On the security of a provably secure,efficient,and flexible authentication scheme for ad hoc wireless sensor networks

Abstract

In a recent paper, Chang and Le proposed an efficient smart card–based authenticated key exchange protocol (which is referred to as CL scheme) for heterogeneous ad hoc wireless sensor networks. However, we found that the CL scheme is subject to sensor capture attack which breaks the session key security of the CL scheme. An improved protocol is proposed to fix this problem.

Introduction

Wireless sensor networks (WSNs) play more and more important role in many critical practical applications, such as battle field monitoring, healthy data acquisition, and many others. In WSN-based applications, data collected and stored by sensors are usually valuable and sensitive, which should be protected against unauthorized access from malicious attackers. An ideal solution for providing both secrecy and authentication is to apply the well-known cryptographic primitive—authenticated key exchange (AKE). The “form” of an AKE protocol here is closely related to the system model of the deployed WSNs.

System model

We here consider a system model (shown in Figure 1) for heterogeneous ad hoc WSNs which involve three types of principles, that is, users (U), sensors (S), and a gateway node (GWN). In this system, a user may hold a smart card, who wants to access or configure a sensor (on-site) in terms of actual field conditions. The user’s smart card is used as a security tool to authenticate the user via both memorable password and its stored long-term symmetric authentication key. Meanwhile, an AKE protocol is typically executed among user’s smart card, sensor, and GWN to establish a secure channel between user and sensor. Since the smart card and sensor do not share an authentication key, the online authentication is carried out by the remote GWN which shares symmetric authentication keys with users and sensors, respectively.

Figure 1.

System model.

Related work

A sensor node is typically limited in power, storage, and computation resources. This has led to the development of so-called “lightweight” multi-factor user authentication schemes and AKE protocols for WSNs.^1–15 However, these AKE schemes have various protocol structures determined by underlying wireless sensor networks. For example, the protocols proposed in previous studies^10,12–17 are specifically designed for Internet of things (IoT), wherein the GWN stands in the middle of the user and the sensor to take charge of the communication between them. We refer the reader to the work by Ferrag et al. ¹⁸ for more recently proposed lightweight AKE schemes. In this article, we primarily concern about the AKE schemes^{1,2,6,7,9–11} under the system model shown in Figure 1. Note that building a secure AKE protocol for WSNs is non-trivial, since more than two participants and multiple authentication factors might be involved. Any subtle errors may lead to a broken protocol. Specifically, several previous schemes are found^1,5,7,9,11 to be vulnerable to certain practical active attacks.

Chang and Le ⁹ recently showed that a previous protocol proposed by Turkanovic et al. ⁷ is vulnerable to stolen smart card attack, impersonation attack with node capture, sensor node spoofing attack, stolen verifier attack, and backward secrecy attack. As an improvement of Turkanovic et al.’s scheme, two lightweight AKE protocols (i.e. called P1 and P2) were introduced by Chang and Le ⁹ (which will be referred to as CL scheme), which can provide both authentication and data privacy for the communication between user and sensor. The CL scheme can be considered as a trade-off between security and performance; that is, the CL scheme aims to satisfy the most desirable security attributes but provides high performance with low computation and communication cost (which are important for WSNs). In particular, only one authentication key is required to be stored at GWN. This dramatically improves the storage performance of GWN. Besides the efficiency, one of the advantages of the CL scheme is its provable security. The security of the CL scheme was proven in a model (which will be referred to as CL model) that is derived from the AKE model by Bellare et al. ¹⁹ A protocol with security proof is reasonably necessary to formally show that its targeting security goals and properties (specified by the corresponding security model) are satisfied.

However, a security proof itself needs time to be further validated and discussed by researchers to avoid errors that were somehow overlooked. In 2016, Das et al. ¹¹ instigated the weaknesses of CL protocols, that is, the CL protocols cannot resist with smart card lost/stolen attacks and session-specific temporary information attacks. The password update phase of the CL protocols was also criticized by Das et al. by lacking of local password verification during the authentication phase. In order to enhance the security of the CL protocols, an efficient three-factor AKE for WSNs is presented to eliminate the weaknesses of the CL protocols.

Our results

In this work, we further revisit the security results of the CL scheme. We first notice that some key elements (e.g. the freshness and security experiment) in the CL security model are not well-formulated at all. This may lead to an awkward situation that no protocols can be proven secure in the CL model. We hereby clarify the ambiguities and fix up the loopholes in the CL model by showing a revised version. Furthermore, we notice that some recently proposed multi-factor AKE protocols^11,14 are claimed to satisfy probably security. But similar problems can be also found in the models defined in these literature. Hence, our improved model can serve as a guidance to show how to formulate security definitions for three-party multi-factor AKE protocols. Researchers can simply derive new appropriate security models from ours to formally re-analyze the state-of-the-art “provable secure” AKE protocols^11,14 for WSNs.

In particular, we figure out that the CL scheme cannot provide session key security as claimed by the authors since it is unable to resist with sensor capture attack, namely, the security result of Chang and Le ⁹ Theorem 2 is incorrect. We show that the attackers can make use of a corrupted sensor to impersonate arbitrary uncorrupted users to uncompromised sensors as it wishes. We notice that such corruption of a sensor is allowed in the security analysis of P2. ⁹ It is not hard to see that such attack is very harmful in real-world applications. For example, if an attacker plants a malicious sensor, then it can intercept all communications among uncorrupted principles. In order to fix this problem, we give a simple and effective improvement with minimum modifications to P2. The improved scheme is also shown as an example to achieve the provable security with random oracles in our revised security model.

Organizations

The remainder of the article is organized as follows. Section “Security model” discusses the problems of the CL model and introduces our revised security model. Subsequently, in section “On the security of the CL protocol,” we introduce an attack against the CL scheme and our improvement. Section “Performance comparison” shows our experimental and comparison results. Finally, section “Conclusion” concludes this article.

Security model

The CL model ⁹ is defined very vaguely and informally. Based on the CL model, it cannot be used to analyze the security and the corresponding proof of the CL protocol. In the sequel, we first give some remarks on relevant important notions which are defined inappropriately in the CL model. Second, we re-define the security definitions to obtain an improved security model. The notations used in the rest of the article are first recalled in Table 1.

Table 1.

Notations.

