Analysis and Improvement of an Authentication Scheme for Fog Computing Services

Yuyan HUO; Baoyuan KANG; Shufang NIU; Anqian LI; Xinyu ZUO

doi:10.1051/wujns/2024293209

All issues

Volume 29 / No 3 (June 2024)

Wuhan Univ. J. Nat. Sci., 29 3 (2024) 209-218

Full HTML

Open Access

Issue		Wuhan Univ. J. Nat. Sci. Volume 29, Number 3, June 2024


Page(s)		209 - 218
DOI		https://doi.org/10.1051/wujns/2024293209
Published online		03 July 2024

Wuhan University Journal of Natural Sciences, 2024, Vol.29 No.3, 209-218

Computer Science

CLC number: TP309.2

Analysis and Improvement of an Authentication Scheme for Fog Computing Services

Yuyan HUO¹, Baoyuan KANG¹^†, Shufang NIU², Anqian LI¹ and Xinyu ZUO¹

¹ School of Software, Tiangong University, Tianjin 300387, China
² School of Computer Science and Technology, Tiangong University, Tianjin 300387, China

^† Corresponding author. E-mail: baoyuankang@aliyun.com

Received: 28 September 2023

Abstract

Fog computing utilizes devices in the edge network to transmit data with very low latency and supports high mobility. However, fog computing inherits security and privacy problems from cloud computing. Therefore, various privacy schemes for fog computing have been proposed to prevent different types of attacks. Recently, Weng et al proposed a fog computing authentication scheme; after analyzing, we found that Weng et al's scheme cannot resist user tracking attack and user impersonation attack. Then, we propose an improved scheme through adding a password, modifying the calculation method of E_i, and adding timestamps. In addition, we also compare the improved scheme with existing authentication schemes in terms of security and computational efficiency. The results show that the improved scheme is more secure and has less computation.

Key words: authentication scheme / fog computing / security

Cite this article: HUO Yuyan, KANG Baoyuan, NIU Shufang, et al. Analysis and Improvement of an Authentication Scheme for Fog Computing Services[J]. Wuhan Univ J of Nat Sci, 2024, 29(3): 209-218.

Biography: HUO Yuyan, female, Master candidate, research directions: cryptography. E-mail: yuyanhuo@aliyun.com

© Wuhan University 2024

This is an Open Access article distributed under the terms of the Creative Commons Attribution License (https://creativecommons.org/licenses/by/4.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

0 Introduction

Cloud computing is a business computing model. It distributes computer tasks to resource pools made up of large numbers of computers, enabling various applications to obtain computing power, storage space, and information services as needed. However, compared with traditional decentralized computing, cloud computing centralizes computing resources, and risks are centralized together. Therefore, cloud computing cannot meet the needs of high mobility, location-aware, and low-latency applications^[1]. Fog computing was born to eliminate the limitations of cloud computing and is used to be a link between the Internet of Things devices and the cloud^[1]. In fog computing, fog services are distributed at the margin of the network and close to terminal equipment geographically^[2], so some data can be processed and stored directly in the fog layer. As a result, fog computing can reduce the pressure on the cloud, improve transmission rates, and reduce latency.

Fog computing can effectively decentralize computational and analytical power and help reduce bandwidth usage. However, fog nodes are often deployed in remote and unprotected places^[3], and rely on insecure public channels for data transmission between users and fog servers, as well as fog servers and cloud servers. Therefore, secure identity authentication is critical in fog computing.

Many researchers have recently proposed identity authentication schemes in fog computing environments. Lampot first proposed a remote authentication scheme in an insecure environment in 1981^[4]. Then, many two-factor authentication schemes based on Hashes, smart cards, and temporary certificates were proposed^[5-10], but most of them have security issues. Then, lots of three-factor authentication schemes^[1,11-15] based on fog computing were proposed. In 2019, Ma et al^[16] proposed an authenticated key agreement protocol without bilinear pairing and claimed that their scheme achieves mutual authentication, generates a securely agreed session key for secret communication, and supports privacy protection. In 2021, Chen et al^[17] proposed an authenticated key exchange scheme for fog computing. However, after analysis, Rana et al^[18] found that Chen et al's scheme^[17] does not provide user anonymity and is also not resistant to tamper-proof device stolen attack, user impersonation attack, fog node impersonation attack, insider attack, and known session key attack. In 2021, Weng et al^[15] proposed a lightweight anonymous mutual authentication and secure communication scheme and claimed that their scheme only uses one-way Hash functions, and XOR operations and security can be ensured.

In this paper, we point out the shortcomings of Weng et al's^[15] scheme. Weng et al's scheme cannot resist user traceability attack and user impersonation attack. Therefore, we propose an improved scheme through adding a password, modifying the calculation method of E_i, and adding timestamps. We also compare security features and computation costs between the improved scheme and the other four schemes^{[3, 15-17]}.

The rest of the paper is structured as follows: Section 1 briefly reviews Weng et al's scheme. Section 2 analyses the shortcomings of Weng et al's scheme. In Section 3, an improved scheme is presented. Section 4 provides a security analysis and comparison of the enhanced scheme. Section 5 concludes the paper.

1 Review of Weng et al's Scheme

In Weng et al's scheme^[15], there are two mutual authentication and key agreement phases: one is the authentication and key agreement phase of edge user EU_i and fog server FS_j, and the other is the authentication and key agreement phase of edge device ED_k and fog server FS_j. Through analysis, we find that the two phases similarly implement mutual authentication and key agreement. So, in this section, we only review the authentication and key agreement phase of edge user EU_i and fog server FS_j. There are three participants in Weng et al's scheme: cloud server, fog servers, and edge users. Fog servers and edge users all register to the cloud server, and then edge users and fog servers authenticate with each other and agree on the same session keys with the help of the cloud server. Weng et al's scheme^[15]consists of the following steps. The notations used in this article are listed in Table 1.

Table 1

Notations table

1.1 System Initialization

The cloud server CS generates a master secret key MK, and two long-term secret keys K_cf and K_cu, and keeps them secret. CS chooses a one-way Hash function h(·).

1.2 Fog Server Registration Phase

Fog server FS_j selects a unique identity ID_j and sends identity ID_j to CS via a secure channel. On receiving ID_j, CS generates a pseudonym TID_j, and computes

$B_{j} = h (I D_{j} | | K_{c f}), h (M K | | K_{c f}) .$

Then CS sends {TID_j, B_j, h(MK||K_cf)} to FS_j and maintains {TID_j, ID_j, B_j} in a protected verifier table of FS_j. Finally, FS_j stores TID_j, B_j, and h(MK||K_cf) in its memory.

