A Privacy-Preserving Authentication, Authorization, and Key Agreement Scheme for Wireless Sensor Networks in 5G-Integrated Internet of Things

Wireless sensor networks (WSNs) have played an important role in the Internet of Things (IoT), and the 5G network is being considered as a major candidate for IoT's communication network with the advent of 5G commercialization. The potential of integrating WSNs and 5G in the IoT is expected to allow IoT to penetrate deeply into our daily lives and to provide various services that are convenient, but at the same time, it also brings new security threats. From this aspect, user authentication and key agreement are essential for secure end-to-end communication. As IoT devices, including sensors, collect and process more and more personal information, both anonymous authentication and authorization are also required to protect the privacy and to prevent anyone without privileges from accessing private data. Recently, Adavoudi-Jolfaei et al. proposed an anonymous three-factor authentication and access control scheme for real-time applications in WSNs. However, we found that this scheme does not provide sensor-node anonymity and suffers from user collusion and desynchronization attacks. In this paper, we introduce a system architecture by considering the integration of WSNs and 5G for IoT. Based on a cryptanalysis of Adavoudi-Jolfaei et al.'s scheme and the system architecture, we propose an elliptic curve cryptography (ECC)-based privacy-preserving authentication, authorization, and key agreement scheme for WSNs in 5G-integrated IoT. We conduct a formal and informal security analysis in order to demonstrate that the proposed scheme withstands various security attacks and guarantees all desired security features, overcoming the drawbacks of Adavoudi-Jolfaei et al.'s scheme. Finally, a performance and comparative analysis with the related schemes indicate that the proposed scheme is both efficient and more secure.

SECTION I. Introduction

The Internet of Things (IoT) is an intelligent technology and service that connects all things including sensors, smartphones, and home appliances to communicate information between people and things based on the Internet. Recently, various IoT applications have made it possible for users, through linkage with smart devices, to access, use, and process information collected from sensors. From this aspect, the smartphone, the most common device that is steadily increasing in performance, plays an important interface role in allowing users to access and control other devices in the IoT through Wi-Fi and cellular networks. 5G is becoming an active candidate for various IoT applications such as the smart home, smart city, smart health, and smart grid [1]. Owing to the commercialization of 5G, one of the cellular networks, IoT has penetrated into everyday life.

The wireless sensor network (WSN) is one of the core elements of the IoT and is responsible for collecting and delivering the physical phenomena and information using a number of heterogeneous and resource-constrained sensors. Therefore, the integration of WSN and 5G will be a key driver for successful IoT deployment. With WSNs and 5G-integrated IoT, more sensors and smart devices will surround us and reach deeper into our private lives. This increases connectivity and provides convenient services to us, but at the same time, it increases the number of attack surfaces. To protect IoT devices and their data and provide secure communication, user authentication and key establishment are the most basic security requirements.

IoT devices including sensors have various types of data, and the collected data in several IoT applications are privacy-sensitive. For example, personal health information collected from wearable and implanted medical devices and private information collected from home sensors are privacy-sensitive data. If these types of data are leaked or controlled by malicious people, they may pose serious threats, and these threats may be linked directly to human life. Anonymity with untraceability is a representative technique for stronger privacy preservation. Anonymity hides the identities of participants, including users, from third parties so that they do not know who accesses data at certain points in time. Untraceability disallows an adversary who wants to trace different sessions of a particular user from publicly exchanged messages. The authorization and access control mechanisms grant different access rights according to the data’s importance and privacy sensitivity, and verify whether a user has the corresponding privilege to access data. Therefore, authorization and access control mechanisms and privacy-preserving techniques are also essential for securing the IoT.

A. Related Works

Since Das et al. introduced a two-factor user authentication scheme for WSNs [2], a large number of two-factor user authentication schemes using passwords and smart cards have been proposed [3]–​[8]. To address the security vulnerabilities associated with two-factor user authentication schemes and to improve their security strength, three-factor authentication, with biometrics as the third factor, has attracted attention from many researchers in recent years [9]–​[16].

Park et al. proposed a security-enhanced authentication and key agreement scheme to overcome the security weaknesses of Chang et al.’s scheme [6] by using biometric information and an elliptic curve cryptogrphy (ECC) [10]. However, Wang et al. [17] and Maurya and Sastry [12] revealed that Park et al.’s scheme has security flaws. Moon et al. showed how an adversary can impersonate a legitimate user or a sensor node, and proposed an improved authentication scheme [18]. Das proposed a novel biometric-based user authentication scheme suitable for WSNs [19]. Unfortunately, in the same year, Maurya et al. pointed out that these two schemes including Park et al.’s scheme are insecure against various security attacks. Instead, Maurya et al. proposed a fuzzy extractor and ECC-based efficient authenticated session key establishment protocol for WSNs and IoT [12].

Amin et al. proposed a new secure three-factor authentication scheme that claimed to be secure against all known security attacks [11], but Jiang et al. found that Amin et al.’s scheme has security drawbacks [13]. Jiang et al. then proposed a three-factor authentication and key agreement scheme based on the Rabin cryptosystem for Internet-integrated WSNs. Wadiz et al. proposed a secure and lightweight three-factor authenticated key management scheme for the hierarchical IoT network as a special kind of generic IoT network [14]. All the abovementioned schemes have evolved by identifying and solving the security problems in the previous systems. However, they still have security drawbacks and do not support authorization to access control, which is one of the essential security requirements in WSNs for IoT.

Adavoudi-Jolfaei et al. [15] pointed out a security vulnerability in Gope and Hwang’s [7] two-factor authentication protocol for WSNs. To address this vulnerability, Adavoudi-Jolfaei et al. devised an enhanced scheme by employing biometrics with a fuzzy extractor and by providing access control as an additional desired security property for WSNs. They proved their scheme was secure against various attacks. However, as illustrated in Section II-B, we found that Adavoudi-Jolfaei et al.’s scheme still has several security flaws. Their scheme does not provide sensor node anonymity, and it is vulnerable to user collusion attacks in which malicious users collude with each other in order to access data that is inaccessible with their own privileges. In addition, it is also vulnerable to desynchronization attacks in which an attacker breaks the synchronization of the secret values that are shared between a server and a user and updated on a per session basis, thereby preventing the server from authenticating a legitimate user’s credentials [20].

B. Research Contributions

As discussed in Section I-A, the existing schemes for authentication and key establishment for WSNs and IoT still suffer from security attacks and fail to guarantee all desirable security features. In particular, most of them do not support authorization, another desirable security requirement. The contributions of our research to overcoming these drawbacks are as follows:

• We analyze the recent lightweight and anonymous three-factor authentication and access control scheme of Adavoudi-Jolfaei et al. [15]. We show that their scheme does not provide sensor node anonymity and is vulnerable to user collusion and desynchronization attacks.

• We introduce a system architecture suitable for WSNs in 5G-integrated IoT. Based on the system architecture, we design an ECC-based privacy-preserving authentication, authorization, and key agreement scheme. The proposed scheme provides three-factor user authentication and overcomes the security weaknesses of the Adavoudi-Jolfaei et al.’s scheme. In addition, the proposed scheme not only satisfies various security features, including authorization, but also withstands all known attacks.

• We formally verify the security of the proposed scheme using both the widely used Burrows-Abadi-Needham (BAN) logic and a robust security verification tool, Automated Validation of Internet Security Protocols (AVISPA). We also informally analyze the security of the proposed scheme to show that it can satisfy the required security features and resist various attacks. We then compare the security of the proposed scheme with those of related schemes in terms of security features.

• Through a performance evaluation, we compare the performance of the proposed scheme with those of related schemes in terms of computation and communication costs.

The remainder of the paper is organized as follows: Section II briefly reviews Adavoudi-Jolfaei et al.’s scheme and demonstrates its security weaknesses. Section III describes the details of the proposed scheme. Section IV conducts a formal and informal security analysis of the proposed scheme. Section V presents a performance evaluation of the proposed scheme and compares the performance with related schemes. Section VI concludes the paper.

C. Preliminaries

This section introduces the necessary mathematical preliminaries and system architecture for the proposed scheme.

1) Fuzzy Extractor

In recent years, the fuzzy extractor technique has been a useful tool that is widely accepted for biometric authentication [9], [15], [21]. The fuzzy extractor extracts biometric information as a uniformly random string with an error tolerance limit $t$ from a biometric template and also outputs a public string as auxiliary information. Namely, the fuzzy extractor can output the same random string with the help of the public string even if there is a minor change in the input. The fuzzy extractor consists of two algorithms, as follows:

• $GEN(Bio_{i})=(B_{i},C_{i})$ : Given a biometric template $Bio_{i}$ as the input, this probabilistic algorithm outputs a secret biometric key $B_{i}$ and a helper string $C_{i}$ .

• $REP(Bio'_{i},C_{i})=(B_{i})$ : Given a noisy biometric $Bio'_{i}$ and a helper string $C_{i}$ as inputs, this deterministic algorithm reproduces the biometric key $B_{i}$ .

2) Elliptic Curve Cryptography

Let $q>3$ be a large prime and $E_{a,b}$ denote a group of points of the elliptic curve $E_{a,b}: y^{2}=x^{3}+ax+b$ over the finite field $\mathbb {F}_{q}$ , where $a,b\in \mathbb {F}_{q}$ satisfy $4a^{3}+27b^{2}\neq 0$ mod $q$ . Let $G_{p}=P$ be a cyclic group of prime order $p$ ,

• The Elliptic Curve Discrete Logarithm (ECDL) problem finds $a$ when given a point $Q\in G_{p}$ , where $a\in \mathbb {Z}^{*}_{p}$ and $Q=aP$ .

