# Dependable and Provable Secure Two-Factor Mutual Authentication Scheme Using ECC for IoT-Based Telecare Medical Information System

Authors: Niranchana Radhakrishnan; Amutha Prabakar Muniyandi
Journal: Journal of Healthcare Engineering
 (2022)

---

## Abstract

With the recent tremendous growth in technology, the Internet of Things (IoT) Telecare Medicine Information System (TMIS) is the most widely used medical information system with prominent achievements. Authentication schemes, which use Smart cards, offer the best solution for TMIS applications that in turn provide efficiency and security. Furthermore, authentication schemes that combine passwords and smart cards are considered to be an effective solution for the two-factor authentication scheme. Such schemes contribute to high security along with the public-key cryptosystem. In this research work, a two-factor authentication technique that is both efficient and secure, which makes use of Elliptic Curve Cryptography (ECC) with smart cards, has been proposed. Here, we have used the fundamental assumptions of strong and collision free cryptographic Hash function and Elliptic Curve arithmetic. The proposed authentication technique protects user privacy by allowing registered users to change their passwords without revealing their identity to the server. The proposed authentication scheme has been subjected to formal and informal security investigations. In terms of efficiency and performance, the proposed two-factor authentication technique was compared with the existing relevant two-factor authentication schemes based on ECC. This scheme satisfies the two-factor authentication scheme’s basic security standards.


---

## Body

## 1. Introduction

It is related to the need for information and communication technology in hospitals and medical institutions for telecare medical information systems that permits medical personnel and patients to perform remote medical care services via the Internet, lowering medical costs and reducing time-consuming hospital visits. The digital revolution has ushered in a slew of new opportunities across the board, and it has boosted the use of information technology. Many latest devices, advanced technologies, and sharing of information have promised a much easier and better life. The Telecare Medical Information System (TMIS) provides a wide platform for sharing the medical related issues, and it offers quick solution between the patients and doctors. This technology enables the patient or the doctor to access patients related personal record from anywhere in the world at any time. It has become a good solution for the modern medical field to maintain the patient’s personal medical records. The remote system access is a widespread technology used by the normal user, and it becomes inevitable nowadays. Any lawful patient will be able to obtain information from the server utilizing remote access mode after the authentication between the patient and the medical server has been verified. Almost every remote user authentication solution is based on the use of smart cards. Several two-factor authentication schemes are proposed or designed by the developers. Password based authentication along with the smart card becomes more popular among the users. Still, most of the researchers are focusing on developing more secure and highly efficient remote authentication schemes using two factors. In 1981, Lamport [1] was the first to propose a remote authentication scheme over a potentially insecure public channel. This was the road map for the many research articles based on password-based authentication techniques published over the last three decades. Using Elliptic Curve Cryptography (ECC), we have suggested an efficient and secure two-factor authentication approach for the Telecare Medical Information System (TMIS).


### 1.1. TMIS System Architecture

The TMIS system architecture is illustrated in a Figure1 that includes multiple entities such as the registration center, user/patient Ui, and medical server. S. Patients are registered at the Registration Center, and smart cards are distributed to individuals who have registered. It also registers the other servers almost simultaneously. Patients upload their healthcare data to a telecare server at their convenience using wired/wireless terminals at home. After receiving a patient’s medical records, the doctors or health care professionals at the healthcare center make a diagnosis and then use the Internet to administer the patient’s final and best medical treatments. The TMIS system is equipped to overcome the obstacles of location and time using this way.Figure 1
Overview of telecare medicine information systems.


### 1.2. Notations

Table1 lists out and explains the basic notations used in this research work.Table 1
The proposed scheme’s notations.
NotationsDescriptionsUiLegal userSTrusted serverIDiUser’s identityPWiUser’s passwordTr, Tc,Tc′, Ts,Ts′Time stamp valuesSKnewSession keyh⋅Hash functionSCiSmart cardΔTTime intervalrandr,rands,randiRandom nonce||Concatenation operatorSKey,PKeyx,yPrivate and public key pairsy2=x3+ax+bElliptic curve equationGx,yGroup generator point overZp∗Zp∗Group of ECC points overp


### 1.3. Our Contributions

This research work includes the following contributions:(1)
This particular work proposes an efficient and provably secure two-factor user authentication scheme based on Elliptic Curve Cryptography (ECC) using smart cards.(2)
The suggested approach incorporates validation and verification at several levels of authentication. The smart card performs the initial level of authentication verification on the reader side, while the server does the second level of verification.(3)
This research study addresses the shortcomings of typical password-based authentication solutions. Without involving the server, the user can simply update their password.(4)
The proposed two-factor authentication technique provides robust security while having less computational and communication cost.(5)
This particular scheme offers user anonymity, and it includes the best features from the other two-factor authentication schemes, Li et al. [2] and Das [3], for strengthening its security.


### 1.4. The Evaluation Criteria

An evaluation criterion is required to assess the security and efficiency of the already existing methods. Several metrics for evaluation have been stated in the literature [4–6], whereas Madhusudhan and Mittal [7] in 2012 asserted that the previously suggested measurements were contradictory. In their research work, they listed a new set of evaluation criterion. Following that, Wang et al. [8, 9] revised the metrics listed in the literature [7] and suggested some additional security standards in 2016. In this research work, we test the efficiency of our proposed method, with the security criteria stated by Wang et al. [10], summarized in Table 2.Table 2
Evaluation criteria.
CriteriaEC-1:User anonymity untraceabilityEC-2:Stolen smart card attackEC-3:Offline password guessing attackEC-4:Insider attackEC-5:Replay attackEC-6:Session key agreementEC-7:Impersonation attackEC-8:Multilevel authenticationEC-9:Server free password changeEC-10:Forward secrecyEC-11:Denial of service attackEC-12:Known session-specific temporary information attack


### 1.5. Road Map of the Paper

The following sections are structured throughout this study effort; Section2 contributes a quick review of the two-factor authentication protocol for Telecare Medical Information System (TMIS). The flaws of Karthigaiveni-Indrani are discussed in Section 4. In Section 5, an explanation about the proposed two-factor authentication scheme based on the smart card is given. Section 6 provides security analysis of the proposed authentication scheme in the view of formal and informal security analysis. The comprehensive performance study, which covers both computational and communication expenses, is explained in Section 7. The findings in 8 brought our scheme to a conclusion.


## 1.1. TMIS System Architecture

The TMIS system architecture is illustrated in a Figure1 that includes multiple entities such as the registration center, user/patient Ui, and medical server. S. Patients are registered at the Registration Center, and smart cards are distributed to individuals who have registered. It also registers the other servers almost simultaneously. Patients upload their healthcare data to a telecare server at their convenience using wired/wireless terminals at home. After receiving a patient’s medical records, the doctors or health care professionals at the healthcare center make a diagnosis and then use the Internet to administer the patient’s final and best medical treatments. The TMIS system is equipped to overcome the obstacles of location and time using this way.Figure 1
Overview of telecare medicine information systems.


## 1.2. Notations

Table1 lists out and explains the basic notations used in this research work.Table 1
The proposed scheme’s notations.
NotationsDescriptionsUiLegal userSTrusted serverIDiUser’s identityPWiUser’s passwordTr, Tc,Tc′, Ts,Ts′Time stamp valuesSKnewSession keyh⋅Hash functionSCiSmart cardΔTTime intervalrandr,rands,randiRandom nonce||Concatenation operatorSKey,PKeyx,yPrivate and public key pairsy2=x3+ax+bElliptic curve equationGx,yGroup generator point overZp∗Zp∗Group of ECC points overp


## 1.3. Our Contributions

This research work includes the following contributions:(1)
This particular work proposes an efficient and provably secure two-factor user authentication scheme based on Elliptic Curve Cryptography (ECC) using smart cards.(2)
The suggested approach incorporates validation and verification at several levels of authentication. The smart card performs the initial level of authentication verification on the reader side, while the server does the second level of verification.(3)
This research study addresses the shortcomings of typical password-based authentication solutions. Without involving the server, the user can simply update their password.(4)
The proposed two-factor authentication technique provides robust security while having less computational and communication cost.(5)
This particular scheme offers user anonymity, and it includes the best features from the other two-factor authentication schemes, Li et al. [2] and Das [3], for strengthening its security.


## 1.4. The Evaluation Criteria

An evaluation criterion is required to assess the security and efficiency of the already existing methods. Several metrics for evaluation have been stated in the literature [4–6], whereas Madhusudhan and Mittal [7] in 2012 asserted that the previously suggested measurements were contradictory. In their research work, they listed a new set of evaluation criterion. Following that, Wang et al. [8, 9] revised the metrics listed in the literature [7] and suggested some additional security standards in 2016. In this research work, we test the efficiency of our proposed method, with the security criteria stated by Wang et al. [10], summarized in Table 2.Table 2
Evaluation criteria.
CriteriaEC-1:User anonymity untraceabilityEC-2:Stolen smart card attackEC-3:Offline password guessing attackEC-4:Insider attackEC-5:Replay attackEC-6:Session key agreementEC-7:Impersonation attackEC-8:Multilevel authenticationEC-9:Server free password changeEC-10:Forward secrecyEC-11:Denial of service attackEC-12:Known session-specific temporary information attack


## 1.5. Road Map of the Paper

The following sections are structured throughout this study effort; Section2 contributes a quick review of the two-factor authentication protocol for Telecare Medical Information System (TMIS). The flaws of Karthigaiveni-Indrani are discussed in Section 4. In Section 5, an explanation about the proposed two-factor authentication scheme based on the smart card is given. Section 6 provides security analysis of the proposed authentication scheme in the view of formal and informal security analysis. The comprehensive performance study, which covers both computational and communication expenses, is explained in Section 7. The findings in 8 brought our scheme to a conclusion.


