# Research on Lightweight Mutual Authentication for the Product Authorization Chain

Authors: Hanqing Ding; Qing Zhang; Yifeng Yin; Yong Gan; Weihua Liu
Journal: Security and Communication Networks
 (2021)

---

## Abstract

With the development of the globalization economic integration in Internet of Things (IoT), it is very crucial to protect the wireless two-way authentication between users’ intelligent terminals and servers in the product authorization chain. In order to ensure that legitimate users connect to the wireless network correctly, a lightweight wireless mutual authentication scheme for the product authorization chain was proposed contrapose to the security defect of Kaul and Awasthi’s scheme, which easily suffered from offline password guessing attack. The improved scheme uses lightweight hash function and verifies the freshness of messages by using the send packet sequence number instead of timestamp, which can avoid strict clock synchronization between devices, and user passwords can be updated by themselves. Security analysis and cost and efficiency analysis show that the scheme presented in this paper has higher security, lower storage and communication costs, and lower computational complexity.


---

## Body

## 1. Introduction

With the progress of wireless technology, sensor network, and the explosion of intelligent terminals such as smart phones and smart watches, mobile users can enjoy a variety of overall service provided application, purchase products, and access to product information everywhere at any time through individual intelligent devices accessing the mobile Internet [1]. In the whole product authorization chain, from producer and agents to consumers, users want to use smart devices to purchase products at any time and place and obtain the product-related information. However, with the access of wireless network, intelligent terminals are vulnerable to unauthorized users to attack, intercept, steal, download, delete, or tamper with the private data [2].Therefore, in the process of data transmission between the intelligent terminal and the remote server in the product authorization chain, it is particularly critical to accurately verify the identities of the wireless communication parties to ensure data security. User identity authentication can accurately identify legitimate users and assign them to server authorization to eliminate network security and malicious users. At present, a large number of user authentication schemes have been put forward.Lamport initially designed a password-based authentication scheme in an insecure channel in 1981, but the scheme verifies the user’s legitimacy by constructing a password table, which has large hash overhead and is not suitable for the practical application system [3]. Subsequently, many scholars began to study and improve the scheme that cannot achieve mutual authentication. In 2009, Wang et al. proposed an enhanced scheme to provide higher security [4]. Wen and Li demonstrated that Wang et al.’s scheme could not defend against impersonation attack in 2012 [5]. The legitimate users could initiate offline password guessing attack through obtaining the sensitive private information of other legitimate users in the system. In 2014, Chang et al. showed that Wang et al.’s scheme still used plaintext to transmit user identity in public channel [6]. Then, they designed an untraceable remote user authentication scheme on the basis of dynamic identity with a verifiable password update. In the same year, Kumari et al. proved that Chang et al.’s scheme could not prevent offline password guessing attack, impersonation attack, and so on and proposed an improved scheme to overcome these security flaws [7]. In 2016, Kaul and Awasthi proved that Kumari et al.’s scheme is completely insecure because attackers can easily gain security parameters of the scheme and the public session key between the user and the server [8]. They proposed a new authentication scheme and proved its security. However, in 2017, Wang and Xu indicated that Kaul and Awasthi’s scheme could not prevent offline password guessing attack and meet security requirements in the authentication system [9]. In view of the security level of remote user ID authentication, Liu et al. proposed an improved two-way security authentication scheme by dividing hash value into two parts in 2018 [10].All above schemes use the timestamp to ensure whether the communication message is fresh. It is necessary to ensure strict clock synchronization between the intelligent terminal and the server. However, with the increase in intelligent terminal devices accessing wireless network, it is difficult to ensure that the clock of all intelligent terminals and servers is strictly synchronized. Many scholars have studied this problem and proposed corresponding authentication schemes. In 2016, Wang et al. improved the scheme of Wen and Li by using the send packet sequence number instead of timestamp, but the login password could not be changed freely [11, 12].Given the above analysis, the scheme of the public key system proposed by Qiu et al. eliminates the long-standing problem of security and availability conflict in two-factor authentication mechanism by combining “honeyed words” with “fuzzy verifier” [13, 14]. This paper analyzes the security flaw of Kaul and Awasthi’s scheme and proposes a lightweight wireless mutual authentication scheme for product authorization chain [15].The sequence numberPN of sending packet is constantly updated to verify the freshness of the message. The iterative operation composed of strong one-way hash function, and simple XOR is used to securely mutually authenticate the user and the server. The user can change his password and generate a secure session [16, 17]. The proposed scheme uses one-way hash function and bit exclusive or operation to realize the two-way authentication between users and servers and maintains the security advantage of the traditional scheme.


