Open AccessEditor’s ChoiceArticle

WSN-SLAP: Secure and Lightweight Mutual Authentication Protocol for Wireless Sensor Networks

Deok Kyu Kwon

Sung Jin Yu

Joon Young Lee

Seung Hwan Son

and

Young Ho Park

^1,2,*

School of Electronic and Electrical Engineering, Kyungpook National University, Daegu 41566, Korea

School of Electronics Engineering, Kyungpook National University, Daegu 41566, Korea

Author to whom correspondence should be addressed.

Sensors 2021, 21(3), 936; https://doi.org/10.3390/s21030936

Submission received: 8 January 2021 / Revised: 21 January 2021 / Accepted: 27 January 2021 / Published: 30 January 2021

(This article belongs to the Special Issue Cryptography and Information Security in Wireless Sensor Networks)

Download

Browse Figures

Figure 1
System model in Wireless sensor networks (WSNs). "> Figure 2
Sensor node registration phase of Moghadam et al.’s scheme. "> Figure 3
User registration phase of Moghadam et al.’s scheme. "> Figure 4
Login and authentication phase of Moghadam et al.’s scheme. "> Figure 5
Sensor node registration phase of a secure and lightweight mutual authentication protocol (WSN-SLAP). "> Figure 6
User registration phase of WSN-SLAP. "> Figure 7
Login and authentication phase of WSN-SLAP. "> Figure 8
Role of session, environment and goal. "> Figure 9
Role of user. "> Figure 10
Result of the Automated Verification of Internet Security Protocols and Applications (AVISPA) simulation. ">

Versions Notes

Abstract

Wireless sensor networks (WSN) are widely used to provide users with convenient services such as health-care, and smart home. To provide convenient services, sensor nodes in WSN environments collect and send the sensing data to the gateway. However, it can suffer from serious security issues because susceptible messages are exchanged through an insecure channel. Therefore, secure authentication protocols are necessary to prevent security flaws in WSN. In 2020, Moghadam et al. suggested an efficient authentication and key agreement scheme in WSN. Unfortunately, we discover that Moghadam et al.’s scheme cannot prevent insider and session-specific random number leakage attacks. We also prove that Moghadam et al.’s scheme does not ensure perfect forward secrecy. To prevent security vulnerabilities of Moghadam et al.’s scheme, we propose a secure and lightweight mutual authentication protocol for WSNs (WSN-SLAP). WSN-SLAP has the resistance from various security drawbacks, and provides perfect forward secrecy and mutual authentication. We prove the security of WSN-SLAP by using Burrows-Abadi-Needham (BAN) logic, Real-or-Random (ROR) model, and Automated Verification of Internet Security Protocols and Applications (AVISPA) simulation. In addition, we evaluate the performance of WSN-SLAP compared with existing related protocols. We demonstrate that WSN-SLAP is more secure and suitable than previous protocols for WSN environments.

Keywords:

mutual authentication; wireless sensor networks; BAN logic; ROR model; AVISPA

1. Introduction

As a rapid development of wireless communication technology, wireless sensor networks (WSN) can be applied to various environments such as smart grids, smart homes, agriculture, industrial internet of things (IoT), and health-care [1,2,3,4,5]. People can achieve a more bountiful life by utilizing WSN environments. Generally, WSN environments consist of sensor nodes, a gateway, and users, as shown in Figure 1. Sensor nodes detect and monitor their surrounding environment. Then, sensor nodes transmit the monitored data to the gateway. The gateway relays and analyzes the message between sensor nodes and users. The gateway also manages the private information of sensor nodes and users to provide secure services. Users can access the data collected by sensor nodes through the gateway.

An example of the application environment in WSN is health-care services. Wearable sensors attached to a patient analyze the health condition of the patient. Then, these sensors send the collected data to the physician. However, these services can be exposed to various security attacks because each entity exchanges information through a public channel. If an adversary intercepts messages in WSN, the adversary can disguise as a legal user and send an incorrect message to the sensor node. Moreover, if an adversary registers to the gateway as a legal entity, the adversary can try to obtain other legal user’s sensitive information. Therefore, we need an authentication protocol that can provide secure services and prevent various attacks in WSN environments.

In 2020, Moghadam et al. [6] suggested an authentication and key agreement scheme for WSN environments utilizing Elliptic-Curve Diffie-Hellman (ECDH) [7]. They demonstrated that their scheme is efficient and secure against various security attacks such as replay, password guessing, stolen verifier, and man-in-the-middle (MITM) attacks. However, we discover that Moghadam et al.’s scheme does not provide security against insiders, and session-specific random number leakage attacks. We also prove that Moghadam et al.’s scheme does not support perfect forward secrecy. Moreover, each entity performs Elliptic Curve Cryptography (ECC) multiplication operations to compute a session key in Moghadam et al.’s scheme. However, ECC requires heavy computational costs. Since sensor nodes have low computation capabilities and storage resources in a WSN environment, we cannot ensure real-time communications using ECC in WSN environments. Therefore, using Moghadam et al.’s scheme makes it difficult to provide efficient services. To improve security vulnerabilities and reduce the computational cost of Moghadam et al.’s scheme, we propose a secure and lightweight mutual authentication protocol (WSN-SLAP) considering security and efficiency features using hash functions and XOR operations.

1.1. Contributions

Our paper’s contributions are as below.

We analyze and prove the security vulnerabilities of Moghadam et al.’s scheme. Then, we propose WSN-SLAP to resolve security vulnerabilities of Moghadam et al.’s scheme.
We demonstrate the mutual authentication of WSN-SLAP using Burrows–Abadi–Needham (BAN) logic [8].
We proof the session key security of WSN-SLAP by using the Real-or-Random (ROR) model [9]
We use Automated Verification of Internet Security Protocols and Applications (AVISPA) [10,11] to prove security features of WSN-SLAP against replay and MITM attacks.
We analyze the communication cost, the computational cost, and security properties of WSN-SLAP compared with related schemes.

1.2. Adversary Model

WSN-SLAP uses a well-known adversary model called the Dolev–Yao (DY) model [12]. Through the DY model, the adversary can eavesdrop, delete, intercept, and insert exchanged messages through a public channel. Moreover, the adversary can get exposed session-specific ephemeral parameters, which is based on the Canetti–Krawczyk (CK) adversary model [13]. The adversary can perform various security attacks with the DY model and the CK model. The detailed assumptions of the adversary model are defined in the following manner.

If an adversary registers as a legal user to the gateway, the adversary can authenticate with other entities.
An adversary can obtain a user’s lost/stolen smart card. The adversary can perform the power analysis attack [14] to get stored parameters of the smart card.
An adversary can attempt various attacks such as replay, sensor node capture, stolen verifier, and off-line password guessing attacks.

1.3. Organization

In Section 2, we describe related works for WSN environments. Then, we revisit Moghadam et al.’s scheme in Section 3 and prove the security flaws of Moghadam et al.’s scheme in Section 4. Section 5 illustrates WSN-SLAP. In Section 6, we perform informal and formal security analyses of WSN-SLAP by using BAN logic, the ROR model, and AVISPA simulation tool. In Section 7, we analyze WSN-SLAP’s performance compared with the existing related protocols. In Section 8, we conclude and summarize our paper.

2. Related Works

In the past few decades, numerous password-based authentication schemes have been proposed to provide security and efficiency in WSN environments [15,16,17,18,19]. In 1981, Lamport [20] suggested an authentication mechanism based on a password. Lamport used one-way hash functions to encode the password and stored the hashed password inside the system. In 2006, Wong et al. [21] suggested a password-based authentication scheme in WSN environments. Unfortunately, Tseng et al. [22] proved that Wong et al.’s scheme is insecure against forgery and replay attacks. Tseng et al. demonstrated a dynamic user authentication scheme to improve security vulnerabilities of Wong et al. [21]’s scheme. However, these schemes [20,21,22] can suffer from on/off-line password guessing attacks because they only used the password as a factor to login and authenticate with other entities.

In the last few decades, two-factor-based authentication schemes [23,24,25] have been presented using hash functions and XOR operations to improve single factor’s security weaknesses. In 2009, Das et al. [23] proposed a two-factor authentication scheme based on a smart card in WSNs. They demonstrated that their scheme can prevent various attacks such as replay, stolen verifier, and off-line password guessing attacks. However, Khan et al. [24] analyzed that Das et al. [23]’s scheme is vulnerable to privileged insider attack. He et al. [25] found that Das et al. [23]’s scheme is vulnerable to insider and impersonation attacks. To improve the security vulnerabilities of Das et al.’s scheme, He et al. [25] suggested an enhanced two-factor user authentication scheme for WSNs. However, these schemes [23,24,25] can suffer from various attacks such as thoe using stolen smart cards and mobile devices.

To resolve the security flaws associated with two-factor-based authentication schemes and improve the security level in WSN environments, researchers have proposed many ECC-based authentication schemes [26,27,28,29,30,31]. In 2011, Yeh et al. [26] proposed an authentication protocol for WSN environments using ECC. Yeh et al.’s scheme used a smart card and ECC to prevent various security issues such as insider, and masquerade attacks. Choi et al. [27] suggested an ECC-based user authentication scheme for WSN. However, Wu et al. [28] pointed out that Choi et al.’s protocol does not provide security against forgery attack. Nam et al. [29] suggested a secure authentication protocol for WSN based on ECC. Nam et al.’s scheme provides a secure protocol based on an Elliptic Curve Computation Diffie-Hellman (ECCDH) problem. In 2016, Jiang et al. [30] proposed an ECC-based authentication scheme. Jiang et al.’s scheme provides secure communications and untraceability in WSN environments. In 2017, Wu et al. [31] suggested a user authentication scheme using ECC. Wu et al.’s scheme can preserve user privacy in WSN environments. However, sensor nodes in WSN have low computing power and resources. Therefore, it is difficult to provide efficiency in WSN environments using these schemes [26,27,28,29,30,31] because ECC requires large computational resources.

In 2020, Moghadm et al. [6] suggested an authentication and key agreement scheme using ECDH. They asserted that their scheme provides resistance against various attacks such as replay, MITM, off-line password guessing, and stolen verifier attacks. However, we discover that Moghadam et al.’s scheme is vulnerable to insider, session-specific random number leakage attacks and perfect forward secrecy. Moreover, Moghadam et al.’s scheme suffers from heavy computational cost because it involves an ECC-based computation. Therefore, we propose WSN-SLAP, which has resistance to various security problems.

3. Review of Moghadam et al.’s Scheme

Moghadam et al. proposed an authentication scheme based on ECDH in WSN [6]. Moghadam et al.’s scheme is composed of sensor node registration, user registration, and login and authentication phases. Table 1 indicates the notations of Moghadam et al.’s scheme and WSN-SLAP.

