An Advanced Temporal Credential-Based Security Scheme with Mutual Authentication and Key Agreement for Wireless Sensor Networks

Abstract

Wireless sensor networks (WSNs) can be quickly and randomly deployed in any harsh and unattended environment and only authorized users are allowed to access reliable sensor nodes in WSNs with the aid of gateways (GWNs). Secure authentication models among the users, the sensor nodes and GWN are important research issues for ensuring communication security and data privacy in WSNs. In 2013, Xue et al. proposed a temporal-credential-based mutual authentication and key agreement scheme for WSNs. However, in this paper, we point out that Xue et al.'s scheme cannot resist stolen-verifier, insider, off-line password guessing, smart card lost problem and many logged-in users' attacks and these security weaknesses make the scheme inapplicable to practical WSN applications. To tackle these problems, we suggest a simple countermeasure to prevent proposed attacks while the other merits of Xue et al.'s authentication scheme are left unchanged.

1. Introduction

Wireless sensor networks are innovative ad hoc networks that include a large number of sensor nodes with resource-constrained characteristics such as limited power, communication and computational capabilities [1–4]. As soon as sensor nodes are massively and randomly deployed in a target field, the basic functions of the gateway node are to collect sensitive data for authorized users [5,6]. In many cases, a WSN may be deployed in hostile environments and malicious intruders may launch possible attacks for disrupting the normal operations (such as impersonating a legal user to abuse the network resources, inject false messages or invalid sensors into the WSN, launch security attacks and so on) of a WSN. Therefore, entity authentication [7–16] plays an important role in WSNs and logging-in users and deployed sensors should be authenticated to be the admissible participants by the GWN.

In the recent literature, there are a few works that detail a complete secure user authentication schemes for wireless sensor networks with all their different features. In [17] Das proposed an efficient two-factor scheme of user authentication, which is based on easy-to-remember passwords and smart cards. In Das' scheme, it only needs XOR and hashing computations and this reduces the computational complexity, which is suitable for resource-constrained WSNs. Although Das' scheme enhances system performance, it did not make up for the security weaknesses [18–20]. Das' scheme has later attracted a lot of attention and several two-factor user authentication schemes with mutual authentication and key agreement have been proposed in Li et al. [20], Yeh et al. [21], Das et al. [22], Li et al. [23], and Xue et al. [24]. In [20], Li et al. proposed a secure billing service based on the framework of Das' scheme. In [21], Yeh et al. introduced an ECC-based user authentication scheme for preventing all the security flaws of the previous scheme [25]. However, in [23], Li et al. showed that Yeh et al.'s scheme is insecure against several security attacks and further proposed an improved version of Yeh et al.'s scheme, which covers all the identified weaknesses and is more efficient for practical WSN environments. In [24], Xue et al. suggest a lightweight temporal-credential-based mutual authentication and key agreement scheme that not only provides more functionality features with higher security, but also ensures low costs of computation, communication and storage.

1.1. Our Contributions

Contributions made in this work can be summarized as follows

1. We analyze the security weaknesses of one of the most recent temporal-credential-based authentication schemes for WSNs proposed by Xue et al. [24]. Xue et al. claimed that their authentication scheme is secure against various known attacks with mutual authentication and key agreement and is suitable for resource-constrained WSNs. However, we find that Xue et al.'s authentication scheme still has other security weaknesses such as disclosure of the password and failing to prevent the lost smart card problem and many logged-in users' attacks.

2. We propose an advanced scheme to prevent the security threats of Xue et al.'s authentication scheme and the phases in our scheme are shown to be efficient in terms of computational complexity and communication overhead.

3. Our advanced scheme provides both mutual authentication and key agreement among the user, GWN and the sensor node in wireless sensor networks.

4. Our three-party authentication scheme can be used to verify users and sensor nodes without revealing their passwords whenever it is deemed to be necessary.

5. A service period feature can be used to revoke users or sensor nodes in a controlled manner and prevent abuse by an authority node GWN.

6. Status-bit and login recording features are efficiently implemented and assist in catching misbehaving attackers trying to abuse network resources. The above-mentioned features are especially useful when non-registered attackers attempt illegal activities such as many logged-in user attacks.

1.2. Organization of the Paper

The remainder of the paper is organized as follows: Section 2 reviews Xue et al.'s authentication scheme [24], whose security weaknesses are shown in Section 3. We propose an advanced authentication scheme with higher security in Section 4, whose security and comparisons of related schemes are analyzed in Section 5 and Section 6, respectively. Section 7 concludes the paper.

