Anonymous Authentication Scheme for Intercommunication in the Internet of Things Environments

Abstract

Authentication and privacy protection are important security mechanisms for keeping things safe in the Internet of Things environments. In particular, an anonymous authentication scheme is a privacy preserving authentication technique which provides both authentication and privacy preservation. An authentication scheme with anonymity in mobility networks was proposed recently. However, it was proven that it failed to provide anonymity against passive adversaries and malicious users and security against known session key attacks and side channel attacks. We propose an anonymous authentication scheme for intercommunication between the things in the Internet of Things environments. The proposed scheme provides not only anonymity and security, but also untraceability for the thing. Moreover, we only use low cost functions, such as hash functions and exclusive-OR operations in consideration of limited computing power of the thing.

1. Introduction

As the Internet of Things (IoT) market is expanding recently, the importance of trustworthy IoT products and services is increasing. Zhang et al. [1] discussed IoT security issues just in time. To preserve IoT security, authentication and privacy preservation are some of the major mechanisms and a few authentication schemes in IoT are proposed [2, 3]. And improvements and drawbacks of those schemes are presented [4–6]. Since a lot of systems and things in IoT environments are connected to the Internet for intercommunication, apparently they can be exposed to hacker's attacks anytime and anywhere.

Systems of IoT infrastructure, such as a computer, a gateway, and a server system, have high computing power, enough memory, and wide communication bandwidth. On the contrary, things like a tag, a sensor, and a device deployed at the end of IoT environments have limited computing capacity and resource. Therefore, the convergence of symmetric and asymmetric cryptosystems and lightweight cryptographic protocols is necessary to guarantee the whole IoT security. Various things interconnected in IoT environments produce a lot of transmitting data. These data may contain user's behavior, taste, and preference as well as private information. Hence, an adversary can abuse user's information or do some damage through tapping, leaking, modifying, and destroying them. It is clear that privacy protection is one of the most important issues of IoT security. Because only human beings can have privacy, privacy preservation is not originally applied to things. However, things also need to have security measures to prevent privacy invasion in case they deal with human beings' information. For such a reason, anonymity and anonymous authentication are essential to preserve privacy and security of all objects in IoT environments.

Many anonymous authentication schemes in wireless environments, proofs of weaknesses, and countermeasures have been proposed [7–14]. Particularly, Chang et al. [15] proposed an efficient authentication scheme with anonymity for roaming service in global mobility networks. Since their scheme only uses low cost functions, such as hash functions and exclusive-OR operations, it is suitable for battery-powered mobile devices. However, Youn et al. [16] showed that Chang et al.'s scheme does not provide anonymity and security in certain situations. In other words, it fails to preserve anonymity against passive adversaries and malicious users as well as security against known session key attacks and side channel attacks. Since then, to make up the security faults proven by Youn et al., a few enhanced schemes have been proposed [17–19]. Also, anonymous authentication schemes with unlinkability that guarantee not to link one user and his/her messages have been followed [20–22].

In this paper, we suppose that IoT components are a thing, a gateway, and a registration server. The thing senses, handles, and transmits various information. All things need to be registered for the registration server before being deployed in IoT environments. The registration server keeps and manages the thing's identity. Also, it maintains a trustworthy relationship with the gateway to response to gateway's request for authenticating the thing. No one but the thing and the registration server can know the thing's identity because the thing certainly knows its identity and the registration server takes the thing's identity when the thing registers for it. The gateway authenticates the thing in relation to the registration server without knowing the thing's identity. And it makes the thing be able to communicate with other things through a secure way. The thing accomplishes mutual authentication and key agreement with the gateway through an anonymous authentication method when it connects to the gateway for the first time. At this time, the gateway which does not know the thing's identity can authenticate the thing with the aid of the registration server. Centering around one gateway, a number of things consist of their own domain. Things in the same domain can do anonymous authentication and session key sharing through the same gateway.

We propose a novel authentication scheme that guarantees anonymity, security, and untraceability in IoT environments by remedying the defects of Chang et al.'s scheme which are shown by Youn et al. The proposed scheme makes the things in IoT environments communicate with each other safely. Also, it only uses low cost functions to reduce computing loads of the thing's side as Chang et al.'s scheme does.

The remainder of this paper is organized as follows. We review the related works in Section 2 and present our scheme in Section 3. In Section 4, we analyze security of our scheme. Finally, a concluding remark is given in Section 5.

2. Related Works

In this section, we review Chang et al.'s scheme and Youn et al.'s analysis. Table 1 denotes notations in Chang et al.'s scheme.

Table 1

Notations in Chang et al.'s scheme.

Notations	Descriptions
MN	Mobile user
HA	Home agent of a mobile user
FA	Foreign agent of a foreign network
$${\text{ID}}_X$$	Identity of an entity X
$${\text{PW}}_X$$	Password of an entity X
SID	Shadow identity
SK	Session key
x	Private key of HA
$$K_{XY}$$	Common secret key shared between an entity X and an entity Y
$$h()$$	Collision-free one-way hash function
∥	Concatenation
⊕	Exclusive-OR operation

2.1. Chang et al.'s Scheme

Chang et al.'s scheme consists of three phases: registration, authentication, and session key establishment. And three entities are involved: the mobile user $\mathrm{M}\mathrm{N}$ , the foreign agent $\text{FA}$ , and the home agent $\mathrm{H}\mathrm{A}$ in each phase. Their assumption is that each $\mathrm{F}\mathrm{A}$ and each $\mathrm{H}\mathrm{A}$ share and store a long term session key using any secure method, such as the Diffie-Hellman key agreement protocol.

2.1.1. Registration Phase

In the registration phase, $\mathrm{M}\mathrm{N}$ submits his/her identity ${\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}$ and the selected password ${\text{PW}}_{\mathrm{M}\mathrm{N}}$ to $\mathrm{H}\mathrm{A}$ . $\mathrm{H}\mathrm{A}$ uses its private key x to compute the secret value R as follows: $$\begin{array}{cc}& R=h\left({\text{ID}}_{\mathrm{M}\mathrm{N}}\parallel x\right)\oplus {\mathrm{P}\mathrm{W}}_{\mathrm{M}\mathrm{N}}.\end{array}$$ (1) Then $\mathrm{H}\mathrm{A}$ issues a smart card containing $\{{\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}},{\mathrm{I}\mathrm{D}}_{\mathrm{H}\mathrm{A}},R,h\left(x\right),h(·)\}$ and delivers it to $\mathrm{M}\mathrm{N}$ in a secure way.

2.1.2. Authentication Phase

It is assumed that $\mathrm{M}\mathrm{N}$ wants to take a roaming service from $\mathrm{F}\mathrm{A}$ . Before providing services, $\mathrm{F}\mathrm{A}$ tries to authenticate $\mathrm{M}\mathrm{N}$ through $\mathrm{H}\mathrm{A}$ . To achieve this, $\mathrm{M}\mathrm{N}$ , $\mathrm{F}\mathrm{A}$ , and $\mathrm{H}\mathrm{A}$ perform the authentication phase as follows.

• (1)

$\mathrm{M}\mathrm{N}$ inserts his/her smart card into the device and enters a password ${{\mathrm{P}\mathrm{W}}_{\mathrm{M}\mathrm{N}}}^{\ast }$ .

(2)

Smart card generates a nonce $n_{\mathrm{M}\mathrm{N}}$ randomly and computes the parameter C as shown in $$\begin{array}{cc}& C=\left(R\oplus {{\mathrm{P}\mathrm{W}}_{\mathrm{M}\mathrm{N}}}^{\ast }\right)\oplus n_{\mathrm{M}\mathrm{N}}.\end{array}$$ (2)

(3)

$\mathrm{M}\mathrm{N}$ sends the login message $m_1=\{\text{Login\hspace{0.17em}\hspace{0.17em}request},n_{\mathrm{M}\mathrm{N}},{\mathrm{I}\mathrm{D}}_{\mathrm{H}\mathrm{A}}\}$ to $\mathrm{F}\mathrm{A}$ . “ $\text{Login\hspace{0.17em}\hspace{0.17em}request}$ ” is the header of the message to establish a new secure session between $\mathrm{M}\mathrm{N}$ and $\mathrm{F}\mathrm{A}$ .