3.1. Sensor Node Registration Phase

In this phase, a sensor node

S_{j}

sends its identity to the gateway

G W

. Then,

G W

computes a shared secret parameter between

G W

and

S_{j}

. In Figure 2, we show the sensor node registration phase and the details are as follows.

Step 1:: $S_{j}$ generates its identity $S I D_{j}$ , and sends it to $G W$ over a secure channel.
Step 2:: $G W$ receives $S I D_{j}$ and checks the validity of $S I D_{j}$ . After that, $G W$ computes $K G = h (S I D_{j} | | k_{G W N})$ , and stores ${S I D_{j}, K G}$ in its secure database, where $k_{G W N}$ is the master key of $G W$ . Finally, $G W$ sends ${K G}$ to $S_{j}$ .
Step 3:: $S_{j}$ receives and stores ${K G}$ in its database.

3.2. User Registration Phase

A user

U_{i}

registers to the gateway

G W

by sending an identity and a masked password value. Then,

G W

issues a smart card to

U_{i}

. In Figure 3, we describe the user registration phase and the details are shown as below.

Step 1:: $U_{i}$ inputs the identity $I D_{i}$ and the password $P W_{i}$ , and then generates a random number $q_{i}$ . After that, $U_{i}$ computes $A P W_{i} = h (q_{i} | | P W_{i})$ and sends the registration request message ${I D_{i}, A P W_{i}}$ to the gateway $G W$ over a secure channel.
Step 2:: $G W$ receives ${I D_{i}, A P W_{i}}$ from $U_{i}$ , and then generates a random number $z_{i}$ . After that, $G W$ computes $B_{i} = h (I D_{i} | | A P W_{i} | | z_{i}),$ $C_{i} = h (I D_{i} | | k_{G W N})$ , and $D_{i} = h (I D_{i} | | C_{i} | | z_{i} | | B_{i})$ . Finally, $G W$ stores ${z_{i}, C_{i}, D_{i},$ $h (.)}$ in a smart card and issues it to $U_{i}$ over a secure channel.
Step 3:: $U_{i}$ receives the smart card, and stores $q_{i}$ in the smart card. Finally, parameters ${z_{i}, C_{i}, D_{i}, h (.), q_{i}}$ are stored in the smart card.

3.3. Login and Authentication Phase

After the registration phase, the user

U_{i}

authenticates the gateway

G W

. In Figure 4, we describe the login and authentication phase and the detailed steps of the phase are shown as below.

Step 1:: After inserting the smart card, $U_{i}$ inputs the identity $I D_{i}^{*}$ and the password $P W_{i}^{*}$ . The smart card computes $A P W_{i}^{*} = h (P W_{i}^{*} | | q_{i}), B_{i}^{*} = h (I D_{i}^{*} | | A P W_{i}^{*} | | z_{i}), D_{i}^{*}$ $= h (I D_{i}^{*} | | C_{i} | | z_{i} | | B_{i}^{*})$ and verifies $D_{i}^{*} \overset{?}{=} D_{i}$ . If the verification process is successful, the smart card generates a random nonce $a_{i}$ and timestamp $T_{1}$ . With the public key of the gateway X, the smart card computes $A_{1} = a_{i} \cdot P, A_{2} = a_{i} \cdot X, D I D_{i} = I D_{i} \oplus A_{2 (x)}, A_{3} = S I D_{j} \oplus A_{2 (x)}$ , and $A_{4} = E_{A_{2}} (B_{i} | | S I D_{j} | | A_{3})$ . At last, the smart card sends ${A_{1}, A_{3}, A_{4}, T_{1}}$ to $G W$ through a public channel.
Step 2:: $G W$ receives ${A_{1}, A_{3}, A_{4}, T_{1}}$ from $U_{i}$ , and selects a timestamp $T_{2}$ and checks the validity of $T_{1}$ . If the timestamp is vaild, $G W$ computes $A_{2} = k_{G W N} \cdot A_{1}, D_{A_{2}} (A_{4}) = (B_{i}^{*} | | S I D_{i}^{*} | | A_{3}^{*}), A_{3} = S I D_{i}^{*} \oplus A_{2 (x)}$ and verifies $A_{3}^{*} \overset{?}{=} A_{3}$ . If the equality holds, $G W$ generates a random nonce $g_{i}$ and computes $K G = h (S I D_{j} | | k_{G W N}),$ $D_{1} = K G \oplus A_{2}, D_{2} = h (A_{2} | | S I D_{j} | | A_{3})$ . At last, $G W$ sends ${g_{i} \cdot P, D_{1}, D_{2},$ $T_{2}}$ to the sensor node $S_{j}$ over a public channel.
Step 3:: After reception of the message ${g_{i} \cdot P, D_{1}, D_{2}, T_{2}}$ from $G W$ , $S_{j}$ selects a timestamp $T_{3}$ and checks the validity of $T_{2}$ . Then, $S_{j}$ computes $A_{2} = K G \oplus D_{1}, A_{3} = S I D_{j} \oplus A_{2 (x)}, D_{2}^{*} = h (A_{2} | | S I D_{j} | | A_{3})$ and verifies $D_{2}^{*} \overset{?}{=} D_{2}$ . If the verification is legitimate, $S_{j}$ generates a random nonce $f_{i}$ , and computes $s k = h (A_{2} | | f_{i} \cdot g_{i} \cdot P), X_{i} = h (s k | | K G)$ . At last, $S_{j}$ sends ${f_{i} \cdot P, X_{i}, T_{3}}$ to $G W$ .
Step 4:: After receiving ${f_{i} \cdot P, X_{i}, T_{3}}$ from $S_{j}$ , $G W$ selects a timestamp $T_{4}$ and checks the validity of $T_{3}$ . Then, $G W$ computes $s k = h (A_{2} | | f_{i} \cdot g_{i} \cdot P), X_{i} = h (s k | | K G)$ and verifies $X_{i}^{*} \overset{?}{=} X_{i}$ . If it is equal, $G W$ computes $D_{4} = E_{A_{2}} (g_{i}), y_{i} = h (s k | | A_{3})$ and sends ${y_{i}, D_{4}, T_{4}}$ to $U_{i}$ .
Step 5:: $U_{i}$ receives the message ${y_{i}, D_{4}, T_{4}}$ , and selects a timestamp $T_{5}$ and checks the validity of $T_{4}$ . At last, $U_{i}$ computes $D_{A_{2}} (D_{4}) = (g_{i}), s k = h (A_{2} | | f_{i} \cdot g_{i} \cdot P), y_{i}^{*} = h (s k | | A_{3})$ and verifies $y_{i}^{*} \overset{?}{=} y_{i}$ . If it is equal, the key agreement is successful.

4. Cryptanalysis of Moghadam et al.’s Scheme

In this section, we demonstrate the security vulnerabilities of Moghadam et al.’s scheme [6] such as insider, and session-specific random number leakage attacks. Moghadam et al.’s scheme also does not achieve perfect forward secrecy.

4.1. Insider Attack

If an adversary

A

ordinary registers as a legal user

U_{i}

A

can authenticate with the gateway

G W

and the sensor node

S_{j}

by exchanging messages. With this information,

A

can compute another legal user

U_{i}^{l}

’s session key. The details are shown as below.

Step 1:: $A$ inserts the smart card, and inputs the identity $I D_{i}$ and the password $P W_{i}$ of $A$ . Then, the smart card checks the validity of $A$ , and sends a login request message ${A_{1}, A_{3}, A_{4}, T_{1}}$ to $G W$ . After authenticating $A$ , $G W$ sends ${g_{i} \cdot P, D_{1}, D_{2}, T_{2}}$ to $S_{j}$ . Upon reception of the message ${g_{i} \cdot P, D_{1}, D_{2}, T_{2}}$ , $S_{j}$ computes a session key $s k$ . Then, $S_{j}$ sends the authentication response message ${f_{i} \cdot P, X_{i}, T_{3}}$ to $G W$ . $G W$ computes the session key and sends ${y_{i}, D_{4}, T_{4}}$ to $A$ . $A$ computes the session key and obtains communication messages during the login and authentication phase.
Step 2:: After obtaining the message ${g_{i} \cdot P, D_{1}, D_{2}, T_{2}}$ , $A$ computes $K G = D_{1} \oplus A_{2}$ , where $A_{2}$ is the secret key of $A$ using ECC and $K G$ is a shared secret key between $G W$ and $S_{j}$ .
Step 3:: $A$ intercepts a message ${g_{i}^{l} \cdot P, D_{1}^{l}, D_{2}^{l}, T_{2}^{l}}$ from the message of another legal user $U_{i}^{l}$ . Since $A$ knows $K G$ , it can compute $A_{2}^{l} = D_{1}^{l} \oplus K G$ , where $A_{2}^{l}$ is the secret key of $U_{i}^{l}$ .
Step 4:: $A$ obtains the message ${y_{i}^{l}, D_{4}^{l}, T_{4}^{l}}$ and decrypts $D_{4}^{l}$ using the secret key $A_{2}^{l}$ of $U_{i}^{l}$ . Then, $A$ can obtain the random secret nonce $g_{i}^{l}$ of sensor node. $A$ can compute $f_{i}^{l} \cdot g_{i}^{l} \cdot P$ by utilizing the message ${f_{i}^{l} \cdot P, X_{i}^{l}, T_{3}^{l}}$ . Finally, $A$ compute the session key $s k^{l} = h (A_{2}^{l} | | f_{i}^{l} \cdot g_{i}^{l} \cdot P)$ .

Therefore, Moghadam et al.’s scheme cannot prevent insider attacks.

4.2. Perfect Forward Secrecy

Moghadam et al. demonstrated that their scheme can ensure the security feature of perfect forward secrecy. However, if the adversary

A

gets the master key

k_{G W N}

of the gateway

G W

, the adversary can compute the legal user

U_{i}

’s session key

s k

. The details are shown in following steps.

Step 1:: If $A$ obtains the master key $k_{G W N}$ , $A$ can compute the secret key $A_{2} = k_{G W N} \cdot A_{1}$ of $U_{i}$ by utilizing the login request message ${A_{1}, A_{3}, A_{4}, T_{1}}$ .
Step 2:: When $A$ intercepts the message ${y_{i}, D_{4}, T_{4}}$ , $A$ can decrypt $E_{A_{2}} (g_{i})$ because $A_{2}$ is the symmetric key between the $U_{i}$ and the gateway $G W$ .
Step 3:: After $A$ obtains the message ${f_{i} \cdot P, X_{i}, T_{3}}$ , $A$ can get $(A_{2}, g_{i})$ and $(f_{i} \cdot P)$ . At last, $A$ computes $U_{i}$ ’s session key $s k = h (A_{2} | | f_{i} \cdot g_{i} \cdot P)$ .

