© Wuhan University 2023

0 Introduction

The ability to bring physical things into the digital world is becoming increasingly possible because of the high level of development of wireless communication and smart device technologies^[1]. A very significant opportunity for wireless sensor networks (WSNs) has been offered by the rise of Internet of Things (IoT) era and the development of communication technology. As a combination of wireless networks and IoT sensors, WSNs have attracted more and more attention worldwide because of the excellent performance in industrial control, smart home, environmental monitoring and other aspects^[2].

However, owing to the openness of the network and the broadcast nature of wireless communication, WSNs are facing a variety of threats that ordinary wireless networks may suffer from, such as replay attacks, information leakage, denial-of-service (DOS) attacks, in addition to the vulnerability of sensor nodes to physical access and disassembly until these sensor nodes are fully controlled by attackers. Sensor devices in WSNs are disposed in public environments to collect information in real time^[3]. If one of the sensor nodes is compromised, its linkability will become a focal point. An attacker can use the compromised device as a springboard to attack other devices and systems. Coupled with the sensitive and critical nature of the transmitted data, the data must be protected by end-to-end services as it is transmitted between WSNs and entities outside of WSNs^[4]. Therefore, it is crucial to provide an authentication scheme for WSNs that can guarantee secure communication between users and sensor nodes. In WSNs, the communication between devices requires the use of various protocols that will define the purpose of the communication, the sequence of steps to be performed during the communication, and the encryption techniques used to protect the transmitted information^[5].

In recent years, researchers have been developing efficient ways to merge WSNs into IoT environments and have done a lot of research on authentication schemes that balance efficiency and security in WSNs, but numerous schemes have security concerns^[6]. In 2019, Ostad-Sharif et al^[6] proposed a secure and lightweight authenticated key agreement scheme for WSNs, and they claimed that their scheme not only was efficient but also provided perfect forward secrecy and was resistant to common attacks. In 2020, Chen et al^[7] pointed out that Ostad-Sharif et al's scheme^[6] not only had design errors in the login and authentication phase, which resulted in legitimately registered users not being able to access the system, but also did not provide password change and update capabilities. In 2021, Chunka et al^[8] presented a smart card-based user authentication and session key agreement scheme. They claimed that their scheme not only was efficient but also was resistant to attacks such as sensor node capture attacks, gateway key leakage and so on. However, Lee et al^[9] confirmed that Chunka et al's scheme^[8] was vulnerable to known session-specific temporary information attacks, identity/password pair guessing attacks, impersonation attacks, etc. In 2022, Hu et al^[10] proposed a two-factor authentication scheme for WSNs in IoT environment, and they claimed that their scheme could maximized the balance of security and computational cost as well as efficiency, and was able to resist many common attacks. However, we found that there were security risks in Hu et al's scheme. Firstly, this scheme could not resist stolen smart card attacks and DOS attacks. Secondly, during the login and key agreement phase of Hu et al's scheme, gateway (GWN) could not extract key values for subsequent computation based on the messages sent by the sensor nodes, resulting in the scheme's failure to achieve mutual authentication and key agreement.

Hu et al's authentication scheme is briefly reviewed in Section 1. In Section 2, we analyze the shortcomings of the Hu et al's scheme. An improved scheme is given in Section 3. In Section 4, we analyze the security for the improved scheme. The performance evaluation for the proposed scheme in different metrics and the comparison with the same type of schemes are presented in Section 5. In Section 6, we conclude the paper.

1 Review of Hu et al's Scheme

In Hu et al's scheme^[10], users and sensor nodes complete mutual authentication and agree on session keys with the help of GWN. The scheme consists of four phases: initialization phase, registration phase, login and key agreement phase, and password and expiration time update phase. The notations involved in the scheme and their definitions are shown in Table 1.

1.1 Intialization Phase

GWN chooses two random numbers $K_{\mathrm{G}\mathrm{U}},$$K_{\mathrm{G}\mathrm{S}}$$\in {Z_q}^{\mathrm{*}}$ as the private key of GWN. P is the generator in the elliptic curve. The public key of GWN is P_pub and the calculation formula is $P_{\mathrm{p}\mathrm{u}\mathrm{b}}=K_{\mathrm{G}\mathrm{U}}\cdot P$.

1.2 Registration Phase

The current phase consists of a user registration phase and a sensor node registration phase. In this phase, the data is transmitted over a secure channel.

1.2.1 Registration for users

When a new user wants to access the services provided by WSNs, he/she must register with the gateway at first. The details of the user registration phase are as follows.

Step 1  U_i chooses ID_i and PW_i, generates a random number r_i, and calculates

$A_i=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i||r_i)$

Then, U_i sends a message $\{\mathrm{I}{\mathrm{D}}_i,A_i\}$ to the GWN over a secure channel.

Step 2   Once GWN receives a message from U_i, it selects an expiration time TE_i for the temporary credentials of U_i.

GWN calculates the public key $P_{\mathrm{p}\mathrm{u}\mathrm{b}}=K_{\mathrm{G}\mathrm{U}}\cdot P$ and U_i's temporal credential $\mathrm{T}{\mathrm{C}}_i=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||K_{\mathrm{G}\mathrm{U}}||\mathrm{T}{\mathrm{E}}_i)$.

GWN will store $\{\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}},\mathrm{T}{\mathrm{E}}_i,P_{\mathrm{p}\mathrm{u}\mathrm{b}},h(\cdot ),\mathrm{P}\mathrm{T}{\mathrm{C}}_i\}$ in a smart card SC and send SC to U_iover a secure channel.

Step 3  U_i computes $\mathrm{T}{\mathrm{C}}_i=\mathrm{P}\mathrm{T}{\mathrm{C}}_i\oplus A_i$, $B_i=\mathrm{T}{\mathrm{C}}_i\oplus h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i)$, and stores $\{B_i\}$ in SC.

1.2.2 Registration for sensor nodes

Each sensor node must register with GWN and only once, and its registration phase consists of the following operations.

Step 1   GWN selects an identity SID_j for the sensor node S_jand calculates

$\mathrm{T}{\mathrm{C}}_j=h(K_{\mathrm{G}\mathrm{S}}||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)$

GWN sends a message $\{\mathrm{T}{\mathrm{C}}_j,\mathrm{S}\mathrm{I}{\mathrm{D}}_j\}$to S_j over a secure channel.