2. A Review of Xue et al.'s Temporal-Credential-Based Authentication Scheme

In this section, we review Xue et al.'s temporal-credential-based mutual authentication scheme [24]. This scheme is mainly composed of three phases: registration, login, authentication and key agreement. Moreover, their scheme is composed of three roles: gateway node (GWN), sensor node (S_j) and user (U_i). For convenience of description, we summarize the notations used throughout this paper in Table 1.

Table 1.

Notations used throughout this paper.

Symbol	Description
Ui	User
Sj	Sensor node
GWN	Gateway node
IDi/PWi	Identity/Password of the user Ui
SIDj/PWj	Pre-configured identity/password of the sensor node Sj
KGWN_U/KGWN_S	Two private system parameters only know to GWN
TCi/TCj	A temporal credential issued by GWN to Ui/Sj
TS	The timestamp value
KEYij	The shared session key between Ui and Sj
TEi	The expiration time of Ui's temporal credential
⊕	The bitwise exclusive-OR operation
H(•)	The one-way hashing function
‖	The bitwise concatenation operation

2.1. Registration Phase

Before registration of the user U_i and the sensor node S_j, each U_i has a secure password pre-shared with GWN and U_i's identity ID_i and hash value of U_i's password H(PW_i) are stored in GWN's side. Moreover, each S_j has a pre-configured password PW_i and hash value of S_j's password H(PW_i) is stored in GWN's side. This phase has two parts for U_i and S_j and we review them as follows:

• (U-1) U_i selects ID_i and computes VI_i = H(TS₁‖ H(PW_i)) and sends {ID_i, TS₁, VI_i} to GWN via an open and public channel, where TS₁ is current timestamp value of U_i.

• (U-2) After receiving the registration request from U_i, GWN checks if |TS₁–T*_GWN| < ΔT, where T*_GWN is the current system timestamp of GWN and ΔT is the expected time interval for the transmission delay. If it does not hold, GWN sends REJ message back to U_i. Otherwise, GWN retrieves its own copy of H(PW_i) by using the key “ID_i”, computes VI_i* = H(TS₁‖ H(PW_i)) and checks if VI_i* = VI_i. If not, GWN terminates it; otherwise, GWN computes P_i = H(ID_i‖TE_i), TC_i = H(K_{GWN_U}‖P_i‖TE_i) and PTC_i = TC_i⊕H(PW_i) and personalizes the smart card for U_i with the parameters:{H(•), ID_i, H(H(PW_i)), TE_i, PTC_i}.

Before deployment of sensor nodes in a target field, each S_j performs the following steps for registration:

• (S-1) S_j computes VI_j = H(TS₂‖H(PW_j)) and sends {SID_j, TS₂} to GWN via an open and public channel, where TS₂ is current timestamp value of S_j.

• (S-2) After receiving the message from S_j, GWN checks if |TS₂–T*_GWN | < ΔT, where T*_GWN is the current system timestamp of GWN and ΔT is the expected time interval for the transmission delay. If it does not hold, GWN sends REJ message back to S_j. Otherwise, GWN retrieves its own copy of H(PW_j) by using the key “SID_j”, computes VI_j* = H(TS₂‖H(PW_j)) and check if VI_j* = VI_j. If not, GWN terminates it; otherwise, GWN computes TC_j = H(K_{GWN_S}‖ SID_j) and REG_j = H(H(PW_j)‖TS₃)⊕TC_j and sends {TS₃, REG_j} to S_j.

• (S-3) After receiving the message from GWN, S_j checks if |TS₃ – T_j*| < ΔT, where T_j* is the current timestamp value of S_j. If not, S_j terminates it; otherwise, S_j computes its temporal credential TC_j = REG_j⊕H(H(PW_j)‖TS₃) and stores it.

2.2. Login Phase

If the user U_i wants to access sensor data from the wireless sensor network, U_i inserts a smart card into a terminal and enters ID_i and PW_i. The terminal computes H(H(PW_i)) and checks the validity of ID_i and PW_i with the stored ID_i and H(H(PW_i)). If not, the smart card terminates this login request. Otherwise, U_i passes the verification and he/she can read the information stored in the smart card. U_i computes TC_i = PTC_i⊕H(PW_i).

2.3. Authentication and Key Agreement Phase

• (A-1) U_i computes DID_i = ID_i⊕H(TC_i‖TS₄), C_i = H(H(ID_i‖TS₄)⊕TC_i) and PKS_i = K_i⊕H(TC_i‖TS₄‖“000”) and sends the mutual authentication message {DID_i, C_i, PKS_i, TS₄, TE_i, P_i} to GWN, where TS₄ is current timestamp value of U_i, K_i is a random key only known to U_i and the binary number “000” is used for distinguishing H(TC_i‖TS₄‖“000”) and H(TC_i‖TS₄).

