cr maintains a hash list and is referred to as a Lhash. To make it simple, we use three transcripts between entities, which are as follows:
(14)mUa=autha,Qa,PIDa,mUb=authb,Qb,PIDb,mGWN=authGWN1,Qb,NGWN1,authGWN2,Qa,NGWN2
After simulating the scheme,Crs answers the queries questioned by UAadvs as follows:
(i)
Hash Query. after getting the hash query with input m from UAadv, Cr scans the LHash.Cr returns r to UAadv if entry m,r∈LHash; otherwise, Cr selects r randomly and gives r back to UAadv and adds m,r in to LHash(ii)
Send Query.
(1)
Cr simulates UAadv’s response in the following way after getting SendUAadv,Start: selects a random numbers la1,la2 and computes Qa=la2G, PIDa=IDa∥MIDb⊕la2.pub, autha=hIDa∥MIDb∥IDGWN∥Va and returns back autha,Qa,PIDa as response(2)
Upon the reception of querySendUb,autha,Qa,PIDa, assume that Ub is in accurate state. Ub′s response is simulated by Cr as follows: selects random numbers lb1,lb2 and computes Qb=lb2G, PIDb=IDb∥MIDa⊕lb2pub, authb=hIDb∥MIDb∥IDGWN∥Vb and returns back authb,Qb,PIDb as response(3)
Upon gettingSendGWNautha,Qa,PIDa, suppose that GWN is in true state, then the response of Send query is simulated by Cr as follows: computes xQa=la2xG=la2pub, IDa∥MIDb=PIDa⊕la2pub,MIDa=hIDa, and autha=hIDa∥MIDb∥IDGWN∥hx∥MIDa. Furthermore, GWN generates lGWN and computes NGWN1=MGWN⊕Va, authGWN1=hIDa∥IDGWN∥Va∥MGWN and response back with authGWN1,Qb,NGWN1.(4)
After receiving querySendGWN,authb,Qb,PIDb and assuming GWN as a correct state, Cr simulates GWN’s response as follows: computes xQb=lb2xG=lb2pub, IDb∥MIDa=PIDb⊕lb2pub,MIDb=hIDb and verifies authb=hIDb∥MIDa∥IDGWN∥hx∥MIDb. Furthermore, generate lGWN and compute NGWN2=MGWN⊕Vb, authGWN2=hIDb∥IDGWN∥Vb∥MGWN, and return authGWNa,Qa,NGWN2 as response(5)
In the end, the session key is shared among the participants if checksauthGWN1=?hIDa∥IDGWN∥Va∥MGWN and authGWN2=?hIDb∥IDGWN∥Vb∥MGWN are hold true. Otherwise, the session will be terminated(iii)
Execute Query. While getting execute query Ua,GWN,Ub, Cr simulates the send query as follows:(15)mUag=SendUa,Start,mUbg=SendUb,mUa,mgUaUb=SendGWN,mUag,mUbg
Cr returns mUag, mUbg and mgUaUb as an answer.
(iv)
Corrupt Query.
(1)
On getting a queryCorruptUi,IDi, Cr responds Vi=hx∥MIDi(2)
On receiving queryCorruptGWN,Vi, Cr responds all information stored in temper proof onboard storage/memory(v)
Reveal query: after getting a query RevealUi, Cr responds SKab if the instance is accepted; otherwise, ⊥ will be responded.(vi)
Test query: upon the reception of query TestUi, toss up a coin b∈0,1. The right session key SKab will be returned if b=1. Otherwise, an arbitrary value of the same size will be returned.A game sequenceGa0,Ga1..⋯Ga5 is defined next. For every game Gai, assume Si is an event that UAadv wins the game, which means UAadv predicted b successfully. The following is the description:GameGa0. This game is the original attack game constructed by (BRP) [64, 65] and Abdalla et al.’s [66] security model, where the hash functions are modeled as a random oracle. According to the definition, we got:
(16)AdvUAadv=∣2PrS0−1∣GameGa1. Ga1 is similar to Ga0, but the difference is that hash queries are entertained by scanning the Lhash by Cr. Ga1 remains indistinguishable from Ga0 until the queries are answered similarly in Ga0. Hence, we got
(17)PrS1=PrS0GameGa2. Ga2 is similar to Ga1. But, the difference is that Ga2’s simulation terminates if subsequent events occur:
(i)
Event_1. Collision of hash queries during simulation.(ii)
Event_2. Collision on the simulation of transcripts mUag,mUbg,mgUaUb.As per the concept of birthday paradox, we gotPrEvent1≤qhash2/2l+1. For transcript mgUaUb, the collision probability of Event2 is qsend+qexe2/2P2, while the probability of collision on the transcript mUa,mUb is qSend+qexe2/2p. We got:
(18)∣PrS2−PrS1∣≤qhash22l+1+qsend+qexe22p2+qsend+qexe22pGameGa3. Ga3 is almost similar to Ga2, but the difference is that, UAadv may know the authentication value autha,authb,authGWN1 and authGWN2 without knowing the hash oracle. Thus, we got
(19)∣PrS3−PrS2∣≤qSend2lGameGa4. In Ga4, Ga3 is modified as follows:
(i)
Ua scans LHash for IDa. If the entries exist, then calculate autha,Qa,PIDa(ii)
GWN verifies the legitimacy of Ua. If it holds, then GWN scans for autha,Qa,PIDa in the Send list. Otherwise, the session aborts. Ga4 will succeed if UAadv guess the authentication parameters without a hash oracle. So(20)∣PrS4−PrS3∣≤qsend2lGAMEGa5. In Ga5, the Ga4 is modified as follows:
(i)
Ua randomly chooses la2 and computes Qa=la2G, PIDa=IDa∥MIDa⊕la2pub, and autha=hIDa∥MIDa∥IDGWN∥Ya⊕hIDa∥la1 and stores autha,Qa,PIDa in LHash(ii)
Ub randomly selects lb2 and computes Qb2=lb2G, PIDb=IDb∥MIDa⊕lb2pub, and authb=h(IDb∥MIDa∥IDGWN∥Yb⊕hIDb∥lb1 and stores authb,Qb,PIDb in LHashNow, the updatedGa5 is indistinguishable from Ga4 until UAadv asks a hash oracle on abP, whose probability is 1/qhash. So
(21)∣PrS5−PrS4∣≤qhashAdvGECDHPGAMEGa6: In this game, if UAadv asks a hash query for abP then test query will be terminated.The probability of obtaining the session key here isqhash2/2l+1, So UAadv has no advantage in Ga6. The resultant of all equations that we got is:
(22)AdvtPpAKA≤qhash22l−1+qsend2l−2+qsend+qexe2P2+qsend+qexe2P+2qhashAdvGECDHP


