An Efficient Post-Quantum User Authentication Protocol for Wireless Sensor Networks Using NTRU

Abstract

Wireless sensor networks (WSNs) are pervasively employed in critical domains such as smart healthcare, industrial automation, and environmental surveillance, where secure access control is essential. User authentication protocols are vital for thwarting unauthorized intrusions, yet the vast majority of existing schemes rely on conventional public-key cryptography (such as ECC, RSA), which is provably insecure in the post-quantum era due to Shor’s algorithm. This motivates the design of post-quantum authentication that is also lightweight for resource-limited sensors. To address this challenge, we propose an efficient authentication and key agreement protocol based on Number Theory Research Unit (NTRU), a lattice-based cryptosystem offering proven resistance to quantum attacks. We have proven the correctness and security of our scheme through BAN logic and random oracle model and demonstrated through informal analysis that our scheme can resist various attack methods and possesses high security features. Moreover, we thoroughly evaluate our protocol against the most recent state-of-the-art schemes. The results indicate that our scheme has the lowest computational cost, and its communication cost is superior to that of most other schemes. Overall, our proposed protocol provides a robust, efficient, and future-proof authentication solution for WSNs, well-suited for deploying WSNs environments.

1. Introduction

Wireless sensor networks (WSNs) consist of numerous low-power resource-constrained sensor nodes deployed for environmental monitoring, industrial control, smart medical care and IoT systems [1]. The architecture of WSNs is shown in Figure 1. In WSNs, the sensors continuously collect sensitive data and transmit them to a user via a gateway node over wireless channels. However, the inherent openness of wireless channels makes user real-time access in WSNs vulnerable to various security and privacy threats [2]. User authentication acts as the core defense line to verify the legitimacy of communication entities. Without authentication mechanisms, attackers can forge sensor identities to inject false data or steal private monitoring information, which may lead to industrial system failures and leakage of patients’ private medical data [3]. Wireless sensor nodes within WSNs suffer from constrained energy supplies, limited computing capacity and narrow communication bandwidth, and they are generally deployed in unattended harsh field surroundings. These circumstances render traditional security mechanisms inapplicable to WSNs. In addition, the unprecedented progress of quantum computers has drastically undermined the security guarantees of traditional security frameworks, necessitating urgent countermeasures. Therefore, lightweight post-quantum secure authentication protocols are indispensable for the secure communication of WSNs.

Figure 1. The architecture of WSNs.

1.1. Related Works

In WSNs environments, the sensitivity of transmitted data imposes stringent security requirements alongside severe resource limitations on sensor nodes. To tackle these conflicting challenges, numerous hash-function-based user authentication schemes have been developed in the literature [4,5,6,7,8,9,10,11]. Despite their computational efficiency, these protocols are not immune to adversarial threats—offline password guessing attacks in particular. Such vulnerabilities can either expose the established session key or cause it to fall short of the required security criteria, thereby undermining the assurance of secure key negotiation between the two communicating parties.

To overcome the inherent weaknesses of hash-based authentication schemes, Wang et al. advocated the adoption of public-key cryptographic operations as a more robust foundation for protocol design in general scenarios [12]. Among the available public-key alternatives, elliptic curve cryptography (ECC) stands out for its shorter key lengths and superior computational speed relative to RSA and other conventional systems, which has led to its extensive deployment in numerous authentication frameworks. In 2023, Sahoo et al. [13] proposed an improved three-factor wireless sensor authentication scheme based on ECC in a 5G environment to address the flaws present in previous schemes. However, we found that if the smartcard and biometric information are obtained by an attacker, the adversary can guess the user’s password, thus failing to provide three-factor security. Additionally, the scheme’s users use the same pseudo-identity UID for each login, allowing attackers to track user behavior, thus failing to provide anonymity. Meanwhile, Xie et al. [14] also pointed out that the Sahoo’s scheme was vulnerable to attacks, such as no data transmission security, transmitted data can be forged, user impersonation attack, and simultaneous impersonation attacks on gateway and sensor node, and proposed some improvement suggestions. In 2024, Saini et al. [15] proposed a three-factor security scheme to enhance the security of health data communication between doctors and patients in wireless healthcare sensor networks and believed their scheme to be efficient. However, since their scheme employs the computationally expensive ECC point multiplication for mutual authentication not only at the user and sensor ends but also at the gateway end, we believe their scheme is not as efficient as they claimed. To address issues such as impersonation attack, password guessing attacks, and internal attack in WSNs authentication protocol schemes, Huang [16] proposed a three-factor user authentication and key agreement scheme based on ECC. After analyzing this scheme, we believe that, similar to Sahoo et al.’s scheme, anonymity cannot be achieved because users use the same TID_i for each login; similar to Saini et al.’s scheme, it is not efficient due to the extensive use of ECC point multiplication operations at the user end, gateway end, and sensor end. In 2025, Xu et al. [17] conducted a comprehensive cryptographic analysis of two authentication protocols [18,19] and demonstrated that they share four major vulnerabilities: offline password guessing attacks, node capture attacks, DoS service hijacking attacks, and the inability to achieve genuine multi-factor security and forward security. They also proposed an improvement scheme that employs a fuzzy verifier to compress the verification matching space to resist offline dictionary attacks and utilizes ECC to decouple the session key using public and private keys to circumvent node capture, thereby achieving forward security. In 2026, Yu et al. [20] proposed a lightweight authentication and key agreement protocol for resource-constrained IoT WSNs, utilizing ECC and PUF (physically unclonable function) to defend against common attacks and employing the Chinese Remainder Theorem to enable password recovery when users forget their passwords. However, we found that in their scheme, if the smartcard is obtained by the attacker, and the attacker also eavesdrops on the user login request messages on the public channel, by combining the secret parameters on the smartcard, the attacker can guess the user’s identity identifier and password, thereby being able to impersonate the user to log in to the system.

Due to its capability to produce seemingly random and unpredictable keys that effectively resist brute-force attacks, chaotic mapping is leveraged as a cryptographic primitive for building secure authentication schemes for WSNs in environments with stringent security requirements. Feng et al. [21] addressed the two core pain points in WSNs, namely the limited resources (computing, storage, and energy) of sensor nodes and the insecure public nature of communication channels. They proposed a lightweight two-factor authentication scheme based on Chebyshev chaotic mapping. However, this scheme claimed to be resistant to replay attacks and DoS attacks, but it did not use timestamps because it was actually impossible to achieve resistance to replay attack and DoS attack. According to our analysis, this scheme has the risk of desynchronization attack. In step 4 of the authentication stage, after the GW verifies the sensor successfully, it will update the temporary identity PID_i in the database to the new alias AID_i. At this time, if the last message is lost in the public channel (or intercepted and discarded by the attacker), then the user side still holds the old PID_i, while the GW side has already replaced the old value with a new one. Then, when the user attempts to log in next time, he sends PID_i to the GW, but the GW cannot match this identity in the database and will directly deny the service. Mo et al. [22] proposed a two-factor authentication protocol that combines the PUF and the Chebyshev chaotic mapping to address the overlooked physical cloning attack and node capture attacks in distributed wireless sensor networks. Wang et al. [23] proposed an authentication and key agreement protocol based on PUF, Chebyshev chaotic mapping, and three factors: biometric features, password, and smartcard, addressing the shortcomings of existing WSNs such as man-in-the-middle attack, replay attack, and physical cloning attacks.

With the development of quantum computing, cryptosystems capable of resisting quantum computer cracking are becoming increasingly important. Lattice-based cryptography is a new generation of cryptosystem designed to withstand this threat, and it is considered to be the most promising and fastest-standardizing anti-quantum cryptographic scheme at present. Currently, some authentication protocols have adopted lattice-based cryptosystems to achieve the authentication process and resist quantum attacks. Singh et al. [24] proposed a quantum-resistant authenticated key agreement protocol for WSNs. The core idea is to replace traditional discrete logarithm or large integer factorization problems with Ring Learning with Errors (RLWE) problems, aiming to resist the threat posed by future quantum computers to classical cryptosystems such as RSA and ECC. However, we have identified a significant logical error in their scheme, namely the misuse of the reconciliation function ψ₂(,), which renders the scheme inoperable. In 2025, Jiang et al. [25] proposed a novel authentication protocol based on the NTRU cryptosystem to address two core challenges faced by underwater wireless sensor networks (UWSNs)—resource constraints (limited computation, storage, and energy of nodes) and the threat of quantum computing attacks. NTRU is a lattice-based lightweight public-key cryptosystem with security relying on the worst-case shortest vector problem (SVP) and closest vector problem (CVP) on lattices, offering fast encryption/decryption and low resource overhead [26]. Traditional authentication protocols, which either incur excessive computational overhead or fail to resist quantum attacks, struggle to balance security and efficiency in UWSNs. However, we find that the proposed scheme cannot resist an offline password guessing attack, and the use of NTRU encryption and decryption at the gateway side also makes the scheme computationally inefficient overall. Ahmad et al. [27] addressed the issue that existing post-quantum authentication schemes for the Internet of medical things (IoMT) environment, although quantum-resistant, incur excessive computational overhead and are thus unsuitable for resource-constrained IoMT devices. To this end, they proposed a lightweight quantum-resistant user authentication protocol based on the RLWE algorithm. However, upon analysis, we find that the scheme suffers from a fundamental flaw in mathematical and logical terms that makes it infeasible to execute. Specifically, in step 3 of the login and authentication phase, the sensor node does not possess sid_i and m_i, and consequently cannot recover ν_i′ and id_i′, thereby preventing the subsequent steps from being executed. Chaotic cryptography has also been explored for lightweight IoT sensing security [28,29]. Its attractive features include high sensitivity to initial conditions, pseudorandom keystreams, large key space, and resistance to statistical and differential attacks. However, inherent drawbacks remain: classical chaotic maps often have narrow chaotic parameter ranges, non-uniform dynamics, and periodic windows, which make keystreams predictable and vulnerable to known plaintext attacks. They also require abundant keystreams and complex key management, and they are symmetric primitives that cannot provide mutual authentication or key agreement under quantum attacks. Memristive-neuron models improve complexity and randomness but do not remove these limitations. In contrast, NTRU bases its security on hard lattice problems (SVP/CVP), offering quantum-resistant authentication and key agreement for WSNs.