• (A-2) After receiving the message from U_i, GWN checks the validity of TS₄. If TS₄ is valid for the transmission delay, GWN computes ID_i = DID_i⊕H(H(K_{GWN_U}‖P_i‖TE_i)‖TS₄), P_i* = H(ID_i‖TE_i), TC_i = H(K_{GWN_U}‖P_i‖TE_i) and C_i* = H(H(ID_i*‖TS₄)⊕TC_i) and verifies whether C_i* ≠ C_i or P_i* ≠ P_i. If it holds, GWN rejects U_i's login request; otherwise, GWN computes K_i = PKS_i⊕H(TC_i‖TS₄‖“000”) and chooses a nearby suitable sensor node S_j as the accessed sensor node. GWN further computes S_j's temporal credential TC_j = H(K_{GWN_S}‖SID_j), DID_GWN = ID_i⊕H(DID_i‖TC_j‖TS₅), C_GWN = H(ID_i‖TC_j‖TS₅) and PKS_GWN = K_i⊕H(TC_j‖TS₅) and sends {TS₅, DID_i, DID_GWN, C_GWN, PKS_GWN} to S_j, where TS₅ is current timestamp value of GWN.

• (A-3) After receiving the message from GWN, S_j checks the validity of TS₅. If TS₅ is valid for the transmission delay, S_j computes ID_i = DID_GWN⊕H(DID_i‖TC_j‖TS₅) and $C_{\mathit{\text{GWN}}}^{*}=H(I{D}_i\Vert T{C}_j\Vert T{S}_5)$ and checks if $C_{\mathit{\text{GWN}}}^{*}=C_{\mathit{\text{GWN}}}$. If not, S_j terminates this session. Else, S_j convinces that the received message is from a legitimate GWN. Moreover, S_j computes K_i = PKS_GWN⊕H(TC_j‖TS₅), C_j = H(K_j‖ID_j‖SID_j‖TS₆) and PKS_j = K_j⊕H(K_i‖TS₆) and sends {SID_j, TS₆, C_j, PKS_j} to U_i and GWN, where K_j is a random key chosen by S_j.

• (A-4) After receiving the message from S_j, U_i and GWN separately computes K_j=PKS_j⊕H(K_i‖TS₆) and C_j* = H(K_j‖ID_i‖SID_j‖TS₆). For GWN, if C_j* = C_j, S_j is authenticated by GWN. For the user U_i, if C_j* = C_j, S_j and GWN are authenticated by U_i. Finally, U_i and S_j can separately compute a common session key KEY_ij = H(K_i⊕K_j) and U_i and S_j will use KEY_ij for securing communications in future.

3. Security Analysis on Xue et al.'s Scheme

Xue et al. claimed that their authentication scheme is robust and secure against insider, password guessing and stolen smart card attacks. In fact, based on our security analysis, we observe that Xue et al.'s temporal-credential based scheme is insecure against these security requirements. The details of our attacks are as follows.

3.1. Stolen Verifier and Insider Attack

In Xue et al.'s scheme, GWN needs to maintain the verifier table and it stores each U_i's identity ID_i and hash value to U_i's password H(PW_i) in GWN's side. In a practical environment, the PW_i chosen by U_i could be short and easily human memorizable, which might be convenient for U_i to remember easily and in practice many users use same identities and passwords to access various online applications or remote servers for their convenience. Thus, we assume that an attacker U_A may steal the password-verifier from GWN's database and launches off-line guessing attacks on it to obtain U_i's real password PW_i. The details of stolen verifier attack are as follows.

• Step 1:

  U_A steals verifier table from GWN's database and retrieves the hash value of U_i's password H(PW_i).

• Step 2:

  U_A guesses a password PW_i* and computes H(PW_i*).

• Step 3:

  U_A compares the result of H(PW_i*) with stolen H(PW_i).

A match in Step 3 above indicates the correct guessing of U_i's easy-to-remember password and Xue et al.'s authentication scheme then cannot resist the stolen verifier attack. Moreover, if a privileged insider of GWN knows U_i's password PW_i, he/she may try to use the knowledge of U_i's PW_i and ID_i to access other applications or servers.

3.2. Off-Line Password Guessing Attack

In step (U-1) of registration phase of Xue et al.'s scheme, U_i sends{ID_i, TS₁, VI_i} to GWN via an open and public environment, where TS₁ is current timestamp value of U_i and VI_i = H(TS₁‖H(PW_i)). If an attacker U_A eavesdrops U_i's registration message {ID_i, TS₁, VI_i}, U_A can launch the off-line password guessing attack by performing the following step:

• Step 1:

  U_A guesses a password PW_i* and computes VI_i* = H(TS₁‖H(PW_i*)).

