Efficient and Anonymous Two-Factor User Authentication in Wireless Sensor Networks: Achieving User Anonymity with Lightweight Sensor Computation

Junghyun Nam; Kim-Kwang Raymond Choo; Sangchul Han; Moonseong Kim; Juryon Paik; Dongho Won

doi:10.1371/journal.pone.0116709

Abstract

A smart-card-based user authentication scheme for wireless sensor networks (hereafter referred to as a SCA-WSN scheme) is designed to ensure that only users who possess both a smart card and the corresponding password are allowed to gain access to sensor data and their transmissions. Despite many research efforts in recent years, it remains a challenging task to design an efficient SCA-WSN scheme that achieves user anonymity. The majority of published SCA-WSN schemes use only lightweight cryptographic techniques (rather than public-key cryptographic techniques) for the sake of efficiency, and have been demonstrated to suffer from the inability to provide user anonymity. Some schemes employ elliptic curve cryptography for better security but require sensors with strict resource constraints to perform computationally expensive scalar-point multiplications; despite the increased computational requirements, these schemes do not provide user anonymity. In this paper, we present a new SCA-WSN scheme that not only achieves user anonymity but also is efficient in terms of the computation loads for sensors. Our scheme employs elliptic curve cryptography but restricts its use only to anonymous user-to-gateway authentication, thereby allowing sensors to perform only lightweight cryptographic operations. Our scheme also enjoys provable security in a formal model extended from the widely accepted Bellare-Pointcheval-Rogaway (2000) model to capture the user anonymity property and various SCA-WSN specific attacks (e.g., stolen smart card attacks, node capture attacks, privileged insider attacks, and stolen verifier attacks).

Citation: Nam J, Choo K-KR, Han S, Kim M, Paik J, Won D (2015) Efficient and Anonymous Two-Factor User Authentication in Wireless Sensor Networks: Achieving User Anonymity with Lightweight Sensor Computation. PLoS ONE 10(4): e0116709. https://doi.org/10.1371/journal.pone.0116709

Academic Editor: Muhammad Khurram Khan, King Saud University, Kingdom of Saudi Arabia, SAUDI ARABIA

Received: October 19, 2014; Accepted: December 14, 2014; Published: April 7, 2015

Copyright: © 2015 Nam et al. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited

Data Availability: All relevant data are within the paper and its Supporting Information files.

Funding: This work was supported by Konkuk University. The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.

Competing interests: The authors have declared that no competing interests exist.

Introduction

The quest to understand real-world phenomena at a fine spatial-temporal resolution has led to a great increase in the interest in wireless sensor networks (WSNs). Where not already in place, a WSN is now being planned and deployed in various application settings such as wildlife monitoring, military surveillance, healthcare diagnostics, and vehicular tracking [1]. Providing an application service in a WSN environment introduces significant security challenges for the involved parties: sensors, users and gateways. One fundamental challenge is to establish a shared session key between a sensor and a user in an authenticated manner (known as authenticated key exchange) via a gateway, and thereby to prevent unauthorized access to sensitive sensor data and their transmissions. Since sensors have severe resource constraints and due to network characteristics such as unattended operation and unreliable communication channel, authenticated key exchange in WSNs is generally regarded as more challenging to achieve than in traditional networks with sufficient computing resources and pre-existing infrastructures. Achieving authenticated key exchange becomes even more difficult when user anonymity is desired. As the concern for privacy increases in our lives, user anonymity has become a vital security property in various WSN applications as well as in many other applications like location-based services, e-voting, mobile roaming services, and anonymous web browsing.

A smart-card-based user authentication scheme for WSNs (in short, a sca-wsn scheme) allows a user holding its smart card issued by the gateway to achieve authenticated key exchange with a sensor, preferably in a way that its anonymity is preserved. Since the early work of Das [2], He et al. [3], Khan and Alghathbar [4] and Chen and Shih [5], all of which provide no key-exchange functionality, the design of sca-wsn schemes has attracted much attention from researchers due to their potential to be widely deployed, and a number of proposals offering various levels of security and efficiency have been presented [6–20]. Some schemes consider only authenticated key exchange [6, 8, 9, 12, 20] while others attempt to additionally provide user anonymity [7, 10, 11, 13–19]. Schemes such as the ones in [6, 12, 20] employ elliptic curve cryptography to provide perfect forward secrecy while most schemes [7–11, 13–19] use only lightweight cryptographic techniques, such as symmetric encryptions, message authentication codes and hash functions, to focus on improving the efficiency.

One common security requirement for sca-wsn schemes is to ensure that:

only a user who is in possession of both a smart card and the corresponding password can be successfully authenticated (by the gateway) and access the sensor data.

This requirement is commonly referred to as two-factor security [21–25] and is modelled via an adversary who is able to either extract all the information inside the smart card of a user or learn the password of the user, but not both. (Clearly, there is no means to prevent the adversary from impersonating a user if both the information in the smart card and the password of the user are disclosed.) The former requires physical access to the smart card and then mounting a side-channel attack [26, 27] on the (lost, misplaced or stolen) card, while the latter can be achieved with shoulder-surfing or by using a malicious card reader. Any attack exploiting the former ability is commonly called a stolen smart card attack and is considered practical under the assumption that users’ smart cards are non-tamper-resistant. Accordingly, sca-wsn schemes should be designed to achieve their intended security properties, such as authenticated key exchange and user anonymity, against stolen smart card attacks.

Despite the many research efforts to date, it remains a challenging task to design an efficient sca-wsn scheme that provides user anonymity. The recent work of Wang and Wang [28, 29] shows that, under the non-tamper-resistance assumption of smart cards, no sca-wsn scheme can provide user anonymity without recourse to public key cryptography. This result is somewhat surprising because it implies that all existing anonymous schemes using only lightweight cryptographic techniques [7, 10, 11, 13–19] fail to achieve user anonymity in the presence of an adversary who can mount a stolen smart card attack. As an example of such a failure, we here take the recent sca-wsn scheme of Jiang et al. [19] which has been presented with a claim of user anonymity. To illustrate the failure, we only need to examine the user registration and login request phases of the scheme. Let MK be the master key of the gateway GW, and H be a cryptographic hash function. Then, the two phases proceed as follow:

User Registration. A user U registers with GW as follows:
1. U chooses its identity ID_U and password PW_U, generates a random number r, computes RPW_U = H(r‖PW_U), and submits ID_U and RPW_U to GW via a secure channel.
2. If ID_U is valid, GW generates a temporary identity for U, TID_U, and computes TC_U = H(MK‖ID_U‖TE_U) and PTC_U = TC_U⊕RPW_U, where TE_U is the expiration time of TID_U. GW then stores (TID_U, ID_U, TE_U) in its verification table, and issues U a smart card containing {H(⋅), TID_U, TE_U, PTC_U}.
3. U stores the random number r into the smart card, which then holds {H(⋅), TID_U, TE_U, PTC_U, r}.
Login Request. U inserts its smart card into a card reader, and inputs ID_U and PW_U. The smart card retrieves the current timestamp T_U, selects a random key K_U, and computes TC_U = PTC_U⊕H(r‖PW_U), PKS_U = K_U⊕H(TC_U‖T_U) and C_U = H(ID_U‖K_U‖TC_U‖T_U). Then, U sends the login request message M_U = ⟨TID_U, C_U, PKS_U, T_U⟩ to GW.

Assume an attacker A who has obtained the information {H(⋅), TID_U, TE_U, PTC_U, r} stored on the smart card of user U. A eavesdrops and obtains the login request message M_U = ⟨TID_U, C_U, PKS_U, T_U⟩, and mounts the following offline dictionary attack.

Step 1. A makes a guess $P W_{U}^{'}$ on the password PW_U and computes $T C_{U}^{'} = P T C_{U} \oplus H (r ‖ P W_{U}^{'})$ and $K_{U}^{'} = P K S_{U} \oplus H (T C_{U}^{'} ‖ T_{U})$ .
Step 2. For each possible identity $I D_{U}^{'}$ , A computes $C_{U}^{'} = H (I D_{U}^{'} ‖ K_{U}^{'} ‖ T C_{U}^{'} ‖ T_{U})$ and verifies the correctness of $P W_{U}^{'}$ and $I D_{U}^{'}$ by checking that $C_{U}^{'}$ is equal to C_U. Note that, with an overwhelming probability, $C_{U}^{'} = C_{U}$ if and only if $P W_{U}^{'} = P W_{U}$ and $I D_{U}^{'} = I D_{U}$ .
Step 3. A repeats Steps 1 and 2 until the correct password and identity are found.

This dictionary attack works because the identity space is very limited in practice, being usually even smaller than the password space [28, 29]. All other schemes using only lightweight cryptographic techniques are also vulnerable to similar dictionary attacks, as shown in [28, 29]. Note that simply using a symmetric encryption scheme cannot overcome the inherent failure. Although there are some published schemes that employ elliptic curve cryptography [6, 12, 20], these schemes were designed with no user anonymity in the first place and moreover, are not efficient in the sense that they impose expensive scalar-point multiplications on resource-constrained sensors.

In this paper, we present an efficient and provably-anonymous sca-wsn scheme that requires sensors to perform only lightweight cryptographic operations. Our scheme employs elliptic curve cryptography but restricts its use to anonymous user-to-gateway authentication in order not to impose any (expensive) public-key operations, such as scalar-point multiplications and map-to-point operations, on sensors. We formally prove that our scheme achieves user anonymity as well as authenticated key exchange in an extension of the widely accepted model of Bellare et al. [30]. In proving the security properties, we assume that the cryptographic hash functions used are random oracles and the elliptic curve computational Diffie-Hellman problem is computationally hard. The extended model captures not only the notion of two-factor security but also standard attacks against sca-wsn schemes like node capture attacks, privileged insider attacks, and stolen verifier attacks.