• The Elliptic Curve Computational Diffie-Hellman (ECCDH) problem finds $abP$ when given $aP$ and $bP$ , where $a, b\in \mathbb {Z}^{*}_{p}$ .

3) System Architecture

Many researchers have proposed different layers of architecture for IoT, including three-layer, four-layer, and five-layer architectures [22]. However, in terms of operations related to WSNs, IoT architecture can be simply expressed as shown in Figure 1, where the information collected from a WSN in the perception layer is delivered to the cloud through the gateway in the network layer, processed and refined at the cloud computing of the support layer, and passed to the application layer.

FIGURE 1.

System architecture for WSNs in 5G-integrated IoT.

The IoT is highly heterogeneous because it connects a variety of devices, including existing ones, to devices newly developed for the IoT. As IoT applications are deployed at different locations and evolve over time, it is very likely that the heterogeneous devices developed by different manufacturers will communicate through a variety of communication techniques such as IEEE 802.15.4, ZigBee, Wi-Fi, Bluetooth, and 4G/5G [23]. In addition, for IoT applications, multiple WSNs may be deployed in large numbers in various environments. Sensor nodes in WSNs are also heterogeneous, ranging from just various types of sensor motes to sensors embedded in IoT devices. Unlike traditional mobile communication networks and the Internet, WSNs primarily use short-distance communication between objects by constructing wireless networks in an ad hoc manner. Namely, it is difficult to directly connect WSNs and traditional communication networks and the Internet to each other because they lack uniform standardization in communication techniques, and the data from WSNs cannot be transmitted long distance given the limited transmission range of WSNs [24]. Thus, there are limitations to direct communication between heterogeneous sensor nodes and user mobile devices. Instead, they are more likely to communicate through a gateway that acts as a bridge between them.

Figure 1 describes a system architecture for WSNs and 5G-integrated IoT as an extension and generic version of the previously introduced architecture for 5G-integrated WSNs [8]. There are three types of participants: users, the authentication and authorization server (AAS), and gateways (GWs). AAS with IoT application servers and system administrators is responsible for registering users, issuing membership parameters including access rights based on personal credit information, deploying WSNs, and setting up identities and keys for gateways and sensor nodes. AAS also helps with authentication, authorization, and key establishment between a gateway and a user when the user tries to log into the WSN in real time. After registration, authentication, and authorization, through the 5G network or the Internet, a user with a mobile device usually accesses IoT application data in the cloud and directly accesses WSNs through gateways for real-time data acquisition. In general, an IoT gateway plays an important role in IoT applications: facilitating the seamless integration of WSNs and traditional mobile communication networks or the Internet, and managing and controlling WSNs [24]. Likewise, in our system architecture, a gateway usually collects data from the sensor nodes of the WSN and delivers it to the cloud, which serves as a bridge between the user’s mobile device and the sensor nodes for real-time data access. Among these, the proposed scheme focuses on user authentication, authorization, and key agreement when accessing WSNs in real time.

SECTION II. Review and Cryptanalysis of Adavoudi-Jolfaei $et~al.$ ’s Scheme

In this section, we briefly review Adavoudi-Jolfaei et al.’s scheme [15] and show that it has security weaknesses.

A. Review of Adavoudi-Jolfaei $et~al.$ ’s Scheme

Adavoudi-Jolfaei et al.’s scheme consists of four phases: registration, anonymous authentication and key exchange, password and biometric update, and dynamic node addition. We describe the first two phases in detail. The last two phases were omitted because they have little relevance to this work. Table 1 lists the notations used in Adavoudi-Jolfaei et al.’s scheme.

TABLE 1 Notations Used in Adavoudi-Jolfaei et al.’s Scheme

In both Gope et al.’s scheme and Adavoudi-Jolfaei et al.’s scheme, the sensor registration phase was missed, and thus we add it briefly according to their papers [7], [15]. Before WSN deployment, $GW$ preloads $SN_{id}$ and $K_{gs}$ into the memory of each $GW_{j}$ and saves $SN_{id}$ and $K^{\#}_{gs}$ into the database, where $K^{\#}_{gs}=K_{gs}\oplus h(ID_{G}||w||SN_{id})$ . In Adavoudi-Jolfaei et al.’s scheme, to provide access control, $GW$ generates a set of access group IDs $G=\{ G_{1},G_{2},\cdots \}$ and a set of access privilege masks $APM=\{APM_{1},APM_{2}\cdots \}$ , where $G_{j}\in G$ is a 128-bit unique random number used to identity a particular access group, and $APM_{j}\in APM$ is a 128-bit random number except for the first 16 bits (high order) in which each bit defines a different task or service. [83246]: [87132]: [00: 07: 9E: 45: F4: A4:…] is an example of a user access list [15] that consists of [user id]: [group id]: [APM]. If the first bit of the $APM$ is a temperature bit and the corresponding bit is set as 1, then this indicates that all members of this access group can use the temperature parameter. A user can belong to one or more access groups, and multiple users who have similar access privileges can be organized into the same group.

1) Registration Phase

In this phase, $GW$ issues a smart card to an intended user via a secure channel. During this phase, depending on the probable user query, $GW$ prepares an access list that defines the user’s privilege and consists of $ID_{i}, G_{j}$ and user access privilege mask $APM_{j}$ .

1. $U_{i}$ sends $ID_{i}$ and a personal credential to $GW$ .

2. For $U_{i}$ , $GW$ issues a smart card containing $\{K_{ug}, (SID,~KEM_{ug}), Ts_{ug},G_{u},h(\cdot)\}$ , where $K_{ug} =h(ID_{i}||n_{g})\,\,\oplus ID_{G}, sid_{j}=h(ID_{i}||r_{j}||K_{ug}), SID =\{sid_{1},sid_{2},\,\,\cdots \},\,\,KEM_{ug}=\{KEM_{ug_{1}},KEM_{ug_{2}},\,\,\cdots \}, KEM_{ug_{j}}=h(ID_{i}||sid_{j}||r'_{j})$ , $n_{g},r_{j}$ , and $r'_{j}$ are random numbers, and $Ts_{ug}$ is a 64-bit random sequence number generated by $GW$ . For $U_{i}$ , $GW$ finally saves $\langle Ts_{ug},(SID,KEM^{\#}_{ug}),K^{\#}_{ug},K^{\#}_{gs},~ID^{\#}_{i},G^{\#},APM^{\#}\rangle $ into the database, where $KEM^{\#}_{ug} =KEM_{ug}\oplus h(ID_{G}||ID_{i}||w), K^{\#}_{ug}=K_{ug}\oplus h(ID_{G}||ID_{i}||w), ID^{\#}_{i}= ID_{i}\oplus h(ID_{G}||ID_{i}||w),\,\,G^{\#}_{j}=G_{j}\oplus h(ID_{G}||ID_{i}\,\,||w), G^{\#}=\{G^{\#}_{1}, G^{\#}_{2},\cdots \},\,\,APM^{\#}_{j}=APM_{j}\oplus h(ID_{G}||ID_{i}||w)$ , and $APM^{\#}=\{APM^{\#}_{1},\,\, APM^{\#}_{2},\cdots \}$ .

3. $U_{i}$ inputs $PW_{i}$ and $Bio_{i}$ , then $SC$ stores $\langle K^{*}_{ug},f^{*}_{ug},~(SID^{*},KEM^{*}_{ug}),Ts_{ug},G^{*},C_{i}, GEN(\cdot),~REP(\cdot),~h(\cdot)\rangle $ in its memory, where $GEN(Bio_{i})=(B_{i},C_{i}), K^{*}_{ug}=h(h(ID_{i})\oplus h(PW_{i})\oplus h(B_{i})), KEM^{*}_{ug} =KEM_{ug}\oplus h(h(ID_{i})\oplus h(PW_{i})\oplus h(B_{i})), SID^{*}=SID\oplus h(h(ID_{i})\oplus h(PW_{i})\oplus h(B_{i})), G^{*}=G\oplus h(h(ID_{i})\oplus h(PW_{i})\oplus h(B_{i})), f^{*}_{u}=h(h(K_{ug})\oplus h(ID_{i})\oplus h(PW_{i})\oplus h(B_{i}))$ .

2) Anonymous Authentication and Key Exchange Phase

In both Gope et al.’s scheme and Adavoudi-Jolfaei et al.’s scheme, to speed up the authentication processes and to prevent any replay attacks, a 64-bit random sequence number, $Ts_{ug}$ , is used as a one-time pseudonym. To provide user anonymity and untraceability, the researchers also employed a set of unlinkable shadow IDs, $SID$ , and a corresponding set of emergency keys, $KEM$ . These values are used during a loss of synchronization of $Ts_{ug}$ between $U_{i}$ and $GW$ .