• Step 2:

  U_A compares the result of VI_i* with eavesdropped VI_i.

A match in Step 2 above indicates the correct guessing of U_i's easy-to-remember password and Xue et al.'s authentication scheme suffers from off-line password guessing attack in user side. On the other hand, in step (S-1) of registration phase, S_j sends {SID_j, TS₂, VI_i} to GWN via an open and public environment, where TS₂ is the current timestamp value of S_j and VI_j = H(TS₂‖H(PW_j)). If an attacker U_A eavesdrops S_j's registration message {SID_j, TS₂, VI_j}, U_A can launch an off-line password guessing attack by performing the following steps:

• Step 1:

  U_A guesses a password PW_j* and computes VI_j* = H(TS₂‖H(PW_j*)).

• Step2:U_A compares the result of VI_j* with eavesdropped VI_j.

A match in Step 2 above indicates the correct guessing of S_j's password and Xue et al.'s authentication scheme is then open to an off-line password guessing attack on the sensor side. Moreover, once U_A has successfully guessed S_j's random password, U_A can use PW_j* and the eavesdropped message in step (S-2) of the registration phase to derive S_j's temporal credential TC_j by computing TC_j=REG_j⊕H(H(PW_j*)‖TS₃) = H(K_{GWN_S}‖SID_j). Finally, Xue et al.'s scheme may suffer from masquerading attacks and an attacker U_A who knows TC_j can easily impersonate the sensor node S_j.

3.3. Lost Smart Card Problem

Let us consider the scenario of a lost smart card problem. In the case where U_i's smart card is lost and it is picked up by an attacker U_A, the stored parameters can be extracted by launching a power analysis attack [22]. As we know, the content of U_i's smart card is {H(•), ID_i, H(H(PW_i)), TE_i, PTC_i}. With this information, U_A can launch another off-line password guessing attack by performing the following steps:

• Step 1:

  U_A guesses a password PW_i* and computes H(H(PW_i*)).

• Step 2:

  U_A compares the result of H(H(PW_i*)) with extracted H(H(PW_i*)).

If Step 2 holds, the guessed password PW_i* is the same as U_i's real password PW_i. Otherwise, U_A tries another password. Once U_A successfully guesses U_i's real password, U_A can use PW_i* and the content of U_i's smart card to derive U_i's temporal credential TC_i by computing TC_i = PTC_i⊕H(PW_i*) = H(K_{GWN_U}‖P_i‖TE_i). Thus, Xue et al.'s scheme may suffer from masquerading attacks and an attacker U_A who knows TC_i can easily impersonate a legal user U_i to log in to the gateway node and GWN is not aware of having caused any problem.

3.4. Many Logged-in Users' Problem

The many logged-in users attack [26,27] means that if a registered user U_i's smart card is massively duplicated and his/her identity ID_i and password PW_i are exposed to m non-registered users U_a, where a = 1, 2, …, m. Each one who has a smart card and knows ID_i and PW_i can log in to GWN at the same time and GWN is not aware of having caused any problem. In Xue et al.'s scheme, each non-registered user U_a generates his/her timestamp TS_a and random key K_a and sends a legal login message {DID_a, C_a, PKS_a, TS_a, TE_i, P_i} to GWN, where DID_a = ID_i⊕H(TC_i‖TS_a), C_a = H(H(ID_i‖TS_a)⊕TC_i) and PKS_a = K_a⊕H(TC_i‖TS_a‖“000”). After receiving all the login requests from U_a, GWN gets the same identity ID_i with different timestamps TS_a and random keys K_a and GWN allows them to log in and access U_i's account simultaneously.

4. Advanced Authentication Scheme

In this section, we propose an advanced scheme with strong security. Our advanced scheme consists of four phases, namely pre-registration phase, registration phase, login phase, authentication and key agreement phase. The details of each of these phases are as follows.

4.1. Pre-Registration Phase

Before registration of the user U_i and the sensor node S_j, each U_i has a pre-configured pair of identity $I{D}_i^{\mathit{\text{pre}}}$ and password $P{W}_i^{\mathit{\text{pre}}}$ with GWN and the unique parameter $H(I{D}_i^{\mathit{\text{pre}}}\Vert P{W}_i^{\mathit{\text{pre}}})$ and $I{D}_i^{\mathit{\text{pre}}}$ are kept by GWN to check the validity of registration user. Moreover, each S_j has a pre-configured identity SID_j and a 160-bits random number r_j and the hash value of S_j's pre-configured identity and random number H(SID_j‖r_j) and SID_j are stored on the GWN's side.

