Lightweight Failover Authentication Mechanism for IoT-Based Fog Computing Environment

Abstract

Fog computing as an extension to the cloud computing infrastructure has been invaluable in enhancing the applicability of the Internet of Things (IoT) paradigm. IoT based Fog systems magnify the range and minimize the latency of IoT applications. However, as fog nodes are considered transient and they offer authenticated services, when an IoT end device loses connectivity with a fog node, it must authenticate freshly with a secondary fog node. In this work, we present a new security mechanism to leverage the initial authentication to perform fast lightweight secondary authentication to ensure smooth failover among fog nodes. The proposed scheme is secure in the presence of a current de-facto Canetti and Krawczyk (CK)-adversary. We demonstrate the security of the proposed scheme with a detailed security analysis using formal security under the broadly recognized Real-Or-Random (ROR) model, informal security analysis as well as through formal security verification using the broadly-used Automated Validation of Internet Security Protocols and Applications (AVISPA) software tool. A testbed experiment for measuring computational time for different cryptographic primitives using the Multiprecision Integer and Rational Arithmetic Cryptographic Library (MIRACL) has been done. Finally, through comparative analysis with other related schemes, we show how the presented approach is uniquely advantageous over other schemes.

1. Introduction

The adoption of Internet of Things (IoT) has been unprecedented. The concept has materialized into one of the most popular driver technology into the next generation of ubiquitous connectivity. As more applications of smart connectivity are realized even more applications are envisioned. The IoT paradigm aims to provide connectivity between the physical and the cyber worlds with the intention to enable greater economic welfare, accuracy, and efficiency with minimal human intervention [1,2]. IoT enables Industry 4.0, connectivity during a humanitarian crisis, and ushers in a more comfortable standard of living.

The IoT paradigm predicts an explosion of connected devices [3,4]. This, in spite of the distributed nature of IoT, put an unprecedented load on the existing centralized infrastructure. This issue is addressed with the fog computing paradigm and extension to cloud computing. Transient fog nodes can extend the connectivity of cloud computing infrastructure as well as reduce latency and pre-process data to reduce computational load [5]. Fog nodes, by design, form an intermediate layer between the cloud infrastructure and the IoT end devices. Figure 1 shows a fog architecture for edge-based IoT environment adapted form [6]. Fog nodes, by virtue of their deployment near the smart devices, offer location awareness, lower latency, capability for real-time interaction, and so forth. For example, in a smart vehicular network, fog nodes might be deployed regularly along the roadway. As vehicles pass by, they can communicate with the nearest fog node at that point. Thus, fog computing can provide added functionality to IoT systems.

1.1. Motivation

Fog nodes, as described in Figure 1, act as a bridge between the end device and the cloud infrastructure. The fog nodes are considered transient and consequently, they are not trusted. The end device (for example, a user or an IoT smart device) must be authenticated by the fog node before any service is provided. This authentication can involve the cloud server, but that introduces latency as well at overhead at the cloud server. Normally, authentication and session key establishment between an end device and the fog nodes rely on public-key cryptography. However, relatively speaking, this is rather computationally expensive. Fog nodes are considered transient in nature. This can be because the nodes go out of range or they go off-line for some other reasons. In such a scenario, the end-user must re-authenticate with a secondary fog node that will take over the role of the previous fog node. The main objective with this work is to achieve the failover re-authentication without using public-key cryptography. This can be achieved if the fog nodes pre-agree on some security tokens, that are made available to the end device after the initial authentication. These security tokens can be leveraged to make a fast authentication possible between the end device and the secondary fog node. Moreover, insecure communication among the end devices and the fog nodes may lead to open up with several security attacks like replay, impersonation, man-in-the-middle and denial of service (clogging) attacks, that can be launched by an adversary. In order to resist such attacks, the designed failover authentication mechanism in this paper has been proposed. The proposed scheme also maintain anonymity and untraceability properties.

1.2. Research Contributions

The primary contributions in this work are summarized as follows:

• We present the architecture and threat model for the envisioned failover authentication model.
• We define the proposed failover authentication model in detail with all its phases.
• We present a detailed security analysis with both formal and informal security analysis, and also a formal security verification using the AVISPA software validation tool to prove the robustness of the proposed scheme against various known attacks.
• A testbed experiment for measuring computational time for different cryptographic primitives using the MIRACL library has been provided.
• Finally, through a detailed comparative study, we showcase the unique advantages of the proposed scheme.

1.3. Paper Outline

The rest of the paper is sketched as follows. The relevant related work is provided in Section 2. In Section 3, the architecture and threat models are discussed for analyzing the proposed scheme. Various phases related to the proposed scheme are then discussed in Section 4. A detailed security analysis is provided in Section 5 including the formal security verification through AVISPA simulation in Section 6 to show the robustness of the proposed scheme. A testbed experiment for measuring computational time for different cryptographic primitives using the MIRACL library is demonstrated in Section 7. After comparative among the proposed scheme and other existing relevant schemes in Section 8, the paper is finally concluded in Section 9.

2. Related Work

Access control and authentication are two important security services to secure different networking environments, like IoT, “Internet of Drones (IoD)”, “Internet of Vehicles (IoV)”, “Wireless Sensor Networks (WSNs)”, cyber-physical systems, smart grids, healthcare services, and so forth [7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29]. Several existing works describe the procedure to secure establish an authenticated session key between the end devices, the fog nodes, and the cloud servers.

Wazid et al. [6] designed a “secure key management and user authentication scheme for fog computing environment, known as SAKA-FC”. SAKA-FC establishes a common session key between a user, the fog node, and a smart device. The fog nodes could also establish a secure connection with the cloud. However, in their scheme, the cloud may act as a single point of failure. Though SAKA-FC is lightweight and offers several security and functionality features, it does not support failover authentication mechanism.

Roy et al. [9] proposed a user authentication for mobile cloud computing. It uses cryptographic hash, bitwise XOR, and fuzzy extractor as primitives. Though this scheme is secure and lightweight, it does not offer failover authentication mechanism. Similarly, there are other authentication schemes, such as the schemes proposed in [14,19,22,23,24,28], which are efficient and also secure, but they do not offer failover authentication feature.

Gope [30] presented a scheme for an anonymous device to device (D2D) authentication for fog computing environment. In Gope’s scheme [30], there are three scenarios: (1) LAAP1: It is for the “initial authentication protocol for device-to-device (D2D)-aided fog computing”; (2) LAAP2: It denotes the “subsequent authentication protocol with the co-operation of EDs in D2D-aided fog computing”; and (3) LAAP3: It corresponds to the “subsequent authentication protocol with the co-operation of NADs in D2D-aided fog computing”, where ED is an “end device”; NAD means the “Network Access Devices” and CCS denotes “Centralized Cloud Servers”. The initial authentication involves the end devices, fog nodes as well as the cloud server. Subsequently, D2D authentication could be operated with the involvement of the cloud server. If the fog node becomes unavailable, the initial authentication must be repeated with a new fog node. Thus, this scheme doe not provide the fog failover authentication process. In addition, this scheme does not protect the “Ephemeral Secret Leakage (ESL)” attack under the “Canetti and Krawczyk (CK)-adversary model” [31].