## 2. Literature Review

Many authentication and key agreement methods [10–14] have been proposed since the turn of the decade, many of which have been proven to be vulnerable against a variety of well-known security threats. In 2005, Yang et al. [15] presented a scheme for a secure authentication procedure for the Session Initiation Protocol, which improves the security of the original scheme that depends on the Diffie-Hellman key exchange protocol. They claimed that the existing authentication protocol is prone to the offline password guessing attack and the server-spoofing attack. Then, to enhance the security, they presented an improved authentication protocol.Then, Huang et al. [16] proved that Yang et al. [15] scheme was unable to resist the stolen-verifier, offline password guessing, and Denning-Sacco attacks. Huang et al. [16] method could not be used for the low computation power devices due to its high computational cost [2, 17].Tsai et al. [18] put forth an efficient nonce-based authentication protocol by using Session Initiation Protocols (SIP). Arshad et al. [19] claimed that Tsai’s proposed method suffered with retrieving the password and stolen-verifier attack. Then, Tsai et al. [18] scheme failed to offer known-key secrecy attack followed by perfect forward secrecy. Arshad et al. [19] proposed an improvised mutual authentication scheme that depends on Elliptic Curve discrete logarithm problem for SIP application. Next, He et al. [20] proved that Arshad et al.’s [19] method was subjected to the password guessing attack in an offline mode. Later, they published an improvised authentication scheme that uses Elliptic Curve Cryptography for SIP.In 2010, Wu et al. [21] came with a password based authentication scheme that used smart card for TMIS. He et al. [22] showed that Wu et al. [21] scheme was vulnerable to impersonation attacks and insider attacks. He et al. [22] stated an advanced authentication scheme to overcome the vulnerabilities present in Wu et al. scheme [21].Wei et al. [23] proved that Wu et al. [21] and He et al. [22] schemes do not achieve the basic security requirements of two-factor authentication scheme. Wei et al. [23] proposed an authentication protocol for TMIS application and pointed out that their proposed scheme fulfills all the needed security requirements of Two-factor authentication schemes.Xu et al. [24] recommended an efficient two-factor mutual authentication scheme with less computational expense. This scheme facilitated patient anonymity by introducing dynamic identity. When compared to related two-factor authentication techniques, the authors believe that the suggested scheme is substantially more efficient and secure.In 2014, Islam et al. [17] claimed that Xu et al. [24] method is not suitable for practical application because the following points are not satisfied: (a) Xu et al. [24] scheme failed to provide strong authentication in login and authentication phases; (b) this scheme does not enable the user to change his password correctly during the password changing phase; and (c) this scheme failed to achieve the strong replay attack.For the purpose of overcoming the security flaws of Xu et al. [24] scheme, next, Islam et al. [17] proposed a provably secure two-factor authentication scheme. Chaudhry et al. [25] claimed that Islam et al. [17] scheme suffered from user impersonation and server impersonation attacks. Chaudhry et al. [25] showed an enhanced authentication protocol for addressing the weakness identified in the Islam et al. [17] scheme.Qiu et al. [26] showed that Chaudhry et al. [25] and Islam et al. [17] schemes suffer from offline password guessing, impersonation of user, or server attack and man-in-middle attack. For the purpose of overcoming the limitations of both schemes, Qiu et al. [26] proposed an enhanced authentication scheme that opts smart card. Kumari and Renuka [27] proved in 2019 that Qiu et al. technique [26] is flawed. Then, they introduced a three-factor authentication approach for healthcare scenarios that was more secure and dependable.In 2017, Kumari et al. [28] cited that Lu et al. [29] authentication protocol suffered from user and server impersonation attacks. According to the author, the Lu et al. [29] protocol failed to preserve user credentials and to offer mutual authentication. Kumari et al. [28] stated a secure ECC-based authentication protocol for SIP communication model by incorporating the user anonymity, and this scheme overcomes the pitfalls of Lu et al. [29] scheme.Amin et al. [30] presented and published a three-factor authentication protocol for a E-health care systems, and the authors claim that this scheme withstands most of the common attacks. Ravanbakhsh and Nazari scheme [31] proved that Amin et al.’s [30] study effort could not fulfil the patient and backward secrecy, powerful replay attack, disclosure of session key, and insider attack and untraceability requirements. They later proposed a new and effective remote user mutual authentication protocol for TMIS, based on ECC and the fuzzy extractor. Latestly Ostad et al. [32] proved that Ravanbakhsh and Nazari scheme [31] has two flaws: a known session-specific temporary information attack and not offering perfect forward secrecy. Finally, they proposed a unique, user authentication and key agreement with unlinkability approach for TMIS based on ECC in order to address these shortcomings.Recently, Amin et al. [33] published a three-factor authentication protocol for TMIS application to overcome the pitfalls of the Mishra et al. [34] authentication protocol and Xu et al. schemes [24]. Wazid et al. [35] proved that Amin et al.’s method [33] was subjected to privileged-insider attack, the smart card loss attack, password guessing attack in an online and offline modes, and the impersonation of user attack including strong replay attacks.Giri et al. [36] proposed a TMIS remote user authentication mechanism that is both effective and resilient. Giri et al.’s technique [36] was cryptanalyzed by Arshad and Rasoolzadegan citey8, who revealed that their protocol is subject to replay attacks and does not provide perfect forward secrecy. On the other hand, Arshad and Rasoolzadegan [37] demonstrated that the technique proposed by Amin and Biswas [38] does not survive the offline password guessing attack and the replay attack or provide perfect forward secrecy.Subsequently, Arshad and Rasoolzadegan [37] proposed the efficient authentication scheme for TMIS and stated that their proposed scheme can overcome the existing attacks. Then, Ostad-Sharif [39] proved all three protocols proposed by Arshad and Rasoolzadegan [37]. Both Giri et al. [36] and Amin-Biswas [38] schemes were additionally vulnerable to the key compromise impersonation attack. Hence, to overcome this challenge in security, Ostad-Sharif et al. [39] presented an authentication and key agreement protocol for TMIS that was based on ECC. Recently, Kumari et al. [40] showed that Ostad-Sharif et al. [39] technique not only is vulnerable to key compromise impersonation attacks, but it is also susceptible to key compromise password guessing attacks.Lee et al. [41] proposed an efficient protocol for TMIS, and the authors have mentioned that his authentication scheme withstands the known attacks. Karuppiah et al. [3] proved that Lee et al.’s [41] protocol suffered from forgery attacks and offline password guessing attacks, and Lee et al. [41] scheme fails to withstand following important criteria such as user anonymity, forward secrecy, and mutual authentication.Karuppiah et al. [3] published an enhanced version of password based authentication protocol to rectify the weakness found in the Lee et al. [41] scheme. The authors show that this scheme is provably secure with respect to random oracle model. In 2018, Li et al. [41] presented a cloud based authentication and privacy preserving protocol for Tele Medicine Information System, and the authors claim that it is more secure against most of the well-known attacks. In global mobility networks, Karuppiah et al. [42] published a user mutual authentication scheme using smart cards for remote systems; they stated that their protocol was strong against the existing attacks. Next, they proposed [43] a dynamic ID-based generic framework for anonymous authentication scheme to be utilized for roaming service in global mobility networks. Additionally, a light weight authentication protocol with user anonymity for roaming service in ubiquitous networks has been proposed [42].Recently, Kumar et al. [44] claimed that Li et al.’s [45] scheme suffered from the following attacks: in the healthcare center, uploading phase message authentication is not achieved, session key is not used in healthcare center uploading phase, and impersonation attack is possible in patient data upload phase, patient anonymity, and patient unlinkability. Kumar et al. [44] proposed an enhanced version of Li et al. [45] protocol, and the new version of protocol satisfied the following security features, such as man-in-the-middle attack, provided patient anonymity, resists replay attack, known-impersonation attack, secure session key, and patient unlinkability.Later, Kumar et al. [44] scheme was proved to be susceptible to session specific temporary information attack, and it does not guarantee perfect forward secrecy. Using ECC, a biometric user authentication protocol approach [46] with privacy protection was also proposed. For agricultural monitoring, techniques such as secure user authentication and key-agreement schemes [47] employing wireless sensor networks have been developed. Then, the best authentication methods in the field of IoT and cloud server [47, 48] were even proposed.


## 3. Review of Karthigaiveni-Indrani’s [49] Scheme

This section reviews the scheme of Karthigaiveni-Indrani [49], which comprises registration phase, login, and authentication phase.


### 3.1. Registration Phase

For registering a new patient to the server maintained in the healthcare center, the below discussed steps are performed by using a secured channel; later, the smart cardSCi will be obtained from the healthcare center.The registration phase is shown in the steps discussed below:(1)
The userUi chooses IDi and password PWi without the involvement of the server.(2)
Then, theUi chooses a nonce Ni and calculates(1)MIdi=hIDiNiTr,MPwi=hPWiNiTr.(3)
Then, the request for the registrationMIdi,MPwi,Ni,Tr is forwarded to the server S.(4)
At the server side, the registration request is received from the UserUi and then the timestamp Tr is verified; if it is valid, the request is accepted, or else rejected.(5)
Then, a nonceMi is chosen at the server side, and the following is computed as(2)AIdi=ESkeyhMIdiIDSMi.(6)
CalculateMi⋅Ni⋅Px,y by using ECC and the values stored by the server S for all the users registered to it.(7)
The values such asMIdi,MPwi,AIdi,Tr,Mi⋅Ni⋅Px,y,h⋅,IDs have been stored in the smart card SCi by the server, and they are issued to the registered users.


### 3.2. The Login and Authentication Phase

In this phase, the patient who is already registered in the healthcare center can log in with their login credentials, and the steps to be executed are shown as follows:(1)
The userUi keys his IDi and PWi after inserting the SCi into the card reader.(2)
Then, the values as shown below are calculated:(3)MIdinew=hIDiNiTr,MPwinew=hPWiNiTr.(3)
Suppose that the values(4)MIdinew=MIdi,MPwinew=MPwi.are equal, and then, the login request is accepted, and further mentioned steps are executed; else the request is rejected.(4)
The random nonceRi is chosen and by using the values Ri⋅Mi⋅Ni⋅Px,y,Px,yECC−point below mentioned calculations are done:(5)B1=Ri⊕hAIdiTcMi,Ni⋅Px,y,B2=hAIdiRi⋅Ni⋅Px,yTc.(5)
Then, the login request message Lrq =B1,B2,AIdi,Tc is generated and sent to the server S.(6)
After receiving the login request message from the registered user, the serverS verifies the Timestamp values, i.e., ΔT≤Ts−Tc. If the timestamp values are valid, then the request message is accepted, and further calculations are done, or else it is rejected.(7)
Next, calculate(6)Ri=B1⊕hAIdiTcMi⋅Ni⋅Px,y.And the values ofRi⋅Mj⋅Ni⋅Px,y are also calculated.(8)
By using the above mentioned values,(7)B2new=hAIdiRi⋅Mj⋅Ni⋅Px,yTc.is calculated. If both the valuesB2 and B2new are the same, then the login request message is accepted at the server side; else it is rejected.(9)
Then, a random nonceRj is selected, and calculate(8)Qx,y=Rj⋅Ri⋅Mj⋅Ni⋅Px,y,m=hMIdiIDsNi=DskeyAIdi.(10)
Next, the session key(9)SK=hQxx,yTcTsm.is calculated along withB3=Rj⊕m and B4=EskAIdi.(11)
The mutual authentication messageMA=B3,B4,Ts is sent to the registered user.(12)
After receiving the mutual authentication message at the timestampTm, the validity of the timestamp is verified; if it is valid, then the request is accepted.(13)
Then, calculate(10)m=hMIdiIDsNi=DskeyAIdi,Rj=B3⊕m,Qx,y=Rj⋅Ri⋅Mj⋅Ni⋅Px,yECCpoint.(14)
Then, calculate Session Key(11)SK=hQxx,yTcTsm.(15)
IfAIdi=DSkB4 are equal, then it is accepted or else rejected.


## 3.1. Registration Phase

For registering a new patient to the server maintained in the healthcare center, the below discussed steps are performed by using a secured channel; later, the smart cardSCi will be obtained from the healthcare center.The registration phase is shown in the steps discussed below:(1)
The userUi chooses IDi and password PWi without the involvement of the server.(2)
Then, theUi chooses a nonce Ni and calculates(1)MIdi=hIDiNiTr,MPwi=hPWiNiTr.(3)
Then, the request for the registrationMIdi,MPwi,Ni,Tr is forwarded to the server S.(4)
At the server side, the registration request is received from the UserUi and then the timestamp Tr is verified; if it is valid, the request is accepted, or else rejected.(5)
Then, a nonceMi is chosen at the server side, and the following is computed as(2)AIdi=ESkeyhMIdiIDSMi.(6)
CalculateMi⋅Ni⋅Px,y by using ECC and the values stored by the server S for all the users registered to it.(7)
The values such asMIdi,MPwi,AIdi,Tr,Mi⋅Ni⋅Px,y,h⋅,IDs have been stored in the smart card SCi by the server, and they are issued to the registered users.


## 3.2. The Login and Authentication Phase

In this phase, the patient who is already registered in the healthcare center can log in with their login credentials, and the steps to be executed are shown as follows:(1)
The userUi keys his IDi and PWi after inserting the SCi into the card reader.(2)
Then, the values as shown below are calculated:(3)MIdinew=hIDiNiTr,MPwinew=hPWiNiTr.(3)
Suppose that the values(4)MIdinew=MIdi,MPwinew=MPwi.are equal, and then, the login request is accepted, and further mentioned steps are executed; else the request is rejected.(4)
The random nonceRi is chosen and by using the values Ri⋅Mi⋅Ni⋅Px,y,Px,yECC−point below mentioned calculations are done:(5)B1=Ri⊕hAIdiTcMi,Ni⋅Px,y,B2=hAIdiRi⋅Ni⋅Px,yTc.(5)
Then, the login request message Lrq =B1,B2,AIdi,Tc is generated and sent to the server S.(6)
After receiving the login request message from the registered user, the serverS verifies the Timestamp values, i.e., ΔT≤Ts−Tc. If the timestamp values are valid, then the request message is accepted, and further calculations are done, or else it is rejected.(7)
Next, calculate(6)Ri=B1⊕hAIdiTcMi⋅Ni⋅Px,y.And the values ofRi⋅Mj⋅Ni⋅Px,y are also calculated.(8)
By using the above mentioned values,(7)B2new=hAIdiRi⋅Mj⋅Ni⋅Px,yTc.is calculated. If both the valuesB2 and B2new are the same, then the login request message is accepted at the server side; else it is rejected.(9)
Then, a random nonceRj is selected, and calculate(8)Qx,y=Rj⋅Ri⋅Mj⋅Ni⋅Px,y,m=hMIdiIDsNi=DskeyAIdi.(10)
Next, the session key(9)SK=hQxx,yTcTsm.is calculated along withB3=Rj⊕m and B4=EskAIdi.(11)
The mutual authentication messageMA=B3,B4,Ts is sent to the registered user.(12)
After receiving the mutual authentication message at the timestampTm, the validity of the timestamp is verified; if it is valid, then the request is accepted.(13)
Then, calculate(10)m=hMIdiIDsNi=DskeyAIdi,Rj=B3⊕m,Qx,y=Rj⋅Ri⋅Mj⋅Ni⋅Px,yECCpoint.(14)
Then, calculate Session Key(11)SK=hQxx,yTcTsm.(15)
IfAIdi=DSkB4 are equal, then it is accepted or else rejected.


## 4. Security Flaws in Karthigaiveni-Indrani’s Scheme

In 2019, Karthigaiveni-Indrani [49] proposed a two-factor authentication scheme with key agreement, which was comprised of registration phase, login phase, and authentication phase. Providing the Karthigaiveni-Indrani’s scheme might make proposed scheme lengthier. So, in this section, the security shortcomings of Karthigaiveni-Indrani’s scheme have been discussed. For reviewing Karthigaiveni-Indrani’s scheme, readers can go through [49].


### 4.1. The Offline Password Guessing Attack

Assume that an attacker obtains the values from smart card, \{RIDi, RPWi,TR,mi⋅ni⋅Px,y, h⋅, CIDi, IDS\} from the lost/stolen smart card by Assumption 2 as already mentioned in [13]. By retrieving the values, the attacker is capable of performing the offline password guessing attack by executing the following steps:(1)
Attacker guesses the password asPWia(2)
ComputesRPWi∗=hPWianiTR where ni and TR are discovered from the smart card(3)
VerifyRPWi∗=?RPWi; if true, then the value PWia guessed password is correct(4)
If false, then the attacker will repeat the steps from 1 to 3, untilPWi=PWiaHence, this scheme does not resist offline password guessing attack.


### 4.2. The User Anonymity

Assume that an attacker obtains the values \{RIDi, RPWi, TR, mi⋅ni⋅Px,y, h⋅, CIDi, IDS\} from the smart card under Assumption 2, referred to in [13]; using these values, the attacker can find the user identity IDi as follows:(1)
Attacker guesses the identity asIDia(2)
ComputesRIDi∗=hIDianiTR where ni and TR are discovered from smart card(3)
VerifyRIDi∗=?RIDi. If true, then the guessed identity IDia is correct(4)
If false, then the attacker repeats the step from 1 to 3 untilIDi=IDiaTherefore, this scheme does not provide user anonymity and traceability property.