(4)

Upon receiving $m_1$ , $\mathrm{F}\mathrm{A}$ stores $n_{\mathrm{M}\mathrm{N}}$ and generates a random nonce $n_{\mathrm{F}\mathrm{A}}$ to send the authentication request message $m_2=\{\text{Authenticaton\hspace{0.17em}\hspace{0.17em}request},n_{\mathrm{F}\mathrm{A}},{\mathrm{I}\mathrm{D}}_{\mathrm{F}\mathrm{A}}\}$ to $\mathrm{H}\mathrm{A}$ . The message header “ $\text{Authenticaton\hspace{0.17em}\hspace{0.17em}request}$ ” notifies $\mathrm{H}\mathrm{A}$ to authenticate $\mathrm{M}\mathrm{N}$ .

(5)

After receiving $m_2$ , $\mathrm{H}\mathrm{A}$ checks ${\mathrm{I}\mathrm{D}}_{\mathrm{F}\mathrm{A}}$ to see whether a trustworthy relationship between $\mathrm{H}\mathrm{A}$ and $\mathrm{F}\mathrm{A}$ is built or not. If ${\mathrm{I}\mathrm{D}}_{\mathrm{F}\mathrm{A}}$ is valid, $\mathrm{H}\mathrm{A}$ generates a nonce $n_{\mathrm{H}\mathrm{A}}$ randomly and sends the message $m_3=\{n_{\mathrm{H}\mathrm{A}},{\mathrm{I}\mathrm{D}}_{\mathrm{H}\mathrm{A}}\}$ to $\mathrm{F}\mathrm{A}$ .

(6)

Upon receiving $m_{\mathrm{3}}$ , $\mathrm{F}\mathrm{A}$ sends the message $m_{\mathrm{4}}=\{n_{\mathrm{H}\mathrm{A}},n_{\mathrm{F}\mathrm{A}},{\mathrm{I}\mathrm{D}}_{\mathrm{F}\mathrm{A}}\}$ to $\mathrm{M}\mathrm{N}$ .

 

After checking the identities and exchanging nonces between $\mathrm{M}\mathrm{N}$ , $\mathrm{F}\mathrm{A}$ , and $\mathrm{H}\mathrm{A}$ , they accomplish the following steps for anonymous authentication.

(7)

$\mathrm{M}\mathrm{N}$ who receives $m_4$ computes the shadow identity $\text{SID}$ , the parameter $V_1$ , the session key $\mathrm{S}\mathrm{K}$ , and the parameter $V_2$ sequentially such that $$\begin{array}{cc}& \text{SID}={\text{ID}}_{\mathrm{M}\mathrm{N}}\oplus h\left(h\left(x\right)\parallel n_{\mathrm{H}\mathrm{A}}\right),\\ V_{\mathrm{1}}=h\left(n_{\mathrm{H}\mathrm{A}}\parallel C\right),\\ \mathrm{S}\mathrm{K}=h\left(h\left(x\right)\parallel {\text{ID}}_{\mathrm{M}\mathrm{N}}\parallel {\text{ID}}_{\text{FA}}\parallel n_{\mathrm{M}\mathrm{N}}\parallel n_{\text{FA}}\right),\\ V_{\mathrm{2}}=\mathrm{S}\mathrm{K}\oplus h\left(n_{\mathrm{H}\mathrm{A}}\parallel {\text{ID}}_{\mathrm{M}\mathrm{N}}\right).\end{array}$$ (3)

(8)

$\mathrm{M}\mathrm{N}$ computes the following hashing value $S_1$ and sends the message $m_5=\{\text{SID},V_1,V_2,n_{\mathrm{M}\mathrm{N}},S_1,{\text{ID}}_{\mathrm{H}\mathrm{A}}\}$ to $\text{FA}$ : $$\begin{array}{cc}& S_{\mathrm{1}}=h\left(n_{\text{FA}}\parallel \text{SID}\parallel V_{\mathrm{1}}\parallel V_{\mathrm{2}}\parallel n_{\mathrm{M}\mathrm{N}}\right).\end{array}$$ (4)

(9)

Upon receiving $m_5$ , $\text{FA}$ checks $S_1$ and computes the following hashing value $S_2$ . And then it sends the message $m_6=\{\text{SID},V_1,V_2,n_{\mathrm{M}\mathrm{N}},S_2,{\text{ID}}_{\text{FA}}\}$ to $\mathrm{H}\mathrm{A}$ : $$\begin{array}{cc}& S_{\mathrm{2}}=h\left(K_{\mathrm{F}\mathrm{H}}\parallel n_{\mathrm{H}\mathrm{A}}\parallel \text{SID}\parallel V_{\mathrm{1}}\parallel V_{\mathrm{2}}\parallel n_{\mathrm{M}\mathrm{N}}\right).\end{array}$$ (5)

(10)

After receiving $m_6$ , $\mathrm{H}\mathrm{A}$ checks ID_FA and $S_2$ firstly. And it checks the format of $\mathrm{M}\mathrm{N}$ 's identity after computing ${\text{ID}}_{\mathrm{M}\mathrm{N}}$ as follows: $$\begin{array}{cc}& {\text{ID}}_{\mathrm{M}\mathrm{N}}=\text{SID}\oplus h\left(h\left(x\right)\parallel n_{\mathrm{H}\mathrm{A}}\right).\end{array}$$ (6)

(11)

$\mathrm{H}\mathrm{A}$ computes $C^{\ast }$ and ${V_1}^{\ast }$ as demonstrated in (7) to check whether ${V_1}^{\ast }$ is equal to $V_1$ . The equivalence between ${V_1}^{\ast }$ and $V_1$ implies that the selected ${\mathrm{P}\mathrm{W}}_{\mathrm{M}\mathrm{N}}$ in the registration phase is the same as the password ${{\mathrm{P}\mathrm{W}}_{\mathrm{M}\mathrm{N}}}^{\ast }$ that $\mathrm{M}\mathrm{N}$ enters in the authentication phase: $$\begin{array}{cc}& C^{\ast }=h\left({\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}\parallel x\right)\oplus n_{\mathrm{M}\mathrm{N}},\\ {V_{\mathrm{1}}}^{\ast }=h\left(n_{\mathrm{H}\mathrm{A}}\parallel C^{\ast }\right).\end{array}$$ (7)

(12)

$\mathrm{H}\mathrm{A}$ computes the parameter $K_1$ after obtaining the session key $\mathrm{S}\mathrm{K}$ from $V_2$ . And it computes the parameter $V_3$ and the hashing value $S_3$ to send the message $m_7=\{K_1,V_3,S_3\}$ to $\text{FA}$ . $\mathrm{S}\mathrm{K}$ , $K_1$ , $V_3$ , and $S_3$ are calculated such that $$\begin{array}{cc}& \mathrm{S}\mathrm{K}=V_{\mathrm{2}}\oplus h\left(n_{\mathrm{H}\mathrm{A}}\parallel {\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}\right),\\ K_{\mathrm{1}}=\mathrm{S}\mathrm{K}\oplus h\left(K_{\mathrm{F}\mathrm{H}}\parallel n_{\text{FA}}\right),\\ V_{\mathrm{3}}=h\left({\mathrm{I}\mathrm{D}}_{\text{FA}}\parallel h\left(x\right)\parallel n_{\mathrm{M}\mathrm{N}}\right),\\ S_{\mathrm{3}}=h\left(K_{\mathrm{F}\mathrm{H}}\parallel n_{\text{FA}}\parallel K_{\mathrm{1}}\parallel V_{\mathrm{3}}\right).\end{array}$$ (8)

2.1.3. Session Key Establishment Phase

After completing the authentication phase, $\mathrm{M}\mathrm{N}$ and $\text{FA}$ continue the following session key establishment phase.

• (1)

Upon receiving $m_7$ , $\text{FA}$ obtains the following session key $\text{SK}$ from $K_1$ after checking $S_3$ : $$\begin{array}{cc}& \mathrm{S}\mathrm{K}=K_{\mathrm{1}}\oplus h\left(K_{\mathrm{F}\mathrm{H}}\parallel n_{\text{FA}}\right).\end{array}$$ (9)

 

And it computes the parameter $K_2$ as follows to send the message $m_8=\{V_3,K_2\}$ to $\mathrm{M}\mathrm{N}$ : $$\begin{array}{cc}& K_{\mathrm{2}}=\mathrm{S}\mathrm{K}\oplus h\left(\mathrm{S}\mathrm{K}\parallel n_{\mathrm{M}\mathrm{N}}\right).\end{array}$$ (10)

(2)

After receiving $m_8$ , $\mathrm{M}\mathrm{N}$ computes the following ${V_3}^{\ast }$ and checks whether ${V_3}^{\ast }$ and $V_3$ are equal or not: $$\begin{array}{cc}& {V_3}^{\ast }=h\left({\mathrm{I}\mathrm{D}}_{\text{FA}}\parallel h\left(x\right)\parallel n_{\mathrm{M}\mathrm{N}}\right).\end{array}$$ (11)

 

The fact that two values are equal means $\mathrm{M}\mathrm{N}$ confirms $\text{FA}$ as a valid foreign agent.