1. $U_{i}$ inputs $ID_{i},PW_{i}$ and biometrics $Bio_{i}$ , then $SC$ computes $B_{i}=REP(Bio_{i},C_{i}), K_{ug}=K^{*}_{ug}\oplus h(h(ID_{i})\oplus h(PW_{i})\oplus h(B_{i}))$ , and $f_{u}=h(h(K_{ug})\oplus h(ID_{i})\oplus h(PW_{i})\oplus h(B_{i}))$ . $SC$ checks $f_{u}\stackrel {?}{=}f^{*}_{u}$ . If so, then $SC$ computes $N_{x}=K_{ug}\oplus N_{i}$ , where $N_{i}$ is a random number generated by $U_{i}$ , $G=G^{*}\oplus h(h(ID_{i})\oplus h(PW_{i})\oplus h(B_{i}))$ and $AID_{i}=h(ID_{i}||K_{ug}||N_{i}||Ts_{ug})$ . Then, $U_{i}$ chooses an access group-ID $G_{j}$ from $G$ . Finally, $SC$ computes $G'_{j}=G_{j}\oplus N_{i}$ and $V_{1}=h(AID_{i}||G'_{j}||K_{ug}||N_{x}||SN_{id})$ . In case of loss of synchronization, $U_{i}$ chooses one of the unused pair of $(sid_{j},KEM_{ug_{j}})$ from $(SID^{*},KEM^{*}_{ug})$ and assigns $sid_{j}$ as $AID_{i}$ and $KEM_{ug_{j}}$ as $K_{ug}$ . $SC$ sends a request message $\langle AID_{i},G'_{j},N_{x},Ts_{ug}$ (if req), $SN_{id}, V_{1}\rangle $ to $GW$ .

2. $GW$ first checks the validity of $Ts_{ug}$ provided by $U_{i}$ . If $GW$ cannot find $Ts_{ug}$ in its database, then it terminates the connection. Otherwise, $GW$ selects the tuple related to $U_{i}$ using $Ts_{ug}$ . $GW$ decodes $ID_{i}$ and $K_{ug}$ , and checks the validity of $V_{1}$ . If so, then $GW$ computes $N_{i}=N_{x}\oplus K_{ug}$ and $G_{j}=G_{j}\oplus N_{i}$ , and checks $AID'_{u}\stackrel {?}{=}AID_{i}$ , where $AID'_{u}=h(ID_{i}||K_{ug}||N_{i}||Ts_{ug})$ . If so, then $GW$ computes $APM'_{j}=h(K_{gs})\oplus APM_{j}$ by finding $APM_{j}$ related to $G_{j}$ , generates $SK$ and a timestamp $T$ , and finally sends the message by computing $SK'=h(K_{gs})\oplus SK$ and $V_{2}=h(AID_{i}||APM'_{j}||SK'||T||K_{gs})$ . In case of loss of synchronization, $U_{i}$ will resend the request message using $AID_{i}=sid_{j}$ and $K_{ug}=KEM_{j}$ instead of using $Ts_{ug}$ . In this case, $GW$ will check the validity of $AID_{i}$ by comparing $sid_{j}$ with the entries in its database. If $GW$ can find it, then $GW$ derives the tuple associated with $sid_{j}$ and retrieves $KEM_{j}$ . $GW$ checks the validity of $V_{1}$ with these values and sends a message $\langle AID_{i},APM'_{j},SK', T, V_{2}\rangle $ to $GW_{j}$ .

3. $GW_{j}$ first checks the freshness of $T$ and verifies $V_{2}$ . If so, then $GW_{j}$ computes $APM_{j}=APM'_{j}\oplus h(K_{gs})$ and generates a timestamp $T'$ . $GW_{j}$ then derives $SK=SK'\oplus h(K_{ug})$ and computes $V_{3}=h(SK||K_{gs}||SN_{id}||T')$ . Finally, $GW_{j}$ sends the response message $\langle T', SN_{id}, V_{3}\rangle $ and updates $K_{gs}=K_{gs_{new}}$ , where $K_{gs_{new}}=h(K_{gs}||SN_{id})$ .

4. $GW$ first checks the freshness of $T'$ , generates a random number $m$ , and computes $Ts_{ug_{new}}=m, Ts=h(K_{ug}||ID_{i}||N_{i})\oplus Ts_{ug_{new}}, SK''=h(K_{ug}||ID_{i}||N_{i})\oplus SK$ , and $V_{4}=h(SK''||N_{i}||Ts||\,\,K_{ug})$ . Finally, $GW$ sends the response message $\langle SK'', V_{4}, Ts, x$ (if req)$\rangle $ and updates $K_{ug}=K_{ug_{new}}$ and $K_{gs}=K_{gs_{new}}$ , where $K_{ug_{new}}=h(K_{ug}||ID_{i}||Ts_{ug_{new}})$ and $K_{gs_{new}}=h(K_{gs}||SN_{id})$ . In the case of loss of synchronization, instead of the above update method, $GW$ randomly generates $K_{ug_{new}}$ and sends $x=K_{ug_{new}}\oplus h(ID_{i}||KEM_{j})$ with other parameters.

5. $U_{i}$ first checks $V_{4}$ . If so, then $U_{i}$ derives $SK=SK''\oplus h(K_{ug}||ID_{i}||N_{i})$ and updates $Ts_{ug}=Ts_{ug_{new}}$ and $K_{ug}=K_{ug_{new}}$ , where $Ts_{ug_{new}}=h(K_{ug}||ID_{i}||N_{i})\oplus Ts$ and $K_{ug_{new}}=h(K_{ug}||ID_{i}||\,\,Ts_{ug_{new}})$ . In the case of loss of synchronization, $U_{i}$ performs a different update to $K_{ug}=K_{ug_{new}}$ , where $K_{ug_{new}}=h(ID_{i}||KEM_{j})\oplus x$ .

B. Security Flaws in Adavoudi-Jolfaei $et~al$ .’s Scheme

In this section, we discuss the cryptanalysis of Adavoudi-Jolfaei et al.’s scheme and the observation of several security weaknesses.

1) User Collusion Attacks

In access control systems, a user collusion attack is that two or more malicious users with different privileges deceive the system to obtain a service or data with higher privileges. In the systems, if there is no collusion of users possible, this may be a too strong assumption. Rather, users are more likely to try to get more data that requires higher privileges than their own at low cost [25]. In Adavoudi-Jolfaei et al.’s scheme, a user can have multiple access group IDs, and multiple users with similar privileges can share the same access group ID. As users’ access group IDs are given to users when they are in the registration phase, the users can exploit other users’ group IDs through user collusion to obtain sensor data that requires higher privileges. GW stores the group ID that a user has in the database but does not verify that the group ID presented by the user in the anonymous authentication and key exchange phase is the group to which the user belongs. Therefore, Adavoudi-Jolfaei et al.’s scheme is vulnerable to user collusion attacks. In addition, Adavoudi-Jolfaei et al.’s scheme does not provide access privilege updates.

2) Desynchronization Attack

Both Gope et al.’s scheme [7] and Adavoudi-Jolfaei et al.’s scheme [15] employ a transaction sequence number $Ts_{ug}$ as a one-time pseudonym to provide user anonymity and untraceability, and to prevent replay attacks. In Gope et al.’s scheme, at the end of the anonymous authentication and key exchange phase, this number is updated by incrementing $U_{i}$ and $GW$ by 1 to speed up the authentication process and to prevent a replay attack. On the other hand, Adavoudi-Jolfaei et al. showed that Gope et al.’s scheme is vulnerable to a session-key disclosure attack owing to the above simple update method. However, to solve this problem, they used the vulnerable update method of [3], [9] that Gope et al. identified. Namely, in [3], [9], for untraceability, the updated temporal identity used for the next session is transmitted from the gateway to a user at the end of the authentication phase. Likewise, in Adavoudi-Jolfaei et al.’s scheme, the updated $Ts_{ug_{new}}$ is transmitted to a user. Thus, if the last response message sent from $GW$ is disrupted by an adversary, it will cause a loss of synchronization between the user and $GW$ .

Moreover, both schemes utilize a set of shadow IDs, $SID$ , and the corresponding set of emergency keys, $KEM_{ug}$ , for each user to solve the problem of synchronization loss. However, this causes another desynchronization attack. In the registration phase, if $GW$ cannot find $Ts_{ug}$ of the request message sent from $U_{i}$ in its database, then $GW$ will terminate the connection. Upon receiving this termination message, $U$ will resend the request message using one of the shadow IDs and an emergency key. In this case, an adversary can exploit this method by arbitrarily changing $Ts_{ug}$ of the request message to break the synchronization between $GW$ and $U_{i}$ and to exhaust $SID$ and $KEM_{ug}$ shared between them.

In addition, they have not specified how many $sid_{j}\text{s}$ and $KEM_{ug_{j}}\text{s}$ each user has in both schemes and how to handle them when they are exhausted. Although the storage of smart cards, users’ terminals, and GW is not restrictive compared to the storage of sensor nodes, as the number of $sid_{j}\text{s}$ and $KEM_{ug_{j}}$ and the number of users increase, the storage cost will be exacerbated.

3) No Sensor Node Anonymity

Anonymity in WSNs means preventing a third party other than the message sender and receiver from knowing the identity of the two primary parties in communication. This includes the sender anonymity, receiver anonymity, and unlinkability between the sender and receiver [26]. Thus, the anonymity of the sensor node is as important as the user anonymity. In particular, sensor node anonymity means that no adversary can trace different sessions from a special sensor node and launch further attacks (e.g., a sensor node impersonation attack and sensor node capture attack) by hiding the sensor node’s identity. If the identity of a sensor node is exposed to the adversary in plain text in the transmitted messages, then the adversary can identify the frequently accessed sensor node by users. This means that the adversary can identify an important sensor node with more data of interest to users, and eventually, that sensor node is likely to be the adversary’s preferred target for attack.

