Secure and Efficient User Authentication Scheme in Ubiquitous Wireless Sensor Networks

Abstract

The user authentication scheme in ubiquitous wireless sensor networks (WSNs) is an important security mechanism that allows users to access sensors through wireless networks. Therefore, many user authentication schemes in ubiquitous WSNs have been proposed. However, many user authentication schemes are vulnerable to impersonation attacks, parallel session attacks, password guessing attacks, stolen smart card attacks, and so forth. In this paper, we propose a secure and efficient user authentication scheme for use in ubiquitous WSNs. Our proposed scheme is secure against various attacks and provides mutual authentication and session key establishment. Furthermore, our proposed scheme is efficient at using the hash function and exclusive-OR operation.

1. Introduction

In a ubiquitous wireless sensor network (WSN), a sensor is configured as a network. WSN technology has been actively researched globally and has expanded into a ubiquitous paradigm that can access a computing environment anytime and anywhere [1–3]. The main characteristics of a WSN include the following: power consumption constraints for nodes using batteries or energy harvesting, ability to cope with node failures, mobility of nodes, communication failures, heterogeneity of nodes, scalability to large-scale deployment, ability to withstand harsh environmental conditions, and ease of use [4].

WSN-related software platforms such as TinyOS [5], Nano-Qplus [6], Contiki [7], and LiteOS [8] support a variety of standards and protocols. WSN-related standards include 6LoWPAN [9] by the Internet Engineering Task Force (IETF), ROLL [10] by the IETF, CoRE [11] by the IETF, ZigBee [12], Wireless HART [13], and ISA 100 [14].

Some applications of ubiquitous WSN technology include area monitoring, environmental/earth monitoring, industrial monitoring, agriculture, passive localization and tracking, and smart home monitoring [15, 16]. In these applications, the ubiquitous WSN must have a user authentication scheme in which the user has secure access to the sensor nodes. As a result, many user authentication schemes have been proposed for ubiquitous WSNs. However, the existing proposed schemes are vulnerable to various attacks and are not efficient. Therefore, in this paper, we propose a secure and efficient user authentication and key-establishment scheme for use in ubiquitous WSNs.

This study is organized as follows. Section 2 describes related work, and Section 3 proposes a secure and efficient user authentication scheme for ubiquitous WSNs. In Section 4, we analyze and compare related work. Section 5 presents our conclusion.

2. Related Work

In 2004, Watro et al. [17] proposed TinyPK, a user authentication scheme that uses RSA and the Diffie-Hellman algorithm. However, Das [18] proposed that TinyPK is vulnerable to “masquerade as sensor node to an unknowing user” attack. In 2006, Wong et al. [19] proposed a dynamic strong-password-based scheme to address this access control problem and adapted it into the WSN environment. Their scheme imposes a very light computational load and requires simple operations, such as a one-way hash function and exclusive-OR. Unfortunately, Das also proposed that in Wong et al.'s scheme, many logged-in users are vulnerable to the same login-id attack and stolen-verifier attack.

Das [18] proposed a user authentication scheme that eliminates the weaknesses of Wong et al.'s scheme and provides better security and efficiency. Later, Nyang and Lee [20] found that Das's scheme is vulnerable to an offline password guessing attack by insiders and showed a security-enhanced user authentication scheme to overcome this vulnerability without sacrificing efficiency and usability.

In 2010, He et al. [21] demonstrated that Das's scheme suffers from insider attacks and impersonation attacks, and users cannot change their passwords. As a solution to these weaknesses in Das's scheme, He et al. [21] proposed an enhanced two-factor user authentication scheme. In the same year, Khan and Alghathbar [22] found that Das's scheme is vulnerable to gateway ( $GW$ )-node bypassing attacks, does not provide mutual authentication between the $GW$ node and sensor nodes, is vulnerable to insider attacks, and does not have provisions for changing or updating registered users’ passwords. To overcome these security weaknesses of Das's scheme, they proposed improvements and security patches. Unfortunately, Kumar and Lee [23] pointed out the vulnerabilities of He et al.'s and Khan and Alghathbar's schemes. First, Kumar and Lee found that He et al.'s scheme is susceptible to information-leakage attacks and cannot preserve user anonymity, does not provide mutual authentication between the sensor and the user, and does not establish a session key between the user and the sensor node. Second, they found that Khan and Alghathbar's scheme does not provide mutual authentication between the sensor and the user, does not establish a session key between the user and the sensor node, and does not provide confidentiality for their air message.