The remainder of this paper is structured as follows. Section 2 describes an extended security model for the analysis of anonymous sca-wsn schemes. Section 3 presents our proposed sca-wsn scheme along with cryptographic primitives on which the security of the scheme relies. Section 4 provides proofs for the security properties of our proposed scheme in the extended security model. Section 5 concludes the paper with a comparative efficiency and security of our scheme and other sca-wsn schemes.

A Security Model for Anonymous sca-wsn Schemes

This section describes a security model extended from the Bellare et al.’s model [30] to analyze authentication and key exchange protocols of anonymous sca-wsn schemes. Our security model captures the notion of two-factor security as well as the resistance to node capture attacks, privileged insider attacks, stolen verifier attacks, and other common attacks. We provide two security definitions associated with the model, one for authenticated key exchange and one for user anonymity, which collectively define a secure, anonymous sca-wsn scheme.

Participants

Let 𝓢𝓝 and 𝓤 be the sets of all sensors and users, respectively, registered with the gateway GW. Let 𝓔 = 𝓤∪𝒮𝓝∪{GW}. We identify each entity E ∈ 𝓔 by a string, and interchangeably use E and ID_E to refer to this identifier string. To formally capture the user anonymity property, we assume that: (1) each user U ∈ 𝓤 has its pseudo identity PID_U in addition to the true identity ID_U and (2) the adversary 𝓐 is given only PID_U but not ID_U.

Protocol Executions

A user U ∈ may run multiple sessions of the authentication and key exchange protocol of a sca-wsn scheme, either serially or concurrently, to establish a session key with a sensor SN ∈ 𝒮𝓝 via assistance of the gateway GW. Therefore, at any given time, there could be multiple instances of the entities U, SN and GW. We use $Π_{E}^{i}$ to denote instance i of entity E ∈ 𝓔. Instances of U and SN are said to accept when they compute a session key in an execution of the protocol. We denote the session key of $Π_{E}^{i}$ by $s k_{E}^{i}$ .

Long-Lived Keys

During the initialization of the protocol,

each U ∈ 𝓤 chooses its password PW_U from a fixed dictionary 𝒟, and
GW generates its master secret(s), issues a smart card to each U ∈ 𝓤, and shares a cryptographic key with each SN ∈ 𝒮𝓝.

Partnering

Informally, two instances are said to be partners of each other if they participate together in the same protocol session and as a result, compute the same session key. Formally, partnering between instances is defined in terms of the notion of session identifier. A session identifier (sid) is an identifier of a protocol session and is typically defined as a function of the messages exchanged in the session. Let $s i d_{E}^{i}$ denote the sid of instance $Π_{E}^{i}$ . We say that two instances, $Π_{U}^{i}$ and $Π_{S N}^{j}$ , are partners if (1) both the instances have accepted and (2) $s i d_{U}^{i} = s i d_{S N}^{j}$ .

Adversary Capabilities

We assume there exists an adversary 𝓐 running in a probabilistic polynomial time (ppt) in the security parameter κ, which represents the bit-length of session keys. We note that the size of the dictionary 𝒟 is a fixed constant that is independent of the security parameter κ. The ppt adversary 𝓐 has complete control of all communications between entities, can request for access to session keys and long-term keys, and can extract user’s information stored on the smart card. These capabilities of 𝓐 are modeled via the following oracle queries which are allowed for 𝓐 to make.

$Execute$ ( $Π_{U}^{i}$ , $Π_{S N}^{j}$ , $Π_{G W}^{k}$ ): This query models passive attacks against the protocol. It prompts an execution of the protocol between the instances $Π_{U}^{i}$ , $Π_{S N}^{j}$ and $Π_{G W}^{k}$ , and outputs the transcript of the protocol execution to 𝓐.
$Send$ ( $Π_{E}^{i}, m$ ): This query sends a message m to an instance $Π_{E}^{i}$ , modelling active attacks against the protocol. Upon receiving m, the instance $Π_{E}^{i}$ proceeds according to the protocol specification. The message output by $Π_{E}^{i}$ , if any, is returned to 𝓐. A query of the form $Send$ ( $Π_{U}^{i}$ , start:⟨SN, GW⟩) prompts $Π_{U}^{i}$ to initiate a protocol session with instances of SN and GW.
$Reveal$ ( $Π_{E}^{i}$ ): This query captures the notion of known key security. The instance $Π_{E}^{i}$ , upon receiving the query and if it has accepted, returns the session key, $s k_{E}^{i}$ , back to 𝓐.
$CorruptLL (U) / CorruptSC (U)$ : These queries together capture the notion of two-factor security. The former returns the password of U while the latter returns the information stored in the smart card of U.
$CorruptLL$ (SN): This query returns the long-lived secret(s) of the sensor SN, modelling node capture attacks.
$CorruptLL$ (GW), modelling privileged insider attacks.
$CorruptVFR$ (GW): This query returns the password verifiers stored by GW, modelling stolen verifier attacks.
$TestAKE$ ( $Π_{E}^{i}$ ): This query is used for determining whether the protocol achieves authenticated key exchange or not. If $Π_{E}^{i}$ has accepted, then depending on a random bit b chosen by the oracle, 𝓐 is given either the real session key $s k_{E}^{i}$ if b = 1 or a random key drawn from the session-key space if b = 0.
$TestUA$ (U): This query is used for determining whether the protocol provides user anonymity or not. Depending on a randomly chosen bit b, 𝓐 is given either the identity actually used for U in the protocol sessions (when b = 1) or a random identity drawn from the identity space (when b = 0).

$CorruptLL$ queries all together also capture the notion of perfect forward secrecy. SN and GW are said to be corrupted when they are asked a $CorruptLL$ query while U is considered as corrupted if it has been asked both $CorruptLL$ and $CorruptSC$ queries.

Authenticated Key Exchange (AKE)

The AKE security of an authentication and key exchange protocol P is defined via the notion of freshness. Intuitively, a fresh instance is one that holds a session key which should not be known to the adversary 𝓐, and an unfresh instance is one whose session key (or some information about the key) can be known by trivial means. A formal definition of freshness follows:

Definition 1 (Freshness). An instance $Π_{E}^{i}$ is fresh if none of the following occurs:

𝓐 queries $Reveal (Π_{E}^{i})$ or $Reveal (Π_{E^{'}}^{j})$ , where $Π_{E^{'}}^{j}$ is the partner of $Π_{E}^{i}$ .
𝓐 queries both $CorruptLL (U)$ and $CorruptSC (U)$ when U is E itself or the peer entity of E.
𝓐 queries $CorruptLL (S N)$ when SN is E itself or the peer entity of E.
𝓐 queries $CorruptLL (G W)$ .

Note that this definition of freshness is unable to capture the notion of perfect forward secrecy. (As explained in the next section, the authentication and key exchange protocol of our scheme does not provide perfect forward secrecy.) The AKE security of protocol P is defined in the context of the following two-stage experiment:

Experiment ExpAKE₀:

Stage 1. 𝓐 makes any oracle queries at will, except that:
1. 𝓐 is not allowed to make the $TestAKE$ ( $Π_{E}^{i}$ ) query if the instance $Π_{E}^{i}$ is not fresh.
2. 𝓐 is not allowed to make the $Reveal$ ( $Π_{E}^{i}$ ) query if it has already made a $TestAKE$ query to $Π_{E}^{i}$ or its partner instance.
3. 𝓐 is not allowed to access to the $TestUA$ oracle.
Stage 2. Once 𝓐 decides that Stage 1 is over, it outputs a bit b^′ as a guess on the hidden bit b chosen by the $TestAKE$ oracle. 𝓐 is said to succeed if b = b^′.

Let ${SuccAKE}_{0}$ be the event that 𝓐 succeeds in the experiment ExpAKE₀, and ${Adv}_{P}^{AKE} (𝓐)$ denote the advantage of 𝓐 in breaking the AKE security of protocol P. Then, we define ${Adv}_{P}^{AKE} (𝓐) = 2 \cdot {Pr}_{P, 𝓐} [{SuccAKE}_{0}] - 1$ .

Definition 2 (AKE Security). An authentication and key exchange protocol P is AKE-secure if ${Adv}_{P}^{AKE} (𝓐)$ is negligible for any ppt adversary 𝓐.

User Anonymity

An authentication and key exchange protocol that does not provide user anonymity may still be rendered AKE-secure. That is, the AKE security does not imply user anonymity. Therefore, a new, separate definition is necessary to capture the user anonymity property. Our definition of user anonymity is based on the notion of cleanness.

Definition 3 (Cleanness). A user U ∈ 𝓤 is clean if none of the following occurs:

𝓐 queries both $CorruptLL (U)$ and $CorruptSC (U)$ .
𝓐 queries $CorruptLL (G W)$ .

Note that the definition of cleanness does not impose any restriction on making $CorruptLL$ queries to sensors. This reflects our objective to achieve user anonymity even against sensors.

User anonymity is formalized in the context of the following two-stage experiment:

Experiment ExpUA₀:

Stage 1. 𝓐 makes any oracle queries at will, except that:
1. 𝓐 is not allowed to make the $TestUA$ (U) query if the user U is not clean.
2. 𝓐 is not allowed to corrupt GW and U if it has already made the $TestUA (U)$ query.
3. 𝓐 is not allowed to access to the $TestAKE$ oracle.
Stage 2. Once 𝓐 decides that Stage 1 is over, it outputs a bit b^′ as a guess on the hidden bit b chosen by the $TestUA$ oracle. 𝓐 is said to succeed if b = b^′.