In Adavoudi-Jolfaei et al.’s scheme, $U_{i}$ and $GW_{j}$ send the request message $\langle AID_{i},G'_{j},N_{x},Ts_{ug}$ (if req), $SN_{id}, V_{1}\rangle $ and response message $\langle T', SN_{id}, V_{3}\rangle $ to $GW$ via an insecure channel. Clearly, if an adversary intercepts either the request message of $U_{i}$ or the response message of $GW_{j}$ , he/she can obtain $GW_{j}$ ’s identity $SN_{id}$ . Thus, Adavoudi-Jolfaei et al.’s scheme does not ensure sensor node anonymity.

SECTION III. Our Proposed Scheme

In this section, we propose an ECC-based anonymous authentication, authorization and key agreement scheme as an improved version of Adavoudi-Jolfaei et al.’s scheme. The proposed scheme remedies security vulnerabilities based on the system architecture in WSNs for 5G-integrated IoT. Figure 1 illustrates the system architecture of the proposed scheme. Our proposed scheme is split into five phases: (1) setup; (2) user registration; (3) authentication, authorization, and key agreement (AAK); (4) password and biometrics update; and (5) access privilege update. ECC is asymmetric key cryptography and provides similar security measures with smaller key sizes in comparison with other non-ECC-based asymmetric key cryptography methods such as RSA [27]. As WSNs are resource-constrained, techniques that are more lightweight, such as symmetric ones (XOR and hash computations, for example), are more appropriate [4]. However, efficient ECC implementations in resource-constrained sensor motes have continued to be proposed [28]–​[30], thus increasing the feasibility and practicality of ECC in IoT devices. Moreover, although we employ ECC to address the security weaknesses found in Adavoudi-Jolfaei et al.’s scheme, ECC operations are performed by users, authentication and authorization servers, and gateways with fewer resource constraints than sensor nodes. Table 2 lists different and additional notations used in the proposed scheme.

TABLE 2 List of Notations Used in Proposed Scheme

A. System Setup Phase

This phase includes the initialization of the system parameters and gateway and sensor node registration before deployment.

1. $AAS$ chooses an elliptic curve $E$ over prime finite field $F_{q}$ and an additional subgroup $G$ of $E$ , which is generated by $P$ with a large prime order $p$ . $AAS$ then generates its private and public key pair $\{y,Q_{AAS}\}$ , where $y\in \mathbb {Z}^{*}_{p}$ and $Q_{AAS}=yP$ . $AAS$ also chooses its own identity $ID_{AAS}$ , membership verification secret $\alpha $ , access privilege verification secret $\beta $ , and secure one-way hash function $h(\cdot)$ . $AAS$ publishes the system parameters $\{E, G, p, P\}$ .

2. According to authorization policies of the system, $AAS$ generates indices of access privilege groups, $(APG_{1},\cdots,~APG_{\ell }, \cdots, APG_{L})$ , a unique random number, $APR_{\ell }$ , and access privilege mask, $APM_{\ell }$ , for each group [15], where $L$ is the number of access privilege groups.

3. For each gateway $GW_{j}$ , where $1\leq j\leq J$ and $J$ is the number of gateways, $AAS$ selects a unique identity $GID_{j}$ and generates a shared secret key $K_{j}$ between $AAS$ and $GW_{j}$ . According to the WSN deployment plan, $AAS$ divides and allocates all sensor nodes into $J$ gateways. For each sensor node $SN_{n}$ , where $1\leq n\leq N$ and $N$ is the total number of sensor nodes, $AAS$ selects a unique identity $SID_{n}$ and generates a shared secret key $K_{GW_{j}SN_{n}}$ between $GW_{j}$ and $SN_{n}$ . Secure communication through these shared secret keys and data transmission between gateways and sensor nodes are out of the scope of this paper.

4. For each gateway $GW_{j}$ , $AAS$ preloads $\langle ID_{AAS}, Q_{AAS}$ , $GID_{j}, K_{j}\rangle $ , identities of sensor nodes belonging to the corresponding gateway and secret keys shared with them, into $GW_{j}$ ’s memory. For each sensor node $SN_{n}$ , $AAS$ then preloads $\langle GID_{j}, SID_{n}, K_{GW_{j}SN_{n}}\rangle $ into $SN_{n}$ ’s memory.

5. Finally, $AAS$ stores all system parameters and generated values for gateways and sensor nodes in its database, and deploys WSNs in the target area.

B. User Registration Phase

The user registration phase begins when a user $U_{i}$ sends a request message for registration to $AAS$ over a secure channel. Figure 2 illustrates the user registration phase. This phase is described below.

1. $U_{i}$ inputs an identity $ID_{i}$ , a password $PW_{i}$ , and biometrics $Bio_{i}$ into $MD_{i}$ . $U_{i}$ then selects a random number $a$ and computes $TID_{i}=h(ID_{i}||a), GEN(Bio_{i})=(B_{i},C_{i})$ , and $HPW_{i}=h(PW_{i}||B_{i})$ . Finally, $U_{i}$ sends a registration request with $TID_{i}, HPW_{i}$ , and a personal credential to $AAS$ over a secure channel.

2. $AAS$ verifies $U_{i}$ ’s personal credential and computes a membership value $M_{i}=h(TID_{i}||ID_{AAS}||\alpha), HM_{i}=h(TID_{i}||HPW_{i})\oplus M_{i}$ , and $CM_{i}=h(HPW_{i}||M_{i})$ . $AAS$ selects access privilege groups (i.e., $\ell $ -th and $\ell +k$ -th privileges) suitable for the user’s privileges and computes linking values between the membership $M_{i}$ and access privilege groups such that $LMA^{i}_{\ell }=h(M_{i}||\beta ||APR_{\ell })$ . $AAS$ then generates an $AL_{i}=\{(APG_{\ell },LMA^{i}_{\ell }),(APG_{\ell +k},LMA^{i}_{\ell +2})\}$ for $U_{i}$ and sends membership parameters $\langle HM_{i},CM_{i}, AL_{i},~P,Q_{AAS},h(\cdot)\rangle $ to $U_{i}$ over a secure channel. $AAS$ finally stores $TID_{i},M_{i}$ and $APGs_{i}=\{APG_{\ell },APG_{\ell +k},\cdots \}$ in its database.

3. Upon receiving the membership parameters, $U_{i}$ computes $D_{i}=a\oplus h(ID_{i}||B_{i})$ and stores $\langle HM_{i}, CM_{i},AL_{i},C_{i},D_{i},P,Q_{AAS},GEN(\cdot),REP(\cdot),~h(\cdot)\rangle $ into its memory.

FIGURE 2.

User registration phase of our proposed scheme.

C. Authentication, Authorization, and Key Agreement (AAK) Phase

Whenever $U_{i}$ wants to access the WSN in charge of $GW_{j}$ , the following steps should be performed with $U_{i},AAS$ , and $GW_{j}$ over a public channel. With the help of $AAS$ , $U_{i}$ and $GW_{j}$ mutually authenticate each other and establish a common session key for future communication. Finally, $U_{i}$ can obtain the sensory data in real time from the WSN that matches his/her access privileges. Figure 3 illustrates the AAK phase, and this phase is described below.

1. To log into the WSN, $U_{i}$ inputs an identity $ID_{i}$ , password $PW_{i}$ , and biometrics $Bio_{i}$ into $MD_{i}$ . Using the stored values, $MD_{i}$ computes $B_{i}=REP(Bio_{i},C_{i}), a=D_{i}\oplus h(ID_{i}||B_{i}), TID_{i}=h(ID_{i}||a), HPW_{i}=h(PW_{i}||B_{i}), M_{i}=HM_{i}\oplus h(TID_{i}||HPW_{i})$ , and $CM^{*}_{i}=h(M_{i}\oplus h(TID_{i}||PW_{i}||B_{i}))$ and checks $CM^{*}_{i}\stackrel {?}{=}CM_{i}$ . If this does not hold, then the login request is rejected by $MD_{i}$ as at least one factor of the identity, password, or biometrics is invalid. Otherwise, $MD_{i}$ selects $GID_{j}$ and retrieves a proper access privilege group $APG_{\ell }$ and $LMA^{i}_{\ell }$ from $AL_{i}$ . $MD_{i}$ then generates a random value $x\in \mathbb {Z}^{*}_{p}$ and timestamp $T_{1}$ . $MD_{i}$ computes $X_{i}=xP, Y_{i}=xQ_{AAS}, MID_{i}=TID_{i}\oplus h(X_{i}||Y_{i}), MGW_{i}=GID_{j}\oplus h(Y_{i}||T_{1}), MAPG^{i}_{\ell }=APG_{\ell }\oplus h(M_{i}||T_{1}), MLMA^{i}_{\ell }=LMA^{i}_{\ell } \oplus h(TID_{i}||T_{1})$ , and $V_{1}=h(TID_{i}||GID_{n}||APG_{\ell }||M_{i}\,\,||X_{i}||Y_{i}||T_{1})$ . $MD_{i}$ sends a login request $\langle MID_{i},~MGW_{i},~MAPG^{i}_{\ell },~MLMA^{i}_{\ell },X_{i},V_{1},T_{1}\rangle $ to $AAS$ .