## 8. Functionality Comparison and Performance Analysis

In this section, we compared our proposed scheme with related schemes [67–73] in terms of resource utilization (storage, communication, and computation cost) and security functionality. The detailed description is as follows.


### 8.1. Computational Overhead Comparison

We have evaluated our scheme and related schemes to determine the computational efficiency. For this purpose, we have considered hash functionh. and point multiplication PM. Cryptographic operations have been implemented at the server end on a desktop device, whereas operations at Ui end are implemented using a mobile device. The specifications of both devices are listed in Tables 2 and 3.Table 2
Desktop device specifications.
ItemSpecificationProcessori7 3.60 GHzRAM8 GBOperating systemUbuntuTable 3
Mobile device specifications.
ItemSpecificationMobile deviceVivo S1ProcessorOcta-CoreROM128 GBRAM6 GBThe time taken by hash and point multiplication on the system is 0.001032 and 0.002672 milliseconds (ms), respectively, whereas the time taken by hash and point multiplication on the system is 4 and 8 milliseconds (ms), respectively. The computation cost of the related and proposed schemes [67–73] is presented in Table 4. Table 4 shows that the proposed scheme requires 44.0094 ms for computation. The time required by [67–73] is also mentioned in Table 4.Table 4
Computation Cost of Proposed and Related Schemes.
SchemesNo. of operations atUiNo. of operation atGWNTotal no. of operationsTotal time (ms)Ours5h.+3PM4h.+2PM9h.+5PM44.0094He et al. [67]6h.+4PM8h.+8PM14h.+12PM56.0296Challa et al. [68]8h.+5PM4h.+4PM12h.+9PM72.0148Ma et al. [69]4h.+3PM9h.+6PM13h.+9PM40.0253Taher et al. [70]9h.6h.15h.36.0062Chandrakar and Om [71]11h.+4PM6h.+4PM17h.+8PM76.0169Lu et al. [72]8h.+4PM6h.+1PM14h.+5PM64.0088Mo and Chen [73]13h.+1PM10h.23h.+1PM60.0103If we present the Table4 results graphically we can observe the proposed scheme is efficient in terms of computation as compared to [67, 68, 71–73] and slightly greater than [69, 70].In Figure4, the vertical axis (Y-axis) shows the time required in millisecond (ms), whereas schemes are presented on horizontal axis (X-axis). Figure 4 visually demonstrates the total time taken for the computation of the operations.Figure 4
Comparison of the proposed and related scheme computation overhead.


