Security Improvement on Biometric Based Authentication Scheme for Wireless Sensor Networks Using Fuzzy Extraction

Abstract

Wireless sensor networks are used to monitor physical or environmental conditions. However, authenticating a user or sensor in wireless sensor networks is more difficult than in traditional networks owing to sensor network characteristics such as unreliable communication networks, resource limitation, and unattended operation. As a result, various authentication schemes have been proposed to provide secure and efficient communication. He et al. suggested a robust biometrics-based user authentication scheme, but Yoon and Kim indicated that their scheme had several security vulnerabilities. The latter then proposed an advanced biometrics-based user authentication scheme; in this paper, we analyze this advanced scheme and perform a cryptanalysis. Our analysis shows that Yoon and Kim's scheme has various security weaknesses such as a biometric recognition error, a user verification problem, lack of anonymity and perfect forward secrecy, session key exposure by the gateway node, vulnerability to denial of service attacks, and a revocation problem. Therefore, we suggest countermeasures that can be implemented to solve these problems and then propose a security-enhanced biometrics-based user authentication scheme using fuzzy extraction that conforms to the proposed countermeasures. Finally, we conduct a security analysis for the proposed biometrics-based user authentication scheme.

1. Introduction

Nowadays, numerous physical, chemical, and biological sensors are deployed in wireless sensor network (WSN) environments for various applications. These sensors can monitor a variety of conditions, including temperature, pressure, military surveillance, and real-time traffic conditions. One benefit of WSNs is that the sensors can be easily deployed in various kinds of harsh environments. Therefore, there has been a remarkable increase in the interest in WSNs [1]. WSNs generally consist of gateways, users, and sensors, and communication security is a momentous concern in real-world applications. Various authentication schemes for WSNs have been proposed for ensuring secure communication.

To support confidentiality and authentication for sensor networks, Watro et al. introduced a user authentication scheme employing the RSA and DH algorithms for WSNs in 2004. Wong et al. proposed a dynamic user authentication scheme that used a hash function [2]. But Tseng et al. indicated that Wong et al.'s authentication scheme has vulnerability to replay, stolen-verifier, and forgery attacks [3–7]. Das proposed a two-factor user authentication scheme based on a password and smart card to improve the security in 2009. Das demonstrated his scheme to be secure against various real-time attacks [6]. However, He et al. indicated that Das's scheme has vulnerability to insider attacks and impersonation attacks and that no provision was available for users to change their passwords. And also He et al. proposed an improved two-factor scheme to solve these security problems [8]. Khan and Alghathbar demonstrated that Das's scheme did not provide mutual authentication, and it has vulnerability to gateway bypassing and privileged-insider attacks [9]. Chen and Shih indicated that Das's scheme did not provide mutual authentication between the gateway and the sensor, and Chen and Shih proposed a robust mutual authentication scheme for WSNs and claimed that their scheme provides greater security than Das's scheme [10]. In 2010, Yuan et al. [11] proposed a biometric-based user authentication scheme, but it was found to have various security problems. Yoon and Yoo pointed out that Yuan et al.'s scheme has vulnerability to insider, user impersonation, gateway node impersonation, and sensor node impersonation attacks. To address these problems, Yoon and Yoo proposed an improved user authentication scheme [12]. However, in 2012, He demonstrated that Yoon and Yoo scheme was still vulnerable to denial of service (DoS) and sensor impersonation attacks. The former then proposed an improved scheme to overcome these security problems [13].

In 2013, Yoon and Kim [14] indicated that even He et al.’ scheme had various security vulnerabilities such as poor repair-ability and vulnerability to user and sensor node impersonation attacks. The former then proposed an advanced biometrics-based user authentication scheme for WSNs. They demonstrated that their scheme was more effective and had stronger security than other related schemes [13, 14]. To verify the security of Yoon and Kim's advanced scheme, we analyzed their scheme and performed a security cryptanalysis. We found that it has various security problems, including a biometric recognition error, a user verification problem, lack of anonymity and perfect forward secrecy, session key exposure by the gateway node, vulnerability to DoS attacks, and a revocation problem. To solve these problems, we first suggest appropriate countermeasures and then propose a biometrics-based user authentication scheme using fuzzy extraction with improved security that conforms to the proposed countermeasures. Moreover, we also conduct a security analysis of 16 security properties for the proposed biometrics-based user authentication scheme.

The remainder of this paper is organized as follows. Section 2 describes some related work to understand this paper. Section 3 explains Yoon and Kim's authentication scheme, and Section 4 analyzes their scheme to discuss the inherent security problems. Section 5 explains countermeasures to solve these problems. Section 6 proposes the biometric-based authentication using fuzzy extraction with improved security, and Section 7 presents a security analysis about 16 security properties for the proposed scheme. Section 8 concludes the paper.

2. Related Works

2.1. Attacker's Capability

Throughout this paper, we make the following assumptions about the capabilities of a probabilistic, polynomial-time attacker $\mathcal{A}$ in order to properly capture the security requirements of the two-factor authentication scheme that uses smart cards in WSNs [15].

• (i)

$\mathcal{A}$ has complete control over all message exchanges between the protocol participants, including a user, a sensor, and the gateway. That is, $\mathcal{A}$ can eavesdrop, insert, modify, intercept, and delete messages exchanged among the three parties at will.

(ii)

$\mathcal{A}$ is able to $(1)$ extract sensitive information from the smart card of a user through a power analysis attack or $(2)$ determine the user's password possibly via shoulder-surfing or by employing a malicious card reader. However, it is assumed that $\mathcal{A}$ is unable to compromise both the information of the smart card and the password of the user. It is otherwise clear that there is no way to prevent $\mathcal{A}$ from impersonating the user if both factors have been compromised.

2.2. Elliptic Curves Cryptography

Elliptic Curves Cryptography (ECC) is a form of public-key cryptography that is based on the use of algebraic structures of elliptic curves over finite fields. Elliptic curves are also used in several integer factorization algorithms. The important benefit of ECC is that it provides a smaller key size, so ECC can maintain the same degree of security with a smaller key size than other public-key forms of cryptography, such as Rivest Shamir Adleman (RSA), Diffie-Hellman (DH), and Digital Signature Algorithm (DSA). Therefore, ECC is especially useful for wireless devices that are typically limited in terms of their computational ability, power, and network connectivity.

ECC has three related mathematical problems: an Elliptic Curve Discrete Logarithm Problem (ECDLP), Elliptic Curve Computational Diffie-Hellman Problem (ECCDHP), and Elliptic Curve Decisional Diffie-Hellman Problem (ECDDHP). No polynomial time algorithm can solve the ECDLP, ECCDHP, and ECDDHP with nonnegligible probability.

Let $p>3$ be a large prime and choose two field elements $a,b\in {\mathbf{F}}_p$ satisfying $\mathrm{4}{a}^{\mathrm{3}}+\mathrm{27}{b}^{\mathrm{2}}\ne 0$ $\mathrm{mod}p$ to define the equation of a nonsuper-singular elliptic curve $\mathbf{E}\text{:}\hspace{0.17em}{y}^{\mathrm{2}}=x^{\mathrm{3}}+ax+b\mathrm{mod}p$ over ${\mathbf{F}}_p$ . Choose a generator point $P=(x\times P,y\times P)$ whose order is a large prime number q over $\mathbf{E}({\mathbf{F}}_p)$ . The subgroup G of the elliptic curve group $\mathbf{E}({\mathbf{F}}_p)$ with order q is constructed in the same way. Then, the three mathematical problems in ECC that are defined in several studies [16–18] are given as follows:

• (i)

ECDLP: given a point element Q in G, find an integer $x\in {\mathbf{Z}}_q^{\ast }$ such that $Q=x\times P$ , where $x\times P$ indicates that point P is added to itself x times through an operation with elliptic curves.

(ii)

ECCDHP: for $a,b\in {\mathbf{Z}}_q^{\ast }$ , given two point elements $a\times P$ , $b\times P$ in G, compute $a\times b\times P$ in G.

(iii)

ECDDHP: for $a,b,c\in {\mathbf{Z}}_q^{\ast }$ , given three point elements $a\times P$ , $b\times P$ , and $c\times P$ in G, decide whether $c\times P=a\times b\times P$ .

