Contents Introduction
The rapid growth of micro-electromechanical system and Wireless Sensor Networks (WSNs) is due to heavy application of them in our everyday life in resource constrained and hostile environments (for instance places where wired networks cannot be deployed, such as forests) supporting real-time application in healthcare, military surveillance, wildlife monitoring, intelligent transportation, vehicular tracking and environment control to name few. Thus, the WSNs are integral part of our daily lives [13], [32]. The wireless sensors possess limited communication and computation resources, thus it is vital to ensure that these operations do not result in heavy consumption of sensor’s power resources. The above is because the external users are in interest to access real-time information from the nodes. A WSN is formed with the help of a gateway node and other sensor nodes where each specific sensor node collects a data from a region, and then the attained data is forwarded to the gateway node over the communication channel where the gateway node is presumed to be possessing high computational abilities as to meet the demands. The issue in WSN is to identify the authentic user and grant access to the data, which becomes a key challenge in IIOT environments.
Moreover, protecting the data from malicious access, modifications and eavesdropping is also necessary. To meet the above requirements, it is essential that the user gets authenticated first. The general approach used is that user, gateway and the sensor node get authenticated adhered to which a secure session key will be enabled such that the user and the sensor node can exchange data. To proceed with this, the user sends the authentication message to the gateway adhered to which the gateway initiates the communication with the said sensor which collects the information desired by the user. Now, the gateway receives the information from the sensor node which is then provided to the user. In the real-time access of data sensor, data is collected using a mobile device owned by a valid user. Figure 1 depicts the real-time flow of data between WSNs [1]–[3], [5], [6]. Although the WSN networks are efficient and environment friendly, there exists many security issues in the said network. Privacy and security are major concerns in a WSN networks [1]–[12]. The security requirements for the proposed work were motivated from [1]–[12], [14], [24]–[28], [48]. The following are the security requirements which are essential to ensure security (also a safe exchange environemnt) of the WSN based schemes.
Known Session Specific Temporary Information Attack: The knowledge of temporary session information such as random number or timestamp or any other data should not be sufficient for an adversary to derive the exchanged session key or any other sensitive data (such as pseudonym).
Computational DOS Attack: The execution of the overall process should occupy less computation and communication overheads while ensuring high grade security.
Perfect Forward Secrecy: Every session key must be unique and session key derived from a set of long-term keys of gateway node
$GW$ $U$ $SN$ Replay Attack: The gateway node
$GW$ $SN$ $U$ Impersonation Attack: The adversary should not be able to successfully impersonate the gateway node
$GW$ $SN$ $U$ $GW$ $SN$ De-synchronization Attack: In this attack the pseudonym stored at the gateway node
$GW$ $SN$ Suppress Replay Attack: The said attack exist due to different clock drift rates (the clocks counting time at different rates) of user’s mobile
$U$ $GW$ $SN$ $GW$ $U$ $SN$ Identity Compromise Impersonation Attack: In this attack if the identity of either gateway node
$GW$ $U$ $SN$ Man-in-the-Middle Attack: The active adversary observing the messages in the network should not be able to attain any vital information from traffic analysis or perform malicious attacks.
Un-linkability: In the said attack the adversary should not be able to link two authentication messages coming from the same user
$U$ Key-offset Attack: In this attack an active adversary can off-set the agreed session key by a value
$\sigma $ $U$ $GW$ Resist Stolen Device/ Smart Card Attack: In this attack, it is assumed that an adversary is able to corrupt the given device and attain the stored credentials on them, thus the knowledge of attained credentials should not be enough for an adversary to attain useful information to impersonate a valid user
$U$ Known Key Attack: If a session key of a given session is compromised then, it should be infeasible for an adversary to attain the session key of next session. Thus, an authentication and key exchange protocol must be designed such that it can withstand this attack.
A novel lightweight conditional privacy preserving authentication and key agreement protocol scheme, where the entities make use of hidden and dynamic modulus as to enhance security. The proposed work is such that exposure of all current session based group key agreement information will not be sufficient to derive future information of modulus or the session key.
A novel scheme where the authentication process is expedited, here the suppress relay is detected. The proposed work makes use of only hash, xor based functions and a sequence number as to expedite the authentication process.
Secure and dynamic probabilistic session key establishment protocol, where the entities make use of dynamic session modulus, thus every entity generates its unique session specific modulus using which they converges on the common session key.
Using pseudonyms of different sensor nodes to communicate, the following is used as to prevent exposure of identity of sensor node. Thus providing anonymity of the sensor node during communication.
Cryptanalyzing Xiong et al. scheme [6] and overcoming the vulnerabilities and weaknesses described in the review (of Xiong et al. scheme) and the related works section (of different schemes).
Related Works
In the recent years, many user authentication protocols have been proposed for WSNs. The schemes can be broadly classified into three categories, scheme deploying symmetric encryption, schemes deploying hash based approaches and scheme depending on public key approaches. Wong et al. [10] proposed a hash based user authentication which motivated towards a lightweight, less complex scheme. The said scheme resulted in fast authentication and met many security properties but the said work is vulnerable to replay attack, forgery attack and stolen-verifier attack, thus making it vulnerable to real-time application in WSNs. Das [11] proposed a two factor authentication scheme using a password authenticated smart cards, although the scheme deployed two factor authentication, but the scheme was vulnerable to mutual authentication, user anonymity, offline password guessing, gateway bypassing and masquerade attack. Gope and Hwang [5] presented a hash based authentication scheme for WSN, the proposed work presented a means via which two entities can agree on a session key using hash functions only, the proposed work promises a practical application in WSNs but the said work is vulnerable to untraceablity, de-synchronization, stolen device attack [6], KSSTI attack (as session key is dependent on the temporary information) and fails to provide sensor anonymity (as sensor identity is exposed), thus making the scheme vulnerable in IIOT environment. However, the proposed work highlighted vulnerabilities in [35]–[37] which motivates to design system overcoming these issues. Shi and Gong [12] proposed an ECC based authentication protocol but Choi et al. [1] depicted that the previous work is vulnerable as it suffered from key share attack and stolen smart card attack. Although Choi et al scheme claims to be secure, but it suffers from many attacks such as absence of user anonymity, untraceability, clock synchronization [6], KSSTI attack (as session key is based on it), cannot withstand sensor node corruption (as user associated credentials will get exposed), suppress replay attack (due to clock synchronization issue) and fails to provide sensor node anonymity as its identity is known to the user in advance, thus making it vulnerable to real-time application in IIOT. Nam et al. [2] presented a authentication protocol depending on ECC which presented a provably secure scheme but the said work is vulnerable as it lacks password change phase, wrong password detection [6], KSSTI attack (as session key is dependent on temporary information), suppress replay attack (due to clock synchronization issue) and fails to provide sensor node anonymity (identity of the sensor node is known), thus making the proposed work vulnerable in IIOT environment. Jiang et al. [3] scheme presents a two factor ECC based authentication two factor authentication scheme for high security but the proposed work is vulnerable as it fails to provide perfect forward secrecy, password change phase [6], KSSTI attack (as session key is dependent on it), suppress replay attack (due to clock synchronization issue), and withstand sensor node corruption (as its corruption can expose user associated credentials), thus making the scheme vulnerable in IIOT environment. Paliwal et al. [4] presented a group key agreement scheme using modular exponentiation, the proposed work is secure against DOS attack but the said work is vulnerable to replay attacks (absence of timestamp or random number), identity of all entities must be known in order to initiate a communication, thus loss of anonymity exists and cannot withstand impersonation thus the proposed work is vulnerable in IIOT environment, the same holds for [29] as it is vulnerable to suppress replay attack, fails to preserve identity of the entities and is vulnerable to KSSTI attack. Recently, Li et al. [6] presented a authentication and group key agreement scheme depending on ECC approach suitable for WSN and IIOT application, the proposed work is vulnerable to many attacks such as DOS Attack, KSSTI attack, impersonation attack (user, sensor node and gateway) and key-offset attack, the vulnerabilities are discussed in next section. The proposed work aims to provide an authentication and key-agreement protocol based on hash functions, the proposed work aims to overcome vulnerabilities of existing schemes such that it can be easily deployed in resource constrained environments. The security proofs, assumptions and practices are followed from [5], [21], [38]–[40] as these are hash based schemes, similar to proposed work.
