# An Efficient Anonymous Authentication Scheme for Mobile Pay-TV Systems

Authors: Yuting Li; Qingfeng Cheng; Jinzheng Cao
Journal: Wireless Communications and Mobile Computing
 (2020)

---

## Abstract

As a component of mobile communication, the pay-TV system has attracted a lot of attention. By using mobile devices, users interact with the head end system in service providers to acquire TV services. With the growth of mobile users, how to protect the privacy of users while improving efficiency of the network has become an issue worthy of attention. Anonymous authentication schemes for mobile pay-TV systems came into being. In this paper, we analyze the shortcomings of the existing authentication protocol and then propose an improved one, which is secure against stored set attack and user traceability attack. The proposed scheme is proved to be secure. Moreover, our new scheme performs better in efficiency and storage, compared with several other schemes.


---

## Body

## 1. Introduction

With the rapid development of wireless communication technology, pay-TV systems have attracted a lot of attention as a component of mobile communication. According to Ref. [1], the number of users who used the pay-TV system reached 3.45 million in 1994, in England. Four years later, that number has doubled. TV service is developing from socialization to personalization, which means that users are able to watch their favourite TV programs anytime, anywhere. The pay-TV systems can meet the personalized needs of users. These changes have prompted the emergence of many communication systems for mobile TV services [2, 3].In a pay-TV system, there are two entities, a service provider and a user. When a user needs a TV service, she interacts with the head end system (HES) of the service provider. The pay-TV system generally uses a conditional access system (CAS) to handle interactions between end users and service providers. Figure1 shows the main components of CAS, which controls the reception of TV services by encrypting transmission services to ensure that only authorized users can access certain services. The transmitter (TX) and the receiving module (RX) are subsystems responsible for signal transmission and reception, respectively. The multiplexer (MUX) is responsible for multiplexing audio and video into the MPEG-2 transport stream, while the demultiplexer (DEMUX) is responsible for separating audio and video from the MPEG-2 transport stream. The subscriber authorization system (SAS) and subscriber management system (SMS) authorize and manage users separately.Figure 1
Encryption and authentication in conditional access system. Encryption and authentication process are marked in blue.Encryption and authentication play significant roles in CAS for mobile pay-TV systems. Obviously, we can see encryption and authentication processes Figure1. The encryptor and the decryptor are responsible for encryption. When a user needs to obtain a service, she sends subscription and authentication messages to HES. In detail, the encryption keys must be distributed to all subscribers so that they can receive and decrypt the broadcasts they are entitled to under the terms of their subscriptions. Each receiver first filters the corresponding EMM messages and decrypts the SK and then decrypts ECM using SK. After the authorized user gets CW from ECM, she could descramble the content.As for highly distributed mobile TV service delivery architectures [4], cloud computing models are unable to meet demands. The massive data generated by various access devices has made cloud network bandwidth even more limited, causing greater data bottlenecks [5]. For example, delay-sensitive business systems do not work well in cloud computing. These delay-sensitive services are often located at the edge of the data centers and can use nearby computing resources to complete calculations or reduce delays.On the other hand, data generated by the terminal TV devices usually involves personal privacy information. Uploading these data to the cloud data center not only consumes a lot of bandwidth resources but also increases the risk of user privacy leakage [6, 7]. In order to deal with this problem, the user’s identity and password are involved in anonymous authentication protocols. The role of user-generated passwords is becoming more prominent in wireless mobile networks [8]. Two-factor anonymous authentication schemes have been proposed to wireless networks for a long time [9, 10]. Moreover, three-factor authentication and key agreements have also been widely used for cloud environment [11, 12]. Besides, fuzzy commitment with low latency can also be employed to ensure high efficiency [13].In recent years, mobile pay-TV systems have risen in popularity due to their extensive application. The most challenging issue is providing secure authentication [14]. There have been many studies on anonymous authentication schemes used for HES. In Ref. [15], Far and Alagheband designed a lightweight anonymous authentication protocol. We found that this protocol is suffering from the risk of revealing user’s password. Besides, there is still room for improvement in storage. The main contributions of our paper are listed below:
(i)
We reveal Far and Alagheband’s protocol is suffering from the risk of revealing user’s privacy. Besides, there is still room for improvement in storage(ii)
We propose a new efficient anonymous authentication scheme based on Far and Alagheband’s protocol(iii)
The proposed anonymous authentication scheme in the paper performs better in computing efficiency and storage, which is more suitable for resource-constrained devices in edge computing environmentThe rest of the paper is planned as follows. In Section2, we describe related authentication schemes used in pay-TV systems. In Section 3, the preliminaries needed in protocol design are listed. The proposed anonymous authentication scheme is described in detail in Section 4. In Section 5, we give analysis of security proof and security features. Performance comparison is shown in Section 6. The conclusion is given in Section 7.


## 2. Related Work

In this section, we first introduce secure CASs and categorize pay-TV systems in three groups. Encryption-based pay-TV systems are the most classic category. Signature-based pay-TV systems are the most practical application. Authentication schemes for pay-TV systems are the most important point of our attention. Table1 shows the relationships of some related works in chronological order.Table 1
The relationship of related works.
SchemesYearBase articleContributionSong and Korba [29]2003Lee et al. [28]Designed an improved version using RSA blind signature technologyWang and Laith [21]2008Huang et al. [20]Proposed an improved key distribution schemeSun and Leu [34]2009Yang and Chang [31]Designed the first one-to-many authentication schemeWang and Qin [35]2012Sun and Leu [34]Presented an enhanced scheme against impersonation attacksKim and Lee [33]2012Chen et al. [32]Gave an improved version against password guessing attack and impersonation attackArshad et al. [36]2017Wang and Qin [35]Designed an authentication scheme without bilinear pairingsFar and Alagheband [15]2018Chen et al. [32]Proposed a strengthened scheme to alleviate its security risks


### 2.1. Secure CASs

In 1992, ITU first proposed the standards for CASs in pay-TV systems [16]. However, this standard does not provide authentication capabilities for service providers. Since then, in order to further strengthen security, the academic community has proposed some CASs based on symmetric cryptography. In this type of CASs, users must share group keys used to encrypt and decrypt.Zhu proposed a one-to-many CAS [17]. This system adopted the word-counting model for the first time, which improved the overall efficiency of the system to some extent. However, because the number of keys that a user needs to save was directly proportional to the number of related users, the storage and distribution of keys became very complicated, so this type of CASs was not suitable for practical applications. In general, CASs based on symmetric encryption could not avoid complicated key distribution problems. At the same time, such systems could not provide nonrepudiation.In 2019, Pal and Alam proposed a channel package free centralized key distribution scheme, which was based on dynamicity of the groups [18]. The scheme used finite state machine (FSM) and optimal binary search tree (OBST) data, providing leaving and joining mechanisms for both batch users and single user. Recently, Kumar et al. [19] designed a key management protocol for access control for the pay-TV system, using the theory of numbers. The protocol is said to achieve the minimum communication complexity and storage overhead.