Step 2  S_j receives the message from GWN and stores$\{\mathrm{T}{\mathrm{C}}_j,\mathrm{S}\mathrm{I}{\mathrm{D}}_j\}$.

1.3 Login and Key Agreement Phase

In this phase, U_i and S_jagree on a session key with the help of GWN, thus performing a mutually authenticated key agreement to ensure further secure communication between them. The specific steps are as follows.

Step 1  U_i inserts SC and enters his/her identity ID_i and password PW_i. SC then generates two random numbers N₁ and x₁ based on the stored information and the extracted

$\mathrm{T}{\mathrm{C}}_i=B_i\oplus h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i)$

entered by U_i, and calculates

$T_{\mathrm{1}}=x_{\mathrm{1}}\cdot P$

$T_{\mathrm{2}}=(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||N_{\mathrm{1}})\oplus h(x_{\mathrm{1}}\cdot P_{\mathrm{p}\mathrm{u}\mathrm{b}})$

where $P_{\mathrm{p}\mathrm{u}\mathrm{b}}=K_{\mathrm{G}\mathrm{U}}\cdot P$ is the public key of GWN,

$T_{\mathrm{3}}=h(T_{\mathrm{1}}||\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i||N_{\mathrm{1}}||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)$

U_isends a login request message $M_{\mathrm{1}}=\{T_{\mathrm{1}},T_{\mathrm{2}},T_{\mathrm{3}}\}$ to GWN.

Step 2   After receiving the message $M_{\mathrm{1}}=\{T_{\mathrm{1}},T_{\mathrm{2}},T_{\mathrm{3}}\}$ from U_i, GWN calculates

$\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||N_{\mathrm{1}}=T_{\mathrm{2}}\oplus h(K_{\mathrm{G}\mathrm{U}}\cdot T_{\mathrm{1}})$

and checks the validity of TE_i. If it fails, GWN will reject U_i's login request. Otherwise, GWN calculates

$\mathrm{T}{\mathrm{C}}_i=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||K_{\mathrm{G}\mathrm{U}}||\mathrm{T}{\mathrm{E}}_i)$

$T_{\mathrm{3}}\mathrm{*}=h(T_{\mathrm{1}}||\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i||N_{\mathrm{1}}||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)$

GWN checks whether $T_{\mathrm{3}}\mathrm{*}=T_{\mathrm{3}}$ is correct or not. If not, GWN terminates the current phase. Otherwise, GWN generates three random numbers N₂, x as well as x₂ and computes

$\mathrm{T}{\mathrm{C}}_j=h(K_{\mathrm{G}\mathrm{S}}||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)$

$T_{\mathrm{4}}=x_{\mathrm{2}}\oplus h(\mathrm{T}{\mathrm{C}}_j||N_{\mathrm{2}}||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}})$

$T_{\mathrm{5}}=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||x)\oplus h(N_{\mathrm{2}}||\mathrm{T}{\mathrm{C}}_j)$

$T_{\mathrm{6}}=h(T_{\mathrm{1}}||h(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||x)||x_{\mathrm{2}}||N_{\mathrm{2}})$

Then, GWN sends a message $M_{\mathrm{2}}=\{T_{\mathrm{1}},T_{\mathrm{4}},T_{\mathrm{5}},T_{\mathrm{6}},N_{\mathrm{2}}\}$ to S_j over a secure channel.

Step 3   After receiving the message from GWN, S_j recovers

$x_{\mathrm{2}}=T_{\mathrm{4}}\oplus h(\mathrm{T}{\mathrm{C}}_j||N_{\mathrm{2}}||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}})$

$h(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||x)=T_{\mathrm{5}}\oplus h(N_{\mathrm{2}}||\mathrm{T}{\mathrm{C}}_j)$

and calculates

$T_{\mathrm{6}}\mathrm{*}=h(T_{\mathrm{1}}||h(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||x)||x_{\mathrm{2}}||N_{\mathrm{2}})$

S_j checks whether $T_{\mathrm{6}}\mathrm{*}=T_{\mathrm{6}}$ holds or not. if it does, S_j generates two random numbers N₃, x₃, and computes

$\mathrm{S}\mathrm{K}=h(h(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||x)||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||x_{\mathrm{3}}\cdot T_{\mathrm{1}}||T_{\mathrm{1}}||T_{\mathrm{7}}),$

$T_{\mathrm{8}}=h(\mathrm{S}\mathrm{K}||N_{\mathrm{3}})$

$T_{\mathrm{9}}=(T_{\mathrm{8}}||T_{\mathrm{7}}||N_{\mathrm{3}})\oplus h(\mathrm{T}{\mathrm{C}}_j||N_{\mathrm{2}})$

$T_{\mathrm{10}}=h(\mathrm{T}{\mathrm{C}}_j||T_{\mathrm{7}}||N_{\mathrm{2}}||T_{\mathrm{8}})$

S_j transmits a message$M_{\mathrm{3}}=\{T_{\mathrm{9}},T_{\mathrm{10}}\}$to GWN.

Step 4   After receiving the message from S_j, GWN extracts

$T_{\mathrm{8}}||T_{\mathrm{7}}||N_{\mathrm{3}}=T_{\mathrm{9}}\oplus h(\mathrm{T}\mathrm{C}||N_{\mathrm{2}})$

and calculates $T_{\mathrm{10}}\mathrm{*}=h(\mathrm{T}{\mathrm{C}}_j||T_{\mathrm{7}}||N_{\mathrm{2}}||T_{\mathrm{8}})$.

Then, GWN verifies whether $T_{\mathrm{10}}\mathrm{*}=T_{\mathrm{10}}$ or not. If not, GWN will terminate the current phase immediately. Otherwise, GWN calculates

$T_{\mathrm{11}}=(T_{\mathrm{8}}||N_{\mathrm{1}}||T_{\mathrm{7}}||N_{\mathrm{3}}||x)\oplus h(N_{\mathrm{1}}||\mathrm{T}{\mathrm{C}}_i)$

GWN sends the message $M_{\mathrm{4}}=\{T_{\mathrm{11}}\}$ to U_i.