### 8.2. Communicational Overhead Comparison

We compared our proposed scheme with the related schemes [67–73] in terms of communicational expenses in this subsection. The communication structure of the proposed and related schemes [67–73] is demonstrated in Table 5 on the basis of scheme architecture. The communication structure in Table 5 shows the way in which communicating entities interact with each other and how they exchange messages. In Table 5, the symbol represents Ui: users, Sj: sensor node, TA: trusted authority, CS: server.Table 5
Communication structure.
SchemesCommunication structureOursUi→GWN→UiHe et al. [67]Ui→Sj→GWN→Sj→UiChalla et al. [68]Ui→TA→SjMa et al. [69]Ui→Sj→CS→Sj→UiTaher et al. [70]Ui,Sj→GWN→Ui,SjChandrakar and Om [71]Ui→GWN→Sj→GWN→UiLu et al. [72]Ui→GWN→Sj→UiMo and Chen [73]Ui→GWN→Sj→GWN→UiConsidering the communication structure demonstrated the Table5, we computed the communication cost as presented in Table 6. For conventional comparison, we assumed identities (IDi, IDGWNs), random numbers, and point multiplication require 160 bits respectively, whereas we assumed 256 bits for hash, secrete, and public keys (x,Pub). The total bits required for communication by the proposed scheme is 2016 bits, whereas Table 6 shows the proposed scheme requires the least number of bits as compared to the related schemes [67–73].Table 6
Communication cost of the proposed and related schemes.
SchemesNo. of messages exchangedCost of registration phaseCost of login authenticationTotal costOurs367213442016He et al. [67]692837764704Challa et al. [68]551229763488Ma et al. [69]883247045536Taher et al. [70]8339254408832Chandrakar and Om [71]8236833605728Lu et al. [72]567229443616Mo and Chen [73]6211245046616The time taken for communication stated in Table6 is graphically presented in Figure 5. The bits required for communication are displayed on the vertical axis (y-axis) and the schemes on the horizontal axis (x-axis). The proposed scheme requires less number of bits than [67–73] for communication.Figure 5
Comparison of proposed and related scheme communication overhead.


### 8.3. Storage Overhead Comparison

The number of bits required to store parameters in smart devices (i.e., temper proof onboard memory/storage) is referred to as storage cost. In this subsection, we have compared our scheme with related schemes [67–73] for evaluating the storage efficiency. Table 7 depicts the storage cost comparison of proposed and related schemes. It is evident from the table that the proposed scheme’s storage cost is equal to [67] and less than [68–73].Table 7
Storage cost of the proposed and related schemes.
SchemesNo. of bits required for storageOurs672He et al. [67]672Challa et al. [68]1024Ma et al. [69]672Taher et al. [70]1536Chandrakar and Om [71]1856Lu et al. [72]768Mo and Chen [73]2464The storage cost mentioned in Table7 is graphically presented in Figure 6. In Figure 6, the vertical axis (y-axis) presents the number of bits, whereas the horizontal axis (x-axis) presents the schemes. Figure 6 clearly shows that the proposed scheme’s storage cost is less from [68–73] and equals to [67].Figure 6
Comparison of the proposed and related scheme storage overhead.