2. Upon receiving the login request, $AAS$ checks the validity of timestamp $T_{1}$ . $AAS$ computes $Y'_{i}=yX_{i}, TID'_{i}=MID_{i}\oplus h(X_{i}||Y'_{i})$ and $M'_{i}=h(TID'_{i}||ID_{AAS}||\alpha)$ and retrieves $U_{i}$ ’s membership $M_{i}$ from the database using $TID'_{i}$ . $AAS$ checks whether $U_{i}$ is a member of $AAS$ by verifying $M'_{i}\stackrel {?}{=}M_{i}$ . If this does not hold, then $AAS$ rejects the $U_{i}$ ’s login request. Otherwise, $AAS$ computes $GID'_{j}=MGW_{i}\oplus h(Y'_{i}||T_{1}), APG'^{i}_{\ell }=MAPG^{i}_{\ell }\oplus h(M'_{i}||T_{1})$ , and $V'_{1}=h(TID'_{i}||GID_{j}||APG'^{i}_{\ell }||M'_{i}||X_{i}||Y_{i}||T_{1})$ and checks $V'_{1}\stackrel {?}{=}V_{1}$ . If this does not hold, then $AAS$ terminates the $U_{i}$ ’s login request. Otherwise, $AAS$ computes $LMA'^{i}_{\ell }=MLMA^{i}_{\ell } \oplus h(TID'_{i}||T_{1})$ and checks whether the access privilege group $APG'_{\ell }$ suggested by $U_{i}$ matches the data access privileges of the requested WSN in charge of $GW_{j}$ . If so, then $AAS$ retrieves $APGs_{i}$ , unique random number $APR_{\ell }$ , and access privilege mask $APM_{\ell }$ regarding $APG'_{\ell }$ . $AAS$ then checks that $APG'_{\ell }$ belongs to $APGs_{i}$ , computes $LMA''^{i}_{\ell }=h(M'_{i}||\beta ||APR_{\ell })$ , and checks $LMA''^{i}_{\ell }\stackrel {?}{=}LMA'^{i}_{\ell }$ to verify that $U_{i}$ actually has legitimate privileges of access privilege group $APG'^{i}_{\ell }$ . If this does not hold, then $AAS$ regards that $U_{i}$ does not have legitimate privilege and sends a message that it is inaccessible to the WSN to $U_{i}$ . Otherwise, $AAS$ generates a timestamp $T_{2}$ and computes $MID^{*}_{i}=h(TID'_{i}||GID'_{j}||Y'_{i}), MAPM_{\ell }=APM_{\ell }\oplus h(GID'_{j}||K_{j}||T_{2})$ , and $V_{2}=h(MID^{*}_{i}||GID'_{j}||APM_{\ell }\,\,||X_{i}||K_{j}||T_{2})$ . $AAS$ sends the message $\langle MID^{*}_{i},~MAPM_{\ell },X_{i},V_{2},T_{2}\rangle $ to $GW_{j}$ .

3. Upon the receiving the message from $AAS$ , $GW_{j}$ checks the validity of timestamp $T_{2}$ . If so, then $GW_{j}$ computes $APM'_{\ell }=MAPM_{\ell }\oplus h(GID_{n}||K_{j}||T_{2})$ and $V'_{2}=h(MID^{*}_{i}||GID_{j}\,\,||APM_{\ell }||X_{i}||K_{j}||T_{2})$ and checks $V'_{2}\stackrel {?}{=}V_{2}$ . If this does not hold, then $GW_{j}$ terminates the session. Otherwise, $GW_{j}$ generates a random number $z$ and timestamp $T_{3}$ and computes $Z_{j}=zP, SK=h(MID^{*}_{i}||SK),V_{3}=h(ID_{AAS}||GID_{j}||SK)$ , and $V_{4}=h(MID^{*}_{i}||GID_{j}||Z_{j}||V_{3}||K_{j}\,\,||T_{3})$ . $GW_{j}$ finally sends the message $\langle Z_{j},V_{3},V_{4},T_{3}\rangle $ to $AAS$ .

4. Upon receiving the message from $GW_{j}$ , $AAS$ checks the validity of timestamp $T_{3}$ . If so, $AAS$ computes $V'_{3}=h(MID^{*}_{i}||GID_{j}||Z_{j}||V_{3}||K_{j}||T_{3})$ and checks $V'_{4}\stackrel {?}{=}V_{4}$ . If this does not hold, then $AAS$ terminates the session. Otherwise, $AAS$ generates a timestamp $T_{4}$ and computes $V_{5}=h(TID'_{i}||GID_{j}||M'_{i}||Z_{j}||V_{3}||Y'_{i}||T_{4})$ . $AAS$ finally sends a response message $\langle Z_{j}, V_{4},V_{5},T_{4}\rangle $ to $U_{i}$ .

5. Upon receiving the response message, $MD_{i}$ checks the validity of timestamp $T_{4}$ . If so, then $MD_{i}$ computes $MID^{*}_{i}=h(TID_{i}||GID_{j}||Y_{i}), SK=h(MID^{*}_{i}||xZ_{j})$ , and $V'_{3}=h(ID_{AAS}||GID_{j}||SK)$ and checks $V'_{3}\stackrel {?}{=}V_{3}$ . If this does not hold, then the session is terminated. Otherwise, $U_{i}$ can be confident that $SK$ is shared with the desired $GW_{j}$ . $MD_{i}$ , and then computes $V'_{5}=h(TID_{i}||GID_{j}||M'_{i}||Z_{j}||V_{3}||Y_{i}||T_{4})$ and checks $V'_{5}\stackrel {?}{=}V_{5}$ . If this does not hold, then the session is terminated. Otherwise, $AAS$ and $GW_{j}$ are authenticated by $U_{i}$ , and $U_{i}$ shares a session key $SK$ with $GW_{j}$ .

FIGURE 3.

Authentication, authorization, and key agreement (AAK) phase of proposed scheme.

D. Password and Biometric Update Phase

This phase allows a user to update his/her own password $PW_{i}$ and biometrics $Bio_{i}$ without any interaction with $AAS$ . When $U_{i}$ wants to update $PW_{i}$ and $Bio_{i}$ , $U_{i}$ first inserts his identity $ID_{i}$ and old password $PW_{i}$ , and imprints old biometrics $Bio_{i}$ at $MD_{i}$ . $MD_{i}$ computes $B_{i}=REP(Bio_{i},C_{i}), a=D_{i}\oplus h(ID_{i}||B_{i}), TID_{i}=h(ID_{i}||a), HPW_{i}=h(PW_{i}||B_{i}), M_{i}=HM_{i}\oplus h(TID_{i}||HPW_{i})$ , and $CM'_{i}=h(HPW_{i}||M_{i})$ , and checks $CM'_{i}\stackrel {?}{=}CM_{i}$ . If this does not hold, then it means at least one of the authentication factors is invalid, and the update is canceled. Otherwise, $MD_{i}$ requires $U_{i}$ to input a new password $PW^{*}_{i}$ and to imprint new biometrics $Bio^{*}_{i}$ . $MD_{i}$ then computes $GEN(Bio^{*}_{i})=(B^{*}_{i},C^{*}_{i}), D^{*}_{i}=a\oplus h(ID_{i}||B^{*}_{i}), HPW^{*}_{i}=h(PW^{*}_{i}||B^{*}_{i}), HM^{*}_{i}=M_{i}\oplus h(TID_{i}||HPW^{*}_{i})$ , and $CM^{*}_{i}=h(HPW^{*}_{i}||M_{i})$ . Finally, $MD_{i}$ replaces $HM_{i}, CM_{i},C_{i}$ , and $D_{i}$ with $HM^{*}_{i}, CM^{*}_{i},C^{*}_{i}$ , and $D^{*}_{i}$ , respectively.

E. Access Privilege Update Phase

In most applications, there are often cases where a change in the access privileges given to a user is required owing to a change in policies, change in a user’s position, and so on. This phase is performed between $U_{i}$ and $AAS$ to handle these cases. All messages in this phase are transmitted over a secure channel.

1. $AAS$ sends an update request with $TID_{i}$ and new access privilege list $AL'_{i}$ to $MD_{i}$ to inform $U_{i}$ that his/her access privileges need to be updated.

2. Upon receiving the update request, $MD_{i}$ informs $U_{i}$ . $U_{i}$ then inputs an identity $ID_{i}$ , password $PW_{i}$ , and biometrics $Bio_{i}$ into $MD_{i}$ . Using the inputted user information and stored values, $MD_{i}$ then confirms $U_{i}$ as in the login phase (step 1 in Section III-C) and replaces the stored $AL_{i}$ with $AL'_{i}$ . Finally, $MD_{i}$ sends a message with the $M_{i}$ that the access privilege list update is complete.

3. After verifying the membership $M_{i}$ of $U_{i}$ , $AAS$ also replaces the stored $APGs_{i}$ with $APGs'_{i}$ , including new access privilege groups for $U_{i}$ .

SECTION IV. Security Analysis

In this section, we discuss the security of the proposed scheme by considering an informal and formal analysis. Using the widely accepted BAN logic [31], we prove that a session key can be correctly generated between $U_{i}$ and $GW_{j}$ . We adopt the AVISPA tool [32], [33] for the formal security verification of the proposed scheme. The informal analysis of the proposed scheme discusses its security features and robustness against relevant and well-known attacks. We finally compare the proposed scheme with other related schemes in terms of security features.

A. Authentication Proof Based on Ban Logic

We use BAN logic to prove the method in which a session key can be correctly generated between communicating parties during the AAK phase. The basic notations used in BAN logic are as follows:

• $P|\equiv X$ : $P$ believes $X$ ,

• $P\triangleleft X$ : $P$ sees $X$ ,

• $P|\sim X$ : $P$ said $X$ ,

• $P|\Rightarrow X$ : $P$ has jurisdiction over $X$ ,

• $\#(X)$ : $X$ is fresh,

• $P\stackrel {K}{\leftrightarrow }Q$ : $K$ is the shared key between $P$ and $Q$ ,

• $\langle X\rangle _{K}$ : $X$ is combined with $K$ , and $K$ is usually a secret,

Generally, the BAN logic provides some rules as follows:

• Rule 1 (Message meaning rule) $\frac {P|\equiv P\stackrel {K}{\leftrightarrow }Q,P\triangleleft \langle X\rangle _{K}}{P|\equiv Q|\sim X}$ : If $P$ believes that the $K$ is shared with $Q$ and $P$ sees $X$ combined with $K$ , then $P$ believes $Q$ said $X$ .