### 4.3. The Impersonation Attack

An adversaryA can impersonate a legal user by successfully logging into the server as follows:(1)
Attacker obtains the values \{RIDi, RPWi, TR, mi⋅ni⋅Px,y, h⋅, CIDi, IDS\} from the smart card under Assumption 2 referred to in [13].(2)
A calculates the user’s password PWdi as shown in Section 4.1.(3)
A calculates the user’s identity IDi as shown in this Section 4.2.(4)
A chooses a random nonce Ri, and then computes(12)B1=Ri⊕hAIdiTcMi,Ni⋅Px,y,B2=hAIdiRi⋅Ni⋅Px,yTc.(5)
Then, the login request message Lrq =B1,B2,AIdi,Tc is generated and sent to the server S.(6)
After receiving the login request message from the registered user, the serverS verifies the timestamp values.(7)
Next, calculate(13)Ri=B1⊕hAIdiTcMi⋅Ni⋅Px,y.And the values ofRi⋅Mj⋅Ni⋅Px,y are also calculated.(8)
By using the above mentioned values,(14)B2new=hAIdiRi⋅Mj⋅Ni⋅Px,yTc,is calculated. If both the valuesB2 and B2new are the same, then the login request message is accepted at the server side; else it is rejected.(9)
Then, a random nonceRj is selected, and calculate(15)Qx,y=Rj⋅Ri⋅Mj⋅Ni⋅Px,y,m=hMIdiIDsNi=DskeyAIdi.(10)
Next, the session key(16)SK=hQxx,yTcTsm.is calculated along withB3=Rj⊕m and B4=EskAIdi.(11)
The mutual authentication messageMA=B3,B4,Ts is sent to the registered user.(12)
After receiving the mutual authentication message at the timestampTm, the validity of the timestamp is verified; if it is valid, then the request is accepted.(13)
Then, calculate(17)m=hMIdiIDsNi=DskeyAIdi,Rj=B3⊕m,Qx,y=Rj⋅Ri⋅Mj⋅Ni⋅Px,yECCpoint(14)
Then, calculate session key(18)SK=hQxx,yTcTsm.(15)
IfAIdi=DSkB4 are equal, then it is accepted or else rejected. Hence, the Attacker is capable of impersonating as a legal user by recreating the login request message.


### 4.4. Smart Card Lost Attack

Let us consider that the smart card of the legal user is misplaced, lost, or stolen; then, the values stored in the smart card such asMIdi,MPwi,AIdi,Tr,Mi⋅Ni⋅Px,y,h⋅,IDs have been extracted by the attacker. By using those values, the attacker tries and retrieves the original user identity 4.2 and the password 4.1. As the IDi and PWdi of the legal user are retrieved, hence, there is a possibility of smart card loss attack.


### 4.5. Known Session-Specific Temporary Information Attack

When the secret random noncen1 and the TR is retrieved from the smart card, the A can retrieve the IDi as shown in the above section, and the session key can be calculated as follows. Then, calculate(19)m=hMIdiIDsNi=DskeyAIdi,Rj=B3⊕m,Qx,y=Rj⋅Ri⋅Mj⋅Ni⋅Px,yECCpoint.Then, calculate Session Key(20)SK=hQxx,yTcTsm.As the attacker can derive the Session key, hence, the scheme does not withstand session-specific temporary information attack.


### 4.6. Replay Attack

This attack is the capability of the attacker to retransmit the messages that were intercepted earlier.


## 4.1. The Offline Password Guessing Attack

Assume that an attacker obtains the values from smart card, \{RIDi, RPWi,TR,mi⋅ni⋅Px,y, h⋅, CIDi, IDS\} from the lost/stolen smart card by Assumption 2 as already mentioned in [13]. By retrieving the values, the attacker is capable of performing the offline password guessing attack by executing the following steps:(1)
Attacker guesses the password asPWia(2)
ComputesRPWi∗=hPWianiTR where ni and TR are discovered from the smart card(3)
VerifyRPWi∗=?RPWi; if true, then the value PWia guessed password is correct(4)
If false, then the attacker will repeat the steps from 1 to 3, untilPWi=PWiaHence, this scheme does not resist offline password guessing attack.


## 4.2. The User Anonymity

Assume that an attacker obtains the values \{RIDi, RPWi, TR, mi⋅ni⋅Px,y, h⋅, CIDi, IDS\} from the smart card under Assumption 2, referred to in [13]; using these values, the attacker can find the user identity IDi as follows:(1)
Attacker guesses the identity asIDia(2)
ComputesRIDi∗=hIDianiTR where ni and TR are discovered from smart card(3)
VerifyRIDi∗=?RIDi. If true, then the guessed identity IDia is correct(4)
If false, then the attacker repeats the step from 1 to 3 untilIDi=IDiaTherefore, this scheme does not provide user anonymity and traceability property.


## 4.3. The Impersonation Attack

An adversaryA can impersonate a legal user by successfully logging into the server as follows:(1)
Attacker obtains the values \{RIDi, RPWi, TR, mi⋅ni⋅Px,y, h⋅, CIDi, IDS\} from the smart card under Assumption 2 referred to in [13].(2)
A calculates the user’s password PWdi as shown in Section 4.1.(3)
A calculates the user’s identity IDi as shown in this Section 4.2.(4)
A chooses a random nonce Ri, and then computes(12)B1=Ri⊕hAIdiTcMi,Ni⋅Px,y,B2=hAIdiRi⋅Ni⋅Px,yTc.(5)
Then, the login request message Lrq =B1,B2,AIdi,Tc is generated and sent to the server S.(6)
After receiving the login request message from the registered user, the serverS verifies the timestamp values.(7)
Next, calculate(13)Ri=B1⊕hAIdiTcMi⋅Ni⋅Px,y.And the values ofRi⋅Mj⋅Ni⋅Px,y are also calculated.(8)
By using the above mentioned values,(14)B2new=hAIdiRi⋅Mj⋅Ni⋅Px,yTc,is calculated. If both the valuesB2 and B2new are the same, then the login request message is accepted at the server side; else it is rejected.(9)
Then, a random nonceRj is selected, and calculate(15)Qx,y=Rj⋅Ri⋅Mj⋅Ni⋅Px,y,m=hMIdiIDsNi=DskeyAIdi.(10)
Next, the session key(16)SK=hQxx,yTcTsm.is calculated along withB3=Rj⊕m and B4=EskAIdi.(11)
The mutual authentication messageMA=B3,B4,Ts is sent to the registered user.(12)
After receiving the mutual authentication message at the timestampTm, the validity of the timestamp is verified; if it is valid, then the request is accepted.(13)
Then, calculate(17)m=hMIdiIDsNi=DskeyAIdi,Rj=B3⊕m,Qx,y=Rj⋅Ri⋅Mj⋅Ni⋅Px,yECCpoint(14)
Then, calculate session key(18)SK=hQxx,yTcTsm.(15)
IfAIdi=DSkB4 are equal, then it is accepted or else rejected. Hence, the Attacker is capable of impersonating as a legal user by recreating the login request message.


## 4.4. Smart Card Lost Attack

Let us consider that the smart card of the legal user is misplaced, lost, or stolen; then, the values stored in the smart card such asMIdi,MPwi,AIdi,Tr,Mi⋅Ni⋅Px,y,h⋅,IDs have been extracted by the attacker. By using those values, the attacker tries and retrieves the original user identity 4.2 and the password 4.1. As the IDi and PWdi of the legal user are retrieved, hence, there is a possibility of smart card loss attack.


## 4.5. Known Session-Specific Temporary Information Attack

When the secret random noncen1 and the TR is retrieved from the smart card, the A can retrieve the IDi as shown in the above section, and the session key can be calculated as follows. Then, calculate(19)m=hMIdiIDsNi=DskeyAIdi,Rj=B3⊕m,Qx,y=Rj⋅Ri⋅Mj⋅Ni⋅Px,yECCpoint.Then, calculate Session Key(20)SK=hQxx,yTcTsm.As the attacker can derive the Session key, hence, the scheme does not withstand session-specific temporary information attack.


## 4.6. Replay Attack

This attack is the capability of the attacker to retransmit the messages that were intercepted earlier.


## 5. Proposed Scheme

The proposed two-factor authentication method is divided into five phases: Initialization, Registration, Login, Authentication and Verification, and Password Changing.


### 5.1. The Initialization Phase

Here, the serverS chooses a common Elliptic Curve (EC) over the prime field p, the equation y2=x3+ax+b and a group generator point Gx,y over Zp∗. This base point is used for generating private and the public keys of the Server and its corresponding users.The trusted serverS chooses a private key SKey and then calculates its public key PKey=SKey⋅Gx,y. The private key SKey is stored in the trusted server S itself. The public key PKey will be shared along with the public domain among all the users.


### 5.2. The Registration Phase

The registration phase comprises the steps given as follows. Every new legal userUi is allowed to opt his or her identity IDi and the password PWi without any restrictions,(1)
TheUi computes CIDi=hIDiTr and CPWi=hPWiTr.(2)
Then,Ui selects a random number randr.(3)
Sends the messageIDi,CIDi,CPWi,randr,Tr as a registration request. The server S receives the registration request and performs the following steps.(4)
S Compute the following values:(21)CK1=hCIDiCPWirandr,CK2=hCIDiCPWi⊕hrandrSKey.Here,PKey=SKeyGx,y,SKey and PKey private and public key of server S respectively.(5)
The serverS maintains the user IDi along with randr and Tr.(6)
The following values are saved in the smart card of the userUi, CK1,CK2,randr,Tr,PKey,Gx,y.


### 5.3. Login Phase

During the login phase, the userUi has to enter his or her identity IDi and the secret password PWi into the smart card reader. The first level of authentication is done by the smart card reader as discussed in this session:(1)
The smart card reader then calculatesCIDinew=hIDiTr and CPWinew=hPWiTr(2)
Verifies the following condition and computes the login attributes(3)
IfCK1=?hCIDinewCPWinewrandr is satisfied, then ACCEPT the login request, or else REJECT the login request(4)
ComputeshrandrSKey=CK2⊕hCIDiCPWi(5)
The random numberrandi is chosen, and the values randi⋅PKeyx,y are calculated(6)
Then, it computesLRi=hhrandrTrSKeyhrandr⋅PKeyx,y(7)
ComputesEi=EPKeyrandi(8)
Generates a login request along with the attributes such as,LRi,Ei,TsThe login request mentioned above is sent to the medical serverS.


### 5.4. The Verification and Mutual Authentication Phase

Based on the login request, the userUi has been validated and creates an authentication message for verifying the S, as illustrated in the following steps:(1)
The serverS obtains the login request message \{LRi, Ei, Ts\} during Ts′ and verifies as follows:(a)
IfTs′−Ts≤ΔT, then ACCEPT the login request and proceed further. Otherwise, REJECT the \{LRi, Ei, Ts\}(b)
The serverS computes the login message Ei=EPKeyrandi by the private key randi=DSKeyEi(c)
ComputesE1=hrandrTrSKey and E2=randi⋅PKeyx,y(d)
IfLRi=?hE1hE2, then S accepts the message \{LRi, Ei, Ts\} and proceeds further(e)
Otherwise, the \{LRi, Ei, Ts\} is rejected(2)
S computes SKnew=hrands⋅randi⋅PKeyx,y using the random number rands(3)
ComputesMRi=hrandsrandirandrTc; here, Tc is the time stamp currently and generates a mutual authentication message \{MRi,rands,Tc\}(4)
The userUi gets the values MRi,Tc from the server S and goes through the steps below to verify it(a)
WhenTc−Tc′≤ΔT, ACCEPT the Login request and proceed further. Otherwise, REJECT the mutual authentication message accepted by the user. Otherwise, the request will be rejected.(b)
The userUi computes and verifies if MRinew=?hrandsrandirandrTc; if the condition is satisfied, then the mutual authentication will be accepted by the user. Otherwise, the request will be rejected.(c)
The session key has been computed as follows:SKnew=hrands⋅randi⋅PKeyx,y; here, rands and randi values are random numbers generated by a particular login session only.(5)
The userUi and the server S will agree on a shared session key, which will be used for future secure message exchanges.


### 5.5. Password Update Phase

Ui can update PWi as shown in this section.(1)
Ui places the smart card into the device and inputs the PWi(2)
ComputesCPWiold=hPWiTr, and checks the CPWi as follows:(a)
IfCPWiold=CPWi, then the user is allowed to update his or her password PWi, and then Step 3 is executed(b)
Otherwise, the password changing request is rejected(3)
Then,Ui can choose their password PWinew freely and compute a new CPWinew=hPWinewTR(4)
Update and change the previous password by the recentCPWinew in the smart card


## 5.1. The Initialization Phase

Here, the serverS chooses a common Elliptic Curve (EC) over the prime field p, the equation y2=x3+ax+b and a group generator point Gx,y over Zp∗. This base point is used for generating private and the public keys of the Server and its corresponding users.The trusted serverS chooses a private key SKey and then calculates its public key PKey=SKey⋅Gx,y. The private key SKey is stored in the trusted server S itself. The public key PKey will be shared along with the public domain among all the users.


