A Provably Secure and Lightweight Two-Factor Authentication Protocol for Wireless Sensor Network

Abstract

Wireless Sensor Networks (WSNs) are rapidly being integrated into various fields, significantly impacting and facilitating many aspects of human life. However, the increasingly prominent security issues associated with WSNs have become a significant challenge. This paper provides an in-depth analysis of the security challenges faced by WSNs in resource constrained and open communication environments. As a key component of the Internet of Things (IoT), a WSN can perceive, collect and transmit physical environmental data in real-time, and is widely used in military, medical, agricultural and other fields. However, the insecurity of communication channels and unauthorized user access pose severe threats to network security and data integrity. To address these challenges, this paper proposes a provably secure two-factor authentication protocol. This protocol utilizes a Chebyshev chaotic map and a two-factor authentication mechanism, which not only enhances security in WSNs but also improves authentication efficiency. The protocol is validated through security proof and performance experiments, demonstrating excellent security, functionality and efficiency. This provides strong support for secure and efficient communication in WSNs across various application scenarios.

1. Introduction

IoT enables real-time data collection from the surrounding environment through information-gathering devices and technologies, facilitating connections between objects and people via networks. As a critical component of the IoT, the WSN has also become a primary focus of research in the fields of wireless communication and computer science [1,2,3,4,5]. WSN is composed of numerous wireless sensor nodes deployed in the monitored area, forming a self-organizing multi-hop wireless network [6]. They can perceive, collect, process and transmit environmental data in real time, thereby digitizing the physical environment and establishing a connection between the physical environment and the network. The high flexibility, strong fault tolerance, small size, low cost and ease of installation of WSN nodes contribute to their widespread application in fields such as military, healthcare, agriculture, smart cities and environmental monitoring [7,8,9]. In future intelligent communication technologies, the WSN is expected to continue evolving as a critical foundational technology and infrastructure.

Wireless sensor nodes monitor and collect various environmental metric data, which are then uploaded to a base station. The base station connects to the internet, where the data are stored, processed and made available for service. Users can request data interaction from wireless sensor nodes to obtain real-time sensed data. WSNs have been widely applied in various scenarios, but the networks still have certain limitations [10]. First, as a crucial component of the network, wireless sensor nodes are responsible for sensing, collecting and transmitting environmental data. However, these nodes are resource-constrained, independent embedded devices with significant limitations in energy, computing power and memory. Once a node’s battery is depleted, the wireless sensor node is considered dead and ceases to function. Second, the insecurity of communication channels is a concern. Wireless sensor nodes use unprotected public channels for data transmission and reception within the network. If attackers infiltrate the network, they can launch attacks through interception, replay, modification, forwarding and other methods. Third, unauthorized users may impersonate legitimate users when accessing the network, requesting data interaction from wireless sensor nodes or base stations to obtain sensed data. These limitations make WSNs more susceptible to targeted attacks, compromising the credibility and integrity of messages and ultimately undermining the security of the entire network [11,12,13]. Given the widespread application of WSN in various scenarios, an attack on the network poses significant threats to participant privacy, economic interests and even national security. To protect user information from being compromised and to ensure the validity and integrity of exchanged information in an open network environment, identity authentication is essential. The authentication process occurs over public channels, making it susceptible to eavesdropping and other techniques that allow attackers to obtain communication content [14]. Therefore, the primary objectives of an authentication protocol are to achieve mutual authentication and establish a session key. In addition, another critical aspect to consider in an authentication protocol is its efficiency. This efficiency primarily depends on the cryptographic algorithms used in the protocol. To design more efficient authentication protocols, researchers have discovered that Chebyshev polynomials exhibit semigroup properties, which can be utilized to design cryptographic algorithms. Compared to widely used traditional cryptographic algorithms, those based on Chebyshev polynomials offer higher computational efficiency [15]. Consequently, authentication protocols using Chebyshev polynomials require less computational power from devices, making them more promising for development.

Method and Contribution

This paper focuses on analyzing the security issues present in the WSN, investigates the security vulnerabilities in authentication protocols within WSN and proposes a provably secure and lightweight two-factor authentication protocol. The contributions are organized as follows:

(1) In this paper, a provably secure and lightweight authentication protocol is designed using a Chebyshev chaotic map, two-factor authentication and symmetric encryption technologies. This protocol integrates the complexity of the Chebyshev chaotic map with the dual security provided by two-factor authentication, significantly enhancing WSN security while also improving the efficiency of the authentication process. Furthermore, this protocol provides a solid theoretical foundation and technical support for secure and efficient communication in WSN.

(2) The security of this authentication protocol has been rigorously verified through security proof. An informal security analysis further illustrates the protocol’s security features. Performance experiment results indicate that, compared to other related protocols, the proposed protocol achieves a better balance between security, functionality and overhead. While enhancing security and implementing more functional features, the protocol minimizes overhead.

The following sections are structured as follows: Section 2 reviews the advancements in pertinent research areas. Section 3 elaborates on the fundamental principles. Section 4 details the components. Section 5 presents an in-depth security analysis. Section 6 describes the experiment. Section 7 summarizes the work.

2. Related Work

Authentication in WSNs enables secure information transmission between nodes. It ensures that all interacting wireless sensor nodes within the network are authenticated as trusted nodes, preventing unauthorized nodes from joining the network and verifying the integrity of the information. Table 1 summarizes the limitations of some protocols.