1.2. Motivation and Contribution

From the previous analysis, it can be seen that currently a considerable number of authentication protocols are based on public key cryptography systems (such as ECC). A more fundamental concern is that the security of all traditional public-key primitives relies on the intractability of the integer factorization problem and the discrete logarithm problem, which have been proven by Shor to be easily broken by polynomial-time quantum algorithms [30]. Moreover, the current solution still has several security flaws, such as being unable to resist quantum attacks, offline password guessing attacks, and user impersonation attacks. Additionally, the computational cost and communication cost are relatively high, which imposes a significant burden on resource-constrained sensors. To address these issues, this paper proposes a lightweight security authentication protocol based on the NTRU algorithm for WSNs, which boasts low computation and communication costs, is capable of defending against common attacks, and is suitable for deploying on resource-constrained wireless sensors.

Our contributions are threefold:

(1)

We propose an NTRU-based authentication scheme for WSNs, which not only resists quantum attack but also achieves low computation and communication costs.

(2)

We have demonstrated that our scheme meets the security requirements through formal security proofs under BAN logic and random oracle model, as well as informal security analysis.

(3)

We compare our scheme with the latest state-of-the-art related schemes in terms of computational and communication costs. The results show that our scheme is not only feasible but also efficient.

2. Preliminaries

2.1. Lattice

A lattice L is a discrete additive subgroup of Rⁿ. Given m linearly independent basis vectors b₁, b₂, …, b_e ∈ Rⁿ, the lattice is formally defined as: v ∈ L, and

$$L =\left\{{\displaystyle \sum _{i=1}^m}{z}_i{b}_i\mid z_i\in Z\right\}$$

where m is the lattice rank, and n denotes the ambient dimension. All lattice points are integer linear combinations of basis vectors. Lattices possess a rich geometric structure, which gives rise to several computationally hard problems that form the foundation of post-quantum cryptography. Two of the most critical foundational problems are SVP and CVP—the Shortest Vector Problem and the Closest Vector Problem, respectively. SVP asks, given a lattice basis, to find a non-zero lattice vector v ∈ L that minimizes the Euclidean norm ||v||. CVP, given a basis of a lattice L and a target point t (not necessarily in the lattice), finds a lattice vector closest to t. Neither SVP nor CVP can be solved in polynomial time by classical or quantum algorithms, which distinguishes lattice cryptography from quantum-vulnerable ECC and chaotic maps cryptosystems for WSNs.

2.2. NTRU Cryptosystem

The lattice-based public-key cryptosystem NTRU was originally proposed by Hoffstein, Pipher, and Silverman back in 1998 [26]. Unlike RSA or ECC, whose security relies on integer factorization or discrete logarithms (vulnerable to Shor’s algorithm), NTRU’s security reduces to solving SVP (or CVP) in a convolutional polynomial ring. NTRU is renowned for its high efficiency and low resource consumption, making it ideal for WSNs.

The scheme operates in the ring R = ℤ[x]/(xⁿ − 1), where n is a positive integer (typically a prime). Three parameters define an instantiation: n, a small modulus p (usually 2 or 3), and a large modulus q with gcd(p,q) = 1 and q ≫ p. Polynomial sets L_f, L_g, Lᵣ, and L_m restrict coefficient ranges (e.g., {−1, 0, 1}) to ensure security and correctness.

Key Generation: Randomly choose f ∈ L_f and g ∈ L_g such that f is invertible modulo p and q. Compute F_p ≡ f⁻¹ (mod p) and F_q ≡ f⁻¹ (mod q). The public key is h ≡ F_q · g (mod q), and the private key is (f, F_q).

Encryption: For a plaintext m ∈ L_m, select a random blinding polynomial r ∈ Lᵣ and compute

e = p · r · h + m (mod q)

Decryption: The recipient computes a = f · e (mod q), reduces its coefficients to (−q/2, q/2], and recovers

m′ = F_p · a (mod p).

NTRU leverages fast cyclic polynomial multiplication to cut computation and memory overhead, perfectly matching the strict power and storage limits of low-power WSNs sensors, and serves as the post-quantum core of the proposed authentication protocol.

The NTRU ring-dimension n yields a critical security-performance trade-off. A larger n improves post-quantum resilience against SVP/CVP lattice attacks, yet raises polynomial-multiplication latency and memory consumption for constrained sensors. A smaller n accelerates NTRU encryption/decryption but reduces lattice security margins. This paper adopts a moderate-n setting balancing both metrics for WSN scenarios. Designers may adjust n for use-cases prioritizing either stronger security or lower latency.

3. Proposed Scheme

The scheme we propose includes system initialization phase, sensor registration phase, user registration phase, authentication phase, and password update phase. We will detail the specifics of each phase in this section, with the symbols and their meanings listed in Table 1.

Table 1. Notation and its meaning.

Notation	Meaning
Ui	The ith user
GW	The gateway node
SNj	The jth sensor node
UIDi	Identity of user
UPWi	Password of user Ui
SIDj	Identity of sensor SNj
Kg	Master secret key of the gateway
Sug	Shared secret between Ui and GW established during registration
TSi	Timestamps used in the authentication phase, i = 1,2,3,4
ΔT	Maximum allowable transmission delay
H()	Secure one-way hash function
⊕	Bitwise XOR operation
||	Concatenation operation
→	Transmission over a public channel
⇒	Transmission over a secure channel

3.1. System Initialization Phase

The system comprises three types of participants: U_i, GW, SN_j.

(1)

GW publishes the public parameters {p, q, n, n₀}, where {p, q, n, n₀} is defined as required in Section 2.2, and n₀ ∈ [24, 28] to all participating entities.

(2)

U_i selects polynomials f_u ∈ L_f and g_u ∈ L_g satisfying the condition of being invertible both modulo q and modulo p; that is, f_u · $f_{{-1}_{u,p}}$ ≡ 1 (mod p), f_u · $f_{{-1}_{u,q}}$ ≡ 1 (mod q), with the inverse element denoted by $f_{{-1}_{u,p}}$ and $f_{{-1}_{u,q}}$, respectively. U_i’s public key is computed as h_u = p·$f_{{-1}_{u,q}}$ · g_u (mod q), and the corresponding private key is the pair (f_u, $f_{{-1}_{u,p}}$).

(3)

SN_j selects polynomials f_s ∈ L_f and g_s ∈ L_g satisfying f_s · $f_{{-1}_{s,p}}$ ≡ 1 (mod p), f_s · $f_{{-1}_{s,q}}$≡ 1 (mod q). SN_j’s public key is computed as h_s = p·$f_{{-1}_{s,q}}$ · g_s (mod q), and the corresponding private key is (f_s, $f_{{-1}_{s,p}}$).

3.2. Sensor Registration Phase

The sensor SN_j registers with the gateway GW before being deployed to the network. This phase establishes the necessary credentials for the sensor to participate in subsequent authentication operations.

(1)

The sensor SN_j chooses its identity SID_j and transmits a registration request message {SID_j, h_s}to GW via a secure channel.

(2)

Upon receiving the registration request, GW checks whether the identity SID_j already exists in its database. If SID_j is found, GW aborts the registration process. Otherwise, GW computes a secret key specifically for SN_j as K_j = H(SID_j||K_g), where K_g is GW’s master secret key. GW stores the tuple {SID_j, K_j, h_s} in its local database and transmits the message {K_j, h_s} to SN_j through the secure channel.

(3)

SN_j stores {K_j, h_s} in its memory.

This phase is summarized in Figure 2.

Figure 2. The sensor registration phase.

3.3. User Registration Phase

The user U_i registers with the gateway GW to obtain a personalized smartcard that will be used for subsequent authenticated access to sensors.

(1)

U_i keys their identity U_IDi and password U_PWi, selects a nonce x and computes RID_i = H(U_IDi||x), F_i = H(U_PWi||x) mod n₀, and transmits a registration request message {U_IDi, RID_i} to GW via a secure channel.

(2)

Upon receiving the registration request, GW verifies whether U_IDi already exists in its user database. If the identity is already registered, the gateway aborts the registration. Otherwise, GW computes K_i = H(RID_i||K_g) and stores {U_IDi K_i, h_u} in its database. Finally, GW sends a smartcard containing {K_i, h_s} to the user via a secure channel.

During registration over the secure channel, GW validates $h_u$ by checking that $\mathrm{d}\mathrm{e}\mathrm{g}\left(h_u\right)<n$, all coefficients lie in ${\mathbb{Z}}_q$, $h_u\ne 0$, and $h_u$ conforms to the NTRU public-key format. Any malformed or maliciously constructed key causes GW to abort registration; thus, external adversaries cannot upload forged NTRU public keys. The function of deg() is to return the exponent of the highest non-zero degree term of a polynomial.

(3)

Upon receiving the smartcard, U_i computes B_i = H(U_IDi||U_PWi) ⊕ x, $C_i=K_i$ ⊕ F_i mod n₀, deletes the K_i from the smartcard, and then stores {B_i, C_i, F_i} onto the smartcard.

This phase is summarized in Figure 3.

Figure 3. The user registration phase.

3.4. Authentication Phase

This phase enables the user U_i to establish mutual authentication with the sensor SN_j through the mediation of the gateway GW, culminating in the establishment of a shared session key. The phase proceeds in five sequential steps.

(1)

U_i inserts the smartcard into a card reader and inputs U_IDi and U_PWi. The smartcard performs the following computations: x = B_i ⊕ H(U_IDi||U_PWi), F_i’ = H(U_PWi||x) mod n₀ and then verifies whether F_i′ equals the stored value F_i. If the equality does not hold, the session is terminated immediately. Otherwise, the card computes K_i = C_i ⊕ F_i’ mod n₀, selects a random nonce a_i and generates a current timestamp TS₁ and r_u ∈ Lᵣ, computes V₁ = H(s_ug) ⊕ (U_IDi||SID_j||TS₁), V₂ = p·h_s·r_u + (a_i||U_IDi||h_u), m₁ = H(U_IDi||K_i||h_u||TS₁), and transmits the login request message {V₁, V₂, m₁, TS₁} to the GW over the public channel.