1.3 Edge User Registration Phase

Edge user EU_i selects a unique identity ID_i and imprints his/her biometric BIO_i into smart device MD_i. MD_i generates a 160-bit random secret number n_u and computes A_i=h(ID_i||BIO_i||n_u). Then MD_i sends {A_i,ID_i} to CS through a secure channel. After receiving ID_i and A_i, CS generates a pseudonym TID_i, and computes

$B_{i} = h (I D_{i} | | M K),$

$C_{i} = h (I D_{i} | | A_{i} | | h (K_{c u})),$

$D_{i} = B_{i} \oplus h (M K | | K_{c u}) \oplus A_{i} .$

Then CS sends ${T I D_{i}, C_{i}, D_{i}, h (\cdot), h (K_{c u})}$ to EU_i via a secure channel and maintains ${T I D_{i}, B_{i}}$ in a protected verifier table of EU_i. Finally, EU_i's smart device stores ${T I D_{i}, C_{i}, D_{i}, h (\cdot), h (K_{c u}), n_{u}}$ in its memory.

1.4 Authentication and Key Agreement Phase

In this phase, an edge user EU_i wants to access a fog server FS_j through a public channel, the cloud server CS can help EU_i and FS_j to authenticate each other and achieve a session key SK_ij. The specific steps are as follows.

Step 1: EU_i first inputs $I D_{i}^{'}$ and $B I O_{i}^{'}$ into his/her smart device. Then, MD_i retrieves n_u and h(K_cu) to compute

$A_{i}^{'} = h (I D_{i}^{'} | | B I O_{i}^{'} | | n_{u}), C_{i}^{'} = h (I D_{i}^{'} | | A_{i}^{'} | | h (K_{c u}))$

and checks whether $C_{i}^{'} = C_{i}$ . If it is true, it means EU_i is a legal user, then smart device MD_i selects a 128-bit random number r_u and computes

$E_{i} = D_{i} \oplus A_{i}^{} \oplus r_{u}, F_{i} = h (h (K_{c u}) | | I D_{j} | | r_{u}) .$

Finally, MD_i sends the message $M_{u 1} = {T I D_{i}, E_{i}, F_{i}}$ to FS_j through a public channel.

Step 2: On receiving M_u₁, FS_j selects a 128-bit random number r_f and retrieves TID_j, B_j, and h(MK||K_cf ) to compute

$O_{j} = B_{j} \oplus r_{f}, P_{j} = h (h (M K | | K_{c f}) | | T I D_{j} | | r_{f}) .$

Finally, FS_j sends messages M_u₁ and M_u₂ = {TID_j, O_j, P_j} to CS through a public channel.

Step 3: On receiving M_u₁ and M_u₂, CS inspects M_u₁ and searches the verifier table of EU_i in its database to find entry that match TID_i. If there is no matching entry, CS rejects the request and terminates the session. Otherwise, CS retrieves B_i and h(MK||K_cu) to compute

$r_{u}^{'} = E_{i} \oplus B_{i} \oplus h (M K | | K_{c u}), F_{i}^{'} = h (h (K_{c u}) | | I D_{j} | | r_{u}^{'}) .$

Then CS checks whether $F_{i}^{'} = F_{i} .$ If it is not true, CS terminates the session. Otherwise, the legitimacy of EU_i is authenticated by CS.

Step 4: CS further inspects M_u₂ and searches the verifier table of FS_j in its database to find entry that match TID_j. If there is no matching entry, CS rejects the request and terminates the session. Otherwise, CS retrieves B_j and h(MK||K_cf) to compute

$r_{f}^{'} = O_{j} \oplus B_{j}, P_{j}^{'} = h (h (M K | | K_{c f}) | | T I D_{j} | | r_{f}^{'}) .$

Then CS checks whether $P_{j}^{'} = P_{j}$ .

Step 5: After verifying the validity of EU_i and FS_j, CS refreshes pseudonyms for EU_i and FS_j by computing

$T I D_{i}^{n e w} = T I D_{i} \oplus r_{u}^{'}, T I D_{j}^{n e w} = T I D_{j} \oplus r_{f}^{'} .$

And CS replaces TID_iwith $T I D_{i}^{n e w}$ in the verifier table of EU_i, replaces TID_j with $T I D_{j}^{n e w}$ in the verifier table of FS_j. CS further selects a 128-bit random number r_cand computes

$\begin{array}{l} Q_{j} = r_{u}^{'} \oplus r_{c} \oplus h (I D_{j} | | T I D_{j}^{n e w}), S K_{i j} = h (r_{u}^{'} \oplus r_{f}^{'} \oplus r_{c}), \\ R_{j} = h (B_{j} \oplus h (T I D_{j}^{n e w}) \oplus S K_{i j}), S_{j} = r_{f}^{'} \oplus r_{c} \oplus h (I D_{j} | | T I D_{i}^{n e w}), \\ T_{j} = h (B_{i} \oplus h (M K | | K_{c u}) \oplus h (T I D_{i}^{n e w}) \oplus S K_{i j}) . \end{array}$

Finally, CS sends M_u₃ = {Q_j, R_j} and M_u₄ = {S_j, T_j} to FS_j.

Step 6: On receiving M_u₃ and M_u₄, FS_j computes

$\begin{array}{l} T I D_{j}^{n e w} = T I D_{j} \oplus r_{f}, r_{u}^{'} \oplus r_{c}^{'} = Q_{j} \oplus h (I D_{j} | | T I D_{j}^{n e w}), \\ S K_{i j} = h (r_{u}^{'} \oplus r_{c}^{'} \oplus r_{f}), R_{j}^{'} = h (B_{j} \oplus h (T I D_{j}^{n e w}) \oplus S K_{i j}) . \end{array}$

FS_j checks if $R_{j}^{'} = R_{j}$ . Finally, FS_j sends M_u₄ to EU_i.

Step 7: On receiving M_u₄, EU_i computes

$\begin{array}{l} T I D_{i}^{n e w} = T I D_{i} \oplus r_{u}, r_{f}^{'} \oplus r_{c}^{'} = S_{j} \oplus h (I D_{j} | | T I D_{i}^{n e w}), \\ S K_{i j} = h (r_{f}^{'} \oplus r_{c}^{'} \oplus r_{u}), \\ T_{j}^{'} = h (B_{i} \oplus h (M K | | K_{c u}) \oplus h (T I D_{i}^{n e w}) \oplus S K_{i j}) . \end{array}$

If $T_{j}^{'} = T_{j}$ , EU_i believes that CS and FS_j are legal parties and stores the shared session key SK_ij for future secure communication.