Concone et al. [32] presented a cloud-sensing scheme, called “secure protocol for mobile crowdsensing (SMCP)”, for fog based applications that utilized signatures and did not involve the cloud server until the final update. SMCP is based on ECC, “extended triple Diffie–Hellman key agreement” and “symmetric cryptography”. However, in their scheme, the ESL attack under the CK-adversary model is not addressed.

Basudan et al. [33] suggested an improved “certificateless aggregate signcryption scheme (CLASC)” approach for a “privacy-preserving vehicular crowdsensing-based road surface condition monitoring system” that applies bilinear pairing operations. Since the signcryption requires time-consuming pairing operations, Cui et al. [34] presented a scheme for road monitoring based on fog computing to reduce the computational complexity.

Guo et al. [35] then proposed a fog-centric authenticated key agreement scheme without involving the trusted parties. Their scheme is very attractive as it does not need the involvement of a trusted cloud server. Unfortunately, their scheme was designed with the DY-adversary model, and it is secure against the ESL attack under the CK-adversary model.

Ali et al. [36] presented a secure authentication scheme for fog computing specifically resistant against clogging attacks. However, the authentication process in their scheme requires the involvement of the cloud server.

3. System Models

This section details the network model envisioned for the proposed system as well as the threat model describing an adversary’s capabilities that the scheme is designed to be resilient against various known attacks.

3.1. Network Model

The fog architecture envisioned for this work, as shown in Figure 1, has been adapted from [6]. The cloud infrastructure is pre-deployed and is considered to be semi-trusted. The fog nodes are deployed by a fully-trusted registration authority, say $RA$, which is a component of the trusted cloud infrastructure. Thus, the fog nodes can securely communicate with each other leveraging their trusts within the $RA$. The pre-processed data can be forwarded by the fog nodes to the cloud server(s). The end devices, which are the users’ device or IoT endpoints, communicate with the fog nodes acting as the gateway nodes. The need for expensive direct communication between end device and cloud infrastructure can be avoided. This is specially usefully when two end devices need to establish secure communication. This architecture also precludes the need for key management mechanism at the cloud infrastructure as the services offered are available only after post-authentication through the fog nodes.

In this work, we focus only on the fog and IoT layers. We aim to avoid the involvement of the cloud server in the authentication to minimize the communication and computational overheads. Similarly, as described in the motivation section, we also aim to reduce the overheads for the end devices.

3.2. Threat Model

The de-facto standard, known as the Dolev-Yao (DY) threat model [37] considers that an adversary, being a passive or an active adversary, has complete control over the communication media. Any message sent over the open channel is considered insecure. The adversary can eavesdrop on all messages transmitted. Additionally, the adversary can block, replay, or even modify any token transmitted over the channel. For this work, we adhere to another more stringent adversary model, known as the “Canetti and Krawczyk (CK)-adversary model” [31]. The CK-adversary not only has all capabilities of the DY-adversary, but he/she can subvert secure information like ephemeral session states and secret keys through session hijacking attacks. Some end devices may be stolen or physically captured by the adversary, and he/she can learn the stored credentials from those devices through the differential power analysis attacks [38] and utilize the extracted credentials later for subsequent attacks on the system. The registration authority $\left(RA\right)$ is a fully trusted entity, but the fog nodes are considered semi-trusted entities in the network.

4. Proposed Failover Authentication Scheme

This section details the proposed failover authentication scheme for an IoT-based fog computing environment.

The core idea behind the failover authentication is that if and when a fog node becomes unavailable, the end devices connected to it should be trivially able to switch over to a secondary fog node. The functionality provided by this scheme is a fast re-authentication with the secondary fog node without the need to go through an expensive public-key based authentication. The scheme has three per-requisite phases and the authentication phases. Before authentication, the system must be set up and the fog nodes must be enrolled and the end devices must register with the registration authority $\left(RA\right)$. The inter-fog node pre-agreement must also be completed before fast authentication.

Table 1. Important notations and their significance.

Symbol	Description
$RA$	A fully-trusted registration authority
$\mathcal{U}$	An end device
$FN$	A semi-trusted fog node
p	A sufficiently large prime number (i.e., 160-bit number)
${\mathbb{Z}}_p$	A finite (prime) field, ${\mathbb{Z}}_p=\{0,1,\cdots ,p-1\}$
${\mathbb{E}}_p$	A non-singular elliptic curve over a prime finite field ${\mathbb{Z}}_p$
$Q_x,k_x,I{D}_x$	Public and private key and identity of entity x, respectively
$ZY,YZ$	Pre-shared security token for fast authentication
$h(·)$	Collision-resistant cryptographic one-way hash function
$\left|\right|,\oplus$	Concatenation and bitwise XOR operations, respectively
$\mathcal{A}$	A passive or an active adversary
⇒	A secure channel
→	A public (insecure) channel

summarizes the important notations that are used in the proposed scheme, and their significance.

The detailed description of each phase is provided in the following subsections.

4.1. Setup Phase

During the Setup, the registration authority $\left(RA\right)$ selects a non-singular elliptic curve ${\mathbb{E}}_p$ of the form: $y^2=x^3+\alpha x+\beta (modp)$ over a prime finite field ${\mathbb{Z}}_p$, where p is a large prime and the condition for non-singularity $4{\alpha }^3+27{\beta }^2\ne 0(modp)$ is fulfilled. Then, the $RA$ selects a generator G of an order n over ${\mathbb{E}}_p$ such that $n·G=\mathcal{O}$, the zero point or point at infinity, and $n·G=G+G+\cdots G\left(ntimes\right)$ represents an “elliptic curve point (scalar) multiplication”. The $RA$ also selects its own “elliptic curve cryptography (ECC)-based private key” $k_R$ and computes the corresponding public key $Q_R=k_R·G$. Finally, the $RA$ picks a “collision-resistant cryptographic one way hash function, $h(·)$” (for example, a Secure Hash Algorithm (SHA-1) [39]) and makes $h(·),G$ and $Q_R$ as public.