Step 5   Once U_i receives M₄, it extracts

$T_{\mathrm{8}}||N_{\mathrm{1}}||T_{\mathrm{7}}||N_{\mathrm{3}}||x=T_{\mathrm{11}}\oplus h(N_{\mathrm{1}}||\mathrm{T}{\mathrm{C}}_i)$

and calculates the session key

$\mathrm{S}\mathrm{K}=h( h (\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||x)||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||x_{\mathrm{3}}\cdot T_{\mathrm{1}}||T_{\mathrm{1}}||T_{\mathrm{7}}),T_{\mathrm{8}}\mathrm{*}=h(\mathrm{S}\mathrm{K}||N_{\mathrm{3}}).$

U_ichecks whether $T_{\mathrm{8}}\mathrm{*}=T_{\mathrm{8}}$ holds or not. If it does, it means that U_i and S_j have successfully reached the session key.

1.4 Password and Expiration Time Update Phase

If U_i wants to update or change his/her password, he/she inserts a smart card SC and enters ID_i, PW_i. After that, SC will calculate

${B_i}^{\mathrm{n}\mathrm{e}\mathrm{w}}=B_i\oplus h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i)\oplus h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{{\mathrm{W}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}})$

and then replaces B_i with B_i^new.

If GWN wants to update the expiration time TE_i for TC_i, GWN can reselect a TE_i' and recalculate

$\mathrm{T}{\mathrm{C}}_i\text{'}=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||K_{\mathrm{G}\mathrm{U}}||\mathrm{T}{\mathrm{E}}_i\text{'})$

$T_{\mathrm{11}}\text{'}=(T_{\mathrm{8}}||N_{\mathrm{1}}||T_{\mathrm{7}}||N_{\mathrm{3}}||\mathrm{T}{\mathrm{C}}_i\text{'}||\mathrm{T}{\mathrm{E}}_i\text{'})\oplus h(N_{\mathrm{1}}||\mathrm{T}{\mathrm{C}}_i)$

in Step 4 of the login and key agreement phase. After that, U_i can extract TE_i' and TC_i' from T₁₁, update B_i and TE_i in his/her own smart card.

2 Security Analysis of Hu et al's Scheme

This section analyzes the security of Hu et al's scheme^[10], and demonstrates that Hu et al's scheme^[9] has the following risks.

2.1 Vulnerability to Stolen Smart Card Attack and DOS Attack

If an attacker steals a smart card SC of one user U_i, and then attempts to log in by inserting the SC and entering his/her own identity ID_k and password PW_k, since SC does not verify whether the current user has registered legally, based on the information $\{\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}},\mathrm{T}{\mathrm{E}}_i,P_{\mathrm{p}\mathrm{u}\mathrm{b}},h(\cdot ),B_i\}$ stored in SC, the attacker can directly perform a series of calculations by using equation (1) and then send $M_{\mathrm{1}}=\{T_{\mathrm{1}}\text{'},T_{\mathrm{2}}\text{'},T_{\mathrm{3}}\text{'}\}$ to GWN. Although the attacker can neither pass the authentication

$T_{\mathrm{3}}\mathrm{*}=h(T_{\mathrm{1}}||\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i||N_{\mathrm{1}}||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)$

of GWN nor participate in the subsequent operations, GWN has already carried out a series of calculations through equation (2), consuming a large amount of computational resources. If mass forged login requests are sent, GWN's resources will be exhausted, and GWN cannot process normal requests from legitimate users timely. In other words, legitimate users will not be able to get responses from the service.

Generate $N_{\mathrm{1}}\text{'},x_{\mathrm{1}}\text{'}$

$\{\begin{array}{l}\mathrm{T}{\mathrm{C}}_i\text{'}=B_i\oplus h(\mathrm{I}{\mathrm{D}}_k||\mathrm{P}{\mathrm{W}}_k)\\ T_{\mathrm{1}}\text{'}=x_{\mathrm{1}}\text{'}\cdot P\\ T_{\mathrm{2}}\text{'}=(\mathrm{I}{\mathrm{D}}_k||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||N_{\mathrm{1}}\text{'})\oplus h(x_{\mathrm{1}}\text{'}\cdot P_{\mathrm{p}\mathrm{u}\mathrm{b}})\\ T_{\mathrm{3}}\text{'}=h(T_{\mathrm{1}}\text{'}||\mathrm{I}{\mathrm{D}}_k||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i\text{'}||N_{\mathrm{1}}\text{'}||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)\end{array}$(1)

$\{\begin{array}{l}\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||N_{\mathrm{1}}=T_{\mathrm{2}}\oplus h(K_{\mathrm{G}\mathrm{U}}{T}_{\mathrm{1}}) \\ \mathrm{T}{\mathrm{C}}_i=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||K_{\mathrm{G}\mathrm{U}}||\mathrm{T}{\mathrm{E}}_i)\\ T_{\mathrm{3}}\mathrm{*}=h(T_{\mathrm{1}}||\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i||N_{\mathrm{1}}||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)\end{array}$(2)

2.2 GWN Cannot Extract Key Values

Hu et al^[10] claimed that their scheme satisfied user anonymity, meaning that the user's identity ID_i was only included in T₂, T₃, T₄, T₅ and not transmitted over a public channel. However, GWN not only served multiple sensor nodes and users simultaneously, but also received a huge amount of messages.

Since the identity of the sensor node and the identity of the specific user were missing in the message $M_{\mathrm{3}}=\{T_{\mathrm{9}},T_{\mathrm{10}}\}$ sent by the sensor node to GWN, GWN was unable to recognize which sensor node was trying to contact which user after receiving M₃. Therefore, GWN could not determine which temporary credential was used to calculate equation (3). Then, the following operations cannot work.

$\{\begin{array}{l}{T}_{\mathrm{8}}||T_{\mathrm{7}}||N_{\mathrm{3}}=T_{\mathrm{9}}\oplus h(\mathrm{T}{\mathrm{C}}_j||N_{\mathrm{2}})\\ T_{\mathrm{10}}\mathrm{*}=h(\mathrm{T}{\mathrm{C}}_j||T_{\mathrm{7}}||N_{\mathrm{2}}||T_{\mathrm{8}})\end{array}$(3)

2.3 Failure Mutual Authentication and Key Agreement

As described in Section 2.2, GWN cannot obtain SID_j and ID_i from the message $M_{\mathrm{3}}=\{T_{\mathrm{9}},T_{\mathrm{10}}\}$ sent by S_j during login and key agreement phase, so GWN is unable to compute equation (3), much less conduct further authentication by verifying whether $T_{\mathrm{10}}\mathrm{*}= T_{\mathrm{10}}$ or not. It means that Hu et al's scheme^[10] cannot continue to work. Therefore, the scheme fails to achieve mutual authentication and key agreement.