2 Attacks on Weng et al's Scheme

This section will show that Weng et al's scheme^[15] is vulnerable to user traceability and impersonation attacks. Further details are provided in the following subsections.

2.1 User Traceability Attack

Weng et al's scheme^[15] cannot resist user traceability attack. The following steps show the process of user traceability attack.

Step 1:In the first authentication, if a user EU_i sends a message M_U1= ${T I D_{i}, E_{i}, F_{i}}$ trying to contact a fog server FS_j, one attacker may intercept the message M_U1, and then he/she saves {E_i, TID_i}. At the end of this authentication, the cloud server CS and the user will update the pseudonym by (1). Lastly, the first authentication ends.

$T I D_{i}^{n e w} = T I D_{i} \oplus r_{u}$ (1)

$E_{i} = D_{i} \oplus A_{i}^{} \oplus r_{u}$ (2)

But through (1) and (2), the attacker can know

$T I D_{i} \oplus E_{i} \oplus T I D_{i}^{n e w} = D_{i} \oplus A_{i}$ (3)

Step 2:In the second authentication, assume that three users EU_A, EU_B, EU_C, and the same user EU_i all send messages trying to contact a fog server FS_g. EU_A sends message M_U1a= ${T I D_{a}^{n e w}, E_{a}^{n e w}, F_{a}^{n e w}}$ , EU_B sends message M_U1b= ${T I D_{b}^{n e w}, E_{b}^{n e w}, F_{b}^{n e w}}$ , EU_C sends message M_U1_c= ${T I D_{c}^{n e w}, E_{c}^{n e w}, F_{c}^{n e w}}$ and EU_i sends message M_U1_i= ${T I D_{i}^{n e w}, E_{i}^{n e w}, F_{i}^{n e w}}$ , the attacker intercepts four messages M_U1_a, M_U1_b, M_U1_c, M_U1_i and uses the previous intercepted E_i and TID_i to calculate

$T I D_{i} \oplus E_{i} \oplus T I D_{a}^{n e w} = N_{a}, T I D_{i} \oplus E_{i} \oplus T I D_{b}^{n e w} = N_{b},$ (4)

$T I D_{i} \oplus E_{i} \oplus T I D_{c}^{n e w} = N_{c}, T I D_{i} \oplus E_{i} \oplus T I D_{i}^{n e w} = N_{d} .$

The attacker also saves the intercepted messages M_U1a, M_U1b, M_U1c and M_U1_i. At the end of the second authentication, the new pseudonym of user EU_i has been updated to $T I D_{i}^{n e w 2}$ .

Step 3: In the third authentication, assume that three users EU_J, EU_K, EU_L and the same user EU_i send messages trying to contact a fog server FS_l. The four users send messages $M_{U 1 j} = {T I {D_{j}^{n e w}}^{2}, E_{j}^{n e w 2}, F_{j}^{n e w 2}}, M_{U 1 k} = {T I D_{k}^{n e w 2}, E_{k}^{n e w 2}, F_{k}^{n e w 2}}, M_{U 1 l} {T I D_{l}^{n e w 2}, E_{l}^{n e w 2},$ $F_{l}^{n e w 2}}, M_{U 1 i}^{n e w} = {T I D_{i}^{n e w 2}, E_{i}^{n e w 2}, F_{i}^{n e w 2}}$ , respectively. The attacker intercepts all four messages M_U1_j, M_U1_k, M_U1_l, and $M_{U 1 i}^{n e w}$ and according to the second intercepted messages M_U1_a, M_U1_b, M_U1_c and M_U1_i to calculate

$\begin{array}{l} T I D_{a}^{n e w} \oplus E_{a}^{n e w} \oplus T I D_{j}^{n e w 2} = N_{a j}, \\ T I D_{a}^{n e w} \oplus E_{a}^{n e w} \oplus T I D_{k}^{n e w 2} = N_{a k}, \\ T I D_{a}^{n e w} \oplus E_{a}^{n e w} \oplus T I D_{l}^{n e w 2} = N_{a l}, \\ T I D_{a}^{n e w} \oplus E_{a}^{n e w} \oplus T I D_{i}^{n e w 2} = N_{a i}, \\ T I D_{b}^{n e w} \oplus E_{b}^{n e w} \oplus T I D_{j}^{n e w 2} = N_{b j}, \\ T I D_{b}^{n e w} \oplus E_{b}^{n e w} \oplus T I D_{k}^{n e w 2} = N_{b k}, \\ T I D_{b}^{n e w} \oplus E_{b}^{n e w} \oplus T I D_{l}^{n e w 2} = N_{b l}, \\ T I D_{b}^{n e w} \oplus E_{b}^{n e w} \oplus T I D_{i}^{n e w 2} = N_{b i}, \\ T I D_{c}^{n e w} \oplus E_{c}^{n e w} \oplus T I D_{j}^{n e w 2} = N_{c j}, \\ T I D_{c}^{n e w} \oplus E_{c}^{n e w} \oplus T I D_{k}^{n e w 2} = N_{c k}, \\ T I D_{c}^{n e w} \oplus E_{c}^{n e w} \oplus T I D_{l}^{n e w 2} = N_{c l}, \\ T I D_{c}^{n e w} \oplus E_{c}^{n e w} \oplus T I D_{i}^{n e w 2} = N_{c i}, \\ T I D_{i}^{n e w} \oplus E_{i}^{n e w} \oplus T I D_{j}^{n e w 2} = N_{i j}, \\ T I D_{i}^{n e w} \oplus E_{i}^{n e w} \oplus T I D_{k}^{n e w 2} = N_{i k}, \\ T I D_{i}^{n e w} \oplus E_{i}^{n e w} \oplus T I D_{l}^{n e w 2} = N_{i l}, \end{array}$

$T I D_{i}^{n e w} \oplus E_{i}^{n e w} \oplus T I D_{i}^{n e w 2} = N_{i i} .$ (5)

After calculating (4) and (5), the attacker will find that N_d = N_ii. This is because $T I D_{i} \oplus E_{i} \oplus T I D_{i}^{n e w} = T I D_{i}^{n e w} \oplus E_{i}^{n e w} \oplus T I D_{i}^{n e w 2} = D_{i} \oplus A_{i},$ where A_i and D_i are constant, then the attacker can determine the messages M_U1, M_U1_i and $M_{U 1 i}^{n e w}$ are from the same user EU_i. When a user EU_k contacts a fog server FS_n with the new pseudonym $T I D_{k}^{n e w 3}$ next time, the attacker can judge whether EU_k is EU_i by calculating $T I D_{i}^{n e w 2} \oplus E_{i}^{n e w 2} \oplus T I D_{k}^{n e w 3} \overset{?}{=} N_{d} = N_{i i}$ . Thus, user traceability attack can be successful.