In the proposed scheme, we use ECDLP for protecting $r_i$ and $r_s$ . In detail, a user sends $X_i=r_i\times P$ to the gateway, and the sensor node sends $Y_i=r_s\times P$ to the user for authentication and session key agreement. If an attacker knows $r_i$ and $r_s$ , he can attempt various attacks. However, the attacker cannot compute $r_i$ and $r_s$ due to ECDLP even if he steals $X_i$ and $Y_i$ from public communication. And in proposed scheme, we use ECCDHP for protecting $K_{US}=K_{SU}=r_i\times r_s\times P$ . In other words, An attacker cannot compute $K_{US}$ and $K_{SU}$ due to ECCDHP even thought he know $X_i$ and $Y_i$ . Only legal user and sensor node can compute $K_{US}$ and $K_{SU}$ , respectively, using $X_i$ and $Y_i$ , and own random number. The user computes $K_{US}=r_i\times Y_i=r_i\times r_s\times P$ and the sensor node computes $K_{SU}=r_s\times X_i=r_s\times r_i\times P$ .

2.3. Fuzzy Extraction

The fuzzy extractor converts biometric information into a uniformly random string. Therefore, it is possible to apply cryptographic techniques for biometric security. The extractor consists of a pair of efficient randomized procedures, $\text{Gen}$ (generate) and $\text{Rep}$ (reproduce). Li et al.'s scheme uses $\text{Gen}(B_i)=(R_i,P_i)$ and $R_i=\text{Rep}(B_i^{\prime },P_i)$ are used. The fuzzy extractor $\text{Gen}$ generates $R_i$ and $P_i$ by using a user's biometric information during the registration phase. $R_i$ is a uniform and random string, and $P_i$ is the helper string; thus, $R_i$ can be the same under the assistance of auxiliary information $P_i$ even if the the biometric information that has been input changes, so long it maintains a reasonably similar status as the original biometric information. As a result, the fuzzy extraction is error-tolerant, and $\text{Rep}$ reproduces the $R_i$ using the biometric information that has been newly input $B_i^{\prime }$ and $P_i$ in the login phase. To reproduce the same $R_i$ , the metric space distances between $B_i$ and $B_i^{\prime }$ have to meet the given verification threshold [19, 20].

The basic notation that is used consistently throughout this paper is shown in “Notations.”

3. Review of Yoon and Kim's Authentication Scheme

Yoon and Kim's authentication scheme includes a registration phase and login and authentication phases. This scheme does not require making changes to a user's password because this scheme only uses biometrics. The gateway node has two master keys $(x$ and $y)$ and before starting the system, the gateway issues a long-term secret key $h({S\text{ID}}_j\parallel y)$ to sensor node $S_j$ . x is then used for $U_i$ . During the registration phase, the gateway issues a smart card stored as $h({\text{ID}}_i\parallel x)$ to $U_i$ [11].

3.1. Registration Phase

In the registration phase, a user $U_i$ communicates securely with the gateway. $U_i$ sends important information regarding the user's identification and biometrics. Figure 1 describes the registration phase, and detailed steps are given as follows. First, $U_i$ chooses ${\text{ID}}_i$ and imprints his biometrics $B_i$ on the specific sensor device. Then, $U_i$ computes $E_i=h({\text{ID}}_i,E_i)$ and sends ${\text{ID}}_i$ and $E_i$ to $\text{GW}$ node by using a secure channel. Then, $\text{GW}$ node computes two values: $R_i=h({\text{ID}}_i\parallel x)\oplus E_i$ and $V_i=h({\text{ID}}_i\parallel E_i)$ . And the $\text{GW}$ node inputs $〈\text{I}{\text{D}}_{\text{i}},R_i,V_i,h\left(·\right),d\left(·\right),\tau 〉$ into a smart card and sends the smart card to user $U_i$ . $h(·)$ is a one-way hash function. $d(·)$ is a symmetric parametric function and τ is a predetermined threshold for the biometric verification.

Figure 1

Registration phase of Yoon and Kim's scheme.

3.2. Login and Authentication Phases

During the login and authentication phases, when $U_i$ enters ${\text{ID}}_i$ and $B_i$ into a smart card terminal, the smart card must validate the legitimacy of $U_i$ . Then, $U_i$ , $S_j$ , and $\text{GW}$ authenticate each other. This scheme uses three messages $〈M_{\mathrm{1}},M_{\mathrm{2}},M_{\mathrm{3}}〉$ during authentication, as shown in Figure 2. Finally, $U_i$ and $S_j$ share the session key $\text{sk}$ after the login and authentication phases; $U_i$ and $S_j$ communicate with each other using the session key $\text{sk}$ .

• (1)

$U_i$ inserts his smart card into the card reader and imprints his biometric $B_i$ on a specific device to verify the user's biometrics.

(2)

The smart card computes two values: $E_i^{\ast }=h({\text{ID}}_i,B_i)$ and $V_i^{\ast }=h({\text{ID}}_i\parallel E_i^{\ast })$ .

(3)

The smart card compares the computed $V_i^{\ast }$ and the $V_i$ that is stored in the smart card. If $d(V_i,V_i^{\ast })\le \tau$ , the user's smart card stops the login phase. Otherwise, the smart card generates a random number $r_i$ .

(4)

The smart card computes three values: $D_i=R_i\oplus E_i^{\ast }$ , $k_i=h(D_i\parallel T_i)$ , and $C_i=E_{k_i}({\text{ID}}_i\parallel r_i)$ , where $T_i$ is the current timestamps.

(5)

Then, the smart card sends the login message $M_{\mathrm{1}}=〈{\text{ID}}_i,C_i,T_i〉$ to the $\text{GW}$ node.

Figure 2

Login and authentication phase of Yoon and Kim's scheme.

$GW$ receives $M_{\mathrm{1}}$ and executes the following actions.

• (1)

The $\text{GW}$ node checks the freshness of $T_i$ by using $(T^{\prime }-T_i)\le \Delta T$ . $\Delta T$ is the expected time interval for the transmission delay. If $T_i$ is not fresh, the $\text{GW}$ node rejects the user's request.

(2)

The $\text{GW}$ node computes three values: $D_i^{\prime }=h({\text{ID}}_i\parallel x)$ , $k_i^{\prime }=h(D_i^{\prime }\parallel T_i)$ , and ${\text{ID}}_i^{\prime }\parallel r_i^{\prime }=D_{k_i^{\prime }}(C_i)$ .

(3)

The $\text{GW}$ node checks whether ${\text{ID}}_i$ and ${\text{ID}}_i^{\prime }$ are equal. If they are not equal, the $\text{GW}$ node stops the session. Otherwise, the $\text{GW}$ node picks up the current timestamps $T_g$ .

(4)

The $\text{GW}$ node computes two values: $k_g=h(h({S\text{ID}}_j\parallel y)\parallel T_g)$ and $C_g=E_{k_g}({\text{ID}}_i^{\prime }\parallel r_i^{\prime })$ .

(5)

The $\text{GW}$ node then computes $M_{\mathrm{2}}=〈{\text{ID}}_i,C_g,T_g〉$ and sends it to the sensor node $S_j$ .

$S_j$ receives $M_{\mathrm{2}}$ and performs the following actions.

• (1)

$S_j$ checks the freshness of $T_g$ using $(T^{\prime \prime }-T_g)\le \Delta T$ .

(2)

$S_j$ computes two values: $k_g^{\prime }=h(h({S\text{ID}}_j\parallel y)\parallel T_g)$ and ${\text{ID}}_i^{\prime \prime }\parallel r_i^{\prime \prime }=D_{k_g^{\prime }}(C_g)$ .

(3)

$S_j$ checks whether ${\text{ID}}_i$ and ${\text{ID}}_i^{\prime \prime }$ are equal and $S_j$ picks up the current timestamps $T_s$ .

(4)

$S_j$ generates $\text{RM}$ and computes $V_s$ . $\text{RM}$ is response to the query of $U_i$ ; $V_s=h({\text{ID}}_i^{\prime \prime }\parallel r_i^{\prime \prime }\parallel \text{RM}\parallel T_s)$ .

(5)

$S_j$ computes $M_{\mathrm{3}}=〈\text{RM},V_s,T_s〉$ and sends it to the user $U_i$ .

$U_i$ receives $M_{\mathrm{3}}$ and executes the following actions.

• (1)

$U_i$ checks the freshness of $T_s$ using $(T^{\prime \prime \prime }-T_s)\le \Delta T$ .

(2)

$U_i$ computes $V_s^{\prime }=h({\text{ID}}_i\parallel r_i\parallel \text{RM}\parallel T_s)$ and checks whether $V_s^{\prime }$ and $V_s$ are the same.

(3)

If the entire authentication phase finishes without any problems, $U_i$ accepts $\text{RM}$ .

(4)

$U_i$ and $S_j$ communicate with each other securely using the session key $\text{sk}$ , and $U_i$ and $S_j$ compute $\text{sk}=h({\text{ID}}_i\parallel r_i\parallel T_s)$ .