(2)

Upon receiving the login request, GW checks the freshness of timestamp TS₁ using the current time TS₁*. If |TS₁* − TS₁| > ΔT, GW aborts the session; otherwise, GW extracts the identities by computing (U_IDi||SID_j||TS₁) = H(s_ug) ⊕ V₁, retrieves the stored parameters {K_i, h_u} from the database using the extracted U_IDi, and verifies whether m₁ == H(U_IDi||K_i||h_u||TS₁). If the verification fails, GW terminates the session. Otherwise, GW retrieves K_j from the database using the extracted SID_j and computes m₂ = H(U_IDi||K_j||TS₂), where TS₂ is the current timestamp. Finally, GW transmits the message {V₂, m₂, TS₂} to SN_j over the public channel.

(3)

Upon receiving the message from the gateway, SN_j checks the freshness of timestamp TS₂ using the current time TS₂*. If |TS₂* − TS₂| > ΔT, SN_j terminates the session; otherwise, SN_j decrypts V₂ using the NTRU private key (f_s, $f_{{-1}_{s,p}}$) to recover a_i||U_IDi||h_u and verifies whether m₂′ == H(U_IDi||K_j||TS₂). If the verification fails, SN_j aborts the session; otherwise, SN_j selects a random nonce b_j and generates a current timestamp TS₃ and r_s ∈ Lᵣ, computes SK_u−s = H(a_i||b_j||U_IDi||SID_j), V₄ = p · h_u · r_s + b_j, m₃ = H(K_j||SID_j||U_IDi||TS₃), m₄ = H(b_j||SID_j||U_IDi||TS₃), and transmits the message {V₄, m₃, m₄, TS₃} to GW.

(4)

Upon receiving SN_j’s response, GW checks the freshness of timestamp TS₃ using the current time TS₃*. If |TS₃* − TS₃| > ΔT, the gateway aborts the session; otherwise, GW verifies whether m₃′ == H(K_j||SID_j||U_IDi||TS₃). If the verification fails, the gateway terminates the session; otherwise, GW picks up the current timestamp TS₄, computes m₅ == H(K_i||U_IDi||TS₄), and transmits the message {V₄, m₄, m₅, TS₄} to U_i over the public channel.

(5)

Upon receiving the final message from GW, U_i checks the freshness of timestamp TS₄ using the current time TS₄*. If |TS₄* − TS₄| > ΔT, the user aborts the session; otherwise, U_i verifies whether m₅′ == H(K_i||U_IDi||TS₄). If the verification fails, the user terminates the session; otherwise, the user decrypts V₄ to recover the random nonce b_j and verifies whether m₄′ == H(b_j||SID_j||U_IDi||TS₃). If the verification fails, the user terminates the session; otherwise, U_i computes the session key SK_u−s = H(a_i||b_j||U_IDi||SID_j).

At the conclusion of this phase, both U_i and SN_j have mutually authenticated each other and established the shared session key $S{K}_{u-s}$, which can be used for subsequent secure communications.

This phase is summarized in Figure 4.

Figure 4. The authentication phase.

3.5. Password Update Phase

When the user wishes to change their password, the following steps are performed locally on the smartcard without requiring interaction with the gateway.

(1)

U_i inserts the smartcard and inputs U_IDi and the current password U_PWi. The smartcard computes x = B_i ⊕ H(U_IDi||U_PWi), F_i′ = H(U_PWi ||x) mod n₀, verifies whether F_i′ equals the stored value $F_i$. If the verification fails, the session is terminated. Otherwise, the smartcard computes K_i == C_i ⊕ F_i’ mod n₀.

(2)

U_i is prompted to input the new password $U_{new PWi}$. The smartcard performs the following computations: F_i^new= H($U_{new PWi}$||x) mod n, B_i^new= H(U_IDi||$U_{new PWi}$) ⊕ x, C_i^new = K_i⊕F_i^new, replace the stored smartcard parameters (B_i, C_i, F_i) with the new values (B_i^new, C₂^new, F_i^new).

The password update is now complete, and the user may use the new password U _{new PWi} for subsequent login attempts.

4. Security Analysis

In this section, we assess the security of this scheme using BAN logic [31] and the random oracle model. Additionally, we provide heuristic analysis to demonstrate that this scheme can resist a variety of known attacks.

4.1. Formal Security Proof Under the BAN Logic

For brevity, we will not introduce the rules and symbols of BAN logic. Interested readers may refer to [32].

The actual authentication-phase messages are

$$\begin{array}{ll}M1& {:U}_i\to GW:\{V_1,V_2,m_1,{TS}_1\},\\ M2& :GW\to S{N}_j:\{V_2,m_2,{TS}_2\},\\ M3& :S{N}_j\to GW:\{V_4,m_3,m_4,{TS}_3\},\\ M4& :GW\to U_i:\{V_4,m_4,m_5,{TS}_4\}.\end{array}$$

The relevant computations are

$$\begin{array}{ll}{V}_1& =H\left(s_{ug}\right)\oplus \left(U_{IDi}\parallel SI{D}_j\parallel {TS}_1\right),\\ V_2& ={ph}_u{r}_u+\left(a_i\parallel U_{IDi}\parallel h_u\right),\\ m_1& =H\left(U_{IDi}\parallel K_i\parallel h_u\parallel a_i\parallel {TS}_1\right),\\ m_2& =H\left(U_{IDi}\parallel K_j\parallel {TS}_2\right),\\ V_4& ={ph}_u{r}_s+b_j,\\ m_3& =H\left(K_j\parallel SI{D}_j\parallel U_{IDi}\parallel {TS}_3\right),\\ m_4& =H\left(b_j\parallel SI{D}_j\parallel U_{IDi}\parallel {TS}_3\right),\\ m_5& =H\left(K_i\parallel U_{IDi}\parallel {TS}_4\right).\end{array}$$

In BAN logic, a hash/MAC authenticated by a shared key can be abstracted as a message encrypted/authenticated with that key. Thus, the idealized messages are

$$\begin{array}{l}M1 (U_i \to \mathit{GW}): ⟨U_{IDi},SI{D}_j,a_i,h_u,{TS}_1{⟩}_{K_i}\\ M2 (\mathit{GW} \to { \mathit{SN}}_j):⟨U_{IDi},SI{D}_j,a_i,h_u,{TS}_2{⟩}_{K_j}\\ M3 ({\mathit{SN}}_j \to \mathit{GW}): ⟨SI{D}_j,U_{IDi},b_j,{TS}_3{⟩}_{K_j}\\ M4 (\mathit{GW} \to { U}_i):⟨SI{D}_j,b_j,{TS}_4{⟩}_{K_i}\end{array}$$

We formulate the following assumptions in accordance with the protocol’s initialization.

$$\begin{array}{l}(\mathrm{A}1) \mathit{GW}\mid \equiv { U}_i\stackrel{ K_i}{\leftrightarrow }\mathit{GW}\\ (\mathrm{A}2) \mathit{GW}\mid \equiv {\mathit{SN}}_j\stackrel{ K_j}{\leftrightarrow }\mathit{GW}\\ (\mathrm{A}3) U_i\mid \equiv U_i\stackrel{ K_i}{\leftrightarrow }\mathit{GW}\\ (\mathrm{A}4) {\mathit{SN}}_j\mid \equiv {\mathit{SN}}_j\stackrel{ K_j}{\leftrightarrow }\mathit{GW}\\ (\mathrm{A}5) U_i\mid \equiv \mathit{GW} \Rightarrow \left(U_i\stackrel{ \mathit{SK}}{\leftrightarrow }{\mathit{SN}}_j\right)\\ (\mathrm{A}6) {\mathit{SN}}_j\mid \equiv \mathit{GW} \Rightarrow \left(U_i\stackrel{ \mathit{SK}}{\leftrightarrow }{\mathit{SN}}_j\right)\\ (\mathrm{A}7) U_i\mid \equiv {\mathit{SN}}_j \Rightarrow b_j\\ (\mathrm{A}8) {\mathit{SN}}_j\mid \equiv U_i \Rightarrow a_i\\ (\mathrm{A}9) \mathit{GW}\mid \equiv \#\left({TS}_1\right)\\ (\mathrm{A}10) {\mathit{SN}}_j\mid \equiv \#\left({TS}_2\right)\\ (\mathrm{A}11) \mathit{GW}\mid \equiv \#\left({TS}_3\right)\\ (\mathrm{A}12) U_i\mid \equiv \#\left({TS}_4\right)\\ (\mathrm{A}13) \mathit{GW}\mid \equiv \#\left(a_i\right)\\ (\mathrm{A}14) U_i\mid \equiv \#\left(b_j\right)\\ (\mathrm{A}15) {\mathit{SN}}_j\mid \equiv U_i\stackrel{ h_u}{\leftrightarrow }{U}_i \\ (\mathrm{A}16) U_i\mid \equiv { \mathit{SN}}_j\stackrel{ h_s}{\leftrightarrow }{\mathit{SN}}_j\\ (\mathrm{A}17) {\mathit{SN}}_j\mid \equiv \mathit{priv}\left(h_s\right)\\ (\mathrm{A}18) U_i\mid \equiv \mathit{priv}\left(h_u\right)\\ (\mathrm{A}19) GW\mid \equiv { U}_i\stackrel{ h_u}{\leftrightarrow }{U}_i\\ (\mathrm{A}20) GW\mid \equiv {\mathit{SN}}_j\stackrel{ h_s}{\leftrightarrow }{\mathit{SN}}_j\\ (\mathrm{A}21) \mathit{GW}\mid \equiv \#U_i\stackrel{ S_{\mathit{ug}}}{\leftrightarrow }\mathit{GW}\end{array}$$

The practical prerequisites for A1–A21 and their validity in real-world WSN deployments are listed in Table 2.