2.2 User Impersonation Attack

Weng et al's scheme^[15] cannot resist user impersonation attack and the attack can be simulated as follows.

Step 1: According to the Section 2.1, the attacker can obtain the value of $A_{i} \oplus D_{i}$ of edge user EU_i. Based on user traceability attack, the attacker intercepts the message ${M_{U 1}^{}}_{i} = {T I D_{i}^{n e w 3}, E_{i}^{n e w 3}, F_{i}^{n e w 3}}$ sent by EU_i to the fog server. According to (6), the attacker can calculate the random number $r_{u}^{'}$ chosen by edge user EU_i this time; then, the attacker can calculate the new pseudonym updated by the user and cloud server CS at the end of this authentication by (7).

$r_{u}^{'} = D_{i} \oplus A_{i} \oplus E_{i}^{n e w 3}$ (6)

$T I D_{i}^{n e w 4} = T I D_{i}^{n e w 3} \oplus r_{u}^{'}$ (7)

Step 2: Assume that the attacker is a legitimately registered user, then, based on the analysis in Step 1, the attacker can know $A_{i} \oplus D_{i},$ $T I D_{i}^{n e w 4},$ h(K_cu). In the login and authentication phase, the attacker selects a fog server FS_j that he/she wants to contact and picks a random number r_A , calculates

$E_{i}^{n e w 4} = D_{i} \oplus A_{i} \oplus r_{A}^{}, F_{i}^{n e w 4} = h (h (K_{c u}) | | I D_{j} | | r_{A}) .$

Then, the attacker sends the message $M_{u 1}^{*} = {T I D_{i}^{n e w 4}, E_{i}^{n e w 4}, F_{i}^{n e w 4}}$ to the fog server FS_j.

Step 4: Upon receiving the message $M_{u 1}^{*}$ , FS_j chooses a random number r_f₁, and calculates

$O_{j 1} = B_{j} \oplus r_{f 1}, P_{j 1} = h (h (M K | | K_{c f}) | | T I D_{_{j}}^{n e w} | | r_{f 1}) .$

FS_j sends the message $M_{U 1}^{*}, M_{U 2}^{*} = {T I D_{j}^{n e w}, O_{j 1}, P_{j 1}}$ to the cloud server CS, where $T I D_{j}^{n e w}$ is the fog server FS_j's pseudonym.

Step 5: On receiving messages $M_{U 1}^{*}, M_{U 2}^{*},$ CS first checks the validity of pseudonyms; it is evident that $T I D_{i}^{n e w 4}$ , $T I D_{j}^{n e w}$ is valid, and then CS computes

$r_{_{A}}^{'} = E_{_{i}}^{n e w 4} \oplus B_{i}^{} \oplus h (M K | | K_{c u}), F_{i}^{n e w 4'} = h (h (K_{c u}) | | I D_{j} | | r_{_{A}}^{'}),$

$F_{i}^{n e w 4'} \overset{?}{=} F_{i}^{n e w 4} .$

This verification can pass, and the attacker can successfully impersonate user EU_i. Then, cloud server CS chooses a random number r_c₁,and computes

$\begin{array}{l} T I D_{i}^{n e w 5} = T I D_{i}^{n e w 4} \oplus r_{_{A}}^{'}, T I D_{j}^{n e w 2} = T I D_{_{j}}^{n e w} \oplus r_{f 1}^{'}, \\ Q_{j 1} = r_{A}^{'} \oplus r_{c 1} \oplus h (I D_{j} | | T I D_{j}^{n e w 2}), S K_{_{i j}}^{'} = h (r_{A}^{'} \oplus r_{c 1}^{} \oplus r_{f 1}^{'}), \\ R_{j 1} = h (B_{j} \oplus h (T I D_{j}^{n e w 2}) \oplus S K_{i j}^{'}), S_{j 1} = r_{f 1}^{'} \oplus r_{c 1} \oplus h (I D_{j} | | T I D_{i}^{n e w 5}) . \end{array}$

Then, the cloud server CS sends M_U3={Q_j₁, R_j₁}, M_U4={S_j₁,T_j₁} to the fog server FS_j.

Step 6: After receiving M_U3 and M_U4 from CS, the fog server FS_j computes

$\begin{array}{l} T I D_{j}^{n e w 2} = T I D_{j}^{n e w} \oplus r_{f 1}, r_{A}^{'} \oplus r_{c 1}^{'} = Q_{j 1} \oplus h (I D_{j} | | T I D_{j}^{n e w 2}), \\ S K_{i j} = h (r_{A}^{'} \oplus r_{c 1}^{'} \oplus r_{f 1}) . \end{array}$

Step 7: The attacker can also compute the session key by

$T I D_{i}^{n e w 5} = T I D_{i}^{n e w 4} \oplus r_{_{A}}^{}, r_{f 1}^{'} \oplus r_{c 1}^{'} = S_{j 1} \oplus h (I D_{j} | | T I D_{i}^{n e w 5}),$

$S K_{i j} = h (r_{f 1}^{'} \oplus r_{c 1}^{'} \oplus r_{A}) .$

Eventually, the attacker and the fog server FS_j agree on a session key SK_ij with the help of the cloud server CS.

3 The Improved Scheme

To overcome the shortcomings of Weng et al's scheme^[15], we propose an improved scheme in this section. In the registration phase, we add a password to make the improved scheme more complete, and we also avoid sending h(k_cu) and h(MK||K_cf) directly, this can prevent attackers from performing impersonation attack. In the login and authentication phase, to ensure that the improved scheme is resistant to user traceability attack, we also modify the calculation of E_i and add timestamps. The following is a detailed description of the improved scheme.

3.1 Deployment Phase

The cloud server CS generates a master secret key MK and two long-term secret keys K_cf and K_cu and keeps them secret. CS chooses a one-way Hash function h(·).

3.2 Fog Server Registration Phase

Fog server FS_j selects a unique identity ID_j and registers itself with CS by sending identity ID_j to CS via a secure channel. On receiving ID_j, CS generates a pseudonym TID_j and a random secret number n_f and computes $B_{j} = h (I D_{j} | | K_{c f})$ and $h (M K | | K_{c f} | | n_{f}) .$ CS publicizes fog server FS_j's identity ID_j. Then CS sends {TID_j,B_j,h(MK||K_cf||n_f)} to FS_j and maintains {TID_j, ID_j, B_j, n_f} in a protected verifier table. Finally, FS_j stores TID_j, B_j, and h(MK||K_cf||n_f) in its memory. The fog server registration phase is illustrated in Fig. 1.