### 2.2. Encryption-Based Pay-TV Systems

In 2004, Huang et al. divided users into different groups according to their various preferences, and each group shared the key [20]. However, Wang and Laith found that Huang et al.’s protocol was vulnerable to key leakage attack [21]. To enhance security, they proposed an improved key distribution scheme. In the same year, Sun et al. introduced a four-layer key hierarchy model, supporting more users to make flexible choices [22]. These CASs have a common feature in that one request message corresponds to one reply request, so they cannot respond to multiple requests in a short time. The one-to-many CASs, which can respond to many service requests at the same time, have become a new research direction.In 2005, Yeung et al. constructed a new CAS based on the RSA algorithm. In their protocol, the media service provider and the proxy service provider needed to jointly encrypt the TV programs [23]. Several years later, Yeu and Huang presented an attribute-based encryption-based access control scheme and extended it with a revocation mechanism [24]. However, the scheme was pointed to be vulnerable to collusion attacks by Rial [25].


### 2.3. Signature-Based Pay-TV Systems

As one of the cryptographic primitives, signature provides the integrity and authentication of messages [26, 27]. To solve this kind of problem, Lee et al. proposed an authentication protocol based on digital signature technology [28]. However, this protocol could not provide anonymity for service providers. To strengthen its security, Song and Korba designed an improved version of the authentication protocol, using RSA blind signature technology [29]. Since then, Roh and Jung also adopted RSA-based proxy signature technology and designed a new authentication scheme [30]. However, the communication cost of their scheme was relatively high and it was not suitable for practical application.


### 2.4. Authentication Schemes for Pay-TV Systems

The authentication scheme applicable to pay-TV systems cannot be directly applied to mobile pay-TV systems. Yang and Chang designed an authentication scheme for mobile pay-TV systems using elliptic curve cryptography [31]. However, Chen et al. [32] pointed out that there were security issues in Yang and Chang’s scheme and proposed an anonymous authentication protocol to solve the insecure risks. They claimed that their protocol is better for applications with low power-consuming devices and high security requirements. However, Kim and Lee showed that Chen et al.’s protocol suffers the risks in password guessing attack and impersonation attack and gave an improved version [33]. In 2018, Far and Alagheband also enhanced the security in Chen et al.’s protocol to alleviate its security risks [15].To improve the performance, Sun and Leu designed the first one-to-many authentication scheme in 2009 [34]. The scheme also used elliptic curve cryptography, suitable for access control in mobile pay-TV systems. However, Wang and Qin found that Sun and Leu’s scheme had security risks [35]. The adversary could not only pretend to be a mobile set (MS) to deceive HES but also pretend to be MS to deceive HES. Moreover, Sun and Leu’s scheme could not prevent unauthorized entities from accessing mobile TV programs. In order to strengthen security, Wang and Qin proposed a strengthened authentication protocol and claimed that their protocol could resist various common attacks. Based on Wang and Qin’s scheme [34], Arshad et al. designed an encryption-based authentication scheme for mobile pay-TV. This scheme did not use bilinear pairings and was easily implemented on FPGA boards [36].In 2013, Liu and Zhang designed an identity-based encryption scheme based on bilinear pairings [37]. In addition, the batch verification technique allowed the service provider to authenticate various requests from different subscribers.Sabzinejad et al.’s scheme was also designed using a bilinear pair in 2016 [38]. Its running time was shorter than previous solutions, but it was not suitable for lightweight devices. Kuo proposed an authentication scheme based on smart cards and biometrics for mobile pay-TV, which could be used on lightweight smart card devices for multiserver environments [39]. Wu et al. proposed an authentication scheme based on user signatures for mobile pay-TV, but this scheme could not guarantee user anonymity [40]. Zhu presented a deniable authentication protocol for pay-TV system based on chaotic maps, which is called DAP-TV [41]. In 2020, Kumaravelu et al. [14] designed an anonymous scheme which can authenticate both users and HES, with low computational cost.


## 2.1. Secure CASs

In 1992, ITU first proposed the standards for CASs in pay-TV systems [16]. However, this standard does not provide authentication capabilities for service providers. Since then, in order to further strengthen security, the academic community has proposed some CASs based on symmetric cryptography. In this type of CASs, users must share group keys used to encrypt and decrypt.Zhu proposed a one-to-many CAS [17]. This system adopted the word-counting model for the first time, which improved the overall efficiency of the system to some extent. However, because the number of keys that a user needs to save was directly proportional to the number of related users, the storage and distribution of keys became very complicated, so this type of CASs was not suitable for practical applications. In general, CASs based on symmetric encryption could not avoid complicated key distribution problems. At the same time, such systems could not provide nonrepudiation.In 2019, Pal and Alam proposed a channel package free centralized key distribution scheme, which was based on dynamicity of the groups [18]. The scheme used finite state machine (FSM) and optimal binary search tree (OBST) data, providing leaving and joining mechanisms for both batch users and single user. Recently, Kumar et al. [19] designed a key management protocol for access control for the pay-TV system, using the theory of numbers. The protocol is said to achieve the minimum communication complexity and storage overhead.


## 2.2. Encryption-Based Pay-TV Systems

In 2004, Huang et al. divided users into different groups according to their various preferences, and each group shared the key [20]. However, Wang and Laith found that Huang et al.’s protocol was vulnerable to key leakage attack [21]. To enhance security, they proposed an improved key distribution scheme. In the same year, Sun et al. introduced a four-layer key hierarchy model, supporting more users to make flexible choices [22]. These CASs have a common feature in that one request message corresponds to one reply request, so they cannot respond to multiple requests in a short time. The one-to-many CASs, which can respond to many service requests at the same time, have become a new research direction.In 2005, Yeung et al. constructed a new CAS based on the RSA algorithm. In their protocol, the media service provider and the proxy service provider needed to jointly encrypt the TV programs [23]. Several years later, Yeu and Huang presented an attribute-based encryption-based access control scheme and extended it with a revocation mechanism [24]. However, the scheme was pointed to be vulnerable to collusion attacks by Rial [25].


## 2.3. Signature-Based Pay-TV Systems

As one of the cryptographic primitives, signature provides the integrity and authentication of messages [26, 27]. To solve this kind of problem, Lee et al. proposed an authentication protocol based on digital signature technology [28]. However, this protocol could not provide anonymity for service providers. To strengthen its security, Song and Korba designed an improved version of the authentication protocol, using RSA blind signature technology [29]. Since then, Roh and Jung also adopted RSA-based proxy signature technology and designed a new authentication scheme [30]. However, the communication cost of their scheme was relatively high and it was not suitable for practical application.