Choi et al. [16] proposed an enhanced protocol for WSN. This protocol improved upon traditional vulnerable protocols, enabling WSN to more effectively resist attacks, thereby significantly enhancing overall network security. By leveraging the high security and low computational requirements of elliptic curve cryptography, the protocol enhanced security while minimizing the demand for computational and storage resources. However, the protocol’s computational complexity remained high when dealing with complex network environments. Chang et al. [17] proposed an identity protocol for WSNs, which achieved authentication by combining unique node identifiers with hash values. Security analysis demonstrated that this protocol effectively resisted attacks, providing significant advantages for secure WSN transmission. However, the protocol lacked an analysis of potential communication and computation overhead. Marnya et al. [18] specifically designed a multiparty key exchange identity authentication protocol for communication between back-end databases and terminal devices. This protocol not only strengthened the traditional bilateral authentication model, but also enabled secure key distribution and management among multiple nodes. By combining elliptic curve cryptography with hash functions, the security of communication data between authenticated parties was effectively ensured. Additionally, the protocol introduced a key update mechanism to prevent security risks associated with long-term use of the same key. Security analysis demonstrated that this protocol effectively resisted forgery attacks and replay attacks. However, the protocol’s high computational requirements in practice limited its applicability in sensor networks or remote monitoring systems. Pommbage et al. [19] designed a protocol in resource-constrained environments. This protocol maintained symmetric connections between sensor nodes while establishing secure links with end users. Lightweight key exchange was implemented, considering the energy and computational constraints of nodes in resource-constrained networks. Security analysis showed that this protocol effectively resisted common security threats. Based on the research of TWSN authentication mechanisms, researchers had designed several identity authentication mechanisms for UWSN. Galindo et al. [20] proposed a protocol and compared its advantages with those of traditional symmetric key protocols. Although the scheme had relatively high energy consumption, it offered significant advantages in key connectivity, attack resistance and scalability. In practical applications, public key protocols were often the preferred choice. However, the study remained at the theoretical analysis stage and had not been implemented in simulations or hardware. Souzad et al. [21] evaluated and compared the energy consumption of three digital signature schemes to assess their suitability for underwater environments. Due to signal attenuation, propagation delays and dynamic underwater topologies, UWSN had different requirements for energy efficiency and performance. This study provided practical guidance for developing more efficient and energy-saving underwater communication systems. Yuan et al. [22] explored the severe limitations of underwater nodes in UWSN regarding computational capacity and communication bandwidth. They proposed a low-complexity underwater authentication scheme that significantly reduced computational overhead by replacing matrix multiplication with matrix addition, leveraging the properties of the Vandermonde matrix. This scheme performed well in balancing energy consumption and communication efficiency but was somewhat lacking in storage overhead for underwater nodes. Das et al. [23] proposed a dynamic protocol, dividing the authentication process into three stages: registration, login and authentication. In the user registration phase, the base station generated a secret parameter, which was hashed and encrypted. However, if an attacker gained access to the smart card, they could obtain the user’s authentication parameters, impersonate the legitimate user and pose a threat to network security. Additionally, the protocol only supported one-way authentication from the base station to the user, leaving the possibility of the user being deceived by a rogue base station and failing to provide anonymity protection for the user’s identity. Despite these shortcomings, many researchers have made optimizations and improvements based on this protocol. Porambage et al. [24] proposed an implicit certificate-based authentication mechanism, dividing the protocol into two stages. First, the user obtained a cryptographic certificate from the base station and then used this certificate to authenticate their trustworthiness and access detected data. This protocol provided a mechanism for WSN. However, it still faced security threats such as man-in-the-middle attacks. To overcome these deficiencies, Elhabrush et al. [25] introduced improvements by incorporating elliptic curve cryptography, enabling the authentication protocol to resist various types of passive attacks. Farash et al. [26] proposed a scheme for heterogeneous WSN, allowing users to authenticate with wireless sensor nodes through four rounds of message exchanges without interacting with the base station. Sarbini et al. [27] proposed a lightweight scheme for WSN, reducing computational energy consumption, while employing public–private key encryption. Amin et al. [28] proposed a multi-base station authentication security architecture and designed a corresponding protocol, enabling users to securely access data from wireless sensor nodes through the base stations. Subsequently, Amin et al. [29] improved this architecture by dividing wireless sensor nodes into cluster head nodes and regular nodes within the multi-base station framework. Regular nodes performed minimal computations, while the majority of authentication-related computations were handled by the cluster head nodes, thereby balancing the network’s energy consumption. However, Wu et al. [30] analyzed the aforementioned schemes and demonstrated that they still suffered from various security vulnerabilities. Srinivas et al. [31] introduced bio-hashing technology into a multi-base station security authentication system for WSN, significantly improving the separation of malicious and legitimate users, reducing the false acceptance rate of the authentication protocol. Xiong et al. [32] proposed an identity authentication scheme for multi-base station architectures, where users obtained an authentication identifier and password, allowing secure access to multiple base stations using the same credentials. Tran et al. [33] proposed a new dynamic detection protocol. This protocol detected whether the captured facial stream conforms to a valid text sequence. Bera et al. [34] proposed a biometric-based user authentication protocol. The proposed protocol had been proven to be robust against many potential attacks, as required for IoT-based smart city deployment.

Table 1. Comparative Analysis.

Protocol	Limitation
Choi et al. [16]	The protocol’s computational complexity remained high when dealing with complex network environments.
Chang et al. [17]	The protocol lacked an analysis of potential communication and computation overhead
Marnya et al. [18]	The protocol’s high computational requirements in practice
Galindo et al. [20]	The study remained at the theoretical analysis stage and had not been implemented in simulations or hardware.
Yuan et al. [22]	There was a slight lack of storage overhead.
Das et al. [23]	The protocol failed to provide anonymity protection for the user’s identity.
Porambage et al. [24]	The protocol faced security threats such as man-in-the-middle attack.

Table 1. Comparative Analysis.

Protocol	Limitation
Choi et al. [16]	The protocol’s computational complexity remained high when dealing with complex network environments.
Chang et al. [17]	The protocol lacked an analysis of potential communication and computation overhead
Marnya et al. [18]	The protocol’s high computational requirements in practice
Galindo et al. [20]	The study remained at the theoretical analysis stage and had not been implemented in simulations or hardware.
Yuan et al. [22]	There was a slight lack of storage overhead.
Das et al. [23]	The protocol failed to provide anonymity protection for the user’s identity.
Porambage et al. [24]	The protocol faced security threats such as man-in-the-middle attack.

3. Security Model and Symbol Definitions

3.1. System Model

As depicted in Figure 1, the WSN authentication model is carefully constructed with three core components: sensor node (SN), gateway node (GWN) and user. This architecture is designed to ensure secure data transmission and access control, thereby enhancing the reliability and security of the entire network system.

Figure 1. System Model.

Gateway node: As the central hub in WSN, the gateway is responsible not only for creating and maintaining public system information but also for performing multiple critical tasks. It first needs to establish and manage a comprehensive registration mechanism to ensure that all sensor nodes and users are accurately identified and recorded. Additionally, the gateway undertakes the crucial task of verifying identity information by implementing efficient authentication protocols to ensure that only authorized entities can access the network and its data. This process is essential for preventing unauthorized access and safeguarding data privacy and integrity.

User: In the WSN, the user must formally register with the gateway to obtain the necessary authentication information. This process typically involves submitting user identity information to ensure their legitimate status within the network. Once registered and authenticated, the user can interact with gateways and sensor nodes via communication channels to query and control data.

Sensor node: As the fundamental unit of WSN, the sensor node is distributed across the monitored area, responsible for collecting various environmental parameters and converting them into digital signals for transmission. In terms of authentication, sensor nodes must also participate in the authentication process to ensure their authenticity and legitimacy. This typically requires sensor nodes to be registered and store corresponding authentication information prior to deployment. Additionally, the sensor node must be capable of responding to authentication requests from gateways or users to prove their legitimacy and allow further data transmission and processing.

3.2. Attack Model

Due to the widespread application of WSNs, attackers can attack WSNs through various attack methods. Therefore, this article refers to the Dolev Yao (DY) model [35] as the basic capability model for attackers. Based on the characteristics of WSN, it is assumed that attackers should possess the following basic capabilities:

(1)

Attackers can intercept, replay, modify or delete messages transmitted through public channels.