Fig. 1 Fog server registration

3.3 Edge User Registration Phase

Edge user EU_i selects a unique identity ID_i, PW_i, and imprints his/her biometric BIO_i into a smart device. EU_i's smart device MD_i generates a random secret number n_u and computes

$G e n (B I O_{i}) = (σ_{i}, τ_{i}), P P W_{i} = h (P W_{i} | | n_{u}),$

$A_{i} = h (I D_{i} | | P P W_{i} | | σ_{i} | | n_{u}) .$

Then MD_i sends {A_i, ID_i, PPW_i} to CS through a secure channel. After receiving ID_i, A_iand PPW_i, CS generates a psedonym TID_i and computes

$B_{i} = h (I D_{i} | | M K), C_{i} = h (I D_{i} | | A_{i} | | h (K_{c u} | | P P W_{i})),$

$D_{i} = B_{i} \oplus h (M K | | K_{c u}) \oplus A_{i}, H_{i} = P P W_{i} \oplus h (M K | | K_{c u}) .$

Then CS sends ${T I D_{i}, C_{i}, D_{i}, h (\cdot), h (K_{c u} | | P P W_{i})}$ to EU_i via a secure channel and maintains ${T I D_{i}, B_{i}, H_{i}}$ in a protected verifier table. Finally, MD_i computes

$K = h (K_{c u} | | P P W_{i}) \oplus h (P P W_{i} | | σ_{i}), T I D_{i}^{'} = T I D_{i} \oplus h (I D_{i} | | σ_{i}) .$

Then, MD_i stores ${T I D_{i}^{'}, C_{i}, D_{i}, h (\cdot), K, n_{u}, R e p (\cdot), τ_{i}}$ in its memory. Edge user registration phase is explained in Fig. 2.

Fig. 2 Edge user registration

3.4 Authentication and Key Agreement Phase

In this phase, if an edge user EU_i wants to access a fog server FS_j through a public channel, EU_i and FS_j authenticate each other with the help of the cloud server CS and establish a session key SK_ij. The detailed steps are as follows and the detailed process is explicated in Fig. 3.

Fig. 3 Authentication and key agreement phase

Step 1: EU_i first inputs $I D_{i}^{'}, P W_{i}^{'}$ and imprints $B I O_{i}^{'}$ into his/her smart device MD_i. Then, MD_i computes

$σ_{i}^{'} = R e p (B I O_{i}^{'}, τ_{i}), P P W_{i}^{'} = h (P W_{i}^{'} | | n_{u}),$

$A_{i}^{'} = h (I D_{i}^{'} | | P P W_{i}^{'} | | σ_{i}^{'} | | n_{u}), h (K_{c u} | | P P W_{i})^{'} = K \oplus h (P P W_{i}^{'} | | σ_{i}^{'}),$

$C_{i}^{'} = h (I D_{i}^{'} | | A_{i}^{'} | | h (K_{c u} | | P P W_{i})^{'}),$

checks whether $C_{i}^{'} = C_{i}$ . If it does not hold, the smart device MD_i rejects the request and terminates the session. Otherwise, it means that this user is a legitimate smart device holder. Then, user EU_i selects a fog server FS_j that he/she wants to contact, selects a random number r_u, and generates a current timestamp T₁. MD_i computes

$T I D_{i} = T I D_{i}^{'} \oplus h (I D_{i} | | σ_{i}), M_{i} = r_{u} \oplus h (D_{i} \oplus A_{i}^{} \oplus T_{1}),$

$V_{i} = h (h (K_{c u} | | P P W_{i}) | | I D_{j} | | r_{u} | | T_{1}) .$

Finally, MD_i sends the request message $M_{u 1} = {T I D_{i}, M_{i}, V_{i}, T_{1}}$ to FS_j through a public channel.

Step 2: On receiving M_u₁, FS_j first checks the freshness of the message. Then, FS_j selects a random number r_f and a current timestamp T₂, and retrieves TID_j, B_j, and h(MK||K_cf ||n_f) to compute

$M_{j} = r_{f} \oplus h (B_{j} | | T_{2}), V_{j} = h (h (M K | | K_{c f} | | n_{f}) | | T I D_{j} | | r_{f} | | T_{2}) .$

Finally, FS_j sends messages M_u₁ and M_u₂ ={TID_j, M_j, V_j, T₂} to CS through a public channel.

Step 3: On receiving M_u₁ and M_u₂, CS first checks the freshness of the messages. If true, CS retrieves B_i, H_i and B_j, ID_j, n_f according to TID_i and TID_j, respectively. Then CS computes

$P P W_{_{i}}^{'} = H_{i} \oplus h (M K | | K_{c u}), r_{u}^{'} = M_{i} \oplus h (B_{i} \oplus h (M K | | K_{c u}) \oplus T_{1}),$

$V_{i}^{'} = h (h (K_{c u} | | P P W_{_{i}}^{'}) | | I D_{j} | | r_{_{u}}^{'} | | T_{1}) .$

CS checks whether $V_{i}^{'} = V_{i}$ . If it is not true, CS terminates the session. Otherwise, the legitimacy of EU_i is authenticated by CS. CS further computes

$r_{f}^{'} = M_{j} \oplus h (B_{j} | | T_{2}), V_{j}^{'} = h (h (M K | | K_{c f} | | n_{f}) | | T I D_{j} | | r_{f}^{'} | | T_{2}) .$

Then CS checks whether $V_{j}^{'} = V_{j}$ .

Step 4: After verifying the validity of EU_i and FS_j, CS refreshes new pseudonyms for EU_i and FS_j by computing

$T I D_{i}^{n e w} = T I D_{i} \oplus r_{u}^{'}, T I D_{j}^{n e w} = T I D_{j} \oplus r_{f}^{'}$

and replaces TID_iwith $T I D_{i}^{n e w}$ in the verifier table of EU_i, replaces TID_j with $T I D_{j}^{n e w}$ in the verifier table of FS_j. CS further selects a random number r_c and a current timestamp T₃ to compute

$\begin{array}{l} H_{j} = r_{u}^{'} \oplus r_{c} \oplus h (I D_{j} | | T I D_{j}^{n e w}), S K_{i j} = h (r_{u}^{'} \oplus r_{f}^{'} \oplus r_{c}), \\ I_{j} = h (B_{j} \oplus h (T I D_{j}^{n e w}) \oplus S K_{i j} \oplus T_{3}), \\ J_{i} = r_{f}^{'} \oplus r_{c} \oplus h (I D_{j} | | T I D_{i}^{n e w}), \\ K_{i} = h (B_{i} \oplus h (M K | | K_{c u}) \oplus h (T I D_{i}^{n e w}) \oplus S K_{i j} \oplus T_{3}) . \end{array}$

Finally, CS sends M_u₃ ={H_j, I_j, T₃} and M_u₄ ={J_i, K_i, T₃} to FS_j.