## 2.4. Authentication Schemes for Pay-TV Systems

The authentication scheme applicable to pay-TV systems cannot be directly applied to mobile pay-TV systems. Yang and Chang designed an authentication scheme for mobile pay-TV systems using elliptic curve cryptography [31]. However, Chen et al. [32] pointed out that there were security issues in Yang and Chang’s scheme and proposed an anonymous authentication protocol to solve the insecure risks. They claimed that their protocol is better for applications with low power-consuming devices and high security requirements. However, Kim and Lee showed that Chen et al.’s protocol suffers the risks in password guessing attack and impersonation attack and gave an improved version [33]. In 2018, Far and Alagheband also enhanced the security in Chen et al.’s protocol to alleviate its security risks [15].To improve the performance, Sun and Leu designed the first one-to-many authentication scheme in 2009 [34]. The scheme also used elliptic curve cryptography, suitable for access control in mobile pay-TV systems. However, Wang and Qin found that Sun and Leu’s scheme had security risks [35]. The adversary could not only pretend to be a mobile set (MS) to deceive HES but also pretend to be MS to deceive HES. Moreover, Sun and Leu’s scheme could not prevent unauthorized entities from accessing mobile TV programs. In order to strengthen security, Wang and Qin proposed a strengthened authentication protocol and claimed that their protocol could resist various common attacks. Based on Wang and Qin’s scheme [34], Arshad et al. designed an encryption-based authentication scheme for mobile pay-TV. This scheme did not use bilinear pairings and was easily implemented on FPGA boards [36].In 2013, Liu and Zhang designed an identity-based encryption scheme based on bilinear pairings [37]. In addition, the batch verification technique allowed the service provider to authenticate various requests from different subscribers.Sabzinejad et al.’s scheme was also designed using a bilinear pair in 2016 [38]. Its running time was shorter than previous solutions, but it was not suitable for lightweight devices. Kuo proposed an authentication scheme based on smart cards and biometrics for mobile pay-TV, which could be used on lightweight smart card devices for multiserver environments [39]. Wu et al. proposed an authentication scheme based on user signatures for mobile pay-TV, but this scheme could not guarantee user anonymity [40]. Zhu presented a deniable authentication protocol for pay-TV system based on chaotic maps, which is called DAP-TV [41]. In 2020, Kumaravelu et al. [14] designed an anonymous scheme which can authenticate both users and HES, with low computational cost.


## 3. System Model and Security Requirements

In this section, the operating mechanism of mobile pay-TV systems is explained at first. The security features required in anonymous authentication schemes and adversary capabilities are then briefly explained.


### 3.1. Anonymous Authentication Model for Mobile Pay-TV Systems

Table2 shows notations of entities and parameters. The mobile pay-TV system consists of two important components, the head end system (HES) and the mobile set (MS). HES not only has powerful service content processing capabilities but also contains SAS/SMS. SAS/SMS is mainly responsible for authentication and key management, payment management, and subscription information management. MS is a user equipment that can use the mobile Internet connection to HES to obtain TV services.Table 2
Notations of entities and parameters.
EntitiesDescriptionParametersDescriptionHESHead end systemSThe serverMSMobile setUThe userSASSubscriber authorization systemIDIdentity of the userSMSSubscriber management systemPWPassword of the userCWControl wordbRandom numberCASConditional access systemTTimestampECMEntitlement control message∆TSpecified maximum time differenceEMMEntitlement management messageNUser registeration numberDBSData base serverΘToken for issue phaseMUXMultiplexerγToken for subscription phaseDEMUXDemultiplexerηToken for hand-off phaseTXTransmitterh( )One-way hash functionRXReceiving modulexSecret key of DBSDVBDigital video broadcastAThe adversaryIn general, when a user wants to purchase a mobile pay-TV service, she needs to register the private information in HES, such as an ID number and email address. When the user needs TV services, his MS will send a request message for MS authentication and a service content request to HES. If the MS passes the HES authentication, the HES will broadcast a request message for the HES authentication to all nearby mobile sets. After the MS completes the authentication of the HES, the user can obtain service rights and enjoy the mobile pay-TV service. When the user wants to switch to another TV service, the MS and HES need to conduct mutual authentication again.More specifically, there are four steps in the process of mobile TV and HES authentication and subscription services. In the initialization phase, DBS is responsible for generating system parameters and secret parameters required by MS. All HESs can obtain the parameters stored in DBS, which are generated in the initialization phase. In the issue phase, MS sends a log-in request to one HES to obtain a service then authenticates with this HES. As a result, the HES will issue a token for MS, which will be used in the subscription phase to subscribe a service. When the mobile TV wants to move to another area covered by other HES, all the MS needs to do is to authenticate with the new HES, not to reregister or send a log-in request. These four steps are shown in Figure2.Figure 2
Anonymous authentication model for mobile pay-TV system. The initialization phase is performed on secure channel, while the other three phases can be performed on public channel.


### 3.2. Security Requirements

The anonymous authentication protocols used in mobile pay-TV systems need to provide mutual authentication, forward security, and privacy protection of each entity. In addition, the importance of user anonymity and user untraceability is more emphasized in mobile pay-TV systems.


#### 3.2.1. Mutual Authentication

HES and MS need to perform mutual authentication, to conduct subsequent key management, payment management, and subscription management. For resource-constrained devices, the efficiency of authentication should be taken into consideration.


#### 3.2.2. Forward Security

One of the characteristics of mobile users is frequent log-in and log-out. Therefore, when a mobile user leaves a communication network, others cannot infer any user information from the encrypted message left by the user. Forward security means that the authenticated keys generated from each session are independent of each other.


#### 3.2.3. User Anonymity

User anonymity is the most basic requirement in an anonymous authentication protocol, which hides the user’s identity and communication relationship in the communication process through a certain method. This usually means that the user’s identity cannot be obtained by anyone, whether he is an internal attacker or an external attacker. In other words, the identity of the user cannot be publicly transmitted in plaintext.


#### 3.2.4. User Untraceability

User untraceability has many implications. Malicious attackers or other users cannot determine which servers a user has logged in to or how many times a user has logged in to a server. Untraceability can ensure that even if the user reveals his identity at a certain stage, it will not help the adversary to identify the user at other stages. An effective way to achieve untraceability is to randomize the information transmitted in each step of the authentication phase.


#### 3.2.5. Privacy Protection

Privacy protection means that the information of both MS and HES should be unavailable to others. In mobile pay-TV systems, the user logs in anonymously and does not want anyone to know her identity information. This requires that the identity information cannot be stored and transmitted in plain text.


### 3.3. Adversary Capabilities

As defined in other anonymous authentication protocols for mobile pay-TV systems, adversaries have the ability to do all passive attacks, such as eavesdropping on messages in public channel. Moreover, the adversary is allowed to obtain all parameters stored in DBS.In order to prove that our scheme has more advantages in security, we have given adversaries the ability to obtain stored sets. That means the information stored in smart cards of MS and HES is not secure anymore.The capabilities of adversaries are described briefly below:(i)
A can eavesdrop on messages in public channel(ii)
A can obtain all parameters stored in DBS(iii)
A can achieve all information stored in stored set of MS(iv)
A can be a internal attacker