Consequently, Moghadam et al.’s scheme does not ensure perfect forward secrecy.

4.3. Session-Specific Random Number Leakage Attack

Suppose that a random nonce

a_{i}

is disclosed to an adversary

A

. Using the public key X of the gateway

G W

A

can calculate

A_{2} = a_{i} \cdot X

. Then,

A

can compute the session key

s k

. The details are described as below.

Step 1:: After getting the parameter $A_{2}$ , $A$ captures the message ${y_{i}, D_{4}, T_{4}}$ . Then, $A$ decrypts $D_{4} = E_{A_{2}} (g_{i})$ by using the symmetric key $A_{2}$ and obtains $g_{i}$ .
Step 2:: $A$ eavesdrops the message of the sensor node $S_{j}$ ${f_{i} \cdot P, X_{i}, T_{3}}$ . Finally, $A$ computes the session key $s k = h (A_{2} | | f_{i} \cdot g_{i} \cdot P)$ using $f_{i} \cdot P$ in the message of $S_{j}$ .

Therefore, Moghadam et al.’s scheme cannot prevent session-specific random number leakage attacks.

5. Proposed Scheme

We propose a secure and lightweight mutual authentication protocol for WSN environments to resolve security weaknesses of Moghadam et al.’s scheme [6]. To consider the resource-limited sensor nodes, WSN-SLAP uses hash functions and XOR operations that generate low computational overheads. WSN-SLAP is composed of sensor node registration, user registration, login and authentication, password update, and sensor node addition phases.

5.1. Sensor Node Registration Phase

If a sensor node

S_{j}

sends a registration request message, the gateway

G W

computes a secret parameter for the sensor node. Then,

S_{j}

stores the parameter. We show the sensor node registration phase in Figure 5 and the details are presented as below.

Step 1:: $S_{j}$ selects its identity $S I D_{j}$ and generates a random number $R_{j}$ . Then, $S_{j}$ computes $h (S I D_{j} | | R_{j})$ and sends ${S I D_{j}, h (S I D_{j} | | R_{j})}$ to $G W$ over a secure channel.
Step 2:: $G W$ receives ${S I D_{j}, h (S I D_{j} | | R_{j})}$ and computes $K S_{j} = h (h (S I D_{j} | | R_{j}) | | k_{G W N})$ , where $k_{G W N}$ is the master key of $G W$ . $G W$ stores ${S I D_{j}, h (S I D_{j} | |$ $R_{j})}$ in the secure database and sends ${K S_{j}}$ to $S_{j}$ .
Step 3:: At last, $S_{j}$ stores ${K S_{j}}$ in its memory.

5.2. User Registration Phase

A user

U_{i}

sends a registration request message to the gateway

G W

. Then,

G W

computes secret parameters and issues a smart card to the user. In Figure 6, we describe the user registration phase and the detailed steps are shown as below.

Step 1:: $U_{i}$ inputs an identity $I D_{i}$ and a high entropy password $P W_{i}$ . After that, $U_{i}$ transmits ${I D_{i}}$ to $G W$ via a secure channel.
Step 2:: $G W$ generates random numbers x and $R_{g}$ , and computes $H I D_{i} = h (I D_{i} | | R_{g}),$ $P I D_{i}$ $= H I D_{i} \oplus h (x | | k_{G W N})$ . $G W$ stores ${P I D_{i}, x}$ in its secure database and sends the message ${P I D_{i}, H I D_{i}, h (.)}$ to $U_{i}$ .
Step 3:: $U_{i}$ generates a random number $R_{i}$ . With $R_{i}$ , $U_{i}$ computes $A P W_{i} = h (P W_{i} | | R_{i}),$ $S R_{i} = R_{i} \oplus (I D_{i} | | P W_{i}), S H I D_{i} = H I D_{i} \oplus h (P W_{i} | | I D_{i} | | R_{i})$ , and $V_{i} = h ($ $A P W_{i}$ $| | I D_{i} | | R_{i})$ . Finally, $U_{i}$ stores ${S R_{i}, S H I D_{i}, V_{i}, P I D_{i}, h (.)}$ in the smart card.

5.3. Login and Authentication Phase

To access information of the sensor

S_{j}

, the user

U_{i}

sends a login request message to the gateway

G W

. In Figure 7, we describe the login and authentication phase and the details are presented below.

Step 1:: After inserting the smart card, $U_{i}$ inputs the identity $I D_{i}$ and the password $P W_{i}$ . The smart card computes $R_{1}^{*} = S R_{i} \oplus h (I D_{i} | | P W_{i}), A P W_{i}^{*} = h (P W_{i} | | R_{i})$ and $V_{i}^{*} = h (A P W_{i}^{*} | | I D_{i} | | R_{1}^{*})$ . Then, the smart card checks the validity of $V_{i}^{*}$ compared with $V_{i}$ stored in the smart card. If the validity is confirmed, the smart card generates a random nonce $N_{1}$ , and computes $H I D_{i} = S H I D_{i} \oplus h (P W_{i} | | I D_{i} | | R_{i}), S_{i} = S I D_{j} \oplus h (P I D_{i} | | H I D_{i}), M_{1} = N_{1} \oplus h (H I D_{i} | | P I D_{i}),$ and $V_{1} = h (S I D_{j} | | P I D_{i} | | N_{1} | | H I D_{i})$ . At last, $U_{i}$ sends ${P I D_{i}, S_{i}, M_{1}, V_{1}}$ to $G W$ over a public channel.
Step 2:: When $G W$ receives ${P I D_{i}, S_{i}, M_{1}, V_{1}}$ from $U_{i}$ , $G W$ retrieves $P I D_{i}$ and the shared secret value x from $G W$ ’s database. Then, $G W$ computes $H I D_{i}^{*} = P I D_{i} \oplus h (x | | k_{G W N}), S I D_{j}^{*} = S_{i} \oplus h (P I D_{i} | |$ $H I D_{i}^{*}), N_{1}^{*} = M_{1} \oplus h (H I D_{i}^{*} | | P I D_{i})$ and $V_{1}^{*} = h (S I D_{j}^{*} | | P I D_{i} | | N_{1}^{*} | | H I D_{i}^{*})$ , and checks the validity of $V_{1}^{*}$ compared with $V_{1}$ . If the validity is confirmed, $G W$ retrieves $S I D_{j}$ and $h (S I D_{j} | | R_{j})$ from $G W$ ’s database. $G W$ computes $K S_{j} = h (h (S I D_{j} | | R_{j}) | | k_{G W N}), M_{2} = h (N_{2} | | H I D_{i}) \oplus h (K S_{j} | | P I D_{i}),$ $M_{3} = N_{1} \oplus h (h (N_{2} | | H I D_{i}) | | K S_{j}),$ and $V_{2} = h (P I D_{i} | | S I D_{j} | | h (N_{2} | | H I D_{i}) | | N_{1})$ . At last, $G W$ sends ${P I D_{i}, M_{2}, M_{3}, V_{2}}$ to $S_{j}$ over a public channel.
Step 3:: If $S_{j}$ receives ${P I D_{i}, M_{2}, M_{3}, V_{2}}$ , $S_{j}$ computes $h (N_{2} | | H I D_{i})^{*} = M_{2} \oplus h (K S_{j} | |$ $P I D_{i}), N_{1}^{*} = M_{3} \oplus h (h (N_{2} | | H I D_{i})^{*} | | P I D_{i}$ $),$ $V_{2}^{*} = h (P I D_{i} | | S I D_{j} | | h (N_{2} | | H I D_{i}) | |$ $N_{1}^{*})$ and checks the validity of $V_{2}^{*}$ compared with the parameter $V_{2}$ . If the validity is confirmed, $S_{j}$ computes $S K = h (h (N_{2} | | H I D_{i}) | | N_{3} | | N_{1}), M_{4} = N_{3} \oplus h (K S_{j} | | N_{2}), V_{3} = h (S K | | N_{3}$ $| | S I D_{j})$ , where $S K$ is a session key. Finally, $S_{j}$ sends ${M_{4}, V_{3}}$ to $G W$ .
Step 4:: After receiving the message ${M_{4}, V_{3}}$ from $S_{j}$ , $G W$ computes $N_{3}^{*} = M_{4} \oplus h (K S_{j} | | N_{2}), S K^{*} = h (h (N_{2} | | H I D_{i}) | | N_{3}^{*} | | N_{1}), V_{3}^{*} = h (S K^{*} | | N_{3}^{*} | |$ $S I D_{j})$ and verifies the equality of $V_{3}^{*}$ and $V_{3}$ . If the verification is successful, $G W$ generates a random nonce $N_{2}$ and computes $x^{n e w} = h (x | | N_{2}), P I D_{i}^{n e w} = H I D_{i} \oplus h (x^{n e w} | | k_{G W N}), P_{i} = P I D_{i}^{n e w} \oplus h (N_{1} | | H I D_{i}), M_{5} = N_{2} \oplus h (H I D_{i} | | S I D_{j} | |$ $N_{1})$ $, M_{6} = N_{3} \oplus h (N_{2} | | H I D_{i}$ $| | P I D_{i}^{n e w})$ and $V_{4} = h (N_{2} | | N_{3} | |$ $P I D_{i}^{n e w} | | S K)$ . At last, $G W$ sends ${P_{i}, M_{5}, M_{6}, V_{4}}$ to $U_{i}$ and updates ${P I D_{i}, x}$ to ${P I D_{i}^{n e w}, x^{n e w}}$ if the key agreement is successful.
Step 5:: When $U_{i}$ receives the message ${P_{i}, M_{5}, M_{6}, V_{4}}$ from $G W$ , $U_{i}$ computes $P I D_{i}^{n e w}$ $= P_{i} \oplus h (N_{1} | | H I D_{i}), N_{2}^{*} = M_{5} \oplus h (H I D_{i} | | S I D_{j} | | N_{1}), N_{3}^{*} = M_{6} \oplus h (N_{2}^{*} | | H I D_{i}$ $| |$ $P I D_{i}^{n e w})$ $, S K^{*} = h (h (N_{2}^{*} | | H I D_{i}) | | N_{3}^{*} | | N_{1}), V_{4}^{*} = h (N_{2}^{*} | | N_{3}^{*} | |$ $P I D_{i}^{n e w} | | S K^{*})$ and checks the validity of $V_{4}^{*}$ compared with $V_{4}$ . If the validity is confirmed, $U_{i}$ replaces ${P I D_{i}}$ to ${P I D_{i}^{n e w}}$ in the smart card.

5.4. Password Update Phase

In WSN-SLAP, users can easily change their own password. The details are shown as below.