Further, Huang et al. [24] found that Das's scheme is still vulnerable to masquerade attacks and cannot provide user anonymity, so they proposed an improvement to remedy these weakness. In addition, Vaidya et al. [25] showed that both Das's scheme and Khan and Alghathbar's scheme have flaws and remain vulnerable to various attacks including stolen smart card attacks. Thus, they proposed an improved two-factor user authentication that is resilient to stolen smart card attacks as well as other common types of attacks. Chen and Shih [26] found that Das's scheme cannot provide mutual authentication. To address this problem, they proposed a robust mutual authentication scheme for WSN. Recently, Xue et al. [27] proposed a temporal credential-based mutual authentication and key agreement scheme for WSNs.

3. The Proposed Scheme

In this section, we propose a secure and efficient user authentication scheme for use in ubiquitous WSNs. The $GW$ node selects a master secret key x and a secret number y, computes $h(SI{D}_j\parallel h(y)\parallel N_j)$ , and shares them with sensor node $S_j$ through a secure channel, where $SI{D}_j$ is the identity of jth sensor node, and $N_j$ is a random nonce of each jth sensor node generated by the $GW$ node. This scheme consists of four phases: registration, login, authentication and key establishment, and password change.

3.1. Notation

Table 1 summarizes the notation used to describe our proposed scheme.

Table 1

Notation of our proposed scheme.

$U_i$ : ith user
$GW$ : Gateway node
$S_j$ : jth sensor node
$I{D}_i$ : Identity of ith user
$P{W}_i$ : Password of ith user
$SI{D}_j$ : Identity of jth sensor node
$DI{D}_i$ : Dynamic identity of ith user
x: Master secret key for gateway node
y: Secret number of gateway node
$N_j$ : Random nonce of each jth sensor node generated by gateway node
T: Timestamp
$h\left(·\right)$ : A one-way hash function
⊕: Exclusive-OR operation
$\parallel$ : Concatenation operation
$A\to B:X$ : X is transmitted from A to B

3.2. Registration Phase

Figure 1 illustrates the procedure of the registration phase. When a new user $U_i$ wants to register with the $GW$ node, he/she performs the following steps.

Figure 1

Registration phase of our proposed scheme.

Step R1 $(U_i\to GW:\{I{D}_i,h(I{D}_i\parallel P{W}_i),h(b\oplus P{W}_i)\})$ . The user $U_i$ selects a random number b, an identity $I{D}_i$ , and a password $P{W}_i$ , computes $h(I{D}_i\parallel P{W}_i)$ and $h(b\oplus P{W}_i)$ , and sends $I{D}_i$ , $h(I{D}_i\parallel P{W}_i)$ , $h(b\oplus P{W}_i)$ to the $GW$ node for registration via a secure channel.

Step R2    $(GW\to U_i:\{\text{smart}\mathrm{\hspace{0.17em}\hspace{0.17em}}\mathrm{\hspace{0.17em}\hspace{0.17em}}\text{card}[A_i,D_i,E_i,h(y),h(·)]\})$ . The $GW$ node computes the following:

$$\begin{array}{cc}& A_i=h\left(h\left(I{D}_i\parallel P{W}_i\right)\parallel h\left(b\oplus P{W}_i\right)\right)\\ B_i=h\left(x\parallel I{D}_i\right)\\ D_i=B_i\oplus h\left(x\parallel y\right)\\ E_i=h\left(I{D}_i\parallel P{W}_i\right)\oplus h\left(B_i\parallel h\left(x\parallel y\right)\right).\end{array}$$

(3.2)

Then the $GW$ node issues a smart card containing $[A_i,D_i,E_i,h(y),h(·)]$ and delivers it to $U_i$ via a secure channel.