(3)

$\mathrm{M}\mathrm{N}$ computes ${\mathrm{S}\mathrm{K}}^{\ast }$ as follows: from $K_2$ to check the equivalence between ${\mathrm{S}\mathrm{K}}^{\ast }$ and $\mathrm{S}\mathrm{K}$ that $\mathrm{M}\mathrm{N}$ computes in the authentication phase: $$\begin{array}{cc}& {\mathrm{S}\mathrm{K}}^{\ast }=K_{\mathrm{2}}\oplus h\left(\mathrm{S}\mathrm{K}\parallel n_{\mathrm{M}\mathrm{N}}\right).\end{array}$$ (12)

 

According to the sameness of two values, $\mathrm{M}\mathrm{N}$ confirms that he/she shares the authenticated session key with $\text{FA}$ .

(4)

Since then, $\mathrm{M}\mathrm{N}$ and $\text{FA}$ use $\mathrm{S}\mathrm{K}$ when they want to communicate with one another through a secure channel.

Figure 1 describes the authentication and the session key establishment phases in Chang et al.'s scheme.

Figure 1

Authentication and session key establishment phases in Chang et al.'s scheme.

2.2. Youn et al.'s Analysis

Youn et al. proved that Chang et al.'s scheme suffers from some specific attacks. Their assumptions are as follows. Anyone can eavesdrop transmitting messages between $\mathrm{M}\mathrm{N}$ , $\text{FA}$ , and $\mathrm{H}\mathrm{A}$ . And it is easy to perform a brute-force search of a valid identity since it is short and has a certain format. In addition, there exists an adversary who can execute side channel attacks.

2.2.1. Anonymity against Passive Adversaries

A passive adversary can obtain $V_2$ and $K_2$ by eavesdropping messages between $\mathrm{M}\mathrm{N}$ , $\text{FA}$ , and $\mathrm{H}\mathrm{A}$ . The adversary chooses a candidate identity ${\mathrm{I}\mathrm{D}}^{\prime }$ to compute ${\mathrm{S}\mathrm{K}}^{\prime }$ and $K_2^{\prime }$ as follows: $$\begin{array}{cc}& {\mathrm{S}\mathrm{K}}^{\prime }=V_{\mathrm{2}}\oplus h\left(n_{\mathrm{H}\mathrm{A}}\parallel {\mathrm{I}\mathrm{D}}^{\prime }\right),\\ K_2^{\prime }={\mathrm{S}\mathrm{K}}^{\prime }\oplus h\left({\mathrm{S}\mathrm{K}}^{\prime }\parallel n_{\mathrm{M}\mathrm{N}}\right).\end{array}$$ (13) If $K_2^{\prime }$ and $K_2$ are equal, the adversary can recognize that the candidate identity is the same as $\mathrm{M}\mathrm{N}$ 's real identity. Therefore, the adversary can know $\mathrm{M}\mathrm{N}$ 's identity.

2.2.2. Anonymity against Malicious Mobile User

It is supposed that ${\mathrm{M}\mathrm{N}}^{\prime }$ is a malicious mobile user who has a valid smart card issued by $\mathrm{H}\mathrm{A}$ . ${\mathrm{M}\mathrm{N}}^{\prime }$ accomplishes the normal authentication phase with $\mathrm{H}\mathrm{A}$ to get the nonce $n_{\mathrm{H}\mathrm{A}}^{\prime }$ generated by $\mathrm{H}\mathrm{A}$ . And then he/she computes ${\text{SID}}^{\prime }$ using his/her identity ${\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}^{\prime }$ as follows: $$\begin{array}{cc}& {\text{SID}}^{\prime }={\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}^{\prime }\oplus h\left(h\left(x\right)\parallel n_{\mathrm{H}\mathrm{A}}^{\prime }\right).\end{array}$$ (14) ${\mathrm{M}\mathrm{N}}^{\prime }$ replaces $n_{\mathrm{H}\mathrm{A}}$ included in the message $m_4=\{n_{\mathrm{H}\mathrm{A}},n_{\text{FA}},{\mathrm{I}\mathrm{D}}_{\text{FA}}\}$ between $\mathrm{M}\mathrm{N}$ and $\text{FA}$ with $n_{\mathrm{H}\mathrm{A}}^{\prime }$ . Then $\mathrm{M}\mathrm{N}$ who receives $m_4$ computes the following $\text{SID}$ to send it to $\text{FA}$ : $$\begin{array}{cc}& \text{SID}={\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}\oplus h\left(h\left(x\right)\parallel n_{\mathrm{H}\mathrm{A}}^{\prime }\right).\end{array}$$ (15) ${\mathrm{M}\mathrm{N}}^{\prime }$ eavesdrops $\text{SID}$ once again to compute ${\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}$ using $\text{SID}$ and ${\text{SID}}^{\prime }$ . ${\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}$ is calculated as follows: $$\begin{array}{cc}& {\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}=\text{SID}\oplus {\text{SID}}^{\prime }\oplus {\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}^{\prime }={\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}\oplus h\left(h\left(x\right)\parallel n_{\mathrm{H}\mathrm{A}}^{\prime }\right)\oplus {\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}^{\prime }\oplus h\left(h\left(x\right)\parallel n_{\mathrm{H}\mathrm{A}}^{\prime }\right)\oplus {\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}^{\prime }.\end{array}$$ (16) Thus, a legal but malicious user can obtain other's identity.

2.2.3. Security against Known Session Key Attacks

An adversary can get a user's identity when a former session key shared between $\mathrm{M}\mathrm{N}$ and $\text{FA}$ is revealed. The adversary obtains $V_2$ by eavesdropping and computes the verification value $\mathrm{F}\mathrm{l}\mathrm{g}$ using $V_2$ and a revealed $\mathrm{S}\mathrm{K}$ such that $$\begin{array}{cc}& \mathrm{F}\mathrm{l}\mathrm{g}=V_2\oplus \mathrm{S}\mathrm{K}.\end{array}$$ (17) The adversary also computes another verification value ${\mathrm{F}\mathrm{l}\mathrm{g}}^{\prime }$ after choosing a candidate identity ${\mathrm{I}\mathrm{D}}^{\prime }$ in the following manner: $$\begin{array}{cc}& {\mathrm{F}\mathrm{l}\mathrm{g}}^{\prime }=h\left(n_{\mathrm{H}\mathrm{A}}\parallel {\mathrm{I}\mathrm{D}}^{\prime }\right).\end{array}$$ (18) If $\mathrm{F}\mathrm{l}\mathrm{g}$ equals ${\mathrm{F}\mathrm{l}\mathrm{g}}^{\prime }$ , the adversary can ensure that the guessed identity and the $\mathrm{M}\mathrm{N}$ 's real identity are consistent.

2.2.4. Security against Side Channel Attacks

Let us suppose that an adversary who can execute side channel attacks obtains a valid smart card issued by $\mathrm{H}\mathrm{A}$ . The adversary can acquire $h(x)$ from the smart card and take $\text{SID}$ and $n_{\mathrm{H}\mathrm{A}}$ from messages in the authentication phase. Then it is possible that the adversary discovers $\mathrm{M}\mathrm{N}$ 's identity by computing as follows: $$\begin{array}{cc}& {\mathrm{I}\mathrm{D}}_{\mathrm{M}\mathrm{N}}=\text{SID}\oplus h\left(h\left(x\right)\parallel n_{\mathrm{H}\mathrm{A}}\right).\end{array}$$ (19) Hence, Chang et al.'s scheme can be totally broken by side channel attacks.

3. Proposed Scheme

To provide anonymity and security, the proposed scheme that improves Chang et al.'s scheme makes up for the weak points shown by Youn et al. Also, it guarantees untraceability for things by using different anonymized identities all the time. Since it minimizes the number of transmitting messages and computations, it is suitable for IoT environments. Figure 2 presents IoT network environments applied to our scheme. A registration server and a gateway accomplish mutual communication through the Internet while they preserve a trustworthy relationship. The registration server maintains secret information of things. The gateway forms its own domain to combine the things that existed in its permissible range. And it makes the things link up with their registration server. The things collect and produce various information and exchange data one another if necessary. Depending on the number of things in a domain, several base stations are required to provide stable communication channel. Base stations do not participate in the join phase directly. They just act as mediators between the things and the gateway. If the stability of communications channel is guaranteed, a lot of things can work in one domain. It is because the thing only computes low cost functions, while relatively high cost computations are up to the gateway. In other words, a domain can be expanded regardless of the number of things.

