# TC-PSLAP: Temporal Credential-Based Provably Secure and Lightweight Authentication Protocol for IoT-Enabled Drone Environments

Authors: Zeeshan Ali; Bander A. Alzahrani; Ahmed Barnawi; Abdullah Al-Barakati; Pandi Vijayakumar; Shehzad Ashraf Chaudhry
Journal: Security and Communication Networks
 (2021)

---

## Abstract

In smart cities, common infrastructures are merged and integrated with various components of information communication and technology (ICT) to be coordinated and controlled. Drones (unmanned aerial vehicles) are amongst those components, and when coordinated with each other and with the environment, the drones form an Internet of Drones (IoD). The IoD provides real-time data to the users in smart cities by utilizing traditional cellular networks. However, the delicate data gathered by drones are subject to many security threats and give rise to numerous privacy and security issues. A robust and secure authentication scheme is required to allow drones and users to authenticate and establish a session key. In this article, we proposed a provably secure symmetric-key and temporal credential-based lightweight authentication protocol (TC-PSLAP) to secure the drone communication. We prove that the proposed scheme is provably secure formally through the automated verification tool AVISPA and Burrows–Abadi–Needham logic (BAN logic). Informal security analysis is also performed to depict that the proposed TC-PSLAP can resist known attacks.


---

## Body

## 1. Introduction

Over time, more of the rural population is moving to urban areas. Hence, it is right to say that urbanization is the future, and 66% of the society will move to urban areas by 2050 [1]. So, with the rise of the urban population, it becomes crucial to building smart cities by employing information and communication technologies (ICT) [2, 3]. These services incorporate smart home, smart meter, smart grid, edge computing, Internet of Things (IoT), and smartphone which enable the individuals to log in into applications and transmit and receive data [4].In making cities smarter, drone technology has undoubtedly played a significant role. It is challenging to envision a smart city without incorporating drone services [5]. Drones (also known as unmanned aerial vehicles (UAVs)) are employed in diverse areas ranging from transportation, safety and security, agriculture, environmental protection, disaster mitigation, and surveillance and in a variety of areas as illustrated in Figure 1. A typical drone consists of a battery, sensors, actuators, recorder, computing, and communication module [6]. The typical architecture of a drone is depicted in Figure 2.Figure 1
Uses of drones.Figure 2
Typical architecture of the drone (adopted from [6]).Drones are adequately smart, can communicate with one other, and can also make judgments without human involvement [7]. When several drones work together, intercommunicate, accumulate data, and reside in a designated flying zone, then this is referred to as an Internet of Drones (IoD) [8]. Data gathered by the drones are then transmitted to a remote server/ground station/base station where they are further analyzed [9].These drones gather sensitive data from their environment and transmit them to the base station over the insecure wireless channel. So, an attacker can capture and modify the unfeigned environment-related data. Moreover, an attacker can access these drones and can use them for their wicked purposes such as the illegal surveillance of an individual [10, 11]. Consequently, IoD needs a security mechanism to evade proscribed access and to render availability in addition to confidentiality and data integrity.In the recent past, many researchers have presented authentication and key agreement (AKA) schemes and surveys related to drones’ security, privacy, and limitations. As drones rely on the insecure wireless channel to communicate, they are susceptible to many security threats [12–14]. Yaacoub et al. [7] recently presented a detailed survey related to drones, in which they have discussed various aspects associated with UAVs in detail. They have discussed regulations, architecture, communication types, UAV types, crash, collision, and obstacle-collision methods. They have also discussed use domains, various security, privacy, and safety concerns, and existing threats and vulnerabilities related to drones along with suggestions and recommendations to enhance drone security.Alsamhi et al. [5] presented the survey in which they discussed how the collaboration between smart drones and IoT increases the smartness of the smart city. Zhang et al. [15] introduced a lightweight AKA scheme for the IoD. The scheme of Zhang et al. exploits the resource-friendly bitwise exclusive OR (XOR) and noninvertible hash functions (Hash) to provide a lightweight and efficient authentication process. Zhang et al. also stated that the scheme can withstand various known attacks. Kirsal Ever [16] proposed an AKA framework for mobile sinks in the IoD applications. Deebak and Al-Turjman [17] proposed a lightweight scheme for IoT-based drones to provide privacy preservation and to support mutual authentication. Their scheme is based on XOR, Hash, and hash-based message authentication (HMAC). Chen et al. [18] proposed an authentication scheme for UAVs with direct anonymous attestation with low computation cost to enhance performance.Srinivas et al. [19] introduced an anonymous lightweight authentication scheme for the IoD based on the temporary credentials. In their scheme, the user and drone need to be registered with the ground station server (GSS) first to access the remote drone. They stated that their scheme can withstand known attacks such as offline password guessing attack, user, GSS, remote drone impersonation attack, and reply attack and renders user anonymity and untraceability.However, Ali et al. [6] proved that [19] is not secure and is prone to traceability attack and impersonation attack based on the stolen verifier attack and does not scale well. To overcome these issues, they introduced an improved scheme. They also stated that their scheme is secure and can withstand stolen mobile devices, impersonation, reply, man-in-the-middle, remote drone impersonation attack, and various other known attacks.Nikooghadam et al. [20] also proposed a lightweight authentication scheme for the IoD for smart city surveillance. Their scheme is based on elliptic curve cryptography (ECC), one-way hash function, and bitwise (XOR). Their scheme consists of three entities, namely, user, drone, and control server. They stated that their scheme is safe and can withstand various attacks. However, their scheme suffers from user impersonation, control server impersonation, drone impersonation based on the stolen verifier attack, privileged insider attack, and leakage of secret parameters, does not render user anonymity, and lacks untraceability.


### 1.1. Paper Organization

The rest of the paper is arranged as follows: the notations used in the manuscript are provided in Table1. The adversarial model adopted in this paper is outlined in Section 1.2. Our protocol is outlined in Section 2, and its security analysis is performed in Section 3. The comparative analysis is performed in Section 4. The paper is finally concluded in Section 5.Table 1
Notations’ guide.
SymbolsRepresentationsUk,PIDk,PWDkkth user, its personal identity, passwordBIOkkth users’ personal biometricMDkkth users’ mobile deviceCS,MSKControl server and its private master keyDRl,IDDRllth drone and its identitysklk=skklShared session key betweenUk and DRlPECC base pointEpa,bRandmmth random number of 160 bitsTcs,Tk,TlCurrent timestamps ofCS, Uk, and DRlδT,TCMaximum allowable transmission delay and present timei=?jChecks ifi is equal to jH.Cryptographic one-way hash function⊕,‖Bitwise XOR and concatenation operatorsA,UAAn adversary and privileged insider


### 1.2. Threat Model

The common CK adversarial model [21, 22] is adopted in this article, where the adversary A has the following competencies:(1)
Communication over the public/open channel is under the full control ofA(2)
A can forge a message and can also delay, restrain, retransmit, and alter the former message(3)
By employing the power analysis,A can extract the information from the smart card/mobile device/drone(4)
An outsider or insider/privileged user can compromise the privacy and security of the system(5)
An insider saysUA can endanger/access the verifier information put in the database controlled by CS [23](6)
Servers’ private key cannot be compromised