4.2. Fog Node Enrollment Phase

After the Setup phase, the individual fog nodes may be enrolled with the registration authority $\left(RA\right)$. A fog node, say Fog   node  x, selects its ECC-based private-public keys pair ($k_{F_x}$, $Q_{F_x}$), where $Q_{F_x}=k_{F_x}·G$, and learns the list of public keys for the other fog nodes. During the enrollment, the $RA$ also transmits a list containing the mapping between obscured end-devices identities $EI{D}_u$ and their public keys $Q_u$, for all registered end devices. The list is periodically updated to intimate the fog nodes of newly registered end devices and fog nodes.

4.3. End Device Registration

After Setup, the end device (user’s access device or otherwise) is registered with the system.

• The end device provides its identity (user’s identity or otherwise), $I{D}_u$ and selects $k_U\in {\mathbb{Z}}_p$ as its private key. Then it computes its public key $Q_u=k_U·Q_R$ and securely transmits $\langle I{D}_u,Q_u\rangle$ to the $RA$.
• On receiving the registration request, $RA$ selects a $x\in \mathbb{Z}$ and computes the obscured end-device identity $EI{D}_u=h(I{D}_u\left|\right|x)$. $RA$ securely transmits $\langle EI{D}_u\rangle$ to the end device saves $\langle I{D}_u,EI{D}_u,Q_u\rangle$.
• The credentials in the end device can be secured with multi-factor authentication, which is beyond the scope of the scheme.

Figure 2 summarizes the end device registration. Note that, a secure channel is used as a conceptual term. For end devices, this can mean pre-deployment configuration and for end devices this referees to in-person registrations. After the initial registration, a variant of the registration, that does not require a secure channel, can be repeated periodically to update $EI{D}_u$ and $Q_u$.

4.4. Inter-Fog Node Pre-Agreement

Before the fast authentication phase is possible, all pairs of (adjacent) fog nodes must agree to own two security tokens, namely $YZ$ and $ZY$. The pre-agreement is a cooperative procedure and can be initialized by either of the participating nodes. We describe this phase with the assumption that Fog node 1 will act as an initiator and Fog node 2 will act as a responder. The following are the steps that are executed:

• Fog node 1 selects a random secret $y\in {\mathbb{Z}}_p$ and computes $Q_{12}=k_{F_1}·Q_{F_2}$. Additionally, it calculates $K_y=Q_{12}\oplus y$, sets $T{S}_1$ as the current timestamp and then computes $V_1=h(K_y\left|\right|Q_{12}\left|\right|T{S}_1)$ in order to transmit a message $M_{p_1}=\langle K_y,V_1,T{S}_1\rangle$ to Fog node 2 via open channel.
• On receiving the message $M_{p_1}$, Fog node 2 computes $Q_{12}=k_{F_2}·Q_{F_1}$ and verifies if $V_1$ is equal to $h\left(K_y\right|\left|Q_{12}\right|\left|T{S}_1\right)$. Only if the verification holds, it proceeds ahead. It then recovers $y=Q_{12}\oplus K_y$, selects a random secret $z\in {\mathbb{Z}}_p$ and computes $K_z=Q_{12}\oplus z$. It also sets $T{S}_2$ as the current timestamp, computes $V_2=h(K_z\left|\right|Q_{12}\left|\right|T{S}_2)$ and transmits the message $M_{p_2}=\langle K_z,V_2,T{S}_2\rangle$ to Fog node 1 via an open channel. Moreover, it computes the security tokens $YZ=h\left(y\right|\left|z\right)$ and $ZY=h\left(z\right|\left|y\right)$.
• On receiving the message $M_{p_2}$, Fog node 1 verifies if $V_2$ is equal to $h\left(K_z\right|\left|Q_{12}\right|\left|T{S}_2\right)$. If it is valid, it recovers $z=Q_{12}\oplus K_z$, and computes the security tokens $YZ=h\left(y\right|\left|z\right)$ and $ZY=h\left(z\right|\left|y\right)$.

Figure 3 summarizes the inter-fog node pre-agreement phase. This phase can be repeated periodically to update the security tokens as well.

4.5. Initial Authentication

An end device must first authenticate with any one fog node by relying on the public key cryptography. In this case, we have applied ECC-based public key infrastructure. This section describes the initial authentication between an end device, say $\mathcal{U}$ and a fog node, say Fog node 1. The following are the executed steps:

• The end device $\mathcal{U}$ selects a random secret $a\in {\mathbb{Z}}_p$ and computes $Q_{u{F}_1}=a·Q_{F_1}$, $Q_a=a·Q_R$ and $QID=Q_{u{F}_1}\oplus EI{D}_u$. Additionally, it sets $T{S}_1$ as the current timestamp, computes $V_1=h\left(QID\right||Q_{u{F}_1}\left|\right|T{S}_1)$ and transmits a message $M_{a_1}=\langle QID,Q_a,V_1,T{S}_1\rangle$ to Fog node 1 over an insecure channel.
• On receiving the message $M_{a_1}$, the Fog node 1 computes $Q_{u{F}_1}=k_{F_1}·Q_a$ and verifies if $V_1$ is equal to $h\left(QID\right|\left|Q_{u{F}_1}\right|\left|T{S}_1\right)$. Only if the check holds, it proceeds ahead. It then recovers $EI{D}_u=Q_{u{F}_1}\oplus QID$, looks up $Q_u$ from $EI{D}_u$, selects another random secret $b\in {\mathbb{Z}}_p$, and also computes $Q_b=b·k_{F_1}·Q_u$, $B=b\oplus h\left(EI{D}_u\right|\left|Q_{u{F}_1}\right)$ and $SK=h\left(Q_{u{F}_1}\right|\left|Q_b\right)$. Moreover, it sets $T{S}_2$ as the current timestamp, computes $V_2=h\left(b\right||Q_u\left|\right|SK\left|\right|T{S}_2)$ and transmits the message $M_{a_2}=\langle B,V_2,T{S}_2\rangle$ back to $\mathcal{U}$ via an open channel.
• On receiving the message $M_{a_2}$, $\mathcal{U}$ computes $b=B\oplus h\left(EI{D}_u\right|\left|Q_{u{F}_1}\right)$, $Q_b=b·k_U·Q_{F_1}$ and $S{K}^{\prime }=h(Q_{u{F}_1}\left|\right|Q_b)$. If $V_2$ is equal to $h\left(b\right|\left|Q_u\right|\left|S{K}^{\prime }\right|\left|T{S}_2\right)$, $\mathcal{U}$ sets $SK=S{K}^{\prime }$

Figure 4 summarizes the initial authentication phase. After this authentication, Fog node 1 shares the security tokens for the nearby fog nodes that can operate as an failover. As these security tokens are transient, they must be periodically updated.