4.2. Registration Phase

This phase has two parts for U_i and S_j and the details will be described as follows:

• (U-1) U_i selects his/her own ID_i and password PW_i. Then U_i computes $V{I}_i=H(T{S}_{\mathit{1}}\Vert H(I{D}_i^{\mathit{\text{pre}}}\Vert P{W}_i^{\mathit{\text{pre}}}))$, $C{I}_i=H(I{D}_i^{\mathit{\text{pre}}}\Vert P{W}_i^{\mathit{\text{pre}}})\oplus H(I{D}_i\Vert P{W}_i\Vert r_i)$, $D{I}_i=I{D}_i\oplus H(I{D}_i^{\mathit{\text{pre}}}\Vert P{W}_i^{\mathit{\text{pre}}})$ and sends { $I{D}_i^{\mathit{\text{pre}}}$, TS₁, VI_i, CI_i, DI_i} to GWN via an open and public channel, where TS₁ is current timestamp value of U_i and r_i is a random number generated by U_i.

• (U-2) After receiving the registration request from U_i, GWN checks if |TS₁–T*_GWN | < ΔT, where T*_GWN is the current system timestamp of GWN and ΔT is the expected time interval for the transmission delay. If it does not hold, GWN sends REJ message back to U_i. Otherwise, GWN retrieves its own copy of $H(I{D}_i^{\mathit{\text{pre}}}\Vert P{W}_i^{\mathit{\text{pre}}})$ by using the parameter “ $I{D}_i^{\mathit{\text{pre}}}$”, computes $V{I}_i^{\ast }=H(T{S}_1\Vert H(I{D}_i^{\mathit{\text{pre}}}\Vert P{W}_i^{\mathit{\text{pre}}}))$ and checks if VI_i* = VI_i. If not, GWN terminates it; otherwise, GWN computes Q_i=CI_i⊕H(ID_i^pre‖PW_i^pre) = H(ID_i‖PW_i‖r_i), ID_i = DI_i⊕H(ID_i^pre‖PW_i^pre), P_i = H(ID_i‖TE_i), TC_i = H(K_{GWN_U}‖P_i‖TE_i) and PTC_i = TC_i⊕Q_i and personalizes the smart card for U_i with the parameters:{H(•), H(Q_i), TE_i, PTC_i}. Note that GWN maintains a write protected file as depicted in Table 2, where the Status-bit indicates the status of the user, i.e., when U_i is logged-in to GWN, the status-bit is set to one, otherwise it is set to zero. Finally, GWN sends H(Q_i) and smart card to U_i via an public and open environment.

• (U-3) After receiving H(Q_i) and smart card from GWN, U_i checks whether the computed H(H(ID_i‖PW_i‖r_i)) is equal to H(Q_i). If they are not equal, U_i aborts this session and the smart card. Otherwise, GWN is authenticated by U_i. U_i enters r_i into his/her smart card and U_i's smart card contains {H(•), H(Q_i), TE_i, PTC_i, r_i}. Note that U_i does not need to remember r_i after finishing this phase. The communication handshakes of the registration phase of the user U_i are depicted in Figure 1.

Table 2.

The identity table of GWN after finishing the registration phase.

User Identity	Password-Verifier	Status-Bit	Last Login	Service Period
…	…	…	…	…
IDi	Qi	0/1	N/A	TEi
…	…	…	…	…

Figure 1.

Communication handshakes of the registration phase of the user U_i.

Before deployment of sensor nodes in a target field, each S_j performs the following steps for registration.

• (S-1) S_j computes VI_j = H(TS₂‖H(SID_j‖r_j)) and sends {SID_j, TS₂, VI_j} to GWN via an open and public channel, where TS₂ is current timestamp value of S_j.

• (S-2) After receiving the message from S_j, GWN checks if |TS₂–T*_GWN | < ΔT, where T*_GWN is the current system timestamp of GWN and ΔT is the expected time interval for the transmission delay. If it does not hold, GWN sends REJ message back to S_j. Otherwise, GWN retrieves its own copy of H(SID_j‖r_j) by using the key “SID_j”, computes VI_j* = H(TS₂‖H(SID_j‖r_j)) and checks if VI_j* = VI_j. If not, GWN terminates it; otherwise, GWN computes TC_j = H(K_{GWN_S}‖SID_j), Q_j = H(TS₃‖H(SID_j‖r_j)) and REG_j = H(H(SID_j ‖r_j) ‖TS₃)⊕TC_j and sends {TS₃, Q_j, REG_j} to S_j.