Let ${SuccUA}_{0}$ be the event that 𝓐 succeeds in the experiment ExpUA₀, and ${Adv}_{P}^{UA} (𝓐)$ denote the advantage of 𝓐 in attacking the user anonymity of protocol P. Then, we define ${Adv}_{P}^{UA} (𝓐) = 2 \cdot {Pr}_{P, 𝓐} [{SuccUA}_{0}] - 1$ .

Definition 4 (User Anonymity). An authentication and key exchange protocol P provides user anonymity if ${Adv}_{P}^{UA} (𝓐)$ is negligible for any ppt adversary 𝓐.

Our Proposed Scheme

Our sca-wsn scheme restricts the use of elliptic curve cryptography to anonymous user-to-gateway authentication and thereby allows sensor nodes to perform only lightweight cryptographic operations such as symmetric encryption/decryption, MAC generation/verification, and hash function evaluation. We begin by describing the cryptographic building blocks on which the security of our scheme depends.

Building Blocks

Elliptic curve computational Diffie-Hellman (ECCDH) problem.

Let 𝔾 be an elliptic curve group of prime order q. Typically, 𝔾 will be a subgroup of the group of points on an elliptic curve over a finite field. Any elliptic curve and finite field recommended by NIST [31] can be used to instantiate the group 𝔾. The recent work of Choi et al. [20], for example, describes a typical elliptic curve group of a prime order. Let P be a generator of 𝔾. The ECCDH problem for 𝔾 is to compute xyP ∈ 𝔾 when given two elements (xP,yP) ∈ 𝔾², where $x, y \in_{R} ℤ_{q}^{*}$ . We say that the ECCDH assumption holds for 𝔾 if it is computationally infeasible to solve the ECCDH problem for 𝔾. Let ${Adv}_{𝔾}^{ECCDH} (𝓐)$ be the advantage of an algorithm 𝓐 in solving the ECCDH problem for 𝔾 and be defined as ${Adv}_{𝔾}^{ECCDH} (𝓐) = Pr [𝓐 (𝔾, P, x P, y P) = x y P]$ . We assume that ${Adv}_{𝔾}^{ECCDH} (𝓐)$ is negligible for all ppt algorithms 𝓐 (i.e., the ECCDH assumption holds in 𝔾). We denote by ${Adv}_{𝔾}^{ECCDH} (t)$ the maximum value of ${Adv}_{𝔾}^{ECCDH} (𝓐)$ over all algorithms 𝓐 running in time at most t.

Message authentication code schemes.

A message authentication code (MAC) scheme Σ is a pair of efficient algorithms ( $Mac$ , $Ver$ ) where: (1) the MAC generation algorithm $Mac$ takes as input an ℓ-bit key k and a message m, and outputs a MAC σ; and (2) the MAC verification algorithm $Ver$ takes as input a key k, a message m, and a MAC σ, and outputs 1 if σ is valid for message m under the key k or outputs 0 if σ is invalid. We require that Σ should achieve the strong existential unforgeability against chosen message attacks. To formally define this requirement, let ${Adv}_{Σ}^{EF-CMA} (𝓐)$ be the probability that an adversary 𝓐, who mounts an adaptive chosen message attack against Σ with oracle access to ${Mac}_{k} (\cdot)$ and ${Ver}_{k} (\cdot)$ , outputs a message/tag pair (m, σ) such that: (1) ${Ver}_{k} (m, σ) = 1$ and (2) σ has not been output by the oracle ${Mac}_{k} (\cdot)$ as a MAC on the message m. The, we say that the MAC scheme Σ is secure if ${Adv}_{Σ}^{EF-CMA} (𝓐)$ is negligible for every ppt adversary 𝓐. We use ${Adv}_{Σ}^{EF-CMA} (t)$ to denote the maximum value of ${Adv}_{Σ}^{EF-CMA} (𝓐)$ over all adversaries 𝓐 running in time at most t.

Cryptographic hash functions.

Let κ be the bit-length of session keys, ℓ be as defined for Σ, and ω be the bit-length of EID_U (see the registration phase of our scheme described in the next section). Then, our scheme uses three cryptographic hash functions H:{0, 1}* → {0, 1}^κ, J:{0, 1}* → {0, 1}^ℓ, and I:{0, 1}* → {0, 1}^ω. These hash functions are modelled as random oracles in our security proofs.

Symmetric encryption schemes.

A symmetric encryption scheme Δ is a pair of efficient algorithms ( $Enc$ , $Dec$ ) where: (1) the encryption algorithm $Enc$ takes as input an ℓ-bit key k and a plaintext message m, and outputs a ciphertext c; and (2) the decryption algorithm $Dec$ takes as input a key k and a ciphertext c, and outputs a message m. For an eavesdropping adversary 𝓐 against Δ, and for an integer n ≥ 1 and a random bit b ∈ _R{0, 1}, consider the following indistinguishability experiment where only a single encryption key is used:

Experiment ${Exp}_{Δ}^{IND-SEK} (𝓐, n, b)$

k ∈_R {0, 1}^ℓ

for i = 1 to n

(m_{i, 0}, m_i,1) ← 𝓐(Δ)

$c_{i} \leftarrow {Enc}_{k} (m_{i, b})$

𝓐(c_i)

b^′ ← 𝓐, where b^′ ∈ {0, 1}

return b^′

We use ${Adv}_{Δ}^{IND-SEK} (𝓐)$ to denote the advantage of 𝓐 in violating the indistinguishability of Δ in experiment ${Exp}_{Δ}^{IND-SEK} (𝓐, n, b)$ , and define it as We say that the symmetric encryption scheme Δ is secure if ${Adv}_{Δ}^{IND-SEK} (𝓐)$ is negligible for every ppt eavesdropper 𝓐. Let ${Adv}_{Δ}^{IND-SEK} (t)$ be the maximum value of ${Adv}_{Δ}^{IND-SEK} (𝓐)$ over all 𝓐 running in time at most t.

We now claim that if a symmetric encryption scheme is secure with respect to a single encryption key, then it is also secure with respect to multiple encryption keys. Now consider the following indistinguishability experiment where d encryption keys are used:

Experiment ${Exp}_{Δ}^{IND-SEK} (𝓐, n, d, b)$

for i = 1 to d

k_i ∈_R {0, 1}^ℓ

for j = 1 to n

(m_i,j,0, m_i,j,1) ← 𝓐(Δ)

$c_{i, j} \leftarrow {Enc}_{k_{i}} (m_{i, j, b})$

c_i,j ← Enc _ki(m_i,j,b)

𝓐(c_i,j)

b^′ ← 𝓐, where b^′ ∈ {0, 1}

return b^′

We define ${Adv}_{Δ}^{IND-MEK} (𝓐)$ and ${Adv}_{Δ}^{IND-MEK} (t)$ respectively as and where the maximum is over all 𝓐 running in time at most t.

Lemma 1. For any symmetric encryption scheme Δ, where d is as defined for experiment ${Exp}_{Δ}^{IND-MEK} (𝓐, n, d, b)$ .

Proof. Assume an adversary 𝓐 who attacks the indistinguishability of Δ in ${Exp}_{Δ}^{IND-MEK} (𝓐, n, d, b)$ with time complexity t. The proof proceeds with a standard hybrid argument [32]. Consider a sequence of d + 1 hybrid experiments ${Exp}_{Δ, ξ}^{IND-MEK} (𝓐, n, d, b)$ , 0 ≤ ξ ≤ d, where each ${Exp}_{Δ, ξ}^{IND-MEK} (𝓐$ , n, d, b) is different from ${Exp}_{Δ}^{IND-MEK} (𝓐, n, d, b)$ only in that each c_i,j is set as follows: The experiments ${Exp}_{Δ, 0}^{IND-MEK} (𝓐, n, d, b)$ and ${Exp}_{Δ, d}^{IND-MEK} (𝓐, n, d, b)$ at the extremes of the sequence are identical to the experiments ${Exp}_{Δ}^{IND-MEK} (𝓐, n, d, 0)$ and ${Exp}_{Δ}^{IND-MEK} (𝓐, n, d, 1)$ , respectively. As we move from ${Exp}_{Δ, ξ - 1}^{IND-MEK} (𝓐, n, d, b)$ to ${Exp}_{Δ, ξ}^{IND-MEK} (𝓐, n, d, b)$ in the sequence, we change the n ciphertexts c_ξ,1, …, c_ξ,n from encryptions of the first plaintexts to encryptions of the second plaintexts. Since there are d such moves from ${Exp}_{Δ, 0}^{IND-MEK} (𝓐, n, d, b)$ to ${Exp}_{Δ, d}^{IND-MEK} (𝓐, n, d, b)$ , the inequality of the lemma follows immediately if we prove that the difference between the probabilities that 𝓐 outputs 1 in any two neighboring experiments ${Exp}_{Δ, ξ - 1}^{IND-MEK} (𝓐, n, d, b)$ and ${Exp}_{Δ, ξ}^{IND-MEK} (𝓐, n, d, b)$ is at most ${Adv}_{Δ}^{IND-SEK} (t)$ . That is, to complete the proof, it suffices to show that for any 1 ≤ ξ ≤ d, (1) Let $ɛ = ∣ Pr [{Exp}_{Δ, ξ - 1}^{IND-MEK} (𝓐, n, d, b) = 1] - Pr [{Exp}_{Δ, ξ}^{IND-MEK} (𝓐, n, d, b) = 1] ∣$ . Then, to prove Equation 1, we will construct, from 𝓐, an adversary 𝓐_ξ who attacks the indistinguishability of Δ in ${Exp}_{Δ}^{IND-SEK} (𝓐, n, b)$ with advantage ɛ.