Step 5: On receiving M_u₃ and M_u₄, FS_j computes

$\begin{array}{l} T I {D_{j}^{'}}^{n e w} = T I D_{j} \oplus r_{f}, r_{u}^{'} \oplus r_{c}^{'} = H_{j} \oplus h (I D_{j} | | T I {D_{j}^{'}}^{n e w}), \\ S K_{i j} = h (r_{u}^{'} \oplus r_{c}^{'} \oplus r_{f}), I_{j}^{'} = h (B_{j} \oplus h (T I {D_{j}^{'}}^{n e w}) \oplus S K_{i j} \oplus T_{3}) . \end{array}$

FS_j checks if $I_{j}^{'} = I_{j}$ . If it holds, FS_j sends M_u₄ to EU_i.

Step 6: On receiving M_u₄, EU_i computes

$T I {D_{i}^{'}}^{n e w} = T I D_{i} \oplus r_{u}, r_{f}^{'} \oplus r_{c}^{'} = J_{i} \oplus h (I D_{j} | | T I {D_{i}^{'}}^{n e w}),$

$S K_{i j} = h (r_{f}^{'} \oplus r_{c}^{'} \oplus r_{u}), K_{i}^{'} = h (D_{i} \oplus A_{i} \oplus h (T I D_{i}^{n e w}) \oplus S K_{i j} \oplus T_{3}) .$

If $K_{i}^{'} = K_{i}$ , EU_i believes that CS and FS_j are legal parties and stores the shared session key SK_ij for future secure communication. Then, EU_i computes

$T I {D_{i}^{'}}^{n e w} = T I D_{i}^{n e w} \oplus h (I D_{i} | | σ_{i}),$

and replaces $T I D_{i}^{'}$ with $T I {D_{i}^{'}}^{n e w}$ in smart device's memory.

4 Security Analysis and Comparisons

4.1 Security Analysis

This section analyzes security of the improved scheme. We demonstrate the improved scheme's security features and resilience against various attacks.

4.1.1 User anonymity

The improved scheme has strong anonymity. During the authentication and key agreement phase, the edge user's identity is never shared openly or sent over the public channel; instead, the edge user sends his/her pseudonym TID_i. Even if an attacker intercepts the edge user's pseudonym TID_i, he/she cannot know the user's identity ID_i.

4.1.2 Password guessing attack

Assuming that an attacker gets all information ${T I D_{i}^{'}, C_{i}, D_{i}, h (\cdot), K, n_{u}, R e p (\cdot), τ_{i}}$ stored in the mobile device, the attacker performs password guessing attack based on $P P W_{i} = h (n_{u} | | P W_{i})$ . However, the attacker must know the values of PPW_i and n_u. Although the attacker knows the value of n_u, he/she cannot know the value of PPW_i. So, the attacker cannot guess the password.

4.1.3 Replay attack

An attacker may resend previous messages to cloud server for replay attack. However, this will not succeed because the improved scheme contains timestamp verifications, and the timestamps in past messages are not within an acceptable range. Resending past messages will cause the session to terminate. Even if an attacker can modify the timestamp T₁, the attacker does not know D_i, A_i, and h(K_cu||PPW_i), then the corresponding values M_i and V_i cannot be modified based on the new timestamp. Finally, the value of V_i sent by the attacker differs from $V_{i}^{'}$ calculated by the cloud server CS by (8), and verification $V_{i}^{'} \overset{?}{=} V_{i}$ cannot pass. Therefore, the improved scheme can resist replay attack.

$V_{i}^{'} = h (h (K_{c u} | | P P W_{i}) | | I D_{j} | | r_{u} | | T_{1})$ (8)

4.1.4 User untraceability

In the mutual authentication and key agreement phase, the user's identity is hidden by sending the pseudonym TID_i, and the user's pseudonym TID_i is updated every time by (9). Due to the inclusion of random number r_u in (9), the user's pseudonym will be different each time. Therefore, the attacker does not know what the user's next pseudonym $T I D_{i}^{n e w}$ will be.

$T I D_{i}^{n e w} = T I D_{i} \oplus r_{u}$ (9)

When the attacker intercepts EU_i's request message M_u₁={TID_i,M_i,V_i,T₁}, and stores {TID_i, M_i} as described in Section 2.1.

In the second authentication, even if the attacker intercepts EU_i's message $M_{u 1}^{'} =$ ${T I D_{i}^{n e w}, M_{i}^{'}, V_{i}^{'}, T_{1}^{'}}$ , the attacker computes

$M_{i} \oplus T I D_{i}^{n e w} \oplus T I D_{i} = h (D_{i} \oplus A_{i} \oplus T_{1}) .$

In the third authentication, assuming that the attacker intercepts EU_i's request message $M_{u 1}^{2} = {T I D_{i}^{n e w 2},$ $M_{i}^{2}, V_{i}^{2}, T_{1}^{2}}$ once again, the attacker computes

$M_{i}^{'} \oplus T I D_{i}^{n e w 2} \oplus T I D_{i}^{n e w} = h (D_{i} \oplus A_{i} \oplus T_{1}^{'}) .$

Because $h (D_{i} \oplus A_{i} \oplus T_{1})$ and $h (D_{i} \oplus A_{i} \oplus T_{1}^{'})$ contain timestamps $T_{1}, T_{1}^{'},$ which makes the value of $h (D_{i} \oplus A_{i} \oplus$ $T_{1})$ is not equal to the value of $h (D_{i} \oplus A_{i} \oplus T_{1}^{'})$ . Therefore, even if the attacker intercepts messages from the same user EU_i, the result of $M_{i} \oplus T I D_{i}^{n e w} \oplus T I D_{i}$ will be different every time, and the user traceability attack cannot be performed.

4.1.5 User impersonation attack

If an attacker intercepts $M_{u 1} = {T I D_{i}, M_{i}, V_{i}, T_{1}}$ sent by edge user EU_i on the public channel and assumes that the attacker obtains the user's data stored in the mobile device's memory ${T I D_{i}^{'}, C_{i}, D_{i}, h (\cdot), K, n_{u}, R e p (\cdot), τ_{i}}$ , if an attacker wants to impersonate the user to spoof the cloud server successfully, he/she must construct new M_i and V_i based on (10) and (11), so that the verification of the V_i can pass. Still, the attacker cannot construct a correct M_i and V_i, because the attacker cannot obtain the values of D_i, A_i, and h(K_cu||PPW_i). Therefore, the attacker cannot impersonate an edge user.