• (S-3) After receiving the message from GWN, S_j checks if |TS₃–T_j*| < ΔT, where T_j* is the current timestamp value of S_j. If not, S_j terminates it. Otherwise, S_j checks whether the computed H(TS₃‖H(SID_j‖r_j) is equal to Q_j. If they are equal, S_j computes its temporal credential TC_j = REG_j⊕H(H(SID_j)‖r_j‖TS₃) and stores it. Note that S_j does not need to store r_j after finishing the phase. The communication handshakes of the registration phase of sensor node S_j are depicted in Figure 2.

Figure 2.

Communication handshakes of the registration phase of sensor node S_j.

4.3. Login Phase

If the user U_i wants to access sensor data from the wireless sensor network, U_i inserts a smart card into a card reader and enters ID_i and PW_i. The smart card retrieves r_i, computes H(H(ID_i‖PW_i‖r_i)) ≠ H(Q_i), and the smart card terminates this login request. Otherwise, U_i passes the verification and he/she can read the information stored in the smart card. U_i computes TC_i = PTC_i⊕H(ID_i‖PW_i‖r_i). The details of the login phase are shown in Figure 3.

Figure 3.

Illustration of the login phase of our advanced scheme.

4.4. Authentication and Key Agreement Phase

• (A-1) U_i computes DID_i = ID_i⊕H(TC_i‖TS₄), C_i = H(H(ID_i‖PW_i‖r_i)‖TS₄)⊕TC_i) and PKS_i = K_i⊕H(TC_i‖TS₄‖“000”) and H(TC_i‖TS₄).

• (A-2) After receiving the message from U_i, GWN checks the validity of TS₄. If TS₄ is valid for the transmission delay, GWN computes TC_i* = H(K_{GWN_U}‖P_i‖TE_i) and ID_i = DID_i⊕H(TC_i*‖TS₄) and retrieves U_i's password-verifier of Q_i = H(ID_i‖PW_i‖r_i) by using the parameter “ID_i”. Then, GWN further computes C_i* = H(H(Q_i‖TS₄)⊕TC_i) and verifies whether C_i* = C_i. If it does not hold, GWN rejects U_i's login request; otherwise, the status-bit is set to one and TS₄ is recorded in the 4th field of the identity table to demonstrate U_i's last login. GWN computes K_i = PKS_i⊕H(TC_i‖TS₄‖“000”) and chooses a nearby suitable sensor node S_j as the accessed sensor node. GWN further computes S_j's temporal credential TC_j = H(K_{GWN_S}‖SID_j), DID_GWN = ID_i⊕H(DID_i‖TC_j‖TS₅), C_GWN = H(ID_i‖TC_i‖TS₅) and PKS_GWN = K_i⊕H(TC_j‖TS₅) and sends {TS₅, DID_i, DID_GWN, C_GWN, PKS_GWN} to S_j, where TS₅ is current timestamp value of GWN.

• (A-3) After receiving the message from GWN, S_j checks the validity of TS₅. If TS₅ is valid for the transmission delay, S_j computes ID_i = DID_GWN⊕H(DID_i‖TC_j‖TS₅) and C*_GWN = H(ID_i‖TC_j‖TS₅) and check if C*_GWN = C_GWN. If not, S_j terminates this session. Else, S_j convinces that the received message is from a legitimate GWN. Moreover, S_j computes K_i = PKS_GWN⊕H(TC_j‖TS₅), C_j = H(K_j‖ID_i‖SID_i‖TS₆) and PKS_j = K_j⊕H(K_i‖TS₆) and sends{SID_j, TS₆, C_j, PKS_j} to U_i and GWN.

• (A-4) After receiving the message from S_j, U_i and GWN separately computes K_j = PKS_j⊕H(K_i‖TS₆) and C_j* = H(K_j‖ID_i‖SID_j‖TS₆). For GWN, if C_j* = C_j, S_j is authenticated by GWN. For the user U_i, if C_j* = C_j, S_j and GWN are authenticated by U_i. Finally, U_i and S_j can separately compute a common session key KEY_ij = H(K_i⊕K_j) and U_i and S_j will use KEY_ij for securing communications in future.

After finishing the authentication and key agreement phase, the identity table is updated and the content of the identity table is shown in Table 3. The detailed steps of the authentication and key agreement phase are shown in Figure 4.

Table 3.

The identity table of GWN after finishing the authentication and key agreement phase.

User Identity	Password-Verifier	Status-Bit	Last Login	Service Period
…	…	…	…	…
IDi	Qi	0/1	TS4	TEi
…	…	…	…	…

Figure 4.