Review of Xiong $et ~al$
In this section a briefly review of Xiong et al.’s authentication and key agreement scheme for WSNs in IIOT [6] is presented. The proposed work of Xiong et al. has three phases: Registration Phase, Authentication and Key-Agreement Phase and Password Change Phase. The focus is given on first two phases.
A. Registration Phase
All registrations take place over a secure channel, here both the sensor and user registration takes place. The initial section depicts the registration of the sensor and the later depicts the registration of the user.
1) Sensor Node Registration
For every sensor node
2) User Registration
In this phase the user is successfully registered with the gateway node
Step 1:
$U$ $ID_{U} $ $PW_{U}$ $Gen(BIO_{U})=(R_{U}, P_{U})$ $U$ $r_{U} $ $HPW_{U} =h(PW_{U} \vert \vert r_{U})$ $U$ $(ID_{U}, HPW_{U}, R_{U})$ $GW$ Step 2:
When the
$GW$ $GW$ $B_{1} =h(ID_{U} \vert \vert HPW_{U} \vert \vert R_{U})$ $B_{2} =h(ID_{U} \vert \vert \omega)$ $B_{3} =h(HPW_{U} \vert \vert R_{U})\oplus B_{2} $ $GW$ $(B_{1},B_{3}, X)$ $U$ Step 3:
$U$ $(P_{U}, r_{U}, B_{1}, B_{3},X,Gen(.),Rep(.))$
B. Authentication and Key-Agreement Phase
To gain access to the sensor data of the sensor node
Step 1:
$U\to GW:M_{1} =\{DID_{U}, D_{1}, D_{3}, D_{4} \}$ $U$ $ID_{U}, PW_{U}, BIO_{U}^{\prime } $ $R_{U} =Rep(BIO_{U}^{\prime }, P_{U})$ $B_{1}^{\prime } =h(ID_{U} \vert \vert h(PW_{U} \vert \vert r_{U})\vert \vert R_{U})$ $B_{1}^{\ast } \mathop{=}\limits^{?} B_{1} $ $U$ $a\in Z_{n}^{\ast } $ $B_{2} =B_{3} \oplus h(h(PW_{U} \vert \vert r_{U})\vert \vert R_{U})$ $D_{1} =aP$ $D_{2} =aX$ $DID_{U} =ID_{U} \oplus h(D_{2})$ $D_{3} =SN_{id} \oplus B_{2} \oplus h(D_{2})$ $D_{4} = h(B_{2} \vert \vert D_{2} \vert \vert SN_{id})$ $M_{1} $ Step 2:
$GW\to SN:M_{2} =\{D_{1}, D_{6}, D_{7} \}$ $GW$ $D_{2}^{\prime } =xD_{1} $ $ID_{U}^{\prime } =DID_{U} \oplus h(D_{2}^{\prime })$ $GW$ $B_{2}^{\prime } =h(ID_{U}^{\prime } \vert \vert \omega)$ $SN_{id}^{\prime } =D_{3} \oplus B_{2}^{\prime } \oplus h(D_{2}^{\prime })$ $D_{4}^{\prime } =h(B_{2}^{\prime } \vert \vert D_{2}^{\prime } \vert \vert SN_{id}^{\prime })$ $D_{4}^{\ast } \mathop{=}\limits^{?} D_{4} $ $GW$ $D_{5} =h(SN_{id}^{\prime } \vert \vert \omega)$ $D_{6} =D_{5} \oplus r_{G} $ $D_{7} =h(D_{1} \vert \vert r_{G} \vert \vert D_{5} \vert \vert SN_{id}^{\prime })$ $r_{G} $ $GW$ $GW$ $M_{2}$ $SN$ Step 3:
$SN\to GW:M_{3} =\{D_{8}, D_{9}, D_{10} \}$ $SN$ $r_{G}^{\prime } =K_{gs} \oplus D_{6} $ $D_{7}^{\prime } =h(D_{1} \vert \vert r_{G}^{\prime } \vert \vert K_{gs} \vert \vert SN_{id})$ $D_{7}^{\ast } \mathop{=}\limits^{?} D_{7} $ $SN$ $D_{8} =bP$ $SK=h(D_{1} \vert \vert D_{8} \vert \vert bD_{1})$ $D_{9} =h(K_{gs} \vert \vert D_{8} \vert \vert r_{G}^{\prime } \vert \vert SN_{id})$ $D_{10} =h(SN_{id} \vert \vert SK)$ $b\in Z_{n}^{\ast }$ $SN$ $M_{3} $ $GW$ Step 4:
$GW\to U:M_{4} =\{D_{8}, D_{10}, D_{11} \}$ $GW$ $D_{9} =h(D_{5} \vert \vert D_{8} \vert \vert r_{G} \vert \vert SN_{id}^{\prime })$ $D_{9}^{\ast } \mathop{=}\limits^{?} D_{9}$ $GW$ $D_{11} =h(ID_{U}^{\prime } \vert \vert D_{1} \vert \vert D_{8} \vert \vert B_{2}^{\prime })$ $M_{4}$ Step 5:
The mobile device computes
$(D_{11} =h(ID_{U}^{\prime } \vert \vert D_{1} \vert \vert D_{8} \vert \vert B_{2}^{\prime }))$ $D_{11}^{\ast } \mathop{=}\limits^{?} D_{11} $ $SK^{\prime }=h(D_{1} \vert \vert D_{8} \vert \vert aD_{8})$ $D_{10}^{\prime } =h(SN_{id} \vert \vert SK^{\prime })$ $(D_{10} =h(SN_{id} \vert \vert SK))$ $D_{10}^{\ast } \mathop{=}\limits^{?} D_{10} $
Security Weakness and Design Flaws in Xiong $et~al$
In this section various security vulnerabilities in the Xiong et al. scheme is presented. These attacks prove that the said scheme is vulnerable. Before proceeding with the attack, several security assumptions are made, using [1]–[14], [20], [21], [23]–[27]. Following are the assumptions.
Definition 1:
All the system messages (except registration) are transmitted via an unreliable channel; thus, an adversary can delete, modify, append, intercept or replay any message. However, an adversary is not able to attain any information which is taking place via secure channel.
Definition 2:
The length of the long term key and the random number is so long that the adversary is not able to guess the long term key or any random number used in the system.
Definition 3:
The adversary can corrupt any honest entity and attain the pre-shared secret information used by the entity or by the group of entities. Moreover, the adversary can be a valid registered entity in the system, thus can attain all shared information in advance.
Definition 4:
The adversary has unbounded storage space which helps the adversary store several messages.
Definition 5:
The adversary has access to all sensor identities in the said system.
A. DOS Attack
The attack focuses on making the resources of the system unavailable temporarily or permanently to the hosts connected over a network. In the Xiong et al. scheme the said system is vulnerable to Gateway Node DOS attack and Sensor Node DOS attack [5], [31].
1) Gateway Node DOS Attack
The Xiong et al. scheme is vulnerable to Gateway DOS attack; the following are the steps an active adversary can make to perform the said attack.
Step 1:
The adversary can capture the authentication message
$M_{1}$ $U$ Step 2:
Once sufficient number of messages are bundled, the adversary now sends these messages (
$M_{1}$ $GW$ $GW$ Step 3:
The gateway node
$GW$ Step 4:
The gateway node
$GW$ $GW$ $M_{1}$
Thus, processing these bundled requests can result in slower processing of valid requests by
2) Sensor Node DOS Attack
The Xiong et al. scheme is vulnerable to Sensor Node DOS attack; the following are the steps an active adversary can make to perform the said attack.