𝓐_ξ begins by invoking adversary 𝓐, then proceeds to simulate the indistinguishability experiment for 𝓐, and finally ends by outputting whatever bit 𝓐 eventually outputs. In the simulated experiment, 𝓐_ξ generates the ciphertexts exactly as in the hybrid experiment ${Exp}_{Δ, ξ}^{IND-MEK} (𝓐, b, n)$ except that it generates c_ξ,1, …, c_ξ,n as follows:

When 𝓐 outputs the n plaintext pairs (m_ξ,1,0,m_ξ,1,1), …, (m_ξ,n,0,m_ξ,n,1), 𝓐_ξ outputs them as its own plaintext pairs in experiment ${Exp}_{Δ}^{IND-SEK} (𝓐_{ξ}, n, b)$ , receives in return the ciphertexts c₁, …, c_n, and sets c_ξ,1 = c₁, …, c_ξ,n = c_n.

Then, it follows that:

the probability that 𝓐_ξ outputs 1 when the given ciphertexts are the encryptions of the first plaintexts is equal to the probability that 𝓐 outputs 1 in the experiment ${Exp}_{Δ, ξ - 1}^{IND-MEK} (𝓐, n, d, b)$ , and
the probability that 𝓐_ξ outputs 1 when the given ciphertexts are the encryptions of the second plaintexts is equal to the probability that 𝓐 outputs 1 in the experiment ${Exp}_{Δ, ξ}^{IND-MEK} (𝓐, n, d, b)$ .

That is: Since 𝓐_ξ has time complexity t, it follows that ${Adv}_{Δ}^{IND-SEK} (𝓐_{ξ}) \leq {Adv}_{Δ}^{IND-SEK} (t)$ by definition. This completes the proof of Equation 1 and hence the proof of Lemma 1.

Description of the Scheme

The scheme consists of three phases: the registration phase, the authentication and key exchange phase, and the password update phase. During the system initialization, the gateway GW determines the following public parameters: (1) an elliptic curve group 𝔾 with a generator P of prime order q, (2) a MAC scheme $Σ = (Mac, Ver)$ , (3) a symmetric encryption scheme $Δ = (Enc, Dec)$ , and (4) three hash functions H, J and I. We assume that these parameters are known to all parties in the network including the adversary 𝓐. As part of the system initialization, GW chooses two master secrets $y \in ℤ_{q}^{*}$ and z ∈ {0, 1}^ℓ, computes its public key Y = yP, and shares a secret key k_GS = J(ID_SN‖z) with each sensor SN.

Registration phase.

A user U should register itself with the gateway GW before it can ever gain access to the sensor network and data. The registration proceeds as follows:

U chooses its identity ID_U and password PW_U at will, and submits the identity ID_U to GW via a secure channel.
GW computes $E I D_{U} = {Enc}_{z} (I D_{U} ‖ I D_{G W})$ and issues U a smart card loaded with {EID_U, Y, ID_GW, 𝔾, P, Σ, Δ, H, J, I}. (We assume that q is implicit in 𝔾.)
U replaces EID_U with XEID_U = EID_U⊕I(ID_U‖PW_U).

Authentication and key exchange phase.

U needs to perform this phase with SN and GW whenever it wishes to access to the sensor network and data. The steps of the phase are depicted in Fig. 1 and are described as follows:

Step 1. U inserts its smart card into a card reader and inputs its identity ID_U and password PW_U. Then, the smart card retrieves the current timestamp T_U, selects two random $x \in ℤ_{q}^{*}$ and k_US ∈ {0, 1}^κ, and computes After the computations, the smart card sends the message M₁ = ⟨T_U,ID_SN,X,C_U,σ_U⟩ to the gateway GW.
Step 2. GW rejects the message M₁ (and aborts the session) if T_U is not fresh. Otherwise, GW computes K_UG = yX and k_UG = J(T_U‖X‖Y‖K_UG), and checks if ${Ver}_{k_{U G}} (I D_{G W} ‖ I D_{S N} ‖$ T_U‖C_U,σ_U) = 1. If the check fails, GW aborts the session. Otherwise, GW decrypts C_U with key k_UG and then EID_U with key z, and checks if the decryption of EID_U yields the same ID_U as produced through the decryption of C_U. If only the two IDs match, GW retrieves the current timestamp T_GW, computes and sends the message M₂ = ⟨ID_GW,T_GW,T_U,C_GW,σ_GW⟩ to the sensor SN.
Step 3. Upon receiving M₂, SN verifies that (1) T_GW is fresh and (2) ${Ver}_{k_{G S}} (I D_{G W} ‖ I D_{S N} ‖ T_{G W} ‖$ T_U‖C_GW,σ_GW) = 1. If any of the verifications fails, SN aborts the session. Otherwise, SN decrypts C_GW to obtain k_US and computes the session key sk and the authenticator ρ_SN as follows: Then, SN sends the message M₃ = ⟨ρ_SN⟩ to the user U.
Step 4. With M₃ in hand, U checks if ρ_SN is equal to H(k_US‖ID_SN‖T_U). U aborts the session if the check fails or otherwise computes the session key sk = H(k_US‖T_U‖ID_SN).

Download:

Fig 1. Our proposed authentication and key exchange protocol for wireless sensor networks.

https://doi.org/10.1371/journal.pone.0116709.g001

Password update phase.

One of the recommended guidelines for achieving better password security is to enforce regular password updates. In our scheme, users can change their passwords either non-interactively or interactively. The non-interactive password change procedure proceeds as follows:

U inserts his smart card into a card reader and enters the identity ID_U, the current password PW_U, and the new password $P W_{U}^{'}$ .
The smart card computes $X E I D_{U}^{'} = X E I D_{U} \oplus I (I D_{U} ‖ P W_{U}) \oplus I (I D_{U} ‖ P W_{U}^{'})$ and replaces XEID_U with $X E I D_{U}^{'}$ .

Although this procedure is simple and non-interactive, it may render the smart card unusable if the user enters a wrong password by mistake or an adversary intentionally inputs an arbitrary password after gaining temporary access to the smart card. When an invalid password is entered, subsequent login requests of the user will be rejected unless it reregisters with the gateway. This problem can be addressed by storing a password verifier on the smart card, which is used to check the correctness of the user-given password. However, as soon as the smart card contains a password verifier, the scheme becomes vulnerable to an offline dictionary attack under the non-tamper-resistance assumption of smart cards and, consequently, fails to achieve two-factor security. This is clearly unacceptable and, therefore, we suggest the following interactive password change procedure.

U inserts his smart card into a card reader and enters the identity ID_U, the current password PW_U, and the new password $P W_{U}^{'}$ .
The smart card retrieves the current timestamp T_U, selects a random $x \in ℤ_{q}^{*}$ , and computes The smart card sends a password update request ⟨T_U,X,C_U⟩ to the gateway GW.
GW rejects the request if T_U is not fresh. Otherwise, GW computes K_UG = yX and k_UG = J(T_U‖X‖Y‖K_UG), decrypts C_U with key k_UG and then EID_U with key z, and checks whether the two decryptions return the same ID_U. If the check succeeds, GW computes ρ_GW = H(ID_GW‖ID_U‖X‖k_UG) and sends it to the smart card. Otherwise, GW sends a failure message to the smart card.
The smart card aborts the password change procedure if it receives a failure message or ρ_GW is not equal to H(ID_GW‖ID_U‖X‖k_UG). Otherwise, it sets $X E I D_{U} = E I D_{U} \oplus I (I D_{U} ‖ P W_{U}^{'})$ .

This interactive password change procedure provides a secure yet practical way of updating user password, though it is more expensive than the non-interactive one.

Performance and Security Comparison

In Table 1, we provide a comparative summary between our scheme and other sca-wsn schemes both in terms of computation and security. As shown in the table, our scheme requires the sensor SN to perform only lightweight cryptographic operations while enjoying provable anonymity in an extension of the widely accepted model of Bellare et al. [30]. While the recent schemes of Shi & Gong [12] and Choi et al. [20] provide forward secrecy, they impose 2 scalar-point multiplications on the resource-constrained sensor SN. Note that scalar-point multiplication is much more expensive than the lightweight cryptographic operations considered in the table, such as symmetric encryption/decryption, MAC generation/verification, and hash function evaluation. Moreover, these two schemes fail to achieve user anonymity despite their use of elliptic curve cryptography. The schemes presented in [10, 11, 13–19] are computationally efficient, but suffer from the inherent failure of user anonymity. To the best of our knowledge, all existing sca-wsn schemes fall into one of the two classes.

Download:

Table 1. A comparative summary of smart-card-based user authentication schemes for wireless sensor networks.

https://doi.org/10.1371/journal.pone.0116709.t001

According to Crypto++ 5.6.0 benchmarks that ran on an Intel Core 2 1.83 GHz processor under Windows Vista in 32-bit mode, SHA-1 and HMAC take 11.4 and 11.9 cycles per byte respectively; while AES (with 128-bit key) takes 12.6 to 16.9 cycles per byte, depending on the operation mode used—see Table 2 and we refer interested readers to http://www.cryptopp.com/benchmarks.html for Crypto++ benchmarks for commonly used cryptographic algorithms.

Download:

Table 2. Crypto++ 5.6.0 benchmarks for SHA-1, HMAC and AES.

https://doi.org/10.1371/journal.pone.0116709.t002

Our scheme requires the sensor SN to perform 1E+1A+2H operations which amount to about 4.5H operations. Therefore, in terms of computational requirements for SN, our scheme is comparable with other sca-wsn schemes [11, 13–16, 18, 19] using only lightweight cryptographic techniques. Although the schemes of Vaidya et al. [10] and Kim et al. [17] require SN to perform only 2 hash function evaluations, these schemes do not achieve user anonymity and are vulnerable to a stolen smart card attack. Under the non-tamper-resistance assumption of smart cards, our scheme is the only one that provides user anonymity and resists stolen smart card attacks.