## 5.2. The Registration Phase

The registration phase comprises the steps given as follows. Every new legal userUi is allowed to opt his or her identity IDi and the password PWi without any restrictions,(1)
TheUi computes CIDi=hIDiTr and CPWi=hPWiTr.(2)
Then,Ui selects a random number randr.(3)
Sends the messageIDi,CIDi,CPWi,randr,Tr as a registration request. The server S receives the registration request and performs the following steps.(4)
S Compute the following values:(21)CK1=hCIDiCPWirandr,CK2=hCIDiCPWi⊕hrandrSKey.Here,PKey=SKeyGx,y,SKey and PKey private and public key of server S respectively.(5)
The serverS maintains the user IDi along with randr and Tr.(6)
The following values are saved in the smart card of the userUi, CK1,CK2,randr,Tr,PKey,Gx,y.


## 5.3. Login Phase

During the login phase, the userUi has to enter his or her identity IDi and the secret password PWi into the smart card reader. The first level of authentication is done by the smart card reader as discussed in this session:(1)
The smart card reader then calculatesCIDinew=hIDiTr and CPWinew=hPWiTr(2)
Verifies the following condition and computes the login attributes(3)
IfCK1=?hCIDinewCPWinewrandr is satisfied, then ACCEPT the login request, or else REJECT the login request(4)
ComputeshrandrSKey=CK2⊕hCIDiCPWi(5)
The random numberrandi is chosen, and the values randi⋅PKeyx,y are calculated(6)
Then, it computesLRi=hhrandrTrSKeyhrandr⋅PKeyx,y(7)
ComputesEi=EPKeyrandi(8)
Generates a login request along with the attributes such as,LRi,Ei,TsThe login request mentioned above is sent to the medical serverS.


## 5.4. The Verification and Mutual Authentication Phase

Based on the login request, the userUi has been validated and creates an authentication message for verifying the S, as illustrated in the following steps:(1)
The serverS obtains the login request message \{LRi, Ei, Ts\} during Ts′ and verifies as follows:(a)
IfTs′−Ts≤ΔT, then ACCEPT the login request and proceed further. Otherwise, REJECT the \{LRi, Ei, Ts\}(b)
The serverS computes the login message Ei=EPKeyrandi by the private key randi=DSKeyEi(c)
ComputesE1=hrandrTrSKey and E2=randi⋅PKeyx,y(d)
IfLRi=?hE1hE2, then S accepts the message \{LRi, Ei, Ts\} and proceeds further(e)
Otherwise, the \{LRi, Ei, Ts\} is rejected(2)
S computes SKnew=hrands⋅randi⋅PKeyx,y using the random number rands(3)
ComputesMRi=hrandsrandirandrTc; here, Tc is the time stamp currently and generates a mutual authentication message \{MRi,rands,Tc\}(4)
The userUi gets the values MRi,Tc from the server S and goes through the steps below to verify it(a)
WhenTc−Tc′≤ΔT, ACCEPT the Login request and proceed further. Otherwise, REJECT the mutual authentication message accepted by the user. Otherwise, the request will be rejected.(b)
The userUi computes and verifies if MRinew=?hrandsrandirandrTc; if the condition is satisfied, then the mutual authentication will be accepted by the user. Otherwise, the request will be rejected.(c)
The session key has been computed as follows:SKnew=hrands⋅randi⋅PKeyx,y; here, rands and randi values are random numbers generated by a particular login session only.(5)
The userUi and the server S will agree on a shared session key, which will be used for future secure message exchanges.


## 5.5. Password Update Phase

Ui can update PWi as shown in this section.(1)
Ui places the smart card into the device and inputs the PWi(2)
ComputesCPWiold=hPWiTr, and checks the CPWi as follows:(a)
IfCPWiold=CPWi, then the user is allowed to update his or her password PWi, and then Step 3 is executed(b)
Otherwise, the password changing request is rejected(3)
Then,Ui can choose their password PWinew freely and compute a new CPWinew=hPWinewTR(4)
Update and change the previous password by the recentCPWinew in the smart card


## 6. The Security Analysis

We have given a thorough security analysis for the suggested two-factor authentication system in this section. The suggested authentication scheme’s security study was conducted in two ways: informal security analysis and formal security analysis. Our proposed adversary model is depicted in Figure2. We have three major players: Ui, S, and Adversary A1.Figure 2
Adversary model.


### 6.1. The Informal Security Analysis

#### 6.1.1. User Anonymity Untraceability (EC-1)

Assume that anyUi generates a login request message \{LRi, Ei, Ts\} and sends this request via a public (insecure) communication channel. An attacker node Ae captures that login request message. From this message, the attacker attempts to retrieve the authenticate user identity IDi of a legal user Ui. From this scenario, A1 cannot get any information on IDi, because the identity IDi is selected by the user Ui during the initial registration period.


#### 6.1.2. Resistance to Stolen Smart Card Loss Attack (EC-2)

Let us assume that an adversary node acquires and extracts all values saved in the legal userUi’s loss or theft of smart card. The original smart card contains the values such as \{CK1,CK2,randr,Tr,PKey, Gx,y\}, which is extracted by the attacker. From those values, the attacker may try to determine the original IDi and PWi using those values. A legitimate user’s secret credentials cannot be extracted from the known values, CK1=hCIDiCPWirandr and CK2=hCIDiCPWi⊕hrandrSKey, based on the assumption of the strong and collision resistant hash function as discussed in the previous session.


#### 6.1.3. Resistance to Offline Password Guessing Attack (EC-3)

This attack is the method of finding the appropriate or an exact password of the legal user from the known information. Assume that an adversary node captures a valid login request \{LRi, Ei, Ts\} from Ui. From the captured login request message, the adversary could not guess the user’s password, due to these assumptions:(1)
By using the request to login, the adversary could not get any idea about user’s identity and password, because login message contains the parameters \{LRi, Ei, Ts\}, and these are computed as follows:(22)LRi=hhrandrTrSKeyhrandi⋅PKeyx,yEi=EPKeyrandi.These two parameters are not computed or generated by using user’s identity and password. So, the adversary node could not retrieve the user’s password through the attack on password guessing.(2)
The next assumption is that the privileged adversary node obtains the values saved in the smart card \{CK1, CK2, randr, Tr, PKey, Gx,y\} by initiating some smart card hacking attacks. From the extracted values, the adversary node could not get any idea about the original password, because CK1 and CK2 values are not computed directly based on the user’s original identity and password.Based on the above assumptions, any privileged adversary node could not compute or guess the original password of any legal userUi.


#### 6.1.4. Resistance to Insider Attack (EC-4)

Let us assume that a privileged legal user turns into a malicious attackerUa, and he has all of the group’s credentials as a legitimate user. Ua tries to use the resources of some other registered user Ui in the very same network by posing as a legal user and submitting a fraudulent login request. Based on the following assumptions, this attack will not work for the proposed authentication scheme.If an adversary userUa captures the login request \{LRi, Ei\} that is sent by the legal Ui, from the values obtained, the attacker node Ua produces a fake request message. Without the knowledge of secret parameters of randr, Tr, SKey and randi, the adversary cannot construct a legitimate login request, according to the above said assumption. The powerful internal intruder Ua also could not log into the server S as legitimate user Ui since these parameters are unique for every user.


#### 6.1.5. The Replay Attack (EC-5)

This is a sort of denial-of-service attack, where an adversaryUa from the same group captures the valid login request \{LRi, Ei\} from Ui and then replays to S by forging a mutual authentication message \{MRi, rands, Tc\}.In this protocol, the mutual authentication message is computed as follows:MRi=hrandSrandirandrTc by using rands,randi and randr. The attacker Ua is unable to create an appropriate MRi without ever being aware of randr and randi values for any legal session. As a result, the replay attack is not viable in this approach.


#### 6.1.6. The Session Key Agreement (EC-6)

Both parties involved, theUi and S, have created the session key in this two-factor authentication system, as follows:(23)SKnew=hrands⋅randi⋅PKeyx,y.Here,rands and randi are two fresh random numbers generated for every new login session. The session key SK will be agreed upon by the authorized Ui and S after authentication process has been satisfactorily verified.


#### 6.1.7. Resistance to Impersonation Attack (EC-7)

Throughout this attack, an unauthorizedUa obtains the credentials of a legitimate user Ui from S. Consider that an attacker Ua captures a valid logon request \{LRi, Ei, Ts\} and uses LRi and Ei values to create a false login request. Here, LRi=hhrandrTrSKeyhrandi⋅PKeyx,y is computed by using server private key along with the random nonce value, and Ei=EPKeyrandi is encrypted with the help of public key of server S. An adversary node could not get any information for generating a valid forged logon request message. Hence, this protocol is not susceptible to the attack of impersonation.


#### 6.1.8. Multilevel Authentication (EC-8)

TheUi’s legitimacy is validated by using the steps as discussed below:(1)
In the first level, card reader checks theUi’s validity by checking the following conditions. When the user Ui places his card SCi in the reader and enters both Ui and PWi, the card reader calculates CIDinew=hIDiTr and CPWinew=hPWiTr and compares it with the CK1=?hCIDinewCPWinewrandr, which is stored in the SCi. When both parameters are the same, the user is considered to be legitimate.(2)
The server does the second step of verification. After receiving the login request, \{LRi, Ei, Ts\}, it computes E1=hrandrTrSKey and E2=randi⋅PKeyx,y and it compares it with the received LRi, LRi=?hE1hE2; if both are the same, then the request is accepted; else, the request will not be accepted.


#### 6.1.9. The Server Free Password Update (EC-9)

We used a different phase for changing the password in the suggested authentication method. Without the notice of the server, the user can change his credentials. At times, ifUi wants to change his PWi, he or she places his SCi inside the reader and keys IDi and PWi. Then, reader computes CIDiold=hIDiTr and CPWiold=hPWiTr and determines whether or not the following criteria are met: CK1=?hCIDioldCPWioldrandr. If the condition is true, the smart card reader permits Ui to update the password; otherwise, it rejects the request.The valuesCIDinew=hIDiTR and CPWinew  =  hPWinewTR are calculated by the card reader. The CK1new and CK2new values are replaced with the new CK1New=hCIDiNewCPWinewrandr and CK2new=hCIDinewCPWinew⊕hrandrSKey is replaced with the old CK1old and CK2old is saved in the SCi.


#### 6.1.10. Maintaining Forward Secrecy for the Session Key (EC-10)

Both legalUi and S created a new session key for each new session. In this scheme, the session key will be agreed upon in common between the legal communicating parties as follows: SKnew=hrands⋅randi⋅PKeyx,y; here, we are using elliptic curve discrete logarithm. The rands and randi are the two random nonces generated during every new session, as a fresh value. Let us assume a situation in which a session key SKnew is being compromised by the adversary and makes an effort to retrieve the previously computed session keys. It is never feasible in this scheme, because, without the values rands, Ts, randi and Tc that were used previously, the attacker will not be able to compute any other session key that was already used. Hence, this protocol conserves the session key’s forward security.


#### 6.1.11. Resistance to Denial of Service Attack (EC-11)

This is a kind of attack that refuses the requested service by the server. Assume that an adversaryUa tries to deny the service request generated by a legal user Ui. The attacker node Ua captures the login message, and it alters the time stamp value in the message, and this could be found by the server S in initial level checking as mentioned below.From the initial level,S validates the time duration between login request created Ts and the time when login request TS′ was received by the server S. The login request will be denied by the server S if the discrepancy between the time interval produced Ts′−Ts≤ΔT and obtained is higher than the typical time interval Ts. The login request would be approved unless something goes wrong. On obtaining the mutual authentication message from server S, the user Ui does the same time difference verification at the second level. Based on this assumption, the attacker Ua could generate forged message or fabricated message for denying the service of legal user Ui.Table3 illustrates the proposed authentication protocol that withstands the well-known attacks.Table 3
Security requirement comparison.
Evaluation CriteriaSchemes[24][50][17][23][25][39][26][44][49][32][51]OursEC-1✓×✓× [26]✓✓× [27]✓×∗✓✓✓EC-2× [17]✓× [25]× [26]× [26]✓✓✓×∗✓✓✓EC-3✓✓× [25]× [26]× [26]✓× [27]✓×∗✓✓✓EC-4× [17]✓✓✓✓✓✓✓✓✓✓✓EC-5× [17]✓✓× [26]✓✓× [27]✓×∗✓✓✓EC-6✓✓× [25]× [26]✓✓✓✓✓✓✓✓EC-7✓× [52]✓✓✓× [40]✓✓×∗✓✓✓EC-8✓✓× [25]× [26]× [26]✓✓✓✓✓✓✓EC-9× [17]× [52]× [25]× [26]✓✓✓✓✓✓✓✓EC-10× [17]× [52]× [25]✓✓✓✓× [53]✓× [54]× [54]✓EC-11✓× [52]✓× [26]× [26]✓✓✓✓✓✓✓EC-12✓× [52]✓× [26]× [26]✓✓✓×∗× [54]× [54]✓Note. ✓: achieved; ×: not achieved; ∗:We have shown.


### 6.2. Formal Security Analysis

Here, the formal security analysis for the schemeQ is discussed using difference lemma [55].Difference Lemma: Let E1,E2,F1, and F2 be executed. Assume that it is carried out according to a probability distribution, and thus E1∧F1′⟺E2∧F2′ and Pr?F1=Pr?F2 then(24)Pr?E1−Pr?E2≤Pr?F1orPr?E1−Pr?E2≤Pr?F2Victor Shoup [55] detail goes into the theory of distinguishing among two games described and played in the same fundamental probability space. We used the difference lemma to validate this authentication protocol, and we treated the user as one player and the attacker as the other.