Illustration of the authentication and key agreement phase of our advanced scheme.

5. Security Analysis on Our Advanced Authentication Scheme

In this section, for security analysis on our advanced authentication scheme, we use the threat model described in Section 3 and show that our proposed scheme can withstand the following security attacks. Let us consider the following threat scenarios.

• –Scenario 1

  We assume that a privileged-insider of GWN can steal U_i's identity and password verifier from the GWN's identity table.

• – Scenario 2

  We assume that an attacker can eavesdrop U_i's registration message.

• – Scenario 3

  We assume that a legal user's smart card has been stolen or lost and the attacker can extract the secret parameters stored in the smart card.

• – Scenario 4

  We assume that U_i's identity ID_i, password PW_i and login parameters {H(•), H(Q_i), TE_i, PTC_i, r_i} are leaked to more than one non-registered users.

5.1. Resistance to Stolen Verifier and Insider Attacks

In registration phase of our advanced authentication scheme, U_i registers to GWN by presenting Q_i = H(ID_i‖PW_i‖r_i) instead of PW_i and H(PW_i). For the threat model in Scenario 1, we assume that a privileged-insider of GWN can steal U_i's identity and password-verifier from GWN's identity table. Note that the value of r_i is not revealed to GWN and the bit length of |r_i| is large enough. If SHA-256 is used in our advanced scheme, the attacker may attempt to derive PW_i and r_i from password-verifier Q_i = H(ID_i‖PW_i‖r_i). Due to the intractability under the assumption of a secure one-way hashing function and the bit-length of r_i is 160 bits. Thus, the probability to guess correct r_i is 1/2¹⁶⁰. Moreover, the attacker must guess a correct password PW_i and the probability to guess a correct p character PW_i approximated to 1/2^6p. Therefore, it is computationally infeasible for the attacker to derive U_i's password PW_i and random number r_i at the same time because the probability approximated to 1/2^(6p+160). As a result, a privileged-insider still cannot derive U_i's real password PW_i by performing off-line password guessing attacks on H(ID_i‖PW_i‖r_i) and our advanced authentication scheme is secure against stolen verifier and insider attacks.

5.2. Resistance to Off-Line Password Guessing Attacks

In step (U-1) of registration phase of our scheme, U_i sends { $I{D}_i^{\mathit{\text{pre}}}$, TS₁, VI_i, CI_i, DI_i} to GWN via an open and public environment. For the threat model in Scenario 2, if an attacker U_A eavesdrops U_i's registration message { $I{D}_i^{\mathit{\text{pre}}}$, TS₁, VI_i, CI_i, DI_i}. First, U_A cannot derive U_i's password-verifier H(ID_i‖PW_i‖r_i) from $C{I}_i=H(I{D}_i^{\mathit{\text{pre}}}\Vert P{W}_i^{\mathit{\text{pre}}})\oplus H(I{D}_i\Vert P{W}_i\Vert r_i)$ because U_A does not know U_i's unique parameter $H(I{D}_i^{\mathit{\text{pre}}}\Vert P{W}_i^{\mathit{\text{pre}}})$. Second, U_i's password-verifier H(ID_i‖PW_i‖r_i) is under protection of a one-way hashing function and it is computationally infeasible without knowing U_i's identity ID_i, password PW_i and the random number r_i. We assume the bit-length of ID_i is q characters and the probability to guess a correct m character ID_i approximated to 1/2^6q. Therefore, it is computationally infeasible for the attacker to derive U_i's identity ID_i, password PW_i and random number r_i at the same time because the probability approximated to 1/2^(6p+6q+160). On the other hand, in step (S-1) of registration phase of our scheme, S_j registers to GWN by presenting {SID_j, TS₂, VI_j = H(TS₂‖H(SID_j‖r_j))} instead of PW_j and H(PW_j). Therefore the attacker cannot launch an off-line guessing attack unless he/she knows the random number r_j. In this case, a possible off-line password guessing attack on user or sensor side is not working in our advanced scheme.

5.3. Resistance to Smart Card Lost Problem

The smart card lost problem is an inherent limitation of remote user authentication schemes. For the threat model in Scenario 3, we assume that U_i's smart card has been stolen or lost and the attacker U_A can extract the secret parameters {H(•), H(Q_i), TE_i, PTC_i, r_i} stored in the smart card. However, in order to log in to GWN by using U_i's lost or stolen smart card, U_A needs to guess real identity ID_i and password PW_i correctly at the same time. In fact, it is computationally infeasible to guess these two parameters correctly at the same time in polynomial time since ID_i and PW_i are well-protected by a one-way hashing function. Therefore, our proposed scheme can withstand this type of attack too.