4.6. Fast Authentication

Once an end device $\mathcal{U}$ has learned the security token for the Fog node 2, if, for some reasons, the  Fog node 1 becomes unavailable or it goes out of communication range, $\mathcal{U}$ can leverage the security token to authenticate with Fog node 2 without relying on the public key cryptography (as described in Section 4.5). This section describes the fast authentication between the end device $\mathcal{U}$ and the Fog node 2 with the help of the following steps:

• The end device $\mathcal{U}$ selects a random secret $a\in {\mathbb{Z}}_p$ and computes $Q_a=a\oplus h\left(YZ\right||T{S}_1)$, $Q_{u{F}_2}=h\left(a\right|\left|ZY\right)$, $Q_a=a·h\left(YZ\right||T{S}_1)$ and $QID=Q_{u{F}_2}\oplus EI{D}_u$, where $T{S}_1$ is the current timestamp. It then computes $V_1=h\left(QID\right||Q_{u{F}_2}\left|\right|T{S}_1)$ and transmits a message $M_{f_1}=\langle QID,Q_a,V_1,T{S}_1\rangle$ to Fog node 1 via a public channel.
• On receiving the message $M_{a_1}$, the Fog node 2 computes $a=Q_a\oplus h\left(YZ\right||T{S}_1)$, recovers $Q_{u{F}_2}=h\left(a\right|\left|ZY\right)$ and verifies if $V_1$ is equal to $h\left(QID\right|\left|Q_{u{F}_2}\right|\left|T{S}_1\right)$. Only if the check holds, it proceeds ahead. It recovers $EI{D}_u=Q_{u{F}_2}\oplus QID$, looks up $Q_u$ from $EI{D}_u$, selects a random secret $b\in {\mathbb{Z}}_p$ and computes $Q_b=h\left(b\right|\left|ZY\right||Q_u)$, $B=b\oplus h\left(EI{D}_u\right|\left|Q_{u{F}_2}\right)$ and $SK=h\left(Q_{u{F}_2}\right|\left|Q_b\right)$, where $T{S}_2$ is the current timestamp. Moreover, it computes $V_2=h\left(b\right||Q_u\left|\right|SK\left|\right|T{S}_2)$ and transmits the message $M_{f_2}=\langle B,V_2,T{S}_2\rangle$ back to $\mathcal{U}$ via a public channel.
• On receiving the message $M_{f_2}$, $\mathcal{U}$ recovers $b=B\oplus h\left(EI{D}_u\right|\left|Q_{u{F}_2}\right)$, and computes $Q_b=h\left(b\right|\left|ZY\right||Q_u)$ and $S{K}^{\prime }=h(Q_{u{F}_2}\left|\right|Q_b)$. If $V_2$ is equal to $h\left(b\right|\left|Q_u\right|\left|SK\right|\left|T{S}_2\right)$, $\mathcal{U}$ sets the session key shared with the Fog node 2 ass $SK=S{K}^{\prime }$.

Figure 5 summarizes the fast authentication phase. After this authentication, the Fog node 2 must also periodically share the security tokens for the nearby fog nodes that can operate as its failover.

Remark 1.

After the enrollment in Section 4.2, the fog nodes must perform the mutual pre-agreement phase as described in Section 4.4 in order to support the fast authentication phase in Section 4.6. Similarity, an end device must be registered as described in Section 4.3, and it needs to perform the initial authentication and will be in an active session with a fog node. The end device may avail a fast authentication as described in Section 4.6 with an adjacent fog node based on necessity. Note that, the fast authentication is not possible if the device is not already in an active session because the fast authentication leverages the security of the initial authentication.

5. Security Analysis

An authentication scheme can be susceptible to several vulnerabilities that enable an adversary to subvert the scheme. In this section, we first analyze the proposed scheme for formal security using the widely recognized random oracle model, known as the “Real-Or-Random (ROR) model” [40]. We then informally discuss how the proposed scheme resists various known attacks. Additionally, we report the simulation results under the automated software validation tool, called the “Automated Validation of Internet Security Protocols and Applications (AVISPA)” [41] for the formal security verification and show that the proposed scheme is safe against passive/active attacks like “replay”, “impersonation” and “man in the middle” attacks.

5.1. Formal Security Analysis Using ROR Model

In this section, we utilize the Real-Or-Random (ROR) model proposed in [40] to analyze the semantic security of the proposed scheme. The important elements for the ROR model are given below.

Participants: Let ${\pi }_U^u$, ${\pi }_{FN1}^{f_1}$ and ${\pi }_{FN2}^{f_2}$ denote the $u^{th}$, $f_1^{th}$ and $f_2^{th}$ instances corresponding to a user $\mathcal{U}$, the fog nodes $F{N}_1$ and $F{N}_2$, respectively [42,43]. These are also termed as the random oracles.

Partnering: The instances ${\pi }_U^u$ and ${\pi }_{FN}^f$ are considered to be partnered when the following conditions are satisfied simultaneously: (1) they share a communication session id $sid$ and (2) partial transcript of all message exchanged between them are unique.

Freshness:${\pi }_U^u$ and ${\pi }_{SD}^f$ are fresh if the session key $SK$ established between $\mathcal{U}$ and $FN$ has not been revealed to an adversary $\mathcal{A}$ with the help of the $Reveal$ query discussed below.

Adversary: The adversary $\mathcal{A}$ is assumed to have complete influence over the communication media. Thus, $\mathcal{A}$ can eavesdrop and also alter, delete and forge messages at will during communication. Additionally, $\mathcal{A}$ has the access to the following queries:

• $Execute\left({\pi }^u\right)$: By this query, which models an eavesdropping attack, $\mathcal{A}$ can intercept all the transmitted messages among $\mathcal{U}$, $F{N}_1$ and $F{N}_2$.
• $Send({\pi }^f,m)$: This query models an as an active attack and enables $\mathcal{A}$ to send a message, say $msg$ to its participating instance ${\pi }^f$, and also to receive a response in reply.
• $Test({\pi }^u,{\pi }^f)$: This query utilizes the indistinguishability in the ROR model [40] to determine the semantic security of the session key $SK$ established between $\mathcal{U}$ and $FN$. TO begin with, $\mathcal{A}$ performs an unbiased coin toss c. Its outcome decides the result of the $Test$ query. If $SK$ is fresh, ${\pi }^u$ or ${\pi }^f$ produces $SK$ upon the satisfaction of the condition $c=1$ or a random number for the fulfillment of the condition $c=0$. Otherwise, it returns a null value.
• $Reveal\left({\pi }^u\right)$: Through this query, $\mathcal{A}$ can learn the session key $SK$ between $\mathcal{U}$ and $F{N}_1$ or between $\mathcal{U}$ and $F{N}_2$.