4. Cryptanalysis of Yoon and Kim's Authentication Scheme

4.1. Biometric Recognition Error

Yoon and Kim's authentication scheme uses a one-way hash function to provide biometric verification. This hash function can be used to map the data of an arbitrary size to data of a fixed size with slight differences in the input data producing very large differences in the output data. Figure 3 describes the biometric recognition error in Yoon and Kim's scheme. Biometrics have general limitations such as false acceptance and false rejection. This means that the output of the imprinted biometrics is not always constant. Although $U_i$ inputs its own biometrics to the scanning device, it is possible to output a different ${~B}_i^{\ast }$ . Therefore, the same biometrics can generate different output, such as the $B_i^{\ast }$ and $\hspace{0.17em}{~B}_i^{\ast }$ . A different $\hspace{0.17em}{~B}_i^{\ast }$ causes slight differences in $E_i^{\ast }$ and ${~E}_i^{\ast }$ . Therefore, this difference produces a very large difference between $V_i^{\ast }$ and ${~V}_i^{\ast }$ due to the property of hash function. The large difference between $V_i^{\ast }$ and ${~V}_i^{\ast }$ causes a biometric recognition error, so a legal user can fail to accept the smart card verification. As a result, advanced techniques are needed to improve the success rate of a legal user's verification [5].

Figure 3

Biometric recognition error on Yoon and Kim's scheme.

4.2. User Verification Problem

In Yoon and Kim's authentication scheme, $\text{GW}$ verifies a legal user by comparing ${\text{ID}}_i$ in $M_{\mathrm{1}}$ and ${\text{ID}}_i^{\prime }$ in the output of the decrypted $C_i$ . Specifically, the user computes $C_i$ using a symmetric encryption algorithm; $C_i=E_{k_i}({\text{ID}}_i\parallel r_i)$ . ${\text{ID}}_i$ and $r_i$ do not matter but $E_{k_i}$ has a problem in that there is a possibility to obtain unexpected results. This is the reason why $E_{k_i}$ is made up by $D_i$ and $T_i$ and $D_i$ consist of $R_i$ , $E_i^{\ast }$ :

$$\begin{array}{cc}& E_i^{\ast }=h\left({\text{ID}}_i,B_i\right),\\ D_i=R_i\oplus E_i^{\ast },\\ k_i=h\left(D_i\parallel T_i\right),\\ C_i=E_{k_i}\left({\text{ID}}_i\parallel r_i\right).\end{array}$$

(1)

Even if biometrics are the same, the output of the scanning device is not constant. Therefore, the same biometrics can generate a different output, like $~B_i^{\ast }$ . The different output of the biometrics causes slight differences in $E_i^{\ast }$ and $~E_i^{\ast }$ . Due to these slight differences, different $~D_i$ and $~k_i$ are produced. As a result, the user and $\text{GW}$ en/decrypt the $C_i$ using different keys. $\text{GW}$ cannot get a normal ${\text{ID}}_i$ from $C_i$ so the user is not authenticated by $\text{GW}$ even when the user uses its own normal ${\text{ID}}_i$ and $B_i$ . This is the reason why the hash function and the symmetric key encryption algorithm have a property that results in large differences due to a slight difference of input. Figure 4 specifically describes the user verification problem in Yoon and Kim's scheme.

Figure 4

User verification problem on Yoon and Kim's scheme.

4.3. Lack of Anonymity

Figure 5 describes how Yoon and Kim's scheme does not provide the anonymity. In this scheme, the user sends its own $U_i$ to $\text{GW}$ over public communication, and $\text{GW}$ sends $U_i$ to the sensor without any protection. Therefore, an attacker can easily acquire $U_i$ from those communications. This results in an information exposure problem. For the $\text{GW}$ ’ incoming communication, an attacker can obtain information of the approximate number of registered users to $\text{GW}$ . Also an attacker can acquire information on which user communicates with $S_j$ . Therefore, the lack of anonymity in Yoon and Kim's scheme raises some problems that need to be addressed by providing user anonymity through a protection technique. To solve this problem, it is necessary to use anonymity identification ${\text{AID}}_i$ in the WSNs communication instead of sending a normal ${\text{ID}}_i$ [21–23].

Figure 5

Lack of anonymity on Yoon and Kim's scheme.

4.4. Lack of Perfect Forward Secrecy

Perfect forward secrecy means that a session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised at some point in the future [24]. Unfortunately, Yoon and Kim's authentication scheme does not provide perfect forward secrecy. Therefore, an attacker can compute the session key $\text{sk}$ between the $U_i$ and $S_j$ if the attacker knows one of the long-term keys $D_i$ in the future. The following list describes how Yoon and Kim's scheme does not provide perfect forward secrecy [5]:

• (1)

Attacker got $C_i$ , $T_i$ , and $T_s$ in previous public channel.

(2)

Attacker knew one of user's long-term secret: $D_i$ .

• ⇒

Attacker has $C_i$ , $T_i$ , $T_s$ , and $D_i$ and computes $k_i$ and $D_{k_i}$ as follows:

⇒

$k_i=h(D_i\parallel T_i)$ ,

⇒

$D_{k_i}\left(C_i\right)={\text{ID}}_i\parallel r_i$ .

(3)

Attacker acquires ${\text{ID}}_i$ and $r_i$ and then computes $\text{sk}$ .

• ⇒

$\text{sk}=h\left({\text{ID}}_i{\parallel r_i\parallel T}_s\right)$ .

(4)

Attacker can compute all of previous session key sk.

In advance, the attacker obtains $C_i$ , $T_i$ , and $T_s$ from previous communication between $U_i$ and $S_j$ . The attacker obtains one of the user's long-term secrets $D_i$ . Then, the attacker can compute $k_i=h(D_i\parallel T_i)$ and decrypt the $C_i$ using the computed $k_i$ . So the attacker can figure out ${\text{ID}}_i$ and random number $r_i$ . Finally, the attacker can compute the session key $\text{sk}$ using ${\text{ID}}_i$ , $r_i$ , and $T_s$ .

4.5. Session Key Exposure by the Gateway Node

The session key $\text{sk}$ is used to provide secure communications between $U_i$ and $S_j$ after the authentication phase is successfully finished. Even if the $\text{GW}$ node is a trusted node, it is not necessary for the $\text{GW}$ node to know $\text{sk}$ because $U_i$ usually wants to communicate secretly with $S_j$ without the observation of the $\text{GW}$ node. However, in Yoon and Kim's authentication scheme, the $\text{GW}$ node can compute $\text{sk}$ without difficulty. $\text{GW}$ node can collect previous ${\text{ID}}_i$ and $r_i$ in $U_i$ 's authentication phase and thus can obtain all $T_s$ over a public channel. Then, the $\text{GW}$ node can compute all $\text{sk}=h({\text{ID}}_i\parallel r_i\parallel T_s)$ between $U_i$ and $S_j$ . Therefore, the $\text{GW}$ node can decrypt the encrypted message between $U_i$ and $S_j$ , and can figure out all $U_i$ 's secret messages that are protected by session key $\text{sk}$ . The session key exposure by GW on Yoon and Kim's scheme [5] is described as follows:

• (1)

GW knew ${\text{ID}}_i$ and $r_i$ in communication with $U_i$ .

(2)

GW got $T_s$ in public channel:

•  

⇒ $\text{GW}$ has ${\text{ID}}_i$ , $r_i$ and $T_s$ ,

 

⇒ $\text{sk}=h({\text{ID}}_i\parallel r_i\parallel T_s)$ .

(3)

GW can compute all session key sk between $U_i$ and $S_j$ .

(4)

GW can decrypt the secret messages between $U_i$ and $S_j$ .

(5)

GW can acquire important information between $U_i$ and $S_j$ .

4.6. Vulnerability to Denial of Service Attack

Figure 6 shows the potential for a DoS attack on Yoon and Kim's authentication scheme. The attacker can send malicious messages $〈{\text{ID}}_i,C_i,T_c〉$ that have been generated to consume the battery power of the $\text{GW}$ node and sensor node. The attacker obtains ${\text{ID}}_i$ and $C_i$ from the previous public channel communication and generates a current timestamps $T_c$ . When the $\text{GW}$ node and the sensor node receive the malicious messages $〈{\text{ID}}_i,C_i,T_c〉$ , they first check for the freshness of the timestamps $T_c$ . However, the $T_c$ generated by the attacker is current, and the $\text{GW}$ node and sensor cannot determine that ${\text{ID}}_i$ and $C_i$ are from previous messages. So they execute various functions, such as a hash function, decryption function, and verification function before checking whether the ${\text{ID}}_i$ sent by the attacker and the computed ${\text{ID}}_i$ are the same. Therefore, the attacker is able to execute a DoS attack without difficulty [5]. The $\text{GW}$ node has sufficient resources that can be used in the system, but the sensors are different. The sensor nodes have a limited computational ability, low battery, low bandwidth, and a small amount of memory. The computational cost of a sensor node is a critical consideration in the design of WSNs since this increases the consumption of the battery power of the sensor [15]. Quite often it is economically preferable to discard a sensor rather than recharge it, and for this reason, the battery power of a sensor is usually important for wireless devices, with its lifetime determining the sensor lifetime. Therefore, it is significant issue for the sensor node to be protected from a DoS attack.