(2)

Attackers can obtain data and parameters stored in smart cards.

(3)

Attackers can obtain previous session keys.

3.3. Security Objective

The authentication protocol under the WSN needs the identities of entities to be authenticated, to avoid unauthorized accessing, and to generate shared session keys to ensure the security of subsequent communication. This paper mainly introduces the security objectives of the protocol.

(1)

Mutual authentication: The protocol should authenticate each other to ensure secure communication.

(2)

Prevention of Denial of Service (DoS) attacks: An attack that shuts down a system or network, preventing authorized users from accessing it. This is typically achieved by overwhelming the system or network with a flood of invalid access requests, causing it to become overloaded and unable to provide normal service.

(3)

Preventing user anonymity: The protocol should ensure the security of user identities and prevent the tracking of user activities.

(4)

Resisting impersonation attacks: Attackers can pose as authorized users, forging login credentials and manipulating sensitive data sourced from sensor nodes. Therefore, the scheme must be designed to be impervious to these types of attacks.

(5)

Resisting replay attacks: In this case, if an attacker obtains previous messages, they may attempt to impersonate an authorized user. To resist replay attacks, the authentication protocol should use different messages for each session.

3.4. Notation

Table 2 provides the notation used in the paper.

Table 2. Notation and Description.

Notation	Description
$U_i$	User
GWN	Gateway node
${SN}_j$	Sensor Node
${ID}_i$	Identity of $U_i$
SK	Session Key
${SID}_j$	Identity of ${SN}_j$
$h\left(\cdot \right)$	Hash Function
$P{W}_i$	Password of $U_i$
$\parallel$	Linking Operation
${\mathrm{S}\mathrm{C}}_i$	Smart Card of $U_i$
$\oplus$	XOR Operation

3.5. Security Model

The security model for WSN is described using the security models presented in [35,36,37].

Participants: For clarity and to avoid redundancy, let us denote the sensor node instance as ${\Pi }_{S{N}_j}^s$, the user instance as ${\Pi }_{U_i}^u$ and the gateway node instance as ${\Pi }_{GWN}^g$.

Adversary: We assume an adversary $\mathcal{A}$ has complete control over all communications within the WSN. This includes the ability to intercept, read, modify, construct and inject messages into the network.

Freshness: If the session key SK of instance ${\Pi }_{U_i}^s$ or ${\Pi }_{S{N}_j}^s$ has not been exposed to adversary $\mathcal{A}$, they are considered fresh.

$\mathit{E}\mathit{x}\mathit{e}\mathit{c}\mathit{u}\mathit{t}\mathit{e}\left({\mathsf{\Pi }}^{\mathbf{s}},{\mathsf{\Pi }}^{\mathbf{u}},{\mathsf{\Pi }}^{\mathit{g}}\right)$: This query triggers a session between two instances and captures all transmitted messages, modeling an eavesdropping attack.

$\mathit{C}\mathit{o}\mathit{r}\mathit{r}\mathit{u}\mathit{p}\mathit{t}\mathit{S}\mathit{C}\left({\mathsf{\Pi }}^{\mathbf{s}}\right)$: The query enables $\mathcal{A}$ to extract data stored on the smart card.

$\mathit{T}\mathit{e}\mathit{s}\mathit{t}\left({\mathit{\Pi }}^{\mathbf{\prime }}\right)$: This query tests the ability of $\mathcal{A}$ to discern between the actual session key and a randomly generated key for a given instance. Initially, a random bit $bϵ\left\{\mathrm{0,1}\right\}$ is secretly chosen and used to determine the response to a $Test$ query: If $b=1$ and the session key is established and fresh, it returns the session key. If $b=0$, it returns a random number. Otherwise, it returns ⊥.

Semantic security of session key: The essence lies in the inability of $\mathcal{A}$ to discern the actual session key from a randomly generated key. $\mathcal{A}$ can issue a $Test$ query to an instance of $U_i$ or $S{N}_j$. The outcome of the $Test$ query adheres to the predetermined bit b, ensuring consistency. After the attack experiment, $\mathcal{A}$ submits a guess b’, and if b’ = b, $\mathcal{A}$ succeeds in the challenge.

Let $Succ$ denote the success of $\mathcal{A}$ in the challenge game and let P represent the proposed protocol. The advantage of $\mathcal{A}$ in the semantic security is defined as $Ad{v}_P^{ake}=\left|2Pr\left[Succ\right]-1\right|$. Here, if $Ad{v}_P^{ake}\left(\mathcal{A}\right)$ is negligible, then P is a secure authentication protocol.

3.6. Chebyshev Chaotic Map

Definition 1.

(Chebyshev Chaotic Map): Let n be an integer and $x\in \left[-1,1\right]$, with the Chebyshev polynomial defined as (1) and (2) [15].

$$T_n\left(x\right)=cos\left(n\cdot arccos\left(x\right)\right)$$

(1)

$$T_n\left(x\right)=2x{T}_{n-1}\left(x\right)-T_{n-2}\left(x\right)\left(modp\right)$$

(2)

Definition 2.

(Chaotic Map-Based Diffie–Hellman Problem (CMDHP)): Given x, $T_s\left(x\right)$ and $T_r\left(x\right)$, it is almost impossible to find $T_{rs}\left(x\right)$.

4. Proposed Scheme

4.1. System Setup

GWN selects a system master key k and a secret value y, and computes $P_{\mathrm{G}}=T_y\left(x\right)$. Then, GWN selects a large prime number p and a random number $x\in [-\infty ,+\infty ]$. The values k and y are kept secret by the GWN, while $x$ and p are made public. Figure 2 shows the authentication process.

Figure 2. Authentication process.

4.2. Node Registration

GWN assigns an identity ${SID}_j$ to node ${\mathrm{S}\mathrm{N}}_j$ and computes $K_{\mathrm{S}\mathrm{N}}=h\left(S{\mathrm{I}\mathrm{D}}_j\parallel \mathrm{k}\right)$. The pair $\{{\mathrm{S}\mathrm{I}\mathrm{D}}_j,K_{\mathrm{S}\mathrm{N}}\}$ is stored in the sensor node.

4.3. User Registration

User $U_i$ inputs the identity ${ID}_i$ and password ${\mathrm{P}\mathrm{W}}_i$, selects random numbers $a_1$ and $a_2$, and computes ${\mathrm{P}\mathrm{I}\mathrm{D}}_i=h\left({\mathrm{I}\mathrm{D}}_i\parallel a_1\right)$ and ${\mathrm{U}\mathrm{P}\mathrm{W}}_i^{\mathrm{\prime }}=h\left({\mathrm{P}\mathrm{W}}_i\parallel a_2\right)$. The user then sends ${\{\mathrm{P}\mathrm{I}D}_i,{\mathrm{U}\mathrm{P}\mathrm{W}}_i^{\mathrm{\prime }}\}$ to the GWN.