Table 2. The practical prerequisites for A1–A21 and their validity in real-world WSN.

Assumption	Practical Prerequisite	Valid in Real-World WSN?
A1	$K_i=H\left(RI{D}_i\parallel K_g\right)$ is established during user registration over a secure channel; only $U_i$ and $GW$ know it; smartcard is tamper-resistant.	Valid under secure registration and tamper-resistant smartcard.
A2	$K_j=H\left(SI{D}_j\parallel K_g\right)$ is distributed during sensor registration over a secure channel; only $S{N}_j$ and $GW$ know it.	Valid under secure pre-deployment/registration.
A3	$U_i$ can correctly recover $K_i$ from the smartcard.	Valid if smartcard is secure and password-protected.
A4	$S{N}_j$ securely stores $K_j$.	Valid if sensor is tamper-resistant.
A5	$U_i$ trusts $GW$’s jurisdiction over the session key.	Valid if $GW$ is trusted.
A6	$S{N}_j$ trusts $GW$’s jurisdiction over the session key.	Valid if $GW$ is trusted.
A7	$U_i$ trusts $S{N}_j$’s jurisdiction over $b_j$; $S{N}_j$’s random source is reliable.	Valid if $S{N}_j$ is tamper-resistant, and its RNG is secure.
A8	$S{N}_j$ trusts $U_i$’s jurisdiction over $a_i$, and trusts $GW$’s forwarding of $U_i$’s authentication result.	Valid if user device is trusted, and $GW$ is trusted.
A9	$GW$ can verify freshness of ${TS}_1$; $U_i$ and $GW$ are time-synchronized.	Valid under lightweight time synchronization.
A10	$S{N}_j$ can verify freshness of ${TS}_2$; $S{N}_j$ and $GW$ are time-synchronized.	Valid under lightweight time synchronization.
A11	$GW$ can verify freshness of ${TS}_3$; $GW$ and $S{N}_j$ are time-synchronized.	Valid under lightweight time synchronization.
A12	$U_i$ can verify freshness of ${TS}_4$; $U_i$ and $GW$ are time-synchronized.	Valid under lightweight time synchronization.
A13	$a_i$ is bound with ${TS}_1$; $GW$ derives freshness of $a_i$ from freshness of ${TS}_1$.	Valid when $m_1$ covers $a_i$.
A14	$b_j$ is bound with ${TS}_4/m_4$; $U_i$ derives freshness of $b_j$ from freshness of ${TS}_4$.	Valid when $b_j$ is fresh in each session.
A15	$S{N}_j$ believes $h_u$ is $U_i$’s public key, and the corresponding private key is known only to $U_i$.	Valid if public keys are pre-loaded or authenticated.
A16	$U_i$ believes $h_s$ is $S{N}_j$’s public key.	Valid if public keys are pre-loaded or authenticated.
A17	$S{N}_j$ securely stores its NTRU private key $\left(f_s,f_s^i\right)$.	Valid if sensor is tamper-resistant.
A18	$U_i$ securely stores its private key $\left(f_u,f_u^i\right)$.	Valid if smartcard is tamper-resistant.
A19	$GW$ securely stores $\{U_{IDi},K_i,h_u\}$, with correct binding between identity and public key.	Valid under secure registration.
A20	$GW$ securely stores $\{SI{D}_j,K_j,h_s\}$, with correct binding between identity and public key.	Valid under secure registration.
A21	$s_{ug}$ is a long-term shared secret established during registration and shared between $U_i$ and $GW$; its freshness is provided by ${TS}_1$, not by $s_{ug}$ itself.	Valid under secure registration. The original $\#\left(s_{ug}\right)$ assumption is unreasonable and has been corrected.

We define the goals of our scheme as follows:

$$\begin{array}{l}G1:U_i| \equiv (U_i\stackrel{ SK}{\leftrightarrow }{SN}_j)\\ G2:S_j| \equiv (U_i\stackrel{ SK}{\leftrightarrow }{SN}_j)\\ G3:U_i| \equiv {SN}_j| \equiv (U_i \stackrel{ SK}{\leftrightarrow }{SN}_j)\\ G4:{SN}_j| \equiv U_i| \equiv (U_i \stackrel{ SK}{\leftrightarrow }{SN}_j)\end{array}$$

Based on the above definitions and BAN logic rules, we conduct the proof of the protocol’s validity as follows.

Step 1. From M1, $\mathit{GW}$ receives $\mathit{GW}⊲ <{ U}_{I{D}_i}, {\mathit{SID}}_j,{ a}_i, h_u, {TS}_1{ > }_{K_i}.$

Step 2. By Message-Meaning Rule with assumption A1, we obtain

$$\mathit{GW}\mid \equiv U_i\mid \sim <U_{I{D}_i}, {\mathit{SID}}_j,{ a}_i,{ h}_u, {TS}_1>.$$

Step 3. By Freshness Rule with A9, we obtain $\mathit{GW}\mid \equiv \#\left(U_{I{D}_i}, {\mathit{SID}}_j,{ a}_i,{ h}_u, {TS}_1\right).$

Step 4. By Nonce-Verification Rule from Steps 2 and 3, we obtain

$$\mathit{GW}\mid \equiv U_i\mid \equiv <U_{I{D}_i}, {\mathit{SID}}_j,{ a}_i,{ h}_u, {TS}_1>.$$

Step 5. By Belief Rule, we obtain $GW\mid \equiv U_i\mid \equiv a_i,\mathit{GW}\mid \equiv U_i\mid \equiv U_{I{D}_i},\mathit{GW}\mid \equiv U_i\mid \equiv { h}_u.$

Step 6. From M2, ${\mathit{SN}}_j$ receives ${\mathit{SN}}_j⊲ <{ U}_{I{D}_i}, a_i,{ h}_u, {TS}_2{>}_{K_j}.$

Step 7. By Message-Meaning Rule with A4, we obtain

$${\mathit{SN}}_j\mid \equiv \mathit{GW}\mid \sim <U_{I{D}_i},{{\mathit{SID}}_j, a}_i,{ h}_u, {TS}_2⟩.$$

Step 8. By Freshness Rule with A10, we obtain ${\mathit{SN}}_j\mid \equiv \#\left(U_{I{D}_i},{\mathit{SID}}_j, a_i,{ h}_u, {TS}_2\right).$

Step 9. By Nonce-Verification Rule, we obtain ${\mathit{SN}}_j\mid \equiv \mathit{GW}\mid \equiv <U_{I{D}_i},{{\mathit{SID}}_j, a}_i, h_u, {TS}_2>.$

Step 10. By Belief Rule, we obtain ${\mathit{SN}}_j\mid \equiv \mathit{GW}\mid \equiv a_i.$

Step 11. Since $\mathit{GW}$ in Step 5 already believes that $U_i$ originated $a_i$, and $\mathit{GW}$ is trusted by ${\mathit{SN}}_j$ (A4), the sensor can infer that $a_i$ was indeed generated by $U_i$. Formally, combining Step 10 and the fact that $\mathit{GW}$ believes $U_i$’s claim, we obtain ${\mathit{SN}}_j\mid \equiv U_i\mid \sim a_i.$

Step 12. By A8 and the Jurisdiction Rule, we obtain ${\mathit{SN}}_j\mid \equiv a_i.$

Step 13. From M3, $\mathit{GW}$ receives $\mathit{GW}⊲ <{\mathit{SID}}_j, U_{I{D}_i}, b_j, {TS}_3{>}_{K_j}.$

Step 14. By Message-Meaning Rule with A2, we obtain $\mathit{GW}\mid \equiv {\mathit{SN}}_j\mid \sim <{\mathit{SID}}_j, U_{I{D}_i},{ b}_j, {TS}_3>.$

Step 15. By Freshness Rule with A13 and extending freshness to the whole message, we obtain

$$\mathit{GW}\mid \equiv \#\left({\mathit{SID}}_j,{ U}_{I{D}_i},{ b}_j, {TS}_3\right).$$

Step 16. By Nonce-Verification Rule, we obtain $\mathit{GW}\mid \equiv {\mathit{SN}}_j\mid \equiv <{\mathit{SID}}_j,{ U}_{I{D}_i}, b_j, {TS}_3>.$

Step 17. By Belief Rule, we obtain $\mathit{GW}\mid \equiv {\mathit{SN}}_j\mid \equiv { b}_j.$

Step 18. From M4, $U_i$ receives $U_i⊲ <{\mathit{SID}}_j,{ b}_j, {TS}_4{>}_{K_i}.$

Step 19. By Message-Meaning Rule with A3, we obtain $U_i\mid \equiv \mathit{GW}\mid \sim <{\mathit{SID}}_j, b_j, {TS}_4>.$

Step 20. By Freshness Rule with A12, we obtain $U_i\mid \equiv \#\left({\mathit{SID}}_j,{ b}_j, {TS}_4\right).$

Step 21. By Nonce-Verification Rule, we obtain $U_i\mid \equiv \mathit{GW}\mid \equiv <{\mathit{SID}}_j, b_j, {TS}_4>.$

Step 22. By Belief Rule, we obtain $U_i\mid \equiv \mathit{GW}\mid \equiv { b}_j.$

Step 23. From Step 17, $\mathit{GW}$ believes that ${\mathit{SN}}_j$ originated $b_j$. Since $U_i$ trusts $\mathit{GW}$’s judgment (A5), and the message is authenticated by $\mathit{GW}$, we can conclude that $U_i\mid \equiv {\mathit{SN}}_j\mid \sim b_j.$

Step 24. By A7 and the Jurisdiction Rule, we obtain $U_i\mid \equiv b_j.$

The session key is defined as $\mathit{SK} = H\left(a_i\left|\right|b_j\left|\right|U_{I{D}_i}\left|\right|{\mathit{SID}}_j\right).$

Step 25. From Step 12, ${\mathit{SN}}_j\mid \equiv { a}_i$. The sensor also knows its own nonce $b_j$ and the identities $U_{I{D}_i}, {\mathit{SID}}_j.$ Therefore, ${\mathit{SN}}_j\mid \equiv \left(a_i,{ b}_j, U_{I{D}_i}, {\mathit{SID}}_j\right).$

Step 26. Since $\mathit{SK}$ is a deterministic function of these values, the sensor believes that the key is shared with the user: ${\mathit{SN}}_j\mid \equiv U_i\stackrel{ \mathit{SK}}{\leftrightarrow }{\mathit{SN}}_j.$

Thus, G2 holds.