## 1.1. Paper Organization

The rest of the paper is arranged as follows: the notations used in the manuscript are provided in Table1. The adversarial model adopted in this paper is outlined in Section 1.2. Our protocol is outlined in Section 2, and its security analysis is performed in Section 3. The comparative analysis is performed in Section 4. The paper is finally concluded in Section 5.Table 1
Notations’ guide.
SymbolsRepresentationsUk,PIDk,PWDkkth user, its personal identity, passwordBIOkkth users’ personal biometricMDkkth users’ mobile deviceCS,MSKControl server and its private master keyDRl,IDDRllth drone and its identitysklk=skklShared session key betweenUk and DRlPECC base pointEpa,bRandmmth random number of 160 bitsTcs,Tk,TlCurrent timestamps ofCS, Uk, and DRlδT,TCMaximum allowable transmission delay and present timei=?jChecks ifi is equal to jH.Cryptographic one-way hash function⊕,‖Bitwise XOR and concatenation operatorsA,UAAn adversary and privileged insider


## 1.2. Threat Model

The common CK adversarial model [21, 22] is adopted in this article, where the adversary A has the following competencies:(1)
Communication over the public/open channel is under the full control ofA(2)
A can forge a message and can also delay, restrain, retransmit, and alter the former message(3)
By employing the power analysis,A can extract the information from the smart card/mobile device/drone(4)
An outsider or insider/privileged user can compromise the privacy and security of the system(5)
An insider saysUA can endanger/access the verifier information put in the database controlled by CS [23](6)
Servers’ private key cannot be compromised


## 2. Proposed TC-PSLAP

In this section, an enhanced scheme is introduced. The proposed TC-PSLAP comprises mainly four processes, namely, (i) initialization process, (ii) registration process, (iii) login and authentication process, and (iv) password update process. The proposed scheme as depicted in Figure3 is described in the subsequent sections.Figure 3
Working of the proposed TC-PSLAP architecture.


### 2.1. TC-PSLAP: Initialization Process

In this process, the control serverCS picks a private master key MSK∈Zp and a one-way hash function H. and makes the parameters H. public, while MSK is kept private.


### 2.2. TC-PSLAP: Registration Process

This phase describes the procedure of registering a user and a drone with the system.


#### 2.2.1. TC-PSLAP: User Registration Process

To access the system and to utilize its resources, userUk first needs to register with the CS over the private channel. Subsequent are the steps performed by Uk to register with the CS:URG 1: userUk picks an identity PIDk, a password PWDk, and an arbitrary number Rand1∈Zp∗ and transmits PIDk over the secure channel to the control server CS.URG 2:CS receives the registration request from Uk, picks an arbitrary number Rand2∈Zp∗ and a temporary identity TIDk∈Zp∗, and transmits the message containing Xk,Ak,TIDk to Uk over the secure channel where Ak=HPIDkMSKRand2 and Xk=EHMSKPIDk,Rand2. CS also stores the parameter TIDk into the database.URG 3: upon receiving the response fromCS, Uk computes Vk=HPWDk‖Rand1,AUTHk=HPIDkPWDkRand1,Xk+=Xk⊕Vk,Ak+=Ak⊕Vk,TIDk+=TIDk⊕Vk,Rand1+=Rand1⊕HPIDk‖PWDk.URG 4: finally,Uk saves the parameters AUTHk,Xk+,Ak+,TIDk+,Rand1+ into the mobile device MDk.


#### 2.2.2. TC-PSLAP: Drone Registration Process

Following are the steps performed to register the drone with the system in an offline mode:DRG 1: a remote droneDRl picks an identity IDDRl and transmits it to the CS over the secure channel.DRG 2: upon receiving the registration request fromDRl, CS picks an arbitrary number Rand3∈Zp∗ and pseudo-identity TIDl∈Zp∗. Next, CS computes Xl=HIDDRlRand3TIDl,KEYcs,l=HHMSK‖Xl and transmits the message containing TIDl,KEYcs,l to DRl via the secure channel. CS also stores the parameters TIDl,Xl in the database.DRG 3:DRl also stores the parameters IDDRl,TIDl,‖KEYcs,l into the memory securely.


### 2.3. TC-PSLAP: Login and Authentication Process

After successful registration,Uk and DRl can establish a session key to communicate securely with the help of CS. Subsequent steps as depicted in Figure 4 are performed by Uk, CS, and DRl to establish a session key:LAU 1:Uk provides his/her identity PIDk+ and password PWDk+, and MDk computes Ik=HPIDk+‖PWDk+andRand1=Rand1+⊕Ik. If the condition AUTHk=?HPIDk+PWDk+Rand1 is true, then the process continues; else, it terminates.LAU 2: upon successful verification,MDk picks a present timestamp Tk and an arbitrary number Rand4 and computes Ak=Ak+⊕Ik,Vk′=HPWDk‖Rand1,Jk=HAk‖Tk,Xk=Xk+⊕Vk′,TIDk=TIDk+⊕Vk′,Zk=HAkTIDkRand4‖Tk,TIDl+=TIDl⊕Jk,andRand4+=Rand4⊕Jk. Finally, MDk transmits the message containing MSG1=Xk,Zk,Rand4+,TIDk,TIDl+,Tk to CS via the insecure channel.LAU 3: upon receivingMSG1 from Uk, CS first checks the freshness of the message by examining the condition TC−Tk≤δT and checks whether TIDk exists in the database or not. If both conditions are true, CS computes PIDk,Rand2=DHMSKXk, Ak′=HPIDkMSKRand2, Jk′=HAk′‖Tk, and Rand4=Rand4+⊕Jk′ and checks the condition Zk=?HAk′TIDkRand4‖Tk. If false, the process exits; else, the next step is executed.LAU 4:CS picks Rnew,Rand5,TIDknew, further computes TIDl=TIDl+⊕Jk′,KEYcs,l+=HHMSK‖Xl,Wcs=HRand4PIDkHTIDk‖TIDknew‖Ak,Zcs=HKEYcs,l+Rand5Tcs,TIDk+=TIDknew⊕Jk′,Wcs+=Wcs⊕KEYcs,l+,Rand5+=Rand5⊕KEYcs,l+,Ak¯=HPIDkMSKRnew⊕Jk′,andXk¯=EHMSKPIDk,Ak¯,Rnew⊕Jk′, and replaces TIDk with TIDknew. CS finally transmits the message containing MSG2=Wcs+,Ak¯,Xk¯,Zcs,Rand5+,TIDk+,TIDl,Tcs to DRl via the insecure channel.LAU 5: upon receivingMSG2 from CS, DRl first checks the freshness of the message by examining the condition TC−Tcs≤δT and checks whether TIDl received is the same as saved in DRl’s memory. If both conditions are true, DRl computes Rand5=Rand5+⊕KEYcs,l and checks the condition Zcs=?HKEYcs,lRand5Tcs.LAU 6: if true,SRl selects the present timestamp Tl and Rand6 and further computes Wcs=Wcs+⊕KEYcs,l,Rand6+=Rand6⊕Wcs,SKlk=HRand6‖Wcs,and Authl=HSKlkTIDlTl. DRl finally transmits the message containing MSG3=Ak¯,Xk¯,Rand6+,Authl,TIDk+,Tl to Uk via the insecure channel.LAU 7: upon receivingMSG3 from DRl, MDk first checks the freshness of the message by examining the condition TC−Tl≤δT. If true, MDk computes TIDknew=TIDk+⊕Jk,Wcs′=HRand4PIDkHTIDk‖TIDknew‖Ak,andRand6=Rand6+⊕Wcs′,SKkl=HRand6‖Wcs′ and examines the condition Authl=?HSKklTIDlTl. If true, SKkl=SKlk is used as a session key to secure the communication and the next step is executed; else, the process terminates.LAU 8: finally,MDk replaces the parameters TIDk+,Ak+,Xk+ with TIDK′new,AKnew,XKnew, where TID′Knew=TIDknew⊕Vk′,Aknew=Ak¯⊕Jk⊕Vk′,andXknew=Xk¯⊕Jk⊕Vk′.Figure 4
TC-PSLAP: login and authentication process.