## 3.1. Anonymous Authentication Model for Mobile Pay-TV Systems

Table2 shows notations of entities and parameters. The mobile pay-TV system consists of two important components, the head end system (HES) and the mobile set (MS). HES not only has powerful service content processing capabilities but also contains SAS/SMS. SAS/SMS is mainly responsible for authentication and key management, payment management, and subscription information management. MS is a user equipment that can use the mobile Internet connection to HES to obtain TV services.Table 2
Notations of entities and parameters.
EntitiesDescriptionParametersDescriptionHESHead end systemSThe serverMSMobile setUThe userSASSubscriber authorization systemIDIdentity of the userSMSSubscriber management systemPWPassword of the userCWControl wordbRandom numberCASConditional access systemTTimestampECMEntitlement control message∆TSpecified maximum time differenceEMMEntitlement management messageNUser registeration numberDBSData base serverΘToken for issue phaseMUXMultiplexerγToken for subscription phaseDEMUXDemultiplexerηToken for hand-off phaseTXTransmitterh( )One-way hash functionRXReceiving modulexSecret key of DBSDVBDigital video broadcastAThe adversaryIn general, when a user wants to purchase a mobile pay-TV service, she needs to register the private information in HES, such as an ID number and email address. When the user needs TV services, his MS will send a request message for MS authentication and a service content request to HES. If the MS passes the HES authentication, the HES will broadcast a request message for the HES authentication to all nearby mobile sets. After the MS completes the authentication of the HES, the user can obtain service rights and enjoy the mobile pay-TV service. When the user wants to switch to another TV service, the MS and HES need to conduct mutual authentication again.More specifically, there are four steps in the process of mobile TV and HES authentication and subscription services. In the initialization phase, DBS is responsible for generating system parameters and secret parameters required by MS. All HESs can obtain the parameters stored in DBS, which are generated in the initialization phase. In the issue phase, MS sends a log-in request to one HES to obtain a service then authenticates with this HES. As a result, the HES will issue a token for MS, which will be used in the subscription phase to subscribe a service. When the mobile TV wants to move to another area covered by other HES, all the MS needs to do is to authenticate with the new HES, not to reregister or send a log-in request. These four steps are shown in Figure2.Figure 2
Anonymous authentication model for mobile pay-TV system. The initialization phase is performed on secure channel, while the other three phases can be performed on public channel.


## 3.2. Security Requirements

The anonymous authentication protocols used in mobile pay-TV systems need to provide mutual authentication, forward security, and privacy protection of each entity. In addition, the importance of user anonymity and user untraceability is more emphasized in mobile pay-TV systems.


### 3.2.1. Mutual Authentication

HES and MS need to perform mutual authentication, to conduct subsequent key management, payment management, and subscription management. For resource-constrained devices, the efficiency of authentication should be taken into consideration.


### 3.2.2. Forward Security

One of the characteristics of mobile users is frequent log-in and log-out. Therefore, when a mobile user leaves a communication network, others cannot infer any user information from the encrypted message left by the user. Forward security means that the authenticated keys generated from each session are independent of each other.


### 3.2.3. User Anonymity

User anonymity is the most basic requirement in an anonymous authentication protocol, which hides the user’s identity and communication relationship in the communication process through a certain method. This usually means that the user’s identity cannot be obtained by anyone, whether he is an internal attacker or an external attacker. In other words, the identity of the user cannot be publicly transmitted in plaintext.


### 3.2.4. User Untraceability

User untraceability has many implications. Malicious attackers or other users cannot determine which servers a user has logged in to or how many times a user has logged in to a server. Untraceability can ensure that even if the user reveals his identity at a certain stage, it will not help the adversary to identify the user at other stages. An effective way to achieve untraceability is to randomize the information transmitted in each step of the authentication phase.


### 3.2.5. Privacy Protection

Privacy protection means that the information of both MS and HES should be unavailable to others. In mobile pay-TV systems, the user logs in anonymously and does not want anyone to know her identity information. This requires that the identity information cannot be stored and transmitted in plain text.


## 3.2.1. Mutual Authentication

HES and MS need to perform mutual authentication, to conduct subsequent key management, payment management, and subscription management. For resource-constrained devices, the efficiency of authentication should be taken into consideration.


## 3.2.2. Forward Security

One of the characteristics of mobile users is frequent log-in and log-out. Therefore, when a mobile user leaves a communication network, others cannot infer any user information from the encrypted message left by the user. Forward security means that the authenticated keys generated from each session are independent of each other.


## 3.2.3. User Anonymity

User anonymity is the most basic requirement in an anonymous authentication protocol, which hides the user’s identity and communication relationship in the communication process through a certain method. This usually means that the user’s identity cannot be obtained by anyone, whether he is an internal attacker or an external attacker. In other words, the identity of the user cannot be publicly transmitted in plaintext.


## 3.2.4. User Untraceability

User untraceability has many implications. Malicious attackers or other users cannot determine which servers a user has logged in to or how many times a user has logged in to a server. Untraceability can ensure that even if the user reveals his identity at a certain stage, it will not help the adversary to identify the user at other stages. An effective way to achieve untraceability is to randomize the information transmitted in each step of the authentication phase.


## 3.2.5. Privacy Protection

Privacy protection means that the information of both MS and HES should be unavailable to others. In mobile pay-TV systems, the user logs in anonymously and does not want anyone to know her identity information. This requires that the identity information cannot be stored and transmitted in plain text.


## 3.3. Adversary Capabilities

As defined in other anonymous authentication protocols for mobile pay-TV systems, adversaries have the ability to do all passive attacks, such as eavesdropping on messages in public channel. Moreover, the adversary is allowed to obtain all parameters stored in DBS.In order to prove that our scheme has more advantages in security, we have given adversaries the ability to obtain stored sets. That means the information stored in smart cards of MS and HES is not secure anymore.The capabilities of adversaries are described briefly below:(i)
A can eavesdrop on messages in public channel(ii)
A can obtain all parameters stored in DBS(iii)
A can achieve all information stored in stored set of MS(iv)
A can be a internal attacker


## 4. The Proposed Scheme

In this section, we explain an improved scheme of Far and Alagheband’s scheme. Our improved scheme also has four phases as depicted in Section3, the initialization phase, issue phase, subscription phase, and hand-off phase. The initialization phase is performed on secure channel, while the other three phases can be performed on public channel. These four phases are described, respectively, as below. The notations used in this section are shown in Table 2.


### 4.1. Initialization Phase

In the initialization phase, the MS should register in SAS/SMS through DBS, which stores data in HES. This phase needs to be performed on a secure channel. More details are listed as follows.MS: chooses a random numberb and generates its password PW, then computes PWB=hPWb. After that, it sends ID and PW to DBS of HESn.DBS: after receiving ID and PW from the MS, DBS computesQ=hIDx⊕PWB, R=hPWBID⊕hIDx, and t=hPWBhIDx. Here, x is the secret key of the DBS, which is generated by HESn. Finally, DBS stores R and t, then sends Q and R to MS.MS: after receivingQ and R from DBS, MS stores Q and R.The initialization phase is shown in Figure3.Figure 3
Initialization phase. The initialization phase needs to be performed on a secure channel.