$U_i$	User
$\mathrm{GWN}$	Gateway node
$S_j$	Sensor node
$I{D}_i$	Identity of a party
$\mathrm{SI}{D}_j$	Identity of a sensor
$I{D}_{\mathrm{GWN}}$	Identity of GWN
$ℐ\mathcal{D}$	General identity which might denote an
	Identity in $\{\mathrm{ID},\mathrm{SID},I{D}_{\mathrm{GWN}}\}$
$p{w}_i$	Password of $U_i$
$S{C}_i$	Smart card of $U_i$
$X_{\mathrm{GWN}}$	Long-term secret of GWN
$T_i$	Timestamp
${\Delta }_T$	Expected transmission delay
$r_i,K_i$	Random numbers
$P$	Point on an elliptic curve
$P·x$	x-axis value of the point P
$||,\oplus ,h()$	Concatenation, XOR, and hash operation

Remarks on the CL security model

We hereby mainly discuss the problems of the CL model from the following two perspectives: (1) freshness and (2) security experiment. Note that all these elements are fundamental to a security model, which are unfortunately not well addressed by the CL model. We review the freshness defined in the CL model:

Freshness

The instance ${\mathrm{\Pi }}_{U_i}^u$ or ${\mathrm{\Pi }}_{S_j}^t$ is fresh if their session key $\mathrm{SK}$ has not been revealed to the adversary $\mathcal{A}$ . ⁹

The problems of such freshness definition are summarized as follows:

• In the CL model, there is no $\mathrm{RevealKey}$ query (as in the work by Bellare et al. ¹⁹ ) which allows the adversary to obtain the session key of a session. Hence, there is no way for an adversary to reveal the session key in the CL security experiment.

• $\mathrm{CorruptSC}$ and $\mathrm{CorruptS}$ queries are defined without any restrictions on this freshness definition. This implies that an adversary $\mathcal{A}$ can trivially ask a $\mathrm{CorruptSC}({\mathrm{\Pi }}_{U_i}^l)$ query to obtain the long-term secret key of $U_i$ , even for the target session. Then $\mathcal{A}$ is able to run some protocol instance with ${\mathrm{\Pi }}_{S_j}^t$ on behalf of $U_i$ and select ${\mathrm{\Pi }}_{S_j}^t$ as the test session in the security experiment. In this situation, $\mathcal{A}$ can always win using her own ephemeral secret key and the long-term secret key of $U_i$ .

According to the above discussions, we, first, have the conclusion that no protocol can be secure in the CL model.

Second, the security experiment is not clearly defined. There is no formulation on the timing of oracle queries which are performed in the security experiment. For example, whether an adversary can keep asking oracle queries after the Test query. This would also affect the security definition. Note that the adversary is allowed to ask many $\mathrm{Test}$ queries in the CL model. However, the guess bit $b\prime$ returned by an adversary is not associated with a specific Test query so that we cannot correctly evaluate the advantage of an adversary.

Improved security model

We here define a security model which is suitable for proving the CL protocol. This model follows from indistinguishability-based AKE security models.^19–22 In the following, let $\ell ,\rho ,d\in \mathbb{N}$ be positive integers. In the execution environment, we fix a set of $\ell$ honest users and $\rho$ sensors at all. We may use a general $\mathcal{I}\mathcal{D}$ in the following to denote one of these kinds of identity in $\{\mathrm{ID},\mathrm{SID},I{D}_{\mathrm{GWN}}\}$ .

We assume that each honest party can only sequentially execute the protocol. This restriction is used to prevent replay attacks. This is characterized by a collection of oracles $\{{\mathrm{\Pi }}_{I{D}_i}^s:i\in [\ell ],s\in [d]\}$ for users, oracles $\{{\mathrm{\Pi }}_{\mathrm{SI}{D}_j}^t:j\in [\rho ],t\in [d]\}$ for sensors, and oracles $\{{\mathrm{\Pi }}_{I{D}_{\mathrm{GWN}}}^z:z\in [(\rho +\ell )d]\}$ for GWN. Each oracle ${\mathrm{\Pi }}_{\mathcal{I}\mathcal{D}}^s$ behaves as party $\mathcal{I}\mathcal{D}$ carrying out a process to execute the $s\mathrm{th}$ protocol instance with some partner (which is determined during the protocol execution). All oracles of $\mathcal{I}\mathcal{D}$ have access to the authentication credential–related information stored on the devices (e.g. the smart card of a user and GWN). For time $T_i$ and pre-specified time interval ${\Delta }_T$ , only one protocol instance can be executed within time period $[T_i,T_i+{\Delta }_T]$ .

Moreover, we assume each oracle ${\mathrm{\Pi }}_{\mathcal{I}\mathcal{D}}^s$ maintains a list of independent internal state variables including (1) ${\Phi }_{\mathcal{I}\mathcal{D}}^s$ —execution state ${\Phi }_{\mathcal{I}\mathcal{D}}^s\in \{\mathrm{accept},\mathrm{reject}\}$ , (2) ${\mathrm{pid}}_{\mathcal{I}\mathcal{D}}^s$ —identity of the intended communication partner, (3) $T_{\mathcal{I}\mathcal{D}}^s$ —timestamp at when the oracle is executed, (4) $K_{\mathcal{I}\mathcal{D}}^s$ —session key, and (5) ${\mathrm{TM}}_{\mathcal{I}\mathcal{D}}^s$ —the protocol messages orderly sent and received by ${\mathrm{\Pi }}_{\mathcal{I}\mathcal{D}}^s$ . Furthermore, we will always assume (for simplicity) that $K_{\mathcal{I}\mathcal{D}}^s=\varnothing$ if an oracle has not reached accept state (yet).

Adversarial model

An active adversary $\mathcal{A}$ in this model is formalized as a probabilistic polynomial time (PPT) Turing Machine. The active attack powers of an adversary are formulated by allowing it to ask the following queries:

• $\mathrm{Execute}(I{D}_i,s,\mathrm{SI}{D}_j,t,I{D}_{\mathrm{GWN}},u)$ : If ${\mathrm{\Pi }}_{I{D}_i}^s$ , ${\mathrm{\Pi }}_{\mathrm{SI}{D}_j}^t$ , and ${\mathrm{\Pi }}_{I{D}_{\mathrm{GWN}}}^u$ have not yet been used, this oracle executes the protocol between these instances and gives the transcript of this execution to the adversary. This oracle query models passive eavesdropping of a protocol execution.

• $\mathrm{Send}(\mathcal{I}{\mathcal{D}}_i,s,m)$ : The adversary can use this query to send any message $m$ of his own choice to the oracle ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ . The oracle will respond with the next message $m^{*}$ (if any) to be sent according to the protocol specification and its internal states. Oracle ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ would be initiated via sending the oracle the first message $m=(\mathrm{T},\mathcal{I}{\mathcal{D}}_j)$ consisting of a special initialization symbol $\mathrm{T}$ and the identity $\mathcal{I}{\mathcal{D}}_j$ of the intended partner. After answering a $\mathrm{Send}$ query, the oracle variables will be updated depending on the specific protocol.