### 2.4. TC-PSLAP: Password Update Process

If a user wants to update his/her password, he/she can do this without the involvement of the control server by adopting the subsequent procedure:(1)
First, the user needs to get verified by adopting the procedure as described in Section2.3(2)
After successful verification,Uk will be prompted to provide a new password PWDknew(3)
Next,MDk will compute Vknew=HPWDkold‖Rand1, AUTHknew=HPIDkPWDknewRand1, Xknew=Xk+⊕Vk, Ak+=Ak⊕Vk, IDk+=TIDk⊕Vk, and Rand1+=Rand1⊕HPIDk‖PWDk


## 2.1. TC-PSLAP: Initialization Process

In this process, the control serverCS picks a private master key MSK∈Zp and a one-way hash function H. and makes the parameters H. public, while MSK is kept private.


## 2.2. TC-PSLAP: Registration Process

This phase describes the procedure of registering a user and a drone with the system.


### 2.2.1. TC-PSLAP: User Registration Process

To access the system and to utilize its resources, userUk first needs to register with the CS over the private channel. Subsequent are the steps performed by Uk to register with the CS:URG 1: userUk picks an identity PIDk, a password PWDk, and an arbitrary number Rand1∈Zp∗ and transmits PIDk over the secure channel to the control server CS.URG 2:CS receives the registration request from Uk, picks an arbitrary number Rand2∈Zp∗ and a temporary identity TIDk∈Zp∗, and transmits the message containing Xk,Ak,TIDk to Uk over the secure channel where Ak=HPIDkMSKRand2 and Xk=EHMSKPIDk,Rand2. CS also stores the parameter TIDk into the database.URG 3: upon receiving the response fromCS, Uk computes Vk=HPWDk‖Rand1,AUTHk=HPIDkPWDkRand1,Xk+=Xk⊕Vk,Ak+=Ak⊕Vk,TIDk+=TIDk⊕Vk,Rand1+=Rand1⊕HPIDk‖PWDk.URG 4: finally,Uk saves the parameters AUTHk,Xk+,Ak+,TIDk+,Rand1+ into the mobile device MDk.


### 2.2.2. TC-PSLAP: Drone Registration Process

Following are the steps performed to register the drone with the system in an offline mode:DRG 1: a remote droneDRl picks an identity IDDRl and transmits it to the CS over the secure channel.DRG 2: upon receiving the registration request fromDRl, CS picks an arbitrary number Rand3∈Zp∗ and pseudo-identity TIDl∈Zp∗. Next, CS computes Xl=HIDDRlRand3TIDl,KEYcs,l=HHMSK‖Xl and transmits the message containing TIDl,KEYcs,l to DRl via the secure channel. CS also stores the parameters TIDl,Xl in the database.DRG 3:DRl also stores the parameters IDDRl,TIDl,‖KEYcs,l into the memory securely.


## 2.2.1. TC-PSLAP: User Registration Process

To access the system and to utilize its resources, userUk first needs to register with the CS over the private channel. Subsequent are the steps performed by Uk to register with the CS:URG 1: userUk picks an identity PIDk, a password PWDk, and an arbitrary number Rand1∈Zp∗ and transmits PIDk over the secure channel to the control server CS.URG 2:CS receives the registration request from Uk, picks an arbitrary number Rand2∈Zp∗ and a temporary identity TIDk∈Zp∗, and transmits the message containing Xk,Ak,TIDk to Uk over the secure channel where Ak=HPIDkMSKRand2 and Xk=EHMSKPIDk,Rand2. CS also stores the parameter TIDk into the database.URG 3: upon receiving the response fromCS, Uk computes Vk=HPWDk‖Rand1,AUTHk=HPIDkPWDkRand1,Xk+=Xk⊕Vk,Ak+=Ak⊕Vk,TIDk+=TIDk⊕Vk,Rand1+=Rand1⊕HPIDk‖PWDk.URG 4: finally,Uk saves the parameters AUTHk,Xk+,Ak+,TIDk+,Rand1+ into the mobile device MDk.


## 2.2.2. TC-PSLAP: Drone Registration Process

Following are the steps performed to register the drone with the system in an offline mode:DRG 1: a remote droneDRl picks an identity IDDRl and transmits it to the CS over the secure channel.DRG 2: upon receiving the registration request fromDRl, CS picks an arbitrary number Rand3∈Zp∗ and pseudo-identity TIDl∈Zp∗. Next, CS computes Xl=HIDDRlRand3TIDl,KEYcs,l=HHMSK‖Xl and transmits the message containing TIDl,KEYcs,l to DRl via the secure channel. CS also stores the parameters TIDl,Xl in the database.DRG 3:DRl also stores the parameters IDDRl,TIDl,‖KEYcs,l into the memory securely.


## 2.3. TC-PSLAP: Login and Authentication Process

After successful registration,Uk and DRl can establish a session key to communicate securely with the help of CS. Subsequent steps as depicted in Figure 4 are performed by Uk, CS, and DRl to establish a session key:LAU 1:Uk provides his/her identity PIDk+ and password PWDk+, and MDk computes Ik=HPIDk+‖PWDk+andRand1=Rand1+⊕Ik. If the condition AUTHk=?HPIDk+PWDk+Rand1 is true, then the process continues; else, it terminates.LAU 2: upon successful verification,MDk picks a present timestamp Tk and an arbitrary number Rand4 and computes Ak=Ak+⊕Ik,Vk′=HPWDk‖Rand1,Jk=HAk‖Tk,Xk=Xk+⊕Vk′,TIDk=TIDk+⊕Vk′,Zk=HAkTIDkRand4‖Tk,TIDl+=TIDl⊕Jk,andRand4+=Rand4⊕Jk. Finally, MDk transmits the message containing MSG1=Xk,Zk,Rand4+,TIDk,TIDl+,Tk to CS via the insecure channel.LAU 3: upon receivingMSG1 from Uk, CS first checks the freshness of the message by examining the condition TC−Tk≤δT and checks whether TIDk exists in the database or not. If both conditions are true, CS computes PIDk,Rand2=DHMSKXk, Ak′=HPIDkMSKRand2, Jk′=HAk′‖Tk, and Rand4=Rand4+⊕Jk′ and checks the condition Zk=?HAk′TIDkRand4‖Tk. If false, the process exits; else, the next step is executed.LAU 4:CS picks Rnew,Rand5,TIDknew, further computes TIDl=TIDl+⊕Jk′,KEYcs,l+=HHMSK‖Xl,Wcs=HRand4PIDkHTIDk‖TIDknew‖Ak,Zcs=HKEYcs,l+Rand5Tcs,TIDk+=TIDknew⊕Jk′,Wcs+=Wcs⊕KEYcs,l+,Rand5+=Rand5⊕KEYcs,l+,Ak¯=HPIDkMSKRnew⊕Jk′,andXk¯=EHMSKPIDk,Ak¯,Rnew⊕Jk′, and replaces TIDk with TIDknew. CS finally transmits the message containing MSG2=Wcs+,Ak¯,Xk¯,Zcs,Rand5+,TIDk+,TIDl,Tcs to DRl via the insecure channel.LAU 5: upon receivingMSG2 from CS, DRl first checks the freshness of the message by examining the condition TC−Tcs≤δT and checks whether TIDl received is the same as saved in DRl’s memory. If both conditions are true, DRl computes Rand5=Rand5+⊕KEYcs,l and checks the condition Zcs=?HKEYcs,lRand5Tcs.LAU 6: if true,SRl selects the present timestamp Tl and Rand6 and further computes Wcs=Wcs+⊕KEYcs,l,Rand6+=Rand6⊕Wcs,SKlk=HRand6‖Wcs,and Authl=HSKlkTIDlTl. DRl finally transmits the message containing MSG3=Ak¯,Xk¯,Rand6+,Authl,TIDk+,Tl to Uk via the insecure channel.LAU 7: upon receivingMSG3 from DRl, MDk first checks the freshness of the message by examining the condition TC−Tl≤δT. If true, MDk computes TIDknew=TIDk+⊕Jk,Wcs′=HRand4PIDkHTIDk‖TIDknew‖Ak,andRand6=Rand6+⊕Wcs′,SKkl=HRand6‖Wcs′ and examines the condition Authl=?HSKklTIDlTl. If true, SKkl=SKlk is used as a session key to secure the communication and the next step is executed; else, the process terminates.LAU 8: finally,MDk replaces the parameters TIDk+,Ak+,Xk+ with TIDK′new,AKnew,XKnew, where TID′Knew=TIDknew⊕Vk′,Aknew=Ak¯⊕Jk⊕Vk′,andXknew=Xk¯⊕Jk⊕Vk′.Figure 4
TC-PSLAP: login and authentication process.