## 2. Problem Statement and Motivation

Due to space limitations, Kaul and Awasthi’s specific implementation steps are detailed in literature [8]. Table 1 presents the notations of this study.Table 1
Notations.
SymbolsMeaningAiith level agent userIDiUnique identity ofAiPWiLogin password ofAiPWiNThe login password to update forAiSServerSPIαi,SPIβi,SPIγiSPIχiTheith values of four security parameters indexx,ySecret key and number ofSRsiUnique random number forAi distributed by SPNiAi saving the last send packet sequence number in login phasePNsS saving the last send packet sequence number in authentication phasePNi+1Ai saving the last send packet sequence number in authentication phaseh⋅Strong one-way hash functionIt is discovered that Kaul and Awasthi’s scheme cannot resist offline password guessing attack. The analysis is as follows.Suppose that an adversaryA can gain the smart card of Ai by stealing and other means and obtain SPIβi,SPIγi,SPIχi,ηi,h⋅ stored in the smart card through some technology. Due to IDi being transmitted in plaintext on the public channel, IDi can be gained illegally by the adversary A in the authentication phase [18, 19]. And then, A performs the following operations to realize offline password guessing attack:(1)
From the password spaceDPW, A selects a PWi∗ to guess as PWi value, in which PWi∈DPW(2)
It computeb=ηi⊕hIDi∗⊕PWi∗, RPWi∗=hb⊕PWi∗, SPIαi∗=SPIβi⊕hIDi∗⊕RPWi∗, Rsi∗=SPIγi⊕hSPIαi∗⊕RPWi∗, and SPIχi∗=hIDi∗‖RPWi∗‖Rsi∗‖SPIαi∗(3)
It checksSPIχi∗=SPIχi to verify the correctness of PWi∗; if not, repeat (1), (2), and (3) until PWi is foundFrom the above analysis, the time complexity of this attack process isODPW∗5Th+5TXOR, Th is the runtime of the hash function operation, TXOR is the runtime of XOR operation, and DPW expresses the number of passwords in DPW. DPW is very limited in practice, usually DPW≤106 [12]. Therefore, the above attack is very effective.The scheme needs to include the encryption information of the product corresponding to the current authorization and the authorization information of all or part of the earlier authorized products. The product authorization chain is also important in tracking product flow through the logistics pipelines. Through the after-sales service tracking of after-sales certification authorized products or service behaviors, a trusted platform based on consumer information binding product information is formed to realize product and user information feedback and transmission under big data. It ensures consumers’ understanding, exquisite manufacturing, and sincere service so as to realize the healthy cycle of social consumption circle.


## 3. Our Proposed Scheme

### 3.1. The Model of Product Authorization Chain

Contrapose to the existing problem in Kaul and Awasthi’s authentication scheme, this paper proposes a model of product authorization chain, which consists of three flows: data flow, product flow, and product information flow. Product information flow flows the most frequently and the most sensitively responses to authorization chain, and it affects the product flow and subordinate agents information, and it is the main basis of authorization chain decision-making. In view of attacks data communication between both parties, the polymorphic authentication service protocol, due to the role of the built-in self-compiling system of the security subsystem, makes the active attacker face the improved virtual iterative function polytropic function set [20]. By using multiagent technology, the model of product authorization chain typically includes three roles: producer, consumer, and n-level agent. Producers with root access rights can access all information of products from the cloud server [21]. Other roles are authorized by the superior and can access the corresponding product information.Figure1 illustrates the authorization process of the product authorization chain. The producer owns the complete product information such as product composition, processing technology, and production cost. Each level of agent can obtain the corresponding amount of information through registration, paging, authorization, and encoding. An agent in authorization chain distributes the information it receives from a superior agent only if it is authorized and not solely based on the discrepancy among superior and subordinate agents information, which might be caused by legitimate changes and not attacks. The product information flow received by primary agent, secondary agent, n-level agent, and consumer is the same or different, in which Pa1, Pa2, Pa1n+i, and Pa2n+j may be equal or different.Figure 1
The model of product authorization chain.This paper proposes a lightweight wireless two-way authentication scheme for product authentication chain, which improves the security performance and efficiency of the authentication system by the improvement based on Kaul and Awasthi’s scheme. Figure2 illustrates the authentication process of registration, login, authentication, and password changing phase of the proposed scheme.Figure 2
The calculation process of the group key.The validity of the improved scheme can be verified by logical reasoning of the security model. Burrows–Abadi–Needham (BAN) logic is used to prove the security of the proposed scheme in this paper [22]. The two authentication entities in the scheme are the ith level agent user Ai and the server S. The transmission plaintext irrelevant to the security attribute to be demonstrated in the authentication process is eliminated.Only the security attributes and logical parts related to mutual authentication are retained. The ideal goal formula of the authorization chain model is as follows:(1)Ai⟶S:yi,SPIαi,PNiIDi,IDi,yi,SPIαi,PNi,(2)S⟶Ai:yi,SPIαi,PNsIDi.IDi is the secret shared by both Ai and the server S. The ultimate objective of mutual authentication scheme is as follows:(3)Ai|≡S⟷SKAi,(4)S|≡Ai⟷SKS.The scheme is initialized and assumed that(5)Ai|≡S↔IDiAi,(6)S|≡Ai↔IDiS.In order to achieve the final goal (4) of the scheme, we will prove the following main logical conclusion.It can be deduced from the idealized model (1).(7)S⊲yi,SPIαi,PNiIDi,IDi,yi,SPIαi,PNi.Based on assumptions (6), the result can be obtained by substituting (7) into R1: P|≡P↔kQ,P⊲Xk/P|≡Q|∼X.(8)S|≡Ai|∼yi,SPIαi,PNi.The inference rules of the freshness in BAN logic can be applied to infer the formula.(9)S|≡#yi,SPIαi,PNi.Result (10) can be obtained by combining (8) and (9) with fresh value validation rules R4.(10)S|≡Ai|≡yi,SPIαi,PNi.According to the improved scheme proposed in this paper, the session key isSK=hIDi‖Rsi‖SPIαi‖PNi‖PNS. The result can be derived by combining the results of (6), (9), and (10).(11)S|≡Ai|≡Ai↔SKS.Based on assumptions (6), the result can be obtained by substituting (11) into jurisdiction rule R5: P|≡Q|⟹X,P|≡Q|≡X/P|≡X.(12)S|≡Ai↔SKS.The safety target (4) is achieved, and the proof is completed.