Step R3.   $U_i$ enters b into his/her smart card, and the smart card contains $[A_i,D_i,E_i,b,h(y),h(·)]$ .

3.3. Login Phase

If the user $U_i$ wants to access jth sensor node $S_j$ , he/she performs the following steps.

Step L1.   $U_i$ inserts his/her smart card into the device and inputs the identity $I{D}_i$ and the password $P{W}_i$ .

Step L2. The smart card computes $h(I{D}_i\parallel P{W}_i)$ , $h(b\oplus P{W}_i)$ , $A_i^{\prime }=h(h(I{D}_i\parallel P{W}_i)\parallel h(b\oplus P{W}_i))$ and checks whether $A_i^{\prime }$ is equal to $A_i$ . If they are not equal, the procedure is terminated. Otherwise, the following steps are performed.

Step L3. The smart card computes the following:

$$\begin{array}{cc}& DI{D}_i=h\left(b\oplus P{W}_i\right)\oplus h\left(h\left(I{D}_i\parallel P{W}_i\right)\parallel SI{D}_j\parallel T_1\right)\\ C_1=h\left(h\left(b\oplus P{W}_i\right)\parallel h\left(I{D}_i\parallel P{W}_i\right)\parallel SI{D}_j\parallel T_1\right),\end{array}$$

(2)

where $T_{\mathrm{1}}$ is the current timestamp of $U_i$ 's system.

Step L4    $(U_i\to GW:\{DI{D}_i,SI{D}_j,D_i,E_i,C_1,T_1\})$ . $U_i$ sends $DI{D}_i$ , $SI{D}_j$ , $D_i$ , $E_i$ , $C_{\mathrm{1}}$ , and $T_{\mathrm{1}}$ to the $GW$ node.

3.4. Authentication and Key Establishment Phase

The procedure that is followed in the authentication and key establishment phase is illustrated in Figure 2. After receiving the login request message $\{DI{D}_i,SI{D}_j,D_i,E_i,C_1,T_1\}$ from user $U_i$ , the $GW$ node performs the following steps.

Figure 2

Login and authentication and key establishment phase of our propose scheme.

Step A1 (the $GW$ node validates timestamp $T_{\mathrm{1}}$ ). If $|T^{*}-T_{\mathrm{1}}|\le \Delta T$ , then the $GW$ node proceeds to the next step, where $\Delta T$ is the expected time interval for the transmission delay and $T^{*}$ is the current timestamp of the $GW$ node. Otherwise, the procedure is terminated. The $GW$ node computes the following:

$$\begin{array}{cc}& B_i=D_i\oplus h\left(x\parallel y\right)\\ h(I{D}_i\parallel P{W}_i)=E_i\oplus h\left(B_i\parallel h\left(x\parallel y\right)\right)\\ h\left(b\oplus P{W}_i\right)=DI{D}_i\oplus h\left(h\left(I{D}_i\parallel P{W}_i\right)\parallel SI{D}_j\parallel T_1\right)\\ C_1^{\prime }=h\left(h\left(b\oplus P{W}_i\right)\parallel h\left(I{D}_i\parallel P{W}_i\right)\parallel SI{D}_j\parallel T_1\right).\end{array}$$

(3)