3 The Proposed Scheme

To overcome the shortcomings in Hu et al's scheme^[10], this paper presents an improved scheme. Firstly, proposed scheme adds a user's pseudo-identity PID_i in the registration phase of users for the transmission of identity information in a public channel. The pseudo-identity is dynamic and updated promptly after each communication. Secondly, the proposed scheme incorporates a key authentication in the login phase of user, where the smart card verifies whether the current user is the legitimate registered one. Finally, the proposed scheme adds some necessary identity information in the transmitted messages. This measure ensures that GWN, upon receiving a message from a sensor node, can clearly know which sensor node wants to communicate with which user.

The proposed scheme satisfies mutual authentication and effectively enhances the anonymity of users. In addition, the proposed scheme not only resists the stolen smart card attacks and DOS attacks mentioned above, but also solves the problem that GWN cannot extract key values. For the sake of brevity, this section only describes the initialization phase, the registration phase, and the login and key agreement phase. The specific steps are as follows.

3.1 Initialization Phase

GWN selects an additive group G of order q and a generator P of G on an elliptic curve E. GWN chooses two private keys $K_{\mathrm{G}\mathrm{U}}\in {Z_q}^{\mathrm{*}}$ and $K_{\mathrm{G}\mathrm{S}}\in {Z_q}^{\mathrm{*}}$, and computes its public key $P_{\mathrm{p}\mathrm{u}\mathrm{b}}=K_{\mathrm{G}\mathrm{U}}\cdot P$.

3.2 Registration Phase

Any user and sensor can register with GWN. Unregistered entities are not able to communicate subsequently. The above approach can effectively guarantee the security of data transmission, thereby ensuring the network security of the whole system. This phase is divided into a user registration phase and a sensor node registration phase.

3.2.1 Registration of users

When a new user wants to access an IoT service and communicate with one of the sensor nodes, he/she must first register with GWN and obtain his/her SC through a secure channel. GWN stores the user's registration information in order to verify his/her identity during the login phase. In Fig.1, this phase is divided into three steps and the process is as follows.

Step 1   User U_i selects his/her unique identity ID_i and password PW_i, generates a random number $r_i\in {Z_q}^{\mathrm{*}}$, and calculates A_i and pseudo-identity PID_i according to equation (4). Then, U_i sends a registration message $\{\mathrm{I}{\mathrm{D}}_i,A_i,\mathrm{P}\mathrm{I}{\mathrm{D}}_i\}$ to the GWN over a secure channel.

$\{\begin{array}{l}{A}_i=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i||r_i)\\ \mathrm{P}\mathrm{I}{\mathrm{D}}_i=h(\mathrm{I}{\mathrm{D}}_i||r_i)\end{array}$(4)

Step 2   GWN receives the registration message from U_i and chooses an expiration time TE_i for U_i. GWN calculates its own public key P_pub, the user's temporary credentials TC_i and PTC_i by equation (5). GWN stores $\{ \mathrm{I}{\mathrm{D}}_i,\mathrm{T}{\mathrm{E}}_i,\mathrm{P}\mathrm{I}{\mathrm{D}}_i \}$ into its own database and embeds $\{ \mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}, \mathrm{T}{\mathrm{E}}_i, P_{\mathrm{p}\mathrm{u}\mathrm{b}}, h (\cdot ),$$\mathrm{P}\mathrm{T}{\mathrm{C}}_i\}$ into a smart card SC. GWN then issues SC to U_i over a secure channel.

$\{\begin{array}{l}{P}_{pub}=K_{GU}\cdot P\\ \mathrm{T}{\mathrm{C}}_i=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{GWN}||K_{GU}||\mathrm{T}{\mathrm{E}}_i)\\ \mathrm{P}\mathrm{T}{\mathrm{C}}_i=\mathrm{T}{\mathrm{C}}_i\oplus A_i\end{array}$(5)

Step 3   Once the SC is received, U_i performs equation (6) for the calculation in order to create the values required for the authentication in the next stage. After that, U_i stores $\{A_i,B_i,C_i\}$ in SC and removes PTC_i. As of now, the values stored in SC are $\{\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}},\mathrm{T}{\mathrm{E}}_i,P_{\mathrm{p}\mathrm{u}\mathrm{b}},h(\cdot ),A_i,B_i,C_i\}$.

$\{\begin{array}{l}\mathrm{T}{\mathrm{C}}_i=\mathrm{P}\mathrm{T}{\mathrm{C}}_i\oplus A_i\\ B_i=\mathrm{T}{\mathrm{C}}_i\oplus h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i||\mathrm{T}{\mathrm{E}}_i)\\ C_i=r_i\oplus h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i)\end{array}$(6)

3.2.2 Registration of sensor nodes

Any sensor node that interacts with GWN for the first time must register first. The registration process of sensor nodes is shown in Fig. 2, with the following steps.

Step 1   For a newly installed sensor node S_j, GWN first selects an identity SID_j for it and calculates the temporary credential TC_j by $\mathrm{T}{\mathrm{C}}_j=h(K_{\mathrm{G}\mathrm{S}}||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)$.

Step 2  S_j receives a message $\{\mathrm{S}\mathrm{I}{\mathrm{D}}_j,\mathrm{T}{\mathrm{C}}_j\}$ sent from GWN over a secure channel and stores $\{\mathrm{S}\mathrm{I}{\mathrm{D}}_j,\mathrm{T}{\mathrm{C}}_j\}$ in memory.

3.3 Login and Key Agreement Phase

In this stage, the legally registered user U_i can share a session key with registered sensor node S_j that wants to register via GWN^[11]. As shown in Fig.3, U_i authenticates with S_j mutually and establishes a session key for secure communication with the help of GWN. The detailed steps are described below.