### 3.2. Registration Phase

So as to acquire services fromS, new user Ai must register as follows:Step 1. Ai chooses his own IDi, PWi, and a random number Ra, calculates RPWi=hRa⊕PWi, and transmits IDi,RPWi to remote server S by the secure channel.Step 2.S selects randomly an unique random number Rsi and computes the values of four security parameter indexes (SPI) SPIαi, SPIβi,SPIγi, and SPIχi:SPIαi=hIDi⊕Rsi‖x‖y,SPIβi=SPIαi⊕hIDi⊕RPWi,SPIγi=Rsi⊕hSPIαi⊕RPWi,SPIχi=hIDi‖RPWi‖Rsi‖SPIαi,It storesSPIβi,SPIγi,SPIχi,h⋅ in the smart card and delivers it to Ai.Step 3.Ai computes ηi=b⊕hIDi⊕PWi and stores it in the smart card.


### 3.3. Login Phase

IfAi wants to log in S, it must insert the smart card into the card reader, and then does as follows:Step 1. Ai inputs IDi∗ and PWi∗ and computes the following:b=ηi⊕hIDi∗⊕PWi∗, RPWi∗=hb⊕PWi∗,SPIαi∗=SPIβi⊕hIDi∗⊕RPWi∗,Rsi∗=SPIγi⊕hSPIαi∗⊕RPWi∗,SPIχi∗=hIDi∗‖RPWi∗‖Rsi∗‖SPIαi∗.If the calculatedSPIχi∗ is equivalent to SPIχi saved in the smart card, the reader accepts the login request of Ai; else, exits. In addition, in order to prevent online password guessing attack, if wrong passwords are entered more than a preset number of times, the card is locked in a predefined limited period of time.Step 2. After verifying the legality of the login request, Ai calculates λi,ωi,andϑi as follows:λi=IDi⊕Rsi,ωi=Rsi⊕hλi⊕SPIαi⊕PNi,ϑi=hIDi‖λi⊕SPIαi⊕PNi.Ai updates the sending package sequence number PNi=PNi+1 and then sends the login request information λi,ωi,ϑi,PNi to the server S.


### 3.4. Authentication Phase

At this phase,Ai and S complete two-way authentication and establish a secure session key:Step 1. Firstly, S verifies the freshness of the message through PNi=?PNS+1; if it is satisfied, S receives the login request λi,wi,ϑi,PNi; else, rejects the login request.Step 2. S computes SPIαi∗,Rsi∗,IDi∗,andϑi∗ as follows:SPIαi∗=hλi∗‖x‖y,Rsi∗=ωi∗⊕hλi∗⊕SPIαi∗⊕PNs,IDi∗=Rsi∗⊕λi∗,ϑi∗=hIDi∗‖Rsi∗‖SPIαi∗‖PNs.S checks ϑi∗=?ϑi. If they are equal, the identity of Ai is legal; if not, S withdraws from the authentication phase.Step 3. S computes μi=hIDi‖Rsi‖SPIαi‖PNS, updates the sending package serial number PNi=PNi+1, and sends μi,PNS to Ai.Step 4.Ai checks PNS=?PNi+1+1 to verify that the message is valid, then calculates μi∗=hIDi‖Rsi‖SPIαi‖PNi+1, and judges μi∗=?μi. If μi∗=μi, the identity of S is legal; if not, exits.Step 5. After realizing two-way authentication successfully, Ai and S generate independently session key SK=hIDi‖Rsi‖SPIαi‖PNi‖PNS for the future safety communication.


### 3.5. Password Changing Phase

At this phase,Ai can update password directly in the smart card without any help from the remote server. When the user Ai wants PWi to be updated to PWiN, Ai only needs to make the smart card inserted into the smart card reader and then performs the following actions:Step 1. Ai inputs IDi∗, PWi∗, and PWiN and sends a password update request.Step 2. The card reader calculates b, RPWi∗, SPIαi∗, Rsi∗, and SPIχi∗ by Step 1 in Section 3.2 and compares SPIχi∗=?SPIχi; if the result is equal, it verifies that the requesting user is a legitimate user and updates their password; else, exits;Step 3. The card reader computes RPWiN,SPIβiN,SPIγiN,SPIχiN,andηiN as follows:RPWiN=hb‖PWiN,SPIβiN=SPIαi⊕hIDi⊕RPWiN,SPIγiN=Rsi⊕hSPIαi⊕RPWiN,SPIχiN=hIDi‖RPWiN‖Rsi‖SPIαi,ηiN=b⊕hIDi⊕PWiN,It updatesSPIβi,SPIγi,SPIχi,ηi to SPIβiN,SPIγiN,SPIχiN,ηiN.


### 3.6. Information Inquiry and Information Authorization Phase

Step 1. Information inquiry phase: After the two-way authentication between the intelligent terminal and the server, if Ai wants to query the product information, the identity IDi is encrypted by the secure session key generated after mutual authentication and then Ai transmits it and the query request to S. S inquires the information authorization of the authorization user granted by the upper level user, and then S sends relevant encrypted information to the user Ai through using the session key SK.Step 2. Information authorization phase: After the user successfully logs in the system, the user sends an information authorization request to the server and uses SK to encrypt the identity of the next-level user and encrypted amount of information granted and sends it to S. The server saves it and waits for the query of the next-level user.