• $\mathrm{RevealKey}(\mathcal{I}{\mathcal{D}}_i,s)$ : Oracle ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ responds with the contents of the variable $K_{\mathcal{I}{\mathcal{D}}_i}^s$ if and only if the oracle ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ has reached an internal state ${\Phi }_{\mathcal{I}{\mathcal{D}}_i}^s=\mathrm{accept}$ and $\mathcal{I}{\mathcal{D}}_i\ne I{D}_{\mathrm{GWN}}$ .

• $\mathrm{CorruptSC}(I{D}_i)$ : This query returns information stored on the smart card of the user $I{D}_i$ .

• $\mathrm{CorruptS}(\mathrm{SI}{D}_j)$ : This query returns information stored on the sensor $\mathrm{SI}{D}_j$ .

• $\mathrm{Test}(\mathcal{I}{\mathcal{D}}_i,s)$ : If oracle ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ has state ${\Phi }_{\mathcal{I}{\mathcal{D}}_i}^s\ne \mathrm{accept}$ or $K_{\mathcal{I}\mathcal{D}i}^s=\varnothing$ or $\mathcal{I}{\mathcal{D}}_i=I{D}_{\mathrm{GWN}}$ , then the oracle returns some failure symbol ⊥. Otherwise, it flips a random bit $b$ , samples a random key $K_0\stackrel{\$}{\to }\mathcal{K}\mathrm{ake}$ , and sets $K_1=K_{\mathcal{I}{\mathcal{D}}_i}^s$ , where $\mathcal{K}\mathrm{ake}$ is a session key space. Finally, the key $K_b$ is returned. The oracle ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ selected by adversary in this query is called as test oracle.

Secure AKE protocols

During the protocol execution, two oracles may interact with each other to exchange messages for key establishment. We here define a notion concerning partnership following Bellare and Rogaway ²² which is specifically introduced for three-party AKE. Note that the patterning notion in Chang and Le ⁹ is defined in a similar way (but quite informal).

Let $\mathrm{pf}:\mathcal{I}{\mathcal{D}}_i,s,{\mathrm{pid}}_{\mathcal{I}{\mathcal{D}}_i}^s,T_{\mathcal{I}{\mathcal{D}}_i}^s,{\mathrm{TM}}_{\mathcal{I}{\mathcal{D}}_i}^s\to (\mathcal{I}{\mathcal{D}}_j,t)$ be a partner function ²² which is a map on given execution states of ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ points to its partner oracle ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_j}^t$ , where $\mathcal{I}{\mathcal{D}}_j\in {\mathrm{pid}}_{\mathcal{I}{\mathcal{D}}_i}^s$ and $t\in [d]$ . The output of partner function should be uniquely determined by ${\mathrm{TM}}_{I{D}_i}^s$ of each oracle. In terms of the CL protocol, we realize $\mathrm{pf}$ by returning $(\mathcal{I}{\mathcal{D}}_j,t)$ if and only if all of the following conditions are held:

• Both ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ and ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_j}^t$ accept.

• $\mathcal{I}{\mathcal{D}}_j\in {\mathrm{pid}}_{\mathcal{I}{\mathcal{D}}_i}^s$ and $\mathcal{I}{\mathcal{D}}_i\in {\mathrm{pid}}_{\mathcal{I}{\mathcal{D}}_j}^t$ ;

• $0\le |T_{\mathcal{I}{\mathcal{D}}_i}^s-T_{\mathcal{I}{\mathcal{D}}_j}^t|\le {\Delta }_T$ ;

• ${\mathrm{TM}}_{\mathcal{I}{\mathcal{D}}_i}^s\subseteq {\mathrm{TM}}_{\mathcal{I}{\mathcal{D}}_j}^t$ or ${\mathrm{TM}}_{\mathcal{I}{\mathcal{D}}_j}^t\subseteq {\mathrm{TM}}_{\mathcal{I}{\mathcal{D}}_i}^s$ .

• ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_j}^t$ is the unique oracle (which meets the above conditions).

Correctness

We say an AKE protocol $\mathrm{\Pi }$ is correct if two accepted oracles ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ and ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_j}^t$ are partner, then both oracles hold the same session key.

In order to define the security, we define two notions on oracle freshness that describe the active attacks allowed in the following security experiment. Let ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ be an accepted oracle with intended partner $\mathcal{I}{\mathcal{D}}_j$ , where $(\mathcal{I}{\mathcal{D}}_i,\mathcal{I}{\mathcal{D}}_j)\ne \mathrm{I}{\mathrm{D}}_{\mathrm{GWN}}$ . And let ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_j}^t$ be an oracle (if it exists), such that ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ is a partner oracle of ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_j}^t$ , that is, $\mathrm{pf}(\mathcal{I}{\mathcal{D}}_i,s,{\mathrm{pid}}_{\mathcal{I}{\mathcal{D}}_i}^s,T_{\mathcal{I}{\mathcal{D}}_i}^s,{\mathrm{TM}}_{\mathcal{I}{\mathcal{D}}_i}^s)\to (\mathcal{I}{\mathcal{D}}_j,t)$ .

Definition 1

Oracle Freshness with Forward Secrecy (OFFS)—the oracle ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ is said to be $\mathrm{OFFS}-\mathrm{fresh}$ if none of the following conditions holds:

1. $\mathcal{A}$ queried $\mathrm{RevealKey}(\mathcal{I}{\mathcal{D}}_i,s)$ ;

2. If ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_j}^t$ exists, $\mathcal{A}$ queried $\mathrm{RevealKey}(\mathcal{I}{\mathcal{D}}_j,t)$ ;

3. If $\mathcal{I}{\mathcal{D}}_i$ is user, $\mathcal{A}$ queried either $\mathrm{CorruptSC}(I{D}_i)$ or $\mathrm{CorruptS}(\mathrm{SI}{D}_j)$ prior to the acceptance of ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ ;

4. If $\mathcal{I}{\mathcal{D}}_i$ is sensor, $\mathcal{A}$ queried either $\mathrm{CorruptS}(\mathrm{SI}{D}_i)$ or $\mathrm{CorruptSC}(I{D}_j)$ prior to the acceptance of ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ .

Definition 2

Oracle Freshness without Forward Secrecy (OFwoFS)—the oracle ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ is said to be OFwoFS-fresh if none of the following conditions holds:

1. $\mathcal{A}$ queried $\mathrm{RevealKey}(\mathcal{I}{\mathcal{D}}_i,s)$ ;

2. If ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_j}^t$ exists, $\mathcal{A}$ queried $\mathrm{RevealKey}(\mathcal{I}{\mathcal{D}}_j,t)$ ;

3. If $\mathcal{I}{\mathcal{D}}_i$ is user, $\mathcal{A}$ queried either $\mathrm{CorruptSC}(I{D}_i)$ or $\mathrm{CorruptS}(\mathrm{SI}{D}_j)$ ;

4. If $\mathcal{I}{\mathcal{D}}_i$ is sensor, $\mathcal{A}$ queried either $\mathrm{CorruptS}(\mathrm{SI}{D}_i)$ or $\mathrm{CorruptSC}(I{D}_j)$ .

We let $\mathcal{O}\mathcal{F}=\{\mathrm{OFFS},\mathrm{OFwoFS}\}$ .

Security experiment ${\mathrm{EXP}}_{\mathrm{\Pi },\mathcal{A}}^{\mathrm{ake}}(\lambda ,\mathcal{O}\mathcal{F})$

On input security parameter $1^{\lambda }$ , the security experiment is proceeded as a game between a challenger $\mathcal{C}$ and an adversary $\mathcal{A}$ based on AKE protocol $\mathrm{\Pi }$ , where the following steps are performed:

1. At the beginning of the game, the challenger $\mathcal{C}$ implements the collection of oracles $\{{\mathrm{\Pi }}_{I{D}_i}^s:i\in [\ell ],s\in [d]\}$ for users and $\{{\mathrm{\Pi }}_{\mathrm{SI}{D}_j}^t:j\in [\rho ],t\in [d]\}$ for sensors, and $\{{\mathrm{\Pi }}_{I{D}_{\mathrm{GWN}}}^z:z\in [(\rho +\ell )d]\}$ for GWN. All long-term pre-shared key for users, sensors, and GWN are generated, respectively. $\mathcal{C}$ gives the adversary $\mathcal{A}$ all identities as input.

2. $\mathcal{A}$ may issue a polynomial number of queries regarding $\mathrm{Execute}$ , $\mathrm{Send}$ , $\mathrm{CorruptSC}$ , $\mathrm{CorruptS}$ , and $\mathrm{RevealKey}$ .

3. At some point, $\mathcal{A}$ may issue $\mathrm{Test}(\mathcal{I}{\mathcal{D}}_i,s)$ queries during the experiment. After the $\mathrm{Test}$ query, $\mathcal{A}$ can keep asking other queries as it wishes.

4. At the end of the game, $\mathcal{A}$ may terminate and output a bit $(b\prime ,\mathcal{I}{\mathcal{D}}_i,s)$ as its guess for $b$ of $\mathrm{Test}(\mathcal{I}{\mathcal{D}}_i,s)$ query. Then the experiment would return a failure symbol ⊥ if one of the following conditions is held: (1) $\mathcal{A}$ has not issued any $\mathrm{Test}$ query, or (2) the $\mathrm{Test}(\mathcal{I}{\mathcal{D}}_i,s)$ query returns a failure symbol ⊥, or (3) the test oracle is not $\mathcal{O}\mathcal{F}-\mathrm{fresh}$ .

5. Finally, the experiment returns $1$ if $b=b\prime$ ; Otherwise, $0$ is returned.

Formally, an instance ${\mathrm{\Pi }}_{\mathcal{I}{\mathcal{D}}_i}^s$ represents an online attack if both following conditions hold at the time of the Test query: (1) at some point, the adversary queried $\mathrm{Send}(\mathcal{I}{\mathcal{D}}_i,s,m^{*})$ and $\mathrm{I}{\mathrm{D}}_i$ is not corrupted and (2) at some point, the adversary queried $\mathrm{RevealKey}(\mathcal{I}{\mathcal{D}}_i,s)$ or $\mathrm{Test}(\mathcal{I}{\mathcal{D}}_i,s)$ . The number of online attacks represents a bound on the number of passwords the adversary could have tested in an online fashion. Let $D$ be the maximum bit length of a user’s password. The maximum number of online attacks that $\mathcal{A}$ can perform to the owner of the test oracle is bound by $d$ .

Definition 3

Session Key Security—Given a correct AKE protocol $\mathrm{\Pi }$ and an adversary $\mathcal{A}$ which runs the above security experiment without failure, we then define the advantage of $\mathcal{A}$ as follows

$$Ad{v}_{\mathrm{\Pi },\mathcal{A}}^{ake}(\lambda ,\mathcal{O}ℱ):=\left|\mathrm{Pr}[EX{P}_{\mathrm{\Pi },\mathcal{A}}^{ake}(\lambda ,\mathcal{O}ℱ)=1]-\frac{1}{2}\right|$$

We say that a correct AKE protocol $\mathrm{\Pi }$ is session-key-secure if for all adversaries $\mathcal{A}$ the advantage such that ${\mathrm{Adv}}_{\mathrm{\Pi },\mathcal{A}}^{\mathrm{ake}}(\lambda ,\mathcal{O}\mathcal{F})\le d\ell /D+\mathrm{negl}(\lambda )$ where $\mathrm{negl}(\lambda )$ is a negligible function in the security parameter $\lambda$ .

On the security of the CL protocol

A sensor capture attack against the CL protocol

CL Protocol

We first briefly review the P2 protocol. ⁹ The user registration phase is shown in Figure 2. The protocol execution of P2 is depicted in Figure 3.

Figure 2.

Registration phase of Chang and Le. ⁹

Figure 3.

P2 of Chang and Le. ⁹

A sensor capture attack against P2

We here describe a sensor capture attack against the session key security of P2. ⁹ The protocol P1 has the same problem. ⁹ In this attack, we will make use of some compromised sensor to impersonate an arbitrary honest user. Note that the corruption of sensor is allowed in Theorem 2. ⁹ In real-world applications, such compromised sensor might be also registered by an attacker as well. The core attack idea is to extract the secret $Y_i=h(f_i||T_1)$ which is used to compute the authentication message $H_j$ . However, $Y_i$ is only computed involving an honest user $U_i$ ’s secret $f_i$ and timestamp $T_1$ . This implies that the $Y_i$ can be re-used many times in different sessions (to impersonate $U_i$ to any uncompromised sensors) during $T_1+{\Delta }_T$ .