Step 1  U_i inserts the smart card SC and enters his/her identity ID_i and password PW_i. After that, SC uses equation (7) for the calculation.

$\{\begin{array}{l}{r}_i\mathrm{*}=C_i\oplus h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i)\\ A_i\mathrm{*}=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i||r_i\mathrm{*})\end{array}$(7)

SC checks $A_i\mathrm{*}=A_i$ holds or not. If this check fails, SC will reject the user's login request. Otherwise, it means that this user is the legitimate holder of SC, and also indicates $r_i\mathrm{*}=r_i$. Then, SC recovers the temporary credentials TC_i for U_i and computes pseudo-identity PID_iby equation (8).

$\{\begin{array}{l}\mathrm{T}{\mathrm{C}}_i=B_i\oplus h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i||\mathrm{T}{\mathrm{E}}_i)\\ \mathrm{P}\mathrm{I}{\mathrm{D}}_i=h(\mathrm{I}{\mathrm{D}}_i||r_i)\end{array}$(8)

After that, SC selects two random numbers $N_{\mathrm{1}}\in {Z_q}^{\mathrm{*}}$, $x_{\mathrm{1}}\in {Z_q}^{\mathrm{*}}$ and calculates the values F₁, F₂, F₃ according to equation (9). U_i sends message $M_{\mathrm{1}}=\{F_{\mathrm{1}},F_{\mathrm{2}},F_{\mathrm{3}},\mathrm{P}\mathrm{I}{\mathrm{D}}_i\}$ to GWN over a public channel.

$\{\begin{array}{l}{F}_{\mathrm{1}}=x_{\mathrm{1}}\cdot P\\ F_{\mathrm{2}}=(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||N_{\mathrm{1}})\oplus h(x_{\mathrm{1}}\cdot P_{\mathrm{p}\mathrm{u}\mathrm{b}})\\ F_{\mathrm{3}}=h(F_{\mathrm{1}}||\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i||N_{\mathrm{1}}||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)\end{array}$(9)

Step 2   Once GWN receives the message M₁ from U_i, it extracts the values needed for subsequent authentication according to equation (10).

$\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||N_{\mathrm{1}}=F_{\mathrm{2}}\oplus h(K_{\mathrm{G}\mathrm{U}}\cdot F_{\mathrm{1}})$(10)

GWN verifies the effectiveness of TE_i. If the verification fails, GWN rejects U_i's login request. Otherwise, GWN calculates the TC_i and F₃* by equation (11).

$\{\begin{array}{l}\mathrm{T}{\mathrm{C}}_i=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||K_{\mathrm{G}\mathrm{U}}||\mathrm{T}{\mathrm{E}}_i)\\ F_{\mathrm{3}}\mathrm{*}=h(F_{\mathrm{1}}||\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i||N_{\mathrm{1}}||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)\end{array}$(11)

GWN verifies whether $F_{\mathrm{3}}\mathrm{*}=F_{\mathrm{3}}$ holds or not. GWN rejects U_i's login request if the condition fails. Or else, it proves that U_i is a legitimate user who has registered with GWN. Then, GWN selects three random numbers $N_{\mathrm{2}}\in {Z_q}^{\mathrm{*}}$,$x\in {Z_q}^{\mathrm{*}}$, $x_{\mathrm{2}}\in {Z_q}^{\mathrm{*}}$ and calculates the temporary credentials TC_j of S_j and three values F₄, F₅, F₆ according to equation (12).

$\{\begin{array}{l}\mathrm{T}{\mathrm{C}}_j=h(K_{\mathrm{G}\mathrm{S}}||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)\\ F_{\mathrm{4}}=x_{\mathrm{2}}\oplus h(\mathrm{T}{\mathrm{C}}_j||N_{\mathrm{2}}||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}})\\ F_{\mathrm{5}}=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||x)\oplus h(N_{\mathrm{2}}||\mathrm{T}{\mathrm{C}}_j)\\ F_{\mathrm{6}}=h(F_{\mathrm{1}}||h(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||x)||x_{\mathrm{2}}||N_{\mathrm{2}})\end{array}$(12)

Lately, GWN sends a message $M_{\mathrm{2}}=\{F_{\mathrm{1}},F_{\mathrm{4}},F_{\mathrm{5}},F_{\mathrm{6}},N_{\mathrm{2}},\mathrm{P}\mathrm{I}{\mathrm{D}}_i\}$ to S_j over a public channel.

Step 3   Upon receiving the message M₂, S_j calculates a series of values according to equation (13) .

$\{\begin{array}{l}{x}_{\mathrm{2}}=F_{\mathrm{4}}\oplus h(\mathrm{T}{\mathrm{C}}_j||N_{\mathrm{2}}||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}})\\ h(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||x)=F_{\mathrm{5}}\oplus h(N_{\mathrm{2}}||\mathrm{T}{\mathrm{C}}_j)\\ F_{\mathrm{6}}\mathrm{*}=h(F_{\mathrm{1}}||h(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||x)||x_{\mathrm{2}}||N_{\mathrm{2}})\end{array}$(13)

S_jverifies whether $F_{\mathrm{6}}\mathrm{*}=F_{\mathrm{6}}$ holds or not, and aborts the current phase if equation is not matched. Otherwise, S_j generates two random numbers $N_{\mathrm{3}}\in {Z_q}^{\mathrm{*}}$,$x_{\mathrm{3}}\in {Z_q}^{\mathrm{*}}$ and calculates the session key SK_ji and a set of values by equation (14).

$\{\begin{array}{l}{F}_{\mathrm{7}}=x_{\mathrm{3}}\cdot P\\ \mathrm{S}{\mathrm{K}}_{ji}=h(\mathrm{P}\mathrm{I}{\mathrm{D}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||x_{\mathrm{3}}\cdot F_{\mathrm{1}}||F_{\mathrm{1}}||F_{\mathrm{7}})\\ F_{\mathrm{8}}=h(\mathrm{S}{\mathrm{K}}_{ji}||N_{\mathrm{3}})\\ F_{\mathrm{9}}=(F_{\mathrm{8}}||F_{\mathrm{7}}||N_{\mathrm{3}})\oplus h(\mathrm{T}{\mathrm{C}}_j||\mathrm{P}\mathrm{I}{\mathrm{D}}_i)\\ F_{\mathrm{10}}=h(\mathrm{T}{\mathrm{C}}_j||F_{\mathrm{7}}||N_{\mathrm{3}}||F_{\mathrm{8}})\end{array}$(14)

S_j sends a message $M_{\mathrm{3}}=\{F_{\mathrm{9}},F_{\mathrm{10}},\mathrm{S}\mathrm{I}{\mathrm{D}}_j,\mathrm{P}\mathrm{I}{\mathrm{D}}_i\}$ to GWN over a public channel.