## 2.4. TC-PSLAP: Password Update Process

If a user wants to update his/her password, he/she can do this without the involvement of the control server by adopting the subsequent procedure:(1)
First, the user needs to get verified by adopting the procedure as described in Section2.3(2)
After successful verification,Uk will be prompted to provide a new password PWDknew(3)
Next,MDk will compute Vknew=HPWDkold‖Rand1, AUTHknew=HPIDkPWDknewRand1, Xknew=Xk+⊕Vk, Ak+=Ak⊕Vk, IDk+=TIDk⊕Vk, and Rand1+=Rand1⊕HPIDk‖PWDk


## 3. Security Analysis: TC-PSLAP

In this section, automated formal security analysis and informal security analysis of the introduced scheme have been presented.


### 3.1. Informal Analysis

The subsequent sections explore and explain that our TC-PSLAP scheme provides robustness for the known vulnerabilities.


#### 3.1.1. Mutual Authentication

In the proposed TC-PSLAP, all of the entities involved in the communication authenticate one another before proceeding with the process.CS receives MSG1 from Ui and authenticates it by examining Zk=?HAk′TIDkRand4‖Tk. DRl also verifies the authenticity of CS by examining the condition Zcs=?HKEYcs,lRand5Tcs. Upon receiving the message from DRl, Uk also authenticates the drone by examining the condition AUTHl=?HSKklTIDlTl. Hence, the scheme successfully achieves the mutual authentication.


#### 3.1.2. Anonymity and Traceability

To render anonymity, the identities of the entities involved in the communication are not shared over the public channel. All of the identities are concealed and temporal, and pseudo-identities are used to communicate. So, the scheme provides pseudo-anonymity. Also, the presence of timestampsTk,Tcs,Tl and arbitrary numbers Rand4,Rand5,Rand6 in messages MSG1,MSG2,MSG3 makes the scheme untraceable as these parameters are updated in each session. Hence, the proposed scheme renders anonymity and traceability.


#### 3.1.3. Perfect Forward Secrecy

In the proposed TC-PSLAP, both long- and short-term secrets are incorporated to yield the perfect forward secrecy. Suppose an adversaryA had the knowledge of short-term secrets Rand4,Rand5,Rand6,TIDk, but he/she also requires long-term secrets PIDk,Ak in order to compute the session key. Therefore, the TC-PSLAP supports perfect forward secrecy.


#### 3.1.4. Stolen Verifier Attack

In the TC-PSLAP, the parametersTIDk and TIDl,Xl are stored in the database of the CS. Now, if a privileged insider has access to these parameters, he/she cannot employ these parameters in any way to compromise the security of the system. TIDk changes after each session, TIDl is not employed to compute anything, and Xl is also a hash digest. Therefore, the TC-PSLAP can successfully defend against stolen verifier attacks.


#### 3.1.5. Stolen Mobile Device and Drone Attack

Assume that a legal userUk has lost his/her mobile device or it is stolen by the adversary. Now, through power analysis, A can extract the parameters AUTHk,Xk+,Ak+,TIDk+,Rand1+ from MDk. None of these parameters reveal any information about the user or the system. Also, all of these parameters are encrypted with the help of XOR. Now, A can also extract the parameters stored in the drone which are IDDRl,TIDl,KEYcs,l. None of these parameters can be used to compute the session key as this also requires short-term and other long-term secrets. Therefore, it can withstand the stolen mobile device and drone attack.


#### 3.1.6. Reply Attack

In the TC-PSLAP, timestamp is employed to preventA from launching the reply attack. In the messages MSG1,MSG2,MSG3, timestamp is sent openly and is also hashed with other parameters. Now, if A replaces the old timestamp in any of these messages and retransmits the messages, still he/she would not be able to successfully get authenticated due to the usage of a timestamp in other parameters. Hence, the scheme is secure against reply attacks.


#### 3.1.7. Known Session Key Attack

In the TC-PSLAP, the session key is computed by employing the parametersRand4,Rand6,PIDk,Ak. Now, if A has the information of an old session key, he/she cannot obtain any other session-specific key as the parameters employed in producing the session key are novel in each session. So, the TC-PSLAP can bear the known session key attack.


#### 3.1.8. User Impersonation Attack

A may try to impersonate as a legal user Uk. To impersonate as Uk, A needs Ak, which is Ak=HPIDkMSKRand2. Now, Ak is also session-specific and is updated after each session. And MSK is the private master key of CS, which is inaccessible to A. Hence, it is not feasible for A to impersonate as a legal user Uk.


#### 3.1.9. Drone Impersonation Attack

Uk authenticates DRl by examining the condition AUTHl=HSKlkTIDlTl. Now, to impersonate as DRl, A requires the knowledge of Rand6,Wcs, where Wcs contains Ak which further contains the private master key of CS and is not accessible by A. Hence, the scheme can withstand the drone impersonation attack.


### 3.2. Formal Security Proof Using the BAN Logic

In this section, the TC-PSLAP is tested for robustness under the formal BAN logic.


#### 3.2.1. Postulates

Table2 shows the postulates and corresponding purposes. In addition, Table 3 shows notations used in the BAN logic and corresponding descriptions.Table 2
BAN logic: postulates.
RuleDescriptionA|≡A⟷KB,A⊲XK/A≡Y∼KMessage-meaning ruleA|≡#X,A≡B∼X/A|≡B|≡XNonce verification ruleA|≡B,A|≡C/A|≡B,CAcceptance conjunctionA|≡B|≡X,Y/A|≡B|≡XBelief ruleA|≡#X/A|≡#X,YFresh conjuncatenation ruleA|≡B|≡X,A|≡B|⇒X/A|≡XJurisdiction ruleA|≡#X,A|≡B|≡X/A|≡A⟷KBSession keyTable 3
BAN logic: notations.
NotationExplanationA|≡BA believes statement BA⟷KYShare a keyK between A and Y#BB is freshA⊲BA sees BA|∼BA said BB,CKB,C are hashed by key KBKB is hashed with key KBKB is encrypted with key K


#### 3.2.2. Establishing the Security Goal

Following are the security goals for the TC-PSLAP under the BAN logic:G1:Uk|≡DRl|≡Uk⟷SKDRl.