Security Proofs

We now prove that the authentication and key exchange protocol of our scheme is AKE-secure (in the sense of Definition 2) and provides user anonymity (in the sense of Definition 4). Recall that the security model described in Section 2 captures various sca-wsn specific attacks (such as stolen smart card attacks, node capture attacks, privileged insider attacks, and stolen verifier attacks) as well as other common attacks (like impersonation attacks, man-in-the-middle attacks, replay attacks, and known key attacks) [21, 23, 25, 34]. Before providing formal security proofs in the model, we briefly discuss the security of our scheme against sca-wsn specific attacks.

Stolen smart card attacks. Our scheme does not require a password verifier to be stored on the smart card of user U. Moreover, even if an adversary managed to obtain the ciphertext $C_{U} = {Enc}_{k_{U G}} (I D_{U} ‖ E I D_{U} ‖ k_{U S})$ , the adversary would be unable to exploit C_U as a password verifier since, under the ECCDH assumption, it is infeasible to compute k_UG = J(T_U‖X‖Y‖K_UG) from X and Y. Thus, our scheme is resistant against stolen smart card attacks.
Node capture attacks. In our scheme, each sensor node SN holds its individual secret key k_GS = J(ID_SN‖z) which is shared only with the gateway GW. In other words, different sensor nodes have different secret keys (with an overwhelming probability). Thus, the secret key k_GS obtained by capturing a sensor node SN will be of no use in impersonating another sensor node SN^′ who holds a secret key other than k_GS. Therefore, node capture attacks are not possible against our scheme.
Privileged insider attacks. A privileged insider attack occurs when the gateway administrator can access a user’s password to impersonate the user. In our scheme, the gateway GW receives no password-related information from the user U and does not manage any table for storing such information. It is thus clear that privileged insider attacks cannot be mounted against our scheme.
Stolen verifier attacks. In a stolen verifier attack, the adversary attempts to impersonate a legitimate user by stealing the user’s password verifier stored on the gateway GW. However, in our scheme, GW does not store a password verifier of any kind but stores only two master secrets y and z which are selected independently of user passwords. Hence, our scheme is secure against stolen verifier attacks.

User Anonymity

Theorem 1. Our authentication and key exchange protocol, P, provides user anonymity in the random oracle model under the ECCDH assumption in 𝔾 and the security of the symmetric encryption scheme Δ.

Proof. Let 𝓐 be a ppt adversary against the user anonymity property of protocol P. We prove the theorem by making a series of modifications to the original experiment ExpUA₀, bounding the difference in the success probability of 𝓐 between two consecutive experiments, and ending up with an experiment where 𝓐 has a success probability of 1/2 (i.e., 𝓐 has no advantage). Let ${SuccUA}_{i}$ denote the event that 𝓐 correctly guesses the hidden bit b chosen by the $TestUA$ oracle in experiment ExpUA_i. Let $t_{U A}^{i}$ be the maximum time required to perform the experiment ExpUA_i involving the adversary 𝓐.

Experiment ExpUA₁. In this experiment, we simulate the random oracle J as follows:

Simulation of the J oracle: For each J query on a string str, the simulator first checks if an entry of the form (str,j) is in a list called JList which contains all the input-output pairs of J. If such an entry exists in JList, the simulator returns j as the output of the J query. Otherwise, the simulator chooses a random ℓ-bit string j^′, returns j^′ in response to the query, and adds the entry (str,j^′) to JList.

For all other oracle queries of 𝓐, the simulator answers them as in the original experiment ExpUA₀. Then, ExpUA₁ is perfectly indistinguishable from ExpUA₀ and therefore, Claim 1 holds.

Claim 1. ${Pr}_{P, 𝓐} [{SuccUA}_{1}] = {Pr}_{P, 𝓐} [{SuccUA}_{0}]$ .

Experiment ExpUA₂. Here, we modify the experiment so that X is computed as follows:

The ExpUA₂ modification:

The simulator chooses a random exponent $a \in ℤ_{q}^{*}$ and computes A = aP.
For each user instance, the simulator chooses a random $r \in ℤ_{q}^{*}$ and sets X = rA.

As a result of the modification, each K_UG is set to rayP for some random $r \in ℤ_{q}^{*}$ . Since the view of 𝓐 is identical between ExpUA₂ and ExpUA₁, it follows that:

Claim 2. ${Pr}_{P, 𝓐} [{SuccUA}_{2}] = {Pr}_{P, 𝓐} [{SuccUA}_{1}]$ .

Experiment ExpUA₃. We next modify the computations of X and Y as follows:

The ExpUA₃ modification:

The simulator chooses two random elements A, B ∈ 𝔾 and sets Y = B.
For each instance of clean users, the simulator chooses a random $r \in ℤ_{q}^{*}$ and sets X = rA. For other instances, the simulator computes X as in experiment ExpUA₂.
For each instance of clean users, the simulator sets each k_UG to a random ℓ-bit string. For other instances, the simulator computes k_UG as in experiment ExpUA₂.

Since k_UG is set to a random ℓ-bit string (for instances of clean users), the success probability of 𝓐 may be different between ExpUA₃ and ExpUA₂ if it makes an J(T_U‖X‖Y‖K_UG) query. However, this difference is bounded by Claim 3.

Claim 3. $∣ {Pr}_{P, 𝓐} [{SuccUA}_{3}] - {Pr}_{P, 𝓐} [{SuccUA}_{2}] ∣ \leq 1 / q_{J} \cdot {Adv}_{𝔾}^{ECCDH} (t_{U A}^{3})$ , where q_J is the number of queries made to the J oracle.

Proof. We prove the claim via a reduction from the ECCDH problem which is believed to be hard. Assume that the success probability of 𝓐 is non-negligibly different between ExpUA₃ and ExpUA₂. Then we construct an algorithm 𝓐_ECCDH that solves the ECCDH problem in 𝔾 with a non-negligible advantage. The objective of 𝓐_ECCDH is to compute and output the value W = uvP ∈ 𝔾 when given an ECCDH-problem instance (U = uP, V = vP) ∈ 𝔾². 𝓐_ECCDH runs 𝓐 as a subroutine while simulating all the oracles on its own.

𝓐_ECCDH handles all the oracle queries of 𝓐 as specified in experiment ExpUA₃ but using U and V in place of X and Y. When 𝓐 outputs its guess b^′, 𝓐_ECCDH chooses an entry of the form (T_U‖X‖Y‖K,j) at random from JList and terminates outputting K/r. From the simulation, it is clear that 𝓐_ECCDH outputs the desired result W = uvP with probability at least 1/q_J if 𝓐 makes a J(T_U‖X‖Y‖K_UG) query for some instance of a clean user U ∈ 𝓤. This completes the proof of Claim 3.

Experiment ExpUA₄. We finally modify the experiment so that, for each clean user U ∈ 𝓤, a random identity $I D_{U}^{'}$ drawn from the identity space is used in place of the true identity ID_U in generating C_U.

Claim 4. $∣ {Pr}_{P, 𝓐} [{SuccUA}_{4}] - {Pr}_{P, 𝓐} [{SuccUA}_{3}] ∣ \leq {Adv}_{Δ}^{IND-MEK} (t_{U A}^{4})$ .

Proof. We prove the claim by constructing an eavesdropping adversary 𝓐_IND-MEK who attacks the indistinguishability of Δ in ${Exp}_{Δ}^{IND-MEK} (𝓐, n, d, b)$ with advantage equal to $∣ {Pr}_{P, 𝓐} [{SuccUA}_{4}] - {Pr}_{P, 𝓐} [{SuccUA}_{3}] ∣$ (see Section 1 for details of experiment ${Exp}_{Δ}^{IND-MEK} (𝓐, n, d, b)$ ).

𝓐_IND-MEK begins by choosing a random bit b ∈ {0, 1}. Then, 𝓐_IND-MEK invokes the adversary 𝓐 and answers all the oracle queries of 𝓐 as in experiment ExpUA₃ except that, for each clean user U ∈ 𝓤, it generates C_U by accessing its own encryption oracle as follows:

𝓐_IND-MEK outputs $(I D_{U} ‖ E I D_{U} ‖ k_{U S}, I D_{U}^{'} ‖ E I D_{U} ‖ k_{U S})$ as the first plaintext-pair in the indistinguishability experiment ${Exp}_{Δ}^{IND-MEK}$ . Let c₁ be the ciphertext received in return for the first pair. 𝓐_IND-MEK sets C_U equal to the ciphertext c₁.

That is, 𝓐_IND-MEK sets C_U to the encryption of either ID_U‖EID_U‖k_US or $I D_{U}^{'} ‖ E I D_{U} ‖ k_{U S}$ . Now when 𝓐 terminates and outputs its guess b^′, 𝓐_IND-MEK outputs 1 if b = b^′, and 0 otherwise. Then, it is clear that:

the probability that 𝓐_IND-MEK outputs 1 when the first plaintexts are encrypted in the experiment ${Exp}_{Δ}^{IND-MEK}$ is equal to the probability that 𝓐 succeeds in the experiment ExpUA₃, and
the probability that 𝓐_IND-MEK outputs 1 when the second plaintexts are encrypted in the experiment ${Exp}_{Δ}^{IND-MEK}$ is equal to the probability that 𝓐 succeeds in the experiment ExpUA₄.

That is,

{Adv}_{Δ}^{IND-MEK} (𝓐_{IND-MEK}) = ∣ {Pr}_{P, 𝓐} [{SuccUA}_{4}] - {Pr}_{P, 𝓐} [{SuccUA}_{3}] ∣

. Note that in the simulation, 𝓐_IND-MEK eavesdrops at most q_send encryptions which is polynomial in the security parameter ℓ. This completes the proof of Claim 4.