Step 27. From Step 24, $U_i\mid \equiv b_j.$ The user knows its own nonce $a_i$ and the identities. Hence,

$$U_i\mid \equiv \left(a_i, b_j,{ U}_{I{D}_i}, {\mathit{SID}}_j\right).$$

Step 28. By the same reasoning, we obtain $U_i\mid \equiv U_i\stackrel{ \mathit{SK}}{\leftrightarrow }{\mathit{SN}}_j.$

Thus, G1 holds.

Step 29. From Step 5, $\mathit{GW}\mid \equiv U_i\mid \equiv a_i$; from Step 5, $\mathit{GW}\mid \equiv {\mathit{SN}}_j\mid \equiv b_j$; GW also knows ${ U}_{I{D}_i}$ and ${\mathit{SID}}_j$. Therefore,

$$\mathit{GW}\mid \equiv U_i\mid \equiv \left(a_i,{ b}_j, U_{I{D}_i}, {\mathit{SID}}_j\right)$$

$$\mathit{GW}\mid \equiv {\mathit{SN}}_j\mid \equiv \left(a_i,{ b}_j, U_{I{D}_i}, {\mathit{SID}}_j\right)$$

Since SK is a deterministic function of these values,

$$\mathit{GW}\mid \equiv U_i\mid \equiv \left(U_i\stackrel{ \mathit{SK}}{\leftrightarrow }{\mathit{SN}}_j\right)$$

$$\mathit{GW}\mid \equiv {\mathit{SN}}_j\mid \equiv \left(U_i\stackrel{ \mathit{SK}}{\leftrightarrow }{\mathit{SN}}_j\right)$$

Step 30. From Step 21, $U_i\mid \equiv \mathit{GW}\mid \equiv <{\mathit{SID}}_j, b_j, {TS}_4>$. By A5, $U_i$ trusts $GW$’s jurisdiction over the session key. Combined with Step 29, where $\mathit{GW}$ believes that ${\mathit{SN}}_j$ believes the session key, $U_i$ can conclude that

$$U_i\mid \equiv {\mathit{SN}}_j\mid \equiv \left(U_i\stackrel{ \mathit{SK}}{\leftrightarrow }{\mathit{SN}}_j\right)$$

Thus, G3 holds.

Step 31. From Step 9,${ \mathit{SN}}_j\mid \equiv \mathit{GW}\mid \equiv <U_{I{D}_i},{{\mathit{SID}}_j, a}_i, h_u, {TS}_2>$. By A6, ${SN}_j$ trusts $GW$’s jurisdiction over the session key. Combined with Step 29, where $GW$ believes that $U_i$ believes the session key, $S{N}_j$ can conclude

$${\mathit{SN}}_j\mid \equiv U_i\mid \equiv \left(U_i\stackrel{ \mathit{SK}}{\leftrightarrow }{\mathit{SN}}_j\right)$$

Thus, G4 holds.

Therefore, the achievement of Goals 1–4 implies that the proposal enables U_i and SN_j to mutually authenticate each other, while simultaneously negotiating a shared session key for subsequent communications.

4.2. Formal Security Proof Under Random Oracle Model

The security of the proposed scheme is formally validated in the random oracle model in this subsection. For conciseness, we adopt the adversary model of [33,34] without loss of generality.

Theorem 1.

Let Π denote the proposal, and let the hash function $H:\{0,1{\}}^{*}\to \{0,1{\}}^{\mathcal{l}}$ be modeled as a random oracle, where l is the bit-length of hash output. Let the NTRU encryption scheme be instantiated with public parameters $\left(p,q,n,n_0,L_f,L_g,L_r\right)$, and assume that the NTRU decryption problem (NDP) is hard: for any probabilistic polynomial-time algorithm running in time t, its success probability in inverting an NTRU ciphertext is at most Adv_NDP(t), which is a negligible function in the security parameter.

For any probabilistic polynomial-time adversary $\mathcal{A}$ against the authenticated key exchange (AKE) security of Π, making at most $q_s$ Send queries, $q_e$ Execute queries, and $q_h$ hash queries to the random oracle, the advantage of $\mathcal{A}$ in winning the Test query (distinguishing the real session key from a random string of equal length) is bounded by

$$\begin{array}{ll}{\mathrm{Adv}}_{\Pi }^{\mathrm{AKE}}\left(\mathcal{A}\right)& \le {\displaystyle \frac{2q_s+q_h^2+{\left(q_s+q_e\right)}^2}{2^{\mathcal{l}}}}+{\displaystyle \frac{{\left(q_s+q_e\right)}^2}{2\left(n_0-1\right)}}\\ & +2q_h\cdot \mathrm{m}\mathrm{a}\mathrm{x} \left\{\hspace{0.17em}{\displaystyle \frac{q_s}{\left|{\mathcal{D}}_{\mathrm{ID}}\right|}},\hspace{0.17em}{\displaystyle \frac{q_s}{\left|{\mathcal{D}}_{\mathrm{PW}}\right|}},\hspace{0.17em}{\displaystyle \frac{1}{n_0}}\right\}\\ & +2q_h\cdot {\mathrm{Adv}}_{\mathrm{NDP}}\left(t+\left(2q_s+6q_e\right)\hspace{0.17em}{T}_{\mathrm{ntru}}\right)\\ & +4q_h\hspace{0.17em}{\left(q_s+q_e\right)}^2\cdot {\mathrm{Adv}}_{\mathrm{NDP}} \left(t+\left(q_s+q_e\right)\hspace{0.17em}{T}_{\mathrm{ntru}}\right),\end{array}$$

where ${\mathit{Adv}}_{\Pi }^{\mathit{AKE}}\left(\mathcal{A}\right)$ denotes the advantage of $\mathcal{A}$ in breaking security of AKE in Π, n₀ ∈ [24, 28] denotes the public modulus used in the fuzzy verifier, $\left|{\mathcal{D}}_{\mathit{ID}}\right|$ denotes the size of dictionary space of possible user identities, ${|\mathcal{D}}_{\mathit{PW}}|$ denotes the size of dictionary of possible user passwords, $T_{\mathit{ntru}}$ denotes the time required for one NTRU encryption or decryption operation, and $q_s,q_e,q_h$ denote the number of Send, Execute, and hash queries, respectively.

The protocol is considered AKE-secure if this advantage is negligible in the security parameter $\mathcal{l}$ (and in the NTRU dimension $n$), under the stated hardness assumption.

Proof of Theorem 1.

We prove the theorem by a sequence of games $G_0,G_1,\dots ,G_5$ starting from the real execution and ending in an idealized game where the session key is completely independent of the adversary’s view. Let $S_i$ denote the event that $\mathcal{A}$ correctly guesses the hidden bit $b$ in the Test query in game $G_i$. The advantage in game $G_i$ is ${\mathit{Adv}}_i=2Pr\left[S_i\right]-1$, and we bound the differences $\left|Pr\left[S_i\right]-Pr\left[S_{i-1}\right]\right|$ for each transition.

Game $G_0$: This is the actual execution of $\Pi$ under the random oracle model. All oracles—including the hash function, NTRU encryption/decryption, and timestamp checks—are implemented exactly as specified. Thus, we have

$${\mathrm{Adv}}_{\Pi }^{\mathrm{AKE}}\left(\mathcal{A}\right)=2Pr\left[S_0\right]-1$$

(1)

Game $G_1$: We replace the real hash function by a random oracle that maintains a list ${\mathcal{L}}_H$ of all input–output pairs. Every new hash query is answered with a uniformly random string in $\{0,1{\}}^{\mathcal{l}}$, and the answer is recorded for consistency. The NTRU operations are simulated using the actual public/private keys. This game is perfectly indistinguishable from ${\mathrm{G}}_0$ from the adversary’s perspective; hence,

$$Pr\left[S_1\right]=Pr\left[S_0\right]$$

(2)

Game $G_2$: We abort the game if any of the following collisions occur:

• Hash collisions: Two distinct inputs yield the same output. The probability of this event among $q_h$ hash queries is at most $q_h^2/2^{\mathcal{l}+1}$.
• Nonce collisions: The random values $a_i,b_j,r_u,r_s$ (drawn from spaces of size at least $n_0-1$) repeat across different sessions. For $\left(q_s+q_e\right)$ sessions, the union bound gives at most ${\left(q_s+q_e\right)}^2/\left(2\left(n_0-1\right)\right)$.
• Transcript collisions: Two different executions produce identical full messages, which could allow the adversary to replay or confuse sessions. This is bounded by the same term ${\left(q_s+q_e\right)}^2/2^{\mathcal{l}+1}$.

Summing these probabilities gives

$$\left|Pr\left[S_2\right]-Pr\left[S_1\right]\right|\le {\displaystyle \frac{q_h^2+{\left(q_s+q_e\right)}^2}{2^{\mathcal{l}+1}}}+{\displaystyle \frac{{\left(q_s+q_e\right)}^2}{2\left(n_0-1\right)}}$$

(3)

Game $G_3$: In this game, we rule out the possibility that $\mathcal{A}$ produces a valid authentication tag $m_1,m_2,m_3,m_4,$ or $m_5$ without having queried the corresponding hash input. Each tag involves a secret value (e.g., $K_i$, $K_j$, or the nonce $b_j$) that is unknown to the adversary. If $\mathcal{A}$ attempts to guess a tag without querying the oracle, the success probability per attempt is $1/2^{\mathcal{l}}$. Across $q_s$ Send queries and $q_h$ hash queries, the total forgery probability is bounded by $q_s{q}_h/2^{\mathcal{l}}\le q_h/2^{\mathcal{l}}$ (assuming $q_s\le q_h$, which is typical). Thus,

$$\left|Pr\left[S_3\right]-Pr\left[S_2\right]\right|\le {\displaystyle \frac{q_h}{2^{\mathcal{l}}}}$$

(4)

Game $G_4$: We now address the two main adversarial strategies that could compromise the session key: (i) recovering the ephemeral nonces $a_i$ and $b_j$ from the NTRU ciphertexts $V_2$ and $V_4$ and (ii) performing an offline dictionary attack against the user’s identity/password using the smartcard data. We analyze these two cases separately.