Step 1:
The adversary can capture the authentication message
$M_{2} $ $GW$ Step 2:
Once all the messages are bundled, the adversary now sends these messages (
$M_{2}$ $SN$ $SN_{id} $ $SN$ Step 3:
The sensor node
$SN$ $SN$ $SN$ Step 4:
The sensor node
$SN$
In above case if very high numbers of messages are bundled then there is a good probability that the sent message is indeed intended for the sensor node
B. Identity Compromise Impersonation Attack
It is possible that an adversary may attain knowledge of identity of the user via some wicked means (such as Dumpster Diving, social engineering, pretext, vishing, phishing or other means) [22]. These attacks are done using the
1) Attaining Secret Parameters (When Identity is Exposed) and Performing User Impersonation Attack
In the proposed Xiong et al. scheme if user identity is attained by some wicked means then the adversary can impersonate the valid user
Step 1:
The adversary captures a valid authentication message
$M_{1} =\{DID_{U}, D_{1}, D_{3}, D_{4} \}$ $DID_{U} $ $DID_{U} \oplus ID_{U} =h(D_{2})$ $h(D_{2})$ $D_{3} $ $D_{3} \oplus SN_{ID} \oplus h(D_{2})=B_{2} $ $B_{2} $ $SN_{id} $ Step 2:
To validate the attained credentials the adversary generates a random number
$u$ $\{E,G,n,P,X\}$ $D_{1} =uP$ $D_{2} =uX$ $DID_{U} =ID_{U} \oplus h(D_{2})$ $D_{3} =SN_{id} \oplus B_{2} \oplus h(D_{2})$ $D_{4} =h(B_{2} \vert \vert h(D_{2})\vert \vert SN_{id})$
The above is feasible as in the system there are only limited sensor identities; the adversary can brute force the identities of
Further the adversary can impersonate the valid user
2) Key-Offset Attack
The previous knowledge can help perform key-offset attack [30]. The following are the steps the active adversary can take to proceed with a key-offset attack.
Step 1:
The adversary as before attains the values of
$B_{2}$ $SN_{id} $ $M_{4} =\{D_{8}, D_{10}, D_{11} \}$ $DID_{U} \oplus ID_{U} =h(D_{2})$ Step 2:
Once the said credentials are captured then the adversary generates a random number
$k$ $D_{8}^{Malicious} =kP$ $SK=h(D_{1} \vert \vert D_{8}^{Malicious} \vert \vert kD_{1})$ $D_{10}^{Malicious} =h(SN_{id} \vert \vert SK)$ $SN_{ID} =D_{3} \oplus B_{2} \oplus h(D_{2})$ $D_{11}^{Malicious} =h(ID_{U}^{\prime } \vert \vert D_{1} \vert \vert D_{8}^{Malicious} \vert \vert B_{2}^{\prime })$ $M_{4}^{Malicious} =\{D_{8}^{Malicious},D_{10}^{Malicious}, D_{11}^{Malicious} \}$ Step 3:
The mobile device now computes and checks if
$D_{11}^{\ast } \mathop{=}\limits^{?} D_{11} $ $SK^{\prime }=h(D_{1} \vert \vert D_{8}^{Malicious} \vert \vert aD_{8}^{Malicious})$ $D_{10}^{\ast } \mathop{=}\limits^{?} D_{10} $ $k$
C. Known Session Specific Temporary Information Attack (KSSTI Attack)
The said attack makes the scheme highly vulnerable; the consequence of this attack produces vulnerabilities such as impersonation (user, gateway node and sensor node) attaining the session key and Modification attack [23], [30]. In this attack only session specific information such as nonce, timestamp, etc. are exposed, whereas the long term secrets are kept still unknown to the adversary.
1) User Impersonation
If the adversary is able to attain the session specific information ‘
Step 1:
The adversary fetches the message
$M_{1} =\{DID_{U},D_{1}, D_{3}, D_{4} \}$ $D_{2} =aX$ $\{E,G,n,P,X\}$ $DID_{U} \oplus h(D_{2})=ID_{U}$ $D_{3} \oplus SN_{ID} \oplus h(D_{2})= B_{2} $ $B_{2}^{\ast } $ $D_{4}^{\ast } \mathop{=}\limits^{?} D_{4} $ $SN_{id} $ Step 2:
The adversary to gain access to any particular sensor node can generate authentication messages from this point as the value of
$\{ID_{U}, B_{2}, SN_{id} \}$ $SN$ $M_{1} =\{DID_{U}, D_{1}, D_{3}, D_{4} \}$
2) Gateway Node Impersonation and Sensor DOS Attack
If the adversary is able to attain the session specific information ‘
Step 1:
The adversary fetches the message
$M_{2} =\{D_{1}, D_{6},D_{7} \}$ $D_{6} \oplus r_{G} =D_{5} $ $K_{gs} $ $SN$ $D_{7}^{\ast } \mathop{=}\limits^{?} D_{7}$ Step 2:
Once the long term key is attained then the adversary can impersonate the gateway node for this the adversary generates
$M_{2}^{Malicious} =\{D_{1}, D_{6}^{Malicious}, D_{7}^{Malicious} \}$ $D_{6}^{Malicious} =_{}D_{5} \oplus r_{G}^{Malicious}$ $D_{7}^{Malicious} =h(D_{1} \vert \vert r_{G}^{Malicious} \vert \vert D_{5} \vert \vert {SN_{id}}^{\prime })$ $SN$
Step 1:
The adversary generates multiple
$M_{2}^{Malicious} =\{D_{1}^{Malicious}, D_{6}^{Malicious}, D_{7}^{Malicious} \}$ $D_{1}^{Malicious} =AP$ $A$ $D_{6}^{Malicious} =D_{5} \oplus B$ $B$ $D_{7}^{Malicious} =h(D_{1} \vert \vert B\vert \vert D_{5} \vert \vert SN_{id}^{\prime })$ Step 2:
The sensor node verifies the attained credentials of message
$M_{2}^{Malicious} $ $M_{3} $
3) Sensor Node Impersonation and Key-Offset Attack
If the adversary is able to attain the session specific information ‘
Step 1:
The step is similar to that of gateway node impersonation, the adversary attains the credentials similar to the step1 (as depicted in gateway node impersonation) adhered to which the adversary produces fraudulent message
$M_{3}^{Malicious} =\{D_{8}^{Malicious}, D_{9}^{Malicious}, D_{\vphantom {D_{j}}10}^{Malicious} \}$ $GW$ $D_{8}^{Malicious} =CP, SK=h(D_{1} \vert \vert D_{8}^{Malicious} \vert \vert CD_{1})$ $C$ $D_{9}^{Malicious} =h(K_{gs} \vert \vert D_{8}^{Malicious} \vert \vert r_{G}^{\prime } \vert \vert SN_{id})$ $D_{10}^{Malicious} =h(SN_{id}\vert \vert SK)$ Step 2:
The gateway node
$GW$ $D_{9}^{\ast } \mathop{=}\limits^{?} D_{9}^{Malicious} $ $GW$ $M_{4} =\{D_{8}^{Malicious}, D_{10}^{Malicious}, D_{11} \}$ $U$ $D_{11} =h(ID_{U} ^{\prime }\vert \vert D_{1} \vert \vert D_{8} \vert \vert B_{2}^{\prime })$ Step 3:
The mobile device of user
$U$ $D_{11}^{\ast } \mathop{=}\limits^{?} D_{11} $ $SK=h(D_{1} \vert \vert D_{8} \vert \vert aD_{8})$ $D_{10}^{\ast } \mathop{=}\limits^{?} D_{10} $
The same approach can be used to perform key-offset attack as the knowledge of all sensor node credentials is exposed. The following are the steps an adversary will take to perform key-offset attack.
Step 1:
The adversary captures the message
$M_{2} =\{D_{1},D_{6}, D_{7} \}$ $D_{1}$ $r_{G}^{\prime } =D_{6} \oplus K_{gs} $ $M_{3} =\{D_{8},D_{9}, D_{10} \}$ Step 2:
Once the said credentials are discarded then the adversary generates a random number
$k$ $D_{8}^{Malicious} =kP$ $SK=h(D_{1} \vert \vert D_{8}^{Malicious} \vert \vert kD_{1})$ $D_{9}^{Malicious} =h(K_{gs} \vert \vert D_{8}^{Malicious} \vert \vert r_{G}^{\prime } \vert \vert SN_{id})$ $D_{10}^{Malicious} =h(SN_{id} \vert \vert SK)$ $M_{3}^{Malicious} =\{D_{8}^{Malicious}, D_{9}^{Malicious},D_{10}^{Malicious} \}$ Step 3:
The gateway node validates the credentials by checking if
$D_{9}^{\ast } \mathop{=}\limits^{?} D_{9}^{Malicious} $ $k$
4) Attaining the Session Key
Here, if the adversary is given access to either of the ephemeral ‘
Proposed Scheme
In the proposed scheme there are three phases: Registration Phase, Authentication and Key-Agreement Phase and Password Change Phase.