Upon receiving ${\{\mathrm{P}\mathrm{I}D}_i,{\mathrm{U}\mathrm{P}\mathrm{W}}_i^{\mathrm{\prime }}\}$, GWN computes $U{X}_i=h\left({\mathrm{P}\mathrm{I}\mathrm{D}}_i\parallel k\right)$ and ${UB}_i^{\mathrm{\prime }}={UX}_i\oplus h\left({\mathrm{U}\mathrm{P}\mathrm{W}}_i^{\mathrm{\prime }}\parallel {\mathrm{P}\mathrm{I}\mathrm{D}}_i\right)$. GWN stores $\{{PID}_i,Honeynum=0\}$ in its database and sends $\left\{{UB}_i^{\mathrm{\prime }}\right\}$ and the smart card ${SC}_i$ (Smart card is a chip card with built-in integrated circuits. It can not only store data, but also process it, with high information security and confidentiality. In WSNs, smart cards are mainly used as authentication tokens to achieve legitimate access and control of users by storing their unique identification information and required keys) to $U_i$.

The user computes $U{X}_i={UB}_i^{\mathrm{\prime }}\oplus h\left({\mathrm{U}\mathrm{P}\mathrm{W}}_i^{\mathrm{\prime }}\parallel {\mathrm{P}\mathrm{I}\mathrm{D}}_i\right)$, selects a random number $a_3$, and calculates ${\mathrm{UPW}}_i=h\left({\mathrm{P}\mathrm{W}}_i\parallel a_3\right)$ and ${UB}_i={UX}_i\oplus h\left({\mathrm{U}\mathrm{P}\mathrm{W}}_i\parallel {\mathrm{P}\mathrm{I}\mathrm{D}}_i\right)$. The user then computes ${UA}_i=h\left({\mathrm{P}\mathrm{I}\mathrm{D}}_i\parallel {\mathrm{U}\mathrm{P}\mathrm{W}}_i\right)\mathrm{m}\mathrm{o}\mathrm{d} n_0$, where $n_0$ is an integer in the range $[2^8,2^{10}]$. Finally, the user writes ${\{a}_1,a_3,\mathrm{U}{B}_i$, $U{A}_i$} to ${SC}_i$.

4.4. User Login and Authentication

(1) User inputs ${ID}_i$ and ${PW}_i$. ${\mathrm{S}\mathrm{C}}_i$ computes ${PID}_i^{\mathrm{*}}=h\left({\mathrm{I}\mathrm{D}}_i‖a_1\right)$, ${UPW}_i^{\mathrm{*}}=h({PW}_i\parallel a_3)$ and $A_i^{\mathrm{*}}=h({PID}_i^{\mathrm{*}}\parallel {UPW}_i^{\mathrm{*}}) \mathrm{m}\mathrm{o}\mathrm{d} n_0$. $A_i^{\mathrm{*}}?=A_i$ is compared. If they are equal, the process continues; otherwise, it terminates. $U_i$ computes ${UX}_i={UB}_i\oplus h({\mathrm{U}\mathrm{P}\mathrm{W}}_i^{\mathrm{*}}\parallel {\mathrm{P}\mathrm{I}\mathrm{D}}_i^{\mathrm{*}})$, and selects random numbers $a_4$ and $m_i$. The user then computes $M_1=T_{m_i}\left(x\right)$, $M_2=T_{m_i}\left(P_{\mathrm{G}}\right)$, ${AID}_{\mathrm{i}}=h({ID}_i\parallel {\alpha }_4)$, $M_3=E_{h\left(M_1\parallel {UX}_i\right)}({AID}_{\mathrm{i}}\parallel {SID}_j)$, and $M_4=h({UX}_i\parallel M_2\parallel {AID}_{\mathrm{i}}\parallel {SID}_j)$. Finally, $U_i$ sends $\{{PID}_i,M_1,M_3,M_4\}$ to GWN.

(2) Upon receiving $\{{PID}_i,M_1,M_3,M_4\}$, GWN computes ${UX}_i=h\left({\mathrm{P}\mathrm{I}\mathrm{D}}_i\parallel \mathrm{k}\right)$, and then decrypts $M_3$ using $h\left(M_1\parallel {UX}_i\right)$ to obtain ${AID}_{\mathrm{i}}$ and ${SID}_j$. GWN then computes ${\mathrm{M}}_2^{\prime }=T_y\left(M_1\right)$ and $M_4^{\mathrm{*}}=h\left({UX}_i\parallel {\mathrm{M}}_2^{\prime }\parallel {AID}_{\mathrm{i}}\parallel {SID}_j\right)$, and compares $M_4^{\mathrm{*}}$ with $M_4$. If the comparison does not work, it is over. Honeynum is incremented by one. If Honeynum exceeds the threshold, the user is frozen and required to re-register. If the comparison holds, a random number $n_g$ is chosen by GWN, which then computes $K_{\mathrm{S}\mathrm{N}}=h\left({SID}_j\parallel \mathrm{k}\right)$, ${GS}_i=h\left({UX}_i{\parallel M}_1\right)$, $M_5=n_g\oplus h\left(K_{\mathrm{S}\mathrm{N}}\parallel M_1\right)$, $M_6={GS}_i\oplus h\left(n_g\parallel K_{\mathrm{S}\mathrm{N}}\parallel M_1\right)$ and $M_7=h\left(n_g\right||{SID}_j\parallel M_1\parallel {GS}_i)$. GWN sends the $\{M_1,M_5,M_6,M_7\}$ to ${\mathrm{S}\mathrm{N}}_j$.

(3) Upon receiving the message, ${\mathrm{S}\mathrm{N}}_j$ calculates ${\mathrm{n}}_g^{\prime }=M_5\oplus h\left(K_{\mathrm{S}\mathrm{N}}\parallel M_1\right)$, $G{S}_i^{\mathrm{*}}=M_5\oplus h\left({\mathrm{n}}_g^{\prime }\parallel K_{\mathrm{S}\mathrm{N}}\parallel M_1\right)$ and $M_7^{\mathrm{*}}=h\left({\mathrm{n}}_g^{\prime }\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_j\parallel M_1\parallel {GS}_i^{\mathrm{*}}\right)$. If $M_7^{\mathrm{*}}$ matches $M_7$, the process continues; otherwise, it is terminated. ${\mathrm{SN}}_j$ selects $n_j$ and computes $M_8=T_{n_j}\left(x\right)$, ${SNS}_j=h\left(K_{\mathrm{S}\mathrm{N}}\parallel M_8\right)$, ${USK}_{\mathrm{j}}=T_{n_j}\left(M_1\right)$ and ${\mathrm{S}\mathrm{K}}_j=h\left(M_1\parallel M_8\parallel {USK}_{\mathrm{j}}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_j\parallel {\mathrm{n}}_g^{\prime }\parallel \mathrm{G}{S}_i^{\mathrm{*}}\parallel \mathrm{S}\mathrm{N}{S}_j\right)$. The values $M_9=h({\mathrm{S}\mathrm{I}\mathrm{D}}_j\parallel {\mathrm{S}\mathrm{K}}_j\parallel M_8\parallel M_1\parallel {\mathrm{n}}_g^{\prime })$ and $M_{10}=h\left({\mathrm{S}\mathrm{I}\mathrm{D}}_j\parallel M_8\parallel M_9\parallel K_{SN}\parallel {\mathrm{n}}_g^{\prime }\right)$ are then computed and sent to GWN as $\{M_8,M_9,M_{10}\}$.