Case 1: Reduction to NDP

To compute the session key

$$SK=H\left(a_i\parallel b_j\parallel U_{IDi}\parallel SI{D}_j\right),$$

the adversary must know both $a_i$ and $b_j$ (or at least the hash preimage, which is as hard as inverting $H\left(\right)$. The only way to obtain them without guessing is to decrypt the NTRU ciphertexts:

• $V_2=h_s\cdot r_u+\left(a_i\parallel U_{IDi}\parallel h_u\right)$ requires the sensor’s private key $\left(f_s,f_{s,p}^{-1}\right)$;
• $V_4=h_u\cdot r_s+b_j$ requires the user’s private key $\left(f_u,f_{u,p}^{-1}\right)$.

We construct a reduction $\mathcal{B}$ that embeds a challenge NTRU ciphertext (say, targeting $h_s$) into the simulation. If $\mathcal{A}$ correctly guesses the session key, then, with probability at least $1/q_h$, it has queried the oracle on the correct $a_i$ (and $b_j$). By inspecting the hash list, $\mathcal{B}$ extracts the plaintext and solves the NDP instance. A symmetric reduction handles the case where $V_4$ is targeted. The total success probability of the reduction is bounded by the adversary’s advantage multiplied by $q_h$, which yields the term

$$q_h\cdot {\mathrm{Adv}}_{\mathrm{NDP}}\left(t+\left(2q_s+6q_e\right)\hspace{0.17em}{T}_{\mathrm{ntru}}\right).$$

Case 2: Offline Guessing with Fuzzy Verifier

Suppose $\mathcal{A}$ compromises the smartcard and obtains $\{B_i,C_i,F_i\}$. To verify a candidate identity/password pair $\left(U_{IDi}^{*},U_{PWi}^{*}\right)$, it computes

$$x^{*}=B_i\oplus H\left(U_{IDi}^{*}\parallel U_{PWi}^{*}\right), F_i^{*}=H\left(U_{PWi}^{*}\parallel x^{*}\right)\hspace{0.25em}\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}{n}_0.$$

The guess is accepted if $F_i^{*}=F_i$. Since the hash output is uniformly distributed, the probability that a wrong pair satisfies this equality is exactly $1/n_0$. Thus, for $q_s$ online guesses, the success probability of guessing the correct credentials is at most

$$\mathrm{m}\mathrm{a}\mathrm{x}\left\{{\displaystyle \frac{q_s}{\left|{\mathcal{D}}_{\mathrm{ID}}\right|}},\hspace{0.17em}{\displaystyle \frac{q_s}{\left|{\mathcal{D}}_{\mathrm{PW}}\right|}},\hspace{0.17em}{\displaystyle \frac{1}{n_0}}\right\},$$

where the first two terms correspond to dictionary attacks when one factor (identity or password) is known, and the third is the false-acceptance rate of the fuzzy verifier. Since the adversary may attempt this for each hash query, we multiply by $q_h$.

Combining both cases gives

$$\left|Pr\left[S_4\right]-Pr\left[S_3\right]\right|\le q_h\cdot \mathrm{m}\mathrm{a}\mathrm{x}\left\{{\displaystyle \frac{q_s}{\left|{\mathcal{D}}_{\mathrm{ID}}\right|}},{\displaystyle \frac{q_s}{\left|{\mathcal{D}}_{\mathrm{PW}}\right|}},{\displaystyle \frac{1}{n_0}}\right\}+q_h\cdot {\mathrm{Adv}}_{\mathrm{NDP}}\left(t+\left(2q_s+6q_e\right)T_{\mathrm{ntru}}\right)$$

(5)

Game $G_5$: In this final game, we consider the adversary’s ability to compromise session keys established before it obtains long-term secrets. Specifically, $\mathcal{A}$ may issue a Corrupt(GW) query and obtain the gateway’s long-term master secret $K_g$. From $K_g$, $\mathcal{A}$ can derive any gateway-side secret key of the form

$$K_i=H\left(RI{D}_i\parallel K_g\right), K_j=H\left(SI{D}_j\parallel K_g\right).$$

Thus, $\mathcal{A}$ can verify or forge all MACs/tags $m_1,m_2,m_3,m_4,m_5$ that are computed with $K_i$ or $K_j$. However, $\mathcal{A}$ does not obtain the NTRU private keys

$$\left(f_u,f_u^{-1}\right) \mathrm{of} U_i, \left(f_s,f_s^{-1}\right) \mathrm{of} S{N}_j,$$

nor the ephemeral nonces $a_i,b_j,r_u,r_s$, which are assumed to be erased after the session. This is consistent with the standard forward-secrecy threat model: the long-term key of the gateway is leaked, but the per-node private keys and ephemeral session state remain protected.

We claim that even with $K_g$, $\mathcal{A}$ cannot compute the historical session key

$$SK=H\left(a_i\parallel b_j\parallel U_{IDi}\parallel SI{D}_j\right).$$

The reason is that $SK$ does not depend on $K_g$, $K_i$, or $K_j$. It depends only on the ephemeral nonces $a_i$ and $b_j$ and the public identities $UI{D}_i,SI{D}_j$. In the transcript, these nonces are protected by NTRU encryption:

$$V_2=h_s{r}_u+\left(a_i\parallel U_{IDi}\parallel h_u\right),$$

$$V_4=h_u{r}_s+b_j.$$

Recovering $a_i$ from $V_2$ requires the sensor’s private key $\left(f_s,f_s^{-1}\right)$. Recovering $b_j$ from $V_4$ requires the user’s private key $\left(f_u,f_u^{-1}\right)$. Neither private key is derivable from $K_g$. Therefore, from $\mathcal{A}$’s view, $a_i$ and $b_j$ are hidden by the NDP.

To distinguish the real $SK$ from a random string of the same length, $\mathcal{A}$ must query the random oracle $H$ on the correct tuple

$$\left(a_i,b_j,U_{IDi},SI{D}_j\right).$$

Without such a query, the value of $H\left(\cdot \right)$ is uniformly random and independent of $\mathcal{A}$’s view. We now bound the probability that $\mathcal{A}$ makes this query.

Let $Q$ be the event that $\mathcal{A}$ queries $H$ on the correct tuple for the Test session. We construct a reduction $\mathcal{B}$ that solves an NDP instance using $\mathcal{A}$. $\mathcal{B}$ receives an NDP challenge $\left(h^{*},c^{*}\right)$. It guesses

• One session among the $q_s+q_e$ executed sessions;
• One hash query among the $q_h$ queries made by $\mathcal{A}$.

$\mathcal{B}$ embeds $c^{*}$ as $V_2$ (if targeting $f_s$) or $V_4$ (if targeting $f_u$) in the guessed session. All other values are simulated using $K_g$ and the known protocol logic. If $\mathcal{A}$ queries $H$ on the correct tuple for that session, then $\mathcal{B}$ reads $a_i$ (or $b_j$) from the query input and outputs it as the NDP plaintext.

The probability that $\mathcal{B}$’s guess is correct is at least

$${\displaystyle \frac{1}{{\left(q_s+q_e\right)}^2}}{q}_h.$$

Therefore,

$$\mathrm{P}\mathrm{r}\left[Q\right]\le {\left(q_s+q_e\right)}^2{q}_h\cdot {\mathrm{A}\mathrm{d}\mathrm{v}}_{\mathrm{N}\mathrm{D}\mathrm{P}}\left(t+\left(q_s+q_e\right)T_{\mathrm{n}\mathrm{t}\mathrm{r}\mathrm{u}}\right).$$

If both $a_i$ and $b_j$ must be recovered, a factor of $2$ may be included, yielding

$$\mathrm{P}\mathrm{r}\left[Q\right]\le 2{\left(q_s+q_e\right)}^2{q}_h\cdot {\mathrm{A}\mathrm{d}\mathrm{v}}_{\mathrm{N}\mathrm{D}\mathrm{P}}\left(t+\left(q_s+q_e\right)T_{\mathrm{n}\mathrm{t}\mathrm{r}\mathrm{u}}\right).$$

In Game $G_5$, if $Q$ does not occur, the session key is replaced by a uniformly random string. Hence,

$$Pr\left[S_5\right]={\displaystyle \frac{1}{2}}$$

(6)

Consequently,

$$\left|\mathrm{P}\mathrm{r}\left[S_5\right]-\mathrm{P}\mathrm{r}\left[S_4\right]\right|\le \mathrm{P}\mathrm{r}\left[Q\right]\le 2{\left(q_s+q_e\right)}^2{q}_h\cdot {\mathrm{A}\mathrm{d}\mathrm{v}}_{\mathrm{N}\mathrm{D}\mathrm{P}}\left(t+\left(q_s+q_e\right)T_{\mathrm{n}\mathrm{t}\mathrm{r}\mathrm{u}}\right)$$

(7)

Combining (1)~(7), we have

$$\begin{array}{ll}{\mathrm{Adv}}_{\Pi }^{\mathrm{AKE}}\left(\mathcal{A}\right)& =2Pr\left[S_0\right]-1\\ & \le 2{\displaystyle \sum _{i=1}^5}\left|Pr\left[S_i\right]-Pr\left[S_{i-1}\right]\right|\\ & \le {\displaystyle \frac{2q_s+q_h^2+{\left(q_s+q_e\right)}^2}{2^{\mathcal{l}}}}+{\displaystyle \frac{{\left(q_s+q_e\right)}^2}{2\left(n_0-1\right)}}\\ & +2q_h\cdot \mathrm{m}\mathrm{a}\mathrm{x}\left\{\hspace{0.17em}{\displaystyle \frac{q_s}{\left|{\mathcal{D}}_{\mathrm{ID}}\right|}},\hspace{0.17em}{\displaystyle \frac{q_s}{\left|{\mathcal{D}}_{\mathrm{PW}}\right|}},\hspace{0.17em}{\displaystyle \frac{1}{n_0}}\right\}\\ & +2q_h\cdot {\mathrm{Adv}}_{\mathrm{NDP}} \left(t+\left(2q_s+6q_e\right)\hspace{0.17em}{T}_{\mathrm{ntru}}\right)\\ & +4q_h\hspace{0.17em}{\left(q_s+q_e\right)}^2\cdot {\mathrm{Adv}}_{\mathrm{NDP}}\left(t+\left(q_s+q_e\right)\hspace{0.17em}{T}_{\mathrm{ntru}}\right)\end{array}$$

This completes the proof. □

4.3. Informal Security Analysis

This section provides an informal security evaluation, verifying the proposed scheme’s robustness against diverse attacks and its compliance with essential privacy and security requirements. In addition, we compared our scheme with four latest schemes in terms of security attributes, and the results are presented in Table 3.