## 3.1. The Model of Product Authorization Chain

Contrapose to the existing problem in Kaul and Awasthi’s authentication scheme, this paper proposes a model of product authorization chain, which consists of three flows: data flow, product flow, and product information flow. Product information flow flows the most frequently and the most sensitively responses to authorization chain, and it affects the product flow and subordinate agents information, and it is the main basis of authorization chain decision-making. In view of attacks data communication between both parties, the polymorphic authentication service protocol, due to the role of the built-in self-compiling system of the security subsystem, makes the active attacker face the improved virtual iterative function polytropic function set [20]. By using multiagent technology, the model of product authorization chain typically includes three roles: producer, consumer, and n-level agent. Producers with root access rights can access all information of products from the cloud server [21]. Other roles are authorized by the superior and can access the corresponding product information.Figure1 illustrates the authorization process of the product authorization chain. The producer owns the complete product information such as product composition, processing technology, and production cost. Each level of agent can obtain the corresponding amount of information through registration, paging, authorization, and encoding. An agent in authorization chain distributes the information it receives from a superior agent only if it is authorized and not solely based on the discrepancy among superior and subordinate agents information, which might be caused by legitimate changes and not attacks. The product information flow received by primary agent, secondary agent, n-level agent, and consumer is the same or different, in which Pa1, Pa2, Pa1n+i, and Pa2n+j may be equal or different.Figure 1
The model of product authorization chain.This paper proposes a lightweight wireless two-way authentication scheme for product authentication chain, which improves the security performance and efficiency of the authentication system by the improvement based on Kaul and Awasthi’s scheme. Figure2 illustrates the authentication process of registration, login, authentication, and password changing phase of the proposed scheme.Figure 2
The calculation process of the group key.The validity of the improved scheme can be verified by logical reasoning of the security model. Burrows–Abadi–Needham (BAN) logic is used to prove the security of the proposed scheme in this paper [22]. The two authentication entities in the scheme are the ith level agent user Ai and the server S. The transmission plaintext irrelevant to the security attribute to be demonstrated in the authentication process is eliminated.Only the security attributes and logical parts related to mutual authentication are retained. The ideal goal formula of the authorization chain model is as follows:(1)Ai⟶S:yi,SPIαi,PNiIDi,IDi,yi,SPIαi,PNi,(2)S⟶Ai:yi,SPIαi,PNsIDi.IDi is the secret shared by both Ai and the server S. The ultimate objective of mutual authentication scheme is as follows:(3)Ai|≡S⟷SKAi,(4)S|≡Ai⟷SKS.The scheme is initialized and assumed that(5)Ai|≡S↔IDiAi,(6)S|≡Ai↔IDiS.In order to achieve the final goal (4) of the scheme, we will prove the following main logical conclusion.It can be deduced from the idealized model (1).(7)S⊲yi,SPIαi,PNiIDi,IDi,yi,SPIαi,PNi.Based on assumptions (6), the result can be obtained by substituting (7) into R1: P|≡P↔kQ,P⊲Xk/P|≡Q|∼X.(8)S|≡Ai|∼yi,SPIαi,PNi.The inference rules of the freshness in BAN logic can be applied to infer the formula.(9)S|≡#yi,SPIαi,PNi.Result (10) can be obtained by combining (8) and (9) with fresh value validation rules R4.(10)S|≡Ai|≡yi,SPIαi,PNi.According to the improved scheme proposed in this paper, the session key isSK=hIDi‖Rsi‖SPIαi‖PNi‖PNS. The result can be derived by combining the results of (6), (9), and (10).(11)S|≡Ai|≡Ai↔SKS.Based on assumptions (6), the result can be obtained by substituting (11) into jurisdiction rule R5: P|≡Q|⟹X,P|≡Q|≡X/P|≡X.(12)S|≡Ai↔SKS.The safety target (4) is achieved, and the proof is completed.


## 3.2. Registration Phase

So as to acquire services fromS, new user Ai must register as follows:Step 1. Ai chooses his own IDi, PWi, and a random number Ra, calculates RPWi=hRa⊕PWi, and transmits IDi,RPWi to remote server S by the secure channel.Step 2.S selects randomly an unique random number Rsi and computes the values of four security parameter indexes (SPI) SPIαi, SPIβi,SPIγi, and SPIχi:SPIαi=hIDi⊕Rsi‖x‖y,SPIβi=SPIαi⊕hIDi⊕RPWi,SPIγi=Rsi⊕hSPIαi⊕RPWi,SPIχi=hIDi‖RPWi‖Rsi‖SPIαi,It storesSPIβi,SPIγi,SPIχi,h⋅ in the smart card and delivers it to Ai.Step 3.Ai computes ηi=b⊕hIDi⊕PWi and stores it in the smart card.


## 3.3. Login Phase

IfAi wants to log in S, it must insert the smart card into the card reader, and then does as follows:Step 1. Ai inputs IDi∗ and PWi∗ and computes the following:b=ηi⊕hIDi∗⊕PWi∗, RPWi∗=hb⊕PWi∗,SPIαi∗=SPIβi⊕hIDi∗⊕RPWi∗,Rsi∗=SPIγi⊕hSPIαi∗⊕RPWi∗,SPIχi∗=hIDi∗‖RPWi∗‖Rsi∗‖SPIαi∗.If the calculatedSPIχi∗ is equivalent to SPIχi saved in the smart card, the reader accepts the login request of Ai; else, exits. In addition, in order to prevent online password guessing attack, if wrong passwords are entered more than a preset number of times, the card is locked in a predefined limited period of time.Step 2. After verifying the legality of the login request, Ai calculates λi,ωi,andϑi as follows:λi=IDi⊕Rsi,ωi=Rsi⊕hλi⊕SPIαi⊕PNi,ϑi=hIDi‖λi⊕SPIαi⊕PNi.Ai updates the sending package sequence number PNi=PNi+1 and then sends the login request information λi,ωi,ϑi,PNi to the server S.