5.4. Resistance to the Many Logged-in Users Problem

For the threat model in Scenario 4, we assume that U_i's identity ID_i, password PW_i and parameters {H(•), H(Q_i), TE_i, PTC_i, r_i} are leaked to more than one non-registered users. However, the gateway node GWN maintained a status-bit field and a last login field in its identity table. Therefore, no one is allowed to login GWN at the same time out of all who know ID_i, PW_i and valid parameters {H(•), H(Q_i), TE_i, PTC_i, r_i}. Based on the protection of GWN's identity table, the advanced scheme is secure against many logged-in users attacks.

6. Comparisons of Related Schemes

In this section, we will analyse the functionality and performance of our advanced scheme and compare it with Xue et al.'s scheme [24] and other related schemes [17,21]. Functionality and performance comparisons of our scheme and other related schemes [17,21,24] are shown in Table 4 and Table 5, respectively. In Table 4, we can see that our advanced scheme not only provides proper password protection and secure service billing, but also prevents many logged-in users attack and other attacks. According to the analysis results reported in [10,24], the time complexity of various operations in terms of T_H and T_ECC are listed in Table 5. We have compared the computational complexity using both formulated results and rough quantitative analysis in Table 5 for different phases: the registration, login and authentication phases of [17,21,24], and our scheme. For example in the test environment (CPU: 2.4 GHz, RAM: 4.0 G), we have run it 100 times to get the average result. T_H is about 3,000 times faster than T_ECC (T_H is nearly 0.0002 second on average when using SHA-256 and T_ECC is nearly 0.6 second on average when using ECC-160). Our advanced scheme, Yeh et al. [21] and Xue et al. [24] all provide the functions of session key agreement and mutual authentication between each two of the user, GWN and the sensor node.

Table 4.

Functionality comparisons of our advanced scheme and related schemes.

Items/Schemes	Das [17] (2009)	Yeh et al.[21] (2011)	Xue et al.[24] (2013)	Our Advanced Scheme
Mutual authentication	No	Yes	Yes	Yes
Key agreement	No	Yes	Yes	Yes
Password protection	No	No	No	Yes
Provision of service billing	No	No	Yes	Yes
Resistant to stolen verifier attack	Yes	Yes	No	Yes
Resistant to insider attack	No	Yes	No	Yes
Resistant to lost smart card attack	No	No	No	Yes
Resistant to many logged-in users' attack	No	No	No	Yes

Table 5.

Performance comparisons of our advanced scheme and related schemes.

Participant/Computations	Das [17] (2009)	Yeh et al.[21] (2011)	Xue et al.[24] (2013)	Our Advanced Scheme
User (Ui)	4 TH	1 TH + 2 TECC	7 TH	9 TH
Sensor (Sj)	1 TH	3 TH + 2 TECC	5 TH	6 TH
Gateway node (GWN)	7 TH	4 TH + 4 TECC	10 TH	11 TH
Computation costs	12 TH	8 TH + 8 TECC	22 TH	26 TH
Computation time	0.0024 s	4.8016 s	0.0044 s	0.0052 s

T_H: Time for SHA-256 one-way hashing computation; T_ECC: Time for ECC-160 encryption/decryption computation; s: Second.

Moreover, our scheme and Xue et al. [24] both provide the service billing function. Our advanced scheme requires 9T_H for the user, 6T_H for the sensor node and 11T_H for GWN. Assume T_H = 0.0002 second and T_ECC = 0.6 second according to our simulation.

Compared with other three schemes which cannot ensure password protection, all participants in three phases of our advanced scheme require about 0.0052 seconds, which can be almost ignored, so our advanced scheme does not increase too much computational complexity while providing more function requirements and preventing more security attacks.

7. Conclusions

In this paper, we have analyzed the vulnerability and security attacks existing in Xue et al.'s temporal-credential-based mutual authentication scheme and proposed an advanced secure authentication scheme which can satisfy mutual authentication and key agreement between the user, the gateway node and the sensor node. Compared to the existing schemes, our advanced scheme supports extra functionalities such as user password protection and login recording strategy for enhancing the system security. In addition, through the use of lightweight one-way hashing computation, our authentication scheme significantly reduces the implementation cost. Through informal security analysis, we have shown that our proposed scheme has the ability to resist various known attacks, including stolen verifier attacks, insider attacks, lost smart card problems and many logged-in users attack, etc. As a result, extra functionalities are added and its higher security along with low computational cost make our advanced scheme very appropriate for securing wireless sensor networks in practice.

Conflict of Interest

The authors declare no conflict of interest.