Step 4   As soon as GWN receives M₃, it extracts the values to be used for the subsequent operation and the validation value F₁₀* by equation (15).

$\{\begin{array}{l}{F}_{\mathrm{8}}||F_{\mathrm{7}}||N_{\mathrm{3}}=F_{\mathrm{9}}\oplus h(\mathrm{T}{\mathrm{C}}_j||\mathrm{P}\mathrm{I}{\mathrm{D}}_i)\\ F_{\mathrm{10}}\mathrm{*}=h(\mathrm{T}{\mathrm{C}}_j||F_{\mathrm{7}}||N_{\mathrm{3}}||F_{\mathrm{8}})\end{array}$(15)

GWN verifies whether $F_{\mathrm{10}}\mathrm{*}=F_{\mathrm{10}}$ holds or not. If

the condition fails, this session is aborted immediately. Otherwise, GWN updates PID_i by equation (16) and calculates some values.

$\{\begin{array}{l}\mathrm{P}\mathrm{I}{{\mathrm{D}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}}=\mathrm{P}\mathrm{I}{\mathrm{D}}_i\oplus h(N_{\mathrm{3}}||\mathrm{T}{\mathrm{C}}_i)\\ F_{\mathrm{11}}=\mathrm{P}\mathrm{I}{{\mathrm{D}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}}\oplus h(\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i||N_{\mathrm{1}})\\ F_{\mathrm{12}}=h(\mathrm{P}\mathrm{I}{{\mathrm{D}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}}||\mathrm{T}{\mathrm{C}}_i)\\ F_{\mathrm{13}}=(F_{\mathrm{8}}||F_{\mathrm{7}}||N_{\mathrm{3}})\oplus h(\mathrm{P}\mathrm{I}{{\mathrm{D}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}})\end{array}$(16)

GWN then sends a message $M_{\mathrm{4}}=\{F_{\mathrm{11}},F_{\mathrm{12}},F_{\mathrm{13}}\}$ to U_i over a public channel.

Step 5   After receiving the message from GWN, U_i extracts the updated pseudo-identity PID_i^new* and calculates F₁₂* through equation (17) .

$\{\begin{array}{l}\mathrm{P}\mathrm{I}{{\mathrm{D}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}}\mathrm{*}=F_{\mathrm{11}}\oplus h(\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i||N_{\mathrm{1}})\\ F_{\mathrm{12}}\mathrm{*}=h(\mathrm{P}\mathrm{I}{{\mathrm{D}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}}\mathrm{*}||\mathrm{T}{\mathrm{C}}_i) \end{array}$(17)

U_i checks whether $F_{\mathrm{12}}\mathrm{*}=F_{\mathrm{12}}$ holds or not. U_i terminates the session on the mismatch of equality. Otherwise, it indicates that U_i authenticates GWN and the accuracy of the transmitted message, and also means that $\mathrm{P}\mathrm{I}{{\mathrm{D}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}}\mathrm{*}=\mathrm{P}\mathrm{I}{{\mathrm{D}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}}$. Then, U_i recovers and calculates some values by equation (18).

$\{\begin{array}{l}{F}_{\mathrm{8}}||F_{\mathrm{7}}||N_{\mathrm{3}}=F_{\mathrm{13}}\oplus h(\mathrm{P}\mathrm{I}{{\mathrm{D}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}})\\ \mathrm{S}{\mathrm{K}}_{ij}=h(\mathrm{P}\mathrm{I}{\mathrm{D}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||x_{\mathrm{1}}\cdot F_{\mathrm{7}}||F_{\mathrm{1}}||F_{\mathrm{7}})\\ F_{\mathrm{8}}\mathrm{*}=h(\mathrm{S}{\mathrm{K}}_{ij}||N_{\mathrm{3}})\end{array}$(18)

U_i verifies whether $F_{\mathrm{8}}\mathrm{*}=F_{\mathrm{8}}$ holds or not. If the verification fails, U_i terminates the current session immediately. Otherwise, it means that U_iand S_j have successfully negotiated a session key, which can be used to secure subsequent communications.

4 Security Analysis

The most basic requirement of any authentication scheme is security. In this section, we give a security analysis of the proposed scheme. The proposed scheme provides mutual authentication, satisfies user anonymity and untraceability, and is resistant to many common attacks as described below.

4.1 User Anonymity

For the sake of ensuring user's privacy, the authentication scheme must guarantee anonymity. In the proposed scheme, the identity ID_i of U_i is neither transmitted in a public channel nor stored in SC. As shown in equation (19), the proposed scheme encrypts ID_i with a random number r_i chosen by U_i thereby generating the user's pseudo-identity PID_i. In the login and key agreement phase, the proposed scheme transmits the identity information in the public channel as PID_i instead of ID_i, and even if an attacker intercepts PID_i, he/she cannot crack ID_i due to the protection of h(·) with a random number r_i. In summary, the proposed scheme satisfies user anonymity.

$\mathrm{P}\mathrm{I}{\mathrm{D}}_i=h(\mathrm{I}{\mathrm{D}}_i||r_i)$(19)

4.2 User Untraceability

U_i sends a login message $M_{\mathrm{1}}=\{F_{\mathrm{1}},F_{\mathrm{2}},F_{\mathrm{3}},\mathrm{P}\mathrm{I}{\mathrm{D}}_i\}$ to GWN through a public channel, and an attacker can intercept M₁. However, as equation (20) shows,$\{F_{\mathrm{1}},F_{\mathrm{2}},F_{\mathrm{3}}\}$are all related to the random numbers x₁ or N₁, and the random numbers are different in each session. Similarly, the random numbers make PID_i vary from session to session. That is, all values in M₁ cannot be associated with a specific user. Therefore, the attacker cannot trace the user's actions during the login and key agreement phase. Meanwhile, after GWN authenticates S_j in the login and key agreement phase, it updates PID_i by equation (21) and transmits it to U_i, which means that U_i's pseudo-identity is dynamic. Usually, an attacker intercepts messages from different sessions and tries to find the relationship between them to determine whether they belong to the same device^[12]. In the proposed scheme, GWN does not transmit PID_i^new directly through a public channel after it updates PID_i, but protects PID_i^new by equation (22) before transmitting F₁₁. In this way, attacker cannot obtain the correlation between PID_i and PID_i^new by intercepting both of them. As shown above, proposed scheme not only satisfies user untraceability, but also enhances user anonymity because of dynamic identity.