Table 3. Security features comparison among schemes.

Security Features	[16]	[17]	[23]	[25]	Ours
User impersonation resistance	✓	✓	✗	✗	✓
GW impersonation resistance	✓	✓	✓	✓	✓
Sensor node impersonation resistance	✓	✓	✓	✓	✓
Forward secrecy	✓	✓	✓	✓	✓
Replay attack resistance	✓	✗	✓	✓	✓
Privileged insider attack resistance	✓	✓	✓	✓	✓
Sensor node capture attack resistance	✗	✓	✓	✓	✓
User anonymity	✓	✓	✓	✓	✓
Quantum attack resistance	✗	✗	✗	✓	✓

4.3.1. User Impersonation Attack

An adversary attempting to impersonate user $U_i$ must forge a valid login request $\{V_1,V_2,m_1,{TS}_1\}$. This requires knowledge of

• The identity $U_{IDi}$ and password $U_{PWi}$ to recover $x=B_i\oplus H\left(U_{IDi}\parallel U_{PWi}\right)$,
• The secret $K_i=C_i\oplus H\left(U_{PWi}\parallel x\right)\hspace{0.25em}\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}{n}_0$,
• The gateway’s secret $s_{ug}$ to construct $V_1=H\left(s_{ug}\right)\oplus \left(U_{IDi}\parallel SI{D}_j\right)$,
• The ephemeral nonce $a_i$ and the NTRU public key $h_s$ to build $V_2$.

Even if the adversary obtains the smartcard and extracts $\{B_i,C_i,F_i\}$, he cannot compute $x$ without $U_{IDi}$ and $U_{PWi}$. The fuzzy verifier $F_i=H\left(U_{PWi}\parallel x\right)\hspace{0.25em}\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}{n}_0$ ensures that a guessed password/identity pair cannot be verified offline with certainty, as the modulo operation yields approximately $\left|{\mathcal{D}}_{ID}\right|\cdot \left|{\mathcal{D}}_{PW}\right|/n_0$ false positives. To distinguish the correct pair, the adversary must launch an online login attempt, which is detectable and limited by timestamp checks. Without $K_i$, forging $m_1=H\left(U_{IDi}\parallel K_i\parallel h_u\parallel {TS}_1\right)$ is infeasible due to the one-way property of $H\left(\right)$. Hence, the scheme resists user impersonation.

4.3.2. GW Impersonation Attack

To impersonate the gateway $GW$, the adversary must produce valid messages $\{V_2,m_2,{TS}_2\}$ to $S_j$ and $\{V_4,m_4,m_5,{TS}_4\}$ to $U_i$. These require

• $m_2=H\left(U_{IDi}\parallel K_j\parallel {TS}_2\right)$, where $K_j=H\left(SI{D}_j\parallel K_g\right)$ is the sensor’s long-term key known only to $GW$ and $S_j$,
• $m_5=H\left(K_i\parallel U_{IDi}\parallel {TS}_4\right)$, where $K_i=H\left(RI{D}_i\parallel K_g\right)$ is known only to $GW$ and the legitimate user,
• The NTRU ciphertexts $V_2$ and $V_4$, which are constructed using the sensor’s public key $h_s$ and the user’s public key $h_u$, respectively.

An adversary without the master key $K_g$ cannot compute either $K_i$ or $K_j$. Even if the adversary eavesdrops past messages, the hash function’s collision resistance prevents the derivation of the inputs from the outputs. Moreover, $V_2$ and $V_4$ cannot be correctly regenerated without the corresponding ephemeral random values ($r_u$, $a_i$, $r_s$, $b_j$). Thus, forging any gateway message is computationally infeasible, and the scheme resists GW impersonation.

4.3.3. Sensor Node Impersonation Attack

To impersonate a sensor node $S_j$, the adversary must forge the response $\{V_4,m_3,m_4,{TS}_3\}$ to $GW$. This requires

• The sensor’s NTRU private key $\left(f_s,f_{s,p}^{-1}\right)$ to decrypt $V_2$ and extract $a_i,U_{IDi},h_u$,
• The secret $K_j=H\left(SI{D}_j\parallel K_g\right)$ to compute $m_3=H\left(K_j\parallel SI{D}_j\parallel U_{IDi}\parallel T{S}_3\right)$,
• The ephemeral nonce $b_j$ and blinding factor $r_s$ to construct $V_4=h_u\cdot r_s+b_j$ and $m_4=H\left(b_j\parallel SI{D}_j\parallel U_{IDi}\parallel {TS}_3\right)$.

Without $K_j$, the adversary cannot forge $m_3$. Without the private key, they cannot recover $a_i$ (needed to link the response to the ongoing session). Even if a sensor has been previously captured, the captured private key cannot be used to impersonate a different sensor or to forge messages for a session that originated from a legitimate user who has not yet interacted with the captured node. The scheme therefore resists sensor node impersonation.

4.3.4. Forward Secrecy

In the proposed scheme, the session key is computed as ${SK}_{u-s} = H\left(a_i\left|\right|b_j\left|\right|{\mathit{UID}}_i\left|\right|{\mathit{SID}}_j\right)$, where $a_i, b_j$ denote ephemeral one-time random nonces separately generated by the user $U_i$ and sensor ${\mathit{SN}}_j$ in each independent authentication round. The gateway’s long-term master secret $K_g$ only participates in computing static pre-registration secrets $K_i = H\left({\mathit{RID}}_i\left|\right|K_g\right)$ and $K_j = H\left({\mathit{SID}}_j\left|\right|K_g\right)$ during offline registration, and it is never embedded into the hash derivation formula of the session key. If an adversary fully leaks the gateway’s master key $K_g$, he can only deduce the permanent static credentials $K_i$ and $K_j$ stored in the gateway database. However, the ephemeral values $a_i$ and $b_j$ are freshly sampled per session and encapsulated inside NTRU ciphertexts $V_2$ and $V_4$ transmitted over public channels. Breaking NTRU polynomial encryption requires solving the hard ring lattice problem, which is computationally infeasible for classical and quantum polynomial-time adversaries. Without recovering $a_i$ and $b_j$, the adversary cannot reconstruct the historical session key ${SK}_{u-s}$. Therefore, our scheme provides perfect forward secrecy.

4.3.5. Replay Attack

Every authentication message carries a timestamp: ${TS}_1$ in the login request, ${TS}_2$ from $GW$ to $S_j$, ${TS}_3$ from $S_j$ to $GW$, and ${TS}_4$ from $GW$ to $U_i$. Upon receipt, each party verifies that $\left|{TS}^{*}-TS\right|\le \Delta T$, where ${TS}^{*}$ is the current time. Any replayed message with a stale timestamp is immediately rejected. Moreover, even if an adversary replays a message within the valid time window, the inclusion of fresh nonces ($a_i,b_j,r_u,r_s$) in the hash computations (e.g., $m_1,m_4$) and in the NTRU ciphertexts makes the replayed message inconsistent with the current session’s expected values. The receiving entity will detect the mismatch when verifying the authentication tags. Consequently, replay attacks are effectively prevented.

It should be noted that practical WSN nodes suffer inherent clock drift and clock offset. The configurable threshold ΔT can tolerate moderate clock offsets, but overly enlarged ΔT will widen the valid time window and increase the replay-attack surface. Hence, system operators need to balance clock-desynchronization robustness and replay-attack resistance in real deployment.

4.3.6. Privileged Insider Attack

A privileged insider (e.g., a gateway administrator) may have full read access to the gateway’s database, which stores $\{U_{IDi},K_i,h_u\}$ for each user and $\{SI{D}_j,K_j,h_s\}$ for each sensor. However, the user’s password $U_{PWi}$ is never transmitted to or stored by the gateway; during registration, the user sends only $U_{IDi}$, $h_u$, and $RI{D}_i=H\left(U_{IDi}\parallel x\right)$, where $x$ is a nonce chosen locally by the user. The smartcard stores $B_i=H\left(U_{IDi}\parallel U_{PWi}\right)\oplus x$, $C_i=K_i\oplus F_i$, and $F_i=H\left(U_{PWi}\parallel x\right)\hspace{0.25em}\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}{n}_0$. Even if the insider obtains $K_i$ from the database, they cannot recover $x$ or $U_{PWi}$ because both are protected by the one-way hash $H$. The fuzzy verifier $F_i$ further obstructs offline guessing: any guessed $\left(U_{IDi}^{*},U_{PWi}^{*}\right)$ produces a false match with probability $1/n_0$, forcing the insider to validate guesses through online interactions, which are limited. Thus, the scheme resists privileged insider attacks.