Figure 2

IoT network environments in the proposed scheme.

The proposed scheme consists of three phases: registration, join, and communication. In each phase, the thing T, the gateway G, and the registration server R are involved. We assume R and G share a common secret key using a secure method, such as the Diffie-Hellman key agreement protocol in advance. And let us suppose that a time synchronization is established between T, G, and R.

In the registration phase, T registers for R in a safe way. T registered for R normally joins G's domain in the join phase. In that phase, G can authenticate T through R. The things that successfully joined G's domain cannot trust each other yet, whereas they already build a trustworthy relationship with G through sharing of a common secret key. When the things want to communicate with each other safely, they carry out authentication and session key establishment processes through G. Table 2 indicates additional notations used in our scheme. We use notations in both Tables 1 and 2.

Table 2

Additional notations in the proposed scheme.

Notations	Descriptions
T	Thing
R	Registration server
G	Gateway of a domain
$${\text{SID}}_X$$	Shadow identity of an entity X
$${\text{VID}}_X$$	Virtual identity of an entity X
$$x_X$$	Private key of an entity X
$$t_X$$	Timestamp generated by an entity X

3.1. Registration Phase

Firstly, T registers for R and R issues T's virtual identity. T receives secret information from R and stores them safely. Figure 3 shows the registration phase between T and R.

Figure 3

Registration phase in the proposed scheme.

• (1)

  T submits its identity ${\mathrm{I}\mathrm{D}}_T$ to R.

• (2)

  R generates T's private key $x_T$ and an initial timestamp $t_I$ . And it computes T's virtual identity ${\text{VID}}_T$ as follows: $$\begin{array}{cc}& {\text{VID}}_T=h\left({\mathrm{I}\mathrm{D}}_T\parallel x_T\parallel t_I\right).\end{array}$$ (20) Due to the private key, the virtual identity hides the real identity perfectly. The registration server is supposed to use the virtual identity to verify the thing's real identity. The virtual identity is essential element to make the proposed scheme provide anonymity.

• (3)

  R stores T's secret information $[{\mathrm{I}\mathrm{D}}_T,{\text{VID}}_T,x_T,t_I]$ in its database secretly. It computes the hashing values $h\left(x_T\right)$ of T's private key $x_T$ and $h\left(x_R\right)$ of its private key $x_R$ . And it sends the secret information ${\{\mathrm{I}\mathrm{D}}_T,{\text{VID}}_T,x_T,h\left(x_T\right),h\left(x_R\right),{\mathrm{I}\mathrm{D}}_R\}$ to T.

• (4)

  T stores the secret information ${[\mathrm{I}\mathrm{D}}_T,{\text{VID}}_T,x_T,h\left(x_T\right),h\left(x_R\right),{\mathrm{I}\mathrm{D}}_R]$ safely.

3.2. Join Phase

Let us suppose T wants to join G's domain in order to take services from G. Then G tries to authenticate T through R to provide services. We define $K_{RG}$ as the common secret key shared between R and G in advance. T, G, and R perform the following authentication and key establishment steps. Figure 4 presents the join phase.

Figure 4

Join phase in the proposed scheme.

• (1)

  T generates a timestamp $t_T$ to compute the following shadow identity ${\text{SID}}_T$ using ${\text{VID}}_T$ and $h(x_R)$ : $$\begin{array}{cc}& {\text{SID}}_T={\text{VID}}_T\oplus h\left(h\left(x_R\right)\parallel t_T\right).\end{array}$$ (21)

•  

  The virtual identity already concealed the thing's real identity in the registration. In this step, the shadow identity hides the virtual identity again. While the shadow identity of Chang et al.'s scheme hides the real identity directly, our shadow identity contains the virtual identity instead of the real identity. It means the proposed scheme provides anonymity, even if the shadow identity is revealed.

• (2)

  T sends the join request message $m_1=\{\text{JoinReq}.,{\text{SID}}_T,{\mathrm{I}\mathrm{D}}_R,t_T\}$ to G, where the message header $\text{JoinReq}.$ means T requests R to authenticate G and to provide a common secret key for joining G.

• (3)

  After receiving $m_1$ , G checks $t_T$ and generates a timestamp $t_G$ . And it computes the hashing value $H_1$ using the preshared common secret $K_{RG}$ as follows: $$\begin{array}{cc}& H_{\mathrm{1}}=h\left(K_{RG}\parallel {\text{SID}}_T\parallel t_T{\parallel t}_G\right).\end{array}$$ (22)

•  

  And it sends the authentication request message $m_2=\{\text{AuthReq}.,{\text{SID}}_T,{\mathrm{I}\mathrm{D}}_G,H_1,t_T{,t}_G\}$ to R. The message header $\text{AuthReq}.$ indicates G requests R to authenticate T.

• (4)

  Upon receiving $m_2$ , R checks ${\mathrm{I}\mathrm{D}}_G$ to determine whether it is an ally or not and checks $t_G$ to verify the validity of time period. And it computes the following ${H_1}^{\ast }$ to check whether it is equal to $H_1$ : $$\begin{array}{cc}& {H_{\mathrm{1}}}^{\ast }=h\left(K_{RG}\parallel {\text{SID}}_T\parallel t_T{\parallel t}_G\right).\end{array}$$ (23)

•  

  If results are all valid, R generates a timestamp $t_R$ .

• (5)

  R computes ${{\text{VID}}_T}^{\ast }$ using received information and $h(x_R)$ as follows: $$\begin{array}{cc}& {{\text{VID}}_T}^{\ast }={\text{SID}}_T\oplus h\left(h\left(x_R\right)\parallel t_T\right).\end{array}$$ (24)

•  

  And it retrieves the secret information [ ${\mathrm{I}\mathrm{D}}_T,{\text{VID}}_T,x_T,t_I]$ from its database using ${{\mathrm{V}\mathrm{I}\mathrm{D}}_T}^{\ast }$ as a keyword. If it is impossible to get ${\text{VID}}_T$ same as ${{\mathrm{V}\mathrm{I}\mathrm{D}}_T}^{\ast }$ , then R rejects G's request for authentication and stops communication with G.

• (6)

  R computes T's new virtual identity ${\mathrm{V}\mathrm{I}\mathrm{D}}_T^{\prime }$ as shown in (25) and stores it safely to substitute the existing virtual identity ${\text{VID}}_T$ : $$\begin{array}{cc}& {\mathrm{V}\mathrm{I}\mathrm{D}}_T^{\prime }=h\left({\mathrm{I}\mathrm{D}}_T\parallel x_T\parallel t_R\right).\end{array}$$ (25)

•  

  This step makes every virtual identity supposed to be used only once. In other words, it guarantees the freshness of all virtual identities and it finally provides unlinkability of the proposed scheme.

• (7)

  After the renewal of the virtual identity, R computes the common secret key supposed to be shared between G and T using T's private key $x_T$ . Also, it computes the verification values $V_1$ , $V_2$ , and $V_3$ for T and the verification value $V_4$ for G as follows: $$\begin{array}{cc}& K_{GT}=h\left(h\left(x_T\right)\parallel {\mathrm{I}\mathrm{D}}_T\parallel {\mathrm{I}\mathrm{D}}_G\parallel t_T\parallel t_G\right),\\ V_{\mathrm{1}}=h\left(h\left(x_T\right)\parallel {{\mathrm{I}\mathrm{D}}_G\parallel t}_T\right),\\ V_{\mathrm{2}}=h\left(K_{GT}\parallel {{\mathrm{I}\mathrm{D}}_R\parallel t}_T\right),\\ V_{\mathrm{3}}=h\left({\mathrm{V}\mathrm{I}\mathrm{D}}_T^{\prime }\parallel {\mathrm{I}\mathrm{D}}_R\parallel t_T\right),\\ V_{\mathrm{4}}=K_{GT}\oplus h\left(K_{RG}\parallel t_G\right).\end{array}$$ (26)

•  

  Since the common secret key $K_{GT}$ is derived from a secret hashing value $h\left(x_T\right)$ and changing timestamps, the secrecy and the freshness of the common secret key are always guaranteed.