Definition 1

(Semantic security of session key). According to the ROR model, $\mathcal{A}$ must distinguish between an instance’s actual session key and a random key. To this goal, $\mathcal{A}$ can repeat the $Test(·)$ query to ${\pi }^u$ or ${\pi }^f$, and save the results to bit c. $\mathcal{A}$ wins the game if $c=c^{\prime }$, where $c^{\prime }$ is a randomly guessed bit. The  advantage of $\mathcal{A}$ in breaking the semantic security of the proposed authenticated key agreement ($AKE$), say $\mathcal{P}$ in time $t_p$ is defined as

$$Ad{v}_{\mathcal{P},\mathcal{A}}^{AKE}\left(t_p\right)=|2.Pr\left[SUCCESS\right]-1|,$$

where $SUCCESS$ represents an event such that $\mathcal{A}$ wins the game, that is, $Pr\left[SUCCESS\right]=Pr[c^{\prime }=c]$.

Random oracle: All communicating entities in the proposed scheme including $\mathcal{A}$ will have access to a “collision-resistant hash function, $h(·)$” that is modeled as a “random oracle, say $\mathcal{HO}$”.

Definition 2

(Collision-resistant one-way cryptographic hash function [44]). Let h: ${\{0,1\}}^{*}\to {\{0,1\}}^{l_b}$ be a “collision-resistant one-way hash function” which is a deterministic function. It takes a variable-length input $x\in {\{0,1\}}^{*}$ and returns a fixed-length output, $y=h\left(x\right)\in {\{0,1\}}^{l_b}$ of $l_b$ bits. Assume that the “advantage of an adversary $\mathcal{A}$ in finding a hash collision” in time $t_p$ be denoted by $Ad{v}_{\mathcal{A}}^{Hash}\left(t_p\right)$. Then,

$$\begin{array}{ccc}\hfill Ad{v}_{\mathcal{A}}^{Hash}\left(t_p\right)& =& Pr[(i{p}_1,i{p}_2){\in }_R\mathcal{A}:i{p}_1\ne i{p}_2,h\left(i{p}_1\right)=h\left(i{p}_2\right)],\hfill \end{array}$$

where the pair $(i{p}_1,i{p}_2){\in }_R\mathcal{A}$ means that the input strings $i{p}_1$ and $i{p}_2$ are randomly picked by $\mathcal{A}$. We say “an $(\eta ,t)$-adversary $\mathcal{A}$ attacking the collision resistance of $h(·)$” means that the execution time taken by $\mathcal{A}$ is at most t and $Ad{v}_{\mathcal{A}}^{Hash}\left(t_p\right)\le \eta$.

Definition 3

(Elliptic curve decisional Diffie-Hellman problem (ECDDHP)). Let $G\in {\mathbb{E}}_p$ be a point in an elliptic curve ${\mathbb{E}}_p$. Then, the ECDDHP states that with a given quadruple $(G,$ $l_1·G,$ $l_2·G,$ $l_3·G)$ to decide if $l_3=l_1*l_2$ or a “uniform value”, where $l_1$, $l_2$ and $l_3$ are the scalars chosen randomly from $Z_p^{*}=$ $\{1,2,\cdots ,p-1\}$.

Security proof:

By utilizing the definition of the “collision-resistant hash function” (defined in Definition 2), “elliptic curve decisional Diffie-Hellman problem (ECDDHP)” (defined in Definition 3) and the above described ROR model, Theorem 1 provides the semantic security of the proposed scheme against the adversary $\mathcal{A}$ the derive the session key during the communication.

Theorem 1.

Let $\mathcal{A}$ be a polynomial time adversary running in time $t_p$ against the proposed scheme $\mathcal{P}$ under the ROR model. If $Ad{v}_{\mathcal{P},\mathcal{A}}^{AKE}\left(t_p\right)$ denotes $\mathcal{A}$’s advantage in breaking $\mathcal{P}$’s semantic security in time $t_p$ in order to derive the session key between a legal registered end device $\mathcal{U}$ and an accessed fog node $F{N}_1$ or $F{N}_2$, then

$$Ad{v}_{\mathcal{P},\mathcal{A}}^{AKE}\left(t_p\right)\le \frac{q_h^2}{\left|Hash\right|}+2Ad{v}_{\mathcal{A}}^{ECDDHP}\left(t_p\right),$$

where $q_h$ is the number of hash queries, $\left|Hash\right|$ defines the range space of $h(·)$ and $Ad{v}_{\mathcal{A}}^{ECDDHP}\left(t_p\right)$ is the advantage of an adversary $\mathcal{A}$ in solving ECDDHP in polynomial time $t_p$.

Proof.

Our proof is analogous to the proofs that were presented in [45,46]. We define $G_0$–$G_2$ as the three sequential games in which an event $SUCCES{S}_i$ denotes that the adversary $\mathcal{A}$ can successfully guess the bit c corresponding to the game $G_j$, $j\in [0,2]$. The details of these games are provided below.

• Game$G_0$: This game models an actual (real) attack on the proposed scheme, $\mathcal{P}$ by $\mathcal{A}$. Thus, the bit c is guessed at the beginning of $G_0$. Therefore, the semantic security of the proposed scheme defined in Definition 1, it follows that

  $$Ad{v}_{\mathcal{P},\mathcal{A}}^{AKE}\left(t_p\right)=|2.Pr\left[SUCCES{S}_0\right]-1|.$$

  (1)
• Game$G_1$: This game models an eavesdropping attack, where $\mathcal{A}$ can query $Execute$ oracle to intercept the messages $M_{a_1}=\langle QID,Q_a,V_1,T{S}_1\rangle$, $M_{a_2}=\langle B,V_2,T{S}_2\rangle$, $M_{f_1}=\langle QID,Q_a,V_1,T{S}_1\rangle$, and $M_{f_2}=\langle B,V_2,T{S}_2\rangle$ during the initial and fast authentication processes. Afterwards, $\mathcal{A}$ can also query $Test$ oracle and determine if the result is the actual session key $SK$ or just simply a random number. Note that in the proposed scheme, $SK=h\left(Q_{u{F}_1}\right|\left|Q_b\right)$$=h\left(Q_{u{F}_1}\right|\left|Q_b\right)$$=S{K}^{\prime }$ is the session key established between an end device $\mathcal{U}$ and fog node $F{N}_1$ during the initial authentication, and also $SK=h\left(Q_{u{F}_2}\right|\left|Q_b\right)$$=h\left(h\right(a\left|\right|ZY\left)\right|\left|h\right(b\left|\right|ZY\left|\right|Q_u\left)\right)$$=S{K}^{\prime }$ is the established session key between a user $\mathcal{U}$ and a fog node $F{N}_2$ during the fast authentication. In both cases, to compute $SK$, $\mathcal{A}$ must know the short term secrets (a and b) as well as long term secrets ($k_u$, $YZ$ and $ZY$) simultaneously. Thus, only the intended user $\mathcal{U}$ and fog nodes $F{N}_1$ and $F{N}_2$ can compute $SK$. Therefore, $\mathcal{A}$’s probability of wining the game $G_1$ is not increased form $G_0$ through an eavesdropping attack. Consequently, both the games $G_0$ and $G_1$ are indistinguishable, and we have the following result:

  $$Pr\left[SUCCES{S}_1\right]=Pr\left[SUCCES{S}_0\right].$$

  (2)
• Game$G_2$: Under this game, the $Send$ and hash $\mathcal{HO}$ queries are simulated. This game is modeled as an active attack, where $\mathcal{A}$ can attempt to fool a legitimate participant into accepting a modified message. $\mathcal{A}$ is permitted to make repeated queries to the random oracles to examine the presence of hash collisions. However, since all the messages $M_{a_1}$, $M_{a_2}$, $M_{f_1}$ and $M_{f_2}$ contain unique single use values, hash coalition does not occur (see Definition 2) when $\mathcal{A}$ queries the $Send$ oracle with the help of $h(·)$. Moreover, to derive the session key $SK=h\left(Q_{u{F}_1}\right|\left|Q_b\right)$$=h\left(Q_{u{F}_1}\right|\left|Q_b\right)$$=S{K}^{\prime }$ is the session key established between an end device $\mathcal{U}$ and fog node $F{N}_1$ during the initial authentication, the adversary $\mathcal{A}$ needs to solve the computational ECDDHP defined in Definition 2. It is worth noticing that both the games $G_1$ and $G_2$ are “indistinguishable” except the $Send$ and hash queries are simulated in $G_2$ along with solving ECDDHP. Thus, by using the birthday paradox results and the advantage of $\mathcal{A}$ in solving ECDDHP, we have,

  $$|Pr\left[SUCCES{S}_2\right]-Pr\left[SUCCES{S}_1\right]|\le \frac{q_h^2}{2\left|Hash\right|}+Ad{v}_{\mathcal{A}}^{ECDDHP}\left(t_p\right).$$

  (3)

  Finally, to win the game $G_2$, $\mathcal{A}$ needs to guess bit $c^{\prime }$ after querying the $Test$ oracle. Thus, it is clear that

  $$|Pr\left[SUCCES{S}_2\right]=\frac{1}{2}.$$

  (4)

  From Equations (1)–(4), we have

  $$\begin{array}{cc}\hfill \frac{1}{2}Ad{v}_{\mathcal{P},\mathcal{A}}^{AKE}\left(t_p\right)& =|Pr\left[SUCCES{S}_0\right]-\frac{1}{2}|\hfill \\ \hfill & =|Pr\left[SUCCES{S}_1\right]-\frac{1}{2}|\hfill \\ \hfill & =|Pr\left[SUCCES{S}_1\right]-\left|Pr\left[SUCCES{S}_2\right]\right|\hfill \\ \hfill & \le \frac{q_h^2}{2\left|Hash\right|}+Ad{v}_{\mathcal{A}}^{ECDDHP}\left(t_p\right).\hfill \end{array}$$

  (5)

  By solving Equation (5), we obtain the required result:

  $$Ad{v}_{\mathcal{P},\mathcal{A}}^{AKE}\left(t_p\right)\le \frac{q_h^2}{\left|Hash\right|}+2Ad{v}_{\mathcal{A}}^{ECDDHP}\left(t_p\right).$$

  □

5.2. Informal Security Analysis

In this section, through informal security analysis, we demonstrate the security features of the proposed scheme as well as its resilience against well-known attacks.

5.2.1. Mutual Authentication

In the proposed authentication scheme, the initial authentication is a standard public key-based authentication and the end device and the fog node authenticate each other with the public-private key pairs. For fast authentication, The participants are mutually authenticated with the pre-shared security tokens. Here for brevity, we have shown a single pair of secret tokens but for real implementations, these pair of secret tokens can be scaled up such that there is a one-to-one correspondence between a user and a token pair.

5.2.2. Anonymity and Untraceability

The messages exchanged during the initial or the subsequent fast authentications do not contain any plaintext identifiable values for the adversary to identify the participants with. Additionally, all the values are composed of nonce or timestamps, making tracing attacks infeasible. This the proposed scheme guarantees anonymity and untraceability.

5.2.3. Forward and Backward Secrecy

Assuming that the adversary can somehow learn the session key $SK$ along with all its contributing secret values $Q_{u{F}_2}$ and $Q_b$ under the CK-adversary model. No past or future sessions are compromised as all these values are independent and distinct across sessions. This is true for both the initial or the subsequent fast authentications. Similarly, if the security tokens are leaked, no existing or future sessions are compromised.

5.2.4. Ephemeral Secret Leakage (ESL) Attack

The session key $SK$ is composed form both long and short-term keys. Thus the adversary cannot derive session key $SK$ unless both short and long-term secrets are exposed at once. Thus, the proposed scheme is resilient against the “ESL attack”.

5.2.5. Impersonation Attacks

The initial authentication is designed around the public key cryptography and thus the public keys (issued through the trusted $RA$) prevent impersonation attacks. For fast authentication, the security token is responsible for mutual authentication and if compromised can lead to successful impersonation. However. the mitigation strategies mention in the context of mutual authentication prevents such attacks.

5.2.6. Clogging Attacks

The fog nodes detect and terminate spurious authentication requests after a xor and one or two hash operations for initial and fast authentications receptively. Thus, denial of services through clogging attacks will be mostly ineffective against the proposed scheme.

Remark 2.

The scheme is designed to work in conjuncture with other systems to ensure security against stolen smart cards, privileged insiders, end device capture, and other similar attacks and are beyond the scope of this scheme. Thus, within its scope, the proposed scheme resists all known attacks.

6. Formal Security Verification through AVISPA Simulation

In this section, we validate the security of the proposed scheme with the help of one of the most widely recognized automated software verification tools, known as the “Automated Validation of Internet Security Protocols and Applications (AVISPA)” [41]. AVISPA is a push-button tool for automatic verification of security protocols. It is widely accepted as the formal verification of a security scheme against the man-in-the-middle and replay attacks (also, indirectly impersonation attacks), and internally implements the Dolev-Yao (DY) threat model [37]. Thus, the adversary has not only capability to intercept the communicating messages, but also can delete, modify or insert fake messages during the communication.