Figure 6

Vulnerability to denial of service attack on Yoon and Kim's scheme.

4.7. Revocation Problem

Yoon and Kim's authentication scheme does use the user's password but only uses the user's ${\text{ID}}_i$ and biometrics $B_i$ . Therefore, a password change phase is not necessary. For this reason, when an attacker steals or picks up the user's smart card, a revocation problem occurs. When the $\text{GW}$ node issues the user's smart card, it always produces the same $〈{\text{ID}}_i,R_i,V_i,h(·),d(·),\tau 〉$ if the $U_i$ sends the same ${\text{ID}}_i$ and $B_i$ to the $\text{GW}$ node. So even though $U_i$ reissues a new smart card, $U_i$ cannot discard the lost smart card because the reissued smart card and the lost smart card are the same. Therefore, the user $U_i$ has to change his ID in order to reissue a different smart card. Figure 7 describes the potential problem due to lack of revocation phase on Yoon and Kim's scheme [5].

Figure 7

Revocation problem on Yoon and Kim's scheme.

5. Countermeasures

The vulnerability of Yoon and Kim's scheme to a biometric recognition error and a user verification problem is due to the fact that

• (i)

though the same $U_i$ inputs its own biometrics to the scanning device, a different output can be generated;

(ii)

the hash function makes slight differences in the input data by producing very large differences in the output data;

(iii)

in a symmetric key encryption algorithm $E_{k_i}$ , small differences of $k_i$ produce large differences in the output.

This design flaw causes normal users to fail the login phase using smart card. Therefore, we suggest modifying the $E_i^{\ast }=h({\text{ID}}_i,B_i^{\ast })$ , $V_i^{\ast }=h({\text{ID}}_i\parallel E_i^{\ast })$ , and $d(V_i,V_i^{\ast })\le \tau$ to prevent a biometric recognition error. Moreover, the difference in $B_i$ and $B_i^{\ast }$ results in a different encryption key $k_i$ . So, this can cause a user verification problem because the differences in $K_i$ and $K_i^{\prime }$ produce a different $C_i$ that is used for authentication between $U_i$ and the $\text{GW}$ node. To prevent an authentication error, we also suggest modifying $D_i=R_i\oplus E_i^{\ast }$ and $k_i=h(D_i\parallel T_i)$ . We thus improve Yoon and Kim's scheme using fuzzy extraction as follows.

During the registration phase, instead of $E_i^{\ast }=h({\text{ID}}_i,B_i^{\ast })$ , the smart card computes $R_i$ and $P_i$ using a fuzzy extraction function $\text{Gen}(B_i)$ such as $〈R_i,P_i〉=\text{Gen}(B_i)$ . It also computes $F_i=h(R_i)$ and sends both ${\text{ID}}_i$ and $F_i$ to the $\text{GW}$ node. The $\text{GW}$ node modifies the computation of $A_i$ and $V_i$ from $A_i=h({\text{ID}}_i\parallel x)\oplus E_i$ and $V_i=h({\text{ID}}_i\parallel E_i)$ to

$$\begin{array}{cc}& A_i=h\left(R_i\right),\\ M_i=h\left({\text{ID}}_i\parallel x\right)\oplus A_i,\\ V_i=h\left({\text{ID}}_i\parallel A_i\right).\end{array}$$

(2)

During the login and authentication phase, instead of $E_i^{\ast }=h({\text{ID}}_i,B_i^{\ast })$ , $V_i^{\ast }=h({\text{ID}}_i\parallel E_i^{\ast })$ , $d(V_i,V_i^{\ast })\le \tau$ , and $D_i=A_i\oplus E_i^{\ast }$ , smart card computes the following:

$$\begin{array}{cc}& R_i^{\ast }=\text{Rep}\left(B_i^{\ast },P_i\right),\\ A_i^{\ast }=h\left(R_i^{\ast }\right),\\ V_i^{\ast }=h\left({\text{ID}}_i\parallel A_i^{\ast }\right),\\ V_i\stackrel{?}{=}{V}_i^{\ast },\\ D_i=M_i\oplus A_i^{\ast }.\end{array}$$

(3)

As a result of this modification carried out using a fuzzy extraction function, the accuracy of verification using biometrics improves. Consequently, the biometric recognition error and user verification problem can be solved.

We next present a possible mechanism for eliminating the vulnerability in Yoon and Kim's scheme due to the lack of anonymity. This vulnerability is due to the fact that

• (i)

${\text{ID}}_i$ is used in public communication without any protection;

(ii)

the $\text{attacker}$ can know how many users are registered in $\text{GW}$ and which user wants to access $S_j$ .

Using the user's ${\text{ID}}_i$ , the attacker can acquire a variety of information on the user, $\text{GW}$ , and the sensor. Therefore, we propose to use an anonymity ${\text{AID}}_i$ to provide anonymity. Instead of sending a normal ${\text{ID}}_i$ , we suggest using ${\text{AID}}_i$ in the communication as follows:

$$\begin{array}{cc}& {\text{AID}}_i={\text{ID}}_i\oplus h\left(h\left(x\parallel y\right)\parallel T_i\right).\end{array}$$

(4)

$\text{GW}$ sends $h(x\parallel y)$ to a user using $N_i$ = $h(x\parallel y)\oplus A_i$ in registration phase. $h(x\parallel y)$ uses only a previous secret x and y so it does not need to add a new secret. The attacker and sensor cannot know $h(x\parallel y)$ and ${\text{AID}}_i$ changes every session due to $T_i$ so we can provide user anonymity.

To provide the perfect forward secrecy in our proposed scheme, we modify the computation of $\text{sk}$ from $\text{sk}$ = $h({\text{ID}}_i\parallel r_i\parallel T_s)$ to

$$\begin{array}{cc}& \text{sk}=h\left({\text{AID}}_i\parallel K_{US}\parallel T_s\right).\end{array}$$

(5)

${\text{AID}}_i={\text{ID}}_i\oplus h(h(x\parallel y)\parallel T_i)$ has a secret $h(x\parallel y)$ . Therefore, $\text{sk}$ has two secret $h(x\parallel y)$ and $K_{US}$ ; moreover, they are independent on each other, and so the session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised in the future. $K_{US}$ is thus important information between $U_i$ and $S_j$ :

$$\begin{array}{cc}& K_{US}=r_i\times r_s\times P.\end{array}$$

(6)

Since $K_{US}$ can be used to eliminate the vulnerability in Yoon and Kim's scheme to session key exposure by the $\text{GW}$ node, this vulnerability is due to the fact that

• (i)

  the $\text{GW}$ node can know all elements of $\text{sk}$ including $r_i$ ;

• (ii)

  it is hard to share secret information between $U_i$ and $S_j$ in advance.

To prevent this problem, we suggest a key exchange using elliptic curve encryption. The user generates $r_i$ and computes $X_i$ and $K_{US}$ :

$$\begin{array}{cc}& X_i=r_i\times P,\\ K_{US}=r_i\times Y_i=r_i\times r_s\times P.\end{array}$$

(7)

Then, the user sends $X_i$ to the sensor through the $\text{GW}$ and receives $Y_i$ from the sensor, so the sensor can compute $\text{sk}$ as follows:

$$\begin{array}{cc}& Y_i=r_s\times P,\\ K_{SU}=r_s\times X_i=r_s\times r_i\times P.\end{array}$$

(8)

$K_{US}$ and $K_{SU}$ can be used by the user and sensor to compute $\text{sk}=h({\text{AID}}_i\parallel K_{US}\parallel T_s)$ in a manner that is concealed from the $\text{GW}$ node. Therefore, we resolve the session key exposure by the $\text{GW}$ node.

However, even after implementing the modifications described above, Yoon and Kim's scheme is vulnerable to DoS attacks. This type of attack results from the fact that

• (i)

$\text{GW}$ and the sensor perform all operations without checking the freshness of the incoming messages;

(ii)

in particular, the sensor has limited energy but this scheme verifies messages after performing various operations.