Step 1:: After inserting the smart card, The user $U_{i}$ inputs the identity $I D_{i}$ and the password $P W_{i}$ . The smart card computes $R_{i}^{*} = S R_{i} \oplus h (I D_{i} | | P W_{i}), A P W_{i}^{*} = h (P W_{i} | | R_{i}), V_{i}^{*} = h (A P W_{i} | | I D_{i} | | R_{i}^{*})$ and verifies the equality of $V_{i}^{*}$ and $V_{i}$ . If the verification is successful, the smart card requests a new password to $U_{i}$ .
Step 2:: $U_{i}$ inputs a new password $P W_{i}^{n e w}$ . The smart card selects a random number $R_{i}^{n e w}$ and computes $A P W_{i}^{n e w} = h (P W_{i}^{n e w} | | R_{i}^{n e w}), S R_{i}^{n e w} = R_{i}^{n e w} \oplus (I D_{i} | | P W_{i}^{n e w})$ $, S H I D_{i}^{n e w} = H I D_{i} \oplus h (P W_{i}^{n e w} | | I D_{i} | | R_{i}^{n e w}), V_{i}^{n e w} = h (A P W_{i}^{n e w} | | I D_{i} | | R_{i}^{n e w})$ . Finally, the smart card stores ${S R_{i}^{n e w}, S H I D_{i}^{n e w}, V_{i}^{n e w}, P I D_{i}, h (.)}$ .

5.5. Sensor Node Addition Phase

To add a new sensor node

S_{j}^{n e w}

to WSN-SLAP,

S_{j}^{n e w}

registers to the gateway

G W

. The detailed steps are described as follows.

Step 1:: $S_{j}^{n e w}$ selects its identity $S I D_{j}^{n e w}$ . Then, $S_{j}^{n e w}$ generates a random number $R_{j}^{n e w}$ . With $S I D_{j}^{n e w}$ and $R_{j}^{n e w}$ , $S_{j}^{n e w}$ computes $h (S I D_{j}^{n e w} | | R_{j}^{n e w})$ and sends ${S I D_{j}^{n e w}, h ($ $S I D_{j}^{n e w}$ $| | R_{j}^{n e w})}$ to $G W$ through a secure channel.
Step 2:: After receiving ${S I D_{j}^{n e w}, h (S I D_{j}^{n e w} | | R_{j}^{n e w})}$ from $S_{j}^{n e w}$ , $G W$ computes $K S_{j}^{n e w} = h (h (S I D_{j}^{n e w} | | R_{j}^{n e w}) | | k_{G W N})$ and stores ${S I D_{j}^{n e w}, h (S I D_{j}^{n e w} | | R_{j}^{n e w})}$ in the database of $G W$ . Finally, $G W$ sends ${K S_{j}^{n e w}}$ to $S_{j}^{n e w}$ .
Step 3:: $S_{j}^{n e w}$ receives the message ${K S_{j}^{n e w}}$ from $G W$ and stores ${K S_{j}^{n e w}}$ in the memory of $S_{j}^{n e w}$ .

6. Security Analysis

WSN-SLAP not only considers lightweight features using hash functions and XOR operations, but also ensures a higher security level compared with related schemes. To evaluate the security of WSN-SLAP, we perform informal security analysis and formal security analysis such as BAN logic, ROR model, and AVISPA simulation tool. We show that WSN-SLAP prevents a variety of attacks using informal analysis. We demonstrate the mutual authentication of WSN-SLAP using BAN logic and also prove the session key security of WSN-SLAP by using the ROR model. We use the AVISPA simulation tool to prove security features of WSN-SLAP against replay and MITM attacks.

6.1. Informal Security Analysis

WSN-SLAP provides security against various attacks such as insider, stolen smart card, replay, sensor node capture, off-line password guessing, privileged insider, stolen verifier, and MITM attacks. Furthermore, WSN-SLAP ensures perfect forward secrecy and mutual authentication.

6.1.1. Insider Attack

If an adversary

A

registers to the gateway

G W

as a legal user,

A

can authenticate to

G W

and the sensor node

S_{j}

A

captures messages

{P I D_{i}, M_{2}, M_{3}, V_{2}}, {M_{4}, V_{3}}

and

{P_{i}, M_{5}, M_{6}, V_{4}}

. Then,

A

computes

h (h (N_{2} | | H I D_{i}) | | K S_{j}) = M_{3} \oplus N_{1}

and

h (K S_{j} | | P I D_{i})

= M_{2} \oplus h (N_{2} | | H I D_{i})

. To compromise other legal user’s sessions,

A

must need

K S_{j}

to compute the session key. Since hash functions mask the random nonce

N_{2}

and the user’s secret parameter

H I D_{i}

such as

h (h (N_{2} | | H I D_{i}) | | K S_{j})

A

cannot compute the shared secret parameter

K S_{j}

between

G W

and

S_{j}

. Therefore, WSN-SLAP is secure against the insider attacks.

6.1.2. Stolen Smart Card Attack

Suppose that an adversary

A

captures the legal user

U_{i}

’s smart card. Then,

A

uses the power analysis attack to extract stored parameters in the smart card. With

U_{i}

’s smart card parameters,

A

tries to authenticate with the gateway

G W

and the sensor node

S_{j}

. However,

A

cannot compute the login request message

{P I D_{i}, S_{i}, M_{1}, V_{1}}

because

H I D_{i}

is masked by

S H I D_{i} = H I D_{i} \oplus h (P W_{i} | | I D_{i} | | R_{i})

. To calculate

H I D_{i}

A

needs to guess

I D_{i}

and

P W_{i}

at the same time. Since these tasks are computationally infeasible task, it is hard to obtain both

I D_{i}

and

P W_{i}

. For these reasons, WSN-SLAP is secure against stolen smart card attacks.

6.1.3. Replay Attack

If an adversary

A

intercepts messages

{P I D_{i}, M_{2}, M_{3}, V_{2}}

and

{I D_{i}, S_{i}, M_{1}, V_{1}}

from a legal user

U_{i}

A

tries to authenticate with the gateway

G W

by sending intercepted messages at other sessions. In WSN-SLAP,

G W

and the sensor node check the freshness of random nonces

N_{1}, N_{2}

and

N_{3}

. Thus, WSN-SLAP can provide security against replay attacks.

6.1.4. Sensor Node Capture Attack

We assume that an adversary

A

captures a specific sensor node

S_{j}

and obtains parameters

{S I D_{j},

K S_{j}}

from the

S_{j}

’s memory by using the power analysis attack. Then,

A

can authenticate with gateway

G W

and user

U_{i}

. However,

A

cannot threat other sensor nodes. Since the shared secret parameter

K S_{j} = h (h (S I D_{j} | | R_{j}) | | k_{G W N})

A

can only authenticate with the specific sensor node

S_{j}

A

cannot calculate any information about other sensor nodes. Therefore, WSN-SLAP is secure against sensor node capture attacks.

6.1.5. Off-Line Password Guessing Attack

According to Section 1.2, an adversary

A

can guess a legal user

U_{i}

’s password

P W_{i}

A

can also extract stored parameters

{S R_{i}, S H I D_{i}, V_{i}, P I D_{i}, h (.)}

from

U_{i}

’s legitimate smart card. Then,

A

tries to impersonate as

U_{i}

. However,

A

cannot compute

R_{i} = S R_{i} \oplus h (I D_{i} | | P W_{i})

to obtain

H I D_{i} = S H I D_{i} \oplus h (P W_{i} | | I D_{i} | | R_{i})

without knowing the identity

I D_{i}

. Therefore,

A

cannot compute the legal message

{P I D_{i}, M_{2}, M_{3}, V_{2}}

. Accordingly, WSN-SLAP has resistance to off-line password-guessing attacks.

6.1.6. Privileged Insider Attack

If a privileged insider adversary

A

intercepts a legal user

U_{i}

’s registration message

{I D_{i}}

A

tries to compute

U_{i}

’s session key by using messages in Section 5.3. However,

A

cannot compute the session key of

U_{i}

. To compute

S K = h (h (N_{2} | | H I D_{i}) | |

N_{3} | | N_{1})

A

has to calculate

H I D_{i}

which is the shared secret parameter between

U_{i}

and the gateway

G W

. However,

A

cannot compute

H I D_{i} = S H I D_{i} \oplus h (P W_{i} | | I D_{i} | | R_{i})

from the login request message

{P I D_{i}, S_{i}, M_{1}, V_{1}}

without

U_{i}

’s password and the random number

R_{i}

. Consequently, WSN-SLAP ensures security against privileged insider attacks.

6.1.7. Stolen Verifier Attack

Assuming that an adversary

A

steals the gateway

G W

’s verification table including

{S I D_{j}, h (S I D_{j} | | R_{j})}

and

(P I D_{i}, x)

. However,

A

cannot compute the session key of the legal user

U_{i}

with these parameters. To compute the session key

S K = h (h (N_{2} | | H I D_{i}) | | N_{3} | |

N_{1})

A

must compute

H I D_{i}

by using

P I D_{i} = H I D_{i} \oplus h (x | | k_{G W N})

. Since the parameter

k_{G W N}

G W

’s master key,

A

cannot compute

H I D_{i}

. Therefore, WSN-SLAP has resistance to stolen verifier attacks.

6.1.8. MITM Attack

During the login and authentication phase, an adversary

A

intercepts and tries to modify the login request message

{P I D_{i}, S_{i}, M_{1}, V_{1}}

. However, the gateway

G W

can easily detect the modified message by using the verification table. In addition, it is impossible to modify all messages because they include random parameters. Therefore, WSN-SLAP can prevent MITM attacks.

6.1.9. Session-Specific Random Number Leakage Attack

Assume that an adversary

A

obtains all random parameters

N_{1}, N_{2}

, and

N_{3}

. Then,

A

tries to compute the session key

S K

. However, it is impossible to calculate the session key without knowing

H I D_{i}

H I D_{i}

is masked with the secret key x and the master key

k_{G W N}

during the session. Accordingly, WSN-SLAP is secure against session-specific random number leakage attacks.

6.1.10. Perfect Forward Secrecy

We suppose that an adversary

A

obtains

G W

’s master key

k_{G W N}

. Then,

A

tries to compute the session key

S K = h (h (N_{2} | | H I D_{i}) | | N_{3} | | N_{1})

of the user

U_{i}

. However, the master key

k_{G W N}

is utilized, i.e.,

h (x | | k_{G W N})

and

h (h (S I D_{j} | | R_{j}) | | k_{G W N})

. Therefore,

A

needs the shared secret parameter x or

h (S I D_{j} | | R_{j})

to analyze the secret parameter. For this reason, WSN-SLAP provides perfect forward secrecy.