Then the $GW$ node checks whether $C_{\mathrm{1}}^{\prime }$ is equal to $C_{\mathrm{1}}$ . If they are equal, the $GW$ node accepts the login request and computes the following:

$$\begin{array}{l}DI{D}_i^{\prime }=h(b\oplus P{W}_i)\hfill \\ \oplus h\left(h\left(I{D}_i\parallel P{W}_i\right)\parallel h\left(SI{D}_j\parallel h\left(y\right)\parallel N_j\right)\parallel T_2\right)\hfill \\ C_2=h(I{D}_i\parallel P{W}_i)\oplus h\left(SI{D}_j\parallel h\left(y\right)\parallel N_j\right)\hfill \\ C_3=h(\phantom{\parallel h\left(SI{D}_j\parallel h\left(y\right)\parallel N_j\right)\parallel T_2}h\left(b\oplus PW\right)\parallel h\left(I{D}_i\parallel P{W}_i\right)\hfill \\ \hspace{1em}\hspace{1em}\hspace{1em}\times \parallel h\left(SI{D}_j\parallel h\left(y\right)\parallel N_j\right)\parallel T_2),\hfill \end{array}$$

(4)

where $T_{\mathrm{2}}$ is the current timestamp of $GW$ node's system.

Step A2 ( $GW\to S_j:\{DI{D}_i^{\prime },C_{\mathrm{2}},C_{\mathrm{3}},T_{\mathrm{2}}\}$ ). The $GW$ node sends $DI{D}_i^{\prime }$ , $C_{\mathrm{2}}$ , $C_{\mathrm{3}}$ , and $T_{\mathrm{2}}$ to sensor node $S_j$ .

Step A3  ( $S_j$ validates timestamp $T_2$ ). If $|T^{*}-T_{\mathrm{2}}|\le \Delta T$ , then $S_j$ proceeds to the next step, where $\Delta T$ is the expected time interval for the transmission delay and $T^{*}$ is the current timestamp of $S_j$ . Otherwise, the procedure is terminated. $S_j$ computes the following:

$$\begin{array}{l}h\left(I{D}_i\parallel P{W}_i\right)=C_2\oplus h\left(SI{D}_j\parallel h\left(y\right)\parallel N_j\right)\hfill \\ h\left(b\oplus P{W}_i\right)\hfill \\ =DI{D}_i^{\prime }\hfill \\ \hspace{1em}\oplus h\left(h\left(I{D}_i\parallel P{W}_i\right)\parallel h\left(SI{D}_j\parallel h\left(y\right)\parallel N_j\right)\parallel T_2\right)\hfill \\ C_3^{\prime }=h(\phantom{\parallel h\left(SI{D}_j\parallel h\left(y\right)\parallel N_j\right)\parallel T_2}h\left(b\oplus PW\right)\parallel h\left(I{D}_i\parallel P{W}_i\right)\hfill \\ \hspace{1em}\hspace{1em}\hspace{1em}\times \parallel h\left(SI{D}_j\parallel h\left(y\right)\parallel N_j\right)\parallel T_2).\hfill \end{array}$$

(5)

Then $S_j$ checks whether $C_{\mathrm{3}}^{\prime }$ is equal to $C_{\mathrm{3}}$ . If they are equal, $S_j$ authenticates $GW$ and $U_i$ , generates K, and computes the following:

$$\begin{array}{cc}& C_4=K\oplus h\left(h\left(b\oplus P{W}_i\right)\parallel h\left(SI{D}_j\parallel h\left(y\right)\parallel N_j\right)\parallel T_3\right)\\ C_5=h\left(K\parallel h\left(b\oplus P{W}_i\right)\parallel h\left(SI{D}_j\parallel h\left(y\right)\parallel N_j\right)\parallel T_3\right),\end{array}$$

(6)

where $T_{\mathrm{3}}$ is the current timestamp of $S_j$ sensor node's system.

Step A4 ( $S_j\to GW:\{C_{\mathrm{4}},C_{\mathrm{5}},T_{\mathrm{3}}\}$ ). $S_j$ sends $C_{\mathrm{4}}$ , $C_{\mathrm{5}}$ , and $T_{\mathrm{3}}$ to the $GW$ node.