$\{\begin{array}{l}{F}_{\mathrm{1}}=x_{\mathrm{1}}\cdot P\\ F_{\mathrm{2}}=(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_i||N_{\mathrm{1}})\oplus h(x_{\mathrm{1}}\cdot P_{\mathrm{p}\mathrm{u}\mathrm{b}})\\ F_{\mathrm{3}}=h(F_{\mathrm{1}}||\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i||N_{\mathrm{1}}||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)\end{array}$(20)

$\mathrm{P}\mathrm{I}{{\mathrm{D}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}}=F_{\mathrm{11}}\oplus h(\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i||N_{\mathrm{1}})$(21)

$F_{\mathrm{11}}=\mathrm{P}\mathrm{I}{{\mathrm{D}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}}\oplus h(\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i||N_{\mathrm{1}})$(22)

4.3 Mutual Authentication

The three parties involved in the communication, i.e., U_i, GWN, and S_j, must authenticate each other to ensure the legitimacy of either party. In the login phase, SC authenticates the currently logged-in user as the legitimate holder of SC by verifying A_i in equation (23). GWN authenticates U_i by verifying F₃ in equation (23), in particular TC_i contained therein, before responding to U_i's login request. GWN authenticates S_j by checking F₁₀ in equation (23) according to integrity and accuracy, especially TC_j contained therein. S_j achieves authentication of GWN by examining F₆ in equation (23), especially $h(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||x)$ contained therein. U_i authenticates GWN by verifying F₁₂ in equation (23), and verifies that the session key reached with S_j is consistent by checking F₈. In conclusion, if the whole authentication process can be completed, the participants can trust each other, which means that proposed scheme supports mutual authentication.

$\{\begin{array}{l}{A}_i=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i||r_i)\\ F_{\mathrm{3}}=h(F_{\mathrm{1}}||\mathrm{I}{\mathrm{D}}_i||\mathrm{I}{\mathrm{D}}_{\mathrm{G}\mathrm{W}\mathrm{N}}||\mathrm{T}{\mathrm{C}}_i||N_{\mathrm{1}}||\mathrm{T}{\mathrm{E}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j)\\ F_{\mathrm{10}}=h(\mathrm{T}{\mathrm{C}}_j||F_{\mathrm{7}}||N_{\mathrm{3}}||F_{\mathrm{8}})\\ F_{\mathrm{6}}=h(F_{\mathrm{1}}||h(\mathrm{I}{\mathrm{D}}_i||\mathrm{T}{\mathrm{E}}_i||x)||x_{\mathrm{2}}||N_{\mathrm{2}})\\ F_{\mathrm{12}}=h(\mathrm{P}\mathrm{I}{{\mathrm{D}}_i}^{\mathrm{n}\mathrm{e}\mathrm{w}}||\mathrm{T}{\mathrm{C}}_i)\\ F_{\mathrm{8}}=h(\mathrm{S}{\mathrm{K}}_{ij}||N_{\mathrm{3}})\end{array}$(23)

4.4 Resistance to Replay Attack

Although the proposed scheme still does not use timestamps as Hu et al's scheme^[10], all values transmitted in a public channel are added with random numbers N₁, x₁, N₂, x, x₂, N₃, x₃ chosen randomly by U_i, S_j, and GWN in the login and key agreement phase, and these random numbers vary from session to session. Even if an attacker intercepts messages M₁, M₂, M₃, M₄ over a public channel and replays them, the attacker cannot compute the correct session key. As shown in equation (24), if the attacker wants to compute the session key, he/she must know F₇ at first. However, he/she cannot obtain F₇ in the session key from the intercepted messages. It is because the attacker must first obtain the random number x₃ chosen by S_j and the base point P of the elliptic curve in order to compute F₇, but he/she cannot know these values from the messages transmitted over the public channel, so the attacker cannot compute the session key. It follows that the proposed scheme is able to resist replay attacks.

$\mathrm{S}{\mathrm{K}}_{ji}=h(\mathrm{P}\mathrm{I}{\mathrm{D}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||x_{\mathrm{3}}\cdot F_{\mathrm{1}}||F_{\mathrm{1}}||F_{\mathrm{7}})$(24)

4.5 Resistance to Man-in-the-Middle(MITM) Attack

If an attacker tries to eavesdrop, manipulate, or intercept messages transmitted in the public channel, he/she will be detected by the mutual authentication mechanism at each entity involved in the communication. As shown in Sections 4.3 and 4.4, such a malicious attempt will not succeed even if the attacker attempts to replay or tamper with the values in the transmitted message. Thus, the proposed scheme is resistant to MITM attacks.

4.6 Resistance to DOS Attack

An attacker may send a large number of fake request messages to the target device multiple times in an attempt to prevent legitimate users from accessing the service, resulting in the target device being unable to provide normal service. In the proposed scheme, SC verifies the U_i's login information. In equation (25), ID_i and PW_i are the identity and password entered by U_i, and r_i is recovered from h(·) and C_i, both of which are stored in SC inserted by U_i. Therefore, SC can verify whether U_i is the legitimate holder of SC or not by verifying A_i. In addition to this, each message in the proposed scheme authenticates the sender before proceeding to the next operation. If authentication is successful, the session will proceed normally. Otherwise, it will be terminated immediately. Thus, the proposed scheme is resistant to DOS attacks.