6.1.11. Mutual Authentication

To authenticate with each other, each participant of WSN-SLAP performs verification processes. The gateway

G W

checks the validity of

V_{1} \overset{?}{=} V_{1}^{*}

and

V_{3} \overset{?}{=} V_{3}^{*}

, the sensor node

S_{j}

verifies

V_{2} \overset{?}{=} V_{2}^{*}

, and the

U_{i}

checks

V_{4} \overset{?}{=} V_{4}^{*}

. If the whole verification process is successful, we can conclude that each participant is authenticated with each other. Therefore, WSN-SLAP guarantees mutual authentication.

6.2. BAN Logic

In this section, we prove mutual authentication of WSN-SLAP using BAN logic analysis [8]. BAN logic has been widely used to analyze the mutual authentication of various authentication schemes [32,33]. In WSN-SLAP, the participants authenticate with each other to establish a session key

S K

among U,

G W

, and

S N

. Table 2 presents the basic notations of the BAN logic used in this proof.

6.2.1. Rules

The logical rules of the BAN logic are described as below.

1.: Message meaning rule (MMR):

$\frac{P_{1} | \equiv P_{1} \overset{K e y}{\leftrightarrow} P_{2}, P_{1} ⊲ {(S_{1})}_{K e y}}{P_{1} | \equiv P_{2} | \sim S_{1}}$
2.: Nonce verification rule (NVR):

$\frac{P_{1} | \equiv # (S_{1}), P_{1} | \equiv P_{2} | \sim S_{1}}{P_{1} | \equiv P_{2} | \equiv S_{1}}$
3.: Jurisdiction rule (JR):

$\frac{P_{1} | \equiv P_{2} | ⟹ S_{1}, P_{1} | \equiv P_{2} | \equiv S_{1}}{P_{1} | \equiv S_{1}}$
4.: Belief rule (BR):

$\frac{P_{1} | \equiv (S_{1}, S_{2})}{P_{1} | \equiv S_{1}}$
5.: Freshness rule (FR):

$\frac{P_{1} | \equiv # (S_{1})}{P_{1} | \equiv # (S_{1}, S_{2})}$

6.2.2. Goals

In WSN-SLAP, the basic goals of the BAN logic are that each principal establishes a session key and achieves mutual authentication. The goals for proving mutual authentication of WSN-SLAP are defined as follows:

Goal 1:: $U | \equiv U \overset{S K}{\leftrightarrow} G W$
Goal 2:: $U | \equiv G W | \equiv U \overset{S K}{\leftrightarrow} G W$
Goal 3:: $G W | \equiv U \overset{S K}{\leftrightarrow} G W$
Goal 4:: $G W | \equiv U \equiv U \overset{S K}{\leftrightarrow} G W$
Goal 5:: $S N | \equiv S N \overset{S K}{\leftrightarrow} G W$
Goal 6:: $S N | \equiv G W | \equiv S N \overset{S K}{\leftrightarrow} G W$
Goal 7:: $G W | \equiv S N \overset{S K}{\leftrightarrow} G W$
Goal 8:: $G W | \equiv S N | \equiv S N \overset{S K}{\leftrightarrow} G W$

6.2.3. Idealized Forms

In WSN-SLAP, the authentication request and response messages

{P I D_{i}, S_{i}, M_{1}, V_{1}}

{P I D_{i}, M_{2}, M_{3}, V_{2}}

{M_{4}, V_{3}}

, and

{P_{i}, M_{5}, M_{6}, V_{4}}

are transmitted through a public channel. We will transmit these messages into the idealized form and omit other messages because they cannot efficiently provide the logical properties of BAN logic. WSN-SLAP’s idealized form messages are shown as below:

$M s g_{1}$: : $U \to G W : {N_{1}, S I D_{j}}_{H I D_{i}}$
$M s g_{2}$: : $G W \to S N : {h (N_{2} | | H I D_{i} {), N_{1}}}_{K S_{j}}$
$M s g_{3}$: : $S N \to G W : {N_{3}}_{K S_{j}}$
$M s g_{4}$: : $G W \to U : {N_{2}, N_{3}}_{H I D_{1}}$

6.2.4. Assumptions

After the registration phase, each principal believes that it has secret keys which are shared among each other. The principal also trusts that random numbers and pseudo identity are fresh. Moreover, the principal believes that a legal principal can control the entitled components and values. The assumptions of the BAN logic in WSN-SLAP are as below:

$A_{1}$ :: $G W | \equiv # (N_{1})$
$A_{2}$ :: $G W | \equiv # (N_{3})$
$A_{3}$ :: $S N | \equiv # (h (N_{2} | | H I D_{i}))$
$A_{4}$ :: $U | \equiv # (N_{2})$
$A_{5}$ :: $U | \equiv G W \Rightarrow (U \overset{S K}{\leftrightarrow} G W)$
$A_{6}$ :: $G W | \equiv U \Rightarrow (U \overset{S K}{\leftrightarrow} G W)$
$A_{7}$ :: $S N | \equiv G W \Rightarrow (S N \overset{S K}{\leftrightarrow} G W)$
$A_{8}$ :: $G W | \equiv S N \Rightarrow (S N \overset{S K}{\leftrightarrow} G W)$
$A_{9}$ :: $U | \equiv U \overset{H I D_{i}}{\leftrightarrow} G W$
$A_{10}$ :: $G W | \equiv U \overset{H I D_{i}}{\leftrightarrow} G W$
$A_{11}$ :: $S N | \equiv S N \overset{K S_{j}}{\leftrightarrow} G W$
$A_{12}$ :: $G W | \equiv S N K S_{j} G W$

6.2.5. BAN Logic Proof

We conduct the BAN logic analysis of WSN-SLAP as follows:

Step 1:: $S_{1}$ can be obtained from $M s g_{1}$ .
$S_{1}$ : $G W ⊲ {N_{1}, S I D_{j}}_{H I D_{i}}$
Step 2:: $S_{2}$ can be induced by applying the MMR using $S_{1}$ and $A_{10}$ .
$S_{2}$ : $G W | \equiv U | \sim (N_{1}, S I D_{j})$
Step 3:: $S_{3}$ can be induced by applying the FR using $S_{2}$ and $A_{1}$ .
$S_{3}$ : $G W | \equiv # (N_{1}, S I D_{j})$
Step 4:: $S_{4}$ can be induced by applying the NVR using $S_{2}$ and $S_{3}$ .
$S_{4}$ : $G W | \equiv U | \equiv (N_{1}, S I D_{j})$
Step 5:: $S_{5}$ is can be induced by $S_{4}$ and the BR.
$S_{5}$ : $G W | \equiv U | \equiv (N_{1})$
Step 6:: $S_{6}$ is obtained from $M s g_{2}$ .
$S_{6}$ : $S N ⊲ {h (N_{2} | | H I D_{i} {), N_{1}}}_{K S_{j}}$
Step 7:: $S_{7}$ is can be induced by applying the MMR using $S_{6}$ and $A_{13}$ .
$S_{7} : S N | \equiv G W | \sim (h (N_{2} | | H I D_{i}), N_{1})$
Step 8:: $S_{8}$ is can be induced by applying the FR using $S_{7}$ and $A_{3}$ .
$S_{8} : S N | \equiv # (h (N_{2} | | H I D_{i}), N_{1})$
Step 9:: $S_{9}$ is can be induced by applying the NVR using $S_{7}$ and $S_{8}$ .
$S_{9} : S N | \equiv G W | \equiv (h (N_{2} | | H I D_{i}), N_{1})$
Step 10:: $S_{10}$ is obtained from $M s g_{3}$ .
$S_{10} : G W ⊲ {N_{3}}_{K S_{j}}$
Step 11:: $S_{11}$ can be induced by applying the MMR using $A_{5}$ and $S_{8}$ .
$S_{11}$ : $G W | \equiv S N | \sim (N_{3})$
Step 12:: $S_{12}$ can be induced by applying the NVR using $S_{9}$ and $S_{10}$ .
$S_{12} : G W | \equiv S N | \equiv (N_{3})$
Step 13:: $S_{13}$ and $S_{14}$ can be induced by $S_{9}$ , and $S_{12}$ . $S N$ and $G W$ can compute the session key $S K = h (h (N_{2} | | H I D_{i}) | | N_{3} | | N_{1})$ .
$S_{13} : G W | \equiv S N | \equiv (S N \overset{S K}{\leftrightarrow} G W)$ (Goal 8)
$S_{14} : S N | \equiv G W | \equiv (S N \overset{S K}{\leftrightarrow} G W)$ (Goal 6)
Step 14:: $S_{15}$ and $S_{16}$ can be induced by applying the JR using $S_{13}$ and $A_{8}$ , and $S_{14}$ and $A_{7}$ , respectively.
$S_{15} : G W | \equiv (S N \overset{S K}{\leftrightarrow} G W)$ (Goal 7)
$S_{16} : S N | \equiv (S N \overset{S K}{\leftrightarrow} G W)$ (Goal 5)
Step 15:: $S_{17}$ is obtained from $M s g_{4}$ .
$S_{17}$ : $U ⊲ {N_{2}, N_{3}}_{H I D_{i}}$
Step 16:: $S_{18}$ can be induced by $A_{9}$ , $S_{17},$ and the MMR.
$S_{18}$ : $U | \equiv G W | \sim (N_{2}, N_{3})$
Step 17:: $S_{19}$ can be induced by applying the FR using $S_{18}$ and $A_{4}$ .
$S_{19}$ : $U | \equiv # (N_{2}, N_{3})$
Step 18:: $S_{20}$ can be induced by $S_{16}$ , $S_{17},$ and the NVR.
$S_{20}$ : $U | \equiv G W | \equiv (N_{2}, N_{3})$
Step 19:: $S_{21}$ and $S_{22}$ can be induced by $S_{5}$ , $S_{18}$ . U and $G W$ can compute the session key $S K = h (h (N_{2} | | H I D_{i}) | | N_{3} | | N_{1})$
$S_{21} : U | \equiv G W | \equiv (U \overset{S K}{\leftrightarrow} G W)$ (Goal 2)
$S_{22} : G W | \equiv U | \equiv (U \overset{S K}{\leftrightarrow} G W)$ (Goal 4)
Step 20:: $S_{23}$ and $S_{24}$ can be induced by applying the JR using $S_{21}$ and $A_{5}$ , $S_{22}$ , and $A_{6}$ , respectively.
$S_{23} : U | \equiv (U \overset{S K}{\leftrightarrow} G W)$ (Goal 1)
$S_{24} : G W | \equiv (U \overset{S K}{\leftrightarrow} G W)$ (Goal 3)

6.3. ROR Model

This section proves the security of the session key of WSN-SLAP by using the well-known Real-Or-Random (ROR) model [9]. In WSN-SLAP, there are three participants.