Step A5 (the $GW$ node validates timestamp $T_3$ ). If $|T^{*}-T_{\mathrm{3}}|\le \Delta T$ , then the $GW$ node proceeds to the next step, where $\Delta T$ is the expected time interval for the transmission delay, and $T^{*}$ is the current timestamp of the $GW$ node. Otherwise, the procedure is terminated. The $GW$ node computes the following:

$$\begin{array}{cc}& K=C_4\oplus h\left(h\left(b\oplus P{W}_i\right)\parallel h\left(SI{D}_j\parallel h\left(y\right)\parallel N_j\right)\parallel T_3\right)\\ C_5^{\prime }=h\left(K\parallel h\left(b\oplus P{W}_i\right)\parallel h\left(SI{D}_j\parallel h\left(y\right)\parallel N_j\right)\parallel T_3\right).\end{array}$$

(7)

Then the $GW$ node checks whether $C_{\mathrm{5}}^{\prime }$ is equal to $C_{\mathrm{5}}$ . If they are not equal, the procedure is terminated. Otherwise, $GW$ authenticates $S_j$ and computes the following:

$$\begin{array}{cc}& C_6=K\oplus h\left(h\left(b\oplus P{W}_i\right)\parallel h\left(SI{D}_j\parallel h\left(y\right)\right)\parallel T_4\right)\\ C_7=h\left(K\parallel h\left(b\oplus P{W}_i\right)\parallel h\left(SI{D}_j\parallel h\left(y\right)\right)\parallel T_4\right),\end{array}$$

(8)

where $T_{\mathrm{4}}$ is the current timestamp of the $GW$ node's system.

Step A6 ( $GW\to U_i:\{C_{\mathrm{6}},C_{\mathrm{7}},T_{\mathrm{4}}\}$ ). The $GW$ node sends $C_{\mathrm{6}}$ , $C_{\mathrm{7}}$ , and $T_{\mathrm{4}}$ to $U_i$ .

Step A7  ( $U_i$ validates timestamp $T_{\mathrm{4}}$ ). If $|T^{*}-T_{\mathrm{4}}|\le \Delta T$ , then the $GW$ node proceeds to the next step, where $\Delta T$ is the expected time interval for the transmission delay and $T^{*}$ is the current timestamp of $U_i$ . Otherwise, the procedure is terminated. $U_i$ computes the following:

$$\begin{array}{cc}& K=C_6\oplus h\left(h\left(b\oplus P{W}_i\right)\parallel h\left(SI{D}_j\parallel h\left(y\right)\right)\parallel T_4\right)\\ C_7^{\prime }=h\left(K\parallel h\left(b\oplus P{W}_i\right)\parallel h\left(SI{D}_j\parallel h\left(y\right)\right)\parallel T_4\right).\end{array}$$

(9)

Then $U_i$ checks whether $C_{\mathrm{7}}^{\prime }$ is equal to $C_{\mathrm{7}}$ . If they are equal, $U_i$ authenticates $GW$ and $S_j$ , and the mutual authentication process is completed. After the mutual authentication process, $U_i$ and $S_j$ compute $SK=h(K\parallel h(b\oplus P{W}_i)\parallel h(I{D}_i\parallel P{W}_i)\parallel SI{D}_j)$ for future secure communication.

3.5. Password Change Phase

The procedure that is followed in the password change phase is depicted in Figure 3. If user $U_i$ wants to change his/her password, he/she performs the following steps.

Figure 3

Password change phase of our proposed scheme.

Step P1.   $U_i$ inserts his/her smart card into the device and inputs the identity $I{D}_i$ and the password $P{W}_i$ .

Step P2. The smart card computes $h(I{D}_i\parallel P{W}_i)$ , $h(b\oplus P{W}_i)$ , and $A_i^{\prime }=h(h(I{D}_i\parallel P{W}_i)\parallel h(b\oplus P{W}_i))$ and checks whether $A_i^{\prime }$ is equal to $A_i$ . If they are not equal, the procedure is terminated. Otherwise, the smart card requests a new password for $U_i$ .

Step P3.   $U_i$ inputs the new password $P{W}_i^{new}$ and a new random number $b^{new}$ .