## 3.4. Authentication Phase

At this phase,Ai and S complete two-way authentication and establish a secure session key:Step 1. Firstly, S verifies the freshness of the message through PNi=?PNS+1; if it is satisfied, S receives the login request λi,wi,ϑi,PNi; else, rejects the login request.Step 2. S computes SPIαi∗,Rsi∗,IDi∗,andϑi∗ as follows:SPIαi∗=hλi∗‖x‖y,Rsi∗=ωi∗⊕hλi∗⊕SPIαi∗⊕PNs,IDi∗=Rsi∗⊕λi∗,ϑi∗=hIDi∗‖Rsi∗‖SPIαi∗‖PNs.S checks ϑi∗=?ϑi. If they are equal, the identity of Ai is legal; if not, S withdraws from the authentication phase.Step 3. S computes μi=hIDi‖Rsi‖SPIαi‖PNS, updates the sending package serial number PNi=PNi+1, and sends μi,PNS to Ai.Step 4.Ai checks PNS=?PNi+1+1 to verify that the message is valid, then calculates μi∗=hIDi‖Rsi‖SPIαi‖PNi+1, and judges μi∗=?μi. If μi∗=μi, the identity of S is legal; if not, exits.Step 5. After realizing two-way authentication successfully, Ai and S generate independently session key SK=hIDi‖Rsi‖SPIαi‖PNi‖PNS for the future safety communication.


## 3.5. Password Changing Phase

At this phase,Ai can update password directly in the smart card without any help from the remote server. When the user Ai wants PWi to be updated to PWiN, Ai only needs to make the smart card inserted into the smart card reader and then performs the following actions:Step 1. Ai inputs IDi∗, PWi∗, and PWiN and sends a password update request.Step 2. The card reader calculates b, RPWi∗, SPIαi∗, Rsi∗, and SPIχi∗ by Step 1 in Section 3.2 and compares SPIχi∗=?SPIχi; if the result is equal, it verifies that the requesting user is a legitimate user and updates their password; else, exits;Step 3. The card reader computes RPWiN,SPIβiN,SPIγiN,SPIχiN,andηiN as follows:RPWiN=hb‖PWiN,SPIβiN=SPIαi⊕hIDi⊕RPWiN,SPIγiN=Rsi⊕hSPIαi⊕RPWiN,SPIχiN=hIDi‖RPWiN‖Rsi‖SPIαi,ηiN=b⊕hIDi⊕PWiN,It updatesSPIβi,SPIγi,SPIχi,ηi to SPIβiN,SPIγiN,SPIχiN,ηiN.


## 3.6. Information Inquiry and Information Authorization Phase

Step 1. Information inquiry phase: After the two-way authentication between the intelligent terminal and the server, if Ai wants to query the product information, the identity IDi is encrypted by the secure session key generated after mutual authentication and then Ai transmits it and the query request to S. S inquires the information authorization of the authorization user granted by the upper level user, and then S sends relevant encrypted information to the user Ai through using the session key SK.Step 2. Information authorization phase: After the user successfully logs in the system, the user sends an information authorization request to the server and uses SK to encrypt the identity of the next-level user and encrypted amount of information granted and sends it to S. The server saves it and waits for the query of the next-level user.


## 4. Security and Efficiency Analysis of Our Scheme

### 4.1. Security Analysis

The security of our scheme is investigated, which is the ability of a scheme to fend off some well-known attacks and is compared with the schemes in [4–8, 11]. Table 2 is the comparison result. “✔” indicates that it has resistance to some known attacks. “✕” indicates that it cannot be defended or does not have the resistance. The result illustrates that even if attackers extract all the values saved in the smart card and intercept all communication information in public channel, the security of the proposed solution is not affected.Table 2
Security comparisons with other schemes.
Attack testingWang et al.’s [4]Wen and Li’s [5]Chang et al.’s [6]Kumari et al.’s [7]Wang et al.’s [11]Kaul and Awasthi’s [8]OursResist offline password guessing attack✕✕✕✕✔✕✔Resist replay attack✔✔✔✔✔✔✔Resist impersonation attack✕✕✕✔✔✔✔Resist DoS attack✕✕✕✔✕✔✔Resist insider attack✕✔✕✕✔✔✔Resist man in middle attack✔✕✔✕✔✔✔Secure session key establishment✕✔✕✔✕✔✔


#### 4.1.1. Resist Offline Password Guessing Attack

Assume an attackerA obtains the user’s smart card and extracts all values SPIβi,SPIγi,SPIχi,ηi saved in the smart card by taking some actions. At the same time, the security parameters λi,ωi,ϑi,PNi,μi,PNS transmitted in public channel can also be obtained. Because λi=IDi⊕Rsi=IDi∗⊕Rsi∗, Rsi∗=SPIγi⊕hSPIαi∗⊕RPWi∗, and SPIαi∗=SPIβi⊕hIDi∗⊕RPWi∗, in which IDi∗ and RPWi∗ are unknown, A needs to correctly surmise the values of two unknowns at least each time, which is impossible in polynomial time [13]. Therefore, A cannot guess the values IDiand PWi from all the gained information. Therefore, the scheme proposed in this article can defend against offline password guessing attack.


#### 4.1.2. Resist Impersonation Attack

(1)
Impersonating Legitimate UserAi. For counterfeiting Ai, A must be able to calculate the correct user login request λi,ωi,ϑi,PNi; as can be seen from the model of product authorization chain, it is impossible for A to get useful information from the obtained information from the missing or stolen smart card to infer IDi,PWi,b,andRsi. And A cannot gain the server’s private key x and random number Rsi to calculate SPIαi=hIDi⊕Rsi‖x‖y. So, A cannot successfully disguise as a legitimate user Ai.(2)
Impersonating ServerS. The server does not reveal the unique key x and number y. Hash function has the strong unidirectionality; hence, A cannot calculate SPIαi∗=hλi∗‖x‖y accurately and then calculates ϑi∗=hIDi∗‖Rsi∗‖SPIαi∗‖PNS to make ϑi∗=ϑi. So, A is not able to successfully dress up as a server.