#### 3.2.3. Messages’ Generic Form

Following is the generalized form of the TC-PSLAP:MSG0:Ui→CS:Xk+⊕Vk′,HAkTIDkRand4‖Tk,Rand4⊕Jk,TIDk,TIDl⊕Jk,Tk,MSG1:CS→DRl:Wcs⊕KEYCS,l,HPIDkMSKRnew⊕Jk′,EHkeyPIDk,Ak¯,Rnew⊕Jk′,HKEYcs,l+Rand5Tcs,Rand5⊕KEYCS,l+,TIDknew⊕Jk′,TIDl,Tcs,MSG2:DRl→Uk:HPIDkMSKRnew⊕Jk′,EHkeyPIDk,Ak¯,Rnew⊕Jk′,Rand6⊕Wcs,HSKlkTIDlTl,TIDk⊕Jk′,Tl.


#### 3.2.4. Messages’ Idealized Form

The idealized form of messages in our TC-PSLAP is given in the following.MSG0:Uk→CS:XkVk′,CS↔AkUk,CS↔TIDkUk,TkRand4,Rand4CS↔JkUk,CS↔TIDlDRlCS↔UkUk,CS↔TIDkUk,TkMSG1:CS→DRl:WcsCS↔Keycs,lDRl,CS↔PIDkUk,MSK,RnewCS↔Jk′Uk,CS↔PIDkUk,Ak¯,RnewkeyJk′,KEYcs,l+,TcsRand5,KEYcs,l+Rand5,TIDknewCS↔Jk′Uk,CS↔TIDlDRl,TcsMSG2:DRl→Uk:CS↔PIDkUk,MSK,RnewCS↔Jk′Uk,CS↔PIDkUk,Ak¯,Rnewkey〉CS↔Jk′Uk,WcsRand6,SKlu,Uk↔TIDlDRl,Tl,TIDknewCS↔Jk′Uk,Tl.


#### 3.2.5. Assumptions

(1)A1:CS|≡#Rand4,Tk,A2Uk|≡#Rnew,Rand5,Tl,A3:DRl|≡#Rand6,Tcs,A4:Uk|≡DRl|⇒DRl|∼X,A5:Uk|≡DRl|⇒Uk⟷SKluDRl,A6:DRl|≡CS|⇒CS|∼X,A7:Uk|≡Uk⟷TIDlDRl,A8:CS|≡CS⟷TIDlDRl,A9:Uk|≡CS|≡Uk⟷JkCS,A10:Uk|≡CS|≡Uk⟷AkCS,A11:Uk|≡Uk⟷PIDkCS,A12:DRl|≡CS⟷TIDlDRl.The mutual authentication betweenUk and DRl is proved using the following steps:S1: from MSG2, we get Uk⊲CS⟷PIDkUk,MSK,RnewCS⟷Jk′Uk,CS⟷PIDkUk,Ak¯,Rnewkey〉CS⟷Jk′Uk,WcsRand6,SKlu,Uk⟷TIDlDRl,Tl,TIDknewCS⟷Jk′Uk,TlS2: based on S1, assumptions A1,A2,A3, and message-meaning rule, we get Uk⊲MSK,Rnew,Ak¯,Rnewkey,WcsRand6,SKlu,Tl,TIDknew,TlS3: based on S2 and the message belief rule, we get Uk|≡Uk⊲MSK,Rnew,Ak¯,Rnew,WcsRand6,SKlu,Tl,TIDknew,TlS4: based on S3, nonce verification, and freshness rule, we get Uk|≡DRl|≡MSK,Rnew,Ak¯,Rnew,WcsRand6,SKlu,TIDknewS5: based on S4, assumption A4, and jurisdiction rule, we get Uk|≡MSK,Rnew,Ak¯,Rnew,WcsRand6,SKlu,TIDknewS6: based on S4,S5, assumption A4,A5,A9, and belief rule, we get Uk|≡DRl|≡Uk⟷SKluDRl


## 3.1. Informal Analysis

The subsequent sections explore and explain that our TC-PSLAP scheme provides robustness for the known vulnerabilities.


### 3.1.1. Mutual Authentication

In the proposed TC-PSLAP, all of the entities involved in the communication authenticate one another before proceeding with the process.CS receives MSG1 from Ui and authenticates it by examining Zk=?HAk′TIDkRand4‖Tk. DRl also verifies the authenticity of CS by examining the condition Zcs=?HKEYcs,lRand5Tcs. Upon receiving the message from DRl, Uk also authenticates the drone by examining the condition AUTHl=?HSKklTIDlTl. Hence, the scheme successfully achieves the mutual authentication.


### 3.1.2. Anonymity and Traceability

To render anonymity, the identities of the entities involved in the communication are not shared over the public channel. All of the identities are concealed and temporal, and pseudo-identities are used to communicate. So, the scheme provides pseudo-anonymity. Also, the presence of timestampsTk,Tcs,Tl and arbitrary numbers Rand4,Rand5,Rand6 in messages MSG1,MSG2,MSG3 makes the scheme untraceable as these parameters are updated in each session. Hence, the proposed scheme renders anonymity and traceability.


### 3.1.3. Perfect Forward Secrecy

In the proposed TC-PSLAP, both long- and short-term secrets are incorporated to yield the perfect forward secrecy. Suppose an adversaryA had the knowledge of short-term secrets Rand4,Rand5,Rand6,TIDk, but he/she also requires long-term secrets PIDk,Ak in order to compute the session key. Therefore, the TC-PSLAP supports perfect forward secrecy.


### 3.1.4. Stolen Verifier Attack

In the TC-PSLAP, the parametersTIDk and TIDl,Xl are stored in the database of the CS. Now, if a privileged insider has access to these parameters, he/she cannot employ these parameters in any way to compromise the security of the system. TIDk changes after each session, TIDl is not employed to compute anything, and Xl is also a hash digest. Therefore, the TC-PSLAP can successfully defend against stolen verifier attacks.


### 3.1.5. Stolen Mobile Device and Drone Attack

Assume that a legal userUk has lost his/her mobile device or it is stolen by the adversary. Now, through power analysis, A can extract the parameters AUTHk,Xk+,Ak+,TIDk+,Rand1+ from MDk. None of these parameters reveal any information about the user or the system. Also, all of these parameters are encrypted with the help of XOR. Now, A can also extract the parameters stored in the drone which are IDDRl,TIDl,KEYcs,l. None of these parameters can be used to compute the session key as this also requires short-term and other long-term secrets. Therefore, it can withstand the stolen mobile device and drone attack.


### 3.1.6. Reply Attack

In the TC-PSLAP, timestamp is employed to preventA from launching the reply attack. In the messages MSG1,MSG2,MSG3, timestamp is sent openly and is also hashed with other parameters. Now, if A replaces the old timestamp in any of these messages and retransmits the messages, still he/she would not be able to successfully get authenticated due to the usage of a timestamp in other parameters. Hence, the scheme is secure against reply attacks.


### 3.1.7. Known Session Key Attack

In the TC-PSLAP, the session key is computed by employing the parametersRand4,Rand6,PIDk,Ak. Now, if A has the information of an old session key, he/she cannot obtain any other session-specific key as the parameters employed in producing the session key are novel in each session. So, the TC-PSLAP can bear the known session key attack.


### 3.1.8. User Impersonation Attack

A may try to impersonate as a legal user Uk. To impersonate as Uk, A needs Ak, which is Ak=HPIDkMSKRand2. Now, Ak is also session-specific and is updated after each session. And MSK is the private master key of CS, which is inaccessible to A. Hence, it is not feasible for A to impersonate as a legal user Uk.