Step P4. The smart card computes the following:

$$\begin{array}{l}h\left(I{D}_i\parallel P{W}_i^{new}\right),\hspace{1em}\hspace{1em}h(b\oplus P{W}_i^{new})\hfill \\ A_i^{new}=h(h(I{D}_i\parallel P{W}_i^{new})\parallel h(b^{new}\oplus P{W}_i^{new}))\hfill \\ E_i^{new}=E_i\oplus h\left(I{D}_i\parallel P{W}_i\right)\oplus h\left(I{D}_i\parallel P{W}_i^{new}\right)\hfill \\ =h\left(I{D}_i\parallel P{W}_i^{new}\right)\oplus h\left(B_i\parallel h\left(x\parallel y\right)\right).\hfill \end{array}$$

(10)

Then the smart card replaces $A_i$ with $A_i^{new}$ and $E_i$ with $E_i^{new}$ .

4. Security and Efficiency Analysis of the Proposed Scheme

4.1. Security Analysis

Table 2 compares the security of existing schemes with that of our proposed scheme. Our scheme uses the security properties described in the following subsections.

Table 2

Security analysis of the compared schemes.

Scheme	Section 4.1.1	Section 4.1.2	Section 4.1.3	Section 4.1.4	Section 4.1.5	Section 4.1.6	Section 4.1.7	Section 4.1.8
Das [18]	No	No	No	No	Yes	No	Yes	No
Nyang and Lee [20]	No	Yes	Yes	No	Yes	No	Yes	Yes
He et al. [21]	No	No	Yes	Yes	Yes	No	Yes	No
Khan and Alghathbar [22]	No	Yes	No	No	Yes	No	Yes	No
Huang et al. [24]	No	No	No	No	Yes	No	Yes	No
Vaidya et al. [25]	No	No	No	Yes	Yes	Yes	Yes	Yes
Chen and Shih [26]	No	No	Yes	No	Yes	No	Yes	Yes
Xue et al. [27]	No	Yes	Yes	No	Yes	Yes	Yes	Yes
Proposed scheme	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes

4.1.1. User Anonymity

Even if an attacker eavesdrops on $U_i$ 's login request message $\{DI{D}_i,SI{D}_j,D_i,E_i,C_1,T_1\}$ in the login phase, the attacker cannot obtain $U_i$ 's identity $I{D}_i$ from $DI{D}_i$ , $D_i$ , $E_i$ , and $C_{\mathrm{1}}$ , because x, y, b, and $P{W}_i$ are not known. Furthermore, even if the attacker obtains $U_i$ 's smart card, he/she cannot obtain $U_i$ 's $I{D}_i$ . Therefore, the proposed scheme achieves user anonymity.

4.1.2. Impersonation Attack

Because an attacker cannot know x, y, b, $I{D}_i$ , and $P{W}_i$ , he/she cannot compute the login request message $\{DI{D}_i,SI{D}_j,D_i,E_i,C_1,T_1\}$ . Although the attacker is a legitimate user of the system, he/she cannot compute the login request message without knowing x, y, b, $I{D}_i$ , and $P{W}_i$ . If the attacker also eavesdrops on $U_i$ 's login request message $\{DI{D}_i,SI{D}_j,D_i,E_i,C_1,T_1\}$ , he/she cannot compute $DI{D}_i$ and $C_{\mathrm{1}}$ without knowing b, $I{D}_i$ , and $P{W}_i$ . Even though the attacker obtains $U_i$ 's smart card, he/she cannot compute $DI{D}_i$ and $C_{\mathrm{1}}$ , because $I{D}_i$ and $P{W}_i$ are not known.