To verify a security scheme with AVISPA, it must be specified in the High Level Protocol Specification Language (HLPSL) [47]. AVISPA distribution includes an inbuilt converter for conversion from HLPSL to IF, known as Intermediate Format (IF), for backends for evaluations. There are four backends in AVISPA, namely (1) On-the-fly Model-Checker (OFMC), which is responsible for “performing several symbolic techniques to explore the state space in a demand-driven way”, (2) Constraint Logic based Attack Searcher (CL-AtSe), which provides “a translation from any security protocol specification written as transition relation in intermediate format into a set of constraints which are effectively used to find whether there are attacks on protocols”, (3) SAT-based Model-Checker (SATMC), which builds “a propositional formula and then the formula is fed to a state-of-the-art SAT solver to verify whether there is an attack or not” and (4) Tree Automata based on Automatic Approximations for the Analysis of Security Protocols (TA4SP), which approximates the “intruder knowledge by using regular tree languages”. Of these four backends, OFMC and CL-AtSe are widely used because they support implementation of various functions including bitwise XOR operations, whereas SATMC and TA4SP do not support the implementation of bitwise XOR operations. Finally, the IF is evaluated by these backends and the result is presented in the Output Format (OF). For more details regarding AVISPA and HLPSL [41] can be consulted.

6.1. Specifying the Roles

HLPSL is a role-based language and individual roles for end device, registration authority, and two fog nodes, primary and failover, are defined in addition to the compulsory session, environment, and goal roles. The basic roles for an end device, two fog nodes $F{N}_1$ and $F{N}_2$, and the gateway node $RA$ are defined in Figure 6, Figure 7, Figure 8 and Figure 9, respectively. The compulsory roles for the session and goal and environment are defined in Figure 10. In the HLPSL implementation, secret credentials are kept secret by the secret declaration. The witness and request (authentication) are done by the witness and request declarations, respectively. The privacy and authentication goals are achieved through secrecy_of and authentication_on statements, respectively.

In order to check the replay attack protection, it is required to mention the following two statements in the environment role:

    session(ed, fn1, fn2, ra, h1, secureChannel)

 /\ session(ed, fn1, fn2, ra, h1, secureChannel)

The man-in-the-middle and impersonation attacks are implemented by the following statements in the environment role, where an intruder $\left(i\right)$ actively takes part in the communication:

    session(ed, fn1, fn2, i,  h1, secureChannel)

 /\ session(ed, fn1, i, ra, h1, secureChannel)

 /\ session(ed, i, fn2, ra, h1, secureChannel)

 /\ session(i, fn1, fn2, ra, h1, secureChannel)

The simulation started with end device registration, described the fog node enrollments, the pre-arrangement of the security tokens, initial authentication, and the fast authentication with the failover fog node.

6.2. Simulation Results and Discussion

We evaluated the HLPSL script with the “SPAN, the Security Protocol ANimator for AVISPA” software tool [48]. Figure 11 presents the simulation results in OF. The results demonstrate the proposed scheme is secure against replay, man-in-the-middle and impersonation attacks.

7. Testbed Experiments Using MIRACL

In this section, we measure the execution time needed for different cryptographic primitives with the help of the broadly recognized “Multiprecision Integer and Rational Arithmetic Cryptographic Library (MIRACL)” [49].

The notations $T_{senc}/T_{sdec}$, $T_{eca}$, $T_{ecm}$, $T_{fe}$, $T_h$, $T_{poly}$, $T_{mul}$ and $T_{add}$ denote the time needed for computing symmetric encryption/decryption (using Advanced Encryption Standard (AES) algorithm [50]), elliptic curve point addition, elliptic curve point (scalar) multiplication, fuzzy extractor operation [51], one-way hash operation (using Secure Hash Algorithm (SHA-1) [39]), evaluation of an t-degree polynomial over a finite field, multiplication in a finite field and addition in a finite field, respectively. If we use the Horner’s rule [52], the evaluation of an t-degree uni-variate polynomial, say $f(a,y)$ at $y=b$ (that is, $f(a,b)$) needs t modular multiplications and t modular additions, where a and b are taken from a finite field. In other words, $T_{poly}=t(T_{mul}+T_{add})$.

We have considered two platforms for the testbed experiment. In each platform, we execute each cryptographic primitive for 100 trials in order to measure the average run time of primitives.

• Platform 1: This platform corresponds to a server setting under the environment: “Ubuntu 18.04.4 LTS, with 7.7 GiB memory, Intel Core i7 processor- 8565U, CPU @ 1.80GHz × 8, 64-bit OS type and disk size 966.1 GB”. The experimental results for different primitives are then measured using MIRACL library and then provided in

  Table 2. Execution time (in milliseconds) of cryptographic primitives under a server setting.

  Primitive	Max. Time (ms)	Min. Time (ms)	Average Time (ms)
  $T_h$	0.149	0.024	0.055
  $T_{senc}$	0.008	0.002	0.003
  $T_{sdec}$	0.005	0.002	0.003
  $T_{mul}$	0.035	0.002	0.004
  $T_{add}$	0.004	0.001	0.002
  $T_{ecm}$	2.998	0.284	0.674
  $T_{eca}$	0.002	0.001	0.002

  . Note that under this platform, $T_{poly}=$$t(T_{mul}+T_{add})$$=0.006t$ milliseconds by considering average time. In addition, it is assumed that $T_{fe}$$\approx T_{ecm}$ [53].
• Platform 2: In this platform, we measured the execution time for cryptographic primitives by MIRACL for the smart device side under the Raspberry PI 3 setting. The system configuration is considered as follows: “Raspberry PI 3 B+ Rev 1.3, Ubuntu 20.04 LTS, 64- bit OS, 1.4 GHz Quad-core processor, cores 4, 1 GB RAM” [54]. In

  Table 3. Execution time (in milliseconds) of cryptographic primitives under Raspberry PI 3 setting.

  Primitive	Max. Time (ms)	Min. Time (ms)	Average Time (ms)
  $T_h$	0.643	0.274	0.309
  $T_{senc}$	0.038	0.017	0.018
  $T_{sdec}$	0.054	0.009	0.014
  $T_{mul}$	0.016	0.009	0.011
  $T_{add}$	0.013	0.008	0.010
  $T_{ecm}$	4.532	2.206	2.288
  $T_{eca}$	0.021	0.015	0.016

  , we have tabulated the experimental results of different cryptographic primitives. Note that under this platform, $T_{poly}=$$t(T_{mul}+T_{add})$$=0.021t$ milliseconds by considering average time.