• Rule 2 (Nonce verification rule) $\frac {P|\equiv \#(X),P|\equiv Q|\sim X}{P|\equiv Q|\equiv X}$ : If $P$ believes that $X$ is fresh and $P$ believes that $Q$ said $X$ , then $P$ believes that $Q$ believes $X$ .

• Rule 3 (Freshness conjuncation rule) $\frac {P|\equiv \#(X)}{P|\equiv \#(X,Y)}$ : If $P$ believes that $X$ is fresh, then $P$ believes that $(X,Y)$ is fresh.

• Rule 4 (Jurisdiction rule) $\frac {P|\equiv Q|\Rightarrow X,P|\equiv Q|\equiv X}{P|\equiv X}$ : If $P$ believes that $X$ has jurisdiction over $X$ and $P$ believes that $Q$ believes $X$ , then $P$ also believes $X$ .

In the informal analysis based on BAN logic, the goals of the proposed scheme are defined as

• Goal 1: $U_{i}|\equiv GW_{j}|\equiv (U_{i}\stackrel {SK}{\longleftrightarrow }GW_{j})$

• Goal 2: $U_{i}|\equiv (U_{i}\stackrel {SK}{\longleftrightarrow }GW_{j})$

• Goal 3: $GW_{j}|\equiv U_{i}|\equiv (U_{i}\stackrel {SK}{\longleftrightarrow }GW_{j})$

• Goal 4: $GW_{j}|\equiv (U_{i}\stackrel {SK}{\longleftrightarrow }GW_{j})$ .

According to the proof steps in BAN logic, we convert the protocol messages into the idealized format as follows:

• $M_{1}$ : $U_{i}\rightarrow AAS$ : $\langle TID_{i}, GID_{j}, APG_{\ell }, LMA^{i}_{\ell }, X_{i}, ~T_{1}, U_{i}\stackrel {Y_{i}}{\longleftrightarrow } AAS\rangle _{M_{i}}$

• $M_{2}$ : $AAS\rightarrow GW_{j}$ : $\langle GID_{j}, MID^{*}_{i}, APM_{\ell },X_{i}, T_{2}\rangle _{K_{j}}$

• $M_{3}$ : $GW_{j}\rightarrow AAS$ : $\langle GID_{j}, MID^{*}_{i}, Z_{j}, V_{3}, T_{3}\rangle _{K_{j}}$

• $M_{4}$ : $AAS\rightarrow U_{i}$ : $\langle TID_{i}, GID_{j}, Z_{j}, V_{3}, T_{4}\rangle _{M_{i}}$ .

We then define some assumptions as initiative premises as follows:

• $P_{1}$ : $AAS|\equiv \#(T_{1})$

• $P_{2}$ : $GW_{j}|\equiv \#(T_{2})$

• $P_{3}$ : $AAS|\equiv \#(T_{3})$

• $P_{4}$ : $U_{i}|\equiv \#(T_{4})$

• $P_{5}$ : $U_{i}|\equiv (U_{i}\stackrel {M_{i}}{\longleftrightarrow }AAS)$

• $P_{6}$ : $AAS|\equiv (U_{i}\stackrel {M_{i}}{\longleftrightarrow }AAS)$

• $P_{7}$ : $GW_{j}|\equiv (GW_{j}\stackrel {K_{j}}{\longleftrightarrow }AAS)$

• $P_{8}$ : $AAS|\equiv (GW_{j}\stackrel {K_{j}}{\longleftrightarrow }AAS)$

• $P_{9}$ : $U_{i}|\equiv GW_{j}|\equiv (U_{i}\stackrel {SK}{\longleftrightarrow }GW_{j})$

• $P_{10}$ : $GW_{j}|\equiv U_{i}|\equiv (U_{i}\stackrel {SK}{\longleftrightarrow }GW_{j})$ .

We then prove that the proposed scheme achieves the above goals based on the idealized form of the messages, assumptions, and BAN logic rules as follows:

• From $M_{1}$ , we get

  $V_{1}$ : $AAS\triangleleft \langle TID_{i}, GID_{j}, APG_{\ell },LMA^{i}_{\ell }, X_{i},T_{1}, ~U_{i}\stackrel {Y_{i}}{\longleftrightarrow } AAS\rangle _{M_{i}}$ .

• Then, according to $P_{6}, V_{1}$ , and Rule 1, we get

  $V_{2}$ : $AAS|\equiv U_{i}|\sim \langle TID_{i}, GID_{j}, APG_{\ell },LMA^{i}_{\ell }, X_{i},~T_{1},U_{i}\stackrel {Y_{i}}{\longleftrightarrow } AAS\rangle $ .

• According to $P_{1}$ and Rule 3, we get

  $V_{3}$ : $AAS|\equiv \#\langle TID_{i}, GID_{j}, APG_{\ell },LMA^{i}_{\ell }, X_{i},T_{1},~U_{i}\stackrel {Y_{i}}{\longleftrightarrow } AAS\rangle $ .

• According to $V_{2}, V_{3}$ , and Rule 2, we get

  $V_{4}$ : $AAS|\equiv U_{i}|\equiv \langle TID_{i}, GID_{j}, APG_{\ell },LMA^{i}_{\ell }, X_{i},~T_{1},U_{i}\stackrel {Y_{i}}{\longleftrightarrow } AAS\rangle $ .

• According to $M_{2}$ , we get

  $V_{5}$ : $GW_{j}\triangleleft \langle GID_{j}, MID^{*}_{i}, APM_{\ell },X_{i}, T_{2}\rangle _{K_{j}}$ .

• According to $P_{7}$ and Rule 1, we get

  $V_{6}$ : $GW_{j}|\equiv AAS|\sim \langle GID_{j}, MID^{*}_{i}, APM_{\ell },X_{i}, T_{2}\rangle $ .

• According to $P_{2}$ and Rule 3, we get

  $V_{7}$ : $GW_{j}|\equiv \#\langle GID_{j}, MID^{*}_{i}, APM_{\ell },X_{i}, T_{2}\rangle $ .

• According to $V_{6}, V_{7}$ , and Rule 2, we get

  $V_{8}$ : $GW_{j}|\equiv AAS|\equiv \langle GID_{j}, MID^{*}_{i}, APM_{\ell },X_{i}, T_{2}\rangle $ .

• According to $M_{3}$ , we get

  $V_{9}$ : $AAS\triangleleft \langle GID_{j}, MID^{*}_{i}, Z_{j}, V_{3}, T_{3}\rangle _{K_{j}}$ .

• According to $P_{8}$ and Rule 1, we get

  $V_{10}$ : $AAS|\equiv |\sim \langle GID_{j}, MID^{*}_{i}, Z_{j}, V_{3}, T_{3}\rangle $ .

• According to $P_{3}$ and Rule 3, we get

  $V_{11}$ : $AAS|\equiv \#\langle GID_{j}, MID^{*}_{i}, Z_{j}, V_{3}, T_{3}\rangle $ .

• According to $V_{10}, V_{11}$ , and Rule 2, we get

  $V_{12}$ : $AAS|\equiv GW_{j}|\equiv \langle GID_{j}, MID^{*}_{i}, Z_{j}, V_{3}, T_{3}\rangle $ .

• According to $M_{4}$ , we get

  $V_{13}$ : $U_{i}\triangleleft \langle TID_{i}, GID_{j}, Z_{j}, V_{3}, T_{4}\rangle _{M_{i}}$ .

• According to $P_{5}$ and Rule 1, we get

  $V_{14}$ : $U_{i}|\equiv AAS|\sim \langle TID_{i}, GID_{j}, Z_{j}, V_{3}, T_{4}\rangle $ .

• According to $P_{4}$ and Rule 3, we get

  $V_{15}$ : $U_{i}|\equiv \#\langle TID_{i}, GID_{j}, Z_{j}, V_{3}, T_{4}\rangle $ .

• According to $V_{14}, V_{15}$ , and Rule 2, we get

  $V_{16}$ : $U_{i}|\equiv AAS|\equiv \langle TID_{i}, GID_{j}, Z_{j}, V_{3}, T_{4}\rangle $ .

• As $SK=h(MID^{*}_{i}||xZ_{j})$ and combining $V_{12}, V_{16}$ , we get $V_{17}$ : $U_{i}|\equiv GW_{j}|\equiv (U_{i}\stackrel {SK}{\longleftrightarrow }GW_{j})$ (Goal 1).

• As $SK=h(MID^{*}_{i}||zX_{i})$ and combining $V_{4}, V_{8}$ , we get $V_{18}$ : $GW_{j}|\equiv U_{i}|\equiv (U_{i}\stackrel {SK}{\longleftrightarrow }GW_{j})$ (Goal 3).

• According to $P_{9},V_{17}$ and Rule 4, we get

  $V_{19}$ : $U_{i}|\equiv (U_{i}\stackrel {SK}{\longleftrightarrow }GW_{j})$ (Goal 2).