(4) GWN computes $M_{10}^{\mathrm{*}}=h\left({SID}_j\parallel M_8\parallel M_9\parallel K_{\mathrm{S}\mathrm{N}}\parallel n_g\right)$ and compares it with $M_{10}$. If they do not work, it is over; otherwise, it continues. GWN then calculates $SN{S}_j=h\left(K_{\mathrm{S}\mathrm{N}}\parallel M_8\right)$, ${UX}_i^{new}=h\left({AID}_{\mathrm{i}}\parallel k\right)$, $M_{11}={UX}_i^{new}\oplus h\left(M_1\parallel {UX}_i\right)$, $M_{12}=n_g\oplus h\left(h\left(M_1\parallel {UX}_i\right)\parallel {UX}_i^{new}\right)$, $M_{13}={UX}_i^{new}\oplus {SNS}_j$, and $M_{14}=h\left(M_8\parallel n_g\parallel {SID}_j\parallel {PID}_i\parallel M_9\parallel {SNS}_j\right)$. The database is updated by replacing ${\mathrm{PID}}_i$ with ${AID}_{\mathrm{i}}$, and the error counter is reset. The GWN then sends $\{M_8,M_9,M_{11},M_{12},M_{13},M_{14}\}$ to $U_i$.

(5) The user $U_i$ computes ${UX}_i^{new}=M_{11}\oplus h\left(M_1\parallel {UX}_i\right)$, $n_g^{\prime }=M_{12}\oplus h(h\left(M_1\parallel {UX}_i\right)\parallel {UX}_i^{new})$, ${{SNS}_j}^{\mathrm{\prime }}=M_{13}\oplus {UX}_i^{new}$ and $M_{14}^{\mathrm{*}}=h(M_8\parallel n_g^{\prime }\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_j\parallel {PID}_i\parallel M_9\parallel {SNS}_j^{\mathrm{\prime }})$. If $M_{14}$ matches $M_{14}^{\mathrm{*}}$, the following calculations are performed: $U{K}_{\mathrm{i}}=T_{m_i}\left(M_8\right)$, $S_i=h\left(U{X}_i\parallel M_1\right)$, ${\mathrm{S}\mathrm{K}}_i=h(M_1\parallel M_8\parallel U{K}_{\mathrm{i}}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_j\parallel n_g^{\prime }\parallel S_i\parallel {{SNS}_j}^{\mathrm{\prime }})$, and $M_9^{\mathrm{*}}=h\left({\mathrm{S}\mathrm{I}\mathrm{D}}_j\parallel {\mathrm{S}\mathrm{K}}_i\parallel M_8\parallel M_1\parallel n_g^{\prime }\right)$. If $M_9^{\mathrm{*}}$ matches $M_9$, $U_i$ proceeds to compute ${\mathrm{U}\mathrm{B}}_i^{new}={UX}_i^{new}\oplus h\left({\mathrm{U}\mathrm{P}\mathrm{W}}_i\parallel {AID}_{\mathrm{i}}\right)$) and ${UA}_i^{new}=h\left({AID}_{\mathrm{i}}\parallel {\mathrm{U}\mathrm{P}\mathrm{W}}_i\right)\hspace{0.25em}\mathrm{m}\mathrm{o}\mathrm{d}\hspace{0.25em}{n}_0$. The values ${\mathrm{U}\mathrm{B}}_i^{new}$, ${UA}_i^{new}$, $a_4$ replace ${UB}_i,{UA}_i,a_1$ in the smart card.

4.5. Change Password

The user inputs ${\mathrm{ID}}_i$ and ${PW}_i$. ${\mathrm{S}\mathrm{C}}_i$ computes ${{\mathrm{P}\mathrm{I}\mathrm{D}}_i}^{\mathrm{*}}=h\left({{\mathrm{I}\mathrm{D}}_i}^{\mathrm{*}}\parallel a_1\right)$, ${{\mathrm{U}\mathrm{P}\mathrm{W}}_i}^{\mathrm{*}}=h({{\mathrm{P}\mathrm{W}}_i}^{\mathrm{*}}\parallel a_3)$, and ${UA}_i^{\mathrm{*}}=h\left({\mathrm{P}\mathrm{I}\mathrm{D}}_i^{\mathrm{*}}\parallel {\mathrm{U}\mathrm{P}\mathrm{W}}_i^{\mathrm{*}}\right) \mathrm{m}\mathrm{o}\mathrm{d}{n}_0$. If $A_i^{\mathrm{*}}$ matches $A_i$, the process continues; otherwise, it terminates. The user then inputs a new password ${PW}_i^{new}$, selects a new random number $a_3^{new}$ and computes ${\mathrm{U}\mathrm{P}\mathrm{W}}_i^{new}=h\left({PW}_i^{new},a_3^{new}\right)$, ${UB}_i^{new}={UX}_i\oplus h({\mathrm{U}\mathrm{P}\mathrm{W}}_i^{new}\parallel {\mathrm{P}\mathrm{I}\mathrm{D}}_i^{\mathrm{*}})$ and ${UA}_i^{new}=h\left({\mathrm{P}\mathrm{I}\mathrm{D}}_i^{\mathrm{*}}\parallel {\mathrm{U}\mathrm{P}\mathrm{W}}_i^{new}\right) \mathrm{m}\mathrm{o}\mathrm{d} n_0$. The new values $U{A}_i^{new},{UB}_i^{new},a_3^{new}$ replace the old values $U{A}_i,{UB}_i,a_3$ in ${\mathrm{S}\mathrm{C}}_i$.

5. Security Analysis

5.1. Informal Security Analysis

(1)

Mutual Authentication:

The authentication must ensure that entities involved in communication can mutually verify each other’s identity. In this protocol, the entities involved are $U_i$, GWN and ${SN}_j$. During the mutual authentication process, GWN verifies the legitimacy of $U_i$ by checking whether $M_4^{\mathrm{*}}$ equals $M_4$. ${SN}_j$ directly authenticates GWN by checking whether the authentication message $M_7^{\mathrm{*}}$ equals $M_7$. $U_i$ directly authenticates GWN by checking whether $M_{14}^{\mathrm{*}}$ equals $M_{14}$ and indirectly authenticates ${SN}_j$ by verifying whether $M_9^{\mathrm{*}}$ equals $M_9$. This achieves mutual authentication among $U_i$, GWN and ${SN}_j$, fulfilling the security requirement for mutual authentication.