#### 6.2.1. The Random-Oracle Model’s Basic Notations

(1)
Players: We examined two players for the security study, with their appropriate occurrences marked as follows: ρUit refers to the occurrence of tt for Ui, and ρSr refers to the occurrence of r for S.(2)
The Hand−Shaking: The user’s hand-shaking instance ρUit is linked to the server’s instance ρSr, and conversely. So, server denotes the service provider, while ρSr denotes P’s handshake ID of ρUir. For creating the fundamental hand-shaking method, few pieces of the incomplete information are exchanged between S and Ui, resulting in a unique session ID of SKey during the session, where ρUir obtains handshaking.(3)
Attacker Node: We will suppose that A1 is a member of the group and has full network access, which means that the attacker A1 may perform the following queries to obtain all of the data in the interaction among any legal Ui and S.(a)
ExecuteQueryρt,Pr: the login request communications exchanged among two authorized entities are extracted using this query. With the aid of this query, attacker A1 may launch an eavesdrop assault.(b)
ExposePt: the session key SKey produced by the instance of Pt is found using this query.(c)
SendQueryρt,M: the purpose of such a query is to simulate an active attack. In this case, A1 sends M to Pt involved, in which A1 obtains a response positively.(d)
CorruptSCardρUit: this query is used to acquire data from a smart card and emulate a smart card loss attack.(e)
Testρt: the retrieved session key.ExecuteQuery query output is evaluated using this query. If the ExecuteQuery produces a correct session key, it produces c=1; else c=0.


#### 6.2.2. Random Oracle’s Function

The Random Oracle offers a one-way cryptographic hash functionh⋅ that both users and attackers A1 can use. The model of a random oracle, such as HashQuery⋅ oracle as defined in [55], is the cryptographic hash function h⋅.Theorem 1.
LetA1 be an adversary node that runs the Random Oracle Model (ROM) against the suggested authentication scheme S in polynomial time. The adversary node A1 has not yet hacked even a single node, according to a password dictionary with a uniform distribution Dic. The adversary’s risk of cracking the S’s session key security is calculated as follows:(25)AdvSAKE≤qhash2Hash≤qsend2lenPWi⋅Dic≤2⋅AdvZPECDLPt.
Here,(1)
AdvZPECDLPt: with respect to the EC-equation, A1 cracking the ECDLP has an advantage over ZP(2)
qhash: the total number of hash requests done(3)
Hash: hash function’s range space(4)
qsend: the total amount of hash queries that Random Oracle has received(5)
Dic: dictionary size DicProof.
We must define a game sequenceGi,i=0,1,2,3,4 in order to prove the theorem, and we must calculate the Succi that denotes the adversary node’s effectiveness in the predicting steps in Gi.
Supposition: It is necessary to demonstrate that theA1 has a very low chance of compromising the recommended authentication process and Skey’s security of S.
GameG0: The game G0 depicts a real-time attack carried out by A1 in order to defeat the suggested scheme S1 under RTROM. According to definition, the bit b is chosen at random.(26)AdvS1AKEA1=2PrSucc0−1.
GameG1: the attacker A1 simulates an eavesdropping context, in which some threats can be carried out by running the ExecuteQueryρt,ρr’s queries to RO. A1 uses Test Query to compare the outcome of the ExecuteQueryρt,ρr query against RO. This is used to create a fake login request from the query’s results ExecuteQueryρt,ρr. The attack could not generate any fraudulent login requests that appear in the output of the ExecuteQueryρt,ρr, because the login message \{LRi, Ei, Ts\} is generated by using LRi = hhrandrTrSKeyhrandi⋅PKeyx,y. The attacker could not calculate a fake LRi instead of being aware of the values randr,Tr and SKey. The adversary A1 will not benefit from the game G1. The attacker node A1’s success chance will not be increased by playing G1. As seen in (27), the probability value of G1 is similar to the G0’s probability value.(27)Pr?Succ0=Pr?Succ1.
GameG2: game G2 is not similar to the game of G1. In this case, the attacker employs two additional queries, HashQuery⋅, SendQueryρt,M oracles. G2 depicts an actual attack scenario where the adversary A1 attempts to prove as a legitimate player by receiving a forged communication from it. A1 forwards HashQuery⋅ queries to the Hash oracle periodically in order to discover conflict messages for the related passwords. The adversary node A1 obtains the request for login\{LRi, Ei, Ts\} and tries to discover the conflict for LRi=hhrandrTrSKeyhrandi⋅PKeyx,y in this protocol. Here, randr and SKey are random nonce and private of Server S. The attacker could not find the original randr and original private key of server SKey. Due to this reason no collisions will occur, or collision occurrence ratio is negligible if A1 queries send oracle. By applying birthday paradox, the probability factor for success in this game is lower than qh2/2⋅Hash. From the preceding assumption, the following equation is obtained:(28)Pr?Succ1−Pr?Succ2≤qh22⋅Hash.
GameG3: the smart card loss attempt is presented in G3, and it implements the CorruptSCardρUit query oracle.
Suppose that if the password may not be a robust password, the hackerA1 can attempt to even use the data retrieved from the device cards to initiate Dic dictionary attack in an online mode. Even if the parameters in smart card are hacked, both adversary or node of the adversary A1 will be unable to extract the password PWi because the secret PWi has been masked with other related parameters as follows:(29)CK1=hCIDiCPWirandr.
The passwordCPWi with Tr is calculated as CPWi=hPWiTr. The CPWi is hashed along with the CIDi=hIDiTr and randr. The attacker is not able to retrieve the initial password from the well-known CPWi value. The system limits the amount of incorrect password input during the login phase to a certain number of times (for ex, 3 to 4 attempts). The chances of finding the correct password PWi are approximated as 1/2lenPWi. The adversary A1’s chances of winning in game G3 are evaluated as shown below, and the value of lenPWi denotes password length.(30)Pr?Succ2−Pr?Succ3≤qSend2lenPWi⋅Dic.
GameG4: using the CorruptSCardρUit oracle, G4 is simulated with an attacker A1 who possesses the SCi of authorized user Ui. The two attacks discussed as follows are attempted by the attacker node:(1)
As a result,A1 can obtain the data’s SCi = \{CK1, CK2, randr, Tr, PKey, Gx,y\} and use them to retrieve the IDi and PWi of the authorized user Ui. Because of the hash algorithm’s collision resistance, the authorized user Ui, IDi, and PWi may be identified using a specified value of CK1 that is not possible, as per game G4.(2)
The recommended authentication schemeS1 creates the request for login as, \{LRi, Ei, TS\} and LRi, where it is calculated as LRi=hhrandrTrSKeyhrandi⋅PKeyx,y. Next, the adversary calculates the correct LRi from the known values of \{CK1, CK2, randr, Tr, PKey, Gx,y\}. In this, LRi is calculated by randr and SKey parameters. Because of ECDLP, the adversary cannot really construct a true SKey, from PKeyx,y. As a result, without knowing the SKey, the adversary seems unable to calculate the LRi. Hence, the adversary was unable to create a legitimate request for login based on the discussion.(3)
Here,SKnew=hrandS⋅randI⋅PKeyx,y is the session key computed. The attacker may know the value of PKeyx,y, because it is a public parameter. The attacker could not find or guess the session key for a particular session by using the public key of server PKeyx,y alone, without knowing randS. The chance of an attacker’s rate of success is shown below, based on the aforementioned considerations:(31)Pr?Succ3−Pr?Succ4≤AdvGPDLPt.
As illustrated previously,GameG4 proved that Pr?Succ4=1/2. From (equation (1)), to (equation (5)), we have obtained the results as finalized eq.:(32)Pr?Succ0−12≤qh22⋅Hash+qsend2lenPWi⋅D+AdvGPECDLPt,(33)Pr?Succ0=AdvPakeA2+12.
Hence, by solving the (32) and (33), we have(34)AdvSakeA1≤qhash2Hash+2⋅qsend2lenPWi⋅Dic+2⋅AdvGPECDLPt.
TheCorruptSC oracle is implemented in G4 by stealing the legal user’s smart card (assume attacker A1). Based on ECDLP, an adversary AdvS1akeA1 is extremely not powerful, and under this premise, the suggested authentication system S1 is secure. The ECDLP is impossible computationally for any attacker A1 within the time limit. As a result, based on the assumptions, this proposed scheme is more secure and preserves perfect forward secrecy authentication.


## 6.1. The Informal Security Analysis

### 6.1.1. User Anonymity Untraceability (EC-1)

Assume that anyUi generates a login request message \{LRi, Ei, Ts\} and sends this request via a public (insecure) communication channel. An attacker node Ae captures that login request message. From this message, the attacker attempts to retrieve the authenticate user identity IDi of a legal user Ui. From this scenario, A1 cannot get any information on IDi, because the identity IDi is selected by the user Ui during the initial registration period.


### 6.1.2. Resistance to Stolen Smart Card Loss Attack (EC-2)

Let us assume that an adversary node acquires and extracts all values saved in the legal userUi’s loss or theft of smart card. The original smart card contains the values such as \{CK1,CK2,randr,Tr,PKey, Gx,y\}, which is extracted by the attacker. From those values, the attacker may try to determine the original IDi and PWi using those values. A legitimate user’s secret credentials cannot be extracted from the known values, CK1=hCIDiCPWirandr and CK2=hCIDiCPWi⊕hrandrSKey, based on the assumption of the strong and collision resistant hash function as discussed in the previous session.


### 6.1.3. Resistance to Offline Password Guessing Attack (EC-3)

This attack is the method of finding the appropriate or an exact password of the legal user from the known information. Assume that an adversary node captures a valid login request \{LRi, Ei, Ts\} from Ui. From the captured login request message, the adversary could not guess the user’s password, due to these assumptions:(1)
By using the request to login, the adversary could not get any idea about user’s identity and password, because login message contains the parameters \{LRi, Ei, Ts\}, and these are computed as follows:(22)LRi=hhrandrTrSKeyhrandi⋅PKeyx,yEi=EPKeyrandi.These two parameters are not computed or generated by using user’s identity and password. So, the adversary node could not retrieve the user’s password through the attack on password guessing.(2)
The next assumption is that the privileged adversary node obtains the values saved in the smart card \{CK1, CK2, randr, Tr, PKey, Gx,y\} by initiating some smart card hacking attacks. From the extracted values, the adversary node could not get any idea about the original password, because CK1 and CK2 values are not computed directly based on the user’s original identity and password.Based on the above assumptions, any privileged adversary node could not compute or guess the original password of any legal userUi.


### 6.1.4. Resistance to Insider Attack (EC-4)

Let us assume that a privileged legal user turns into a malicious attackerUa, and he has all of the group’s credentials as a legitimate user. Ua tries to use the resources of some other registered user Ui in the very same network by posing as a legal user and submitting a fraudulent login request. Based on the following assumptions, this attack will not work for the proposed authentication scheme.If an adversary userUa captures the login request \{LRi, Ei\} that is sent by the legal Ui, from the values obtained, the attacker node Ua produces a fake request message. Without the knowledge of secret parameters of randr, Tr, SKey and randi, the adversary cannot construct a legitimate login request, according to the above said assumption. The powerful internal intruder Ua also could not log into the server S as legitimate user Ui since these parameters are unique for every user.


### 6.1.5. The Replay Attack (EC-5)

This is a sort of denial-of-service attack, where an adversaryUa from the same group captures the valid login request \{LRi, Ei\} from Ui and then replays to S by forging a mutual authentication message \{MRi, rands, Tc\}.In this protocol, the mutual authentication message is computed as follows:MRi=hrandSrandirandrTc by using rands,randi and randr. The attacker Ua is unable to create an appropriate MRi without ever being aware of randr and randi values for any legal session. As a result, the replay attack is not viable in this approach.


### 6.1.6. The Session Key Agreement (EC-6)

Both parties involved, theUi and S, have created the session key in this two-factor authentication system, as follows:(23)SKnew=hrands⋅randi⋅PKeyx,y.Here,rands and randi are two fresh random numbers generated for every new login session. The session key SK will be agreed upon by the authorized Ui and S after authentication process has been satisfactorily verified.


### 6.1.7. Resistance to Impersonation Attack (EC-7)

Throughout this attack, an unauthorizedUa obtains the credentials of a legitimate user Ui from S. Consider that an attacker Ua captures a valid logon request \{LRi, Ei, Ts\} and uses LRi and Ei values to create a false login request. Here, LRi=hhrandrTrSKeyhrandi⋅PKeyx,y is computed by using server private key along with the random nonce value, and Ei=EPKeyrandi is encrypted with the help of public key of server S. An adversary node could not get any information for generating a valid forged logon request message. Hence, this protocol is not susceptible to the attack of impersonation.


### 6.1.8. Multilevel Authentication (EC-8)

TheUi’s legitimacy is validated by using the steps as discussed below:(1)
In the first level, card reader checks theUi’s validity by checking the following conditions. When the user Ui places his card SCi in the reader and enters both Ui and PWi, the card reader calculates CIDinew=hIDiTr and CPWinew=hPWiTr and compares it with the CK1=?hCIDinewCPWinewrandr, which is stored in the SCi. When both parameters are the same, the user is considered to be legitimate.(2)
The server does the second step of verification. After receiving the login request, \{LRi, Ei, Ts\}, it computes E1=hrandrTrSKey and E2=randi⋅PKeyx,y and it compares it with the received LRi, LRi=?hE1hE2; if both are the same, then the request is accepted; else, the request will not be accepted.