$\{\begin{array}{l}{r}_i=C_i\oplus h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i)\\ A_i=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i||r_i)\end{array}$(25)

4.7 Perfect Forward Secrecy

In the proposed scheme, a new session key will be generated between U_iand S_j after each communication is completed. If this session key is corrupted by an attacker, however, the attacker cannot find significant correlation between past, present and future session keys because the random numbers x₁ and x₃ contained in each session key change from session to session. As a result, the proposed scheme achieves perfect forward secrecy.

4.8 Resistance to Impersonation Attack

An attacker may impersonate U_i to launch an attack. In the proposed scheme, U_i communicates by using a pseudo-identity PID_i, which is updated at the end of each authentication phase. Therefore, it is difficult for the attacker to impersonate a legitimate user using some outdated pseudo-identity. Even if the attacker happens to guess the identity of U_i, he/she can never send a valid message to the GWN to prove his/her identity. It is because the attacker cannot know the temporary credential TC_i and the expiration time TE_i issued by GWN to the legitimate user. In summary, the proposed scheme is able to resist impersonation attacks.

4.9 Resistance to Stolen Smart Card Attack

If the attacker steals the smart card SC, then he/she may impersonate U_i to log in, insert SC, and then enter his/her own identity and password. However, the attacker cannot pass the authentication of equation (26). That is, even if the attacker steals SC and leaks the data stored inside, he/she still cannot obtain the important authentication information. So the proposed scheme is resistant to stolen smart card attacks.

$\{\begin{array}{l}{A}_i\mathrm{*}=h(\mathrm{I}{\mathrm{D}}_i||\mathrm{P}{\mathrm{W}}_i||r_i\mathrm{*})\\ \mathrm{C}\mathrm{h}\mathrm{e}\mathrm{c}\mathrm{k}\mathrm{s} A_i\mathrm{*}=A_i\end{array}$(26)

4.10 Resistance to Known Session Key Attack

If an attacker wants to use an old or compromised session key for a session, the scheme is considered vulnerable to known session key attacks. As shown in equation (27), the session key in the proposed scheme contains random numbers x₁ and x₃ that are refreshed with each communication, so the attacker is hard to know F₁ and F₇. Meanwhile, due to the complexity of computational Diffie-Hellman problem (CDH), it is infeasible for the attacker to obtain new information from the old session key and extract$\{x_{\mathrm{1}},x_{\mathrm{3}}\}$from$\{F_{\mathrm{1}},F_{\mathrm{7}}\}$.

$\{\begin{array}{l}\mathrm{S}{\mathrm{K}}_{ji}=\mathrm{S}{\mathrm{K}}_{ij}=h(\mathrm{P}\mathrm{I}{\mathrm{D}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||x_{\mathrm{3}}\cdot F_{\mathrm{1}}||F_{\mathrm{1}}||F_{\mathrm{7}})\\ =h(\mathrm{P}\mathrm{I}{\mathrm{D}}_i||\mathrm{S}\mathrm{I}{\mathrm{D}}_j||x_{\mathrm{1}}\cdot F_{\mathrm{7}}||F_{\mathrm{1}}||F_{\mathrm{7}})\\ F_{\mathrm{1}}=x_{\mathrm{1}}\cdot P\\ F_{\mathrm{7}}=x_{\mathrm{3}}\cdot P\end{array}$(27)

4.11 Resistance to Off-Line Password Guessing Attack

Suppose an attacker tries to guess PW_i of the legitimate user using the stolen smart card or any previously transmitted message, so as to pass the verification of equation (27), he/she must know the real identity ID_i and r_i* of the legitimate user. However, the attacker cannot obtain ID_i based on the intercepted message. Moreover, r_i is an independent and unique random number chosen arbitrarily by the legitimate user during the registration phase. The user must extract r_i* at the login stage based on the registered ID_i and PW_i as well as C_i stored in the SC in order to pass the verification of equation (27). That is, even if the attacker guesses PW_i correctly by chance, it will not be able to pass the verification of SC. Therefore, the proposed scheme can resist the off-line password guessing attacks.

4.12 No Key Control

Each entity in the session cannot compute the session key separately by controlling the key negotiation process. Not only x₁ and x₃, but also F₁ and F₇ are chosen and computed independently by U_i and S_j, respectively. As shown in equation (27), if U_idoes not extract F₇ created by S_j based on the received message M₄, then SK_ij cannot be computed. Similarly, if S_j does not extract F₁ created by U_i based on M₂, then SK_ji cannot be computed.

5 Performance Analysis

This section presents a comparison of Hu et al's scheme^[10] with the proposed scheme and other schemes of the same type in terms of both performance and security features.

5.1 Implementation Setup

We refer to the experimental results of Xie et al^[13]. To make it easier, we only consider four main cryptographic operations: ① one-way Hash function, ② point multiplication, ③ symmetric encryption and decryption, and ④ fuzzy extraction function. We do not consider the XOR operation because it can be neglected. The encryption times of the Hash function, encryption/decryption, point multiplication in elliptic curves, and fuzzy extraction function are denoted as T_h, T_s, T_e, and T_f, and the estimated time are 0.068, 0.56, 2.501, and 2.501 ms, respectively.

5.2 Computation Comparisons

Table 3 shows the comparison of proposed scheme with other similar schemes. Although proposed scheme has a slightly longer running time than Hu et al's scheme^[10], it has better security and can effectively improve the security flaws of Hu et al's scheme^[10]. Moreover, the computational cost of proposed scheme is significantly lower than the schemes of Sutrala et al^[14], Xie et al^[15], Srinivas et al^[16] and Sahoo et al^[17] .

5.3 Comparison of Safety Features and Functions

Table 4 shows that the existing schemes do not meet all the security requirements, and the proposed scheme provides sufficient security advantages compared to other schemes and is suitable for wireless sensor networks in the IoT environment.

6 Conclusion

In this paper, we review a two-factor authentication scheme proposed by Hu et al for WSNs in an IoT environment, and point out some flaws of it. Then, we propose an improved scheme that addresses Hu et al's scheme security concerns, and takes into account computational efficiency. We demonstrate the security of proposed scheme through security analysis, and show that proposed scheme is resistant to a wide range of known attacks and meets all security requirements. In addition, we compare and analyze the performance of proposed scheme and Hu et al's scheme as well as similar schemes in recent years. The analysis results show that proposed scheme achieves desired efficiency and is compatible with low-cost, restricted IoT devices.

References

All Tables