### 4.2. Issue Phase

Before a mobile TV wants to obtain a service, the MS needs to send a service start request toHESn, that is, log-in request. After sending a log-in request, MS and HESn authenticate each other in the issue phase. As a result, HESn will issue a token for MS, which will be used in the subscription phase. The detailed authentication process is described in Figure 4.Figure 4
Issue phase. The issue phase can be performed on public channel.MS: computesPWB=hPWb and verifies R=Q⊕PWB⊕hPWBID. If verified, it then computes W=hhPWBQ⊕PWB⊕T1, CID=W⊕hWT1,C=hRCIDT1, and RW=R⊕W, and finally sends m1=W,C,T1 to HESn at T1.HESn: receives message at T2. It first checks T2−T1≤∆T, then verifies W=ht⊕T1 and C=hRW⊕hWT1T1. Next, it chooses a token Θ and computes D=hR⊕WW⊕hWT1T2, E=Θ⊕hRT2R⊕W⊕T1, and finally sends m2=D,E,T2 to MS at T3.MS: after receivingm2, it first checks T3−T2≤∆T. Then, it verifies D′=hRWCIDT2. The authentication key is computed as Θ=E⊕hRT2R⊕W⊕T1.


### 4.3. Subscription Phase

Once the MS has obtained the token from theHESn, it can use it to subscribe to the service. Except for the token Θ from the issue phase to participate in the operation, other steps are similar to the issue phase. The details are showed in Figure 5.Figure 5
Subscription phase. The subscription phase can be performed on public channel.MS: computesPWB=hPWb and verifies R=Q⊕PWB⊕hPWBID. If verified, it then computes W′=hhPWBQ⊕PWB⊕T4, CID′=W′⊕hW′T4, C′=h(RCID′T4), and RΘ=R⊕Θ, and finally sends m1=W′,C′,T4 to HESn at T4.HESn: receives message at T5. It first checks T5−T4≤∆T, then verifies: W′=ht⊕T4, C′=hRW′⊕hW′T4T4. Next, it chooses a new token γ and computes D′=hR⊕ΘW′⊕hW′T4T5 and E′=γ⊕hRT5R⊕W′⊕T4 and finally sends m2=D′,E′,T5 to MS at T6.MS: after receivingm2, it first checks T6−T5≤∆T, then verifies D′=hRΘCID′T5. The authentication key is computed as γ=E′⊕hRT2R⊕W′⊕T4.


### 4.4. Hand-Off Phase

When a mobile user wants to move from the area covered byHESn to another area covered by HESn+1, he does not need to reregister or send a log-in request. All the MS needs to do is to authenticate with the new HESn+1. The details are showed in Figure 6.Figure 6
Hand-off phase. The hand-off phase can be performed on public channel.MS: first computesWnew=hhPWBQ⊕PWB⊕T7, CIDnew=Wnew⊕hWnewT7, and Cnew=hRCIDnewT7, and then sends m1=Wnew,Cnew,T7 to HESn+1 at T7.HESn+1: receives message at T8. It first checks T8−T7≤∆T, then verifiesWnew=ht⊕T7 and Cnew=hRWnew⊕hWnewT7T7. Next, it chooses a new token η and computes Dnew=hRCIDnewT8, Enew=η⊕hRT8Wnew⊕R⊕T7. Finally, it sends m2=Dnew,Enew,T8 to MS at T9.MS: after receivingm2, it first checks T9−T8≤∆T, then verifies Dnew=hRCIDnewT8. The authentication key to get services for new HES is set as η=Enew⊕hRT8R⊕Wnew⊕T7.


## 4.1. Initialization Phase

In the initialization phase, the MS should register in SAS/SMS through DBS, which stores data in HES. This phase needs to be performed on a secure channel. More details are listed as follows.MS: chooses a random numberb and generates its password PW, then computes PWB=hPWb. After that, it sends ID and PW to DBS of HESn.DBS: after receiving ID and PW from the MS, DBS computesQ=hIDx⊕PWB, R=hPWBID⊕hIDx, and t=hPWBhIDx. Here, x is the secret key of the DBS, which is generated by HESn. Finally, DBS stores R and t, then sends Q and R to MS.MS: after receivingQ and R from DBS, MS stores Q and R.The initialization phase is shown in Figure3.Figure 3
Initialization phase. The initialization phase needs to be performed on a secure channel.


## 4.2. Issue Phase

Before a mobile TV wants to obtain a service, the MS needs to send a service start request toHESn, that is, log-in request. After sending a log-in request, MS and HESn authenticate each other in the issue phase. As a result, HESn will issue a token for MS, which will be used in the subscription phase. The detailed authentication process is described in Figure 4.Figure 4
Issue phase. The issue phase can be performed on public channel.MS: computesPWB=hPWb and verifies R=Q⊕PWB⊕hPWBID. If verified, it then computes W=hhPWBQ⊕PWB⊕T1, CID=W⊕hWT1,C=hRCIDT1, and RW=R⊕W, and finally sends m1=W,C,T1 to HESn at T1.HESn: receives message at T2. It first checks T2−T1≤∆T, then verifies W=ht⊕T1 and C=hRW⊕hWT1T1. Next, it chooses a token Θ and computes D=hR⊕WW⊕hWT1T2, E=Θ⊕hRT2R⊕W⊕T1, and finally sends m2=D,E,T2 to MS at T3.MS: after receivingm2, it first checks T3−T2≤∆T. Then, it verifies D′=hRWCIDT2. The authentication key is computed as Θ=E⊕hRT2R⊕W⊕T1.


## 4.3. Subscription Phase

Once the MS has obtained the token from theHESn, it can use it to subscribe to the service. Except for the token Θ from the issue phase to participate in the operation, other steps are similar to the issue phase. The details are showed in Figure 5.Figure 5
Subscription phase. The subscription phase can be performed on public channel.MS: computesPWB=hPWb and verifies R=Q⊕PWB⊕hPWBID. If verified, it then computes W′=hhPWBQ⊕PWB⊕T4, CID′=W′⊕hW′T4, C′=h(RCID′T4), and RΘ=R⊕Θ, and finally sends m1=W′,C′,T4 to HESn at T4.HESn: receives message at T5. It first checks T5−T4≤∆T, then verifies: W′=ht⊕T4, C′=hRW′⊕hW′T4T4. Next, it chooses a new token γ and computes D′=hR⊕ΘW′⊕hW′T4T5 and E′=γ⊕hRT5R⊕W′⊕T4 and finally sends m2=D′,E′,T5 to MS at T6.MS: after receivingm2, it first checks T6−T5≤∆T, then verifies D′=hRΘCID′T5. The authentication key is computed as γ=E′⊕hRT2R⊕W′⊕T4.


## 4.4. Hand-Off Phase

When a mobile user wants to move from the area covered byHESn to another area covered by HESn+1, he does not need to reregister or send a log-in request. All the MS needs to do is to authenticate with the new HESn+1. The details are showed in Figure 6.Figure 6
Hand-off phase. The hand-off phase can be performed on public channel.MS: first computesWnew=hhPWBQ⊕PWB⊕T7, CIDnew=Wnew⊕hWnewT7, and Cnew=hRCIDnewT7, and then sends m1=Wnew,Cnew,T7 to HESn+1 at T7.HESn+1: receives message at T8. It first checks T8−T7≤∆T, then verifiesWnew=ht⊕T7 and Cnew=hRWnew⊕hWnewT7T7. Next, it chooses a new token η and computes Dnew=hRCIDnewT8, Enew=η⊕hRT8Wnew⊕R⊕T7. Finally, it sends m2=Dnew,Enew,T8 to MS at T9.MS: after receivingm2, it first checks T9−T8≤∆T, then verifies Dnew=hRCIDnewT8. The authentication key to get services for new HES is set as η=Enew⊕hRT8R⊕Wnew⊕T7.