### 6.1.9. The Server Free Password Update (EC-9)

We used a different phase for changing the password in the suggested authentication method. Without the notice of the server, the user can change his credentials. At times, ifUi wants to change his PWi, he or she places his SCi inside the reader and keys IDi and PWi. Then, reader computes CIDiold=hIDiTr and CPWiold=hPWiTr and determines whether or not the following criteria are met: CK1=?hCIDioldCPWioldrandr. If the condition is true, the smart card reader permits Ui to update the password; otherwise, it rejects the request.The valuesCIDinew=hIDiTR and CPWinew  =  hPWinewTR are calculated by the card reader. The CK1new and CK2new values are replaced with the new CK1New=hCIDiNewCPWinewrandr and CK2new=hCIDinewCPWinew⊕hrandrSKey is replaced with the old CK1old and CK2old is saved in the SCi.


### 6.1.10. Maintaining Forward Secrecy for the Session Key (EC-10)

Both legalUi and S created a new session key for each new session. In this scheme, the session key will be agreed upon in common between the legal communicating parties as follows: SKnew=hrands⋅randi⋅PKeyx,y; here, we are using elliptic curve discrete logarithm. The rands and randi are the two random nonces generated during every new session, as a fresh value. Let us assume a situation in which a session key SKnew is being compromised by the adversary and makes an effort to retrieve the previously computed session keys. It is never feasible in this scheme, because, without the values rands, Ts, randi and Tc that were used previously, the attacker will not be able to compute any other session key that was already used. Hence, this protocol conserves the session key’s forward security.


### 6.1.11. Resistance to Denial of Service Attack (EC-11)

This is a kind of attack that refuses the requested service by the server. Assume that an adversaryUa tries to deny the service request generated by a legal user Ui. The attacker node Ua captures the login message, and it alters the time stamp value in the message, and this could be found by the server S in initial level checking as mentioned below.From the initial level,S validates the time duration between login request created Ts and the time when login request TS′ was received by the server S. The login request will be denied by the server S if the discrepancy between the time interval produced Ts′−Ts≤ΔT and obtained is higher than the typical time interval Ts. The login request would be approved unless something goes wrong. On obtaining the mutual authentication message from server S, the user Ui does the same time difference verification at the second level. Based on this assumption, the attacker Ua could generate forged message or fabricated message for denying the service of legal user Ui.Table3 illustrates the proposed authentication protocol that withstands the well-known attacks.Table 3
Security requirement comparison.
Evaluation CriteriaSchemes[24][50][17][23][25][39][26][44][49][32][51]OursEC-1✓×✓× [26]✓✓× [27]✓×∗✓✓✓EC-2× [17]✓× [25]× [26]× [26]✓✓✓×∗✓✓✓EC-3✓✓× [25]× [26]× [26]✓× [27]✓×∗✓✓✓EC-4× [17]✓✓✓✓✓✓✓✓✓✓✓EC-5× [17]✓✓× [26]✓✓× [27]✓×∗✓✓✓EC-6✓✓× [25]× [26]✓✓✓✓✓✓✓✓EC-7✓× [52]✓✓✓× [40]✓✓×∗✓✓✓EC-8✓✓× [25]× [26]× [26]✓✓✓✓✓✓✓EC-9× [17]× [52]× [25]× [26]✓✓✓✓✓✓✓✓EC-10× [17]× [52]× [25]✓✓✓✓× [53]✓× [54]× [54]✓EC-11✓× [52]✓× [26]× [26]✓✓✓✓✓✓✓EC-12✓× [52]✓× [26]× [26]✓✓✓×∗× [54]× [54]✓Note. ✓: achieved; ×: not achieved; ∗:We have shown.


## 6.1.1. User Anonymity Untraceability (EC-1)

Assume that anyUi generates a login request message \{LRi, Ei, Ts\} and sends this request via a public (insecure) communication channel. An attacker node Ae captures that login request message. From this message, the attacker attempts to retrieve the authenticate user identity IDi of a legal user Ui. From this scenario, A1 cannot get any information on IDi, because the identity IDi is selected by the user Ui during the initial registration period.


## 6.1.2. Resistance to Stolen Smart Card Loss Attack (EC-2)

Let us assume that an adversary node acquires and extracts all values saved in the legal userUi’s loss or theft of smart card. The original smart card contains the values such as \{CK1,CK2,randr,Tr,PKey, Gx,y\}, which is extracted by the attacker. From those values, the attacker may try to determine the original IDi and PWi using those values. A legitimate user’s secret credentials cannot be extracted from the known values, CK1=hCIDiCPWirandr and CK2=hCIDiCPWi⊕hrandrSKey, based on the assumption of the strong and collision resistant hash function as discussed in the previous session.


## 6.1.3. Resistance to Offline Password Guessing Attack (EC-3)

This attack is the method of finding the appropriate or an exact password of the legal user from the known information. Assume that an adversary node captures a valid login request \{LRi, Ei, Ts\} from Ui. From the captured login request message, the adversary could not guess the user’s password, due to these assumptions:(1)
By using the request to login, the adversary could not get any idea about user’s identity and password, because login message contains the parameters \{LRi, Ei, Ts\}, and these are computed as follows:(22)LRi=hhrandrTrSKeyhrandi⋅PKeyx,yEi=EPKeyrandi.These two parameters are not computed or generated by using user’s identity and password. So, the adversary node could not retrieve the user’s password through the attack on password guessing.(2)
The next assumption is that the privileged adversary node obtains the values saved in the smart card \{CK1, CK2, randr, Tr, PKey, Gx,y\} by initiating some smart card hacking attacks. From the extracted values, the adversary node could not get any idea about the original password, because CK1 and CK2 values are not computed directly based on the user’s original identity and password.Based on the above assumptions, any privileged adversary node could not compute or guess the original password of any legal userUi.


## 6.1.4. Resistance to Insider Attack (EC-4)

Let us assume that a privileged legal user turns into a malicious attackerUa, and he has all of the group’s credentials as a legitimate user. Ua tries to use the resources of some other registered user Ui in the very same network by posing as a legal user and submitting a fraudulent login request. Based on the following assumptions, this attack will not work for the proposed authentication scheme.If an adversary userUa captures the login request \{LRi, Ei\} that is sent by the legal Ui, from the values obtained, the attacker node Ua produces a fake request message. Without the knowledge of secret parameters of randr, Tr, SKey and randi, the adversary cannot construct a legitimate login request, according to the above said assumption. The powerful internal intruder Ua also could not log into the server S as legitimate user Ui since these parameters are unique for every user.


## 6.1.5. The Replay Attack (EC-5)

This is a sort of denial-of-service attack, where an adversaryUa from the same group captures the valid login request \{LRi, Ei\} from Ui and then replays to S by forging a mutual authentication message \{MRi, rands, Tc\}.In this protocol, the mutual authentication message is computed as follows:MRi=hrandSrandirandrTc by using rands,randi and randr. The attacker Ua is unable to create an appropriate MRi without ever being aware of randr and randi values for any legal session. As a result, the replay attack is not viable in this approach.


## 6.1.6. The Session Key Agreement (EC-6)

Both parties involved, theUi and S, have created the session key in this two-factor authentication system, as follows:(23)SKnew=hrands⋅randi⋅PKeyx,y.Here,rands and randi are two fresh random numbers generated for every new login session. The session key SK will be agreed upon by the authorized Ui and S after authentication process has been satisfactorily verified.


## 6.1.7. Resistance to Impersonation Attack (EC-7)

Throughout this attack, an unauthorizedUa obtains the credentials of a legitimate user Ui from S. Consider that an attacker Ua captures a valid logon request \{LRi, Ei, Ts\} and uses LRi and Ei values to create a false login request. Here, LRi=hhrandrTrSKeyhrandi⋅PKeyx,y is computed by using server private key along with the random nonce value, and Ei=EPKeyrandi is encrypted with the help of public key of server S. An adversary node could not get any information for generating a valid forged logon request message. Hence, this protocol is not susceptible to the attack of impersonation.


## 6.1.8. Multilevel Authentication (EC-8)

TheUi’s legitimacy is validated by using the steps as discussed below:(1)
In the first level, card reader checks theUi’s validity by checking the following conditions. When the user Ui places his card SCi in the reader and enters both Ui and PWi, the card reader calculates CIDinew=hIDiTr and CPWinew=hPWiTr and compares it with the CK1=?hCIDinewCPWinewrandr, which is stored in the SCi. When both parameters are the same, the user is considered to be legitimate.(2)
The server does the second step of verification. After receiving the login request, \{LRi, Ei, Ts\}, it computes E1=hrandrTrSKey and E2=randi⋅PKeyx,y and it compares it with the received LRi, LRi=?hE1hE2; if both are the same, then the request is accepted; else, the request will not be accepted.


## 6.1.9. The Server Free Password Update (EC-9)

We used a different phase for changing the password in the suggested authentication method. Without the notice of the server, the user can change his credentials. At times, ifUi wants to change his PWi, he or she places his SCi inside the reader and keys IDi and PWi. Then, reader computes CIDiold=hIDiTr and CPWiold=hPWiTr and determines whether or not the following criteria are met: CK1=?hCIDioldCPWioldrandr. If the condition is true, the smart card reader permits Ui to update the password; otherwise, it rejects the request.The valuesCIDinew=hIDiTR and CPWinew  =  hPWinewTR are calculated by the card reader. The CK1new and CK2new values are replaced with the new CK1New=hCIDiNewCPWinewrandr and CK2new=hCIDinewCPWinew⊕hrandrSKey is replaced with the old CK1old and CK2old is saved in the SCi.


## 6.1.10. Maintaining Forward Secrecy for the Session Key (EC-10)

Both legalUi and S created a new session key for each new session. In this scheme, the session key will be agreed upon in common between the legal communicating parties as follows: SKnew=hrands⋅randi⋅PKeyx,y; here, we are using elliptic curve discrete logarithm. The rands and randi are the two random nonces generated during every new session, as a fresh value. Let us assume a situation in which a session key SKnew is being compromised by the adversary and makes an effort to retrieve the previously computed session keys. It is never feasible in this scheme, because, without the values rands, Ts, randi and Tc that were used previously, the attacker will not be able to compute any other session key that was already used. Hence, this protocol conserves the session key’s forward security.


## 6.1.11. Resistance to Denial of Service Attack (EC-11)

This is a kind of attack that refuses the requested service by the server. Assume that an adversaryUa tries to deny the service request generated by a legal user Ui. The attacker node Ua captures the login message, and it alters the time stamp value in the message, and this could be found by the server S in initial level checking as mentioned below.From the initial level,S validates the time duration between login request created Ts and the time when login request TS′ was received by the server S. The login request will be denied by the server S if the discrepancy between the time interval produced Ts′−Ts≤ΔT and obtained is higher than the typical time interval Ts. The login request would be approved unless something goes wrong. On obtaining the mutual authentication message from server S, the user Ui does the same time difference verification at the second level. Based on this assumption, the attacker Ua could generate forged message or fabricated message for denying the service of legal user Ui.Table3 illustrates the proposed authentication protocol that withstands the well-known attacks.Table 3
Security requirement comparison.
Evaluation CriteriaSchemes[24][50][17][23][25][39][26][44][49][32][51]OursEC-1✓×✓× [26]✓✓× [27]✓×∗✓✓✓EC-2× [17]✓× [25]× [26]× [26]✓✓✓×∗✓✓✓EC-3✓✓× [25]× [26]× [26]✓× [27]✓×∗✓✓✓EC-4× [17]✓✓✓✓✓✓✓✓✓✓✓EC-5× [17]✓✓× [26]✓✓× [27]✓×∗✓✓✓EC-6✓✓× [25]× [26]✓✓✓✓✓✓✓✓EC-7✓× [52]✓✓✓× [40]✓✓×∗✓✓✓EC-8✓✓× [25]× [26]× [26]✓✓✓✓✓✓✓EC-9× [17]× [52]× [25]× [26]✓✓✓✓✓✓✓✓EC-10× [17]× [52]× [25]✓✓✓✓× [53]✓× [54]× [54]✓EC-11✓× [52]✓× [26]× [26]✓✓✓✓✓✓✓EC-12✓× [52]✓× [26]× [26]✓✓✓×∗× [54]× [54]✓Note. ✓: achieved; ×: not achieved; ∗:We have shown.


## 6.2. Formal Security Analysis

Here, the formal security analysis for the schemeQ is discussed using difference lemma [55].Difference Lemma: Let E1,E2,F1, and F2 be executed. Assume that it is carried out according to a probability distribution, and thus E1∧F1′⟺E2∧F2′ and Pr?F1=Pr?F2 then(24)Pr?E1−Pr?E2≤Pr?F1orPr?E1−Pr?E2≤Pr?F2Victor Shoup [55] detail goes into the theory of distinguishing among two games described and played in the same fundamental probability space. We used the difference lemma to validate this authentication protocol, and we treated the user as one player and the attacker as the other.