#### 4.1.3. Resist DoS Attack

WhenAi logs in the server, the smart card first checks whether the input IDiand PWi are correct or not. Only with the correct input IDiand PWi, the smart card would accept the login request. Therefore, it does not exist that Ai inputs error login request IDiand PWi to cause login request calculated incorrectly. The user is exposed to denial-of-service vulnerabilities after the server verification test failure. Similarly, it is impossible for A to update the values SPIβi,SPIγi,SPIχi,ηi in the smart card with any password so that it cannot be used anymore. In addition, due to a fake login request or a legitimate user’s wrong operation or malicious attacks from A, when the number of failed logins exceeds a predetermined value, the card would be locked during a certain period of time, which economizes on server time, cost, and computing resources. Therefore, the scheme can avoid the situation of the DoS caused by a wrong operation of a legitimate user or a malicious attack by an attacker.


#### 4.1.4. Resist Man in Middle Attack

Suppose thatA gets all the parameters transmitted on the public network channel. The authentication message is ϑi=hIDi‖Rsi‖SPIαi‖PNi and μi=hIDi‖Rsi‖SPIαi‖PNi, in which SPIαi=hIDi⊕Rsi‖x‖y is not saved in the smart card and transferred in public channel, x and y are the server private key and number, respectively, and Rsi is the random number chosen for the server randomly. Only U′ knows all the above parameters, and it is possible to intercept during the session. All the secret parameters are unlikely to be correctly guessed at the same time. Therefore, the scheme can resist man in the middle attack.


### 4.2. Efficiency Analysis

From the aspects of memory space, communication cost, and computational complexity, this section analyzes our scheme and other schemes in [4–8, 11] and compares the cost and efficiency of seven schemes in the registration, login, and authentication phase. Assume that all parameter byte lengths are equal to the strong one-way hash function output byte length.Table3 demonstrates the memory and communication cost, where L means the output byte length of the hash function. In our scheme, the security parameters saved in the smart card are SPIβi,SPIγi,SPIχi,ηi,h⋅. Therefore, the memory cost is 5L, and the communication cost includes all message bits λi,ωi,ϑi,PNi,μi,PNs transferred in public network channel in the login and authentication phase. Therefore, the communication cost is 6L. In Table 3, it illustrates that the proposed scheme is equal to the scheme in [5, 7, 8, 11], which is the lowest, in terms of communication cost. The storage overhead of our scheme is equal to Kaul and Awasthi’s scheme, which indicates the proposed scheme does not increase memory cost contrast to Kaul and Awasthi’s scheme [8]. Combined with the security analysis of six attacks mentioned in Table 2, only our scheme can resist all attacks. Therefore, considering the proposed scheme meets all security properties shown in Table 2, our scheme performs best in terms of security attributes and communication cost on the whole, which is more appropriate for resource-constrained intelligent terminal systems.Table 3
The comparison of memory and communication cost.
Cost testingWang et al.’s [4]Wen and Li’s [5]Chang et al.’s [6]Kumari et al.’s [7]Wang et al.’s [11]Kaul and Awasthi’s [8]OursMemory cost3L3L3L6L2L5L5LCommunication cost6L9L6L7L6L6L6LTable4 shows the results of the computational complexity comparison to other scheme, in which Th indicates the runtime of the hash function operation and TXOR indicates the runtime of the XOR operation. The computational complexity of Kaul and Awasthi’s scheme is (20Th+28TXOR), and ours has a smaller computational complexity (18Th+21TXOR) to meet more security needs. Our scheme only uses strong one-way hash function and simple XOR operation to operate. It is suitable for smart terminals with lightweight operation. It has low system overhead and low computational complexity, while ensuring the security and reliability of the system. The requirements of smart devices for data processing performance make them have good scalability.Table 4
The comparison of computational complexity.
SchemeRegistration phaseLogin phaseAuthentication phaseTotalWang et al.’s [4]2Th+2TXOR2Th+4TXOR5Th+10TXOR9Th+16TXORWen and Li’s [5]5Th+4TXOR6Th+6TXOR9Th+11TXOR20Th+21TXORChang et al.’s [6]2Th+TXOR4Th+3TXOR6Th+2TXOR12Th+6TXORKumari et al.’s [7]4Th+5TXOR5Th+10TXOR7Th+3TXOR16Th+18TXORWang et al.’s [11]2Th+2TXOR2Th+5TXOR6Th+9TXOR10Th+16TXORKaul and Awasthi’s [8]6Th+7TXOR8Th+12TXOR6Th+9TXOR20Th+28TXOROurs6Th+7TXOR7Th+10TXOR5Th+4TXOR18Th+21TXORThe diagram in Figure3 shows comparative analysis of the calculation complexity about four phases including Kaul and Awasthi’s, AES, ECC, and ours schemes. The scheme proposed by Kaul and Awasthi is test time 57 μs. The scheme based on ECC is test time 65.8 μs. ECC has high computational complexity in password changing phase, but it has good performance in registration and login phase. Our scheme computational complexity of test time is 50.6 μs, one of the lowest values of four schemes. Taking computational complexity as metric, we also proved the model of product authorization chain performs much better than the other three schemes during registration stage, login, and authentication stage.Figure 3
The efficiency comparison of four schemes.