The concrete attack steps performed by an adversary $\mathcal{A}$ are described as follows:

• $\mathcal{A}$ corrupts some sensor say $\mathrm{SI}{D}_j$ to obtain its long-term secret $f_j$ , that is, via $\mathrm{CorruptS}(\mathrm{SI}{D}_j)$ . The goal of $\mathcal{A}$ , for instance, is to impersonate some honest user $U_i$ to communicate with another uncompromised sensor $S_v$ .

• $\mathcal{A}$ asks $U_i$ to run a protocol instance ${\mathrm{\Pi }}_{I{D}_i}^s$ with sensor $\mathrm{SI}{D}_j$ , that is, via sending ${\mathrm{\Pi }}_{I{D}_i}^s$ the first message as $\mathrm{Send}(I{D}_i,s,(\mathrm{T},\mathrm{SI}{D}_j))$ . $\mathcal{A}$ intercepts the message $m_1=\{M{I}_i,Z_i,N_i,T_1\}$ .

• $\mathcal{A}$ gets timestamp $T_2$ and honestly computes $A_j:=h(f_j||N_i||T_2)$ which is computable via compromised $f_j$ .

• $\mathcal{A}$ sends $m_2=\{M{I}_i,N_i,\mathrm{SI}{D}_j,A_j,T_1,T_2\}$ to GWN and receives $m_3=\{F_{\mathrm{ij}},H_i,E_i,T_3\}$ .

• $\mathcal{A}$ computes $Y_i:=F_{\mathrm{ij}}\oplus h(f_j||T_3)$ . At this point, we stress that the $\mathcal{A}$ is able to impersonate $U_i$ to $\mathrm{SI}{D}_v$ at time $T_1$ . We next show that the attack is possible if the time consumption of the above execution is less than ${\Delta }_T$ . This is very like to happen, for example, ${\Delta }_T=1min$ .

• $\mathcal{A}$ selects a random $a^{*}$ and $K_i^{*}=a^{*}P$ and computes $Z_i^{*}:=K_i^{*}\oplus Y_i$ and $N_i^{*}:=h(Y_i||M{I}_i||\mathrm{SI}{D}_v)$ . The message $m_1^{*}=\{M{I}_i,Z_i^{*},N_i^{*},T_1\}$ is sent to some oracle of sensor $\mathrm{SI}{D}_j$ , say ${\mathrm{\Pi }}_{\mathrm{SI}{D}_v}^l$ .

• Meanwhile $f_j:=h(\mathrm{SI}{D}_j||X_{\mathrm{GWN}})$ would run the protocol with GWN honestly. ${\mathrm{\Pi }}_{\mathrm{SI}{\mathrm{D}}_v}^l$ replies $\mathcal{A}$ with message $m_4^{*}=\{R_{\mathrm{iv}}^{*},E_i^{*},T_4^{*}\}$ where $R_{\mathrm{iv}}^{*}=h(K_i^{*}||T_4)\oplus K_v^{*}$ and $K_v^{*}=b^{*}P$ is chosen by ${\mathrm{\Pi }}_{\mathrm{SI}{\mathrm{D}}_v}^l$ .

• Finally, $\mathcal{A}$ could compute $K_v^{*}:=h(K_i^{*}||T_4)\oplus R_{\mathrm{iv}}$ and session key $K^{*}:=h(a^{*}{b}^{*}P·x)$ , where $a^{*}{b}^{*}P·x$ is the x-coordinate of the point $a^{*}{b}^{*}P$ . Note that $K_i^{*}$ is chosen by $\mathcal{A}$ of its own choice.

Note that based on such corrupted sensor, $\mathcal{A}$ is able to launch (unlimited) the above attack to impersonate any honest users $U_i$ to any uncompromised sensors $S_v$ at an arbitrary time $T_1$ chosen by $\mathcal{A}$ . This would enable us to break the session key security of P2. It is not hard to see that this attack is also very harmful in practice. We highlight that the similar attack can be also mounted to P1.

Since the attack mainly exploits the corrupted sensor to obtain the secret $Y_i$ which can be extracted from the ciphertext $F_{\mathrm{ij}}$ based on the corrupted secret key $f_j$ . Therefore, the attack time roughly equals to the message delivery time of $m_1$ and $m_2$ and computation time of two hash operations (for computing $A_j$ and $Y_i$ ). If the attacker fails within a time $T_1+{\Delta }_T$ , it can just choose another time $T_{1\prime }$ to start the attack again.

An improved protocol

In order to fix the problem of P2 (cf. P1), the computation of $Y_i$ should be modified. Specifically, we suggest adding the sensor’s identity $\mathrm{SI}{\mathrm{D}}_j$ into the generation of $Y_i$ , that is, $Y_i=h(f_i||M{I}_i||\mathrm{SI}{D}_j)$ . We also include the messages exchanged between user and sensor into the session key generation so that the resultant session key is uniquely bound to a specific session. The rest of protocol execution of P2 remains the same. The improved protocol is shown in Figure 4 with minimum modifications. The improved protocol preserves all the properties of the original protocol such as session key security and perfect forward secrecy (PFS).

Figure 4.

The improved P2.

The improved protocol consists of four phases which are described as follows:

1. User registration phase. The user registration phase is shown in Figure 2.

2. Upon receiving $m_{\mathrm{Ureg}}$ , GWN verifies the user’s identity and generates a random nonce $r_i$ . Then, GWN computes a pseudonym $M{I}_i:=h(r_{i\prime }||I{D}_i)$ for $U_i$ and uses its long-term key $X_{\mathrm{GWN}}$ to compute $f_i:=h(M{I}_i||x_{\mathrm{GWN}})$ and $e_i:=M{P}_i\oplus f_i$ . Finally, $\mathrm{GWN}$ creates a smart card $S{C}_i=\{M{I}_i,e_i\}$ and issues it to the user $U_i$ over some secure channel.

3. After receiving the smart card $S{C}_i$ , $U_i$ writes the value $r_i$ into it. Eventually, the smart card $S{C}_i$ stores $\{M{I}_i,e_i,r_i\}$ .

Sensor registration phase. The sensor registration phase should be also run over some secure channel. As for a sensor node $S_j$ , GWN first selects a unique identity $\mathrm{SI}{D}_j$ . Then, GWN computes $f_j:=h(\mathrm{SI}{D}_j||X_{\mathrm{GWN}})$ . Meanwhile, the tuple $(\mathrm{SI}{D}_j,f_j)$ is stored by GWN. Finally, the identity $\mathrm{SI}{D}_j$ and the authentication key $f_j$ are written into the sensor node $S_j$ .