$M_{i} = r_{u} \oplus h (D_{i} \oplus A_{i} \oplus T_{1}),$ (10)

$V_{i} = h (h (K_{c u} | | P P W_{i}) | | I D_{j} | | r_{u} | | T_{1}) .$ (11)

4.1.6 Session key agreement

The improved scheme can achieve secure session key agreement. Edge user, fog server, and the cloud server CS can compute a shared session key $S K_{i j} = h (r_{u}^{} \oplus r_{f}^{} \oplus r_{c})$ . And the attacker cannot compute the correct session key because the random numbers r_u, r_f and r_c chosen by the three entities are protected by (12), (13), (14), (15); the attacker does not know the value of the random number r_u, r_f and r_cin the session key, so security of the session key in the improved scheme is guaranteed.

$M_{i} = r_{u} \oplus h (D_{i} \oplus A_{i}^{} \oplus T_{1})$ (12)

$M_{j} = r_{f} \oplus h (B_{j} | | T_{2})$ (13)

$H_{j} = r_{u}^{'} \oplus r_{c} \oplus h (I D_{j} | | T I D_{j}^{n e w})$ (14)

$J_{i} = r_{f}^{'} \oplus r_{c} \oplus h (I D_{j} | | T I D_{i}^{n e w})$ (15)

4.1.7 Mutual authentication

In the improved scheme, edge users, fog servers, and the cloud server can authenticate each other's identity. For example, the cloud server can authenticate the edge user's identity through the verification of V_iin (16), because the calculation of V_i includes h(K_cu||PPW_i), only edge user EU_i and the cloud server CS know the value of h(K_cu||PPW_i). Cloud server CS authenticates the fog server's identity via V_j in (17), because only fog server FS_j and CS know the value of $h (M K | | K_{c f} | | n_{f}) .$ Therefore, the attacker cannot impersonate the edge user or fog server.

$V_{i} = h (h (K_{c u} | | P P W_{i}) | | I D_{j} | | r_{u} | | T_{1})$ (16)

$V_{j} = h (h (M K | | K_{c f} | | n_{f}) | | T I D_{j} | | r_{f} | | T_{2})$ (17)

4.1.8 Denial of service attack

The improved scheme can resist denial of service attack. If an attacker wants to waste network resources for DOS attack, his fake messages must pass a verification. However, according to our analysis above, if the attacker impersonates user EU_i and sends messages to CS, this fake messages cannot pass the verification of V_i. Even if the attacker changes the timestamp, he/she cannot calculate the correct M_i, V_i, and V_j based on the changed timestamp. Therefore, V_i and V_j constructed by the attacker fail to pass the verification of the cloud server.

4.1.9 Perfect forward security

EU_i and FS_j negotiate the session key $S K_{i j} = h (r_{u}^{} \oplus r_{f}^{} \oplus r_{c})$ , where r_u, r_f, and r_c are all random numbers. The attacker cannot compute the correct session key because he/she does not know the values of the random numbers r_u, r_f,and r_cin the session key. The attacker cannot compute the following session key based on present random numbers, and if this session key is compromised, it does not affect the security of past and future session keys.

4.2 Comparison

This section compares the improved scheme with Weng et al's scheme^[15] and the other three schemes^[3,16,17]. According to Weng et al's scheme^[15], some symbols (H, X, Y, F) are defined and the execution times of these operations are given in Table 2. The results of the comparison of security features and computation costs are shown in Table 3 and Table 4, respectively.

As can be seen from Table 3, the improved scheme can resist various known attacks and has higher security than Weng et al's scheme^[15] and the other three schemes^[3,16,17]. From Table 4, it can be seen that our improved scheme requires less computation than Jia et al' scheme^[3], Chen et al's scheme^[17],and Ma et al's scheme^[16]. Because of the use of fuzzy extractor, the improved scheme requires more computation than Weng et al's scheme^[15]. However, the improved scheme can resist various known attacks and is more secure. It is worthwhile to add some necessary computations to ensure communication security.

Table 2

Approximate time required for various operations

Table 3

Security comparison of different schemes

Table 4

Comparison of computation costs

5 Conclusion

In this paper, we find that Weng et al's authentication scheme is not resistant to user traceability attack and user impersonation attack. We propose an improved scheme to overcome the weaknesses of Weng et al's scheme. We compare the improved scheme with several existing authentication schemes in terms of security features and calculation costs. The improved scheme not only completely overcomes the drawbacks of Weng et al's scheme but also meets the lightweight feature. Therefore, the improved scheme is suitable for use in fog computing.

References

Hamada M, Salem S A, Salem F M. LAMAS: Lightweight anonymous mutual authentication scheme for securing fog computing environments[J]. Ain Shams Engineering Journal, 2022, 13(6): 101752-101766. [CrossRef] [Google Scholar]
Wazid M, Das A K, Kumar N, et al. Design of secure key management and user authentication scheme for fog computing services[J]. Future Generation Computer Systems, 2019, 91(2): 475-492. [CrossRef] [Google Scholar]
Jia X, He D, Kumar N, et al. Authenticated key agreement scheme for fog-driven IoT healthcare system[J]. Wireless Networks, 2019, 25(8): 4737-4750. [CrossRef] [Google Scholar]
Lamport L. Password authentication with insecure communication[J]. Communications of the ACM, 1981, 24(11): 770-772. [CrossRef] [Google Scholar]
Hwang M S, Li L H. A new remote user authentication scheme using smartcards[J]. IEEE Transactions on Consumer Electronics, 2000, 46(1): 28-30. [CrossRef] [Google Scholar]
Juang W S. Efficient multi-server password authenticated key agreement using smart cards[J]. IEEE Transactions on Consumer Electronics, 2004, 50(4): 251-255. [CrossRef] [Google Scholar]
Das M L. Two-factor user authentication in wireless sensor networks[J]. IEEE Transactions on Wireless Communications, 2009, 8(3): 1086-1090. [CrossRef] [Google Scholar]
Kang B Y. Cryptanalysis on an E-voting scheme over computer network[J]. 2008 International Conference on Computer Science and Software Engineering, 2008, 3: 826-829. [NASA ADS] [CrossRef] [Google Scholar]
Xue K, Ma C, Hong P, et al. A temporal-credential-based mutual authenticationand key agreement scheme for wireless sensor networks[J]. Journal of Network and Computer Applications, 2013, 36(1): 316-323. [CrossRef] [Google Scholar]
Kalra S, Sood S K. Advanced password based authentication scheme for wireless sensor networks[J]. Journal of Information Security and Applications, 2015, 20: 37-46. [CrossRef] [Google Scholar]
Arij B A, Abid M, Meddeb A. A privacy-preserving authentication scheme in an edge-fog environment[J]. ACS International Conference on Computer Systems and Applications, 2018, 2017(10): 1225-1231. [Google Scholar]
Wu T Y, Yang L, Meng Q, et al. Fog-driven secure authentication and key exchange scheme for wearable health monitoring system[J]. Security and Communication Networks, 2021, 2021(4): 1-14. [Google Scholar]
Guo Y M, Zhang Z F, Guo Y J. Fog-centric authenticated key agreement scheme without trusted parties[J]. IEEE Systems Journal, 2021, 15(4): 5057-5066. [NASA ADS] [CrossRef] [Google Scholar]
Ali Z, Chaudhry S A, Mahmood K, et al. A clogging resistant secure authentication scheme for fog computing services[J]. Computer Networks, 2021, 185: 107731. [CrossRef] [Google Scholar]
Weng C Y, Li C T, Chen C L, et al. A lightweight anonymous authentication and secure communication scheme for fog computing services[J]. IEEE Access, 2021, 9(4): 145522-145537. [NASA ADS] [CrossRef] [Google Scholar]
Ma M M, He D B, Wang H Q, et al. An efficient and provably secure authenticated key agreement protocol for fog-based vehicular ad-hoc networks[J]. IEEE Internet Things, 2019, 6(5): 8065-8075. [CrossRef] [Google Scholar]
Chen C M, Huang Y, Wang K H, et al. A secure authenticated and key exchange scheme for fog computing[J]. Enterprise Information Systems, 2021, 15(1): 1-16. [NASA ADS] [CrossRef] [Google Scholar]
Rana M, Mahmood K, Saleem MA, et al. Towards a provably secure authentication protocol for fog-driven IoT-based systems[J]. Applied Sciences, 2023, 13(3): 1424-1424. [CrossRef] [Google Scholar]