## 5. Security Analysis

Security analysis is composed of two subsections. First, we prove our improved scheme to be secure using the formal method in Section5.1. Then, the main security features in our scheme are shown in Section 5.2.


### 5.1. Formal Security Analysis

In this subsection, we will show that our improved scheme can resist eavesdropping attack, stored set attack, and internal attack. The approaches proposed in literature [15, 42, 43] are employed in this part. The adversary capabilities are given in Section 3.First, we give the definition that the adversary successfully breaks the scheme [42]. The first thing is to explain notations:
(i)
Experiment function (EXP):A successfully obtains the required information(ii)
Success function (Succ):A’s probability of success in obtaining the key secret informationDefinition 1.
If the probability of success is negligible, the scheme is secure against assumedA.
(1)Succ=PrEXPfunction≤ε.Theorem 2.
The adversaryA eavesdrop on messages in public channel. A can break the scheme with probabilityPrEXPhash≤ε, where ε is negligible.Proof of Theorem 1.
A can eavesdrop m1=W,C,T1 in public channel. We describe the subsequent actions of A in Algorithm 1, which consists of set up, challenge, and guess.Algorithm 1
Set up: InputW,C,T1 eavesdropped from public channel. If success, output 1. Otherwise, output 0.Challenge:(i) EavesdropW,C,T1 from public channel(ii) ComputeW=ht⊕T1. Here t=hPWBhIDx, PWB=hPWb.(iii) Choose randomlyID∗,x∗,PW∗,b∗ as the value of ID,x,PW,b(iv) Computeh(hhPW∗b∗hID∗x∗⊕T1=W∗Guess: If W∗=W, accept the value of ID∗,x∗,PW∗,b∗. Return 1. Otherwise, return 0.It is obviously to see thatA must correctly guess the value of ID,x,PW,b to pass the algorithm. The probability of correctly guessing these four values is less than 1/2length:
(2)SuccID=PrEXPhash−ID≤12ID−length,(3)Succx=PrEXPhash−x≤12x−length,(4)SuccPW=PrEXPhash−PW≤12PW−length,(5)Succb=PrEXPhash−b≤12b−length.Thus,A an break the scheme with probability: PrEXPhash≤1/2ID∣x∣PW‖b−length≤ε, where ε is negligible.Theorem 3.
The adversaryA can achieve the stored set of MS. A can break the scheme with probabilityPrEXPhash≤ε, where ε is negligible.Proof of Theorem 3.
A can achieve the stored set of MS. We describe the subsequent actions of A in Algorithm 2 and Algorithm 3, which represents the situation when A obtains R,b and Q,b, respectively.Algorithm 2
Set up: InputR,b corrupted from MS. If success, output 1. Otherwise, output 0.Challenge:(i) CorruptR,b(ii) Choose randomlyPW∗,ID∗,x∗ as the value of user’s password, identity and server’s secret key(iii) ComputeR∗=hhPW∗bID∗⊕hID∗x∗.Guess: If R∗=R, accepts the value of PW∗,ID∗,x∗. Return 1. Otherwise, returns 0.The key to successfully passing Algorithm2 is to correctly guess the value of PW∗,ID∗,x∗. The probability of correctly guessing these four values is less than 1/2length:
(6)SuccPW=PrEXPhash−PW≤12PW−length,(7)SuccID=PrEXPhash−ID≤12ID−length,(8)Succx=PrEXPhash−x≤12x−length.Thus,A can break the scheme with probability: PrEXPhash≤1/2PWIDx−length≤ε, where ε is negligible.Algorithm 3
Set up: InputQ,b corrupted from MS. If success, output 1. Otherwise, output 0.Challenge:(i) CorruptQ,b(ii) Choose randomlyPW∗,ID∗,x∗ as the value of user’s password, identity, and server’s secret key(iii) ComputeQ∗=hID∗⊕x∗⊕hPW∗bGuess: If Q∗=Q, accepts the value of PW∗,ID∗,x∗. Return 1. Otherwise, returns 0.The key to successfully passing Algorithm3 is to correctly guess the value of PW∗,ID∗,x∗. The probability of correctly guessing these four values is less than 1/2length:
(9)SuccPW=PrEXPhash−PW≤12PW−length,(10)SuccID=PrEXPhash−ID≤12ID−length,(11)Succx=PrEXPhash−x≤12x−length.Thus,A can break the scheme with probability: PrEXPhash≤1/2PWIDx−length≤ε, where ε is negligible.Theorem 4.
The adversaryA be an internal attacker. A can break the scheme with probabilityPrEXPhash≤ε, where ε is negligible.Proof of Theorem 4.
A can be a malicious server, as an internal attacker. Even so, A has no way of knowing identity of the user. We describe the subsequent behavior of A in Algorithm 4.Algorithm 4
Set up: InputW,C,T1 eavesdropped from public channel. If success, output 1. Otherwise, output 0.Challenge:(i) ReceiveW,C,T1 from public channel(ii) SearchesR and t, where t=hPWBhIDx(iii) Choose randomlyPW∗,ID∗,b∗,x∗(iv) ComputeR∗=h(hPW∗b∗ID∗hID∗x∗, t∗=h(hPW∗b∗hID∗x∗Guess: If R∗=R or t∗=t, accepts the value of ID∗,b∗. Return 1. Otherwise, returns 0.Since the hash functions we use are one-way secure, ifA wants to know the value of ID,b to pass the algorithm, they can only guess. The probability of correctly guessing these two values is less than 1/2length:
(12)SuccPW=PrEXPhash−PW≤12PW−length,(13)SuccID=PrEXPhash−ID≤12ID−length,(14)Succb=PrEXPhash−b≤12b−length,(15)Succx=PrEXPhash−x≤12x−length.Therefore,A can break the scheme with probability: PrEXPhash≤1/2IDb−length≤ε, where ε is negligible.In summary, our improved scheme can resist eavesdropping attack, stored set attack, and internal attack.


### 5.2. Security Features

In this subsection, we first explain the main changes in our improved scheme compared with Far and Alagheband’s scheme.(i)
Bindx to R and QIn the initialization phase of Far and Alagheband’s protocol,R and Q are stored directly in DBS. The user’s identity is hidden in R and Q so that the user does not need to reveal its identity when logging in and out. However, there are security risks in storing R, Q, and Q⊕PWB in the DBS. As long as the adversary reveals DBS, she can obtain PWB by exclusive OR. This not only brings the leakage of user identity but also causes the risk of user untraceability. In our new scheme, we add the server’s secret key x and make slight changes when calculating R and Q. Thus, the adversary can no longer recover user’s privacy information through data in DBS.
(ii)
Remove the random numbersn in the issue phase and subscription phaseThe introduction of random numbers is to ensure that the authentication keys generated by each session are independent of each other, in order to meet the forward security of the anonymous authentication protocol. In Far and Alagheband’s protocol, the random numbersn is used. Actually, each time a session generates an authentication key, a time stamp is required. Here, the time stamp Tii=1,⋯,6 not only provides the function of mutual authentication, but also introduces freshness. Therefore, our scheme can still guarantee forward security without using random numbers.As a result of the changes, the security of the new scheme has been improved in terms of user untraceability and privacy protection. Table3 shows the comparison of our improved scheme and Far and Alagheband’s scheme.Table 3
Notations of entities and parameters.
Security featuresFar and Alagheband’s schemeThe improved schemeMutual authenticationYesYesForward secrecyYesYesUser anonymityYesYesUser untraceabilityNoYesPrivacy protectionNoYesStored set attackNoYes


#### 5.2.1. Mutual Authentication

In each session, HES and MS must first perform mutual authentication, using the preassignedR, Q, and t. We bind the server’s secret key x and the user’s identity ID when calculating R, Q, and t, to ensure the confidentiality of them. The one-way hash function also provides an efficient method for mutual authentication.