Authentication and key exchange phase. The following protocol steps are performed:

Message 1 (m1): $U_i$ to $S_j$

$U_i$ inputs its identity $I{D}_i$ and password $p{w}_i$ .

Upon receiving $\{I{D}_i,p{w}_i\}$ , the smart card $S{C}_i$ computes $M{P}_i:=h(r_i||p{w}_i)$ and the corresponding authentication key $f_i:=e_i\oplus M{P}_i$ .

$S{C}_i$ gets the current timestamp $T_1$ and selects a random value $a{\in }_R{\mathbb{Z}}_p$ . Next, $S{C}_i$ computes an ephemeral public key $K_i:=\mathrm{aP}$ , a ciphertext $Z_i:=K_i\oplus Y_i$ and an authentication message $N_i:=h(Y_i||M{I}_i||\mathrm{SI}{D}_j)$ .

The message $m_1=\{M{I}_i,Z_i,N_i,T_i\}$ is sent to the sensor $S_j$ .

Message 2 (m2): $S_j$ to GWN

Upon receiving $m_1$ , $S_j$ checks whether or not $T_1$ is a valid timestamp.

$S_j$ gets a timestamp $T_2$ and computes an authentication message $A_j:=h(f_j||N_i||T_2)$ .

The message $m_2=\{M{I}_i,N_i,\mathrm{SI}{D}_j,A_j,T_1,T_2\}$ is sent to GWN.

Message 3 (m3): GWN to $S_j$

Upon receiving $m_2$ , GWN aborts if either $T_1$ or $T_2$ is not valid.

GWN computes verification messages $f_{j\prime }=h(\mathrm{SI}{D}_j||X_{\mathrm{GWN}})$ and $A_{j\prime }:=h(f_{j\prime }||N_i||T_2)$ , $f_{i\prime }:=h(M{I}_i||X_{\mathrm{GWN}})$ , and $N_{i\prime }:=h(Y_{i\prime }||M{I}_i||\mathrm{SI}{D}_j)$ . GWN rejects if $N_{i\prime }\ne N_i$ and $A_{j\prime }\ne A_j$ .

Next, GWN gets a timestamp $T_3$ and computes an authentication key $Y_{i\prime }:=:=h(f_{i\prime }||T_1||\mathrm{SI}{D}_j)$ and a ciphertext $F_{\mathrm{ij}}:=Y_{i\prime }\oplus h(f_{j\prime }||T_3)$ , and authentication messages $H_j:=h(Y_{i\prime })$ and $E_i:=h(f_{i\prime }||N_{i\prime })$ .

The message $m_3=\{F_{\mathrm{ij}},H_i,E_i,T_3\}$ is sent to the sensor $S_j$ .

Message 4 (m4): $S_j$ to $U_i$

Upon receiving $m_3$ , $S_j$ checks $T_3$ , and computes the verification key $Y_{i\prime }:=F_{\mathrm{ij}}\oplus h(f_j||T_3)$ . $S_j$ rejects if $H_j\ne h(Y_{i\prime })$ .

$S_j$ selects a random value $b{\in }_R{\mathbb{Z}}_p$ and computes an ephemeral public key $K_j:=\mathrm{bP}$ . Next, $S_j$ gets a timestamp $T_4$ and computes a ciphertext $R_{\mathrm{ij}}:=h(K_i||T_4)\oplus K_j$ .

The session key is computed as $K:=h(\mathrm{abP}·x||K_i||K_j||M{I}_i||\mathrm{SI}{D}_j||T_1||T_4)$ , where $\mathrm{abP}·x$ is the x-coordinate of the point $\mathrm{abP}$ . The input of the hash function covers almost all protocol messages exchanged between user and sensor, so that the session key is uniquely bound to a session identified by such transcript.

The message $m_4=\{R_{\mathrm{ij}},E_i,T_4\}$ is sent to the user $U_i$ .

Finalize: User $U_i$ .

Upon receiving message $m_4$ , $U_i$ checks the timestamp $T_4$ and computes the verification message $E_{i\prime }:=h(f_i||N_i)$ and rejects if $E_{i\prime }\ne E_i$ .

$U_i$ computes the session key $K:=h(\mathrm{abP}·x||K_i||K_j||M{I}_i||\mathrm{SI}{D}_j||T_1||T_4)$ .

User authentication key change phase. Suppose the user has been authenticated in an AKE session with his or her old password $p{w}_i$ , $S{C}_i$ has $M{P}_i$ in that session. Then the user $U_i$ inputs his new password ${\mathrm{pw}}_i^{\mathrm{new}}$ . After this, $S{C}_i$ computes ${\mathrm{MP}}_i^{\mathrm{new}}:=h(r_i||{\mathrm{pw}}_i^{\mathrm{new}})$ and $e_i^{\mathrm{new}}:=e_i\oplus M{P}_i\oplus {\mathrm{MP}}_i^{\mathrm{new}}$ . Finally, $S{C}_i$ stores $e_i^{\mathrm{new}}$ .

The decisional Diffie–Hellman assumption

Let $\mathbb{G}$ be a group of prime order $p$ under an elliptic curve. Let $P$ be a random generator of $\mathbb{G}$ . The decisional Diffie–Hellman (DDH) problem is stated as follows: given tuple $(P,\mathrm{aP},\mathrm{bP},\mathrm{cP})$ for $a,b,c\stackrel{\$}{\to }{\mathbb{Z}}_p^{*}$ as input, it is hard to distinguish whether $c=\mathrm{ab}$ .

Definition 4

For a group $\mathbb{G}$ of prime order $p$ and an adversary $\mathcal{D}$ , we define the following experiment:

• ${\mathrm{EXP}}_{\mathbb{G},p,\mathcal{D}}^{\mathrm{ddh}}(\lambda )$

• $P\stackrel{\$}{\leftarrow }\mathbb{G}$ ; $(a,b,\gamma )\stackrel{\$}{\leftarrow }{\mathbb{Z}}_p^{*}$ ; $\beta \stackrel{\$}{\leftarrow }\{0,1\}$ ;

• if $\beta =1$ then $\mathrm{\Gamma }\leftarrow \mathrm{abP}$ , otherwise $\mathrm{\Gamma }\leftarrow \gamma P$ ;

• $\beta \prime \leftarrow \mathcal{D}(\mathbb{G},p,P,\mathrm{aP},\mathrm{bP},\mathrm{\Gamma })$ ; if $\beta =\beta \prime$ then return 1, otherwise return 0.