• (8)

  R computes the following hashing value $H_{\mathrm{2}}$ and sends the message $m_{\mathrm{3}}=\{{\mathrm{I}\mathrm{D}}_R,V_{\mathrm{1}},V_{\mathrm{2}},V_{\mathrm{3}},V_{\mathrm{4}},H_{\mathrm{2}},t_R\}$ to G: $$\begin{array}{cc}& H_{\mathrm{2}}=h\left(K_{RG}\parallel V_{\mathrm{1}}\parallel V_{\mathrm{2}}\parallel V_{\mathrm{3}}\parallel V_{\mathrm{4}}\parallel t_R\right).\end{array}$$ (27)

• (9)

  After receiving $m_3$ , G checks $t_R$ and $H_2$ . If they are all valid, G computes the verification value $V_5$ after computing the common secret key $K_{GT}$ . And it sends the message $m_4=\{{\mathrm{I}\mathrm{D}}_G,V_1,V_2,V_3{,V_5,t}_G,t_R\}$ to T. $K_{GT}$ and $V_5$ are as shown in the following formulas: $$\begin{array}{cc}& K_{GT}=V_4\oplus h\left(K_{RG}\parallel t_G\right),\\ V_{\mathrm{5}}=K_{GT}\oplus h\left(K_{GT}\parallel t_T\right).\end{array}$$ (28)

• (10)

  Upon receiving $m_4$ , T computes the following ${V_1}^{\ast }$ after checking $t_G$ : $$\begin{array}{cc}& {V_1}^{\ast }=h\left(h\left(x_T\right)\parallel {{\mathrm{I}\mathrm{D}}_G\parallel t}_T\right).\end{array}$$ (29)

•  

  The fact that ${V_1}^{\ast }$ is the same as $V_1$ implies that T recognizes the fact that R checked ${\mathrm{I}\mathrm{D}}_G$ .

• (11)

  T computes ${K_{GT}}^{\ast }$ and ${V_2}^{\ast }$ such that $$\begin{array}{cc}& {K_{GT}}^{\ast }=h\left(h\left(x_T\right)\parallel {\mathrm{I}\mathrm{D}}_T\parallel {\mathrm{I}\mathrm{D}}_G\parallel t_T\parallel t_G\right),\\ {V_2}^{\ast }=h\left({K_{GT}}^{\ast }\parallel {{\mathrm{I}\mathrm{D}}_R\parallel t}_T\right),\end{array}$$ (30)

•  

  to check the equivalence between ${V_2}^{\ast }$ and $V_2$ . The sameness of two values means that R trusted by T computes the common secret key which is supposed to be shared between G and T.

• (12)

  T computes the virtual identity ${\mathrm{V}\mathrm{I}\mathrm{D}}_T^{\prime }$ and the verification value ${V_3}^{\ast }$ as follows: $$\begin{array}{cc}& {\mathrm{V}\mathrm{I}\mathrm{D}}_T^{\prime }=h\left({\mathrm{I}\mathrm{D}}_T\parallel x_T\parallel t_R\right),\\ {V_{\mathrm{3}}}^{\ast }=h\left({\mathrm{V}\mathrm{I}\mathrm{D}}_T^{\prime }\parallel {\mathrm{I}\mathrm{D}}_R\parallel t_T\right).\end{array}$$ (31)

•  

  And it checks whether ${V_3}^{\ast }$ is equal to $V_3$ . The equality indicates R computes T's new virtual identity ${\mathrm{V}\mathrm{I}\mathrm{D}}_T^{\prime }$ normally. And then T stores its new virtual identity ${\mathrm{V}\mathrm{I}\mathrm{D}}_T^{\prime }$ securely. As a result, the virtual identity is renewed by replacing the existing ${\text{VID}}_T$ with the new ${\mathrm{V}\mathrm{I}\mathrm{D}}_T^{\prime }$ .

• (13)

  T checks the equivalence between ${V_5}^{\ast }$ and $V_5$ after computing ${V_5}^{\ast }$ as shown in $$\begin{array}{cc}& {V_5}^{\ast }={K_{GT}}^{\ast }\oplus h\left({K_{GT}}^{\ast }\parallel t_T\right).\end{array}$$ (32)

•  

  The valid verification of ${V_5}^{\ast }$ implies that T and G share the common secret key successfully.

3.3. Communication Phase

The things located in G's domain authenticate each other and share session keys to communicate in a secure way. We assume that $T_1$ and $T_2$ already shared common secret keys called $K_{{GT}_1}$ and $K_{G{T}_2}$ , respectively, with G in the join phase. $T_1$ performs the following communication phase to share a session key with $T_2$ . The communication phase is presented in Figure 5.

Figure 5

Communication phase in the proposed scheme.

• (1)

  $T_1$ generates a timestamp $t_{T_1}$ and computes the new shadow identity ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1}^{\prime }$ as shown in $$\begin{array}{cc}& {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1}^{\prime }={\text{VID}}_{T_{\mathrm{1}}}\oplus h\left(h\left(x_R\right)\parallel t_{T_{\mathrm{1}}}\right)\end{array}$$ (33)

•  

  to substitute the existing shadow identity ${\text{SID}}_{T_1}$ .

• (2)

  $T_1$ computes the verification value $V_6$ and the hashing value $H_3$ as follows: $$\begin{array}{cc}& V_{\mathrm{6}}={\mathrm{S}\mathrm{I}\mathrm{D}}_{T_{\mathrm{1}}}^{\prime }\oplus h\left(K_{{GT}_{\mathrm{1}}}\parallel t_{T_{\mathrm{1}}}\right),\\ H_{\mathrm{3}}=h\left(K_{{GT}_{\mathrm{1}}}\parallel {\text{SID}}_{T_{\mathrm{1}}}\parallel V_{\mathrm{6}}\parallel t_{T_{\mathrm{1}}}\right).\end{array}$$ (34)

•  

  And it sends the communication request message $m_5=\{\text{CommReq}.,{\text{SID}}_{T_1},{\mathrm{I}\mathrm{D}}_G,V_6,H_3,t_{T_1}\}$ to $T_2$ . The message header $\text{CommReq}.$ stands for $T_1$ 's request for communicating with $T_2$ .

• (3)

  Upon receiving $m_5$ , $T_2$ generates a timestamp $t_{T_2}$ after checking $t_{T_1}$ and computes its new shadow identity ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}^{\prime }$ , the verification value $V_7$ , and the hashing value $H_4$ such that $$\begin{array}{cc}& {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}^{\prime }={\text{VID}}_{T_{\mathrm{2}}}\oplus h\left(h\left(x_R\right)\parallel t_{T_{\mathrm{2}}}\right),\\ V_{\mathrm{7}}={\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}^{\prime }\oplus h\left(K_{{GT}_{\mathrm{2}}}\parallel t_{T_{\mathrm{2}}}\right),\\ H_{\mathrm{4}}=h\left(K_{{GT}_{\mathrm{2}}}\parallel V_{\mathrm{6}}\parallel V_{\mathrm{7}}\parallel H_{\mathrm{3}}\parallel {\text{SID}}_{T_{\mathrm{1}}}\parallel {\text{SID}}_{T_{\mathrm{2}}}\parallel t_{T_{\mathrm{1}}}\parallel t_{T_{\mathrm{2}}}\right).\end{array}$$ (35)

•  

  And it sends the authentication request message $m_{\mathrm{6}}=\{\text{AuthReq}.,{\text{SID}}_{T_{\mathrm{1}}},{\text{SID}}_{T_{\mathrm{2}}},V_{\mathrm{6}},V_{\mathrm{7}},H_{\mathrm{3}},H_{\mathrm{4}},t_{T_{\mathrm{1}}},t_{T_{\mathrm{2}}}\}$ to G. The message header $\text{AuthReq}.$ means that $T_{\mathrm{2}}$ requests G to authenticate $T_{\mathrm{1}}$ .