A. Registration Phase
In this phase both the sensor node and the user is registered so that secure communication can take place in the system.
1) Sensor Node Registration
In this phase sensor node
2) User Registration
In this phase the user
Step 1:
The user
$U$ $ID_{U} $ $Pwd$ $Nonce_{U} $ $Timestamp_{U} $ $U$ $PublicIdentifier_{U} =h(ID_{U} \oplus Timestamp_{U} \oplus Nonce_{U})$ $HPwd=h(Pwd\vert \vert Nonce_{U} \vert \vert Timestamp_{U})$ $\{ID_{U}, PublicIdentifier_{U}, HPwd\}$ $GW$ Step 2:
The gateway node
$GW$ $ID_{U} $ $GW$ $GW_{1} =h(K\vert \vert ID_{U})\oplus Nonce_{GW} $ $GW_{2} =HPwd\oplus Ke y_{U} $ $GW_{3} =h(ID_{U} \vert \vert Key_{U} \vert \vert HPwd\vert \vert GW_{1})$ $Nonce_{GW} $ $GW$ $Key_{U} $ $GW$ $(Seq_{Num})$ $\{PublicIdentifier_{U}, GW_{1}, GW_{2}, GW_{3},Seq_{Num}, H(.)$ $Mod_{Set} \}$ $U$ Step 3:
Now,
$U$ $Nonce_{U} $ $Timestamp_{U} $ $\{PublicIdentifier_{U}$ $GW_{1}$ $GW_{2}$ $GW_{3}$ $Nonce_{U}$ $Seq_{Num}$ $Timestamp_{U}, H(.),Mod_{Set} \}$
B. Authentication and Key-Agreement Phase
In this phase the user
Step 1:
$U\to GW:M_{1} = \{PublicIdentifier_{U}$ $H_{\alpha 1}$ $H_{\alpha 2}$ $Timestamp_{U}^{1}, PublicIdentifier_{SN} \}$ The user
$U$ $ID_{U} $ $Pwd$ $HPwd^{\ast }=h(Pwd^{\ast }\vert \vert Nonce_{U} \vert \vert Timestamp_{U})$ $Nonce_{U} $ $Timestamp_{U} $ $GW_{2} \oplus HPwd^{\ast }=Key_{U}^{\ast } $ $h(ID_{U}^{\ast } \vert \vert Key_{U}^{\ast } \vert \vert HPwd^{\ast }\vert \vert GW_{1})^{\ast }\mathop{=}\limits^{?} GW_{3} $ $Nonce_{U}^{1} $ $Timestamp_{U}^{1} $ $H_{\alpha 1} =h(Nonce_{U}^{1}~\vert \vert ~GW_{2} ~\vert \vert ~Key_{U} ~\vert \vert ~ PublicIdentifier_{U} \vert \vert Timestamp_{U}^{1} \vert \vert ~PublicIdentifier_{SN})\oplus Seq_{Num} $ $H_{\alpha 2} =H(PublicIdentifier_{U} \vert \vert ~GW_{1}~\vert \vert ~PublicIdentifier_{SN} ~\vert \vert ~ID_{U} ~\vert \vert ~ Timestamp_{U}^{1} ~\vert \vert ~HPwd)~\oplus Nonce_{U}^{1} $ $h_{1} =h(Nonce_{U}^{1} \vert \vert ID_{U} \vert \vert Key_{U})$ $h_{2} =h(ID_{U} \vert \vert Seq_{Num} \vert \vert HPwd)$ $h_{3} =h(Timestamp_{U}^{1} \vert \vert Seq_{Num} \vert \vert ~PublicIdentifier_{U} ~\vert \vert ~ ID_{U} ~\vert \vert ~ Nonce_{U}^{1})$ $Mod_{Set} $ $GW$ Step 2:
$GW\to U:M_{2} =\{PublicIdentifier_{U}$ $H_{\alpha 3}$ $H_{\alpha 4}$ $H_{\alpha 5}, Timestamp_{GW}, A,B\} ~GW\to SN:M_{3} =\{PublicIdentifier_{SN}$ $H_{\alpha 6}$ $H_{\alpha 7}$ $H_{\alpha 8}$ $Timestamp_{GW}$ $A_{SN}$ $B_{SN} \}$ The gateway node
$GW$ $Timestamp_{x} -Timestamp_{U}^{1} \le \Delta T$ $GW$ $PublicIdentifier_{U} $ $GW$ $H_{\alpha 2} \oplus H(PublicIdentifier_{U}^{\ast }~\vert \vert ~ GW_{1} \vert \vert PublicIdentifier_{SN} \vert \vert ID_{U} \vert \vert ~Timestamp_{U}^{1\ast }~\vert \vert ~ HPwd)=Nonce_{U}^{1\ast }$ $GW$ $H_{\alpha 1}^{\ast } \mathop{=}\limits^{?} H_{\alpha 1} $ $GW$ $h_{1}, h_{2},h_{3} $ $GW$ $SN$ $PublicIdentifier_{SN} $ $GW$ $Nonce_{GW1} $ $SN$ $h_{4} =h(Nonce_{GW1} \vert \vert ID_{SN} \vert \vert Nonce_{SN} \vert \vert Key_{SN})$ $h_{5} =h(ID_{SN} \vert \vert Seq_{SN} \vert \vert Nonce_{GW1})$ $h_{6} =h(Timestamp_{GW} \vert \vert Seq_{SN} \vert \vert ~PublicIdentifier_{SN} ~\vert \vert ~ID_{SN} ~\vert \vert ~ Nonce_{GW1})$ $Mod_{Set} $ $GW$ $GW$ $GW$ $A$ $B$ $Key_{Session} = [\{A\bmod (h_{1})\}\cdot \{B\bmod (h_{2})\}] \bmod (h_{3})$ $GW$ $A_{SN} $ $B_{SN}$ $[\{B_{SN} \bmod (h_{5})\}]\bmod (h_{6})=[Key_{Session} \cdot ~\cdot \{A_{SN} \bmod (h_{4})\}^{-1}\bmod (h_{6})]\bmod (h_{6})$ $GW$ $Key_{Session} =[\{A\bmod (h_{1})\}\cdot \{B\bmod (h_{2})\}]\bmod (h_{3})$ $GW$ $h_{4} $ $h_{5}$ $h_{6} $ $A_{SN} \bmod (h_{4})$ $GW$ $B_{SN} $ $Key_{Session} =[\{A_{SN} \bmod (h_{4})\}\cdot \cdot \{B_{SN} \bmod (h_{5})\}]\bmod (h_{6}))$ $GW$ $M_{2} =\{PublicIdentifier_{U} ~,H_{\alpha 3}, H_{\alpha 4}, H_{\alpha 5}, Timestamp_{GW}, A,B\}$ $H_{\alpha 3} =h(PublicIdentifier_{U} ~\vert \vert ~ Timestamp_{GW} ~\vert \vert ~ NewSeq_{Num} ~\vert \vert ~ ~Nonce_{G} ~\vert \vert ~ Timestamp_{U}^{1})\oplus NewPublicIdentifier_{U}$ $NewPublicIdentifier_{U} =h(Timestamp_{GW} ~\vert \vert ~ ID_{U} ~\vert \vert ~ Nonce_{GW} ~ \vert \vert ~Key_{v1} ~\vert \vert ~ Nonce_{U}^{1} ~\vert \vert ~ Timestamp_{U}^{1})$ $H_{\alpha 4} =h(Timestamp_{U}^{1} ~\vert \vert ~Timestamp_{GW} ~\vert \vert ~B~\vert \vert ~ Nonce_{U}^{1} ~\vert \vert ~ PublicIdentifier_{U} ~\vert \vert ~ Key_{v1})\oplus ~Nonce_{G} \oplus Nonce_{U}^{1} $ $H_{\alpha 5} =h(Nonce_{U}^{1} ~\vert \vert ~ ID_{U} ~\vert \vert ~ A~\vert \vert ~PublicIdentifier_{U} ~\vert \vert ~ NewPublicIdentifier_{U} \vert \vert B \vert \vert Timestamp_{GW}~\vert \vert ~ Timestamp_{U}^{1})\oplus NewSeq_{Num} $ $M_{3} =\{PublicIdentifier_{SN}$ $H_{\alpha 6},H_{\alpha 7}, H_{\alpha 8}, Timestamp_{GW}, A_{SN}, B_{SN} \}$ $H_{\alpha 6} =h(Nonce_{GW1} ~\vert \vert ~ Key_{SN} ~\vert \vert ~ B_{SN}~\vert \vert ~ Timestamp_{GW} ~\vert \vert ~PublicIdentifier_{SN} ~\vert \vert ~ NewSeq_{SNNum})\oplus Seq_{SN} $ $H_{\alpha 7} =h(PublicIdentifier_{SN} ~\vert \vert ~ ID_{SN} ~\vert \vert ~ Timestamp_{GW}~\vert \vert ~ A_{SN})\oplus ~Nonce_{GW1} $ $H_{\alpha 8} =Seq_{SN} \oplus h(Key_{SN} \oplus Seq_{SN})\oplus NewSeq_{SNNum} $ $M_{2}$ $M_{3}$ Step 3:
The mobile device when receiving the message
$M_{2} $ $Timestamp_{x} -Timestamp_{GW} \le \Delta T$ $H_{\alpha 4} \oplus ~Nonce_{U}^{1} \oplus h(Timestamp_{U}^{1} ~\vert \vert ~ Timestamp_{GW}^{\ast } ~\vert \vert ~ B^{\ast }~\vert \vert ~ Nonce_{U}^{1} \vert \vert ~PublicIdentifier_{U} ~\vert \vert ~ Key_{v1})=Nonce_{G}^{\ast }$ $NewPublicIdentifier_{U}^{\ast } =h(Timestamp_{GW}^{\ast }~\vert \vert ~ ID_{U} ~\vert \vert ~ Nonce_{GW}^{\ast }~\vert \vert ~ Key_{v1} ~\vert \vert ~ Nonce_{U}^{1} \vert \vert ~Timestamp_{U}^{1})$ $H_{\alpha 5} \oplus h(Nonce_{U}^{1} ~\vert \vert ~ ID_{U} ~\vert \vert A^{\ast }\vert \vert ~ PublicIdentifier_{U} ~\vert \vert ~ NewPublicIdentifier_{U}^{\ast } ~\vert \vert ~ B^{\ast }~\vert \vert ~ Timestamp_{GW}^{\ast } \vert \vert ~Timestamp_{U}^{1}) =NewSeq_{Num}^{\ast } $ $H_{\alpha 3}^{\ast } \mathop{=}\limits^{?} H_{\alpha 3} $ $Key_{Session} =[\{A\bmod (h_{1})\}\cdot \{B\bmod (h_{2})\}]\bmod (h_{3})$ Step 4:
The sensor node
$SN$ $M_{3} $ $Timestamp_{x} -Timestamp_{GW} \le \Delta T$ $SN$ $H_{\alpha 7} \oplus h(PublicIdentifier_{SN} \vert \vert ID_{SN} \vert \vert Timestamp_{GW} ^{\ast }\vert \vert A_{SN}^{\ast })=Nonce_{GW1}^{\ast }$ $H_{\alpha 8} \oplus h(Key_{SN} \oplus Seq_{SN})\oplus Seq_{SN} =NewSeq_{SNNum}^{\ast }$ $H_{\alpha 6}^{\ast } \mathop{=}\limits^{?} H_{\alpha 6} $ $h_{4}$ $h_{5}$ $h_{6}$ $Key_{Session} =[\{A_{SN} \bmod (h_{4})\}\cdot \{B_{SN} \bmod (h_{5})\}]\bmod (h_{6})$ Consider a small example, let us assume that the values of
$\{h_{1},h_{2}, h_{3}, h_{4}, h_{5}, h_{6} \}$ $\{h_{1} =79,h_{2} =102$ $,h_{3} =550,h_{4} =997,h_{5} =99,h_{6} =571\}$ $GW$ $(A,B)$ $GW$ $Mod_{Set} $ $(A,B,h_{4},h_{5}, h_{6})$ $\{h_{1}, h_{2}, h_{3} \}$ $GW)$ $GW$ $(A,B),(A_{SN}, B_{SN})$ $[A\bmod (79)\ast B\bmod (102)]\bmod (550)=[A_{SN} \bmod (997)\ast B_{SN} \bmod (99)]\bmod (571)$ $GW$ $\{A=466,B=495,A_{SN} =449\}$ $GW$ $\{B_{SN} \}$ $\{B_{SN} =13\}$ $GW$ $127=[466\bmod (79)\ast 495\bmod (102)]\bmod (550)=[449\bmod (997)\ast 13\bmod (99)]\bmod (571)$ $GW$ $GW$ $\{A_{SN}, B_{SN} \}$ $\{A_{SN}, B_{SN} \}$ $A$ $A_{SN} $ $B$ $B_{SN}$ Step 5:
Both the mobile device and the sensor node send the hello message to the gateway node by using appropriate pseudonym and credentials (comprising data encrypted using the exchanged session key, where the data is the pseudonym, timestamp and the sequence numbers which were communicated earlier) when the first comm-unication is initiated. Thus, confirming the credibility of the session key, if either entity fails to send the message, the said session is terminated by the
$GW$
In the proposed scheme, every exchanged info-rmation plays a very crucial role, for instance the role of random number generated by the
C. Password Change Phase
In this phase the user decides to change the password enabled on the device. The following are the steps involved in this phase.
Step 1:
The user
$U$ $ID_{U}$ $Pwd$ $HPwd^{\ast }=h(Pwd^{\ast }\vert \vert Nonce_{U} \vert \vert Timestamp_{U})$ $Nonce_{U} $ $Timestamp_{U} $ $GW_{2} \oplus HPwd^{\ast }=Key_{U}^{\ast }$ $h(ID_{U}^{\ast } \vert \vert Key_{U}^{\ast } \vert \vert HPwd^{\ast } \vert \vert GW_{1})^{\ast }\mathop{=}\limits^{?} GW_{3} $ $U$ $Pwd_{New}$ $HPwd=h(Pwd_{New} \vert \vert Nonce_{U} \vert \vert Timestamp_{\delta })$ $Timestamp_{\delta } $ $GW_{2}^{New} =HPwd_{New} \oplus Key_{U} $ $GW_{3}^{New} = h(ID_{U} \vert \vert Key_{U} \vert \vert HPwd_{New} \vert \vert GW_{1})$ $U$ $GW$ $M_{4} =\{PublicIdentifier_{U}, H_{\alpha }, H_{\beta }, Timestamp_{\delta } \}$ $H_{\alpha } =h(Pwd\vert \vert HPwd\vert \vert ID_{U} \vert \vert Timestamp_{U} \vert \vert Seq_{Num})\oplus HPwd_{New} $ $H_{\beta } =h(HPwd_{New} \vert \vert ~Timestamp_{\delta } \vert \vert Seq_{Num})$ $U$ $M_{4} =\{PublicIdentifier_{U}, H_{\alpha } $ $H_{\beta },Timestamp_{\delta } \}$ $GW$ Step 2:
The
$GW$ $H_{\alpha } \oplus H(Pwd ~\vert \vert ~ HPwd\vert \vert ID_{U} \vert \vert ~Timestamp_{U}^{\ast } \vert \vert Seq_{Num})=HPwd_{New}^{\ast } $ $H_{\beta }^{\ast } \mathop{=}\limits^{?} H_{\beta } $
Security Analysis
In this section, an analysis is provided so that it is evident to the readers as of how the proposed scheme is secure against and it resists various wicked attacks.
A. Authentication Proof Using BAN Logic
BAN logic is used for examining the security of any authentication protocol. The aim is to ensure that successful authentication is taking place. The logic defined in [7], [15]–[18] is used to provide security proof of the protocol. For proving the depicted goals in later part, approach similar to that of [7], [15] is used. Following are the set of rules of interest.