The advantage of $\mathcal{D}$ in above experiment is defined as follows

$${\mathrm{Adv}}_{\mathbb{G},p,\mathcal{D}}^{\mathrm{ddh}}(\lambda ):=|\mathrm{Pr}[{\mathrm{EXP}}_{\mathbb{G},p,\mathcal{D}}^{\mathrm{ddh}}(\lambda )=1]-\frac{1}{2}|$$

We say that the $\mathrm{DDH}$ problem relative to a group $\mathbb{G}$ of prime order $p$ holds, if for all PPT adversaries $\mathcal{D}$ the advantage ${\mathrm{Adv}}_{\mathbb{G},p,\mathcal{D}}^{\mathrm{ddh}}(\lambda )$ is a negligible function in $\lambda$ .

Theorem 1

Suppose that the hash function $h$ is modeled as random oracle, the output bit length of the hash function is $\nu$ , and the $\mathrm{DDH}$ problem relative to a group $\mathbb{G}$ with prime order $p$ holds, then the fixed protocol $P2\prime$ is session-key-secure such that ${\mathrm{Adv}}_{P2\prime ,\mathcal{A}}^{\mathrm{ake}}(\lambda ,\mathrm{OFFS})\le d/D+q_h/2^{\nu -3}+(d\ell {)}^2·{\mathrm{Adv}}_{\mathbb{G},p,\mathcal{D}}^{\mathrm{ddh}}(\lambda )$ , where $q_h$ is the number of allowed random oracle query.

Due to this modification, each credential $Y_i$ is particularly bound to an execution between the user $I{D}_i$ and the sensor $\mathrm{SI}{D}_j$ at time $T_1$ . Thus, the attacker is unable to abuse $Y_i$ involving some malicious sensor $\mathrm{SI}{D}_v$ to impersonate $I{D}_i$ to some honest sensor $\mathrm{SI}{D}_j$ .

Proof

The proof is proceeded following the game-based approach. ²³ Let $\mathrm{Ad}{v}_{\xi }$ denote the advantage of $\mathcal{A}$ in Game $\xi$ .

Game 0

The first game is the real security experiment which is run between an adversary $\mathcal{A}$ and an AKE challenger $\mathcal{C}$ . Thus, we have that

$${\mathrm{Adv}}_{\mathrm{\Pi },\mathcal{A}}^{\mathrm{ake}}(\lambda )=\mathrm{Ad}{v}_0$$

Meanwhile, $\mathcal{C}$ will simulate the queries of $\mathcal{A}$ as follows:

• $\mathrm{Execute}(I{D}_i,s,\mathrm{SI}{D}_j,t,I{D}_{\mathrm{GWN}},u)$ and $\mathrm{Send}(\mathcal{I}{\mathcal{D}}_i,s,m)$ queries will be honestly simulated as defined in section “Security model” following our protocol specification.

• $\mathrm{RevealKey}(\mathcal{I}{\mathcal{D}}_i,s)$ : The session key returned by this query is $\mathrm{SK}=h(\mathrm{abP}.x||K_i||K_j||M{I}_i||\mathrm{SI}{D}_j||T_1||T_4)$ .

• $\mathrm{CorruptSC}(I{D}_i)$ : This query returns $S{C}_i=\{M{I}_i,e_i,r_i\}$ of $I{D}_i$ .

• $\mathrm{CorruptS}(\mathrm{SI}{D}_j)$ : This query returns the contents of $f_j=h(\mathrm{SI}{D}_j||X_{\mathrm{GWN}})$ of $\mathrm{SI}{D}_j$ .

• $\mathrm{Test}(\mathcal{I}{\mathcal{D}}_i,s)$ : This query will be honestly simulated as defined in section “Security model.” However, the test oracle (asked by this query) should keep fresh throughout the security experiment in the sense of Definition 1.

In this game, the challenger just simulates these queries following the protocol specification without any modification. In the subsequent games, we may change them step by step till the advantage of the adversary is zero.

Game 1

In this game, the challenger aborts if the adversary $\mathcal{A}$ asks the random oracle $h(·)$ with a user $U_i\mathrm{s}$ password $p{w}_i$ and its randomness $r_i$ as input, that is, $M{I}_i=h(r_i||p{w}_i)$ . This implies that the adversary can ask a $\mathrm{Send}(I{D}_i,s,m)$ query, such that $p{w}_i\in m$ . Recall that $p{w}_i$ is used to compute $M{P}_i$ which is used to decrypt $f_i=M{I}_i\oplus e_i$ . In this case, the adversary must be able to succeed in online attacks.

The length of the password is assumed to be $D$ . Hence, if the adversary can input the correct $p{w}_i$ , then it is able to impersonate the user (e.g. after obtaining the victim’s smart card without compromising the secret information stored in the smart card). The probability that $\mathcal{A}$ correctly guesses is about $1/D$ . Note that $\mathcal{A}$ can try $d\ell$ times which is the maximum number of $\mathrm{Send}$ query to all $\ell$ parties. The winning probability of a successful online attack is bound to $d\ell /D$ . Thus, we have that

$$\mathrm{Ad}{v}_0\le \mathrm{Ad}{v}_1+\frac{d\ell }{D}$$

Game 2

In this game, the challenger first aborts if a fresh oracle of $\mathrm{GWN}$ receives a valid $N_i$ which is not sent by any fresh oracle of $U_i$ at a valid time. To generate a valid $N_i$ , the adversary $\mathcal{A}$ has to either (1) break the one-wayness of the hash function or (2) randomly guess (correctly) the output of the random oracle $h(·)$ for generating $N_i$ . If the case (1) holds, the adversary $\mathcal{A}$ may be able to ask the random oracle $h(Y_i||M{I}_i||\mathrm{SI}{D}_j)$ and $h(f_i)$ with the correct $f_i$ but without asking the corresponding $\mathrm{CorruptSC}$ query. The abort event implies that the adversary is able to either find the pre-image of the hash value (after obtaining the protocol transcript via $\mathrm{Execute}$ query) or forge the protocol message. Since each $N_i$ is used only once, either $f_i$ or $h(f_i||T_1)$ is protected by the one-wayness of the hash function $h$ . Hence, the probability of correctly generating a valid $N_i$ for $\mathcal{A}$ is bound to $1/2^{\nu -1}$ . Furthermore, we add another similar abort rule that the challenger aborts if an oracle of $\mathrm{GWN}$ receives a valid $A_j$ which is not sent by any fresh oracle of $S_j$ . The security of $A_j$ is quite similar to that of $N_i$ .