### 8.4. Security Functionality

In this subsection, we have discussed the proposed and related schemes in terms of security functionality. It is clear from Table8 that the proposed scheme provides aided security as compared to related schemes.Table 8
Security features comparison of the proposed and related schemes.
Security featuresSchemesOurs[67][68][69][70][71][72][73]Mutual authentication••••••••Key agreement••••••••User Untraceability•°••••°•User masquerading attack••••••°•GWN masquerading attack••••••••Man-in-middle attack (MITM)••••••••Parallel session attack•••≈••••Privileged insider and stolen verifier attack••°•••°•Perfect forward secrecy••••••°•No clock synchronization•°°°°°°°• resists, ° not resists, ≈ not applicable.Upon evaluating Tables4, 6–8 we can state that the proposed scheme is efficient in terms of resource utilization; also, the proposed scheme provides aided and reliable security features. Thus, minimum resource utilization and enhanced security features make the proposed authentication scheme efficient and suitable for the underlying infrastructure.


## 8.1. Computational Overhead Comparison

We have evaluated our scheme and related schemes to determine the computational efficiency. For this purpose, we have considered hash functionh. and point multiplication PM. Cryptographic operations have been implemented at the server end on a desktop device, whereas operations at Ui end are implemented using a mobile device. The specifications of both devices are listed in Tables 2 and 3.Table 2
Desktop device specifications.
ItemSpecificationProcessori7 3.60 GHzRAM8 GBOperating systemUbuntuTable 3
Mobile device specifications.
ItemSpecificationMobile deviceVivo S1ProcessorOcta-CoreROM128 GBRAM6 GBThe time taken by hash and point multiplication on the system is 0.001032 and 0.002672 milliseconds (ms), respectively, whereas the time taken by hash and point multiplication on the system is 4 and 8 milliseconds (ms), respectively. The computation cost of the related and proposed schemes [67–73] is presented in Table 4. Table 4 shows that the proposed scheme requires 44.0094 ms for computation. The time required by [67–73] is also mentioned in Table 4.Table 4
Computation Cost of Proposed and Related Schemes.
SchemesNo. of operations atUiNo. of operation atGWNTotal no. of operationsTotal time (ms)Ours5h.+3PM4h.+2PM9h.+5PM44.0094He et al. [67]6h.+4PM8h.+8PM14h.+12PM56.0296Challa et al. [68]8h.+5PM4h.+4PM12h.+9PM72.0148Ma et al. [69]4h.+3PM9h.+6PM13h.+9PM40.0253Taher et al. [70]9h.6h.15h.36.0062Chandrakar and Om [71]11h.+4PM6h.+4PM17h.+8PM76.0169Lu et al. [72]8h.+4PM6h.+1PM14h.+5PM64.0088Mo and Chen [73]13h.+1PM10h.23h.+1PM60.0103If we present the Table4 results graphically we can observe the proposed scheme is efficient in terms of computation as compared to [67, 68, 71–73] and slightly greater than [69, 70].In Figure4, the vertical axis (Y-axis) shows the time required in millisecond (ms), whereas schemes are presented on horizontal axis (X-axis). Figure 4 visually demonstrates the total time taken for the computation of the operations.Figure 4
Comparison of the proposed and related scheme computation overhead.