(2)

User Anonymity:

User anonymity requires that an attacker cannot determine the user’s identity ${ID}_i$ from interaction information or analyze multiple sessions to link them to a specific user. The interaction information generated during the negotiation between the user and ${SN}_j$ includes messages related to the user’s ${ID}_i$. Without ${UX}_i$, the attacker cannot derive ${AID}_{\mathrm{i}}$ from $M_3$ and thus cannot obtain ${ID}_i$ information from ${AID}_{\mathrm{i}}$. Due to the one-way function, the attacker cannot reverse-engineer ${PID}_i^{\mathrm{*}}$ to obtain ${ID}_i$. On the other hand, while the attacker may listen to the current ${PID}_i^{\mathrm{*}}$ used by the user in one session, without ${UX}_i$, they cannot derive the ${AID}_{\mathrm{i}}$ for the next session, thus preventing them from linking two ${PID}_i^{\mathrm{*}}$ values to the same user. Therefore, this protocol ensures user anonymity.

(3)

Forward Security:

This protocol designs the symmetric key generation process between the user and ${SN}_j$ based on the Diffie–Hellman (DH) problem. In this protocol, if the attacker obtains all long-term secrets, they can derive $M_1,M_8$, ${\mathrm{S}\mathrm{I}\mathrm{D}}_j$, ${\mathrm{n}}_g^{\prime }$, $\mathrm{G}{S}_i^{\mathrm{*}}$ and $\mathrm{S}\mathrm{N}{S}_j$ information. Due to the Diffie–Hellman problem, without the temporary secrets, the attacker cannot compute ${USK}_{\mathrm{j}}$. Due to the one-way hash function, ${\mathrm{S}\mathrm{K}}_j$ cannot be derived without knowing ${USK}_{\mathrm{j}}$. Therefore, this protocol provides forward security.

(4)

Offline Dictionary Attack:

After obtaining the smart card, the attacker may guess $\left({\mathrm{I}\mathrm{D}}^{\mathrm{*}},{\mathrm{P}\mathrm{W}}^{\mathrm{*}}\right)$ from the user identity space $D_{\mathrm{I}\mathrm{D}}$ and the user password space $D_{\mathrm{P}\mathrm{W}}$, then compute ${PID}_i^{\mathrm{*}}=h\left({\mathrm{I}\mathrm{D}}_i‖a_1\right)$,${UPW}_i^{\mathrm{*}}=h({PW}_i\parallel a_3)$ and $A_i^{\mathrm{*}}=h({PID}_i^{\mathrm{*}}\parallel {UPW}_i^{\mathrm{*}}) {\mathrm{m}\mathrm{o}\mathrm{d} n}_0$. The attacker can then compare $A_i^{\mathrm{*}}$ with $A_i$ to determine whether the guessed ${\mathrm{I}\mathrm{D}}^{\mathrm{*}}$ and ${\mathrm{P}\mathrm{W}}^{\mathrm{*}}$ are correct. According to [35], there are approximately ${\displaystyle \frac{\left|D_{\mathrm{I}\mathrm{D}}\right|\mathrm{*}\left|D_{\mathrm{P}\mathrm{W}}\right|}{n_0}}\approx 2^{32}$ pairs that satisfy this equation. The attacker can only verify the guessed (${\mathrm{I}\mathrm{D}}^{\mathrm{*}}$, ${\mathrm{P}\mathrm{W}}^{\mathrm{*}}$) by interacting online with GWN, but since the Honeynum for user verification cannot exceed the threshold, the probability of correctly guessing the user’s identity and password in a limited number of online attempts is negligible. Therefore, this protocol can resist offline dictionary attacks.

(5)

Insider Attack:

If the attacker obtains the user’s (${PID}_i,{\mathrm{U}\mathrm{P}\mathrm{W}}_i^{\mathrm{\prime }})$ during registration and also gains access to the user’s smart card, they can only guess the user’s password via ${\mathrm{UPW}}_i$. After guessing ${PW}_i^{*}$ in the password space $D_{\mathrm{P}\mathrm{W}}$, the attacker calculates ${\mathrm{UPW}}_i^{\mathrm{\prime }}=h({PW}_i^{*}\parallel a_1)$ to verify if the guess is correct. Since the smart card replaces $a_2$ with $a_3$ after registration, the attacker cannot obtain $a_2$ from the smart card or guess the user’s password via ${UPW}_i^{\mathrm{\prime }}$. Therefore, this protocol can resist insider attacks.

(6)

Impersonation Attack:

In this attack, the attacker impersonates a legitimate user to access sensor nodes, attempting to compromise the key or other useful information negotiated between other users and the sensor node. The effectiveness of this attack depends on whether the attacker can obtain the secret information authenticated by GWN through negotiation. In this protocol, an attacker impersonates a legitimate user to obtain the messages available and eavesdrops on the channel to compute $M_2$ and ${UX}_{\mathrm{i}}$. However, due to the one-way hash function and the CMCDHP problem, the attacker cannot further compute these secret values. Therefore, this protocol can resist impersonation attacks.

(7)

Man-in-the-Middle Attack:

During the authentication phase, the user sends the message $\{{PID}_i,M_1,M_3,M_4\}$ to the GWN via an open channel. Although attackers can intercept messages transmitted through the open channel, in this protocol, they cannot pass GWN’s verification because they cannot access GWN’s private key k.

(8)

Replay Attack:

During message transmission, attackers send tampered information. After receiving the message, the authentication entity first verifies the timestamp. If the timestamp verification fails, the request session will be lost directly, as is the case if the attacker has made synchronous modifications to the timestamp. So, the authentication entity continues to verify the authentication information. Due to the inclusion of timestamps in the calculation process of these authentication information, attackers are unable to verify using this calculation. Therefore, this protocol can prevent replay attacks.

(9)

Denial of Service Attack:

During the authentication process, the protocol incorporates a timestamp verification step. Once an illegal large-scale request message is received, the session is usually discarded during the first verification step. Therefore, this protocol can resist this attack.

(10)

Known Key Security:

In this scheme, $U_i$ and ${SN}_j$ independently compute the session key ${\mathrm{S}\mathrm{K}}_j=h\left(M_1\parallel M_8\parallel {USK}_{\mathrm{j}}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_j\parallel {\mathrm{n}}_g^{\prime }\parallel \mathrm{G}{S}_i^{\mathrm{*}}\parallel \mathrm{S}\mathrm{N}{S}_j\right)$. Even if an attacker successfully compromises a previously negotiated session key, they cannot obtain any secret parameters to compute a new session key. This is because a one-way hash function is used throughout the authentication process to protect the key parameters. Therefore, this protocol ensures known key security.