P_{U}^{t_{1}}

is a user,

P_{G W}^{t_{2}}

is a gateway, and

P_{G W}^{t_{2}}

is a sensor node. In the ROR model, the network is under an adversary

A

who can eavesdrop, capture, insert, and delete messages. With these abilities,

A

performs various attacks using

E x e c u t e, C o r r u p t S C, R e v e a l, S e n d

, and

T e s t

queries.

$E x e c u t e$ : This query is a passive attack that $A$ can eavesdrop the legal entity’s message.
$C o r r u p t S C$ : This query means $A$ obtains stored parameters from the user’s smart card.
$R e v e a l$ : This query means $A$ reveals the session key $S K$ .
$S e n d$ : This query is an active attack that $A$ sends a message to receive a response message.
$T e s t$ : An adversary $A$ obtains a flipped unbiased coin before the game starts. If $A$ obtains $c = 1$ , it means the session key $S K$ is fresh. If $A$ obtains $c = 0$ , it means the session key is not fresh. Otherwise, $A$ obtains a $N U L L$ value. To ensure the security of the session key, it is necessary that $A$ cannot distinguish the result value between a random number and the session key.

Security Proof

Theorem 1.

Let

A

attempt to obtain the session key of WSN-SLAP in polynomial time as follows.

A d v_{A} (P o l y)

is the probability of the session key being broken by

A

q_{h}^{2}

H A S H

, and

q_{s e n d}

mean the number of hash queries, the range space of the hash function, and the number of send queries, respectively.

s^{'}

and

C^{'}

are the Zipf’s parameters [34].

A d v_{A} (P o l y) \leq \frac{q_{h}^{2}}{| H A S H |} + 2 {C^{'} q_{s e n d}^{s^{'}}}

We follow the proof according to the method of [35,36]. We perform four games

G a m e_{k}

, where

k \in [0, 3]

S u c c_{A, G a m e_{k}}

is the event that

A

can guess a correct bit c in the

G a m e_{k}

, and

P r [S u c c_{A, G a m e_{k}}]

is the probability of

S u c c_{A, G a m e_{k}}

. We can perform

G a m e_{k}

as follows with these parameters.

-: $G a m e_{0}$ : This game describes a real attack of $A$ in WSN-SLAP under the ROR model. The random bit c needs to be selected before starting the game. Therefore, we can derive as follows.

$A d v_{A} (P o l y) = | 2 P r [S u c c_{A, G a m e_{0}}] - 1 |$

(1)
-: $G a m e_{1}$ : In the $G a m e_{1}$ , $A$ obtains each entity’s messages ${P I D_{i}, S_{i}, M_{1}, V_{1}}$ , ${P I D_{i}, M_{2}, M_{3}, V_{2}}$ , ${M_{4}, V_{3}}$ , and ${P_{i}, M_{5}, M_{6},$ $V_{4}}$ using $E x e c u t e$ query. Then, $A$ performs $T e s t$ and $R e v e a l$ queries to obtain the session key $S K$ . Since $S K = h (h (N_{2} | | H I D_{i}) | | N_{3} | | N_{1})$ , $A$ has to get random nonces $N_{1}$ , $N_{2}$ , and $N_{3}$ . In addition, $A$ needs the user’s masked identity $H I D_{i}$ . For these reasons, $A$ cannot calculate $S K$ . This means $G a m e_{0}$ and $G a m e_{1}$ are indistinguishable. Therefore, we can get the following equivalent.

$P r [S u c c_{A, G a m e_{1}}] = P r [S u c c_{A, G a m e_{0}}]$

(2)
-: $G a m e_{2}$ : In this game, $A$ performs $S e n d$ query, which is an active attack. $A$ utilizes ${P I D_{i}, S_{i}, M_{1}, V_{1}}$ , ${P I D_{i}, M_{2}, M_{3}, V_{2}}$ , ${M_{4}, V_{3}}$ , and ${P_{i}, M_{5}, M_{6}, V_{4}}$ to get the session key $S K$ . Parameters $V_{1}$ , $V_{2}$ , $V_{3}$ , and $V_{4}$ are masked by $H A S H$ query. In addition, parameters $P I D_{i}$ , $M_{1}$ , $M_{2}$ , $M_{3}$ , $M_{4}$ , $M_{5}$ , $M_{6}$ , and $P_{i}$ contain random nonces $N_{1}$ , $N_{2}$ , and $N_{3}$ . By using random nonces, we can prevent collision from other sessions. According to the birthday paradox [37], we can get the following inequation.

$| P r [S u c c_{A, G a m e_{2}}] - P r [S u c c_{A, G a m e_{1}}] | \leq \frac{q_{h}^{2}}{| H A S H |}$

(3)
-: $G a m e_{3}$ : In the $G a m e_{3}$ , $A$ executes $C o r r u p t S C$ query and obtains smart card’s stored parameters ${S R_{i}, S H I D_{i}, V_{i}, P I D_{i}}$ by using the power analysis attack, where $S R_{i} = R_{i} \oplus h (I D_{i} | | P W_{i}), S H I D_{i} = H I D_{i} \oplus h (P W_{i} | | I D_{i} | | R_{i}),$ $V_{i} = h (A P W_{i} | | I D_{i} | | R_{i})$ , and $P I D_{i} = H I D_{i} \oplus h (x | | k_{G W N})$ . To obtain $R_{i}$ and $H I D_{i}$ , $A$ needs the identity $I D_{i}$ and the password $P W_{i}$ . Therefore, $A$ cannot distinguish with $G a m e_{2}$ and $G a m e_{3}$ if guessing $P W_{i}$ is computationally infeasible task. Then, we can obtain the result by using Zipf’s law [34].

$| P r [S u c c_{A, G a m e_{3}}] - P r [S u c c_{A, G a m e_{2}}] | \leq C^{'} q_{s e n d}^{s^{'}}$

(4)

Finally, $A$ gets the guessed bit c because games are done.

$P r [S u c c_{A, G a m e_{3}}] = \frac{1}{2}$

(5)

Moreover, we can get the following result by using (1) and (2).

$\frac{1}{2} A d v_{A} (P o l y) = | P r [S u c c_{A, G a m e_{0}}] - \frac{1}{2} | = | P r [S u c c_{A, G a m e_{1}}] - \frac{1}{2} |$

(6)

Using (5) and (6), we obtain the following equation.

$\frac{1}{2} A d v_{A} (P o l y) = | P r [S u c c_{A, G a m e_{1}}] - P r [S u c c_{A, G a m e_{3}}] |$

(7)

We get the following result utilizing the triangular inequality.

$\frac{1}{2} A d v_{A} (P o l y) = | P r [S u c c_{A, G a m e_{1}}] - P r [S u c c_{A, G a m e_{3}}] | \leq | P r [S u c c_{A, G a m e_{1}}] - P r [S u c c_{A, G a m e_{2}}] | + | P r [S u c c_{A, G a m e_{2}}] - P r [S u c c_{A, G a m e_{3}}] |$

$\leq \frac{q_{h}^{2}}{2 | H A S H |} + C^{'} q_{s e n d}^{s^{'}}$

(8)

By multiplying (8) by 2, we get the following result.

$A d v_{A} (P o l y) \leq \frac{q_{h}^{2}}{| H A S H |} + 2 {C^{'} q_{s e n d}^{s^{'}}}$

Therefore, we prove

6.4. AVISPA Simulation

In this section, we analyze security features of WSN-SLAP by using AVISPA [10,11]. AVISPA is a formal security verification tool that detects MITM and replay attacks against the authentication protocol.

AVISPA uses the High-Level Protocols Specification Language (HLPSL). After receiving a protocol written in HLPSL, the translator converts the HLPSL-based protocol to an intermediate format (IF). Then, the translator inputs the IF to four back-ends, which are Constraint Logic-based Attack Searcher (CL-AtSe), Tree Automata based on Automatic Approximations for Analysis of Security Protocol (TA4SP), SAT-based Model-Checker (SATMC), and On the fly Model-Checker (OFMC), respectively. Consequently, the IF is converted to an output format (OF). If the summary of OF is SAFE, it means the protocol has resistance to replay and MITM attacks.

Specifically, OFMC back-end can utilize XOR operations. Therefore, we use this back-end in our paper.

6.4.1. HLPSL Specifications

In HLPSL, WSN-SLAP consists of users

U A

, gateway

G W N

, and sensor nodes

S N

. These entities are written as

r o l e

. There are also two

c o m p o s i t i o n r o l e s

named

s e s s i o n

and

e n v i r o n m e n t

, which contain security goals. Figure 8 indicates goals and the

r o l e

s e s s i o n

and

e n v i r o n m e n t

of WSN-SLAP.

Figure 9 shows the whole process of the user

U A

. In state 1, the user

U A

registers to

G W N

. To start the session,

U A

receives the start message. Then,

U A

sends a registration request message

{I D_{i}}

to the gateway

G W N

through a secure channel. In state 2,

U A

receives a smart card from

G W N

and stores

{R_{i}, S R_{i}, S H I D_{i}, V_{i}}

in the smart card. In the login and authentication phase,

U A

sends

{P I D_{i}, S_{i}, M_{1}, V_{1}}

G W N

via a public channel. The function

w i t n e s s (U A, G W N, u a_g w_n 1, N 1^{'})

indicates the freshness of

N_{1}

generated by

U A

. In State 3,

U A

receives

{P_{i}, M_{5}, M_{6}, V_{4}}

from

G W N

. Then,

U A

authenticates with

G W N

using

N_{2}^{'}

r e q u e s t (G W N, U A, g w_u a_n 3, N_{2}^{'})

6.4.2. Simulation Result

If the protocol’s result summary is SAFE in OFMC simulation, the protocol has resistance to replay and MITM attacks. The result of WSN-SLAP’s AVISPA simulation tool using OFMC back-end is shown in Figure 10. Thus, WSN-SLAP can prevent replay and MITM attacks.

7. Performance Analysis

In this section, we estimate computational costs, communication costs, and security properties of WSN-SLAP compared with existing related schemes [6,27,28,31].

7.1. Computational Costs

We analyze WSN-SLAP’s computational cost compared with the performance of the related schemes [6,27,28,31]. According to [6,38], the execution time of each operation is acquired on a computer with a four-core 3.2 GHz CPU, and 8 GB memory. We estimate that

T_{h}

T_{e c m}

, and

T_{s y m}

are the execution time of the hash function (≈0.00032 s), ECC point multiplication (≈0.0171 s), and symmetric encryption/decryption (≈0.0056 s), respectively. We do not consider the execution time of the XOR operation because it is negligible. Table 3 indicates the result for computational costs. Accordingly, WSN-SLAP has a more efficient computational cost than related schemes [6,27,28,31].