In the experiment ExpUA₄, the adversary 𝓐 gains no information on the hidden bit b chosen by the $TestUA$ oracle because the identities of all clean users are chosen uniformly at random from the identity space. It, therefore, follows that ${Pr}_{P, 𝓐} [{SuccUA}_{4}] = 1 / 2$ . This result combined with Claims 1–4 yields the statement of Theorem 1.

AKE Security

Theorem 2. As long as the MAC scheme Σ and the symmetric encryption scheme Δ are both secure, our authentication and key exchange protocol P is secure in the random oracle model under the ECCDH assumption in 𝔾.

Proof. Fix a ppt adversary 𝓐 against the security of the protocol P. To prove the theorem, we make a series of modifications to the original experiment ExpAKE₀, bounding the effect of each change in the experiment on the success probability of 𝓐 and ending up with an experiment where 𝓐 has a success probability of 1/2. We use ${SuccAKE}_{i}$ to denote the event that 𝓐 correctly guesses the hidden bit b chosen by the $Test$ oracle in experiment ExpAKE_i. Let $t_{A K E}^{i}$ be the maximum time required to perform the experiment ExpAKE_i involving the adversary 𝓐.

Experiment ExpAKE₁. This experiment is different from ExpAKE₀ in that the random oracle J is simulated as follows:

Simulation of the J oracle: For each J query on a string str, the simulator first checks if an entry of the form (str,j) is in a list called JList which contains all the input-output pairs of J. If such an entry exists in JList, the simulator returns j as the output of the J query. Otherwise, the simulator chooses a random ℓ-bit string j^′, returns j^′ in response to the query, and adds the entry (str,j^′) to JList.

The other oracle queries of 𝓐 are answered as in the original experiment ExpAKE₀. Then, since J is a random oracle, ExpAKE₁ is perfectly indistinguishable from ExpAKE₀, and Claim 5 immediately follows.

Claim 5. ${Pr}_{P, 𝓐} [{SuccAKE}_{1}] = {Pr}_{P, 𝓐} [{SuccAKE}_{0}]$ .

Experiment ExpAKE₂. Here, we modify the experiment so that X is computed as follows:

The ExpAKE₂ modification:

The simulator chooses a random exponent $a \in ℤ_{q}^{*}$ and computes A = aP.
For each instance of users, the simulator chooses a random $r \in ℤ_{q}^{*}$ and sets X = rA.

As a result, each K_UG is set to rayP for some random $r \in ℤ_{q}^{*}$ . Since the view of 𝓐 is identical between ExpAKE₂ and ExpAKE₁, it follows that:

Claim 6. ${Pr}_{P, 𝓐} [{SuccAKE}_{2}] = {Pr}_{P, 𝓐} [{SuccAKE}_{1}]$ .

Experiment ExpAKE₃. We further modify the experiment as follows:

The ExpAKE₃ modification:

The simulator chooses two random elements A,B ∈ 𝔾 and sets Y = B.
For each fresh instance, the simulator chooses a random $r \in ℤ_{q}^{*}$ and sets X = rA. For other instances, the simulator computes X as in experiment ExpAKE₂.
For each fresh instance, the simulator sets each k_UG to a random ℓ-bit string. For other instances, the simulator computes k_UG as in experiment ExpAKE₂.

Since k_UG is set to a random ℓ-bit string (for fresh instances), the success probability of 𝓐 may be different between ExpAKE₂ and ExpAKE₃ if it makes an J(T_U‖X‖Y‖K_UG) query. This difference is bounded by Claim 7.

Claim 7 $∣ {Pr}_{P, 𝓐} [{SuccAKE}_{3}] - {Pr}_{P, 𝓐} [{SuccAKE}_{2}] ∣ \leq 1 / q_{J} \cdot {Adv}_{𝔾}^{ECCDH} (t_{A K E}^{3})$ , where q_J is the number of queries made to the J oracle.

Proof. We prove the claim via a reduction from the ECCDH problem which is believed to be hard. Assume that the success probability of 𝓐 is non-negligibly different between ExpAKE₂ and ExpAKE₃. Then we construct an algorithm 𝓐_ECCDH that solves the ECCDH problem in 𝔾 with a non-negligible advantage. The objective of 𝓐_ECCDH is to compute and output the value W = uvP ∈ 𝔾 when given an ECCDH-problem instance (U = uP,V = vP) ∈ 𝔾². 𝓐_ECCDH runs 𝓐 as a subroutine while simulating all the oracles on its own.

𝓐_ECCDH handles all the oracle queries of 𝓐 as specified in experiment ExpAKE₃ but using U and V in place of X and Y. When 𝓐 outputs its guess b^′, 𝓐_ECCDH chooses an entry of the form (T_U‖X‖Y‖K,j) at random from JList and terminates outputting K/r. From the simulation, it is clear that 𝓐_ECCDH outputs the desired result W = uvP with probability at least 1/q_J if 𝓐 makes a J(T_U‖X‖Y‖K_UG) query for some fresh instance of any U ∈ 𝓤. This completes the proof of Claim 7.

Experiment ExpAKE₄. This experiment is different from ExpAKE₃ in that it is aborted if the following event $Forge$ occurs.

$Forge$ : The event that the adversary 𝓐 makes a $Send$ query that contains a MAC forgery.

Then we claim that:

Claim 8 $∣ {Pr}_{P, 𝓐} [{SuccAKE}_{4}] - {Pr}_{P, 𝓐} [{SuccAKE}_{3}] ∣ \leq q_{send} \cdot {Adv}_{Σ}^{EF-CMA} (t_{A K E}^{4})$ , where q_send is the number of queries made to the $Send$ oracle.

Proof. Assume that the event $Forge$ occurs with a non-negligible probability. Then, we construct an algorithm $𝓐_{EF}$ who generates, with a non-negligible probability, a forgery against the MAC scheme Σ. The algorithm $𝓐_{EF}$ is is given access to the ${Mac}_{k} (\cdot)$ and ${Ver}_{k} (\cdot)$ oracles. The goal of $𝓐_{EF}$ is to produce a message/MAC pair (m,σ) such that: (1) ${Ver}_{k} (m, σ) = 1$ and (2) σ has not been output by the oracle ${Mac}_{k} (\cdot)$ on input m.

Let n be the total number of MAC keys used in the sessions initiated via a $Send$ query. $𝓐_{EF}$ begins by choosing a random i ∈ {1, …, n}. Let k_i denote the i^th key among all the n MAC keys, and ${Send}_{i}$ be any $Send$ query that is expected to be answered and/or verified using k_i. $𝓐_{EF}$ runs 𝓐 as a subroutine and answers the oracle queries of 𝓐 as in experiment ExpAKE₃ except that: it answers all ${Send}_{i}$ queries by accessing its ${Mac}_{k} (\cdot)$ and ${Ver}_{k} (\cdot)$ oracles. As a result, the i^th MAC key k_i is not used during the simulation. If $Forge$ occurs against an instance who holds $𝓐_{EF}$ halts and outputs the message/MAC pair generated by 𝓐 as its forgery. Otherwise, $𝓐_{EF}$ terminates with a failure indication.

If the guess i is correct, then the simulation is perfect and $𝓐_{EF}$ achieves its goal. Namely, ${Adv}_{Σ}^{EF-CMA} (𝓐_{EF}) = Pr [Forge] / n$ . Since n ≤ q_send and $𝓐_{EF}$ runs in time at most $t_{A K E}^{4}$ , we get

This completes the proof of Claim 8.

Experiment ExpAKE₅. We next modify the way of answering queries to the H oracle as follows: Simulation of the H oracle: For each H query on a string str, the simulator first checks if an entry of the form (str,h) is in a list called HList which is maintained to store input-output pairs of H. If it is, h is the answer to the hash query. Otherwise, the simulator chooses a random κ-bit string h^′, answers the query with h^′, and adds the entry (str,h^′) to HList.

The other oracle queries of 𝓐 are handled as in experiment ExpAKE₄. Since ExpAKE₅ is perfectly indistinguishable from ExpAKE₄, it is clear that:

Claim 9. ${Pr}_{P, 𝓐} [{SuccAKE}_{5}] = {Pr}_{P, 𝓐} [{SuccAKE}_{4}]$

Experiment ExpAKE₆. We finally modify the experiment so that the session key sk is set to a random κ-bit string for each fresh instance and its partner. Accordingly, the success probability of 𝓐 may be different between ExpAKE₆ and ExpAKE₅ if it asks an H query of the form H(k_US‖T_U‖ID_SN) for some uncorrupted U ∈ 𝓤 and SN ∈ 𝒮𝓝. But the difference is bounded by:

Claim 10 $∣ {Pr}_{P, 𝓐} [{SuccAKE}_{6}] - {Pr}_{P, 𝓐} [{SuccAKE}_{5}] ∣ \leq \frac{1}{q_{H}} \cdot {Adv}_{Δ}^{IND-MEK} (t_{A K E}^{6})$ , where q_H is the number of queries made to the H oracle.

Proof. We prove the claim by constructing an eavesdropper 𝓐_IND-MEK who attacks the indistinguishability of Δ in experiment ${Exp}_{Δ}^{IND-MEK} (𝓐, n, d, b)$ . 𝓐_IND-MEK invokes the adversary 𝓐 and answers all the oracle queries of 𝓐 as in experiment ExpAKE₅ except that it generates each C_GW to be sent to a fresh sensor instance by accessing its own encryption oracle as follows:

Let $k_{U S}^{'} \neq k_{U S}$ be a random string chosen from {0, 1}^κ. 𝓐_IND-MEK outputs $(k_{U S}, k_{U S}^{'})$ as a plaintext pair in the indistinguishability experiment ${Exp}_{Δ}^{IND-MEK}$ . Let c be the ciphertext received in return for the plaintext pair. 𝓐_IND-MEK sets C_GW equal to the ciphertext c.