## 8.2. Communicational Overhead Comparison

We compared our proposed scheme with the related schemes [67–73] in terms of communicational expenses in this subsection. The communication structure of the proposed and related schemes [67–73] is demonstrated in Table 5 on the basis of scheme architecture. The communication structure in Table 5 shows the way in which communicating entities interact with each other and how they exchange messages. In Table 5, the symbol represents Ui: users, Sj: sensor node, TA: trusted authority, CS: server.Table 5
Communication structure.
SchemesCommunication structureOursUi→GWN→UiHe et al. [67]Ui→Sj→GWN→Sj→UiChalla et al. [68]Ui→TA→SjMa et al. [69]Ui→Sj→CS→Sj→UiTaher et al. [70]Ui,Sj→GWN→Ui,SjChandrakar and Om [71]Ui→GWN→Sj→GWN→UiLu et al. [72]Ui→GWN→Sj→UiMo and Chen [73]Ui→GWN→Sj→GWN→UiConsidering the communication structure demonstrated the Table5, we computed the communication cost as presented in Table 6. For conventional comparison, we assumed identities (IDi, IDGWNs), random numbers, and point multiplication require 160 bits respectively, whereas we assumed 256 bits for hash, secrete, and public keys (x,Pub). The total bits required for communication by the proposed scheme is 2016 bits, whereas Table 6 shows the proposed scheme requires the least number of bits as compared to the related schemes [67–73].Table 6
Communication cost of the proposed and related schemes.
SchemesNo. of messages exchangedCost of registration phaseCost of login authenticationTotal costOurs367213442016He et al. [67]692837764704Challa et al. [68]551229763488Ma et al. [69]883247045536Taher et al. [70]8339254408832Chandrakar and Om [71]8236833605728Lu et al. [72]567229443616Mo and Chen [73]6211245046616The time taken for communication stated in Table6 is graphically presented in Figure 5. The bits required for communication are displayed on the vertical axis (y-axis) and the schemes on the horizontal axis (x-axis). The proposed scheme requires less number of bits than [67–73] for communication.Figure 5
Comparison of proposed and related scheme communication overhead.


## 8.3. Storage Overhead Comparison

The number of bits required to store parameters in smart devices (i.e., temper proof onboard memory/storage) is referred to as storage cost. In this subsection, we have compared our scheme with related schemes [67–73] for evaluating the storage efficiency. Table 7 depicts the storage cost comparison of proposed and related schemes. It is evident from the table that the proposed scheme’s storage cost is equal to [67] and less than [68–73].Table 7
Storage cost of the proposed and related schemes.
SchemesNo. of bits required for storageOurs672He et al. [67]672Challa et al. [68]1024Ma et al. [69]672Taher et al. [70]1536Chandrakar and Om [71]1856Lu et al. [72]768Mo and Chen [73]2464The storage cost mentioned in Table7 is graphically presented in Figure 6. In Figure 6, the vertical axis (y-axis) presents the number of bits, whereas the horizontal axis (x-axis) presents the schemes. Figure 6 clearly shows that the proposed scheme’s storage cost is less from [68–73] and equals to [67].Figure 6
Comparison of the proposed and related scheme storage overhead.


## 8.4. Security Functionality

In this subsection, we have discussed the proposed and related schemes in terms of security functionality. It is clear from Table8 that the proposed scheme provides aided security as compared to related schemes.Table 8
Security features comparison of the proposed and related schemes.
Security featuresSchemesOurs[67][68][69][70][71][72][73]Mutual authentication••••••••Key agreement••••••••User Untraceability•°••••°•User masquerading attack••••••°•GWN masquerading attack••••••••Man-in-middle attack (MITM)••••••••Parallel session attack•••≈••••Privileged insider and stolen verifier attack••°•••°•Perfect forward secrecy••••••°•No clock synchronization•°°°°°°°• resists, ° not resists, ≈ not applicable.Upon evaluating Tables4, 6–8 we can state that the proposed scheme is efficient in terms of resource utilization; also, the proposed scheme provides aided and reliable security features. Thus, minimum resource utilization and enhanced security features make the proposed authentication scheme efficient and suitable for the underlying infrastructure.


## 9. Conclusion

We have proposed an identity-based three-party lightweight remote user authentication scheme, for an IoT environment. We have demonstrated with the help of informal security analysis that the proposed scheme does not let any attacker to penetrate the system. We have shown that the proposed scheme has a vigorous capability to resist various attacks. In addition, formal security proof of the proposed scheme is given using Real-Or-Random (ROR); it shows that there exists secure mutual authentication between the remote users through a gateway in IoT infrastructure. Furthermore, the storage, computation, and communication cost of our scheme is far less than various related schemes. Hence, our proposed scheme is more efficient and reliable for IoT infrastructure as compared to various existing schemes.



---

*Source: 8829319-2020-09-22.xml*