To prevent the vulnerability to DoS attack, we suggest adding verification to $M_{\mathrm{1}}$ and $M_{\mathrm{2}}$ to check incoming message. We modify the computations for $M_{\mathrm{1}}$ and $M_{\mathrm{3}}$ from $M_{\mathrm{1}}=〈{\text{ID}}_i,C_i,T_i〉$ and $M_{\mathrm{2}}=〈{\text{ID}}_i,C_g,T_g〉$ to

$$\begin{array}{cc}& M_{\mathrm{1}}=〈{\text{AID}}_i,X_i,C_i,T_i,W_i〉,\\ M_{\mathrm{2}}=〈{\text{AID}}_i,C_g,T_g,W_g〉.\end{array}$$

(9)

In advance, the $\text{GW}$ node and sensor check $W_i$ and $W_g$ to verify an incoming message:

$$\begin{array}{cc}& W_i=h\left(h\left(x\parallel y\right)\parallel {\text{AID}}_i\parallel X_i\parallel C_i\parallel T_i\right),\\ W_g=h\left(h\left({S\text{ID}}_j\parallel y\right)\parallel {\text{AID}}_i\parallel C_g\parallel T_g\right).\end{array}$$

(10)

$W_i$ and $W_g$ are thus only computed for a legal user and the $\text{GW}$ node. Due to this modification, the $\text{GW}$ node and sensor can prevent a DoS attack by checking $W_i$ and $W_g$ in $M_{\mathrm{1}}$ and $M_{\mathrm{2}}$ , respectively.

Finally, the revocation problem is prevented by implementing a revocation and reissue phase. This phase should also be modified for consistency, particularly to induce a user to select identification different from previous identifications (see Section 6.3 for details). All the modifications suggested above are combined to propose an improved authentication scheme that is described in the following section.

6. Proposed Scheme

Our proposed scheme is divided into three phases: a user registration phase, login and authentication phase, and revocation and reissue phase. Before our scheme is executed, $\text{GW}$ generates two master keys, x and y, and provides a long-term secret key $h({S\text{ID}}_j\parallel y)$ to the sensor $S_j$ .

6.1. Registration Phase

The registration phase of the proposed scheme is described in Figure 8. The $U_i$ perform a user registration phase with $\text{GW}$ by using a secure channel. $U_i$ computes $B_i$ by using a biometrics scanning device and $R_i$ and $P_i$ using fuzzy extraction. Then, the user's information is sent to the $\text{GW}$ for registration. However, the $\text{GW}$ cannot store the user's biometrics information. The detailed steps are as follows.

• (1)

$U_i$ selects ${\text{ID}}_i$ and scans its own biometrics to compute $B_i$ .

(2)

$U_i$ computes $〈R_i,P_i〉=\text{Gen}(B_i)$ and $A_i=h(R_i)$ . And then $U_i$ sends $〈{\text{ID}}_i,A_i〉$ to the $\text{GW}$ node.

(3)

After receiving $〈{\text{ID}}_i,A_i〉$ , the $\text{GW}$ node computes the authentication parameters for $U_i$ as follows:

$$\begin{array}{cc}& M_i=h\left({\text{ID}}_i\parallel x\right)\oplus A_i,\\ N_i=h\left(x\parallel y\right)\oplus A_i,\\ V_i=h\left({\text{ID}}_i\parallel A_i\right).\end{array}$$

(11)

(4)

$\text{GW}$ stores ${\text{ID}}_i$ , $h(·)$ , and the authentication parameters; $〈{\text{ID}}_i,M_i,N_i,V_i,h(·)〉$ in a smart card. And GW issues the smart card to $U_i$ through a secure channel.

(5)

$U_i$ receives the smart card and inputs $P_i$ to the smart card.

Figure 8

Registration phase of the proposed scheme.

6.2. Login and Authentication Phases

The login and authentication phase of the proposed scheme is described in Figure 9. During the login phase, the smart card checks the user's legality by using the user's $U_i$ and biometrics $B_i^{\ast }$ . $\text{GW}$ authenticates the user by checking ${\text{ID}}_i$ through the detailed steps of the login phase as follows:

• (1)

$U_i$ inserts his smart card into a card reader. Then, $U_i$ inputs his ${\text{ID}}_i$ and computes the biometric information $B_i^{\ast }$ using a scanning device. The smart card computes $R_i^{\ast }$ , $A_i^{\ast }$ , and $V_i^{\ast }$ using fuzzy extraction and compares $V_i^{\ast }$ with $V_i$ stored in smart card as follows:

$$\begin{array}{cc}& R_i^{\ast }=\text{Rep}\left(B_i^{\ast },P_i\right),\\ A_i^{\ast }=h\left(R_i^{\ast }\right),\\ V_i^{\ast }=h\left({\text{ID}}_i\parallel A_i^{\ast }\right),\\ \text{verifies\hspace{0.17em}\hspace{0.17em}}{V}_i\stackrel{?}{=}{V}_i^{\ast }.\end{array}$$

(12)

(2)

The smart card generates a random number $r_i$ and computes $X_i$ , $D_i$ , and $h(x\parallel y)$ . $X_i$ is used for the session key between $U_i$ and $S_j$ . This scheme uses $h(x\parallel y)$ to provide perfect forward secrecy:

$$\begin{array}{cc}& X_i=r_i\times P,\\ D_i=M_i\oplus A_i^{\ast },\\ h\left(x\parallel y\right)=N_i\oplus A_i^{\ast }.\end{array}$$

(13)

(3)

$U_i$ picks up the current timestamps $T_i$ and computes $k_i$ , $C_i$ , ${\text{AID}}_i$ , and $W_i$ for authentication with $\text{GW}$ . $W_i$ is used to prevent the DoS attack. Then, $U_i$ sends the authentication message $M_{\mathrm{1}}$ to $\text{GW}$ :

$$\begin{array}{cc}& k_i=h\left(D_i\parallel T_i\right),\\ C_i=E_{k_i}\left({\text{ID}}_i\parallel X_i\right),\\ {\text{AID}}_i={\text{ID}}_i\oplus h\left(h\left(x\parallel y\right)\parallel T_i\right),\\ W_i=h\left(h\left(x\parallel y\right)\parallel {\text{AID}}_i\parallel X_i\parallel C_i\parallel T_i\right),\\ M_{\mathrm{1}}=〈{\text{AID}}_i,X_i,C_i,T_i,W_i〉.\end{array}$$

(14)

(4)

Upon receiving $M_{\mathrm{1}}$ from $U_i$ , $\text{GW}$ retrieves the current timestamps $T^{\prime }$ and verifies the freshness of the $U_i$ ’ timestamps $T_i$ using $(T^{\prime }-T_i)\le \Delta T$ . Then, $\text{GW}$ verifies the received $W_i$ using $W_i\stackrel{?}{=}h(h(x\parallel y)\parallel {\text{AID}}_i\parallel X\parallel C_i\parallel T_i)$ .

(5)

$\text{GW}$ computes ${\text{ID}}_i^{\prime }$ , $D_i^{\prime }$ , and $k_i^{\prime }$ and decrypts the $C_i$ in $M_{\mathrm{1}}$ . The output of the decryption is used by $\text{GW}$ to authenticate $U_i$ by comparing ${\text{ID}}_i^{\prime }$ and ${\text{ID}}_i^{\prime \prime }$ :

$$\begin{array}{cc}& {\text{ID}}_i^{\prime }={\text{AID}}_i\oplus h\left(h\left(x\parallel y\right)\parallel T_i\right),\\ D_i^{\prime }=h\left({\text{ID}}_i^{\prime }\parallel x\right),\\ k_i^{\prime }=h\left(D_i^{\prime }\parallel T_i\right),\\ {\text{ID}}_i^{\prime \prime }\parallel X_i^{\prime }=D_{k_i^{\prime }}\left(C_i\right),\\ \text{verifies\hspace{0.17em}\hspace{0.17em}}{\text{ID}}_i^{\prime }\stackrel{?}{=}{\text{ID}}_i^{\prime \prime }.\end{array}$$

(15)

(6)

$\text{GW}$ picks up the current timestamps $T_g$ and $k_g$ , $C_g$ , and $W_g$ to authenticate $S_j$ . Then, $\text{GW}$ sends an authentication message $M_{\mathrm{2}}$ to $S_j$ :

$$\begin{array}{cc}& k_g=h\left(h\left({S\text{ID}}_j\parallel y\right)\parallel T_g\right),\\ C_g=E_{k_g}\left({\text{AID}}_i\parallel X_i^{\prime }\right),\\ W_g=h\left(h\left({S\text{ID}}_j\parallel y\right)\parallel {\text{AID}}_i\parallel C_g\parallel T_g\right),\\ M_{\mathrm{2}}=〈{\text{AID}}_i,C_g,T_g,W_g〉.\end{array}$$

(16)

(7)