7.2. Communication Costs

We evaluate the communication cost of WSN-SLAP compared with related schemes [6,27,28,31] in this section. According to [6], we define that the user identity, sensor node identity, random number, timestamp, SHA-1 hash digest, and ECC point are 128, 16, 128, 32, 160 and 320 bits, respectively. In WSN-SLAP, the login request message

{P I D_{i}, S_{i}, M_{1}, V_{1}}

requires

(160 + 160 + 160 + 160 = 640

bits), and the transmitted authentication messages

{P I D_{i}, M_{2}, M_{3}, V_{2}}

{M_{4}, V_{3}}

, and

{P_{i}, M_{5}, M_{6}, V_{4}}

require

(160 + 160 + 160 + 160 = 640

bits),

(160 + 160 = 320

bits), and

(160 + 160 + 160 + 160 = 640

bits), respectively. Consequently, total communication costs of WSL-SLAP and related schemes [6,27,28,31] are as shown in Table 4. Therefore, WSN-SLAP provides a more efficient communication cost than related schemes do [6,27,28,31].

7.3. Security Properties

In Table 5, we present the security properties of WSN-SLAP with related schemes [6,27,28,31]. We show that existing protocols [6,27,28,31] suffer from various attacks, including insider, stolen smart card, and session-specific random number leakage attacks. Therefore, WSN-SLAP provides better functionality and security features compared with those of related schemes [6,27,28,31].

8. Conclusions

In this paper, we discovered that Moghadam et al.’s scheme has vulnerabilities against insider, and session-specific random number leakage attacks. We also proved that Moghadam et al.’s scheme does not guarantee perfect forward secrecy. To resolve the security weaknesses of Moghadam et al.’s scheme, we proposed a secure and lightweight mutual authentication protocol for WSN environments. WSN-SLAP has resistance to various attacks, including insider, stolen smart card, off-line password guessing, stolen verifier, and session-specific random number leakage attacks. We demonstrated that WSN-SLAP provides perfect forward secrecy and mutual authentication. We proved the security of WSN-SLAP using formal security analyses, which are AVISPA, BAN logic, and ROR model. Moreover, WSN-SLAP has lightweight computational and communication costs because it involves XOR operations and hash functions. Therefore, the proposed WSN-SLAP provides more secure and efficient communication services compared with existing related protocols and is suitable for WSN environments. In future work, we will implement a whole network and secure protocol to design a new scheme that is practical for use in WSN.

Author Contributions

Conceptualization, D.K.K.; Formal analysis, S.J.Y., J.Y.L. and S.H.S.; Investigation, S.J.Y. and Y.H.P.; Methodology, D.K.K.; Software, J.Y.L.; Supervision, Y.H.P.; Validation, J.Y.L. and S.H.S.; Writing—original draft, D.K.K.; Writing—review & editing, S.J.Y., S.H.S. and Y.H.P. All the authors contributed equally to this work. All authors have read and agreed to the published version of the manuscript.

Funding

This research was supported in part by the Basic Science Research Program through the National Research Foundation of Korea(NRF) funded by the Ministry of Education under Grant 2020R1I1A3058605, and in part by the BK21 FOUR project funded by the Ministry of Education, Korea under Grant 4199990113966.

Institutional Review Board Statement

Not applicable.

Informed Consent Statement

Not applicable.

Conflicts of Interest

The authors declare no conflict of interest.

References

Mandal, S.; Bera, B.; Sutrala, A.K.; Das, A.K.; Choo, K.K.R.; Park, Y. Certificateless-signcryption-based three-factor user access control scheme for IoT environment. IEEE Internet Things J. 2020, 7, 3184–3197. [Google Scholar] [CrossRef]
Yu, S.; Park, Y. SLUA-WSN: Secure and lightweight three-factor-based user authentication protocol for wireless sensor networks. Sensors 2020, 20, 4143. [Google Scholar] [CrossRef] [PubMed]
Ghahramani, M.; Javidan, R.; Shojafar, M.; Taheri, R.; Alazab, M.; Tafazolli, R. RSS: An energy-efficient approach for securing IoT service protocols against the DoS attack. IEEE Internet Things J. 2020. [Google Scholar] [CrossRef]
Park, K.; Noh, S.; Lee, H.; Das, A.K.; Kim, M.; Park, Y.; Wazid, M. LAKS-NVT: Provably secure and lightweight authentication and key agreement scheme without verification table in medical internet of things. IEEE Access 2020, 8, 119387–119404. [Google Scholar] [CrossRef]
Lee, J.; Yu, S.; Park, K.; Park, Y.; Park, Y. Secure three-factor authentication protocol for multi-gateway IoT environments. Sensors 2019, 19, 2358. [Google Scholar] [CrossRef] [PubMed] [Green Version]
Moghadam, M.F.; Nikooghadam, M.; Al Jabban, M.A.B.; Alishahi, M.; Mortazavi, L.; Mohajerzadeh, A. An efficient authentication and key agreement scheme based on ECDH for wireless sensor network. IEEE Access 2020, 8, 73182–73192. [Google Scholar] [CrossRef]
Coron, J.S. Resistance against differential power analysis for elliptic curve cryptosystems. In Proceedings of the 1st International Workshop on Cryptographic Hardware and Embedded Systems, Worcester, MA, USA, 12–13 August 1999; pp. 292–302. [Google Scholar]
Burrows, M.; Abadi, M.; Needham, R.M. A logic of authentication. ACM Trans. Comput. Syst. 1990, 8, 18–36. [Google Scholar] [CrossRef]
Abdalla, M.; Fouque, P.; Pointcheval, D. Password-based authenticated key exchange in the three-party setting. In Proceedings of the 8th International Workshop on Theory and Practice in Public Key Cryptography (PKC’05), Lecture Notes in Computer Science (LNCS), Les Diablerets, Switzerland, 23–26 January 2005; pp. 65–84. [Google Scholar]
AVISPA. Automated Validation of Internet Security Protocols and Applications. Available online: http://www.avispa-project.org/ (accessed on 4 December 2020).
SPAN: A Security Protocol Animator for AVISPA. Available online: http://www.avispa-project.org/ (accessed on 4 December 2020).
Dolev, D.; Yao, A. On the security of public key protocols. IEEE Trans. Inf. Theory 1983, 29, 198–208. [Google Scholar] [CrossRef]
Canetti, R.; Krawczyk, H. Universally composable notions of key exchange and secure channels. In Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques—Advances in Cryptology (EUROCRYPT’02), Amsterdam, The Netherlands, 28 April–2 May 2002; pp. 337–351. [Google Scholar]
Kocher, P.; Jaffe, J.; Jun, B. Differential power analysis. In Proceedings of the Annual International Cryptology Conference, Santa Barbara, CA, USA, 15–19 August 1999; pp. 388–397. [Google Scholar]
Yu, S.; Lee, J.; Lee, K.; Park, K.; Park, Y. Secure authentication protocol for wireless sensor networks in vehicular communications. Sensors 2018, 18, 3191. [Google Scholar] [CrossRef] [Green Version]
Fu, X.; Fortino, G.; Li, W.; Pace, P.; Yang, Y. WSNs-assisted opportunistic network for low-latency message forwarding in sparse settings. Future Gener. Comput. Syst. 2019, 91, 223–237. [Google Scholar] [CrossRef]
Fu, X.; Fortino, G.; Pace, P.; Aloi, G.; Li, W. Environment-fusion multipath routing protocol for wireless sensor networks. Inf. Fusion 2020, 53, 4–19. [Google Scholar] [CrossRef]
Lee, J.; Yu, S.; Kim, M.; Park, Y.; Das, A.K. On the design of secure and efficient three-factor authentication protocol using honey list for wireless sensor networks. IEEE Access 2020, 8, 107046–107062. [Google Scholar] [CrossRef]
Fu, X.; Pace, P.; Aloi, G.; Yang, L.; Fortino, G. Topology optimization against cascading failures on wireless sensor networks using a memetic algorithm. Comput. Netw. 2020, 177, 107327. [Google Scholar] [CrossRef]
Lamport, L. Password authentication with insecure communication. Commun. ACM 1981, 24, 770–772. [Google Scholar] [CrossRef]
Wong, K.H.; Zheng, Y.; Cao, J.; Wang, S. A dynamic user authentication scheme for wireless sensor networks. In Proceedings of the IEEE International Conference on Sensor Networks, Ubiquitous, and Trustworthy Computing (SUTC), Taichung, Taiwan, 5–7 June 2006; pp. 1–8. [Google Scholar]
Tseng, H.R.; Jan, R.H.; Yang, W. An improved dynamic user authentication scheme for wireless sensor networks. In Proceedings of the IEEE Globecom, Washington, DC, USA, 26–30 November 2007; pp. 986–990. [Google Scholar]
Das, M.L. Two-factor user authentication in wireless sensor networks. IEEE Trans. Wirel. Commun. 2009, 8, 1086–1090. [Google Scholar] [CrossRef]
Khan, M.K.; Alghathbar, K. Cryptanalysis and security improvements of ‘two-factor user authentication in wireless sensor networks’. Sensors 2010, 10, 2450–2459. [Google Scholar] [CrossRef] [Green Version]
He, D.; Gao, Y.; Chan, S.; Chen, C.; Bu, J. An enhanced two-factor user authentication scheme in wireless sensor networks. Ad Hoc Sens. Wirel. Netw. 2010, 10, 361–371. [Google Scholar]
Yeh, H.L.; Chen, T.H.; Liu, P.C.; Kim, T.H.; Wei, H.W. A secured authentication protocol for wireless sensor networks using elliptic curves cryptography. Sensors 2011, 11, 4767–4779. [Google Scholar] [CrossRef]
Choi, Y.; Lee, D.; Kim, J.; Jung, J.; Nam, J.; Won, D. Security enhanced user authentication protocol for wireless sensor networks using elliptic curves cryptography. Sensors 2014, 14, 10081–10106. [Google Scholar] [CrossRef] [Green Version]
Wu, F.; Xu, L.; Kumari, S.; Li, X. A new and secure authentication scheme for wireless sensor networks with formal proof. Peer-to-Peer Netw. Appl. 2017, 10, 16–30. [Google Scholar] [CrossRef]
Nam, J.; Kim, M.; Paik, J.; Lee, Y.; Won, D. A provably-secure ECC-based authentication scheme for wireless sensor networks. Sensors 2014, 14, 21023–21044. [Google Scholar] [CrossRef] [PubMed] [Green Version]
Jiang, Q.; Ma, J.; Wei, F.; Tian, Y.; Shen, J.; Yang, Y. An untraceable temporal-credential-based two-factor authentication scheme using ECC for wireless sensor networks. J. Netw. Comput. Appl. 2016, 76, 37–48. [Google Scholar] [CrossRef]
Wu, F.; Xu, L.; Kumari, S.; Li, X. A privacy-preserving and provable user authentication scheme for wireless sensor networks based on Internet of Things security. J. Ambient. Intell. Humaniz. Comput. 2017, 8, 101–116. [Google Scholar] [CrossRef]
Ghahramani, M.; Javidan, R.; Shojafar, M. A secure biometric-based authentication protocol for global mobility networks in smart cities. J. Supercomput. 2020, 76, 8729–8755. [Google Scholar] [CrossRef]
Yu, S.; Lee, J.; Park, Y.; Park, Y.; Lee, S.; Chung, B. A secure and efficient three-factor authentication protocol in global mobility networks. Appl. Sci. 2020, 10, 3565. [Google Scholar] [CrossRef]
Wang, D.; Cheng, H.; Wang, P.; Huang, X.; Jian, G. Zipf’s law in passwords. IEEE Trans. Inf. Forensics Secur. 2017, 12, 2776–2791. [Google Scholar] [CrossRef]
Wazid, M.; Bagga, P.; Das, A.K.; Shetty, S.; Rodrigues, J.J.; Park, Y. AKM-IoV: Authenticated key management protocol in fog computing-based internet of vehicles deployment. IEEE Internet Things J. 2019, 6, 8804–8817. [Google Scholar] [CrossRef]
Yu, S.; Lee, J.; Park, K.; Das, A.K.; Park, Y. IoV-SMAP: Secure and efficient message authentication protocol for IoV in smart city environment. IEEE Access 2020, 8, 167875–167886. [Google Scholar] [CrossRef]
Boyko, V.; MacKenzie, P.; Patel, S. Provably secure password-authenticated key exchange using Diffie-Hellman. In Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques, Bruges, Belgium, 14–18 May 2000; pp. 156–171. [Google Scholar]
Lee, C.C.; Chen, C.T.; Wu, P.H.; Chen, T.Y. Three-factor control protocol based on elliptic curve cryptosystem for universal serial bus mass storage devices. IET Comput. Digit. Tech. 2013, 7, 48–55. [Google Scholar] [CrossRef]