Since there are two such authentication messages, $N_i$ and $A_j$ , each of which has two related hash operations, $\mathcal{A}$ can ask at most $q_h$ random oracle queries. We therefore have that

$$\mathrm{Ad}{v}_1\le \mathrm{Ad}{v}_2+\frac{q_h}{2^{\nu -2}}$$

Game 3

In this game, the challenger aborts if one of the following conditions holds: (1) a fresh oracle of $S_j$ receives a valid $H_i$ which is not sent by any fresh oracle of $\mathrm{GWN}$ or (2) a fresh oracle of $U_i$ receives a valid $E_i$ which is not sent by any fresh oracle of $\mathrm{GWN}$ . With the similar arguments in the previous game, we have that

$$Ad{v}_2\le Ad{v}_3+\frac{q_h}{2^{\nu -2}}$$

As a result in this game, we have the fact that the test oracle must have a partner oracle; otherwise, the challenger has aborted.

Game 4

In this game, we try to reduce the security to the DDH hard problem. We change the session key of the test oracle to be a random value. If there exists an adversary which can distinguish this game from the previous game, then we can make use of it build an algorithm $\mathcal{D}$ to solve the DDH problem. Given a DDH challenge instance $(\mathrm{xP},\mathrm{yP},\mathrm{cP})$ , the job of $\mathcal{D}$ is to distinguish $c=?\mathrm{xy}$ . Meanwhile, $\mathcal{D}$ first guesses the test oracle and its partner oracle. If its guess is incorrect then it aborts. The abort probability is bound to $1/(d\ell {)}^2$ . In the following, we assume that $\mathcal{D}$ ’s guess is correct. Then $\mathcal{D}$ sets the ephemeral DH key of the test oracle to $\mathrm{xP}$ and its partner oracle’s DH key as $\mathrm{yP}$ . The session key of the test oracle is computed as $h(\mathrm{cP}||\mathrm{xP}||\mathrm{yP}||M{I}_i||\mathrm{SI}{D}_j||T_1||T_4)$ . The other simulations are similar to the previous games. So that if $c=\mathrm{ab}$ , then the game is identical to the previous game. Otherwise, it is equivalent to this game. Due to the hardness of the DDH problem, we have that

$$\mathrm{Ad}{v}_3\le \mathrm{Ad}{v}_4+{\mathrm{Adv}}_{\mathbb{G},p,\mathcal{D}}^{\mathrm{ddh}}(\lambda )$$

As the bit in the Test query is not used anymore, the advantage of an adversary in this game is zero, that is, $\mathrm{Ad}{v}_4=0$ . To sum up all probabilities in the above games, we get the result of this theorem.

Performance comparison

In this section, we compare our improved scheme with related existing similar lightweight AKE protocols of Shi and Gong ⁴ (SG), Choi et al. ⁶ (CLK+), Turkanovic et al. ⁷ (TBH), and Das et al. ¹¹ (DKO+) which are run under the same system model.

We approximately test the performance of compared protocols on PC with Intel Core i7, 4.2 GHz+8GB RAM, and Python 2.7. Let $t_{\mathrm{mul}}$ and $t_h$ denote the estimated experimental time of 224-bits elliptic curve point multiplication and a SHA256 hash function operation (for 128 bytes message), respectively. We omit the cost of $\mathrm{XOR}$ in the comparison, which is much smaller than the other two types of operations. We specifically have that $t_{\mathrm{mul}}=3.8\mathrm{ms}$ and $t_h=0.007\mathrm{ms}$ . We consider a biometric computation required by Das et al.’s scheme as a hash operation. The comparison of computational cost is listed in Table 2.

Table 2.

Computation cost.

	User	Sensor	Gateway
SG 4	$3\mathrm{mul}+6h$	$2\mathrm{mul}+3h$	$1\mathrm{mul}+5h$
	$11.442\mathrm{ms}$	$7.621\mathrm{ms}$	$3.835\mathrm{ms}$
CLK+ 6	$3\mathrm{mul}+7h$	$2\mathrm{mul}+6h$	$1\mathrm{mul}+5h$
	$11.449\mathrm{ms}$	$7.642\mathrm{ms}$	$3.835\mathrm{ms}$
TBH 7	$6h$	$4h$	$7h$
	$0.042\mathrm{ms}$	$0.028\mathrm{ms}$	$0.049\mathrm{ms}$
DKO+ 11	$2\mathrm{mul}+13h$	$2\mathrm{mul}+9h$	$10h$
	$7.691\mathrm{ms}$	$7.663\mathrm{ms}$	$0.07\mathrm{ms}$
Ours	$2\mathrm{mul}+6h$	$2\mathrm{mul}+5h$	$8h$
	$7.642\mathrm{ms}$	$7.635\mathrm{ms}$	$0.056\mathrm{ms}$

In Figure 5, we compare the communication cost of our scheme with existing schemes. We make reasonable assumptions that each identity is 128 bits, each random nonce is 256 bits, each timestamp is 64 bits, each elliptic curve cryptography (ECC) group value is 224 bits, and each hash value is 256 bits.

Figure 5.

Communication cost.

Turkanovic et al.’s ⁷ scheme (TBH) is more efficient than all other listed protocols but it does not provide PFS. Our improved scheme inherits the high performance of P2, ⁹ which provides a trade-off between security and performance. Although the computation cost of our scheme is slightly more expensive than that of Shi et al.’s scheme (SG), our scheme is the most efficient one for the user and GWN among those compared protocols which satisfy PFS. Furthermore, our scheme has the best communication performance.

Conclusion

In this article, we revisited a recently proposed AKE scheme ⁹ for WSNs. We have shown that there is a security vulnerability in this scheme. We also demonstrated a concrete attack and gave a solution for avoiding this attack. Some improvements for the security model have been given for analyzing the improved protocol. Since a good AKE protocol might need to provide as many security properties as possible, it might be interesting (as a future work) to further improve our protocol and Das et al.’s ¹¹ scheme by incorporating more security attributes as introduced in recent literature.^12,24 Of course, one could also strengthen our security model to cover more active attacks for specific protocols.

Among those security properties, PFS has been a de facto standard property of AKE. Recently proposed lightweight AKE protocols,^4,6,9,12,25 all achieve PFS based on Diffie–Hellman key exchange (DHKE). Since two exponential operations are required in DHKE, it is not efficient for either smart card or sensor due to its low processing resources. Another open problem is to construct lightweight AKE protocols which provide PFS without relying on Diffie–Hellman–like primitives.