• According to $P_{10},V_{18}$ and Rule 4, we get

  $V_{20}$ : $GW_{j}|\equiv (U_{i}\stackrel {SK}{\longleftrightarrow }GW_{j})$ (Goal 4).

Therefore, the above logic proves that the proposed scheme achieves Goals 1–4 successfully. In other words, the proposed scheme achieves mutual authentication, and the session key $SK$ is securely shared between $U_{i}$ and $GW_{j}$ .

B. Security Verification Using AVISPA

AVISPA is one of the widely accepted tools for semiautomated formal security analysis. AVISPA provides the High-Level Protocol Specification Language (HLPSL), a modular role-based expressive formal language, for specifying protocols and their security properties. The HLPSL specification of the protocols is translated into a lower-level description language using the HLPSL2IF translator [32], [33]. In AVISPA, the intruder is modeled using the Dolev-Yao model, and the output format (OF) is generated by applying one of four back ends: On-the-fly Model-Checker (OFMA), CL-based Attack Searcher (CL-AtSe), SAT-based Model-Checker (SATMC), or Tree-Automata-based Protocol Analyzer (TA4SP). The output describes precise information about the result and the conditions obtained.

The proposed scheme by AVISPA was simulated to evaluate its security. We first implemented the specifications in the HLPSL language for user $U_{i}$ , authentication and authorization server $AAS$ , gateway $GW_{j}$ , session, environment, and goal. Figure 4, 5, and 6 illustrate the roles of $U_{i},AAS$ , and $GW_{j}$ in the HLPSL language, respectively. Figure 7 illustrates the session, environment, and goal roles in the HLPSL language. The current version of HLPSL supports the standard authentication and secrecy goals. Five secrecy goals and four authentications of the proposed scheme are verified in the HLPSL implementation.

FIGURE 4.

Role specification for user $U_{i}$ .

FIGURE 5.

Role specification for server $AAS$ .

FIGURE 6.

Role specification for gateway $GW_{j}$ .

FIGURE 7.

Role specification for session, environment, and goal.

We executed the HLPSL specifications using the Security Protocol ANimator for AVISPA (SPAN) [34]. We chose the widely accepted OFMA and CL-AtSe back ends for the execution tests and a bounded number of session model checks. Figure 8 and 9 show the simulation results based on the OFMC and CL-AtSe back ends, respectively. The simulation results show that the proposed scheme is secure against passive and active attacks, such as the man-in-the-middle and replay attacks.

FIGURE 8.

Simulation result based on OFMC.

FIGURE 9.

Simulation result based on CL-AtSe.

C. Informal Security Analysis

In this section, we show that the proposed scheme provides the desired security features and is also secure against well-known attacks.

1) Mutual Authentication

In steps 2) and 5) of Section III-C, $AAS$ and $U_{i}$ authenticate each other by verifying the membership $M_{i}$ and the correctness of $V_{1}$ and $V_{5}$ . As only $U_{i}$ with the correct password, biometrics, and the issued membership from $AAS$ can compute the correct $V_{1}$ , $AAS$ can authenticate $U_{i}$ via $V_{1}$ . After receiving $MID_{i}$ during step 1), as only $AAS$ (who knows the corresponding private key $y$ of $Q_{AAS}$ ) can compute the one-time share key $Y_{i}$ between $U_{i}$ and $AAS$ , we derive $TID_{i}$ from $MID_{i}$ and compute the correct $V_{5}$ . $U_{i}$ can authenticate $AAS$ via $V_{4}$ .

In steps 3) and 4) in Section III-C, $AAS$ and $GW_{j}$ authen- ticate each other by verifying the correctness of $V_{2}$ and $V_{3}$ . An adversary cannot generate legal $V_{2}=h(MID^{*}_{i}||GID'_{j}j||APM^{\ell }||X_{i}||K_{j}||T_{2})$ and $V_{3}=h(MID^{*}_{i}||GID_{j}|| Z_{j}||K_{j}||T_{3})$ without knowing their shared secret key $K_{j}$ .

$U_{i}$ and $GW_{j}$ , and $AAS$ authenticate each other. From the authentication relationship of the three parties, equivalently, $U_{i}$ and $GW_{j}$ can authenticate each other through the help of $AAS$ . Therefore, the proposed scheme can achieve mutual authentication.

2) Anonymity and Untraceability

In the proposed scheme, the $U_{i}$ ’s real identity $ID_{i}$ is not transmitted during all phases, including the registration phase. Thus, even if an adversary eavesdrops on all communication messages, it is not possible to obtain $ID_{i}$ directly from the messages. Furthermore, the temporal identity $TID_{i}$ is protected by the random value $X_{i}$ and one-time shared key $Y_{i}$ between $AAS$ and $U_{i}$ during transmission in the AAK phase. Even if an adversary obtains $TID_{i}$ , it is not possible to derive $ID_{i}$ from $TID_{i}$ because $ID_{i}$ is masked with $a$ , and $a$ is protected by $Bio_{i}$ , which is only known to $U_{i}$ .

In addition, for each session, every element of all messages during the AAK phase dynamically changes with random numbers and time stamps. Therefore, any adversary is unable to trace the different sessions of the specific user from the exchanged messages via public channels. Thus, the proposed scheme ensures the user anonymity with untraceability.

Further, the $GW_{j}$ ’s identity $GID_{j}$ is transmitted as masked by $h(Y_{i}||T_{1})$ via a public channel. $AAS$ can obtain it from the login request by calculating $Y'_{i}=yX_{i}, TID'_{i}=MID_{i}\oplus h(X_{i}||Y'_{i})$ , and $GID'_{j}=MGW_{i}\oplus h(Y'_{i}||T_{1})$ . Therefore, the proposed scheme also guarantees gateway anonymity.

3) Session Key Agreement, Known-Key Secrecy, and Forward and Backward Secrecy

During the AAK phase, a session key $SK=h(MID^{*}_{i}||xZ_{i})=h(MID^{*}_{i}||zX_{i})=h(MID^{*}_{i}||xzP)$ is established between $U_{i}$ and $GW_{j}$ for protecting further communication. In the proposed scheme, the session key relies on $xP$ and $zP$ , where both $x$ and $z$ are random numbers that are different in each session. This session key is used only once for a current session and is independent of other sessions’ keys owing to its random numbers. Even $MID^{*}_{i}$ changes with the one-time shared key $Y_{i}$ for each session. Thus, even if an adversary obtains $SK$ for the $k-th$ session, he/she cannot compute any of the past and future session keys by using this disclosed $SK$ . Furthermore, $U_{i}$ can confirm that the correct $SK$ agrees with the intended $GW_{j}$ by verifying the correctness of $V_{4}$ . Therefore, the proposed scheme guarantees both the session key agreement and known-key security.

Forward secrecy means that even if the long-term secret including the current session keys and all other long-term secret information is corrupted, then the past sessions are still secure. Backward secrecy is also referred to as future secrecy and guarantees the opposite direction of forward secrecy. In other words, this security property means that even if at some point the long-term secret information is corrupted, future messages can still be secure. As shown above, the session key $SK=h(MID^{*}_{i}||xzP)$ is associated with the secret random numbers $x$ and $z$ that are only known to $U_{i}$ and $GW_{j}$ , respectively. Even if all long-term secrets of $U_{i}, AAS$ , and $GW_{j}$ are compromised by an adversary and he/she obtains $MID^{*}_{i}, X_{i}$ and $Z_{i}$ by intercepting all messages, the previous and future session keys are still secure because the adversary has to resolve the intractable ECDL problem or ECDH problem in order to obtain them. As a result, the proposed scheme ensures forward secrecy and backward secrecy.

4) Resistance to Mobile Device Loss and Offline Password Guessing Attacks

If a mobile device $MD_{i}$ of $U_{i}$ is lost or stolen by an adversary, he/she can extract all stored values $\langle HM_{i}, CM_{i}, AL_{i},C_{i},D_{i},P,Q_{AAS}, GEN(\cdot),REP(\cdot), h(\cdot)\rangle $ from $MD_{i}$ through side-channel attacks such as a differential and simple power analysis [35]–​[37]. Suppose the adversary obtains $ID_{i}$ by accident and extracts all stored values from $MD_{i}$ . If this occurs, then the adversary is likely to attempt to guess $PW_{i}$ and $B_{i}$ to obtain the information needed for user impersonation. However, owing to the one-way hash function with collision-resistant property, it is also intractable to guess the two values at the same time.

On the other hand, even if an adversary successfully extracts all information stored on $MD_{i}$ , $B_{i}$ is necessary to attempt an offline password guessing attack. However, the adversary cannot derive $B_{i}$ using only $C_{i}$ without knowing the $U_{i}$ ’s biometric $Bio_{i}$ . Moreover, even if the adversary guesses $B_{i}$ correctly, $HPW_{i}$ is necessary to check whether the guessed $PW_{i}$ is correct. However, $HPW_{i}$ is not stored on $MD_{i}$ , so the adversary cannot obtain it. Therefore, the proposed scheme is resistant to mobile device loss and offline password guessing attacks.

5) Resistance to Privileged Insider and Stolen Verifier Attacks

$U_{i}$ does not transmit $PW_{i}$ in any phases of the proposed scheme. $ID_{i}$ and $PW_{i}$ are not used as is, but $TID_{i}$ and $HPW_{i}$ masked by the random value $a$ and biometric key $B_{i}$ , respectively, are used. Namely, only $U_{i}$ knows $ID_{i}$ and $PW_{i}$ , and thus the proposed scheme is resistant to privileged insider attacks.