#### 5.2.2. Forward Security

Forward security means that the authenticated keys generated from each session are independent of each other. In our new scheme, the time stampsTii=1,⋯,6 introduce the freshness of each session. Different Tii=1,⋯,6 participating in the operation will generate different authentication keys.


#### 5.2.3. User Anonymity

User anonymity means that the user’s identity ID cannot be obtained by internal attackers or external attackers. In our new scheme, the identity ID of the user is not be publicly transmitted in plaintext, while it is placed in a hash function. Moreover, the server has no access to recover the user’s identity ID fromR and t stored in DBS.


#### 5.2.4. User Untraceability

In our scheme, all HESs can obtainR and t stored in DBS when they need them. Thus, the adversary can no longer determine whether the user has logged in, by comparing the stored set of each HES. Moreover, messages m1,m2 transmitted in public channel are diverse from each other.


#### 5.2.5. Privacy Protection

In our new scheme, we add the server’s secret keyx and make slight changes when calculating R and Q. Thus, the adversary can no longer recover user’s privacy information through data in DBS. The proposed scheme can provide user privacy protection.


## 5.1. Formal Security Analysis

In this subsection, we will show that our improved scheme can resist eavesdropping attack, stored set attack, and internal attack. The approaches proposed in literature [15, 42, 43] are employed in this part. The adversary capabilities are given in Section 3.First, we give the definition that the adversary successfully breaks the scheme [42]. The first thing is to explain notations:
(i)
Experiment function (EXP):A successfully obtains the required information(ii)
Success function (Succ):A’s probability of success in obtaining the key secret informationDefinition 1.
If the probability of success is negligible, the scheme is secure against assumedA.
(1)Succ=PrEXPfunction≤ε.Theorem 2.
The adversaryA eavesdrop on messages in public channel. A can break the scheme with probabilityPrEXPhash≤ε, where ε is negligible.Proof of Theorem 1.
A can eavesdrop m1=W,C,T1 in public channel. We describe the subsequent actions of A in Algorithm 1, which consists of set up, challenge, and guess.Algorithm 1
Set up: InputW,C,T1 eavesdropped from public channel. If success, output 1. Otherwise, output 0.Challenge:(i) EavesdropW,C,T1 from public channel(ii) ComputeW=ht⊕T1. Here t=hPWBhIDx, PWB=hPWb.(iii) Choose randomlyID∗,x∗,PW∗,b∗ as the value of ID,x,PW,b(iv) Computeh(hhPW∗b∗hID∗x∗⊕T1=W∗Guess: If W∗=W, accept the value of ID∗,x∗,PW∗,b∗. Return 1. Otherwise, return 0.It is obviously to see thatA must correctly guess the value of ID,x,PW,b to pass the algorithm. The probability of correctly guessing these four values is less than 1/2length:
(2)SuccID=PrEXPhash−ID≤12ID−length,(3)Succx=PrEXPhash−x≤12x−length,(4)SuccPW=PrEXPhash−PW≤12PW−length,(5)Succb=PrEXPhash−b≤12b−length.Thus,A an break the scheme with probability: PrEXPhash≤1/2ID∣x∣PW‖b−length≤ε, where ε is negligible.Theorem 3.
The adversaryA can achieve the stored set of MS. A can break the scheme with probabilityPrEXPhash≤ε, where ε is negligible.Proof of Theorem 3.
A can achieve the stored set of MS. We describe the subsequent actions of A in Algorithm 2 and Algorithm 3, which represents the situation when A obtains R,b and Q,b, respectively.Algorithm 2
Set up: InputR,b corrupted from MS. If success, output 1. Otherwise, output 0.Challenge:(i) CorruptR,b(ii) Choose randomlyPW∗,ID∗,x∗ as the value of user’s password, identity and server’s secret key(iii) ComputeR∗=hhPW∗bID∗⊕hID∗x∗.Guess: If R∗=R, accepts the value of PW∗,ID∗,x∗. Return 1. Otherwise, returns 0.The key to successfully passing Algorithm2 is to correctly guess the value of PW∗,ID∗,x∗. The probability of correctly guessing these four values is less than 1/2length:
(6)SuccPW=PrEXPhash−PW≤12PW−length,(7)SuccID=PrEXPhash−ID≤12ID−length,(8)Succx=PrEXPhash−x≤12x−length.Thus,A can break the scheme with probability: PrEXPhash≤1/2PWIDx−length≤ε, where ε is negligible.Algorithm 3
Set up: InputQ,b corrupted from MS. If success, output 1. Otherwise, output 0.Challenge:(i) CorruptQ,b(ii) Choose randomlyPW∗,ID∗,x∗ as the value of user’s password, identity, and server’s secret key(iii) ComputeQ∗=hID∗⊕x∗⊕hPW∗bGuess: If Q∗=Q, accepts the value of PW∗,ID∗,x∗. Return 1. Otherwise, returns 0.The key to successfully passing Algorithm3 is to correctly guess the value of PW∗,ID∗,x∗. The probability of correctly guessing these four values is less than 1/2length:
(9)SuccPW=PrEXPhash−PW≤12PW−length,(10)SuccID=PrEXPhash−ID≤12ID−length,(11)Succx=PrEXPhash−x≤12x−length.Thus,A can break the scheme with probability: PrEXPhash≤1/2PWIDx−length≤ε, where ε is negligible.Theorem 4.
The adversaryA be an internal attacker. A can break the scheme with probabilityPrEXPhash≤ε, where ε is negligible.Proof of Theorem 4.
A can be a malicious server, as an internal attacker. Even so, A has no way of knowing identity of the user. We describe the subsequent behavior of A in Algorithm 4.Algorithm 4
Set up: InputW,C,T1 eavesdropped from public channel. If success, output 1. Otherwise, output 0.Challenge:(i) ReceiveW,C,T1 from public channel(ii) SearchesR and t, where t=hPWBhIDx(iii) Choose randomlyPW∗,ID∗,b∗,x∗(iv) ComputeR∗=h(hPW∗b∗ID∗hID∗x∗, t∗=h(hPW∗b∗hID∗x∗Guess: If R∗=R or t∗=t, accepts the value of ID∗,b∗. Return 1. Otherwise, returns 0.Since the hash functions we use are one-way secure, ifA wants to know the value of ID,b to pass the algorithm, they can only guess. The probability of correctly guessing these two values is less than 1/2length:
(12)SuccPW=PrEXPhash−PW≤12PW−length,(13)SuccID=PrEXPhash−ID≤12ID−length,(14)Succb=PrEXPhash−b≤12b−length,(15)Succx=PrEXPhash−x≤12x−length.Therefore,A can break the scheme with probability: PrEXPhash≤1/2IDb−length≤ε, where ε is negligible.In summary, our improved scheme can resist eavesdropping attack, stored set attack, and internal attack.