With $M_{\mathrm{2}}$ in hand, $S_j$ retrieves the current timestamps $T^{\prime \prime }$ and checks if $T^{\prime \prime }-T_g\le \Delta T$ . If the freshness check for $T^{\prime \prime }$ fails, $S_j$ stops the authentication phase. Otherwise, $S_j$ computes $W_g$ and compares it with $h(h({S\text{ID}}_j\parallel y)\parallel {\text{AID}}_i\parallel C_g\parallel T_g)$ . After that, $S_j$ computes $k_g^{\prime }$ and decrypts $C_g$ using $k_g^{\prime }$ . Then, $S_j$ checks the sameness between the received ${\text{AID}}_i$ and the computed ${\text{AID}}_i^{\prime }$ :

$$\begin{array}{cc}& k_g^{\prime }=h\left(h\left({S\text{ID}}_j\parallel y\right)\parallel T_g\right),\\ {\text{AID}}_i^{\prime }\parallel X^{\prime }=D_{k_g^{\prime }}\left(C_g\right),\\ \text{verifies\hspace{0.17em}\hspace{0.17em}}{\text{AID}}_i\stackrel{?}{=}{\text{AID}}_i^{\prime }.\end{array}$$

(17)

(8)

To compute $\text{sk}$ , $S_j$ generates a random number $r_s$ and computes $K_{SU}$ , $Y_i$ . This $\text{sk}$ is computed only by $U_i$ and $S_j$ due to a mathematical problem inherent to ECC. Then, $S_j$ picks up the current timestamps $T_s$ and computes $\text{RM}$ , $V_s$ for the authentication. After the operation is finished, $S_j$ send $M_{\mathrm{3}}$ to $U_i$ :

$$\begin{array}{cc}& K_{SU}=r_s\times X_i^{\prime },\\ Y_i=r_s\times P,\\ \text{computes\hspace{0.17em}\hspace{0.17em}sk}=h\left({\text{AID}}_i\parallel K_{SU}\parallel T_s\right),\\ \text{RM}=\text{Response\hspace{0.17em}\hspace{0.17em}to\hspace{0.17em}\hspace{0.17em}the\hspace{0.17em}\hspace{0.17em}query\hspace{0.17em}\hspace{0.17em}of\hspace{0.17em}\hspace{0.17em}}{U}_i,\\ V_s=h\left({\text{AID}}_i^{\prime }\parallel X_i^{\prime }\parallel Y_i\parallel \text{RM}\parallel T_s\right),\\ M_{\mathrm{3}}=〈\text{RM},Y_i,V_s,T_s〉.\end{array}$$

(18)

(9)

First, $U_i$ checks the freshness in $T_s$ and the sameness of $V_s$ . Then, $U_i$ computes $K_{US}$ using the received $Y_i$ , and $\text{sk}$ by using ${\text{AID}}_i$ , $K_{US}$ , and $T_s$ . Only a legal $U_i$ computes $K_{US}$ using $Y_i$ so anyone cannot compute $\text{sk}$ including $\text{GW}$ . Then, $U_i$ accepts RM:

$$\begin{array}{cc}& \text{verifies\hspace{0.17em}\hspace{0.17em}}\left(T^{\prime \prime \prime }-T_s\right)\le \Delta T,\\ \text{verifies\hspace{0.17em}\hspace{0.17em}}{V}_s\stackrel{?}{=}h\left({\text{AID}}_i\parallel X_i\parallel Y_i\parallel \text{RM}\parallel T_s\right),\\ K_{US}=r_i\times Y_i,\\ \text{computes\hspace{0.17em}\hspace{0.17em}sk}=h\left({\text{AID}}_i\parallel K_{US}\parallel T_s\right),\\ \text{accepts\hspace{0.17em}\hspace{0.17em}RM}.\end{array}$$

(19)

(10)

From now on, $U_i$ can communicate securely with $S_j$ using $\text{sk}$ :

$$\begin{array}{cc}& \text{shared\hspace{0.17em}\hspace{0.17em}sk}=h\left({\text{AID}}_i\parallel r_i\times r_s\times P\parallel T_s\right),\\ h\left({\text{AID}}_i\parallel r_s\times X_i\parallel T_s\right)=h\left({\text{AID}}_i\parallel r_i\times Y_i\parallel T_s\right).\end{array}$$

(20)

Figure 9

Login and authentication phase of the proposed scheme.

6.3. Revocation and Reissue Phase

The revocation problem can result in serious attacks, so a revocation phase should be provided when $U_i$ wants to reissue a smart card due to loss. To prevent the same user identification from being selected, $U_i$ inputs the previous ${\text{ID}}_i$ . Then, $U_i$ selects a different identification ${\text{ID}}_i^{\ast }$ and sends ${\text{ID}}_i$ , ${\text{ID}}_i^{\ast }$ to the $\text{GW}$ with hashed biometrics information $A_i$ . After the $\text{GW}$ receives these, $\text{GW}$ revokes ${\text{ID}}_i$ and reissues the smart card using ${\text{ID}}_i^{\ast }$ . Then, $\text{GW}$ continues into a phase that is equal to the registration phase. Revocation and reissue phase of the proposed scheme is described in Figure 10.

Figure 10

Revocation and reissue phase of the proposed scheme.

7. Security Analysis

This section describes the security analysis to confirm the security of the proposed scheme. We need to provide the following definitions to then compare the proposed scheme to other authentication schemes, including that proposed by Yoon and Kim.

Definition 1.

A strong secret key $(B_i,x,y)$ has a high value of entropy $S(k)$ that cannot be guessed in polynomial time.

Definition 2.

A secure one-way hash function $y=h(x)$ is the following. Given x to compute y is easy but y to compute x is hard.

7.1. Biometric Recognition Error

The proposed scheme prevents a biometric recognition error by using fuzzy extraction. Yoon and Kim's scheme uses a hash function to check for conformity in the biometrics. Even if they use a threshold τ, since the hash function makes slight differences in the input data that produces very large differences in the output data, it is possible for biometric recognition errors to occur. However, the proposed scheme using fuzzy extractor prevents biometric recognition errors.

The fuzzy extractor $\text{Gen}()$ generates $R_i$ and $P_i$ using the user's biometric $B_i$ during the registration phase. $R_i$ is a uniform and random string, and $P_i$ is a helper string, so $R_i$ can be the same with the assistance of auxiliary information $P_i$ even if the user's inputs slightly different biometrics $B_i^{\ast }$ , which thus maintains a reasonably similar status as that of the original biometric information. $U_i$ imprints $B_i$ for registration and computes $R_i$ , $P_i$ , and $A_i$ as follows:

$$\begin{array}{cc}& 〈R_i,P_i〉=\text{Gen}\left(B_i\right),\\ A_i=h\left(R_i\right).\end{array}$$

(21)

$U_i$ imprints $B_i^{\ast }$ for login and computes $R_i^{\ast }$ , $P_i^{\ast }$ , and $V_i^{\ast }$ and compares $V_i$ with $V_i^{\ast }$ as follows:

$$\begin{array}{cc}& R_i^{\ast }=\text{Rep}\left(B_i^{\ast },P_i\right),\\ A_i^{\ast }=h\left(R_i^{\ast }\right),\\ V_i^{\ast }=h\left({\text{ID}}_i\parallel A_i^{\ast }\right),\\ \text{verifies\hspace{0.17em}\hspace{0.17em}}{V}_i\stackrel{?}{=}{V}_i^{\ast }.\end{array}$$

(22)

With the assistance of $P_i$ , the fuzzy extractor can compute a constant $V_i^{\ast }$ even if the user inputs slightly different biometrics, so the proposed scheme is secure against a biometric recognition error.

7.2. User Verification Problem

The proposed scheme checks for the sameness in the ${\text{ID}}_i$ to verify the status a legal user. Concretely, $U_i$ makes $B_i$ using the device and computes $R_i$ and $P_i$ . These values and information stored in smart card are used by $U_i$ to compute $D_i,h(x\parallel y),k_i,C_i,{\text{AID}}_i$ and send $M_{\mathrm{1}}$ to $\text{GW}$ . $\text{GW}$ computes ${\text{ID}}_i^{\prime }$ from ${\text{AID}}_i$ and then computes $D_i^{\prime }$ and $k_i^{\prime }$ . $U_i$ decrypts $C_i$ and confirms ${\text{ID}}_i^{\prime \prime }$ . Finally, $\text{GW}$ authenticates $U_i$ as follows if ${\text{ID}}_i^{\prime }$ and ${\text{ID}}_i^{\prime \prime }$ are the same. $U_i$ imprints $B_i$ for authentication. And then GW computes $M_{\mathrm{1}}$ as follows:

$$\begin{array}{cc}& 〈R_i,P_i〉=\text{Gen}\left(B_i\right),\\ A_i=h\left(R_i\right),\\ D_i=M_i\oplus A_i^{\ast },\\ h\left(x\parallel y\right)=N_i\oplus A_i^{\ast },\\ k_i=h\left(D_i\parallel T_i\right),\\ C_i=E_{k_i}\left({\text{ID}}_i\parallel X_i\right),\\ {\text{AID}}_i={\text{ID}}_i\oplus h\left(h\left(x\parallel y\right)\parallel T_i\right),\\ M_{\mathrm{1}}=〈{\text{AID}}_i,X_i,C_i,T_i,W_i〉.\end{array}$$