• (4)

  After receiving $m_6$ , G firstly checks $t_{T_2}$ , ${\text{SID}}_{T_1}$ , and ${\text{SID}}_{T_2}$ to confirm that $T_1$ and $T_2$ were authenticated by itself in the join phase. And then it checks that ${H_3}^{\ast }$ is equal to $H_3$ and ${H_4}^{\ast }$ is equal to $H_4$ after computing the following ${H_3}^{\ast }$ , ${H_4}^{\ast }$ : $$\begin{array}{cc}& {H_3}^{\ast }=h\left(K_{{GT}_{\mathrm{1}}}\parallel {\text{SID}}_{T_{\mathrm{1}}}\parallel V_{\mathrm{6}}\parallel t_{T_{\mathrm{1}}}\right),\\ {H_4}^{\ast }=h\left(K_{{GT}_{\mathrm{2}}}\parallel V_{\mathrm{6}}\parallel V_{\mathrm{7}}\parallel H_{\mathrm{3}}\parallel {\text{SID}}_{T_{\mathrm{1}}}\parallel {\text{SID}}_{T_{\mathrm{2}}}\parallel t_{T_{\mathrm{1}}}\parallel t_{T_{\mathrm{2}}}\right).\end{array}$$ (36)

• (5)

  If all the hashing values are verified successfully, G computes the new shadow identities of $T_1$ and $T_2$ using $V_6$ , $V_7$ , $K_{{GT}_1}$ , and $K_{{GT}_2}$ . The new shadow identities ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1}^{\prime }$ and ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}^{\prime }$ are calculated from $$\begin{array}{cc}& {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1}^{\prime }=V_{\mathrm{6}}\oplus h\left(K_{{GT}_{\mathrm{1}}}\parallel t_{T_{\mathrm{1}}}\right),\\ {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}^{\prime }=V_{\mathrm{7}}\oplus h\left(K_{{GT}_{\mathrm{2}}}\parallel t_{T_{\mathrm{2}}}\right).\end{array}$$ (37)

•  

  And it replaces the existing shadow identities ${\text{SID}}_{T_1}$ and ${\text{SID}}_{T_2}$ with ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1}^{\prime }$ and ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}^{\prime }$ . It stores ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1}^{\prime }$ and ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}^{\prime }$ securely in its database. According to this step, the freshness of all shadow identities is guaranteed. As a result, it preserves unlinkability of the proposed scheme.

• (6)

  G generates a timestamp $t_{G_{12}}$ and computes the session key $\mathrm{S}\mathrm{K}$ and the parameters $K_1$ and $K_2$ using $K_{{GT}_1}$ and $K_{{GT}_2}$ as follows: $$\begin{array}{cc}& \mathrm{S}\mathrm{K}=h\left(K_{{GT}_{\mathrm{1}}}\parallel {K_{{GT}_{\mathrm{2}}}\parallel \text{SID}}_{T_{\mathrm{1}}}\parallel {\text{SID}}_{T_{\mathrm{2}}}\parallel t_{T_{\mathrm{1}}}\parallel t_{T_{\mathrm{2}}}\right),\\ K_{\mathrm{1}}=\mathrm{S}\mathrm{K}\oplus h\left(K_{{GT}_{\mathrm{1}}}\parallel {\text{SID}}_{T_{\mathrm{2}}}\parallel t_{T_{\mathrm{1}}}\right),\\ K_{\mathrm{2}}=\mathrm{S}\mathrm{K}\oplus h\left(K_{{GT}_{\mathrm{2}}}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_{\mathrm{1}}}\parallel t_{T_{\mathrm{2}}}\right).\end{array}$$ (38)

• (7)

  G computes the verification and the hashing values, such as $V_8$ , $V_9$ , $H_5$ , and $H_6$ as shown in $$\begin{array}{cc}& V_{\mathrm{8}}=h\left(\mathrm{S}\mathrm{K}\parallel {\mathrm{I}\mathrm{D}}_G\parallel t_{T_{\mathrm{1}}}\right),\\ V_{\mathrm{9}}=h\left(\mathrm{S}\mathrm{K}\parallel {\mathrm{I}\mathrm{D}}_G\parallel t_{T_{\mathrm{2}}}\right),\\ H_{\mathrm{5}}=h\left(K_{{GT}_{\mathrm{1}}}\parallel K_{\mathrm{1}}\parallel V_{\mathrm{8}}\parallel t_{G_{\mathrm{12}}}\right),\\ H_{\mathrm{6}}=h\left(K_{{GT}_{\mathrm{2}}}\parallel K_{\mathrm{2}}\parallel V_{\mathrm{9}}\parallel t_{G_{\mathrm{12}}}\right).\end{array}$$ (39)

•  

  And then it sends the messages $m_{\mathrm{7}}=\{{\mathrm{I}\mathrm{D}}_G,K_{\mathrm{2}},V_{\mathrm{9}},H_{\mathrm{6}},t_{G_{\mathrm{12}}}\}$ to $T_{\mathrm{2}}$ and $m_{\mathrm{8}}=\left\{{\mathrm{I}\mathrm{D}}_G,K_{\mathrm{1}},V_{\mathrm{8}},{H_{\mathrm{5}},t}_{G_{\mathrm{12}}}\right\}$ to $T_{\mathrm{1}}$ .

• (8)

  Upon receiving $m_7$ , $T_2$ checks $t_{G_{12}}$ and $H_6$ and computes the following session key ${\mathrm{S}\mathrm{K}}^{\ast }$ shared with $T_1$ using the common secret key $K_{{GT}_2}$ and the received $K_2$ : $$\begin{array}{cc}& {\mathrm{S}\mathrm{K}}^{\ast }=K_{\mathrm{2}}\oplus h\left(K_{{GT}_{\mathrm{2}}}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_{\mathrm{1}}}\parallel t_{T_{\mathrm{2}}}\right).\end{array}$$ (40)

•  

  After that, it checks the equivalence between the computed ${V_9}^{\ast }$ and the received $V_9$ , where ${V_9}^{\ast }$ is calculated by the following equation: $$\begin{array}{cc}& {V_9}^{\ast }=h\left({\mathrm{S}\mathrm{K}}^{\ast }\parallel {\mathrm{I}\mathrm{D}}_G\parallel t_{T_{\mathrm{2}}}\right).\end{array}$$ (41)

•  

  If the result is valid, $T_2$ recognizes the fact that G computed the session key $\mathrm{S}\mathrm{K}$ .

• (9)

  Meanwhile, after receiving $m_8$ , $T_1$ also checks the validities of $t_{G_{12}}$ and $H_5$ at first. Then it computes the session key ${\mathrm{S}\mathrm{K}}^{\ast }$ using $K_{{GT}_1}$ and $K_1$ and the verification value ${V_8}^{\ast }$ using ${\mathrm{S}\mathrm{K}}^{\ast }$ as follows: $$\begin{array}{cc}& {\mathrm{S}\mathrm{K}}^{\ast }=K_{\mathrm{1}}\oplus h\left({\mathrm{S}\mathrm{K}}_{{GT}_{\mathrm{1}}}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_{\mathrm{2}}}\parallel t_{T_{\mathrm{1}}}\right),\\ {V_8}^{\ast }=h\left({\mathrm{S}\mathrm{K}}^{\ast }\parallel {\mathrm{I}\mathrm{D}}_G\parallel t_{T_{\mathrm{1}}}\right).\end{array}$$ (42)

•  

  $T_1$ confirms the sameness of ${V_8}^{\ast }$ and $V_8$ to check the session key $\mathrm{S}\mathrm{K}$ computed by G. Finally, $T_1$ shares the session key $\mathrm{S}\mathrm{K}$ with $T_2$ successfully.

4. Security Analysis

In this section, we prove the proposed scheme is secure against particular attacks. The assumptions are as follows: an adversary can eavesdrop any messages transmitted between T, G, and R and he/she can obtain a legitimate thing normally registered for R.

4.1. Anonymity

Our scheme provides anonymity against an adversary who acquires a valid thing.

4.1.1. Anonymity in Join Phase

An adversary can eavesdrop T's shadow identity ${\mathrm{S}\mathrm{I}\mathrm{D}}_T$ and the timestamp $t_T$ from the message $m_1$ in the join phase. If the adversary obtains a valid thing $T^{\prime }$ registered for R, he/she can have a knowledge of the secret information $[{\mathrm{I}\mathrm{D}}_{T^{\prime }},{\text{VID}}_{T^{\prime }},x_{T^{\prime }},h\left(x_R\right),{\mathrm{I}\mathrm{D}}_R]$ stored in $T^{\prime }$ . Thus, the adversary can get T's virtual identity ${\text{VID}}_T$ by computing ${\text{VID}}_T={\mathrm{S}\mathrm{I}\mathrm{D}}_T\oplus h(h(x_R)\parallel t_T)$ using ${\mathrm{S}\mathrm{I}\mathrm{D}}_T$ and $t_T$ from $m_1$ and $h\left(x_R\right)$ from $T^{\prime }$ . To acquire T's real identity ${\mathrm{I}\mathrm{D}}_T$ from ${\text{VID}}_T(=h({\mathrm{I}\mathrm{D}}_T\parallel x_T\parallel t_I))$ , the adversary guesses a candidate identity ${\mathrm{I}\mathrm{D}}_T^{\prime }$ firstly, and then he/she tries to check the equivalence between ${\mathrm{I}\mathrm{D}}_T^{\prime }$ and ${\mathrm{I}\mathrm{D}}_T$ . Since an identity is short and has a certain format, it is guessable. However, the adversary cannot check whether ${\text{VID}}_T=h({\mathrm{I}\mathrm{D}}_T^{\prime }\parallel x_T\parallel t_I)$ is satisfied or not without knowing T's private key $x_T$ and the timestamp $t_I$ . Therefore, it is impossible for the adversary to check whether the real identity is equal to the candidate identity or not.