4.3.7. Sensor Node Capture Attack

Sensor nodes are deployed in unattended and potentially hostile environments, making physical capture a realistic threat. Suppose an adversary captures sensor $S_j$ and extracts its stored secrets, including $K_j=H\left(SI{D}_j\parallel K_g\right)$ and the NTRU private key $\left(f_s,f_{s,p}^{-1}\right)$ (if stored). The adversary can decrypt past $V_2$ messages for that specific node. However,

(1)

The session key $S{K}_{u-s}=H\left(a_i\parallel b_j\parallel U_{IDi}\parallel SI{D}_j\right)$ depends on the user’s ephemeral nonce $a_i$, which was encrypted under $h_s$. Although the captured private key allows decryption of $V_2$, the adversary still obtains $a_i$ only for sessions involving the captured node. For other sessions with other sensors, $a_i$ is encrypted under different public keys and remains secure.

(2)

The gateway’s master key $K_g$ is not stored on the sensor; so, capturing one sensor does not reveal $K_j$ for other sensors (since $K_j=H\left(SI{D}_j\parallel K_g\right)$ and $K_g$ is unknown).

(3)

The ephemeral blinding factor $r_u$ is discarded after the session; without it, the adversary cannot forge new valid ciphertexts for future sessions.

Consequently, the capture of a single sensor node does not compromise the security of other nodes or past session keys for non-captured nodes. The scheme resists sensor node capture attacks.

4.3.8. User Anonymity

User anonymity comprises two aspects: (a) the adversary cannot learn the real identity $U_{IDi}$, and (b) the adversary cannot determine whether two different protocol runs originate from the same user (untraceability). In our scheme, $U_{IDi}$ is never sent in cleartext over the public channel:

• In the login request, $V_1=H\left(s_{ug}\right)\oplus \left(U_{IDi}\parallel SI{D}_j\parallel {TS}_1\right)$ masks the identity with the secret $s_{ug}$, which is known only to the user and the gateway. Without $s_{ug}$, extraction of $U_{IDi}$ is impossible due to the one-wayness of $H$(). In addition, because the timestamp TS₁ is embedded in V₁, the V₁ for each user login to GWN is different, making it impossible for attackers to track users based on the intercepted V₁.
• The same identity also appears inside the NTRU ciphertext $V_2$ as part of the plaintext $\left(a_i\parallel U_{IDi}\parallel h_u\right)$, which is encrypted under the sensor’s public key $h_s$. Only the sensor (with its private key) can recover it.
• The nonce $a_i$ changes uniformly at random for each session; so, the ciphertext $V_2$ and the masked value $V_1$ are computationally indistinguishable from random values across different sessions. An adversary cannot link two login requests to the same user. Thus, the protocol guarantees both user anonymity and untraceability.

4.3.9. Quantum Attack

Our protocol’s security foundation rests on the NTRU public-key cryptosystem, which is a lattice-based primitive and the security relies on NTRU’s hardness, which is derived from SVP and CVP in ideal lattices. Moreover, the hash function $H$() used throughout the protocol (e.g., SHA-256) is also quantum-resistant. The authentication tags $m_1,m_2,\dots ,m_5$ are constructed from $H\left(\right)$ with secret inputs ($K_i,K_j,b_j$); An adversary would need to invert these hashes or forge them without the secrets, which reduces to breaking the one-wayness or collision resistance of $H$().

Importantly, the ephemeral nonces $a_i,b_j$ and blinding factors $r_u,r_s$ are chosen independently of any long-term quantum-vulnerable parameter. Therefore, an adversary equipped with a quantum computer cannot trivially recover past session keys (forward secrecy holds) nor impersonate any party without solving the underlying lattice problem. In summary, the proposed scheme is explicitly designed to be post-quantum secure, offering a distinct advantage over ECC-based and Chebyshev chaotic maps-based counterparts.

5. Performance Analysis

This section evaluates the performance of our proposed NTRU-based two-factor authentication scheme in terms of computational overhead, storage overhead, and communication overhead. A comprehensive comparison with the four state-of-art schemes [16,17,23,25] is presented to demonstrate the efficiency advantages of our protocol.

5.1. Computation Overhead

We analyze the computation cost of our scheme and the related schemes [16,17,23,25] during the authentication phase, focusing on the cryptographic operations performed by the user, the gateway, and the sensor node. Following the benchmark established in [25], we adopt the execution times shown in Table 4. Our scheme mainly involves operations such as NTRU encryption, decryption, hash function, and polynomial multiplication. Operations such as XOR and concatenation are omitted due to their negligible overhead. The comparison results of the computation overhead between our scheme and other schemes [16,17,23,25] are shown in Table 5. To facilitate understanding, we have represented Table 5 graphically in Figure 5.

Table 4. Cryptographic operations and their execution times.

Symbols	Meanings	Time (ms)
Th	Hash function	0.0004
Tc	Chebyshev polynomial	2.45
TM	ECC point multiplication	7.3529
TE	ECC encryption/decryption	7.3529
TFE	Fuzzy extractor	7.3529
Tse	Symmetric encryption/decryption	0.1303
TNe	NTRU encryption	0.13
TNd	NTRU decryption	0.086
Tmm	Polynomial multiplication	0.0011

Table 5. The comparison results of the computation overhead.

Scheme	Ui	GW	SNj	Total (ms)
Huang 2024 [16]	5TM + 22Th + TFE	4TM + 18Th	3TM + 8Th	95.6069
Xu 2025 [17]	3TM + 9Th	TM + 7Th	2TM + 5Th	44.1258
Wang 2025 [23]	8Th + 2Tse + 2Tc + TFE	10Th + 4Tse + 3Tc	4Th + 2Tse + Tc	23.1041
Jiang 2025 [25]	9Th + TNe + TNd + Tmm	13Th + 2TNe + 2TNd + 2Tmm	6Th + TNe + TNd + Tmm	0.8796
Ours	8Th + TNe + TNd + Tmm	5Th	4Th + TNe + TNd + Tmm	0.4410

Figure 5. Comparison of the computation overhead [16,17,23,25].

As shown in Table 5 and Figure 5, the proposed scheme demonstrates superior computational efficiency, achieving the lowest total overhead of 0.4410 ms. It significantly outperforms the ECC-based schemes [16,17] and the chaotic map-based scheme [23]. Compared to the other NTRU-based protocol [25], our design optimizes the gateway’s role by eliminating costly NTRU operations, reducing its workload to only five hash functions. This minimal computational demand makes the protocol exceptionally suitable for resource-constrained WSNs.

Note that the above measured computation overhead is based on our moderate NTRU parameter n. As analyzed in Section 2.2, a larger n for high-security scenarios increases sensor-side cryptographic latency, whereas a smaller n for delay-sensitive IoT applications degrades security margins. Practitioners should tune NTRU parameters following the concrete application security-latency demands.

5.2. Storage Overhead

We analyze the storage overhead incurred by each entity during the authentication phase. Following the benchmark established in Section 5.1 of [25], we assume the following bit lengths: identity (64 bits), timestamp (32 bits), nonce (128 bits), hash value (160 bits), NTRU public/private key (128 bits), ECC point (320 bits), symmetric key (128 bits), and biometric data (160 bits). The storage overhead of our solution at the user end is 480 bits (=160 + 160 + 160), at the gateway end it is 704 bits (=64 + 160 + 128 + 64 + 160 + 128), and at the sensor end it is 352 bits (=64 + 160 + 128). The total storage cost comparison results of our scheme with those of schemes [16,17,23,25] are shown in Table 6 and Figure 6.

Table 6. Storage overhead.

Scheme	Ui	GW	SNj	Total (Bits)
Huang 2024 [16]	1120	448	224	1792
Xu 2025 [17]	928	320	160	1508
Wang 2025 [23]	768	1120	480	2368
Jiang 2025 [25]	928	544	480	1952
Ours	480	704	352	1536

Figure 6. Comparison of storage overhead [16,17,23,25].

According to Table 6 and Figure 6, the proposed scheme requires a total storage of 1536 bits, which is the second most efficient among the compared protocols, surpassed only by scheme [17] (1508 bits). It significantly reduces the storage burden compared to schemes [16,23,25]. This analysis highlights that our design achieves a highly competitive storage footprint, effectively balancing the memory requirements across the user, gateway, and sensor nodes for practical implementation on resource-constrained devices.

5.3. Communication Overhead

Based on the benchmark proposed in Section 5.2, we calculated the communication cost of our scheme and compared it with other schemes [16,17,23,25]. The comparison results are shown in Table 7 and Figure 7.

Table 7. Communication overhead.

Scheme	Huang2024	Xu2025	Wang2025	Jiang2025	Ours
Communication overhead(bits)	4032	2208	1472	1440	1600

Figure 7. Comparison of communication overhead [16,17,23,25].

Table 7 and Figure 7 show that the communication overhead of the proposed scheme is 1600 bits. While this is slightly higher than schemes [25] (1440 bits) and [23] (1472 bits), it remains substantially more efficient than the ECC-based protocols [16] and [17]. This moderate increase in communication cost is a justifiable trade-off for achieving post-quantum security through the NTRU cryptosystem. The protocol maintains a reasonable level of transmission efficiency while providing robust security against future quantum computing threats.

5.4. Summary

In conclusion, the proposed NTRU-based authentication protocol offers a compelling balance between security and performance. It achieves the lowest computational cost and the most efficient storage overhead among the compared schemes, making it highly suitable for resource-constrained WSNs. Although the communication cost is marginally higher than some existing schemes, this is a reasonable trade-off for achieving post-quantum security. The significant advantages in computation and storage, combined with its robust security foundation, establish the proposed protocol as a highly efficient and future-proof solution for WSNs.

6. Conclusions

In this paper, we propose a novel user authentication protocol for WSNs based on the NTRU lattice cryptosystem. Addressing the security vulnerabilities of traditional schemes and the impending threats posed by quantum computing, our design ensures robust post-quantum security while maintaining high efficiency. We conduct formal security proof under the random oracle model and also verify the security of our scheme through BAN logic. Informal security analysis indicates that the protocol can effectively resist various known attacks. Furthermore, performance evaluations confirm that our scheme achieves the lowest computational cost and superior storage overhead compared to existing alternatives based on ECC, Chebyshev chaotic map, and NTRU. Despite slightly higher communication costs, the significant improvements in computational efficiency and quantum resistance make the proposed protocol a highly practical and secure solution in resource-constrained WSNs environments.