That is, each C_GW is set to the encryption of either k_US or $k_{U S}^{'}$ . Now when 𝓐 terminates and outputs its guess b^′, 𝓐_IND-MEK selects an entry of the form (k_US‖T_U‖ID_SN,h) at random from HList and outputs 0 if k = k_US, and 1 otherwise. If 𝓐 asks an H query of the form H(k_US‖T_U‖ID_SN) for some uncorrupted U ∈ 𝓤 and SN ∈ 𝒮𝓝, 𝓐_IND-MEK correctly guesses the bit b in its indistinguishability experiment with probability at least $\frac{1}{q_{H}}$ and therefore, Claim 10 follows.

In experiment ExpAKE₆, the adversary 𝓐 obtains no information on the hidden bit b chosen by the $TestUA$ oracle since the session keys of all fresh instances are selected uniformly at random from {0, 1}^κ. Therefore, it follows that ${Pr}_{P, 𝓐} [{SuccUA}_{4}] = 1 / 2$ . This result combined with Claims 5–10 completes the proof of Theorem 2.

Concluding Remarks

With the continuing advancements in sensor technologies, WSNs will play an increasingly important role in commercial, government and military settings. A number of recent high profiles such as the revelations by Edward Snowden that the US National Security Agency has been conducting massive online surveillance of both US and non-US citizens highlighted the potential of ensuring user privacy and anonymity. In WSNs, for example, designing a secure and efficient user authentication scheme without compromising user anonymity remains an area of active research.

In this work, we have presented a sca-wsn scheme, a smart-card-based user authentication scheme for wireless sensor networks, which achieves user anonymity without imposing (expensive) public key operations on sensors. Our result in this paper does not contradict the result of Wang and Wang [28, 29] but rather supports and clarifies it: in order for a sca-wsn scheme to achieve user anonymity, the use of public key cryptography is inevitable but, if forward secrecy is not desired, can be avoided at least on the sensor side. Extending our result to the case of three-factor authentication [34] would be an interesting future work.

Acknowledgments

All authors, especially the corresponding author Sangchul Han, would like to thank the anonymous reviewers for their time and invaluable comments and suggestions on this paper.

Author Contributions

Conceived and designed the experiments: JN KKRC JP DW. Performed the experiments: SH JP MK. Analyzed the data: SH JP DW. Contributed reagents/materials/analysis tools: JP DW. Wrote the paper: JN KKRC SH MK JP DW. Designed the scheme: JN KKRC DW. Proved the security of the scheme: JN KKRC.

References

1. Rawat P, Singh K, Chaouchi H, Bonnin J (2014) Wireless sensor networks: a survey on recent developments and potential synergies. The Journal of Supercomputing 68: 1–48.
- View Article
- Google Scholar
2. Das M (2009) Two-factor user authentication in wireless sensor networks. IEEE Transactions on Wirelelss Communications 8: 1086–1090.
- View Article
- Google Scholar
3. He D, Gao Y, Chan S, Chen C, Bu J (2010) An enhanced two-factor user authentication scheme in wireless sensor networks. Ad Hoc & Sensor Wireless Networks 10: 361–371.
- View Article
- Google Scholar
4. Khan M, Alghathbar K (2010) Cryptanalysis and security improvements of “two-factor user authentication in wireless sensor networks”. Sensors 10: 2450–2459. pmid:22294935
- View Article
- PubMed/NCBI
- Google Scholar
5. Chen T, Shih W (2010) A robust mutual authentication protocol for wireless sensor networks. ETRI Journal 32: 704–712.
- View Article
- Google Scholar
6. Yeh H, Chen T, Liu P, Kim T, Wei H (2011) A secured authentication protocol for wireless sensor networks using elliptic curves cryptography. Sensors 11: 4767–4779. pmid:22163874
- View Article
- PubMed/NCBI
- Google Scholar
7. Kumar P, Choudhury A, Sain M, Lee S, Lee H (2011) RUASN: a robust user authentication framework for wireless sensor networks. Sensors 11: 5020–5046. pmid:22163888
- View Article
- PubMed/NCBI
- Google Scholar
8. Kumar P, Lee S, Lee H (2012) E-SAP: efficient-strong authentication protocol for healthcare applications using wireless medical sensor networks. Sensors 12: 1625–1647. pmid:22438729
- View Article
- PubMed/NCBI
- Google Scholar
9. Yoo S, Park K, Kim J (2012) A security-performance-balanced user authentication scheme for wireless sensor networks. International Journal of Distributed Sensor Networks 2012: Article ID 382810.
10. Vaidya B, Makrakis D, Mouftah H (2012) Two-factor mutual authentication with key agreement in wireless sensor networks. Security and Communication Networks.
11. Xue K, Ma C, Hong P, Ding R (2013) A temporal-credential-based mutual authentication and key agreement scheme for wireless sensor networks. Journal of Network and Computer Applications 36: 316–323.
- View Article
- Google Scholar
12. Shi W, Gong P (2013) A new user authentication protocol for wireless sensor networks using elliptic curves cryptography. Internation Journal of Distributed Sensor Networks 2013: Article ID 730831.
13. Li C, Weng C, Lee C (2013) An advanced temporal credential-based security scheme with mutual authentication and key agreement for wireless sensor networks. Sensors 13: 9589–9603. pmid:23887085
- View Article
- PubMed/NCBI
- Google Scholar
14. Kumar P, Gurtov A, Ylianttila M, Lee S, Lee H (2013) A strong authentication scheme with user privacy for wireless sensor networks. ETRI Journal 35: 889–899.
- View Article
- Google Scholar
15. He D, Kumar N, Chen J, Lee C, Chilamkurti N, Yeo S (2013) Robust anonymous authentication protocol for health-care applications using wireless medical sensor networks. Multimedia Systems.
16. Chi L, Hu L, Li H, Chu J (2014) Analysis and improvement of a robust user authentication framework for ubiquitous sensor networks. International Journal of Distributed Sensor Networks 2014: Article ID 637684.
17. Kim J, Lee D, Jeon W, Lee Y, Won D (2014) Security analysis and improvements of two-factor mutual authentication with key agreement in wireless sensor networks. Sensors 14: 6443–6462. pmid:24721764
- View Article
- PubMed/NCBI
- Google Scholar
18. Khan M, Kumari S (2014) An improved user authentication protocol for healthcare services via wireless medical sensor networks. Internation Journal of Distributed Sensor Networks 2014: Article ID 347169.
19. Jiang Q, Ma J, Lu X, Tian Y (2014) An efficient two-factor user authentication scheme with unlinkability for wireless sensor networks. Peer-to-Peer Networking and Applications.
20. Choi Y, Lee D, Kim J, Jung J, Nam J, Won D (2014) Security enhanced user authentication protocol for wireless sensor networks using elliptic curves cryptography. Sensors 14: 10081–10106. pmid:24919012
- View Article
- PubMed/NCBI
- Google Scholar
21. Khan M, He D (2012) A new dynamic identity-based authentication protocol for multi-server environment using elliptic curve cryptography. Security and Communication Networks 5: 1260– 1266.
- View Article
- Google Scholar
22. Khan M, Kumari S, Singh P (2013) Cryptanalysis of an ‘efficient-strong authentiction protocol (E-SAP) for healthcare applications using wireless medical sensor networks’. KSII Transactions on Internet & Information Systems 7: 967–979.
- View Article
- Google Scholar
23. He D, Kumar N, Khan M, Lee J (2013) Anonymous two-factor authentication for consumer roaming service in global mobility networks. IEEE Transactions on Consumer Electronics 59: 811–817.
- View Article
- Google Scholar
24. Xie Q, Hu B, Tan X, Bao M, Yu X (2014) Robust anonymous two-factor authentication scheme for roaming service in global mobility network. Wireless Personal Communications 74: 601–614.
- View Article
- Google Scholar
25. He D, Zhang Y, Chen J (2014) Cryptanalysis and improvement of an anonymous authentication protocol for wireless access networks. Wireless Personal Communications 74: 229–243.
- View Article
- Google Scholar
26. Kocher P, Jaffe J, Jun B (1999) Differential power analysis. Proceedings of CRYPTO 1999, Santa Barbara, California, USA, pp. 388–397.
27. Messerges T, Dabbish E, Sloan R (2002) Examining smart-card security under the threat of power analysis attacks. IEEE Transactions on Computers 51: 541–552.
- View Article
- Google Scholar
28. Wang D, Wang P (2014) Understanding security failures of two-factor authentication schemes for real-time applications in hierarchical wireless sensor networks. Ad Hoc Networks 20: 1–15.
- View Article
- Google Scholar
29. Wang D, Wang P (2014) On the anonymity of two-factor authentication schemes for wireless sensor networks: Attacks, principle and solutions. Computer Networks 73: 41–57.
- View Article
- Google Scholar
30. Bellare M, Pointcheval D, Rogaway P (2000) Authenticated key exchange secure against dictionary attacks. Proceedings of EUROCRYPT 2000, Bruges, Belgium, pp. 139–155.
31. NIST (1999) Recommended elliptic curves for federal government use. Avaliable: http://csrc.nist.gov/groups/ST/toolkit/documents/dss/NISTReCur.pdf.
32. Goldwasser S, Micali S (1984) Probabilistic encryption. Journal of Computer and System Sciences 28: 270–299.
- View Article
- Google Scholar
33. Han W (2011) Weakness of a secured authentication protocol for wireless sensor networks using elliptic curves cryptography. IACR Cryptology ePrint Archive. Available: http://eprint.iacr.org/2011/293.
34. He D, Kumar N, Lee J, Sherratt R (2014) Enhanced three-factor security protocol for USB mass storage devices. IEEE Transactions on Consumer Electronics 60: 30–37.
- View Article
- Google Scholar