### 3.1.9. Drone Impersonation Attack

Uk authenticates DRl by examining the condition AUTHl=HSKlkTIDlTl. Now, to impersonate as DRl, A requires the knowledge of Rand6,Wcs, where Wcs contains Ak which further contains the private master key of CS and is not accessible by A. Hence, the scheme can withstand the drone impersonation attack.


## 3.1.1. Mutual Authentication

In the proposed TC-PSLAP, all of the entities involved in the communication authenticate one another before proceeding with the process.CS receives MSG1 from Ui and authenticates it by examining Zk=?HAk′TIDkRand4‖Tk. DRl also verifies the authenticity of CS by examining the condition Zcs=?HKEYcs,lRand5Tcs. Upon receiving the message from DRl, Uk also authenticates the drone by examining the condition AUTHl=?HSKklTIDlTl. Hence, the scheme successfully achieves the mutual authentication.


## 3.1.2. Anonymity and Traceability

To render anonymity, the identities of the entities involved in the communication are not shared over the public channel. All of the identities are concealed and temporal, and pseudo-identities are used to communicate. So, the scheme provides pseudo-anonymity. Also, the presence of timestampsTk,Tcs,Tl and arbitrary numbers Rand4,Rand5,Rand6 in messages MSG1,MSG2,MSG3 makes the scheme untraceable as these parameters are updated in each session. Hence, the proposed scheme renders anonymity and traceability.


## 3.1.3. Perfect Forward Secrecy

In the proposed TC-PSLAP, both long- and short-term secrets are incorporated to yield the perfect forward secrecy. Suppose an adversaryA had the knowledge of short-term secrets Rand4,Rand5,Rand6,TIDk, but he/she also requires long-term secrets PIDk,Ak in order to compute the session key. Therefore, the TC-PSLAP supports perfect forward secrecy.


## 3.1.4. Stolen Verifier Attack

In the TC-PSLAP, the parametersTIDk and TIDl,Xl are stored in the database of the CS. Now, if a privileged insider has access to these parameters, he/she cannot employ these parameters in any way to compromise the security of the system. TIDk changes after each session, TIDl is not employed to compute anything, and Xl is also a hash digest. Therefore, the TC-PSLAP can successfully defend against stolen verifier attacks.


## 3.1.5. Stolen Mobile Device and Drone Attack

Assume that a legal userUk has lost his/her mobile device or it is stolen by the adversary. Now, through power analysis, A can extract the parameters AUTHk,Xk+,Ak+,TIDk+,Rand1+ from MDk. None of these parameters reveal any information about the user or the system. Also, all of these parameters are encrypted with the help of XOR. Now, A can also extract the parameters stored in the drone which are IDDRl,TIDl,KEYcs,l. None of these parameters can be used to compute the session key as this also requires short-term and other long-term secrets. Therefore, it can withstand the stolen mobile device and drone attack.


## 3.1.6. Reply Attack

In the TC-PSLAP, timestamp is employed to preventA from launching the reply attack. In the messages MSG1,MSG2,MSG3, timestamp is sent openly and is also hashed with other parameters. Now, if A replaces the old timestamp in any of these messages and retransmits the messages, still he/she would not be able to successfully get authenticated due to the usage of a timestamp in other parameters. Hence, the scheme is secure against reply attacks.


## 3.1.7. Known Session Key Attack

In the TC-PSLAP, the session key is computed by employing the parametersRand4,Rand6,PIDk,Ak. Now, if A has the information of an old session key, he/she cannot obtain any other session-specific key as the parameters employed in producing the session key are novel in each session. So, the TC-PSLAP can bear the known session key attack.


## 3.1.8. User Impersonation Attack

A may try to impersonate as a legal user Uk. To impersonate as Uk, A needs Ak, which is Ak=HPIDkMSKRand2. Now, Ak is also session-specific and is updated after each session. And MSK is the private master key of CS, which is inaccessible to A. Hence, it is not feasible for A to impersonate as a legal user Uk.


## 3.1.9. Drone Impersonation Attack

Uk authenticates DRl by examining the condition AUTHl=HSKlkTIDlTl. Now, to impersonate as DRl, A requires the knowledge of Rand6,Wcs, where Wcs contains Ak which further contains the private master key of CS and is not accessible by A. Hence, the scheme can withstand the drone impersonation attack.


## 3.2. Formal Security Proof Using the BAN Logic

In this section, the TC-PSLAP is tested for robustness under the formal BAN logic.


### 3.2.1. Postulates

Table2 shows the postulates and corresponding purposes. In addition, Table 3 shows notations used in the BAN logic and corresponding descriptions.Table 2
BAN logic: postulates.
RuleDescriptionA|≡A⟷KB,A⊲XK/A≡Y∼KMessage-meaning ruleA|≡#X,A≡B∼X/A|≡B|≡XNonce verification ruleA|≡B,A|≡C/A|≡B,CAcceptance conjunctionA|≡B|≡X,Y/A|≡B|≡XBelief ruleA|≡#X/A|≡#X,YFresh conjuncatenation ruleA|≡B|≡X,A|≡B|⇒X/A|≡XJurisdiction ruleA|≡#X,A|≡B|≡X/A|≡A⟷KBSession keyTable 3
BAN logic: notations.
NotationExplanationA|≡BA believes statement BA⟷KYShare a keyK between A and Y#BB is freshA⊲BA sees BA|∼BA said BB,CKB,C are hashed by key KBKB is hashed with key KBKB is encrypted with key K


### 3.2.2. Establishing the Security Goal

Following are the security goals for the TC-PSLAP under the BAN logic:G1:Uk|≡DRl|≡Uk⟷SKDRl.


### 3.2.3. Messages’ Generic Form

Following is the generalized form of the TC-PSLAP:MSG0:Ui→CS:Xk+⊕Vk′,HAkTIDkRand4‖Tk,Rand4⊕Jk,TIDk,TIDl⊕Jk,Tk,MSG1:CS→DRl:Wcs⊕KEYCS,l,HPIDkMSKRnew⊕Jk′,EHkeyPIDk,Ak¯,Rnew⊕Jk′,HKEYcs,l+Rand5Tcs,Rand5⊕KEYCS,l+,TIDknew⊕Jk′,TIDl,Tcs,MSG2:DRl→Uk:HPIDkMSKRnew⊕Jk′,EHkeyPIDk,Ak¯,Rnew⊕Jk′,Rand6⊕Wcs,HSKlkTIDlTl,TIDk⊕Jk′,Tl.


### 3.2.4. Messages’ Idealized Form

The idealized form of messages in our TC-PSLAP is given in the following.MSG0:Uk→CS:XkVk′,CS↔AkUk,CS↔TIDkUk,TkRand4,Rand4CS↔JkUk,CS↔TIDlDRlCS↔UkUk,CS↔TIDkUk,TkMSG1:CS→DRl:WcsCS↔Keycs,lDRl,CS↔PIDkUk,MSK,RnewCS↔Jk′Uk,CS↔PIDkUk,Ak¯,RnewkeyJk′,KEYcs,l+,TcsRand5,KEYcs,l+Rand5,TIDknewCS↔Jk′Uk,CS↔TIDlDRl,TcsMSG2:DRl→Uk:CS↔PIDkUk,MSK,RnewCS↔Jk′Uk,CS↔PIDkUk,Ak¯,Rnewkey〉CS↔Jk′Uk,WcsRand6,SKlu,Uk↔TIDlDRl,Tl,TIDknewCS↔Jk′Uk,Tl.