Figure 1. System model in Wireless sensor networks (WSNs).

Figure 2. Sensor node registration phase of Moghadam et al.’s scheme.

Figure 3. User registration phase of Moghadam et al.’s scheme.

Figure 4. Login and authentication phase of Moghadam et al.’s scheme.

Figure 5. Sensor node registration phase of a secure and lightweight mutual authentication protocol (WSN-SLAP).

Figure 6. User registration phase of WSN-SLAP.

Figure 7. Login and authentication phase of WSN-SLAP.

Figure 8. Role of session, environment and goal.

Figure 9. Role of user.

Figure 10. Result of the Automated Verification of Internet Security Protocols and Applications (AVISPA) simulation.

Table 1. Notations.

Notation	Description
$U_{i}$	User
$G W$	Gateway
$S_{j}$	Sensor node
$I D_{i}$	Real identity of user
$P W_{i}$	Password of user
$P I D_{i}$	Pseudo identity of user
$S I D_{j}$	Real identity of sensor node
$k_{G W N}$	Master key of gateway
$K G$	Shared secret key between gateway and sensor node
X	Public key of gateway
G	Elliptic curve group
P	Generator of G
$R_{k}, N_{k}, z_{i}, a_{i}, f_{i}, g_{i}, q_{i}$	Random numbers
$T_{k}$	Timestamp
$S K$	Session key
$E_{k} / D_{k}$	Symmetric key encryption/decryption
$h (.)$	Hash function
$\| \|$	Concatenation function
⊕	Exclusive-or function

Table 2. The basic notations.

Notation	Description
$P_{1}, P_{2}$	Two principals
$S_{1}, S_{2}$	Two statements
$S K$	The session key
$P_{1} \|$ ≡ $S_{1}$	$P_{1}$ believes $S_{1}$
$P_{1} \|$ ∼ $S_{1}$	$P_{1}$ once said $S_{1}$
$P_{1}$ ⇒ $S_{1}$	$P_{1}$ controls $S_{1}$
$P_{1}$ ⊲ $S_{1}$	$P_{1}$ receives $S_{1}$
$# S_{1}$	$S_{1}$ is fresh
${S_{1}}_{K e y}$	$S_{1}$ is encrypted with $K e y$
$P_{1}$ $\overset{K e y}{\leftrightarrow}$ $P_{2}$	$P_{1}$ and $P_{2}$ have shared key $K e y$

Table 3. Computational costs comparison.

Schemes	User	Gateway	Sensor Node	Total	Total Cost (s)
Choi et al. [27]	$9 T_{h} + 3 T_{e c m}$	$6 T_{h} + 2 T_{e c m}$	$5 T_{h} + 1 T_{e c m}$	$20 T_{h} + 6 T_{e c m}$	$0.109$
Wu et al. [28]	$12 T_{h} + 2 T_{e c m} + 1 T_{s y m}$	$11 T_{h} + 2 T_{s y m}$	$4 T_{h} + 2 T_{e c m} + 1 T_{s y m}$	$27 T_{h} + 4 T_{e c m} + 4 T_{s y m}$	$0.09944$
Wu et al. [31]	$13 T_{h} + 2 T_{e c m}$	$13 T_{h}$	$4 T_{h} + 2 T_{e c m}$	$30 T_{h} + 4 T_{e c m}$	$0.078$
Moghadam et al. [6]	$5 T_{h} + 3 T_{e c m} + 2 T_{s y m}$	$5 T_{h} + 3 T_{e c m} + 2 T_{s y m}$	$3 T_{h} + 2 T_{e c m}$	$13 T_{h} + 8 T_{e c m} + 4 T_{s y m}$	$0.16336$
Ours	$13 T_{h}$	$18 T_{h}$	$6 T_{h}$	$37 T_{h}$	$0.01184$

Table 4. Communication costs comparison.

Schemes	Communication Costs	Number of Messages
Choi et al. [27]	3200 bits	4 messages
Wu et al. [28]	3296 bits	4 messages
Wu et al. [31]	3392 bits	4 messages
Moghadam et al. [6]	2512 bits	4 messages
Ours	2240 bits	4 messages

Table 5. Security properties.

Security Property	Choi et al. [27]	Wu et al. [28]	Wu et al. [31]	Moghadam et al. [6]	Ours
Insider Attack	∘	∘	×	×	∘
Stolen Smart Card Attack	×	×	×	∘	∘
Replay Attack	∘	∘	∘	∘	∘
Sensor Node Capture Attack	∘	∘	∘	∘	∘
Off-line Password Guessing Attack	×	×	∘	∘	∘
Privileged Insider Attack	∘	∘	×	∘	∘
Stolen Verifier Attack	×	∘	∘	∘	∘
MITM Attack	∘	∘	×	∘	∘
Session-Specific Random Number Leakage Attack	×	×	×	×	∘
Perfect Forward Secrecy	∘	∘	∘	×	∘
Mutual Authentication	∘	∘	∘	∘	∘

∘: Secure from the attack. ×: Insecure from the attack.

Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations.

© 2021 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).

Share and Cite

MDPI and ACS Style

Kwon, D.K.; Yu, S.J.; Lee, J.Y.; Son, S.H.; Park, Y.H. WSN-SLAP: Secure and Lightweight Mutual Authentication Protocol for Wireless Sensor Networks. Sensors 2021, 21, 936. https://doi.org/10.3390/s21030936

AMA Style

Kwon DK, Yu SJ, Lee JY, Son SH, Park YH. WSN-SLAP: Secure and Lightweight Mutual Authentication Protocol for Wireless Sensor Networks. Sensors. 2021; 21(3):936. https://doi.org/10.3390/s21030936

Chicago/Turabian Style

Kwon, Deok Kyu, Sung Jin Yu, Joon Young Lee, Seung Hwan Son, and Young Ho Park. 2021. "WSN-SLAP: Secure and Lightweight Mutual Authentication Protocol for Wireless Sensor Networks" Sensors 21, no. 3: 936. https://doi.org/10.3390/s21030936

APA Style

Kwon, D. K., Yu, S. J., Lee, J. Y., Son, S. H., & Park, Y. H. (2021). WSN-SLAP: Secure and Lightweight Mutual Authentication Protocol for Wireless Sensor Networks. Sensors, 21(3), 936. https://doi.org/10.3390/s21030936

Note that from the first issue of 2016, this journal uses article numbers instead of page numbers. See further details here.

Article Menu

WSN-SLAP: Secure and Lightweight Mutual Authentication Protocol for Wireless Sensor Networks

Abstract

1. Introduction

1.1. Contributions

1.2. Adversary Model

1.3. Organization

2. Related Works

3. Review of Moghadam et al.’s Scheme

3.1. Sensor Node Registration Phase

3.2. User Registration Phase

3.3. Login and Authentication Phase

4. Cryptanalysis of Moghadam et al.’s Scheme

4.1. Insider Attack

4.2. Perfect Forward Secrecy

4.3. Session-Specific Random Number Leakage Attack

5. Proposed Scheme

5.1. Sensor Node Registration Phase

5.2. User Registration Phase

5.3. Login and Authentication Phase

5.4. Password Update Phase

5.5. Sensor Node Addition Phase

6. Security Analysis

6.1. Informal Security Analysis

6.1.1. Insider Attack

6.1.2. Stolen Smart Card Attack

6.1.3. Replay Attack

6.1.4. Sensor Node Capture Attack

6.1.5. Off-Line Password Guessing Attack

6.1.6. Privileged Insider Attack

6.1.7. Stolen Verifier Attack

6.1.8. MITM Attack

6.1.9. Session-Specific Random Number Leakage Attack

6.1.10. Perfect Forward Secrecy

6.1.11. Mutual Authentication

6.2. BAN Logic

6.2.1. Rules

6.2.2. Goals

6.2.3. Idealized Forms

6.2.4. Assumptions

6.2.5. BAN Logic Proof

6.3. ROR Model

Security Proof

6.4. AVISPA Simulation

6.4.1. HLPSL Specifications

6.4.2. Simulation Result

7. Performance Analysis

7.1. Computational Costs

7.2. Communication Costs

7.3. Security Properties

8. Conclusions

Author Contributions

Funding

Institutional Review Board Statement

Informed Consent Statement

Conflicts of Interest

References

Share and Cite

Article Metrics

Article Access Statistics

Further Information

Guidelines

MDPI Initiatives

Follow MDPI