### 6.2.1. The Random-Oracle Model’s Basic Notations

(1)
Players: We examined two players for the security study, with their appropriate occurrences marked as follows: ρUit refers to the occurrence of tt for Ui, and ρSr refers to the occurrence of r for S.(2)
The Hand−Shaking: The user’s hand-shaking instance ρUit is linked to the server’s instance ρSr, and conversely. So, server denotes the service provider, while ρSr denotes P’s handshake ID of ρUir. For creating the fundamental hand-shaking method, few pieces of the incomplete information are exchanged between S and Ui, resulting in a unique session ID of SKey during the session, where ρUir obtains handshaking.(3)
Attacker Node: We will suppose that A1 is a member of the group and has full network access, which means that the attacker A1 may perform the following queries to obtain all of the data in the interaction among any legal Ui and S.(a)
ExecuteQueryρt,Pr: the login request communications exchanged among two authorized entities are extracted using this query. With the aid of this query, attacker A1 may launch an eavesdrop assault.(b)
ExposePt: the session key SKey produced by the instance of Pt is found using this query.(c)
SendQueryρt,M: the purpose of such a query is to simulate an active attack. In this case, A1 sends M to Pt involved, in which A1 obtains a response positively.(d)
CorruptSCardρUit: this query is used to acquire data from a smart card and emulate a smart card loss attack.(e)
Testρt: the retrieved session key.ExecuteQuery query output is evaluated using this query. If the ExecuteQuery produces a correct session key, it produces c=1; else c=0.


### 6.2.2. Random Oracle’s Function

The Random Oracle offers a one-way cryptographic hash functionh⋅ that both users and attackers A1 can use. The model of a random oracle, such as HashQuery⋅ oracle as defined in [55], is the cryptographic hash function h⋅.Theorem 1.
LetA1 be an adversary node that runs the Random Oracle Model (ROM) against the suggested authentication scheme S in polynomial time. The adversary node A1 has not yet hacked even a single node, according to a password dictionary with a uniform distribution Dic. The adversary’s risk of cracking the S’s session key security is calculated as follows:(25)AdvSAKE≤qhash2Hash≤qsend2lenPWi⋅Dic≤2⋅AdvZPECDLPt.
Here,(1)
AdvZPECDLPt: with respect to the EC-equation, A1 cracking the ECDLP has an advantage over ZP(2)
qhash: the total number of hash requests done(3)
Hash: hash function’s range space(4)
qsend: the total amount of hash queries that Random Oracle has received(5)
Dic: dictionary size DicProof.
We must define a game sequenceGi,i=0,1,2,3,4 in order to prove the theorem, and we must calculate the Succi that denotes the adversary node’s effectiveness in the predicting steps in Gi.
Supposition: It is necessary to demonstrate that theA1 has a very low chance of compromising the recommended authentication process and Skey’s security of S.
GameG0: The game G0 depicts a real-time attack carried out by A1 in order to defeat the suggested scheme S1 under RTROM. According to definition, the bit b is chosen at random.(26)AdvS1AKEA1=2PrSucc0−1.
GameG1: the attacker A1 simulates an eavesdropping context, in which some threats can be carried out by running the ExecuteQueryρt,ρr’s queries to RO. A1 uses Test Query to compare the outcome of the ExecuteQueryρt,ρr query against RO. This is used to create a fake login request from the query’s results ExecuteQueryρt,ρr. The attack could not generate any fraudulent login requests that appear in the output of the ExecuteQueryρt,ρr, because the login message \{LRi, Ei, Ts\} is generated by using LRi = hhrandrTrSKeyhrandi⋅PKeyx,y. The attacker could not calculate a fake LRi instead of being aware of the values randr,Tr and SKey. The adversary A1 will not benefit from the game G1. The attacker node A1’s success chance will not be increased by playing G1. As seen in (27), the probability value of G1 is similar to the G0’s probability value.(27)Pr?Succ0=Pr?Succ1.
GameG2: game G2 is not similar to the game of G1. In this case, the attacker employs two additional queries, HashQuery⋅, SendQueryρt,M oracles. G2 depicts an actual attack scenario where the adversary A1 attempts to prove as a legitimate player by receiving a forged communication from it. A1 forwards HashQuery⋅ queries to the Hash oracle periodically in order to discover conflict messages for the related passwords. The adversary node A1 obtains the request for login\{LRi, Ei, Ts\} and tries to discover the conflict for LRi=hhrandrTrSKeyhrandi⋅PKeyx,y in this protocol. Here, randr and SKey are random nonce and private of Server S. The attacker could not find the original randr and original private key of server SKey. Due to this reason no collisions will occur, or collision occurrence ratio is negligible if A1 queries send oracle. By applying birthday paradox, the probability factor for success in this game is lower than qh2/2⋅Hash. From the preceding assumption, the following equation is obtained:(28)Pr?Succ1−Pr?Succ2≤qh22⋅Hash.
GameG3: the smart card loss attempt is presented in G3, and it implements the CorruptSCardρUit query oracle.
Suppose that if the password may not be a robust password, the hackerA1 can attempt to even use the data retrieved from the device cards to initiate Dic dictionary attack in an online mode. Even if the parameters in smart card are hacked, both adversary or node of the adversary A1 will be unable to extract the password PWi because the secret PWi has been masked with other related parameters as follows:(29)CK1=hCIDiCPWirandr.
The passwordCPWi with Tr is calculated as CPWi=hPWiTr. The CPWi is hashed along with the CIDi=hIDiTr and randr. The attacker is not able to retrieve the initial password from the well-known CPWi value. The system limits the amount of incorrect password input during the login phase to a certain number of times (for ex, 3 to 4 attempts). The chances of finding the correct password PWi are approximated as 1/2lenPWi. The adversary A1’s chances of winning in game G3 are evaluated as shown below, and the value of lenPWi denotes password length.(30)Pr?Succ2−Pr?Succ3≤qSend2lenPWi⋅Dic.
GameG4: using the CorruptSCardρUit oracle, G4 is simulated with an attacker A1 who possesses the SCi of authorized user Ui. The two attacks discussed as follows are attempted by the attacker node:(1)
As a result,A1 can obtain the data’s SCi = \{CK1, CK2, randr, Tr, PKey, Gx,y\} and use them to retrieve the IDi and PWi of the authorized user Ui. Because of the hash algorithm’s collision resistance, the authorized user Ui, IDi, and PWi may be identified using a specified value of CK1 that is not possible, as per game G4.(2)
The recommended authentication schemeS1 creates the request for login as, \{LRi, Ei, TS\} and LRi, where it is calculated as LRi=hhrandrTrSKeyhrandi⋅PKeyx,y. Next, the adversary calculates the correct LRi from the known values of \{CK1, CK2, randr, Tr, PKey, Gx,y\}. In this, LRi is calculated by randr and SKey parameters. Because of ECDLP, the adversary cannot really construct a true SKey, from PKeyx,y. As a result, without knowing the SKey, the adversary seems unable to calculate the LRi. Hence, the adversary was unable to create a legitimate request for login based on the discussion.(3)
Here,SKnew=hrandS⋅randI⋅PKeyx,y is the session key computed. The attacker may know the value of PKeyx,y, because it is a public parameter. The attacker could not find or guess the session key for a particular session by using the public key of server PKeyx,y alone, without knowing randS. The chance of an attacker’s rate of success is shown below, based on the aforementioned considerations:(31)Pr?Succ3−Pr?Succ4≤AdvGPDLPt.
As illustrated previously,GameG4 proved that Pr?Succ4=1/2. From (equation (1)), to (equation (5)), we have obtained the results as finalized eq.:(32)Pr?Succ0−12≤qh22⋅Hash+qsend2lenPWi⋅D+AdvGPECDLPt,(33)Pr?Succ0=AdvPakeA2+12.
Hence, by solving the (32) and (33), we have(34)AdvSakeA1≤qhash2Hash+2⋅qsend2lenPWi⋅Dic+2⋅AdvGPECDLPt.
TheCorruptSC oracle is implemented in G4 by stealing the legal user’s smart card (assume attacker A1). Based on ECDLP, an adversary AdvS1akeA1 is extremely not powerful, and under this premise, the suggested authentication system S1 is secure. The ECDLP is impossible computationally for any attacker A1 within the time limit. As a result, based on the assumptions, this proposed scheme is more secure and preserves perfect forward secrecy authentication.


## 6.2.1. The Random-Oracle Model’s Basic Notations

(1)
Players: We examined two players for the security study, with their appropriate occurrences marked as follows: ρUit refers to the occurrence of tt for Ui, and ρSr refers to the occurrence of r for S.(2)
The Hand−Shaking: The user’s hand-shaking instance ρUit is linked to the server’s instance ρSr, and conversely. So, server denotes the service provider, while ρSr denotes P’s handshake ID of ρUir. For creating the fundamental hand-shaking method, few pieces of the incomplete information are exchanged between S and Ui, resulting in a unique session ID of SKey during the session, where ρUir obtains handshaking.(3)
Attacker Node: We will suppose that A1 is a member of the group and has full network access, which means that the attacker A1 may perform the following queries to obtain all of the data in the interaction among any legal Ui and S.(a)
ExecuteQueryρt,Pr: the login request communications exchanged among two authorized entities are extracted using this query. With the aid of this query, attacker A1 may launch an eavesdrop assault.(b)
ExposePt: the session key SKey produced by the instance of Pt is found using this query.(c)
SendQueryρt,M: the purpose of such a query is to simulate an active attack. In this case, A1 sends M to Pt involved, in which A1 obtains a response positively.(d)
CorruptSCardρUit: this query is used to acquire data from a smart card and emulate a smart card loss attack.(e)
Testρt: the retrieved session key.ExecuteQuery query output is evaluated using this query. If the ExecuteQuery produces a correct session key, it produces c=1; else c=0.


## 6.2.2. Random Oracle’s Function

The Random Oracle offers a one-way cryptographic hash functionh⋅ that both users and attackers A1 can use. The model of a random oracle, such as HashQuery⋅ oracle as defined in [55], is the cryptographic hash function h⋅.Theorem 1.
LetA1 be an adversary node that runs the Random Oracle Model (ROM) against the suggested authentication scheme S in polynomial time. The adversary node A1 has not yet hacked even a single node, according to a password dictionary with a uniform distribution Dic. The adversary’s risk of cracking the S’s session key security is calculated as follows:(25)AdvSAKE≤qhash2Hash≤qsend2lenPWi⋅Dic≤2⋅AdvZPECDLPt.
Here,(1)
AdvZPECDLPt: with respect to the EC-equation, A1 cracking the ECDLP has an advantage over ZP(2)
qhash: the total number of hash requests done(3)
Hash: hash function’s range space(4)
qsend: the total amount of hash queries that Random Oracle has received(5)
Dic: dictionary size DicProof.
We must define a game sequenceGi,i=0,1,2,3,4 in order to prove the theorem, and we must calculate the Succi that denotes the adversary node’s effectiveness in the predicting steps in Gi.
Supposition: It is necessary to demonstrate that theA1 has a very low chance of compromising the recommended authentication process and Skey’s security of S.
GameG0: The game G0 depicts a real-time attack carried out by A1 in order to defeat the suggested scheme S1 under RTROM. According to definition, the bit b is chosen at random.(26)AdvS1AKEA1=2PrSucc0−1.
GameG1: the attacker A1 simulates an eavesdropping context, in which some threats can be carried out by running the ExecuteQueryρt,ρr’s queries to RO. A1 uses Test Query to compare the outcome of the ExecuteQueryρt,ρr query against RO. This is used to create a fake login request from the query’s results ExecuteQueryρt,ρr. The attack could not generate any fraudulent login requests that appear in the output of the ExecuteQueryρt,ρr, because the login message \{LRi, Ei, Ts\} is generated by using LRi = hhrandrTrSKeyhrandi⋅PKeyx,y. The attacker could not calculate a fake LRi instead of being aware of the values randr,Tr and SKey. The adversary A1 will not benefit from the game G1. The attacker node A1’s success chance will not be increased by playing G1. As seen in (27), the probability value of G1 is similar to the G0’s probability value.(27)Pr?Succ0=Pr?Succ1.
GameG2: game G2 is not similar to the game of G1. In this case, the attacker employs two additional queries, HashQuery⋅, SendQueryρt,M oracles. G2 depicts an actual attack scenario where the adversary A1 attempts to prove as a legitimate player by receiving a forged communication from it. A1 forwards HashQuery⋅ queries to the Hash oracle periodically in order to discover conflict messages for the related passwords. The adversary node A1 obtains the request for login\{LRi, Ei, Ts\} and tries to discover the conflict for LRi=hhrandrTrSKeyhrandi⋅PKeyx,y in this protocol. Here, randr and SKey are random nonce and private of Server S. The attacker could not find the original randr and original private key of server SKey. Due to this reason no collisions will occur, or collision occurrence ratio is negligible if A1 queries send oracle. By applying birthday paradox, the probability factor for success in this game is lower than qh2/2⋅Hash. From the preceding assumption, the following equation is obtained:(28)Pr?Succ1−Pr?Succ2≤qh22⋅Hash.
GameG3: the smart card loss attempt is presented in G3, and it implements the CorruptSCardρUit query oracle.
Suppose that if the password may not be a robust password, the hackerA1 can attempt to even use the data retrieved from the device cards to initiate Dic dictionary attack in an online mode. Even if the parameters in smart card are hacked, both adversary or node of the adversary A1 will be unable to extract the password PWi because the secret PWi has been masked with other related parameters as follows:(29)CK1=hCIDiCPWirandr.
The passwordCPWi with Tr is calculated as CPWi=hPWiTr. The CPWi is hashed along with the CIDi=hIDiTr and randr. The attacker is not able to retrieve the initial password from the well-known CPWi value. The system limits the amount of incorrect password input during the login phase to a certain number of times (for ex, 3 to 4 attempts). The chances of finding the correct password PWi are approximated as 1/2lenPWi. The adversary A1’s chances of winning in game G3 are evaluated as shown below, and the value of lenPWi denotes password length.(30)Pr?Succ2−Pr?Succ3≤qSend2lenPWi⋅Dic.
GameG4: using the CorruptSCardρUit oracle, G4 is simulated with an attacker A1 who possesses the SCi of authorized user Ui. The two attacks discussed as follows are attempted by the attacker node:(1)
As a result,A1 can obtain the data’s SCi = \{CK1, CK2, randr, Tr, PKey, Gx,y\} and use them to retrieve the IDi and PWi of the authorized user Ui. Because of the hash algorithm’s collision resistance, the authorized user Ui, IDi, and PWi may be identified using a specified value of CK1 that is not possible, as per game G4.(2)
The recommended authentication schemeS1 creates the request for login as, \{LRi, Ei, TS\} and LRi, where it is calculated as LRi=hhrandrTrSKeyhrandi⋅PKeyx,y. Next, the adversary calculates the correct LRi from the known values of \{CK1, CK2, randr, Tr, PKey, Gx,y\}. In this, LRi is calculated by randr and SKey parameters. Because of ECDLP, the adversary cannot really construct a true SKey, from PKeyx,y. As a result, without knowing the SKey, the adversary seems unable to calculate the LRi. Hence, the adversary was unable to create a legitimate request for login based on the discussion.(3)
Here,SKnew=hrandS⋅randI⋅PKeyx,y is the session key computed. The attacker may know the value of PKeyx,y, because it is a public parameter. The attacker could not find or guess the session key for a particular session by using the public key of server PKeyx,y alone, without knowing randS. The chance of an attacker’s rate of success is shown below, based on the aforementioned considerations:(31)Pr?Succ3−Pr?Succ4≤AdvGPDLPt.
As illustrated previously,GameG4 proved that Pr?Succ4=1/2. From (equation (1)), to (equation (5)), we have obtained the results as finalized eq.:(32)Pr?Succ0−12≤qh22⋅Hash+qsend2lenPWi⋅D+AdvGPECDLPt,(33)Pr?Succ0=AdvPakeA2+12.
Hence, by solving the (32) and (33), we have(34)AdvSakeA1≤qhash2Hash+2⋅qsend2lenPWi⋅Dic+2⋅AdvGPECDLPt.
TheCorruptSC oracle is implemented in G4 by stealing the legal user’s smart card (assume attacker A1). Based on ECDLP, an adversary AdvS1akeA1 is extremely not powerful, and under this premise, the suggested authentication system S1 is secure. The ECDLP is impossible computationally for any attacker A1 within the time limit. As a result, based on the assumptions, this proposed scheme is more secure and preserves perfect forward secrecy authentication.