Message Meaning Rule:
$R_{1} :\frac {P\vert \equiv P \mathrel {\mathop {\longleftrightarrow }\limits ^{K}}Q,P\triangleleft \{X\}_{K}}{P\vert \equiv Q\vert \sim X}$ Nonce Verification Rule:
$R_{2} :\frac {P\vert \equiv \# (X),P\vert \equiv Q\vert \sim X}{P\vert \equiv Q\vert \equiv X}$ Jurisdiction Rule:
$R_{3} :\frac {P\vert \equiv Q\Rightarrow X,P\vert \equiv Q\vert \equiv X}{P\vert \equiv X}$ Freshness Rule:
$R_{4} :\frac {P\vert \equiv \# (X)}{P\vert \equiv \# (X,Y)}$ Belief Rule:
$R_{5} :\frac {P\vert \equiv (X,Y)}{P\vert \equiv (X)}$ Seeing Rule:
$R_{6} :\frac {P\triangleleft (X,Y)}{P\triangleleft (X)}$ ER1 or Hash Verification Rule ([15]):
$R_{7} :\frac {P\vert \equiv Q \mathrel {\mathop {\longleftrightarrow }\limits ^{K}} P,P\triangleleft f(X,Y)}{P\vert \equiv Q\vert \sim X}$ Session Key Rule:
$R_{8} :\frac {P\vert \equiv \# (X),P\vert \equiv Q\vert \equiv X}{P\vert \equiv P \mathrel {\mathop {\longleftrightarrow }\limits ^{K}} Q}$
\begin{equation*} \hspace {-2pc}U \mathrel {\mathop {\!\!\!\leftarrow \!\!\!-\!\!\!-\!\!\!\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{~~PublicIdenitfier_{U}, Key_{V1}, GW_{1}, GW_{2}, GW_{3}, Seq_{Num}, ID_{U}, HPwd}}GW\end{equation*} View Source
\begin{equation*} \hspace {-2pc}U \mathrel {\mathop {\!\!\!\leftarrow \!\!\!-\!\!\!-\!\!\!\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{~~PublicIdenitfier_{U}, Key_{V1}, GW_{1}, GW_{2}, GW_{3}, Seq_{Num}, ID_{U}, HPwd}}GW\end{equation*}
\begin{equation*} \hspace {-2pc}GW \mathrel {\mathop {\!\!\!\leftarrow \!\!\!-\!\!\!-\!\!\!\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{~~PublicIdenitfier_{U}, Key_{V1}, GW_{1}, GW_{2}, GW_{3}, Seq_{Num}, ID_{U}, HPwd}} U\end{equation*} View Source\begin{equation*} \hspace {-2pc}GW \mathrel {\mathop {\!\!\!\leftarrow \!\!\!-\!\!\!-\!\!\!\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{~~PublicIdenitfier_{U}, Key_{V1}, GW_{1}, GW_{2}, GW_{3}, Seq_{Num}, ID_{U}, HPwd}} U\end{equation*}
$GW \mathrel {\mathop {\!\!\!\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{PublicIdenitfier_{SN}, ID_{SN}, Seq_{SN}, Key_{SN}}} SN$ $SN \mathrel {\mathop {\!\!\! \leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{~~PublicIdenitfier_{SN}, ID_{SN}, Seq_{SN}, Key_{SN}}} GWGW\vert \equiv U\Rightarrow {GW}$ $Gw \vert \equiv GW\Rightarrow (H_{\alpha 1}, H_{\alpha 2}, Nonce_{U}, h_{1}, h_{2}, h_{3})$ $U\vert \equiv GW\Rightarrow (H_{\alpha 3}, H_{\alpha 4}, H_{\alpha 5}, Nonce_{GW}, NewSeq_{Num}$ $NewPublicIdentifier_{U}, A,B)$ $SN\vert \!\equiv \! GW\!\Rightarrow \! (H_{\alpha 6}, H_{\alpha 7}, H_{\alpha 8}, Nonce_{GW1}, NewSeq_{Num}, A_{SN}, B_{SN})$ $U\vert \equiv \# (Timestamp_{GW}$ $Nonce_{G}$ $NewSeq_{Num}$ $NewPublicIdentifier_{U}$ $A$ $B)$ $GW\vert \equiv \# (Timestamp_{U}^{1}, Nonce_{U}^{1})$ $SN\vert \equiv \# (Timestamp_{GW}, Nonce_{GW}, NewSeq_{SNNum}, A_{SN}, B_{SN})$
$GW\vert \equiv \# (H_{\alpha 1}, H_{\alpha 2})$ $GW\vert \equiv (Seq_{Num})$ $GW\vert \equiv U \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Nonce_{U}^{1}}} GW$ $GW\vert \equiv U \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{h_{1}, h_{2}, h_{3}}} GW$ $U\vert \equiv \# (H_{\alpha 3}, H_{\alpha 4}, H_{\alpha 5}, A,B)$ $U\vert \equiv GW\vert \equiv (H_{\alpha 3}, H_{\alpha 4}, H_{\alpha 5}, A,B)$ $U\vert \equiv (NewSeq_{Num}, NewPublicIdentifier_{U})$ $U\vert \equiv GW \mathrel {\mathop {\!\!\!\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\!\!\!-\!\!\!\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{NewSeq_{Num}, NewPublicIdentifier_{U}}}U$ $GW\vert \equiv GW \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Key_{Session}}}U$ $U\vert \equiv GW \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Key_{Session}}}U$ $U\vert \equiv GW\vert \equiv GW \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Key_{Session}}}U$ $GW\vert \equiv U\vert \equiv U \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Key_{Session}}}GW$ $SN\vert \equiv \# (H_{\alpha 6}, H_{\alpha 7}, H_{\alpha 8})$ $SN\vert \equiv SN \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{h_{4}, h_{5}, h_{6}}}GW$ $SN\vert \equiv NewSeq_{SNNum} $ $SN\vert \equiv GW \mathrel {\mathop {\!\!\!\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Key_{Session}, NewSeq_{SNNum}}}SN$ $SN\vert \equiv GW\vert \equiv GW \mathrel {\mathop {\!\!\!\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Key_{Session}, NewSeq_{SNNum}}}SN$
Using the message
$M_{1} $ $R_{6} $ $GW\triangleleft (H_{\alpha 1}, H_{\alpha 2})$ Using previous result from the step A, belief 1 and rule
$R_{7} $ $GW\vert \equiv U\vert \sim (H_{\alpha 1}, H_{\alpha 2})$ With result of step A, belief 7 and rule
$R_{4} $ $GW\vert \equiv \# (H_{\alpha 1}, H_{\alpha 2})$ With the result of step B, C and rule
$R_{2} $ $GW\vert \equiv U\vert \equiv (H_{\alpha 1}, H_{\alpha 2})$ With the result of step D, belief 3 and rule
$R_{3} $ $GW\vert \equiv (H_{\alpha 1}, H_{\alpha 2})$ Using the message
$M_{1} $ $R_{5} $ $GW\vert \equiv (Seq_{Num})\left({\frac {GW\vert \equiv (Seq_{Num}, H_{\alpha 1})}{GW\vert \equiv (Seq_{Num})}}\right)$ Using the result of step C, D and rule
$R_{8} $ $GW\vert \equiv U \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Nonce_{U}^{1}}}GW$ Using the result of step C, D and rule
$R_{8} $ $GW\vert \equiv U \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{h_{1}, h_{2}, h_{3}, A,B}} GW$ Using the result of step C, D and rule
$R_{8} $ $GW\vert \equiv GW \mathrel {\mathop {\!\!\!\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Key_{Session}}} U$ Using the message
$M_{2} $ $R_{6} $ $U\triangleleft (H_{\alpha 3}$ $H_{\alpha 4}$ $H_{\alpha 5}$ $A$ $B)$ With the result of the step J, belief 1 and rule
$R_{7} $ $U\vert \equiv GW\vert \sim (H_{\alpha 3}, H_{\alpha 4}, H_{\alpha 5}, A,B)$ With the result of the step J, belief 6 and rule
$R_{4} $ $U\vert \equiv \# (H_{\alpha 3}, H_{\alpha 4}, H_{\alpha 5}, A,B)$ With the result of the step J, K and rule
$R_{2} $ $U\vert \equiv GW\vert \equiv (H_{\alpha 3}, H_{\alpha 4}, H_{\alpha 5}, A,B)$ Using the result of step M, belief 4 and rule
$R_{3} $ $U\vert \equiv (NewSeq_{Num}, NewPublicIdentifier_{U}, A,B)$ With the result of step L, M and rule
$R_{8} $ $U\vert \equiv GW \mathrel {\mathop {\!\!\!\leftarrow \!\!\!-\!\!\!\!\!\!-\!\!\!-\!\!\!-\!\!\!\!\!\!-\!\!\!\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{NewSeq_{Num}, NewPublicIdentifier_{U}, A,B}} U$ With the result of step L, M and rule
$R_{8} $ $U\vert \equiv GW \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Key_{Session}}} U$ Using the result of step O, belief 4 and rule