(11)

Stolen Smart Card Attack:

The smart card of a legitimate user $U_i$ may be stolen by an attacker. Even if the attacker extracts the secret information from ${\mathrm{S}\mathrm{C}}_i$, they still cannot log in to the network. The attacker would also need to know $U_i$’s identity ${ID}_i$ and password ${\mathrm{P}\mathrm{W}}_i$ to generate the login message $A_i^{\mathrm{*}}=h({PID}_i^{\mathrm{*}}\parallel {UPW}_i^{\mathrm{*}}) {\mathrm{m}\mathrm{o}\mathrm{d} n}_0$. Therefore, a stolen smart card attack is not possible in this protocol.

5.2. Security Proof

The detailed proof is as follows:

Theorem 1.

Assume that $\mathcal{A}$ is an adversary operating against P within polynomial time t under the given model. Let $D_{pw}$ be a uniformly distributed password dictionary. Assuming no sensor nodes are compromised by the adversary, the definition given in Equation (3) is obtained:

$$Ad{v}_p^{ake}\left(A\right)\le {\displaystyle \frac{q_h^2}{\left|Hash\right|}}+{\displaystyle \frac{2q_{send}}{\left|D_{pw}\right|}}+2Ad{v}_p^{CMDHP}$$

(3)

Among them, $q_h$, $q_{send}$, |Hash| and |$D_{pw}$| respectively represent the number of hash queries, the number of send queries, the range space of hash and the size of $D_{pw}$. $Ad{v}_p^{CMDHP}$ represents the advantage of attacker $\mathcal{A}$ in solving CMDHP in polynomial time.

Proof. 

Throughout the proof, assume that all games occur as ${\mathrm{G}}_{\mathrm{i}}$, where i = [0, 4]. Let ${Succ}_i$ denote the event where the adversary $\mathcal{A}$ successfully guesses b in game $G_i$. □

Game ${\mathit{G}}_0$: In this game, the adversary $\mathcal{A}$ conducts an actual attack against PPP within the random oracle model. At the beginning of the experiment, b is randomly chosen. By definition, we obtain Equation (4):

$${Adv}_p^{ake}\left(U_A\right)=2Pr\left[Suc{c}_0\right]-1$$

(4)

Game $G_1$: This game simulates an eavesdropping attack where $\mathcal{A}$ initiates an Execute query and performs a test query to determine whether the result is a real session key or a random number at the end of the game. It should be noted that ${\mathrm{S}\mathrm{K}}_i$ can be computed as: ${\mathrm{S}\mathrm{K}}_i=h(M_1\parallel M_8\parallel U{K}_{\mathrm{i}}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_j\parallel n_g^{\prime }\parallel S_i\parallel {{SNS}_j}^{\mathrm{\prime }})$, where $n_g^{\prime }=M_{12}\oplus h(h\left(M_1\parallel {UX}_i\right)\parallel {UX}_i^{new})$, ${{SNS}_j}^{\mathrm{\prime }}=M_{13}\oplus {UX}_i^{new}$, $U{K}_{\mathrm{i}}=m_i{M}_8$ and $S_i=h\left(U{X}_i\parallel M_1\right)$.

Since ${\mathrm{S}\mathrm{K}}_i$ contains the short-term random keys $m_i$ and $n_j$, without these keys, the probability of $\mathcal{A}$ winning game $G_0$ by computing ${\mathrm{S}\mathrm{K}}_i$ is not altered by the eavesdropped messages $\{{PID}_i,M_1,M_3,M_4\}$,$\{M_1,M_5,M_6,M_7\}$, $\{M_8,M_9,M_{10}\}$ and $\{M_8,M_9,M_{11},M_{12},M_{13},M_{14}\}$. Therefore,

$$Pr\left[\begin{array}{c}Suc{c}_0\end{array}\right]=Pr\left[\begin{array}{c}Suc{c}_1\end{array}\right]$$

(5)

Game $G_2$: This game is derived from $G_1$ by adding send and hash queries. In this game, $\mathcal{A}$ attempts to deceive participants into accepting incorrect messages. In this scenario, $\mathcal{A}$ can repeatedly perform hash queries to check for collisions in the hash digests. All communication messages $\{{PID}_i,M_1,M_3,M_4\}$, $\{M_1,M_5,M_6,M_7\}$, $\{M_8,M_9,M_{10}\}$, and $\{M_8,M_9,M_{11},M_{12},M_{13},M_{14}\}$ contain identity information, random numbers, timestamps, and keys. Therefore, when $\mathcal{A}$ executes a send query, no collisions occur.

$$Pr\left[\begin{array}{c}Suc{c}_1\end{array}\right]-Pr\left[\begin{array}{c}Suc{c}_2\end{array}\right]=q_h^2/\left(2\left|hash\right|\right)$$

(6)

Game $G_3$: This game is derived from $G_2$ by performing the $CorruptSC$ query. In this game, $\mathcal{A}$ obtains the credentials stored in $S{C}_i$, including ${\{a}_1,a_3,\mathrm{U}{B}_i$ $U{A}_i$}. $\mathcal{A}$ attempts a dictionary attack to guess the correct $I{D}_i$ and $P{W}_i$ from these credentials. Assuming the system limits the number of incorrect password attempts, the result is as follows:

$$Pr\left[\begin{array}{c}Suc{c}_1\end{array}\right]-Pr\left[\begin{array}{c}Suc{c}_2\end{array}\right]=q_{send}/\left|D_{pw}\right|$$

(7)

Game $G_4$: In this game, the adversary guesses the value of the session key SK. SK is generated through hash values based on chaotic mapping parameters, specifically ${USK}_{\mathrm{j}}=T_{n_j}\left(M_1\right)$ and $U{K}_{\mathrm{i}}=T_{m_i}\left(M_8\right)$. Due to the difficulty of the CMDHP, the adversary cannot compute the session key ${\mathrm{S}\mathrm{K}}_i=h(M_1\parallel M_8\parallel U{K}_{\mathrm{i}}\parallel {\mathrm{S}\mathrm{I}\mathrm{D}}_j\parallel n_g^{\prime }\parallel S_i\parallel {{SNS}_j}^{\mathrm{\prime }})$, with a negligible probability within polynomial time. Then:

$$Pr\left[Suc{c}_4\right]-Pr\left[Suc{c}_3\right]\le Ad{v}_p^{CMDHP}$$

(8)

In the above scenarios, all oracles have been simulated. If the adversary $\mathcal{A}$ has attempted all possible methods to compromise the security of P without success, the final resource after the querying test is to guess b. Therefore, $\mathrm{P}\mathrm{r}\left[\mathrm{S}\mathrm{u}\mathrm{c}{\mathrm{c}}_4\right]$ equals the probability of guessing b; i.e., $\mathrm{P}\mathrm{r}\left[\mathrm{S}\mathrm{u}\mathrm{c}{\mathrm{c}}_4\right]={\displaystyle \frac{1}{2}}$.