### 3.2.5. Assumptions

(1)A1:CS|≡#Rand4,Tk,A2Uk|≡#Rnew,Rand5,Tl,A3:DRl|≡#Rand6,Tcs,A4:Uk|≡DRl|⇒DRl|∼X,A5:Uk|≡DRl|⇒Uk⟷SKluDRl,A6:DRl|≡CS|⇒CS|∼X,A7:Uk|≡Uk⟷TIDlDRl,A8:CS|≡CS⟷TIDlDRl,A9:Uk|≡CS|≡Uk⟷JkCS,A10:Uk|≡CS|≡Uk⟷AkCS,A11:Uk|≡Uk⟷PIDkCS,A12:DRl|≡CS⟷TIDlDRl.The mutual authentication betweenUk and DRl is proved using the following steps:S1: from MSG2, we get Uk⊲CS⟷PIDkUk,MSK,RnewCS⟷Jk′Uk,CS⟷PIDkUk,Ak¯,Rnewkey〉CS⟷Jk′Uk,WcsRand6,SKlu,Uk⟷TIDlDRl,Tl,TIDknewCS⟷Jk′Uk,TlS2: based on S1, assumptions A1,A2,A3, and message-meaning rule, we get Uk⊲MSK,Rnew,Ak¯,Rnewkey,WcsRand6,SKlu,Tl,TIDknew,TlS3: based on S2 and the message belief rule, we get Uk|≡Uk⊲MSK,Rnew,Ak¯,Rnew,WcsRand6,SKlu,Tl,TIDknew,TlS4: based on S3, nonce verification, and freshness rule, we get Uk|≡DRl|≡MSK,Rnew,Ak¯,Rnew,WcsRand6,SKlu,TIDknewS5: based on S4, assumption A4, and jurisdiction rule, we get Uk|≡MSK,Rnew,Ak¯,Rnew,WcsRand6,SKlu,TIDknewS6: based on S4,S5, assumption A4,A5,A9, and belief rule, we get Uk|≡DRl|≡Uk⟷SKluDRl


## 3.2.1. Postulates

Table2 shows the postulates and corresponding purposes. In addition, Table 3 shows notations used in the BAN logic and corresponding descriptions.Table 2
BAN logic: postulates.
RuleDescriptionA|≡A⟷KB,A⊲XK/A≡Y∼KMessage-meaning ruleA|≡#X,A≡B∼X/A|≡B|≡XNonce verification ruleA|≡B,A|≡C/A|≡B,CAcceptance conjunctionA|≡B|≡X,Y/A|≡B|≡XBelief ruleA|≡#X/A|≡#X,YFresh conjuncatenation ruleA|≡B|≡X,A|≡B|⇒X/A|≡XJurisdiction ruleA|≡#X,A|≡B|≡X/A|≡A⟷KBSession keyTable 3
BAN logic: notations.
NotationExplanationA|≡BA believes statement BA⟷KYShare a keyK between A and Y#BB is freshA⊲BA sees BA|∼BA said BB,CKB,C are hashed by key KBKB is hashed with key KBKB is encrypted with key K


## 3.2.2. Establishing the Security Goal

Following are the security goals for the TC-PSLAP under the BAN logic:G1:Uk|≡DRl|≡Uk⟷SKDRl.


## 3.2.3. Messages’ Generic Form

Following is the generalized form of the TC-PSLAP:MSG0:Ui→CS:Xk+⊕Vk′,HAkTIDkRand4‖Tk,Rand4⊕Jk,TIDk,TIDl⊕Jk,Tk,MSG1:CS→DRl:Wcs⊕KEYCS,l,HPIDkMSKRnew⊕Jk′,EHkeyPIDk,Ak¯,Rnew⊕Jk′,HKEYcs,l+Rand5Tcs,Rand5⊕KEYCS,l+,TIDknew⊕Jk′,TIDl,Tcs,MSG2:DRl→Uk:HPIDkMSKRnew⊕Jk′,EHkeyPIDk,Ak¯,Rnew⊕Jk′,Rand6⊕Wcs,HSKlkTIDlTl,TIDk⊕Jk′,Tl.


## 3.2.4. Messages’ Idealized Form

The idealized form of messages in our TC-PSLAP is given in the following.MSG0:Uk→CS:XkVk′,CS↔AkUk,CS↔TIDkUk,TkRand4,Rand4CS↔JkUk,CS↔TIDlDRlCS↔UkUk,CS↔TIDkUk,TkMSG1:CS→DRl:WcsCS↔Keycs,lDRl,CS↔PIDkUk,MSK,RnewCS↔Jk′Uk,CS↔PIDkUk,Ak¯,RnewkeyJk′,KEYcs,l+,TcsRand5,KEYcs,l+Rand5,TIDknewCS↔Jk′Uk,CS↔TIDlDRl,TcsMSG2:DRl→Uk:CS↔PIDkUk,MSK,RnewCS↔Jk′Uk,CS↔PIDkUk,Ak¯,Rnewkey〉CS↔Jk′Uk,WcsRand6,SKlu,Uk↔TIDlDRl,Tl,TIDknewCS↔Jk′Uk,Tl.


## 3.2.5. Assumptions

(1)A1:CS|≡#Rand4,Tk,A2Uk|≡#Rnew,Rand5,Tl,A3:DRl|≡#Rand6,Tcs,A4:Uk|≡DRl|⇒DRl|∼X,A5:Uk|≡DRl|⇒Uk⟷SKluDRl,A6:DRl|≡CS|⇒CS|∼X,A7:Uk|≡Uk⟷TIDlDRl,A8:CS|≡CS⟷TIDlDRl,A9:Uk|≡CS|≡Uk⟷JkCS,A10:Uk|≡CS|≡Uk⟷AkCS,A11:Uk|≡Uk⟷PIDkCS,A12:DRl|≡CS⟷TIDlDRl.The mutual authentication betweenUk and DRl is proved using the following steps:S1: from MSG2, we get Uk⊲CS⟷PIDkUk,MSK,RnewCS⟷Jk′Uk,CS⟷PIDkUk,Ak¯,Rnewkey〉CS⟷Jk′Uk,WcsRand6,SKlu,Uk⟷TIDlDRl,Tl,TIDknewCS⟷Jk′Uk,TlS2: based on S1, assumptions A1,A2,A3, and message-meaning rule, we get Uk⊲MSK,Rnew,Ak¯,Rnewkey,WcsRand6,SKlu,Tl,TIDknew,TlS3: based on S2 and the message belief rule, we get Uk|≡Uk⊲MSK,Rnew,Ak¯,Rnew,WcsRand6,SKlu,Tl,TIDknew,TlS4: based on S3, nonce verification, and freshness rule, we get Uk|≡DRl|≡MSK,Rnew,Ak¯,Rnew,WcsRand6,SKlu,TIDknewS5: based on S4, assumption A4, and jurisdiction rule, we get Uk|≡MSK,Rnew,Ak¯,Rnew,WcsRand6,SKlu,TIDknewS6: based on S4,S5, assumption A4,A5,A9, and belief rule, we get Uk|≡DRl|≡Uk⟷SKluDRl


## 4. The Comparisons

This section explains the comparisons of the introduced TC-PSLAP with existing protocols introduced in [15, 16, 20, 24].