## 4.1. Security Analysis

The security of our scheme is investigated, which is the ability of a scheme to fend off some well-known attacks and is compared with the schemes in [4–8, 11]. Table 2 is the comparison result. “✔” indicates that it has resistance to some known attacks. “✕” indicates that it cannot be defended or does not have the resistance. The result illustrates that even if attackers extract all the values saved in the smart card and intercept all communication information in public channel, the security of the proposed solution is not affected.Table 2
Security comparisons with other schemes.
Attack testingWang et al.’s [4]Wen and Li’s [5]Chang et al.’s [6]Kumari et al.’s [7]Wang et al.’s [11]Kaul and Awasthi’s [8]OursResist offline password guessing attack✕✕✕✕✔✕✔Resist replay attack✔✔✔✔✔✔✔Resist impersonation attack✕✕✕✔✔✔✔Resist DoS attack✕✕✕✔✕✔✔Resist insider attack✕✔✕✕✔✔✔Resist man in middle attack✔✕✔✕✔✔✔Secure session key establishment✕✔✕✔✕✔✔


### 4.1.1. Resist Offline Password Guessing Attack

Assume an attackerA obtains the user’s smart card and extracts all values SPIβi,SPIγi,SPIχi,ηi saved in the smart card by taking some actions. At the same time, the security parameters λi,ωi,ϑi,PNi,μi,PNS transmitted in public channel can also be obtained. Because λi=IDi⊕Rsi=IDi∗⊕Rsi∗, Rsi∗=SPIγi⊕hSPIαi∗⊕RPWi∗, and SPIαi∗=SPIβi⊕hIDi∗⊕RPWi∗, in which IDi∗ and RPWi∗ are unknown, A needs to correctly surmise the values of two unknowns at least each time, which is impossible in polynomial time [13]. Therefore, A cannot guess the values IDiand PWi from all the gained information. Therefore, the scheme proposed in this article can defend against offline password guessing attack.


### 4.1.2. Resist Impersonation Attack

(1)
Impersonating Legitimate UserAi. For counterfeiting Ai, A must be able to calculate the correct user login request λi,ωi,ϑi,PNi; as can be seen from the model of product authorization chain, it is impossible for A to get useful information from the obtained information from the missing or stolen smart card to infer IDi,PWi,b,andRsi. And A cannot gain the server’s private key x and random number Rsi to calculate SPIαi=hIDi⊕Rsi‖x‖y. So, A cannot successfully disguise as a legitimate user Ai.(2)
Impersonating ServerS. The server does not reveal the unique key x and number y. Hash function has the strong unidirectionality; hence, A cannot calculate SPIαi∗=hλi∗‖x‖y accurately and then calculates ϑi∗=hIDi∗‖Rsi∗‖SPIαi∗‖PNS to make ϑi∗=ϑi. So, A is not able to successfully dress up as a server.


### 4.1.3. Resist DoS Attack

WhenAi logs in the server, the smart card first checks whether the input IDiand PWi are correct or not. Only with the correct input IDiand PWi, the smart card would accept the login request. Therefore, it does not exist that Ai inputs error login request IDiand PWi to cause login request calculated incorrectly. The user is exposed to denial-of-service vulnerabilities after the server verification test failure. Similarly, it is impossible for A to update the values SPIβi,SPIγi,SPIχi,ηi in the smart card with any password so that it cannot be used anymore. In addition, due to a fake login request or a legitimate user’s wrong operation or malicious attacks from A, when the number of failed logins exceeds a predetermined value, the card would be locked during a certain period of time, which economizes on server time, cost, and computing resources. Therefore, the scheme can avoid the situation of the DoS caused by a wrong operation of a legitimate user or a malicious attack by an attacker.


### 4.1.4. Resist Man in Middle Attack

Suppose thatA gets all the parameters transmitted on the public network channel. The authentication message is ϑi=hIDi‖Rsi‖SPIαi‖PNi and μi=hIDi‖Rsi‖SPIαi‖PNi, in which SPIαi=hIDi⊕Rsi‖x‖y is not saved in the smart card and transferred in public channel, x and y are the server private key and number, respectively, and Rsi is the random number chosen for the server randomly. Only U′ knows all the above parameters, and it is possible to intercept during the session. All the secret parameters are unlikely to be correctly guessed at the same time. Therefore, the scheme can resist man in the middle attack.


## 4.1.1. Resist Offline Password Guessing Attack

Assume an attackerA obtains the user’s smart card and extracts all values SPIβi,SPIγi,SPIχi,ηi saved in the smart card by taking some actions. At the same time, the security parameters λi,ωi,ϑi,PNi,μi,PNS transmitted in public channel can also be obtained. Because λi=IDi⊕Rsi=IDi∗⊕Rsi∗, Rsi∗=SPIγi⊕hSPIαi∗⊕RPWi∗, and SPIαi∗=SPIβi⊕hIDi∗⊕RPWi∗, in which IDi∗ and RPWi∗ are unknown, A needs to correctly surmise the values of two unknowns at least each time, which is impossible in polynomial time [13]. Therefore, A cannot guess the values IDiand PWi from all the gained information. Therefore, the scheme proposed in this article can defend against offline password guessing attack.


## 4.1.2. Resist Impersonation Attack

(1)
Impersonating Legitimate UserAi. For counterfeiting Ai, A must be able to calculate the correct user login request λi,ωi,ϑi,PNi; as can be seen from the model of product authorization chain, it is impossible for A to get useful information from the obtained information from the missing or stolen smart card to infer IDi,PWi,b,andRsi. And A cannot gain the server’s private key x and random number Rsi to calculate SPIαi=hIDi⊕Rsi‖x‖y. So, A cannot successfully disguise as a legitimate user Ai.(2)
Impersonating ServerS. The server does not reveal the unique key x and number y. Hash function has the strong unidirectionality; hence, A cannot calculate SPIαi∗=hλi∗‖x‖y accurately and then calculates ϑi∗=hIDi∗‖Rsi∗‖SPIαi∗‖PNS to make ϑi∗=ϑi. So, A is not able to successfully dress up as a server.