[ref1] 1. Rawat P, Singh K, Chaouchi H, Bonnin J (2014) Wireless sensor networks: a survey on recent developments and potential synergies. The Journal of Supercomputing 68: 1–48.
View Article
Google Scholar

[2] View Article

[3] Google Scholar

[ref2] 2. Das M (2009) Two-factor user authentication in wireless sensor networks. IEEE Transactions on Wirelelss Communications 8: 1086–1090.
View Article
Google Scholar

[5] View Article

[6] Google Scholar

[ref3] 3. He D, Gao Y, Chan S, Chen C, Bu J (2010) An enhanced two-factor user authentication scheme in wireless sensor networks. Ad Hoc & Sensor Wireless Networks 10: 361–371.
View Article
Google Scholar

[8] View Article

[9] Google Scholar

[ref4] 4. Khan M, Alghathbar K (2010) Cryptanalysis and security improvements of “two-factor user authentication in wireless sensor networks”. Sensors 10: 2450–2459. pmid:22294935
View Article
PubMed/NCBI
Google Scholar

[11] View Article

[12] PubMed/NCBI

[13] Google Scholar

[ref5] 5. Chen T, Shih W (2010) A robust mutual authentication protocol for wireless sensor networks. ETRI Journal 32: 704–712.
View Article
Google Scholar

[15] View Article

[16] Google Scholar

[ref6] 6. Yeh H, Chen T, Liu P, Kim T, Wei H (2011) A secured authentication protocol for wireless sensor networks using elliptic curves cryptography. Sensors 11: 4767–4779. pmid:22163874
View Article
PubMed/NCBI
Google Scholar

[18] View Article

[19] PubMed/NCBI

[20] Google Scholar

[ref7] 7. Kumar P, Choudhury A, Sain M, Lee S, Lee H (2011) RUASN: a robust user authentication framework for wireless sensor networks. Sensors 11: 5020–5046. pmid:22163888
View Article
PubMed/NCBI
Google Scholar

[22] View Article

[23] PubMed/NCBI

[24] Google Scholar

[ref8] 8. Kumar P, Lee S, Lee H (2012) E-SAP: efficient-strong authentication protocol for healthcare applications using wireless medical sensor networks. Sensors 12: 1625–1647. pmid:22438729
View Article
PubMed/NCBI
Google Scholar

[26] View Article

[27] PubMed/NCBI

[28] Google Scholar

[ref9] 9. Yoo S, Park K, Kim J (2012) A security-performance-balanced user authentication scheme for wireless sensor networks. International Journal of Distributed Sensor Networks 2012: Article ID 382810.

[ref10] 10. Vaidya B, Makrakis D, Mouftah H (2012) Two-factor mutual authentication with key agreement in wireless sensor networks. Security and Communication Networks.

[ref11] 11. Xue K, Ma C, Hong P, Ding R (2013) A temporal-credential-based mutual authentication and key agreement scheme for wireless sensor networks. Journal of Network and Computer Applications 36: 316–323.
View Article
Google Scholar

[32] View Article

[33] Google Scholar

[ref12] 12. Shi W, Gong P (2013) A new user authentication protocol for wireless sensor networks using elliptic curves cryptography. Internation Journal of Distributed Sensor Networks 2013: Article ID 730831.

[ref13] 13. Li C, Weng C, Lee C (2013) An advanced temporal credential-based security scheme with mutual authentication and key agreement for wireless sensor networks. Sensors 13: 9589–9603. pmid:23887085
View Article
PubMed/NCBI
Google Scholar

[36] View Article

[37] PubMed/NCBI

[38] Google Scholar

[ref14] 14. Kumar P, Gurtov A, Ylianttila M, Lee S, Lee H (2013) A strong authentication scheme with user privacy for wireless sensor networks. ETRI Journal 35: 889–899.
View Article
Google Scholar

[40] View Article

[41] Google Scholar

[ref15] 15. He D, Kumar N, Chen J, Lee C, Chilamkurti N, Yeo S (2013) Robust anonymous authentication protocol for health-care applications using wireless medical sensor networks. Multimedia Systems.

[ref16] 16. Chi L, Hu L, Li H, Chu J (2014) Analysis and improvement of a robust user authentication framework for ubiquitous sensor networks. International Journal of Distributed Sensor Networks 2014: Article ID 637684.

[ref17] 17. Kim J, Lee D, Jeon W, Lee Y, Won D (2014) Security analysis and improvements of two-factor mutual authentication with key agreement in wireless sensor networks. Sensors 14: 6443–6462. pmid:24721764
View Article
PubMed/NCBI
Google Scholar

[45] View Article

[46] PubMed/NCBI

[47] Google Scholar

[ref18] 18. Khan M, Kumari S (2014) An improved user authentication protocol for healthcare services via wireless medical sensor networks. Internation Journal of Distributed Sensor Networks 2014: Article ID 347169.

[ref19] 19. Jiang Q, Ma J, Lu X, Tian Y (2014) An efficient two-factor user authentication scheme with unlinkability for wireless sensor networks. Peer-to-Peer Networking and Applications.

[ref20] 20. Choi Y, Lee D, Kim J, Jung J, Nam J, Won D (2014) Security enhanced user authentication protocol for wireless sensor networks using elliptic curves cryptography. Sensors 14: 10081–10106. pmid:24919012
View Article
PubMed/NCBI
Google Scholar

[51] View Article

[52] PubMed/NCBI

[53] Google Scholar

[ref21] 21. Khan M, He D (2012) A new dynamic identity-based authentication protocol for multi-server environment using elliptic curve cryptography. Security and Communication Networks 5: 1260– 1266.
View Article
Google Scholar

[55] View Article

[56] Google Scholar

[ref22] 22. Khan M, Kumari S, Singh P (2013) Cryptanalysis of an ‘efficient-strong authentiction protocol (E-SAP) for healthcare applications using wireless medical sensor networks’. KSII Transactions on Internet & Information Systems 7: 967–979.
View Article
Google Scholar

[58] View Article

[59] Google Scholar

[ref23] 23. He D, Kumar N, Khan M, Lee J (2013) Anonymous two-factor authentication for consumer roaming service in global mobility networks. IEEE Transactions on Consumer Electronics 59: 811–817.
View Article
Google Scholar

[61] View Article

[62] Google Scholar

[ref24] 24. Xie Q, Hu B, Tan X, Bao M, Yu X (2014) Robust anonymous two-factor authentication scheme for roaming service in global mobility network. Wireless Personal Communications 74: 601–614.
View Article
Google Scholar

[64] View Article

[65] Google Scholar

[ref25] 25. He D, Zhang Y, Chen J (2014) Cryptanalysis and improvement of an anonymous authentication protocol for wireless access networks. Wireless Personal Communications 74: 229–243.
View Article
Google Scholar

[67] View Article

[68] Google Scholar

[ref26] 26. Kocher P, Jaffe J, Jun B (1999) Differential power analysis. Proceedings of CRYPTO 1999, Santa Barbara, California, USA, pp. 388–397.

[ref27] 27. Messerges T, Dabbish E, Sloan R (2002) Examining smart-card security under the threat of power analysis attacks. IEEE Transactions on Computers 51: 541–552.
View Article
Google Scholar

[71] View Article

[72] Google Scholar

[ref28] 28. Wang D, Wang P (2014) Understanding security failures of two-factor authentication schemes for real-time applications in hierarchical wireless sensor networks. Ad Hoc Networks 20: 1–15.
View Article
Google Scholar

[74] View Article

[75] Google Scholar

[ref29] 29. Wang D, Wang P (2014) On the anonymity of two-factor authentication schemes for wireless sensor networks: Attacks, principle and solutions. Computer Networks 73: 41–57.
View Article
Google Scholar

[77] View Article

[78] Google Scholar

[ref30] 30. Bellare M, Pointcheval D, Rogaway P (2000) Authenticated key exchange secure against dictionary attacks. Proceedings of EUROCRYPT 2000, Bruges, Belgium, pp. 139–155.

[ref31] 31. NIST (1999) Recommended elliptic curves for federal government use. Avaliable: http://csrc.nist.gov/groups/ST/toolkit/documents/dss/NISTReCur.pdf.

[ref32] 32. Goldwasser S, Micali S (1984) Probabilistic encryption. Journal of Computer and System Sciences 28: 270–299.
View Article
Google Scholar

[82] View Article

[83] Google Scholar

[ref33] 33. Han W (2011) Weakness of a secured authentication protocol for wireless sensor networks using elliptic curves cryptography. IACR Cryptology ePrint Archive. Available: http://eprint.iacr.org/2011/293.

[ref34] 34. He D, Kumar N, Lee J, Sherratt R (2014) Enhanced three-factor security protocol for USB mass storage devices. IEEE Transactions on Consumer Electronics 60: 30–37.
View Article
Google Scholar

[86] View Article

[87] Google Scholar

Figures

Abstract

Introduction

A Security Model for Anonymous sca-wsn Schemes

Participants

Protocol Executions

Long-Lived Keys

Partnering

Adversary Capabilities

Authenticated Key Exchange (AKE)

User Anonymity

Our Proposed Scheme

Building Blocks

Elliptic curve computational Diffie-Hellman (ECCDH) problem.

Message authentication code schemes.

Cryptographic hash functions.

Symmetric encryption schemes.

Description of the Scheme

Registration phase.

Authentication and key exchange phase.

Password update phase.

Performance and Security Comparison

Security Proofs

User Anonymity

AKE Security

Concluding Remarks

Acknowledgments

Author Contributions

References