4.1.3. Parallel Session Attack

Suppose an attacker eavesdrops on a login request message $\{DI{D}_i,SI{D}_j,D_i,E_i,C_1,T_1\}$ and the mutual authentication message $\{C_{\mathrm{6}},C_{\mathrm{7}},T_{\mathrm{4}}\}$ ; then the attacker masquerades as a legitimate user to start a new session with the $GW$ node by sending $\{DI{D}_i^{\prime },SI{D}_j,D_i,E_i,C_1^{\prime },T_4\}$ back to the $GW$ node, where $DI{D}_i^{\prime }=C_6$ and $C_{\mathrm{1}}^{\prime }=C_{\mathrm{7}}$ . The $GW$ node computes $M_1=DI{D}_i^{\prime }\oplus h(h(I{D}_i\parallel P{W}_i)\parallel SI{D}_j\parallel T_4)$ and $M_2=h(M_1\parallel h(I{D}_i\parallel P{W}_i)\parallel SI{D}_j\parallel T_4)$ and checks whether $M_{\mathrm{2}}$ is equal to $C_{\mathrm{1}}^{\prime }$ . If they are not equal, the attacker cannot authenticate from the $GW$ node.

4.1.4. Password Guessing Attack

Even when an attacker eavesdrops on $U_i$ 's login request message $\{DI{D}_i,SI{D}_j,D_i,E_i,C_1,T_1\}$ , the attacker cannot guess $U_i$ 's password $P{W}_i$ from login request message $\{DI{D}_i,SI{D}_j,D_i,E_i,C_1,T_1\}$ . This is because the attacker cannot determine the x, y, b, and $I{D}_i$ from login request message $\{DI{D}_i,SI{D}_j,D_i,E_i,C_1,T_1\}$ due to the nature of the one-way hash function.

4.1.5. Replay Attack

We assume that an attacker intercepts $U_i$ 's login request message $\{DI{D}_i,SI{D}_j,D_i,E_i,C_1,T_1\}$ in the login phase. The attacker is replaying the intercepted message to authenticate but cannot authenticate from the server, because the timestamp $T_{\mathrm{1}}$ fails to validate. Although the attacker generates the correct timestamp T, he/she cannot compute the correct login request message, because b, $I{D}_i$ , and $P{W}_i$ are not known.

4.1.6. Stolen Smart Card Attack

We assume that an attacker steals $U_i$ 's smart card or extracts information from $U_i$ 's smart card. However, the attacker cannot compute the login request message without knowing $I{D}_i$ and $P{W}_i$ . In addition, the attacker cannot obtain $I{D}_i$ and $P{W}_i$ through the extracted information because of the nature of the one-way hash function. Therefore, the proposed scheme is resilient against stolen smart card attacks because the $I{D}_i$ and $P{W}_i$ cannot be obtained from $U_i$ 's stolen smart card.

4.1.7. Stolen-Verifier Attack

The proposed scheme can resist stolen-verifier attacks. In other words, in the proposed scheme, the $GW$ node does not store the verifier/password table for verification, so the attacker cannot obtain verification.

4.1.8. Mutual Authentication

The $GW$ node can authenticate the user by checking $C_{\mathrm{1}}$ in Step A1 of the authentication and key establishment phase, and the sensor node can authenticate the user and the $GW$ node by checking $C_{\mathrm{3}}$ in Step A3 of the authentication and key establishment phase. Likewise, the $GW$ node can authenticate the sensor node by checking $C_{\mathrm{5}}$ in Step A5 of the authentication and key establishment phase, and the user can authenticate the $GW$ node and sensor node by checking $C_{\mathrm{7}}$ in Step A7 of the authentication and key establishment phase.

4.2. Efficiency Analysis

Table 3 compares the performance of existing schemes with that of our proposed scheme. Our proposed scheme incurs less computational overhead than Nyang and Lee's [20] or Xue et al.'s [27] schemes. Although our proposed scheme incurs slightly more computational overhead than conventional schemes, it is more secure against various attacks than conventional schemes [18, 21, 22, 24, 25, 27].

Table 3

Performance analysis of the compared schemes.