## 4.1.3. Resist DoS Attack

WhenAi logs in the server, the smart card first checks whether the input IDiand PWi are correct or not. Only with the correct input IDiand PWi, the smart card would accept the login request. Therefore, it does not exist that Ai inputs error login request IDiand PWi to cause login request calculated incorrectly. The user is exposed to denial-of-service vulnerabilities after the server verification test failure. Similarly, it is impossible for A to update the values SPIβi,SPIγi,SPIχi,ηi in the smart card with any password so that it cannot be used anymore. In addition, due to a fake login request or a legitimate user’s wrong operation or malicious attacks from A, when the number of failed logins exceeds a predetermined value, the card would be locked during a certain period of time, which economizes on server time, cost, and computing resources. Therefore, the scheme can avoid the situation of the DoS caused by a wrong operation of a legitimate user or a malicious attack by an attacker.


## 4.1.4. Resist Man in Middle Attack

Suppose thatA gets all the parameters transmitted on the public network channel. The authentication message is ϑi=hIDi‖Rsi‖SPIαi‖PNi and μi=hIDi‖Rsi‖SPIαi‖PNi, in which SPIαi=hIDi⊕Rsi‖x‖y is not saved in the smart card and transferred in public channel, x and y are the server private key and number, respectively, and Rsi is the random number chosen for the server randomly. Only U′ knows all the above parameters, and it is possible to intercept during the session. All the secret parameters are unlikely to be correctly guessed at the same time. Therefore, the scheme can resist man in the middle attack.


## 4.2. Efficiency Analysis

From the aspects of memory space, communication cost, and computational complexity, this section analyzes our scheme and other schemes in [4–8, 11] and compares the cost and efficiency of seven schemes in the registration, login, and authentication phase. Assume that all parameter byte lengths are equal to the strong one-way hash function output byte length.Table3 demonstrates the memory and communication cost, where L means the output byte length of the hash function. In our scheme, the security parameters saved in the smart card are SPIβi,SPIγi,SPIχi,ηi,h⋅. Therefore, the memory cost is 5L, and the communication cost includes all message bits λi,ωi,ϑi,PNi,μi,PNs transferred in public network channel in the login and authentication phase. Therefore, the communication cost is 6L. In Table 3, it illustrates that the proposed scheme is equal to the scheme in [5, 7, 8, 11], which is the lowest, in terms of communication cost. The storage overhead of our scheme is equal to Kaul and Awasthi’s scheme, which indicates the proposed scheme does not increase memory cost contrast to Kaul and Awasthi’s scheme [8]. Combined with the security analysis of six attacks mentioned in Table 2, only our scheme can resist all attacks. Therefore, considering the proposed scheme meets all security properties shown in Table 2, our scheme performs best in terms of security attributes and communication cost on the whole, which is more appropriate for resource-constrained intelligent terminal systems.Table 3
The comparison of memory and communication cost.
Cost testingWang et al.’s [4]Wen and Li’s [5]Chang et al.’s [6]Kumari et al.’s [7]Wang et al.’s [11]Kaul and Awasthi’s [8]OursMemory cost3L3L3L6L2L5L5LCommunication cost6L9L6L7L6L6L6LTable4 shows the results of the computational complexity comparison to other scheme, in which Th indicates the runtime of the hash function operation and TXOR indicates the runtime of the XOR operation. The computational complexity of Kaul and Awasthi’s scheme is (20Th+28TXOR), and ours has a smaller computational complexity (18Th+21TXOR) to meet more security needs. Our scheme only uses strong one-way hash function and simple XOR operation to operate. It is suitable for smart terminals with lightweight operation. It has low system overhead and low computational complexity, while ensuring the security and reliability of the system. The requirements of smart devices for data processing performance make them have good scalability.Table 4
The comparison of computational complexity.
SchemeRegistration phaseLogin phaseAuthentication phaseTotalWang et al.’s [4]2Th+2TXOR2Th+4TXOR5Th+10TXOR9Th+16TXORWen and Li’s [5]5Th+4TXOR6Th+6TXOR9Th+11TXOR20Th+21TXORChang et al.’s [6]2Th+TXOR4Th+3TXOR6Th+2TXOR12Th+6TXORKumari et al.’s [7]4Th+5TXOR5Th+10TXOR7Th+3TXOR16Th+18TXORWang et al.’s [11]2Th+2TXOR2Th+5TXOR6Th+9TXOR10Th+16TXORKaul and Awasthi’s [8]6Th+7TXOR8Th+12TXOR6Th+9TXOR20Th+28TXOROurs6Th+7TXOR7Th+10TXOR5Th+4TXOR18Th+21TXORThe diagram in Figure3 shows comparative analysis of the calculation complexity about four phases including Kaul and Awasthi’s, AES, ECC, and ours schemes. The scheme proposed by Kaul and Awasthi is test time 57 μs. The scheme based on ECC is test time 65.8 μs. ECC has high computational complexity in password changing phase, but it has good performance in registration and login phase. Our scheme computational complexity of test time is 50.6 μs, one of the lowest values of four schemes. Taking computational complexity as metric, we also proved the model of product authorization chain performs much better than the other three schemes during registration stage, login, and authentication stage.Figure 3
The efficiency comparison of four schemes.


## 5. Conclusions

In view of the limitation of Kaul and Awasthi’s scheme in resisting offline password guessing attack, this paper retains other security advantages of Kaul and Awasthi’s scheme and proposes a lightweight wireless two-way authentication scheme based on product authentication chain. This scheme is suitable for solving the problem of limited authentication calculation of IoT terminals. It can effectively avoid common attacks such as offline password guessing attack and man in the middle attack, establish a secure session key, modify the password freely, and ensure the security of Internet of things system. At the same time, in order to avoid strict clock synchronization of various devices in network, the continuously updated sending packet sequence number is used to ensure the validity of the message. According to the analysis of security, cost, and efficiency, the proposed scheme has higher security, less system overhead, lower computational cost, and higher operational efficiency and is more fit for resource-limited user intelligent terminal equipment.



---

*Source: 8852901-2021-09-08.xml*