4.1.2. Anonymity in Communication Phase

In the communication phase, an adversary can get $T_1$ 's shadow identity ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1}$ and its timestamp $t_{T_1}$ from the message $m_5$ or $m_6$ and $h\left(x_R\right)$ from a legitimate thing $T^{\prime }$ . By using them, the adversary can gain $T_1$ 's virtual identity ${\text{VID}}_{T_1}(={\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1}\oplus h(h(x_R)\parallel t_{T_1}))$ as he/she does in the join phase. Then the adversary tries to confirm whether ${\text{VID}}_{T_1}=h({\mathrm{I}\mathrm{D}}_{T_1}^{\prime }\parallel x_{T_1}\parallel t_{I_1})$ is satisfied or not by guessing a candidate identity ${\mathrm{I}\mathrm{D}}_{T_1}^{\prime }$ . Unfortunately, the adversary cannot check the equivalence between the real identity and the candidate identity without knowing $x_{T_1}$ and $t_{I_1}$ . For that reason, the adversary gets no information related to $T_1$ 's identity.

4.2. Untraceability

The proposed scheme provides untraceability for a thing. Because all transmitting messages always include the unique shadow and virtual identities in the join and the communication phases, an adversary cannot know the fact that all messages are originated from the same thing.

4.2.1. Untraceability in Join Phase

If a common secret key shared between T and G is renewed periodically or T tries to join many different Gs, an adversary can collect all shadow identities from T's join request messages in every session by eavesdropping. Besides, the adversary who has a valid thing can obtain T's virtual identity ${\text{VID}}_T$ by computing ${\text{VID}}_T={\mathrm{S}\mathrm{I}\mathrm{D}}_T\oplus h(h(x_R)\parallel t_T)$ because he/she can know ${\mathrm{S}\mathrm{I}\mathrm{D}}_T$ , $h(x_R)$ , and $t_T$ . Meanwhile, if the shadow identity or the virtual identity always has a same value in every session, the adversary can recognize that one thing sends the join request message repeatedly while he/she cannot know that thing's real identity. In other words, the adversary can trace the fact that a certain thing requests to join continuously. However, the whole shadow identities are all different, since they include a unique timestamp. And the registration server always issues the new virtual identity to renew the old one in every session. Therefore, the join request message sent by the thing includes the different shadow identity all the time. It means the proposed scheme guarantees untraceability for the thing.

4.2.2. Untraceability in Communication Phase

The shadow identity in the communication phase also includes a unique timestamp. And everything always computes the new shadow identity and sends it to the gateway when they request to communicate. The gateway stores this new shadow identity to use it in the next session only if it checks that the old shadow identity is valid. Thus, shadow identities in every session have a uniqueness. Due to this, an adversary cannot trace the action of the thing in the communication phase.

4.3. Replay Attacks

Although an adversary resends past transmitting messages after collecting them in a certain session, participants involved in the join and the communication phases can detect a retransmission and stop to communicate with each other.

4.3.1. Replay Attacks in Join Phase

In the join phase, an adversary can gather the messages $m_1$ , $m_2$ , $m_3$ , and $m_4$ between T, G, and R. When the adversary resends the old message $m_1=\{\text{JoinReq}.,{\mathrm{S}\mathrm{I}\mathrm{D}}_T,{\mathrm{I}\mathrm{D}}_R,t_T\}$ to G, G checks a time interval between a current time and $t_T$ . And it rejects the join request if the time interval exceeds a predefined value. In addition, R can also recognize the old message $m_2=\{\text{AuthReq}.,{\mathrm{S}\mathrm{I}\mathrm{D}}_T,{\mathrm{I}\mathrm{D}}_G,H_1,t_T{,t}_G\}$ sent by the adversary by checking the time period between a current time and $t_G$ . In this case, R absolutely breaks a connection.

4.3.2. Replay Attacks in Communication Phase

An adversary who collects the messages $m_5$ , $m_6$ , $m_7$ , and $m_8$ in the communication phase sends $m_5$ to $T_2$ and $m_6$ to G. After receiving the message, $T_2$ and G can know whether the message is resent or not by checking a timestamp and a current time. As a result, resending old messages is always detectable.

4.4. Forgery Attacks

In our scheme, an adversary cannot forge messages to perform the valid join and communication phases.

4.4.1. Forgery Attacks in Join Phase

When the message $m_{\mathrm{1}}^{\prime }=\{\text{JoinReq}.,{\mathrm{S}\mathrm{I}\mathrm{D}}_T^{\prime },{\mathrm{I}\mathrm{D}}_R,t_T\}$ forged from $m_{\mathrm{1}}$ by an adversary is sent to G in the join phase, G makes $m_{\mathrm{2}}^{\prime }=\{\text{AuthReq}.,{\mathrm{S}\mathrm{I}\mathrm{D}}_T^{\prime },{\mathrm{I}\mathrm{D}}_G,H_{\mathrm{1}}^{\prime },t_T{,t}_G\}$ and sends it to R. Then R computes ${{\mathrm{V}\mathrm{I}\mathrm{D}}_T}^{\ast }={\mathrm{S}\mathrm{I}\mathrm{D}}_T^{\prime }\oplus h(h(x_R)\parallel t_T)$ using $h(x_R)$ that is the hashing value of its private key $x_R$ and tries to search T's secret information using ${{\mathrm{V}\mathrm{I}\mathrm{D}}_T}^{\ast }$ as a keyword. Since there is no matched virtual identity in R's database, R stops to communicate with G after recognizing that $m_{\mathrm{2}}^{\prime }$ is originated from the forged message.

4.4.2. Forgery Attacks in Communication Phase

An adversary sends the message $m_{\mathrm{5}}^{\prime }=\{\text{CommReq}.,{\mathrm{S}\mathrm{I}\mathrm{D}}_{T_{\mathrm{1}}}^{\prime },{\mathrm{I}\mathrm{D}}_G,V_{\mathrm{6}}^{\prime },H_{\mathrm{3}}^{\prime },t_{T_{\mathrm{1}}}\}$ to $T_{\mathrm{2}}$ after forging $T_{\mathrm{1}}$ 's message $m_{\mathrm{5}}$ in the communication phase. Upon receiving $m_{\mathrm{5}}^{\prime }$ , $T_{\mathrm{2}}$ sends $m_{\mathrm{6}}^{\prime }=\{\text{AuthReq}.,{\mathrm{S}\mathrm{I}\mathrm{D}}_{T_{\mathrm{1}}}^{\prime },{\mathrm{S}\mathrm{I}\mathrm{D}}_{T_{\mathrm{2}}},V_{\mathrm{6}}^{\prime },V_{\mathrm{7}},H_{\mathrm{3}}^{\prime },H_{\mathrm{4}},t_{T_{\mathrm{1}}},t_{T_{\mathrm{2}}}\}$ to G. Then G can easily know that no shadow identity equals to ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_{\mathrm{1}}}^{\prime }$ in its database. Finally, G rejects $T_{\mathrm{2}}$ 's request.

4.5. Impersonation Attacks

The proposed scheme is secure against attacks that an adversary who obtains a shadow identity of the thing impersonates that thing.

4.5.1. Impersonation Attacks in Join Phase

An adversary who tries to impersonate the valid thing T easily obtains T's shadow identity ${\mathrm{S}\mathrm{I}\mathrm{D}}_T$ from the message $m_1$ in the join phase. The adversary makes the message $m_1^{\prime }=\{\text{JoinReq}.,{\mathrm{S}\mathrm{I}\mathrm{D}}_T,{\mathrm{I}\mathrm{D}}_R,t_T^{\prime }\}$ using the obtained ${\mathrm{S}\mathrm{I}\mathrm{D}}_T$ and a timestamp $t_T^{\prime }$ generated by him/her in a new session. And he/she sends $m_1^{\prime }$ to G. After receiving $m_1^{\prime }$ , G decides $m_1^{\prime }$ is a valid request message because $t_T^{\prime }$ and $H_1^{\prime }$ are verified successfully. And then G sends the message $m_2^{\prime }=\{\text{AuthReq}.,{\mathrm{S}\mathrm{I}\mathrm{D}}_T,{\mathrm{I}\mathrm{D}}_G,H_1^{\prime },t_T^{\prime },t_G^{\prime }\}$ to R. Checking $t_G^{\prime }$ , ${\mathrm{I}\mathrm{D}}_G$ , and $H_1^{\prime }$ by R is also successful. R computes ${{\text{VID}}_T}^{\ast }$ from the received ${\mathrm{S}\mathrm{I}\mathrm{D}}_T$ by computing the equation ${{\text{VID}}_T}^{\ast }={\mathrm{S}\mathrm{I}\mathrm{D}}_T\oplus h(h(x_R)\parallel t_T^{\prime })={\text{VID}}_T\oplus h(h(x_R)\parallel t_T)\oplus h(h(x_R)\parallel t_T^{\prime })$ . There is no equivalent virtual identity to ${{\text{VID}}_T}^{\ast }$ in its database. Surely, R recognizes it is an abnormal case and rejects G's request.