Scheme	Registration phase			Login and authentication phase			Total
	User	GW	Sensor	User	GW	Sensor
Das [18]	∙	3T(h) + 1T(⊕)	∙	4T(h) + 1T(⊕)	3T(h) + 2T(⊕)	1T(h)	11T(h) + 4T(⊕)
Nyang and Lee [20]	∙	3T(h) + 1T(⊕)	∙	4T(h) + 1T(⊕) + 2T(K) + 1T(M) + 1T(D)	2T(h) + 2T(⊕) + 4T(K) + 1T(M) + 1T(E)	2T(K) + 2T(M) + 1T(E) + 1T(D)	9T(h) + 4T(⊕) + 8T(K) + 4T(M) + 2T(E) + 2T(D)
He et al. [21]	1T(h) + 1T(⊕)	5T(h) + 2T(⊕)	∙	5T(h) + 2T(⊕)	4T(h) + 2T(⊕)	1T(h)	16T(h) + 7T(⊕)
Khan and Alghathbar [22]	1T(h)	2T(h) + 1T(⊕)	∙	4T(h) + 1T(⊕)	4T(h) + 2T(⊕)	2T(h)	13T(h) + 4T(⊕)
Huang et al. [24]	∙	4T(h) + 1T(⊕)	∙	4T(h) + 1T(⊕)	4T(h) + 2T(⊕)	2T(h)	14T(h) + 3T(⊕)
Vaidya et al. [25]	1T(h)	4T(h) + 3T(⊕)	∙	6T(h) + 3T(⊕)	4T(h) + 3T(⊕)	2T(h) + 1T(⊕)	17T(h) + 10T(⊕)
Chen and Shih [26]	∙	3T(h) + 1T(⊕)	∙	5T(h) + 1T(⊕)	4T(h) + 2T(⊕)	1T(h)	13T(h) + 4T(⊕)
Xue et al. [27]	2T(h)	7T(h) + 2T(⊕)	3T(h)+ 1T(⊕)	9T(h) + 6T(⊕)	13T(h) + 7T(⊕)	6T(h) + 4T(⊕)	40T(h) + 20T(⊕)
Proposed scheme	2T(h) + 1T(⊕)	4T(h) + 2T(⊕)	∙	9T(h) + 3T(⊕)	12T(h) + 7T(⊕)	5T(h) + 3T(⊕)	33T(h) + 16T(⊕)

h: hash function operation; ⊕: XOR operation; K: key derivation function operation; M: message authentication code; E: symmetric encryption; D: symmetric decryption.

5. Results

5.1. Simulation Environments

In Section 4.2, we compared the performance of existing schemes with that of our proposed scheme. As a result, we implemented a simulation for various schemes. The simulation was performed and evaluated in a standard PC environment. The algorithm for the schemes was implemented using JAVA, and the simulation environment was evaluated with an Intel Core i5-2537 M (1.40 MHz) with 4 GB of RAM.

5.2. Simulation Results

Our simulation calculated the average time to perform the 10 simulation tests because the measured results were slightly different each time. Figure 4 shows the measured results for users performing the login and authentication phase. As shown in Figure 4, our proposed scheme incurs a little more computational time than existing schemes [18, 21, 22, 24–26]. However, our proposed scheme is more secure against various attacks than existing schemes and provides mutual authentication between the user and the $GW$ node, between the user and the sensor nodes, and between the $GW$ node and the sensor nodes. If our proposed scheme performs authentication to the $GW$ node and the sensor nodes only in the authentication phase, it will show measured results similar to the existing schemes [18, 21, 22, 24–26].

Figure 4

Analysis of time according to number of users.

6. Conclusion

In this paper, we proposed a secure and efficient mutual user authentication and key establishment scheme that can be used in ubiquitous WSNs. The proposed scheme provides mutual authentication between the user and the $GW$ node, between the user and the sensor node, and between the $GW$ node and the sensor node. Compared with existing schemes, the proposed scheme has been proven to be secure against various attacks. In addition, the proposed scheme is computationally efficient compared with existing schemes.