$R_{2} $ $U\vert \equiv GW\vert \equiv GW \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Key_{Session}}} U$ Using the result if step I, belief 3 and rule
$R_{2} $ $GW\vert \equiv U\vert \equiv U \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Key_{Session}}} GW$ Using the message
$M_{3} $ $R_{6} $ $SN\triangleleft (H_{\alpha 6}, H_{\alpha 7}, H_{\alpha 8}, A_{SN}, B_{SN})$ Using previous result from the step S, belief 2 and rule
$R_{7} $ $SN\vert \equiv GW\vert \sim (H_{\alpha 6}, H_{\alpha 7}, H_{\alpha 8}, A_{SN}, B_{SN})$ Using the result from step S, belief 8 and rule
$R_{4} $ $SN\vert \equiv \# (H_{\alpha 6}, H_{\alpha 7}, H_{\alpha 8}, A_{SN}, B_{SN})$ Using the result T, U and rule
$R_{2} $ $SN\vert \equiv GW\vert \equiv (H_{\alpha 6}, H_{\alpha 7}, H_{\alpha 8}, A_{SN}, B_{SN})$ Using the result of step V and rule
$R_{5} $ $SN\vert \equiv NewSeq_{SNNum} $ Using the result of step U, V and rule
$R_{8} $ $SN\vert \equiv SN \mathrel {\mathop {\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{h_{4}, h_{5}, h_{6}}} GW$ Using the result of step U, V and rule
$R_{8} $ $SN\vert \equiv GW \mathrel {\mathop {\!\!\!\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Key_{Session}, NewSeq_{SNNum}}} SN$ Using the result Y, belief 5 and rule and rule
$R_{2} $ $SN\vert \equiv GW\vert \equiv GW \mathrel {\mathop {\!\!\!\leftarrow \!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!-\!\!\!\rightarrow }\limits ^{Key_{Session}, NewSeq_{SNNum}}}SN$
B. Formal Verification Using Real-or-Random Oracle Model and AVISPA
In this paper Real-Or-Random Oracle model is used to prove the semantic security of the scheme [9], [20], [21], [34], a design of a security model is very beneficial as it helps us in delivering of robust security goals, the said model has following components which are of interest:
Participants: The participants are the user (
$U$ $SN$ $GW$ $U (U_{i} \subseteq U)$ $SNSN_{j} \subseteq SN$ $GW$ $\prod \nolimits _{V_{i}}^{u}, \prod \nolimits _{SN_{j}}^{v}, \prod \nolimits _{TA}^{w} $ Accepted State: A given instance say
$\prod ^{u}$ $\prod ^{u}$ Partnering: Two instances
$\prod ^{u},\prod ^{v},\prod ^{w}$ $\prod ^{u},\prod ^{v},\prod ^{w}$ $\prod ^{u},\prod ^{v},\prod ^{w}$ $\prod ^{u},\prod ^{v},\prod ^{w}$ Adversary: The adversary has various abilities which it might use to disrupt the scheme and perform wicked attacks. The adversary can play both active and passive attacks, the passive attack is where the adversary is observing the communication flow across two instances
$\prod ^{u},\prod ^{v}$ $Exec\left({\prod ^{u},\prod ^{v}}\right)$ $SND\left({\prod ^{u},Msg_{\alpha } }\right),SND\left({\prod ^{v},Msg_{\beta } }\right)$ $U_{i} \subseteq U$ $SN_{j} \subseteq SN$ $Msg_{\alpha } /Msg_{\beta } $ $GW$ $Corrupt_{U} \left({\prod ^{u}}\right)$ $U$ $U_{i} \subseteq U$ $LowCorrupt_{SN} \left({\prod ^{v}}\right)/LowCorrupt_{U} \left({\prod ^{u}}\right)$ $Test\left({\prod ^{u}}\right)$
Theorem 1:
In the proposed scheme, the advantage of an adversary
Proof:
For proving the semantic security of the session key the proof is distributed across different games, through succession of each game the ability of the adversary is increasing and the advantage
Game0:
$G_{0}^{KAU2SN}$ $A$ \begin{equation*} Adv_{p}^{KAU2SN}=\vert 2\Pr [succ_{0} ]-1\vert\tag{1}\end{equation*} View Source\begin{equation*} Adv_{p}^{KAU2SN}=\vert 2\Pr [succ_{0} ]-1\vert\tag{1}\end{equation*}
$succ$ $A$ Game1:
$G_{1}^{KAU2SN}$ $Exec()$ $Test()$ $Key_{Session} =[\{A\bmod (h_{1})\}\cdot \{B\bmod (h_{2})\}]\bmod (h_{3})$ $Key_{Session} =[\{A_{SN} \bmod (h_{4})\}\cdot \{B_{SN} \bmod (h_{5})\}]\bmod (h_{6})$ $Key_{Session}$ $\{M_{1}, M_{2}, M_{3} \}$ $(\{Nonce_{U}^{1}$ $ID_{U} $ $Key_{U} $ $Seq_{Num} $ $HPwd$ $Timestamp_{U}^{1}$ $PublicIdentifier_{U} \}$ $\{Nonce_{GW1} $ $ID_{SN} $ $Nonce_{SN} $ $Key_{SN}$ $Timestamp_{GW}, Seq_{SN}, PublicIdentifier_{SN} \})$ $\{M_{1}, M_{2}, M_{3} \}$ $h_{1}$ $h_{2}$ $h_{3}$ $h_{4}$ $h_{5}$ $h_{6}$ \begin{equation*} \Pr [succ_{0} ]-\Pr [succ_{1} ]=0\tag{2}\end{equation*} View Source\begin{equation*} \Pr [succ_{0} ]-\Pr [succ_{1} ]=0\tag{2}\end{equation*}
Game2:
$G_{2}^{KAU2SN}$ $A$ $SND()$ $TA$ $SND()$ $H_{Oracle} $ $A$ $A$ $M_{1} $ $\{H_{\alpha 1},H_{\alpha 2} \}$ $H_{\alpha 1} =h(Nonce_{U}^{1} ~\vert \vert ~GW_{2}~ \vert \vert ~Key_{U} ~\vert \vert ~ PublicIdentifier_{U} ~\vert \vert ~ Timestamp_{U}^{1} \vert \vert PublicIdentifier_{SN})\oplus Seq_{Num}$ $H_{\alpha 2} =H(PublicIdentifier_{U} ~\vert \vert ~GW_{1} ~\vert \vert ~PublicIdentifier_{SN} ~\vert \vert ~ ID_{U} ~\vert \vert ~Timestamp_{U}^{1} \vert \vert HPwd)\oplus Nonce_{U}^{1})$ $M_{3} $ $NewSeq_{SNNum} $ $\{H_{\alpha 6} $ $H_{\alpha 7} $ $H_{\alpha 8} \}$ $H_{\alpha 6} =h(Nonce_{GW1} ~\vert \vert ~ Key_{SN} ~\vert \vert ~ B_{SN} ~\vert \vert ~Timestamp_{GW} ~\vert \vert ~PublicIdentifier_{SN} ~\vert \vert ~ NewSeq_{SNNum})\oplus Seq_{SN} $ $H_{\alpha 7} =h(PublicIdentifier_{SN} ~\vert \vert ~ID_{SN} ~\vert \vert Timestamp_{GW} \vert \vert ~A_{SN})\oplus ~Nonce_{GW1} $ $H_{\alpha 8} =Seq_{SN} \oplus h(Key_{SN} \oplus Seq_{SN})\oplus NewSeq_{SNNum})$ $SND()$ $\frac {q_{h}^{2}}{2\vert H\vert }$ \begin{equation*} \vert \Pr [Succ_{1} ]-\Pr [Succ_{2} ]\vert \le \frac {q_{h}^{2}}{2\vert H\vert }\tag{3}\end{equation*} View Source\begin{equation*} \vert \Pr [Succ_{1} ]-\Pr [Succ_{2} ]\vert \le \frac {q_{h}^{2}}{2\vert H\vert }\tag{3}\end{equation*}
Game3:
$G_{3}^{KAU2SN}$ $OBU$ $Corrupt_{U} ()$ $\{PublicIdentifier_{U}, GW_{1}, GW_{2}, GW_{3}, Nonce_{U}, Seq_{Num}$ $Timestamp_{U}, H(.),Mod_{Set} \}$ $OBU$ \begin{equation*} \vert \Pr [Succ_{2} ]-\Pr [Succ_{3} ]\vert \le \frac {q_{send}}{\vert D\vert }\tag{4}\end{equation*} View Source\begin{equation*} \vert \Pr [Succ_{2} ]-\Pr [Succ_{3} ]\vert \le \frac {q_{send}}{\vert D\vert }\tag{4}\end{equation*}
$LowCorrupt_{SN} ()$ $Key_{SN} $ $ID_{SN}$ $M_{3}$ $H_{\alpha 6} $ $H_{\alpha 7} $ \begin{equation*} \vert \Pr [Succ_{2} ]-\Pr [Succ_{3} ]\vert \le \frac {q_{h}^{2}}{2\vert H\vert }\tag{5}\end{equation*} View Source\begin{equation*} \vert \Pr [Succ_{2} ]-\Pr [Succ_{3} ]\vert \le \frac {q_{h}^{2}}{2\vert H\vert }\tag{5}\end{equation*}
Game4:
$G_{4}^{KAU2SN}$ $G_{3}^{KAU2SN}$ $A$ \begin{equation*} \Pr [Succ_{3} ]=\frac {1}{2}\tag{6}\end{equation*} View Source\begin{equation*} \Pr [Succ_{3} ]=\frac {1}{2}\tag{6}\end{equation*}
\begin{align*} \vert \Pr [succ_{1} ]-\Pr [succ_{3} ]\vert\le&\vert \Pr [succ_{1} ]-\Pr [succ_{2} ]\vert \\&+\,\vert \Pr [succ_{2} ]-\Pr [succ_{3} ]\vert \\\le&\frac {q_{h} ^{2}}{2\vert H\vert }+\frac {q_{send}}{\vert D\vert }\tag{7}\end{align*} View Source\begin{align*} \vert \Pr [succ_{1} ]-\Pr [succ_{3} ]\vert\le&\vert \Pr [succ_{1} ]-\Pr [succ_{2} ]\vert \\&+\,\vert \Pr [succ_{2} ]-\Pr [succ_{3} ]\vert \\\le&\frac {q_{h} ^{2}}{2\vert H\vert }+\frac {q_{send}}{\vert D\vert }\tag{7}\end{align*}