## 7. The Performance Analysis

This section provides a detailed explanation about performance analysis of the proposed authentication mechanism in great depth. This section is divided into two parts: communication costs and computational cost analyses.In terms of computing and communication costs, the proposed work has been compared to similar research works such as Xu et al. [24], Tu et al. [50], Islam et al. [17], Wei et al. [23], Chaudhry et al. [25], Ostad-Sharif et al. [39], Qiu et al. [26], kumar et al. [44], karthigaiveni et al. [49], Sharif et al. [32], and Khatoon et al. [51].


### 7.1. Computational Cost Analysis

This proposed authentication method comprises five sections; however, for the computational run-time cost analysis, both the login authentication phases, as well as the verification phase, are considered. The remaining phases are not considered for the analysis, because these phases are executed only once and not executed frequently. In the proposed scheme and related authentication schemes, we have used the following basic cryptographic functions.We have used the following environment setup for calculating the performance evaluation and analysis. The simulation was performed on a Windows 3 64-bit PC with an Intel Core i5-8250U CPU running at 1.60GHz and 4 GB of RAM. Table 4 shows the time taken for executing the individual cryptographic operation in seconds.Table 4
Basic notation of cryptographic computations.
NotationsDescriptionExperimental valuesTecaTime taken for an executing elliptic curve arithmetic≈7.395msThTime taken for an executing one way Hash functions≈8.7msTsmTime taken for an executing symmetric encryption/decryption≈0.7msTsgTime taken for an executing signature≈331.7msTable5 compares the computing cost analysis of the proposed system to those of other comparable schemes. In this authentication phase that is been proposed, login phase consumes 7Th+2Teca and the authentication verification phase requires 5Th+2Teca. This scheme takes ≈37.968ms in order to execute the login authentication verification phases. It needs a minimum cost for computation in comparison with other related schemes.Table 5
Run time analysis.
SchemesLogin phaseAuthentication and key agreement phaseTotal costTime taken(secs)Xu et al. [24]3Th+3Teca5Th+4Teca8Th+7Teca≈57.365msTu et al. [50]5Th+3Teca6Th+3Teca11Th+6Teca≈52.07msIslam et al. [17]4Th+3Teca6Th+4Teca10Th+7Teca≈58.765msWei et al. [23]4Th+Teca6Th+Teca10Th+2Teca≈21.79msChaudry et al. [25]5Th+3Teca4Th+4Teca9Th+7Teca≈58.065msOstad-Sharif et al. [39]4Teca+11Th4Teca+2Tsm+8Th8Teca+2Tsm+19Th≈89.86msQiu et al. [26]8Th+2Teca5Th+2Teca13Th+4Teca≈38.68sKumar et al. [44]3Tsg+11Tsm+21Th4Tsg+12Tsm+16Th7Tsg+23Tsm+37Th≈2540.5msKarthigaiveni [49]4Th+1Teca3Th+2Teca+2Tsm7Th+3Teca+2Tsm≈44.485msSharif et al. [32]7Th+1Teca7Th+3Teca+2Tsm14Th+6Teca+2Tsm≈167.57msKhatoon et al. [51]4Th9Th+7Teca+3Tsm11Th+7Teca+3Tsm≈149.57msOurs7Th+2Teca5Th+2Teca12Th+4Teca≈37.968ms


### 7.2. Communication Cost Analysis

The communication cost analysis is performed with the reasonable assumptions, such as the 160-bit minimum needed forIDi. For ECC, prime number p is chosen of size of 160 bits, which is comparable to the RSA cryptosystem’s size of 1024 bits [24]. The random nonce has a length of 128 bits. Time stamp must be 32 bits in length, and message for Asymmetric encryption or decryption must be 128 bits. The ECC-160-bit encryption algorithm is used here.In this authentication protocol, the request for login is computed by using the values \{LRi, Ei, Ts\} and it requires LRi≈160,Ei≈128,Tc≈32=160+128+32≈310bits. The number of bits required for the message \{MRi, Tc\} is MRi≈160,Tc≈32=160+32≈192bits. The proposed technique’s cumulative communication overhead is 310+192≈502bits. The suggested scheme’s communication overhead is compared to that of other comparable schemes in Table 6. The proposed authentication scheme requires minimum communication overhead ≈502bits when compared to all other schemes related to it.Table 6
Communication cost comparison.
SchemesNo. of messagesTotal no. of bitsXu et al. [24]2≈1184Tu et al. [50]3≈1728Islam et al. [17]3≈1888Wei et al. [23]3≈1376Chaudry et al. [25]4≈2688Ostad-Sharif et al. [39]2≈1248Qiu et al. [26]2≈1760Kumar et al. [44]4≈2128Karthigaiveni [49]2≈800Sharif et al. [32]2≈1376Khatoon et al. [51]2≈1670Ours2≈502Both Qiu [26] and the suggested system consume the closest communication cost in this comparison, as depicted in Table 6. Hence, it is justified that the suggested protocol meets all security criteria, but the approach presented by Qiu et al. [26] fails. Table 3 depicts the security requirement comparison between the proposed scheme and other relevant schemes, showing that the proposed system is much secure and user-friendly than other existing algorithms.


## 7.1. Computational Cost Analysis

This proposed authentication method comprises five sections; however, for the computational run-time cost analysis, both the login authentication phases, as well as the verification phase, are considered. The remaining phases are not considered for the analysis, because these phases are executed only once and not executed frequently. In the proposed scheme and related authentication schemes, we have used the following basic cryptographic functions.We have used the following environment setup for calculating the performance evaluation and analysis. The simulation was performed on a Windows 3 64-bit PC with an Intel Core i5-8250U CPU running at 1.60GHz and 4 GB of RAM. Table 4 shows the time taken for executing the individual cryptographic operation in seconds.Table 4
Basic notation of cryptographic computations.
NotationsDescriptionExperimental valuesTecaTime taken for an executing elliptic curve arithmetic≈7.395msThTime taken for an executing one way Hash functions≈8.7msTsmTime taken for an executing symmetric encryption/decryption≈0.7msTsgTime taken for an executing signature≈331.7msTable5 compares the computing cost analysis of the proposed system to those of other comparable schemes. In this authentication phase that is been proposed, login phase consumes 7Th+2Teca and the authentication verification phase requires 5Th+2Teca. This scheme takes ≈37.968ms in order to execute the login authentication verification phases. It needs a minimum cost for computation in comparison with other related schemes.Table 5
Run time analysis.
SchemesLogin phaseAuthentication and key agreement phaseTotal costTime taken(secs)Xu et al. [24]3Th+3Teca5Th+4Teca8Th+7Teca≈57.365msTu et al. [50]5Th+3Teca6Th+3Teca11Th+6Teca≈52.07msIslam et al. [17]4Th+3Teca6Th+4Teca10Th+7Teca≈58.765msWei et al. [23]4Th+Teca6Th+Teca10Th+2Teca≈21.79msChaudry et al. [25]5Th+3Teca4Th+4Teca9Th+7Teca≈58.065msOstad-Sharif et al. [39]4Teca+11Th4Teca+2Tsm+8Th8Teca+2Tsm+19Th≈89.86msQiu et al. [26]8Th+2Teca5Th+2Teca13Th+4Teca≈38.68sKumar et al. [44]3Tsg+11Tsm+21Th4Tsg+12Tsm+16Th7Tsg+23Tsm+37Th≈2540.5msKarthigaiveni [49]4Th+1Teca3Th+2Teca+2Tsm7Th+3Teca+2Tsm≈44.485msSharif et al. [32]7Th+1Teca7Th+3Teca+2Tsm14Th+6Teca+2Tsm≈167.57msKhatoon et al. [51]4Th9Th+7Teca+3Tsm11Th+7Teca+3Tsm≈149.57msOurs7Th+2Teca5Th+2Teca12Th+4Teca≈37.968ms


## 7.2. Communication Cost Analysis

The communication cost analysis is performed with the reasonable assumptions, such as the 160-bit minimum needed forIDi. For ECC, prime number p is chosen of size of 160 bits, which is comparable to the RSA cryptosystem’s size of 1024 bits [24]. The random nonce has a length of 128 bits. Time stamp must be 32 bits in length, and message for Asymmetric encryption or decryption must be 128 bits. The ECC-160-bit encryption algorithm is used here.In this authentication protocol, the request for login is computed by using the values \{LRi, Ei, Ts\} and it requires LRi≈160,Ei≈128,Tc≈32=160+128+32≈310bits. The number of bits required for the message \{MRi, Tc\} is MRi≈160,Tc≈32=160+32≈192bits. The proposed technique’s cumulative communication overhead is 310+192≈502bits. The suggested scheme’s communication overhead is compared to that of other comparable schemes in Table 6. The proposed authentication scheme requires minimum communication overhead ≈502bits when compared to all other schemes related to it.Table 6
Communication cost comparison.
SchemesNo. of messagesTotal no. of bitsXu et al. [24]2≈1184Tu et al. [50]3≈1728Islam et al. [17]3≈1888Wei et al. [23]3≈1376Chaudry et al. [25]4≈2688Ostad-Sharif et al. [39]2≈1248Qiu et al. [26]2≈1760Kumar et al. [44]4≈2128Karthigaiveni [49]2≈800Sharif et al. [32]2≈1376Khatoon et al. [51]2≈1670Ours2≈502Both Qiu [26] and the suggested system consume the closest communication cost in this comparison, as depicted in Table 6. Hence, it is justified that the suggested protocol meets all security criteria, but the approach presented by Qiu et al. [26] fails. Table 3 depicts the security requirement comparison between the proposed scheme and other relevant schemes, showing that the proposed system is much secure and user-friendly than other existing algorithms.


## 8. Conclusions

Two-factor authentication schemes are the best solution for any remote system applications. Compared to two-factor authentication systems, biometric-based authentication techniques have significant computational costs. The suggested technique in this study is a smart card-based two-factor authentication approach that is considerably more efficient and safe. Elliptic Curve Cryptography, as well as the factors of password and smart card, was utilized in this method. Elliptic Curve Discrete Logarithm Problems are the basis for the proposed methodology. The user’s anonymity is preserved using this authentication technique, and the user can change the password even without server’s awareness. We have done the formal and informal security research on the suggested method, and the results demonstrate that it can withstand the majority of smart card-based two-factor authentication attacks. Furthermore, when compared to comparable two-factor authentication methods, the suggested authentication scheme incurs minimum computational and communication costs.



---

*Source: 9273662-2022-02-14.xml*