In a stolen verifier attack, an adversary steals or modifies the verification information (e.g., the plain texts of passwords, hashed passwords, biometric data, or hashed biometric key data) stored in the server’s database. However, in the proposed scheme, $U_{i}$ submits $HPW_{i}$ masked by $B_{i}$ instead of $PW_{i}$ , and $AAS$ maintains only $\langle TID_{i},M_{i},APGs_{i}\rangle $ , which have no information related to the password or biometric key. Hence, the proposed protocol is resistant to stolen verifier attacks.

6) Resistance to Impersonation Attacks

Assume that an adversary launches a user impersonation attack. The adversary may have the $U_{i}$ ’s mobile device $MD_{i}$ and all stored values in $MD_{i}$ , and intercepts the messages transmitted in the previous session. For a successful attack, the adversary has to forge the login request with a new timestamp. However, without knowledge of the correct $ID_{i}, PW_{i}, B_{i}$ , and $M_{i}$ and the possession of $MD_{i}$ , he/she cannot generate a valid login request. Therefore, the proposed scheme is resistant to user impersonation attacks.

Assume that an adversary with the intercepted messages of the previous session tries to impersonate $AAS$ to deceive either $U_{i}$ or $GW_{j}$ . For this, the adversary has to generate the message of either step 5) or step 2), respectively. However, the adversary cannot compute the correct $\langle V_{4}\rangle $ and $\langle MAPM_{\ell },V_{2}\rangle $ without knowing the $AAS$ ’s private key $y$ and the shared key $K_{j}$ between $AAS$ and $GW_{j}$ , respectively. Thus, the proposed scheme is resistant to server impersonation attacks.

Assume that an adversary carries out a gateway impersonation attack. The adversary may have the intercepted messages of the previous session. For this attack, the adversary has to forge the message including a new timestamp transmitted from $GW_{j}$ to $AAS$ . However, without knowing the shared key $K_{j}$ between $AAS$ and $GW_{j}$ , the adversary cannot compute $V_{3}$ . Hence, the proposed scheme is resistant to gateway impersonation attacks.

7) Resistance to User Collusion Attacks

For authorization, in the registration phase, $AAS$ issues $AL_{i}=\{(APG_{\ell },LMA^{i}_{\ell }),(APG_{\ell +k},LMA^{i}_{\ell +2})\}$ for $U_{i}$ . In the AAK phase, $U_{i}$ sends $APG_{\ell }$ and $LMA^{i}_{\ell }$ , which are protected by $M_{i}$ and $TID_{i}$ , respectively. $AAS$ then verifies in two steps that $U_{i}$ has the certain access privilege $APG_{\ell }$ and that it really is the access privilege granted to $U_{i}$ . The first step searches for $APGs_{i}$ stored in the database, and the second step examines $LMA^{i}_{\ell }$ .

Assume that a malicious user $U_{k}$ obtains $TID_{i}, M_{i}$ , and $APG_{\ell }$ from $U_{i}$ , who colludes with $U_{k}$ to escalate the access privilege. $APG_{\ell }$ is a higher privilege than $APG_{\ell -2}$ of $U_{k}$ . To launch the user collusion attack described in Section II-B.1, $U_{k}$ has to compute the correct $LMA^{k}_{\ell }=h(M_{j}||\beta ||APR_{\ell })$ . However, no one except $AAS$ knows $APRs$ , and the access privilege verification secret $\beta $ is also only known to $AAS$ . Without these values, malicious users cannot collude each other in order to escalate their access privileges. Therefore, the proposed scheme is resistant to user collusion attacks.

8) Resistance to Desynchronization Attacks

In a desynchronization attack, an adversary breaks the synchronization of values shared between the server (or gateway) and users, making it impossible for users to log in and authenticate. In the proposed scheme, there is no need to update a temporal identity $TID_{i}$ for untraceability because even if the same $TID_{i}$ is used in each session, it is protected by a one-time secret value $Y_{i}$ and transmitted as a different value each time. Thus, the proposed scheme avoids desynchronization attacks.

D. Comparison of Security Features

In terms of security features, we compare the proposed scheme with recent three-factor authentication schemes [12]–​[15] designed for IoT, except for Adavoudi-Jolfaei et al.’s scheme, which does not take IoT into account. Table 3 summarizes the comparison between the security features. From the results, we can see that the first three schemes do not support authorization. In addition, Maurya and Sastry’s scheme and Wadiz et al.’s scheme do not provide user anonymity or untraceability. In Maurya and Sastry’s scheme, a user’s identity is transmitted in plain text over the published channel, and Wadiz et al.’s scheme requires exhaustive searching to check whether the login user is the registered user. Jiang et al.’s scheme and Wadiz et al.’s scheme do not guarantee perfect forward secrecy, so both schemes risk exposing session keys if long-term secret information is compromised by an adversary. As we discussed in Section II-B, Adavoudi-Jolfaei et al.’s scheme does not provide sensor node anonymity, and it is insecure against user collusion and desynchronization attacks. However, the proposed scheme not only guarantees basic security requirements including authorization but can also resist most known attacks.

TABLE 3 Security Feature Comparison of Proposed Scheme With Related Three-Factor Authentication Schemes

SECTION V. Performance Analysis

In this section, we summarize the performance of the proposed scheme and compare it with related schemes [12]–​[15] in terms of the computation and communication costs. Table 4 summarizes the results of the performance comparison. As the proposed scheme employs a system model that is distinct from those of related schemes, for the proposed scheme, the performance of AAS and the gateway instead of that of the gateway and sensor node, respectively, are included and marked with square brackets.

TABLE 4 Performance Comparison of Proposed Scheme With Related Three-Factor Authentication Schemes

A. Computation Cost

We analyze the computation cost of the proposed scheme and compare it with those of related schemes. We focus on the authentication and key agreement phase and do not consider XOR operations because the execution time is negligible. For a computation cost analysis, we define the execution time for the different cryptographic operations performed in two kinds of devices: a common PC and sensor mote. According to [5], for the user, server, and gateway, we use the execution time ($T$ -series notation) measured in a computer system (Intel T5870 at 2.00 GHz) with the C/C++ library MIRACLE. According to [38]–​[40], for the sensor node, we use the execution time ($T'$ -series notation) measured in the MicaZ mote (8-bit ATmega128L microcontroller, 4K bytes of ROM, 512K bytes of EEPROM) with necC, TinySec, and TinyECCK. The execution time for the fuzzy extractor and biohash function is almost the same as that for the ECC point multiplication [41], [42] so that $T_{F}=T_{B}\approx T_{P}$ . The execution times for different cryptographic operations are listed in Table 5.

TABLE 5 Execution Time on Common PC and Sensor Mote for Cryptographic Operations

The comparison results imply that the computational costs are largely affected by the type of operations at the sensor node. Despite the use of ECC point multiplication, which is a high-cost operation, the computation cost of the proposed scheme was measured at its lowest because it uses a different system model. However, as mentioned earlier, the system model used in the proposed scheme is more suited and reasonable to a 5G-integrated IoT environment, so the proposed scheme can be said to be efficient while guaranteeing various security features including authorization.

B. Communication Cost

We analyze only the frequently performed authentication and key agreement phase and measure the communication costs in bits as the lengths of messages sent by each participant. For convenience, as with the previous computation cost analysis, we assume a one-way hash function, symmetric key encryption algorithm, and ECC elliptic curves as SHA-1, AES-128, and ECC sect163rl [43], respectively. In other words, we assume that the length of the hash digest is 160 bits, the block size of the encryption message is 128 bits, and the size of the elliptic curve point is 326 bits. In particular, for encryption messages, the ciphertext length is calculated as a multiple of the block size. The other values such as identities and random numbers except for timestamps, whose length is 32 bits, are often XORed with the hash digest, so we assume their lengths are 160 bits.

The communication cost analysis in Table 5 shows that Adavoudi-Jolfaei et al.’s scheme has the lowest total communication cost, and the communication costs of all schemes are lower than that of the proposed scheme. However, this can be justified as the proposed scheme provides better security and additional security features (e.g., authorization) compared with the related schemes.

SECTION VI. Conclusion

In this paper, we analyzed the three-factor authentication and access control scheme of Adavoudi-Jolfaei et al. and showed its security weaknesses. Adavoudi-Jolfaei et al.’s scheme does not support sensor node anonymity as strongly as user anonymity in WSNs and IoT. Furthermore, the scheme suffers from user collusion attacks because all users have the same values for access control and the gateway node does not check whether the presented access privilege from the user is indeed the user’s privilege. To provide user anonymity and untraceability and to prevent a replay attack, the scheme uses a transaction sequence number as a one-time pseudonym, and it is updated for every session. However, this value becomes a target of desynchronization attacks.

We then introduced a system architecture suitable for WSNs in 5G-integrated IoT. Based on this architecture, we proposed an ECC-based three-factor authentication, authorization, and key agreement scheme. Through a formal and informal security analysis of the proposed scheme, we showed that our scheme is capable of withstanding all possible attacks, and that it supports various security features. We also evaluated the performance of the proposed scheme. By comparing the security and performance of the proposed scheme with those of related schemes, we demonstrated that the proposed scheme achieves all desired security features without largely worsening the communication costs.

In our future work, we expect to evaluate the performance of the proposed scheme either by simulating it using NS3 or conducting experiments on actual devices (e.g., smartphones and sensor motes) in WSNs for 5G-integrated IoT. Based on the experimental results, we plan to optimize the proposed scheme and improve its performance.