## 5.2. Security Features

In this subsection, we first explain the main changes in our improved scheme compared with Far and Alagheband’s scheme.(i)
Bindx to R and QIn the initialization phase of Far and Alagheband’s protocol,R and Q are stored directly in DBS. The user’s identity is hidden in R and Q so that the user does not need to reveal its identity when logging in and out. However, there are security risks in storing R, Q, and Q⊕PWB in the DBS. As long as the adversary reveals DBS, she can obtain PWB by exclusive OR. This not only brings the leakage of user identity but also causes the risk of user untraceability. In our new scheme, we add the server’s secret key x and make slight changes when calculating R and Q. Thus, the adversary can no longer recover user’s privacy information through data in DBS.
(ii)
Remove the random numbersn in the issue phase and subscription phaseThe introduction of random numbers is to ensure that the authentication keys generated by each session are independent of each other, in order to meet the forward security of the anonymous authentication protocol. In Far and Alagheband’s protocol, the random numbersn is used. Actually, each time a session generates an authentication key, a time stamp is required. Here, the time stamp Tii=1,⋯,6 not only provides the function of mutual authentication, but also introduces freshness. Therefore, our scheme can still guarantee forward security without using random numbers.As a result of the changes, the security of the new scheme has been improved in terms of user untraceability and privacy protection. Table3 shows the comparison of our improved scheme and Far and Alagheband’s scheme.Table 3
Notations of entities and parameters.
Security featuresFar and Alagheband’s schemeThe improved schemeMutual authenticationYesYesForward secrecyYesYesUser anonymityYesYesUser untraceabilityNoYesPrivacy protectionNoYesStored set attackNoYes


### 5.2.1. Mutual Authentication

In each session, HES and MS must first perform mutual authentication, using the preassignedR, Q, and t. We bind the server’s secret key x and the user’s identity ID when calculating R, Q, and t, to ensure the confidentiality of them. The one-way hash function also provides an efficient method for mutual authentication.


### 5.2.2. Forward Security

Forward security means that the authenticated keys generated from each session are independent of each other. In our new scheme, the time stampsTii=1,⋯,6 introduce the freshness of each session. Different Tii=1,⋯,6 participating in the operation will generate different authentication keys.


### 5.2.3. User Anonymity

User anonymity means that the user’s identity ID cannot be obtained by internal attackers or external attackers. In our new scheme, the identity ID of the user is not be publicly transmitted in plaintext, while it is placed in a hash function. Moreover, the server has no access to recover the user’s identity ID fromR and t stored in DBS.


### 5.2.4. User Untraceability

In our scheme, all HESs can obtainR and t stored in DBS when they need them. Thus, the adversary can no longer determine whether the user has logged in, by comparing the stored set of each HES. Moreover, messages m1,m2 transmitted in public channel are diverse from each other.


### 5.2.5. Privacy Protection

In our new scheme, we add the server’s secret keyx and make slight changes when calculating R and Q. Thus, the adversary can no longer recover user’s privacy information through data in DBS. The proposed scheme can provide user privacy protection.


## 5.2.1. Mutual Authentication

In each session, HES and MS must first perform mutual authentication, using the preassignedR, Q, and t. We bind the server’s secret key x and the user’s identity ID when calculating R, Q, and t, to ensure the confidentiality of them. The one-way hash function also provides an efficient method for mutual authentication.


## 5.2.2. Forward Security

Forward security means that the authenticated keys generated from each session are independent of each other. In our new scheme, the time stampsTii=1,⋯,6 introduce the freshness of each session. Different Tii=1,⋯,6 participating in the operation will generate different authentication keys.


## 5.2.3. User Anonymity

User anonymity means that the user’s identity ID cannot be obtained by internal attackers or external attackers. In our new scheme, the identity ID of the user is not be publicly transmitted in plaintext, while it is placed in a hash function. Moreover, the server has no access to recover the user’s identity ID fromR and t stored in DBS.


## 5.2.4. User Untraceability

In our scheme, all HESs can obtainR and t stored in DBS when they need them. Thus, the adversary can no longer determine whether the user has logged in, by comparing the stored set of each HES. Moreover, messages m1,m2 transmitted in public channel are diverse from each other.


## 5.2.5. Privacy Protection

In our new scheme, we add the server’s secret keyx and make slight changes when calculating R and Q. Thus, the adversary can no longer recover user’s privacy information through data in DBS. The proposed scheme can provide user privacy protection.


## 6. Performance Comparison

Various anonymous authentication schemes have been presented in recent years. In this section, we choose a few schemes that use only hash functions and compare them with our scheme in terms of execution efficiency.We define the execution time of one hash operation is 0.13μs according to Ref. [36]. The number of hash operations of each scheme is shown in Table 4. Since the subscription phase and hand-off phase are similar with the issue phase, we only compare hash operations in the initialization phase and issue phase.Table 4
Comparison of operation numbers in each scheme.
SchemesABCDEFGHThe scheme in [32]60.7870.9170.9145The scheme in [33]70.91201.370.9145The scheme in [15]30.3960.7840.5234Our scheme30.3960.7840.5233Note:A: the number of hash operations in the initialization phase. B: the execution time of the initialization phase (μs). C: the number of hash operations by user side in the issue phase. D: the execution time by user side of the issue phase (μs). E: the number of hash operations by server side in the issue phase. F: the execution time by server side of the issue phase (μs). G: the number of parameters in the stored set. H: the number of parameters transmitted on public channel.From Table4, our scheme performs better in terms of execution time. Moreover, the number of parameters transmitted on public channel is minimal, which means our scheme performs better in computing storage. In order to show the comparison of execution efficiency more clearly, we show the execution time in μs and parameter numbers in Figure 7. It is obvious to see that our scheme has the shortest execution time under the same conditions.Figure 7
Comparison of execution time and parameter numbers. (a) Comparison of execution time. (b) Comparison of parameters in the stored set. (c) Comparison of parameters transmitted on public channel.
(a)(b)(c)


## 7. Conclusion

The security of pay-TV systems is facing the challenge of explosive growth of users and service content. To prevent unauthorized access in mobile pay-TV systems, anonymous authentication technologies are commonly used for secure media delivery and channel protection. In this paper, we review Far and Alagheband’s protocol and find that this protocol is suffering from risks of revealing user’s privacy. Besides, there is still room for improvement in storage. We alleviate the security risks of Far and Alagheband’s protocol. Our improved scheme can resist stored set attack and user traceability attack. Performance comparison shows that our scheme performs better in terms of execution time and storage, which means it is suitable for resource-constrained devices in edge computing environment.



---

*Source: 8850083-2020-09-10.xml*