$\Pr [Succ_{3} ]=\frac {1}{2}$ $\vert \Pr [succ_{1} ]-\frac {1}{2}\vert \le \frac {q_{h}^{2}}{2\vert H\vert }+\frac {q_{send}}{\vert D\vert }$ $2\left[{\Pr [succ_{0} ]-\frac {1}{2}}\right]\le 2\left[{\frac {q_{h}^{2}}{2\vert H\vert }+\frac {q_{send}}{\vert D\vert }}\right]$ \begin{equation*} Adv_{p}^{KAU2SN}\le \frac {q_{h}^{2}}{\vert H\vert }+\frac {2q_{send} }{\vert D\vert }\tag{8}\end{equation*} View Source\begin{equation*} Adv_{p}^{KAU2SN}\le \frac {q_{h}^{2}}{\vert H\vert }+\frac {2q_{send} }{\vert D\vert }\tag{8}\end{equation*}
$LowCorrupt_{SN} ()$ $Adv_{p}^{KAU2SN}\le \frac {2q_{h}^{2}}{\vphantom {D_{j}}\vert H\vert }$
Theorem 2:
The proposed system provides conditional security when mobile device is lost or stolen. The advantage of the adversary is given by
Proof:
To demonstrate this, a game
The table 3 depicts the simulation results in OFMC backend in AVISPA (a formal security verification tool). AVISPA is a simulation tool for security verification which justifies the security of the authentication schemes. It is also a software which is of type role related, where each participants acts as a role [7], [19], [33]. The AVISPA is written in HLPSL which is a High Level Protocol Specification Language which is then translated into IF which is an Intermediate Format lower level language can directly read by AVISPA”s back end. AVISPA has four back ends, namely, (i) OFMC (On – the – fly – Model – Checker, (ii) Constraint Logic Based Attack Searcher, (iii) SATMAC – SAT based Model Checker and Tree Automata based on Automatic Approximations. Table 3 depicts the simulation in AVISPA.
C. Informal Security Analysis
In this section informal security analysis is presented as to prove security of the proposed work against specified attack. The attack is mentioned adhered to which a description is provided which proves as of how the proposed work is secure against the specified attack.
1) Modification Attack
In this attack an adversary tries to modify the sent data so that the valid entities in the system accept these changes, the adversary in this attack can either impersonation a valid entity in the system or make malicious changes. In the proposed work, if the adversary manipulates the credentials on
2) Replay and Suppress Replay Attack
In this attack the adversary tries to impersonate the valid entity by replaying the honest authentication message generated by either
3) Known Session Specific Temporary Information Attack
In this attack, the session specific information such as
4) Impersonation Attack
In the proposed work impersonation of entities
5) DOS Attack
This attack focuses on making the resources of the system unavailable temporarily or permanently to the hosts connected to the network over the internet. In the proposed work, since every message is bounded by a timestamp
6) Identity Compromise Impersonation Attack
In the proposed work if the identity of sensor node
7) Perfect Forward Secrecy
The knowledge of current session key
8) Mobile Loss Attack
In the proposed work if the mobile device is lost, then the active adversary can attain the stored credentials
9) Known Key Attack
In the proposed work, if a session key
10) Unlinkability
In the proposed work, the pseudonym
11) Anonymity
In the proposed work since for every communication from the user
12) Man in the Middle Attack
In the proposed work, since any anomaly caused by the adversary (such as modifications, replays, etc.) on the message will be detected, thus the role of the adversary is limited to just observing the message.
Performance Analysis
In this section a tangible comparison of the proposed work is done with the existing scheme. The comparison of the proposed scheme is done in terms of execution time and communication overhead, and security features.
A. Communication Cost, Storage Cost and Execution Time
In this section the total computation cost and communication cost is presented. For communication cost of different protocols, the sensor node’s identity, gateway’s identity, output of hash function, random number are all taken as 160 bits. The length of user’s identity, pseudonym and timestamps are respectively 80 bits, 80 bits and 32 bits. The length of the modular exponentiation output is 1024 bits. The subgroup G of ECC is 160 bits, and the size of element in G is 320 bits. The block size of symmetric cryptography is 128 bits. The approach used is similar to [6], [9]. Fig 2 depicts the overall cost. The communication costs of different schemes are taken from [4], [6]. In the proposed work the exchanged messages are
The approach used is similar to that of [7], [45]. Using the similar sizes depicted earlier, it can be concluded the overall costs associated with the registration and storage cost on the storage device. For [1] the exchanged messages are
B. Comparison of Various Security Feature
The table above summarizes different attacks and depicts the vulnerabilities of different schemes. In this section several security features are provided, the term “YES” implies that the proposed scheme can withstand the said attack. While “NO” states that the said work does not satisfy the given feature. The proposed work has been motivated by [5], [38]–[40] where hash based lightweight scheme has been proposed, thus the proposed work utilizing these credentials has been developed. The proposed scheme brings more reliability due to enhanced security features. Moreover, the proposed work is secure against Privileged-insider-attack this can be proved using the approach depicted in [5], [39].
Conclusion
In this paper, a lightweight authentication and key agreement protocol for WSN in IIOT environment is proposed, where the proposed work resulted in fast authentication and unpredictable pseudonym update phase. The security of the proposed work is proved using Real-or-Random oracle model, AVISPA, BAN logic and informal security analysis. Moreover, the cryptanalysis of a ECC based authentication and key agreement scheme was presented as a result, new security goals were scoped; a new scheme overcoming vulnerabilities. The proposed work overcomes vulnerabilities present in the existing schemes and provides a new means to exchange session key faster. The rapid growth in IOT technology will lead to heavy applications in healthcare, intelligent transport systems and industrial fields where security and privacy are the major concerns. The proposed work, presents an approach which can make it useful for above applications.