### 4.1. Functionality Comparison

Functionality comparison amongst introduced and related protocols is depicted in Table4. It is evident from Table 4 that the introduced protocol renders superior security in contrast to [20] and also renders more enhanced security features as contrasted to other related protocols. √ tells if a particular feature exists or protocol can resist an attack, × tells if a protocol lacks a particular feature or cannot resist an attack, whereas − means that a particular feature/security requirement is not applicable.Table 4
Comparison of functionality features.
Requirements[15][16][20][25][24]OursPerfect forward secrecy××√√√√Anonymity√√√××√Stolen verifier attack×√×√√√Replay attack√√×√−√User impersonation attack√√××√√Drone impersonation attack√√×××√Man-in-the-middle attack√√××√√Insider attack××××√√Session key agreement×√√√√√Formal verification√√√×√√Mutual authentication×√××√√Control server impersonation attack√√×√√√Stolen mobile device/smart card attack×√×−√√Untraceability√√×−√√Drone/device capture attack√√√√√√DoS attack√√×√√√Forgery attack√√×√√√Secret leakage√√××√√


### 4.2. Computation Analysis

For comparing computation costs of different protocols, the results, as computed in [26], are adopted. The notations pertaining to several cryptographic operations and their running times are briefed in Table 5.Table 5
Experimental computation results.
↓ Entity/operation ⟶ThTecmTecaTsedTbpUser0.0095.1160.0130.01717.36Drone0.0064.1070.0180.01312.52Control station0.0040.9260.0060.0084.038Time is computed in milliseconds; TTC: time to compute;Th: TTC hash operation; Tecm: TTC point multiplication on ECC; Teca: TTC point addition on ECC; Tsed: TTC block cipher operation; Tbp: TTC pairing operation; Tfe≈Tecm: TTC fuzzy extractor.As depicted in Table6 and Figure 5, the computation cost of the introduced TC-PSLAP is less than all the competing schemes [15, 16, 20, 24], and it completes the authentication process in approximately 0.149 ms, whereas the scheme of Zhang et al. [15] completes the same in approximately 0.160 ms. The schemes of Kirsal Ever [16], Nikooghadam et al. [20], and Malani et al. [24] complete the same in 0.160, 19.479, and 64.774 ms, respectively. Hence, our introduced protocol is more lightweight and provides better security as compared to the rest of the protocols, as shown in Table 4.Table 6
Performance comparison.
ProtocolUserCSDroneRTC1C2Zhang et al. [15]10Th7Th7Th0.16031472Kirsal Ever [16]5Th+2Tbp9Th+2Tbp+4Tecm3Th+2Tbp71.63931952Nikooghadam et al. [20]9Th+2Tecm2Th+1Tecm3Th+2Tecm19.47932336Malani et al. [24]8Th+7Tecm+3Teca−8Th+7Tecm+3Teca64.77422783Ours9Th10Th+2Tsed3Th0.14932783RT: running time in ms;C1: number of exchange messages; C2: bits exchanged.Figure 5
Computation cost comparison.


### 4.3. Communication Analysis

The communication expense estimate is represented in Table6. For comparison, identities are considered as 160 bits of length, the size of a timestamp is taken as 32 bits, a hash output of SHA-1 is 160 bits, the size of a random number is assumed 160 bits long, and the block size of symmetric enc/decryption is 128 bits, respectively. The communication cost of various protocols is also shown in Figure 6. The introduced TC-PSLAP exchanges 2783 bits for the completion of the login and authentication phase. Table 6 and Figure 6 explain that the communication cost of the introduced TC-PSLAP is a bit higher than that of the compared protocols [15, 16, 20, 24], but the introduced TC-PSLAP offers better security than remaining protocols.Figure 6
Communication cost comparison.


## 4.1. Functionality Comparison

Functionality comparison amongst introduced and related protocols is depicted in Table4. It is evident from Table 4 that the introduced protocol renders superior security in contrast to [20] and also renders more enhanced security features as contrasted to other related protocols. √ tells if a particular feature exists or protocol can resist an attack, × tells if a protocol lacks a particular feature or cannot resist an attack, whereas − means that a particular feature/security requirement is not applicable.Table 4
Comparison of functionality features.
Requirements[15][16][20][25][24]OursPerfect forward secrecy××√√√√Anonymity√√√××√Stolen verifier attack×√×√√√Replay attack√√×√−√User impersonation attack√√××√√Drone impersonation attack√√×××√Man-in-the-middle attack√√××√√Insider attack××××√√Session key agreement×√√√√√Formal verification√√√×√√Mutual authentication×√××√√Control server impersonation attack√√×√√√Stolen mobile device/smart card attack×√×−√√Untraceability√√×−√√Drone/device capture attack√√√√√√DoS attack√√×√√√Forgery attack√√×√√√Secret leakage√√××√√


## 4.2. Computation Analysis

For comparing computation costs of different protocols, the results, as computed in [26], are adopted. The notations pertaining to several cryptographic operations and their running times are briefed in Table 5.Table 5
Experimental computation results.
↓ Entity/operation ⟶ThTecmTecaTsedTbpUser0.0095.1160.0130.01717.36Drone0.0064.1070.0180.01312.52Control station0.0040.9260.0060.0084.038Time is computed in milliseconds; TTC: time to compute;Th: TTC hash operation; Tecm: TTC point multiplication on ECC; Teca: TTC point addition on ECC; Tsed: TTC block cipher operation; Tbp: TTC pairing operation; Tfe≈Tecm: TTC fuzzy extractor.As depicted in Table6 and Figure 5, the computation cost of the introduced TC-PSLAP is less than all the competing schemes [15, 16, 20, 24], and it completes the authentication process in approximately 0.149 ms, whereas the scheme of Zhang et al. [15] completes the same in approximately 0.160 ms. The schemes of Kirsal Ever [16], Nikooghadam et al. [20], and Malani et al. [24] complete the same in 0.160, 19.479, and 64.774 ms, respectively. Hence, our introduced protocol is more lightweight and provides better security as compared to the rest of the protocols, as shown in Table 4.Table 6
Performance comparison.
ProtocolUserCSDroneRTC1C2Zhang et al. [15]10Th7Th7Th0.16031472Kirsal Ever [16]5Th+2Tbp9Th+2Tbp+4Tecm3Th+2Tbp71.63931952Nikooghadam et al. [20]9Th+2Tecm2Th+1Tecm3Th+2Tecm19.47932336Malani et al. [24]8Th+7Tecm+3Teca−8Th+7Tecm+3Teca64.77422783Ours9Th10Th+2Tsed3Th0.14932783RT: running time in ms;C1: number of exchange messages; C2: bits exchanged.Figure 5
Computation cost comparison.


## 4.3. Communication Analysis

The communication expense estimate is represented in Table6. For comparison, identities are considered as 160 bits of length, the size of a timestamp is taken as 32 bits, a hash output of SHA-1 is 160 bits, the size of a random number is assumed 160 bits long, and the block size of symmetric enc/decryption is 128 bits, respectively. The communication cost of various protocols is also shown in Figure 6. The introduced TC-PSLAP exchanges 2783 bits for the completion of the login and authentication phase. Table 6 and Figure 6 explain that the communication cost of the introduced TC-PSLAP is a bit higher than that of the compared protocols [15, 16, 20, 24], but the introduced TC-PSLAP offers better security than remaining protocols.Figure 6
Communication cost comparison.


## 5. Conclusion

The IoT-enabled drones can be utilized efficiently for surveillance and related tasks in urban areas. However, the privacy and security issues related to drone operations are expanding as their adaption surges. In this article, we initiated a lightweight authentication protocol TC-PSLAP for secure drone communication. The introduced TC-PSLAP, while preserving the lightweight property of symmetric cryptography, defies the related known attacks, which is confirmed through security analysis and comparisons of the security and performance of our TC-PSLAP with related schemes.



---

*Source: 9919460-2021-12-18.xml*