4.5.2. Impersonation Attacks in Communication Phase

An adversary gets ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1}$ from $m_5$ in the communication phase. To impersonate $T_1$ , the adversary generates a new timestamp $t_{t_1}^{\prime }$ , makes the message $m_5^{\prime }=\{\text{CommReq}.,{\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1},{\mathrm{I}\mathrm{D}}_G,V_6^{\prime },H_3^{\prime },t_{T_1}^{\prime }\}$ , and sends $m_5^{\prime }$ to $T_2$ in a new session. Here, the adversary cannot compute the valid $V_6^{\prime }$ and $H_3^{\prime }$ because he/she does not know $T_1$ 's common secret key $K_{{GT}_1}$ . After receiving $m_5^{\prime }$ , $T_2$ makes the message $m_6^{\prime }=\{\text{AuthReq}.,{\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1},{\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2},V_6^{\prime },V_7^{\prime },H_3^{\prime },H_4^{\prime },t_{T_1}^{\prime },t_{T_2}^{\prime }\}$ and sends it to G. G verifies that all $t_{t_2}^{\prime }$ , ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1}$ , ${\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}$ , and $H_4^{\prime }$ are valid but it detects that ${H_3^{\prime }}^{\ast }(=h(K_{{GT}_1}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_1}\parallel V_6^{\prime }\parallel t_{T_1}^{\prime }))$ and the received $H_3^{\prime }$ are not equal. As a result, G recognizes $T_1$ is an invalid thing and refuses $T_2$ 's request.

4.6. Known Session Key Attacks

Disclosure of a common secret key in the join phase or a session key in the communication phase does not affect revelations about the thing's identity, other common secret keys, and other session keys.

4.6.1. Known Session Key Attacks in Join Phase

A common secret key shared between T and G is computed using a timestamp in the join phase. Because a timestamp always has a different value, every common secret key is unique. Although an adversary knows $K_{GT}(=h\left(h\left(x_T\right)\parallel {\mathrm{I}\mathrm{D}}_T\parallel {\mathrm{I}\mathrm{D}}_G\parallel t_T\parallel t_G\right))$ , he/she cannot obtain the thing's identity and the common secret key in other sessions. The reasons are as follows. Firstly, the adversary still cannot get thing's identity ${\mathrm{I}\mathrm{D}}_T$ from $K_{GT}$ without knowing T's secret information $h\left(x_T\right)$ . Moreover, let us suppose the adversary tries to get other common secret keys $K_{GT}^{\prime }$ in the next session after computing $h(K_{RG}\parallel t_G)=V_4\oplus K_{GT}$ using $V_4$ and $K_{GT}$ . In that next session, the adversary eavesdrops $V_4^{\prime }(=K_{GT}^{\prime }\oplus h(K_{RG}\parallel t_G^{\prime }))$   and computes $K_{GT}^{\prime }\oplus h(K_{RG}\parallel t_G^{\prime })\oplus h(K_{RG}\parallel t_G)=V_4^{\prime }\oplus h(K_{RG}\parallel t_G)$ using $V_4^{\prime }$ and $h(K_{RG}\parallel t_G)$ . Due to the difference of $t_G$ and $t_G^{\prime }$ , $h(K_{RG}\parallel t_G^{\prime })\oplus h(K_{RG}\parallel t_G)$ is not eliminated in the above equation and the adversary cannot get $K_{GT}^{\prime }$ . As a result, it is impossible to calculate the new session key even though the former is revealed.

4.6.2. Known Session Key Attacks in Communication Phase

All session keys in the communication phase are independent since all of them include their own unique timestamps. If the session key $\mathrm{S}\mathrm{K}$ shared between $T_1$ and $T_2$ is revealed to an adversary in a certain session, he/she can compute $h(K_{{GT}_1}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}\parallel t_{T_1})=K_1\oplus \mathrm{S}\mathrm{K}$ using $K_1$ and the revealed $\mathrm{S}\mathrm{K}$ . In the next session, the adversary eavesdrops $K_1^{\prime }(={\mathrm{S}\mathrm{K}}^{\prime }\oplus h(K_{{GT}_1}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}\parallel t_{T_1}^{\prime }))$ and tries to compute ${\mathrm{S}\mathrm{K}}^{\prime }\oplus h(K_{{GT}_1}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}\parallel t_{T_1}^{\prime })\oplus h(K_{{GT}_1}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}\parallel t_{T_1})=K_1^{\prime }\oplus h(K_{{GT}_1}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}\parallel t_{T_1})$ using $K_1^{\prime }$ and $(K_{{GT}_1}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}\parallel t_{T_1})$ . Since $t_{T_1}$ is not equal to $t_{T_1}^{\prime }$ , $h(K_{{GT}_1}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}\parallel t_{T_1}^{\prime })$ and $h(K_{{GT}_1}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_{T_2}\parallel t_{T_1})$ are not erased. Therefore, there is no way to obtain the new session key ${\mathrm{S}\mathrm{K}}^{\prime }$ from the old session key $\mathrm{S}\mathrm{K}$ .

5. Performance Analysis

This section partially compares the performance of our scheme with those of Chang et al.'s and Lee's [22] schemes. Since the environment, the component, and the composition of ours and others' are all different, we firstly select similar factors in all schemes and evaluate them. Table 3 shows the performance comparison results. In Table 3, Hash denotes a hash operation, XOR denotes an exclusive-OR operation, and rounds denote communication rounds. We evaluate the number of hash and exclusive-OR operations. We compare the join phase of our scheme and the authentication and session key establishment phases of other schemes, because each phase has similar purpose and procedure. In addition, we only focus on the operations on the part of the limited computing power devices, such as a thing and a mobile user. Since the performance of the whole scheme depends on the capability of those devices, we do not compare the whole operations.

Table 3

Performance comparisons.

Scheme	Ours	Chang et al.'s	Lee's
Join phase
Hash	7	7	7
XOR	2	5	2
Rounds	4	8	7
Communication phase
Hash	5	N/A	N/A
XOR	3	N/A	N/A
Rounds	3	N/A	N/A

As Table 3 shows, our scheme requires less or the same exclusive-OR operations in the join phase. Namely, the computation complexity of ours is a little better than others'. Our communication rounds in the join phase are reduced by half in comparison with Chang et al.'s and less than that in Lee's. Considering the wireless environments, reducing the communication cost is meaningful. Meanwhile, there is no corresponding phases of Chang et al.'s and Lee's schemes to the communication phase of our scheme. So we only show the number of operations and communication rounds of our scheme in Table 3. Definitely, hash operations and communication rounds in the communication phase are less than those in the join phase. The thing accomplishes the communication phase more often than the join phase, so the less number of operations and communication rounds in the communication phase is remarkable. As a result, our scheme provides advantages of the communication complexity as well as the computation complexity.

6. Conclusions

In this paper, we propose a novel anonymous authentication scheme that ensures the things in IoT environments can communicate with one another safely. The proposed scheme uses the virtual identity of the thing to make it be anonymized and authenticated at the same time. To provide untraceability, we keep the uniqueness of all shadow and virtual identities. Namely, duplicated shadow and virtual identities are never used in every session through the renewal process. Even if the valid virtual identity issued by the registration server is revealed, an adversary cannot obtain the real identity from that virtual identity. It is impossible for an adversary to perform replay, forgery, and impersonation attacks. Moreover, he/she cannot know the valid common secret key shared between the registration server, the gateway, and the thing, even though a specific common secret key is exposed. The valid session key shared between two things is also safe when a particular session key is disclosed to an adversary. We only use low cost functions, such as hash functions and exclusive-OR operations in consideration of fast computation and low energy consumption of the thing. In conclusion, our scheme is suitable for IoT environments as a secure and efficient authentication mechanism.