(23)

$\text{GW}$ verifies sameness of ID as follows:

$$\begin{array}{cc}& {\text{ID}}_i^{\prime }={\text{AID}}_i\oplus h\left(h\left(x\parallel y\right)\parallel T_i\right),\\ D_i^{\prime }=h\left({\text{ID}}_i^{\prime }\parallel x\right),\\ k_i^{\prime }=h\left(D_i^{\prime }\parallel T_i\right),\\ {\text{ID}}_i^{\prime \prime }\parallel X_i^{\prime }=D_{k_i^{\prime }}\left(C_i\right),\\ \text{verifies\hspace{0.17em}\hspace{0.17em}}{\text{ID}}_i^{\prime }\stackrel{?}{=}{\text{ID}}_i^{\prime \prime }.\end{array}$$

(24)

Unlike in Yoon and Kim's scheme, $U_i$ can compute constant values including $A_i$ as a result of the fuzzy extractor. Therefore, $\text{GW}$ can authenticate a legal user even if the user inputs a slightly different biometric information $B_i^{\ast }$ . Therefore, the proposed scheme can prevent a user verification problem.

7.3. Anonymity

In the proposed scheme, an attacker cannot compute a user's real identification ${\text{ID}}_i$ without $h(x\parallel y)$ because the real identification of the user is always protected using ${\text{AID}}_i={\text{ID}}_i\oplus h(h(x\parallel y)\parallel T_i)$ . Therefore, only the legal user $U_i$ and $\text{GW}$ can compute ${\text{ID}}_i$ from ${\text{AID}}_i$ . $\text{GW}$ stores x and y, so $\text{GW}$ can easily compute $h(x\parallel y)$ . $U_i$ can compute $h(x\parallel y)$ from the $N_i$ stored in the smart card as follows:

$$\begin{array}{cc}& N_i=h\left(x\parallel y\right)\oplus A_i,\\ 〈R_i,P_i〉=\text{Gen}\left(B_i\right),\\ A_i=h\left(R_i\right),\\ h\left(x\parallel y\right)=N_i\oplus A_i^{\ast }.\end{array}$$

(25)

To compute $h(x\parallel y)$ , the attacker has to obtain both the user's smart card and $B_i$ . However, even if the attacker can obtain a smart card, he cannot compute $B_i$ . As a result, the attacker cannot obtain the user's real identification ${\text{ID}}_i$ . Therefore, the proposed scheme provides user anonymity.

7.4. Perfect Forward Secrecy

Proposed scheme computes the session key between $U_i$ and $S_j$ as follows:

$$\begin{array}{cc}& \text{sk}=h\left({\text{AID}}_i\parallel K_{US}\parallel T_s\right),\\ {\text{AID}}_i={\text{ID}}_i\oplus h\left(h\left(x\parallel y\right)\parallel T_i\right).\end{array}$$

(26)

Therefore, to compute all of the session keys of a user, an attacker has to know both $h(x\parallel y)$ and $K_{US}$ . However, the attacker cannot compute two values using another long-term key because $h(x\parallel y)$ and $K_{US}$ are independent of each other. In other words, if an attacker knows one of $h(x\parallel y)$ and $K_{US}$ , he cannot compute the other one, so the session key that is derived from a set of long-term keys will not be compromised, even if one of the long-term keys is compromised in the future. Therefore, the proposed scheme achieves the perfect forward secrecy.

7.5. Session Key Exposure by the Gateway Node

In the proposed scheme, $\text{GW}$ also knows most of the information related to the scheme but cannot compute $\text{sk}$ between $U_i$ and $S_j$ . we suggest $\text{sk}$ as follows:

$$\begin{array}{cc}& \text{sk}=h\left({\text{AID}}_i\parallel r_i\times Y_i\parallel T_s\right)=h\left({\text{AID}}_i\parallel r_s\times X_i\parallel T_s\right)=h\left({\text{AID}}_i\parallel r_i\times r_s\times P\parallel T_s\right).\end{array}$$

(27)

$\text{GW}$ can know ${\text{AID}}_i$ , $T_s$ , $X_i$ , and $Y_i$ but cannot acquire $r_i$ and $r_s$ . Even though $X_i=r_i\times P$ and $Y_i=r_s\times P$ , $\text{GW}$ cannot compute $r_i$ and $r_s$ from $X_i$ and $Y_i$ because it is mathematical problem about ECC. Therefore, $\text{sk}$ is not exposed by $\text{GW}$ in proposed scheme.

7.6. Vulnerability to Denial of Service Attack

In the proposed scheme, $U_i$ , $\text{GW}$ , and $S_j$ basically check for freshness in the message using timestamps. Therefore, the scheme is considered to be able to endure a DoS attack if an attacker sends a previous message to the server with previous timestamps. Moreover, the DoS attack can be better prevented since the proposed scheme uses $W_i$ , $W_g$ , $V_s$ in $M_{\mathrm{1}}$ , $M_{\mathrm{2}}$ , and $M_{\mathrm{3}}$ , respectively:

$$\begin{array}{cc}& W_i=h\left(h\left(x\parallel y\right)\parallel {\text{AID}}_i\parallel X_i\parallel C_i\parallel T_i\right),\\ W_g=h\left(h\left({S\text{ID}}_j\parallel y\right)\parallel {\text{AID}}_i\parallel C_g\parallel T_g\right),\\ V_s=h\left({\text{AID}}_i^{\prime }\parallel X_i^{\prime }\parallel Y_i\parallel \text{RM}\parallel T_s\right).\end{array}$$

(28)

$W_i$ , $W_g$ , and $V_s$ include the current timestamps $T_i$ . So, $U_i$ , $\text{GW}$ , and $S_j$ can check for the freshness and legality of $M_{\mathrm{1}}$ , $M_{\mathrm{2}}$ , and $M_{\mathrm{3}}$ because the timestamps of $W_i$ , $W_g$ , and $V_s$ do not match the timestamps of $M_{\mathrm{1}}$ , $M_{\mathrm{2}}$ , and $M_{\mathrm{3}}$ even if the attacker sends the previous $W_i$ , $W_g$ , and $V_s$ with the current timestamps. Therefore, the proposed scheme is more secure against the DoS attack than Yoon and Kim's scheme.

7.7. Revocation Problem

The proposed scheme does not use the user's password but only uses the user's ${\text{ID}}_i$ and biometrics $B_i$ for registration. As a result, the proposed scheme needs to provide a revocation and reissue phase when the $U_i$ wants to reissue a smart card due to loss. If a user reissues their own smart card with the same ${\text{ID}}_i$ as the previous ${\text{ID}}_i$ , the reissued smart card is going to be completely the same as the previous smart card. An attacker could thus make use of the lost smart card due to the sameness. Therefore, the proposed scheme suggests for the $\text{GW}$ to check for differences between the previous ${\text{ID}}_i$ and new ${\text{ID}}_i^{\ast }$ during the revocation and reissue phase. In other words, we induce a user to select a different identification from the previous identification, so the $\text{GW}$ reissues a new smart card with different information when the user loses his smart card, and the revocation problem is solved in this manner.

7.8. Mutual Authentication

In the proposed scheme, $U_i$ , $\text{GW}$ , and $S_j$ authenticate each other by checking the accuracy of ${\text{ID}}_i$ , ${\text{AID}}_i$ , and $V_s$ . Specifically, $\text{GW}$ can authenticate whether the $U_i$ that sent $M_{\mathrm{1}}$ is a legal user or not by checking the validity of ${\text{ID}}_i\stackrel{?}{=}{\text{ID}}_i^{\ast }$ . Only the legal case computes $C_i$ using ${\text{ID}}_i$ and $B_i$ , so $\text{GW}$ can confirm the user's legitimacy by decrypting $C_i$ using $k_i$ . $S_j$ can authenticate $\text{GW}$ by checking if it sends a correct hash $k_g$ by verifying ${\text{ID}}_i\stackrel{?}{=}{\text{ID}}_i^{\ast }$ . $k_g$ can be computed within the current time only by a legal $\text{GW}$ and $S_j$ because $k_g=h(h({S\text{ID}}_j\parallel y)\parallel T_g)$ . Finally, $U_i$ can authenticate $S_j$ and $\text{GW}$ by checking $V_s\stackrel{?}{=}h({\text{AID}}_i\parallel X_i\parallel Y_i\parallel \text{RM}\parallel T_s)$ . Only a legal $S_j$ can compute $V_s$ within the current time because only $S_j$ can know $X_i$ and $Y_i$ .