All Tables

Table 1

Notations table

In the text

Table 2

Approximate time required for various operations

In the text

Table 3

Security comparison of different schemes

In the text

Table 4

Comparison of computation costs

In the text

All Figures

	Fig. 1 Fog server registration
In the text

	Fig. 2 Edge user registration
In the text

	Fig. 3 Authentication and key agreement phase
In the text

Current usage metrics show cumulative count of Article Views (full-text article views including HTML views, PDF and ePub downloads, according to the available data) and Abstracts Views on Vision4Press platform.

Data correspond to usage on the plateform after 2015. The current usage metrics is available 48-96 hours after online publication and is updated daily on week days.

Initial download of the metrics may take a while.

[1] Hamada M, Salem S A, Salem F M. LAMAS: Lightweight anonymous mutual authentication scheme for securing fog computing environments[J]. Ain Shams Engineering Journal, 2022, 13(6): 101752-101766. [CrossRef] [Google Scholar]

[2] Wazid M, Das A K, Kumar N, et al. Design of secure key management and user authentication scheme for fog computing services[J]. Future Generation Computer Systems, 2019, 91(2): 475-492. [CrossRef] [Google Scholar]

[3] Jia X, He D, Kumar N, et al. Authenticated key agreement scheme for fog-driven IoT healthcare system[J]. Wireless Networks, 2019, 25(8): 4737-4750. [CrossRef] [Google Scholar]

[4] Lamport L. Password authentication with insecure communication[J]. Communications of the ACM, 1981, 24(11): 770-772. [CrossRef] [Google Scholar]

[5] Hwang M S, Li L H. A new remote user authentication scheme using smartcards[J]. IEEE Transactions on Consumer Electronics, 2000, 46(1): 28-30. [CrossRef] [Google Scholar]

[6] Juang W S. Efficient multi-server password authenticated key agreement using smart cards[J]. IEEE Transactions on Consumer Electronics, 2004, 50(4): 251-255. [CrossRef] [Google Scholar]

[7] Das M L. Two-factor user authentication in wireless sensor networks[J]. IEEE Transactions on Wireless Communications, 2009, 8(3): 1086-1090. [CrossRef] [Google Scholar]

[8] Kang B Y. Cryptanalysis on an E-voting scheme over computer network[J]. 2008 International Conference on Computer Science and Software Engineering, 2008, 3: 826-829. [NASA ADS] [CrossRef] [Google Scholar]

[9] Xue K, Ma C, Hong P, et al. A temporal-credential-based mutual authenticationand key agreement scheme for wireless sensor networks[J]. Journal of Network and Computer Applications, 2013, 36(1): 316-323. [CrossRef] [Google Scholar]

[10] Kalra S, Sood S K. Advanced password based authentication scheme for wireless sensor networks[J]. Journal of Information Security and Applications, 2015, 20: 37-46. [CrossRef] [Google Scholar]

[11] Arij B A, Abid M, Meddeb A. A privacy-preserving authentication scheme in an edge-fog environment[J]. ACS International Conference on Computer Systems and Applications, 2018, 2017(10): 1225-1231. [Google Scholar]

[12] Wu T Y, Yang L, Meng Q, et al. Fog-driven secure authentication and key exchange scheme for wearable health monitoring system[J]. Security and Communication Networks, 2021, 2021(4): 1-14. [Google Scholar]

[13] Guo Y M, Zhang Z F, Guo Y J. Fog-centric authenticated key agreement scheme without trusted parties[J]. IEEE Systems Journal, 2021, 15(4): 5057-5066. [NASA ADS] [CrossRef] [Google Scholar]

[14] Ali Z, Chaudhry S A, Mahmood K, et al. A clogging resistant secure authentication scheme for fog computing services[J]. Computer Networks, 2021, 185: 107731. [CrossRef] [Google Scholar]

[15] Weng C Y, Li C T, Chen C L, et al. A lightweight anonymous authentication and secure communication scheme for fog computing services[J]. IEEE Access, 2021, 9(4): 145522-145537. [NASA ADS] [CrossRef] [Google Scholar]

[16] Ma M M, He D B, Wang H Q, et al. An efficient and provably secure authenticated key agreement protocol for fog-based vehicular ad-hoc networks[J]. IEEE Internet Things, 2019, 6(5): 8065-8075. [CrossRef] [Google Scholar]

[17] Chen C M, Huang Y, Wang K H, et al. A secure authenticated and key exchange scheme for fog computing[J]. Enterprise Information Systems, 2021, 15(1): 1-16. [NASA ADS] [CrossRef] [Google Scholar]

[18] Rana M, Mahmood K, Saleem MA, et al. Towards a provably secure authentication protocol for fog-driven IoT-based systems[J]. Applied Sciences, 2023, 13(3): 1424-1424. [CrossRef] [Google Scholar]