8. Comparative Study

In this section, we compare the proposed scheme with the recent authentication schemes proposed by Gope [30], Guo et al. [35] and Ali et al. [36]. For the proposed scheme, we have considered three cases as follows:

• Case 1: It denotes the “fog node pre-agreement” phase
• Case 2: It corresponds to the “initial authentication” phase
• Case 3: It represents the “fast authentication” phase

In Gope’s scheme [30], we have the following three scenarios:

• LAAP1: It is for the “initial authentication protocol for device-to-device (D2D)-aided fog computing”
• LAAP2: It denotes the “subsequent authentication protocol with the co-operation of EDs in D2D-aided fog computing”
• LAAP3: It corresponds to the “subsequent authentication protocol with the co-operation of NADs in D2D-aided fog computing”

where ED is an “end device”; NAD means the “Network Access Devices” and CCS denotes “Centralized Cloud Servers”.

8.1. Computation Costs Comparison

We have used the average execution time for different cryptographic primitives for the server setting and Raspberry PI 3 setting as shown in Table 2 and Table 3 as those for an end device and a fog node/cloud server, respectively. In

Table 4. Computation costs comparison.

Scheme	Cost at ED	Cost at Fog Node (NAD)	Cost at Cloud Server (CCS)
Proposed (Case 1)	−	$2T_{ecm}+8T_h$	−
		$\approx 1.788$ ms
Proposed (Case 2)	$3T_{ecm}+4T_h$	$2T_{ecm}4T_h$	−
	$\approx 8.1$ ms	$\approx 1.568$ ms
Proposed (Case 3)	$7T_h$	$7T_h$	−
	$\approx 2.163$ ms	$\approx 0.385$ ms
Gope [30] (LAAP1)	$7T_h$	$3T_h$	$6T_h$
	$\approx 2.163$ ms	$\approx 0.165$ ms	$\approx 0.33$ ms
Gope [30] (LAAP2)	$11T_h$	$3T_h$	−
	$\approx 3.399$ ms	$0.165$ ms
Gope [30] (LAAP3)	$5T_h$	$11T_h+2T_{senc}/T_{sdec}$	−
	$\approx 1.545$ ms	$0.611$ ms
Guo et al. [35]	$T_{fe}+19T_h+2T_{poly}$	$8T_h+5T_{poly}$	−
	$\approx (8.159+0.042t)$ ms	$\approx (0.44+0.03t)$ ms
Ali et al. [36]	$T_{fe}+18T_h+3T_{ecm}$	$4T_{ecm}+8T_h+T_{eca}$	−
	$\approx 14.714$ ms	$\approx 3.138$ ms

Note: ED: “end device”; NAD: “Network Access Devices”; CCS: “Centralized Cloud Servers”; LAAP1: “Initial authentication protocol for D2D-aided fog computing”; LAAP2: “Subsequent authentication protocol with the co-operation of EDs in D2D-aided fog computing”; LAAP3: “Subsequent authentication protocol with the co-operation of NADs in D2D-aided fog computing”; Case 1: “Fog node pre-agreement”; Case 2: “Initial authentication”; Case 3: “Fast authentication”; t: degree of a uni-variate polynomial over a finite field.

, we have compared the computational costs needed for the entities, like end device, fog node and cloud server during various authentication phases among the proposed scheme and other schemes, such as the schemes of Gope [30], Guo et al. and Ali et al. During the fast authentication process (Case 3), in the proposed scheme the end device and the fog nodes need to perform $7T_h$$\approx 2.163$ ms and $7T_h$$\approx 0.385$ ms, respectively. The cloud server is not involved in the proposed scheme. From the comparative analysis, it is observed that the proposed scheme has comparable computation overheads for various entities as compared to those for other related competing schemes.

8.2. Communication Costs Comparison

For the communication overheads of different existing schemes, we assume that the hash digest, a random nonce (secret) and an identity to be 160 bits each. We additionally assume that a sequence number and a timestamp to be 32 bits long. In addition, AES-128 cipher [50] needs 128-bit plaintext/ciphertext block and an elliptic curve point needs $(160+160)=$ 320 bits by assuming 160-bit ECC security remains the same level as that for 1024-bit RSA-based public key cryptosystem. In the proposed scheme, Case 1, Case 2 and Case 3 require 88 bytes, 148 bytes and 108 bytes, respectively, for exchange of 2 messages in each case. The communication overheads of the related schemes and the proposed scheme are compared in

Table 5. Communication costs comparison.

Scheme	No. of Bytes	No. of Messages
Proposed (Case 1)	88	2
Proposed (Case 2)	148	2
Proposed (Case 3)	108	2
Gope [30] (LAAP1)	400	4
Gope [30] (LAAP2)	320	4
Gope [30] (LAAP3)	360	4
Guo et al. [35]	272	3
Ali et al. [36]	352	3

Note: LAAP1: “Initial authentication protocol for D2D-Aided fog computing”; LAAP2: “Subsequent authentication protocol with the co-operation of EDs in D2D-Aided fog computing”; LAAP3: “Subsequent authentication protocol with the co-operation of NADs in D2D-Aided fog computing”; Case 1: “Fog node pre-agreement”; Case 2: “Initial authentication”; Case 3: “Fast authentication”.

. We can clearly see that the proposed scheme has the lowest communication cost among the related existing schemes.

8.3. Security and Functionality Features Comparison

Table 6. Security and functionality features comparison.

Functionality Features	Our	Gope [30]	Guo et al. [35]	Ali et al. [36]
Authentication without cloud servers
Fog failover authentication
Resists known attacks
Mutual authentication
ESL attack under CK-adversary model
Formal security verification

summarizes the security and functionality features of the proposed scheme and the related schemes. We can see all the compared schemes support anonymity preserving mutual authentication and resist the known attacks. Apart from Ali et al.’s scheme [36], all other schemes support authentication without the cloud server. The schemes in [30] and [35] are not secure against ESL attack under the CK-adversary model [31]. Finally, as per the design motivation, only the proposed scheme supports fast failover authentication for fog nodes failure. Overall, the proposed scheme provides the richest security and functionality features while having comparable computational costs and lowest communication overheads, as compared to other competing schemes.

9. Concluding Remarks and Future Works

In this work, we have highlighted the need for a fast authentication mechanism in case of fog nodes failure. To achieve this goal, we have presented a new lightweight failover authentication mechanism for fog computing environment. We have shown the robustness of the proposed scheme with a detailed security analysis along with the formal security analysis under the ROR random oracle model, informal security analysis and also the formal security verification under the widely-accepted software validation tool, known as AVISPA. In addition, the testbed experiments for measuring computational time needed for various cryptographic primitives under the MIRACL library have been provided. Finally, through a comparative study among the proposed scheme and other related recent schemes, we have demonstrated the advantage of the proposed approach in terms of the security and functionality features, and communication and computational overheads. In future, we have planned to integrate the proposed scheme into a more complete fog enabled IoT architecture and evaluate the same in a real-world testbed scenario.