7.9. Message Confidentiality

The proposed scheme uses 3 messages $M_{\mathrm{1}}$ , $M_{\mathrm{2}}$ , and $M_{\mathrm{3}}$ in the login and authentication phase as follows:

$$\begin{array}{cc}& M_{\mathrm{1}}=〈{\text{AID}}_i,X_i,C_i,T_i,W_i〉,\\ M_{\mathrm{2}}=〈{\text{AID}}_i,C_g,T_g,W_g〉,\\ M_{\mathrm{3}}=〈\text{RM},Y_i,V_s,T_s〉.\end{array}$$

(29)

$T_i$ , $T_g$ , $T_s$ , and RM are basically public information, so they do not need to be protected. Other information can provide confidentiality because an attacker cannot compute important information from ${\text{AID}}_i$ , $X_i$ , $C_i$ , $W_i$ , $C_g$ , $W_g$ , $Y_i$ , and $V_s$ .

7.10. Password Change Phase

In a password-based authentication scheme, the user should be able to change his own password when he forgets his password or loses his smart card. In detail, to change a password freely, a smart card has to store information related to the user's password, such as $h(\text{password})$ . However, when an attacker steals a user's smart card, he can gain all the information stored in the smart card by using a simple and differential power analysis. Therefore, the attacker can obtain a user's password even when it is protected by $h(\text{password})$ because a few characters are necessary to use the password. Therefore, a password change phase is important but poses a serious risk in that information (such as the password) for login and authentication can be exposed. However, the proposed scheme uses only a user's biometric information with high entropy; therefore, the attacker cannot obtain the original biometric information, even if $h(\text{biometrics})$ is known. Moreover, a user does not forget his biometric information and so does not need to change it.

7.11. Stolen Verifier Attack

If the $\text{GW}$ or $S_j$ stores verifier information, an attacker can attempt a stolen verifier attack. However, the proposed scheme is resistant to a stolen verifier attacker because $\text{GW}$ and $S_j$ do not store a user's identification/password table and the user's biometrics. In the proposed scheme, $\text{GW}$ only stores the secret key x, y, and $S_j$ store only $h({S\text{ID}}_j\parallel y)$ . Therefore, the $\text{GW}$ cannot obtain authentication information from a legal user even if the attacker has the authority to access the database of the $\text{GW}$ and $S_j$ .

7.12. Guessing Attack

Since the proposed scheme does not use the user's password, this scheme is not vulnerable to a guessing attack. Moreover, the user's biometrics is always protected by the one-way hash function. Since the biometrics information has a high level of entropy, unlike a password, the attacker cannot calculate the user's biometric information from the hashed value. When the attacker steals a user's smart card, the attacker can obtain ${\text{ID}}_i$ , $M_i$ , $N_i$ , $V_i$ , $P_i$ , $h(·)$ from the smart card. However, since $M_i$ , $N_i$ , $V_i$ are hashed values, the attacker cannot obtain any secret information from them. ${\text{ID}}_i$ and $P_i$ are not secret information, so the attacker cannot acquire secret information using a guessing attack. Therefore, the proposed scheme is not vulnerable to a guessing attack [25–27].

7.13. Replay Attack

The proposed scheme is secure against a replay attack by adding timestamps $T_i$ , $T_g$ , $T_s$ into authentication messages $W_i$ , $W_g$ , $V_s$ in $M_{\mathrm{1}}$ , $M_{\mathrm{2}}$ , $M_{\mathrm{3}}$ , respectively. Even if the attacker obtains $M_{\mathrm{1}}$ , $M_{\mathrm{2}}$ , $M_{\mathrm{3}}$ and sends them again with the current timestamps, the attacker cannot compute $W_i$ , $W_g$ , $V_s$ using the current timestamps:

$$\begin{array}{cc}& M_{\mathrm{1}}=〈{\text{AID}}_i,X_i,C_i,T_i,W_i〉,\\ W_i=h\left(h\left(x\parallel y\right)\parallel {\text{AID}}_i\parallel X_i\parallel C_i\parallel T_i\right),\\ M_{\mathrm{2}}=〈{\text{AID}}_i,C_g,T_g,W_g〉,\\ W_g=h\left(h\left({S\text{ID}}_j\parallel y\right)\parallel {\text{AID}}_i\parallel C_g\parallel T_g\right),\\ M_{\mathrm{3}}=〈\text{RM},Y_i,V_s,T_s〉,\\ V_s=h\left({\text{AID}}_i^{\prime }\parallel X_i^{\prime }\parallel Y_i\parallel \text{RM}\parallel T_s\right).\end{array}$$

(30)

7.14. Impersonation Attack

Even if an attacker intercepts the authentication message $M_{\mathrm{1}}=〈{\text{AID}}_i,X_i,C_i,T_i,W_i〉$ to impersonate a legitimate user, the attacker cannot normally extract $D_i$ and $k_i$ from ${\text{AID}}_i$ , $C_i$ , and $W_i$ since the one-way hash function is implemented according to Definition 2. Without $D_i$ and $k_i$ , the attacker cannot produce a legitimate login and authentication message in the attacker's current time. Therefore, the proposed scheme is secure from impersonation attacks. Likewise, the attacker cannot impersonate a legitimate $\text{GW}$ and $S_j$ . Even if the attacker obtains $M_{\mathrm{2}}=〈{\text{AID}}_i,C_g,T_g,W_g〉$ , the attacker cannot compute $k_i$ or $h(h({S\text{ID}}_j\parallel y)\parallel T_g)$ from such due to Definition 2.

7.15. Insider Attack

Typically, malicious insiders want to acquire private user information, such as their biometrics. In the proposed registration phase, a user's smart card device imprints the biometric impression $B_i$ and computes $〈R_i,P_i〉$ using $\text{Gen}(B_i)$ and then sends $A_i$ to $\text{GW}$ ; $A_i=h(R_i)$ . Therefore, $\text{GW}$ cannot obtain $B_i$ using the incoming $A_i$ because of the properties of the one-way hash function. Therefore, the proposed scheme is secure against insider attacks.

7.16. Security Factor

Two- or three-factor authentication methods are implemented by means of a combination of two or three different components. In WSNs, most authentication schemes use a user's password, smart card, and biometric information as components. We propose a two-factor authentication scheme that uses the smart card and biometric information without a password but can provide a similar secure authentication environment comparable to those provided by three-factor authentication schemes.

Table 1 provides a summary and comparison of the security provided by the proposed scheme and that provided by other schemes, including the one by Yoon and Kim.

Table 1

Security comparison.

Security property	Yuan et al.[11]	He et al. [8]	Yoon and Kim[14]	Proposed scheme
Biometric recognition error	Insecure	Secure	Insecure	Secure
User verification problem	Insecure	Secure	Insecure	Secure
Anonymity	Provide	Do not provide	Do not provide	Provide
Perfect forward secrecy	No sk	No sk	Do not provide	Provide
sk exposure by GW	No sk	No sk	Insecure	Secure
Vulnerable to DoS attack	Secure	Insecure	Insecure	Secure
Revocation problem	Secure	Secure	Insecure	Secure
Mutual authentication	Do not provide	Provide	Provide	Provide
Message confidentiality	Do not provide	Do not provide	Provide	Provide
Password change phase	Required	Required	Not required	Not required
Stolen verifier attack	Secure	Secure	Secure	Secure
Guessing attack	Secure	Insecure	Secure	Secure
Replay attack	Secure	Secure	Secure	Secure
Impersonation attack	Insecure	Insecure	Secure	Secure
Insider attack	Insecure	Insecure	Secure	Secure
Security factor	Three-factor	Two-factor	Two-factor	Two-factor

8. Conclusions

To provide security to wireless sensors and users, various authentication schemes for WSNs have been proposed recently. The security problem in He et al.'s scheme was addressed by Yoon and Kim, who proposed an advanced biometrics-based user authentication scheme for WSNs. In this paper, we have identified vulnerabilities in Yoon and Kim's scheme in terms of a biometric recognition error, a user verification problem, lack of anonymity and perfect forward secrecy, session key exposure by the GW node, vulnerability to a DoS attack, and a revocation problem. To solve these security vulnerabilities, we have suggested specific countermeasures, including the use of fuzzy extraction to imprint biometrics during the registration phase consisting of error-tolerant cryptographic primitives for biometric security. We recommend the use of the sensor node's random number and ECC to exchange a random number between a user and the sensor node during the authentication phase. ECC can maintain the same degree of security with a smaller key size than other forms of public-key cryptography. Therefore, ECC is suitable for use with wireless devices that have limited resources. In accordance with these countermeasures, we propose a biometrics-based authentication scheme based on fuzzy extraction with improved security. In addition, we conduct a security analysis to show that the proposed scheme is more secure than other authentication schemes.