In all cases, we have $Pr\left[Suc{c}_0\right]=Pr\left[Suc{c}_1\right]$, $|Pr\left[Suc{c}_2\right]-Pr\left[Suc{c}_1\right]|\le {\mathrm{q}}_{\mathrm{h}}^2/2\left|\mathrm{H}\mathrm{a}\mathrm{s}\mathrm{h}\right|,\left|\mathrm{P}\mathrm{r}\hspace{0.25em}\left[\mathrm{S}\mathrm{u}\mathrm{c}{\mathrm{c}}_3\right]-\mathrm{P}\mathrm{r}\left[\mathrm{S}\mathrm{u}\mathrm{c}{\mathrm{c}}_2\right]\right|\le {\mathrm{q}}_{\mathrm{s}\mathrm{e}\mathrm{n}\mathrm{d}}\hspace{0.25em}/\left|D_{pw}\right|$, $Pr\left[Suc{c}_4\right]-Pr\left[Suc{c}_3\right]\le Ad{v}_p^{CMCDHP}$ and $\mathrm{P}\mathrm{r}\left[\mathrm{S}\mathrm{u}\mathrm{c}{\mathrm{c}}_4\right]=1/2$.Thus, we obtain:

$$\mathrm{A}\mathrm{d}{\mathrm{v}}_{\mathrm{p}}^{\mathrm{a}\mathrm{k}\mathrm{e}}\left(\mathrm{A}\right)\le {\displaystyle \frac{{\mathrm{q}}_{\mathrm{h}}^2}{\left|\mathrm{H}\mathrm{a}\mathrm{s}\mathrm{h}\right|}}+{\displaystyle \frac{2{\mathrm{q}}_{\mathrm{s}\mathrm{e}\mathrm{n}\mathrm{d}}}{\left|D_{pw}\right|}}+2Ad{v}_p^{CMDHP}$$

(9)

5.3. AVISPA Verification

AVISPA is an automated validation tool for security protocols with comprehensive performance, which can be used to establish protocol models and analyze protocol security. AVISPA uses High-Level Protocol Specification Language (HLPSL) to describe the protocol, and then translates it into IF (Intermediate Format) language through a translator. Afterwards, different testing techniques can be called on the backend to analyze the protocol.

This article uses AVISPA to formally analyze the proposed protocol. Firstly, HLPSL should be used to describe the basic roles and construct character sessions and environments. The detection results in Figure 3 show that this protocol can effectively resist various known attacks.

Figure 3. AVISPA result.

5.4. Scyther Verification

Scyther is a powerful formal verification tool that allows for the customization of security models, features a user-friendly interface and provides clear visual outputs for attacker scenarios [38]. It is widely used for large-scale protocol analysis, vulnerability detection and security verification. Compared to traditional BAN logic analysis, Scyther offers more robust verification capabilities, enabling the validation of security properties. Additionally, Scyther can provide targeted formal descriptions of specific properties, such as authentication, confidentiality and replay resistance. For security properties of interest to the user, target properties can be declared using the claim feature, allowing for the formal description of entity authentication and variable confidentiality.

In this paper, the Scyther tool is used to analyze the security of the WSN authentication protocol. In the simulation, the roles U, GWN and SN are used to represent the user, gateway and sensor node, respectively. The security properties Alive, Weakagree, Niagree and Nisynch are declared to detect potential replay attacks, man-in-the-middle attacks and others. The simulation results show that the proposed authentication protocol achieves the following security properties, including mutual authentication and message confidentiality and resists common protocol attacks such as replay and man-in-the-middle attacks. The simulation results, as shown in Figure 4, indicate that all states are verified, demonstrating that the protocol successfully meets all the security properties declared in Scyther without detecting any attack.

Figure 4. Simulation result.

6. Performance Evaluation

6.1. Analysis of Computation Overhead

To better describe the involved authentication protocols, a brief explanation of some symbols is provided before evaluating the computation overhead of the related works. $T_H$ represents a one-way hash function operation. $T_{ED}$ denotes an encryption or decryption operation. $T_{ECC}$ represents the time required to perform an ECC operation. $T_F$ denotes the time required for fuzzy extraction. $T_C$ represents a Chebyshev chaotic map operation.

As for the XOR operation used in authentication, the time consumed for a single XOR operation is negligible compared to the operations mentioned above and does not affect the final comparison results. Therefore, the time consumed by the XOR operation is disregarded.

The cryptographic operations were simulated on a network using hardware with 8GB of memory, an Intel Core i7 processor and an Ubuntu 16 system. The execution times of the various cryptographic operations were obtained through this experiment. The results show that $T_H\approx 0.0006, T_{ED}\approx 0.0028, T_{ECC}\approx 0.1872, T_F\approx T_{ECC} \mathrm{a}\mathrm{n}\mathrm{d} T_C\approx 0.0617$. Table 3 presents a comparison of the computation overhead.

Table 3. Computation Overhead.

Scheme	User (U)	GWN	Sensor Node (SN)	Total
[39]	$2T_{ECC}+12T_H+1T_F$	$1T_{ED}+10T_H$	$2T_{ECC}+5T_H+1T_{ED}$	$4T_{ECC}+27T_H+2T_{ED}+1T_F$
[40]	$2T_{ECC}+10T_H+1T_F$	$1T_{ECC}+4T_H$	$5T_H$	$3T_{ECC}+1T_F+19T_H$
[41]	$11T_H$	$17T_H$	$6T_H$	$34T_H$
[42]	$2T_{ECC}+8T_H$	$1T_{ECC}+4T_H$	$4T_H$	$3T_{ECC}+16T_H$
[43]	$1T_{ED}+8T_H$	$2T_{ED}+3T_H$	$1T_{ED}+4T_H$	$4T_{ED}+15T_H$
Ours	$3T_{CM}+1T_{ED}+14T_H$	$1T_{CM}+1T_{ED}+13T_H$	$2T_{CM}+7T_H$	$6T_{CM}+2T_{ED}+34T_H$

As shown in Table 3, the computation overhead at each node in [39] is $2T_{ECC}+12T_H+1T_F$, $1T_{ED}+10T_H$ and $2T_{ECC}+5T_H+1T_{ED}$, respectively. The total time consumed is $4T_{ECC}+27T_H+2T_{ED}+1T_F$. In [40], the computation overhead at each node is $2T_{ECC}+10T_H+1T_F$, $1T_{ECC}+4T_H$ and $5T_H$, respectively. The total time consumed is $3T_{ECC}+1T_F+19T_H$. In [41], the computation overhead at each node is $11T_H$, $17T_H$ and $6T_H$, respectively. The total time consumed is $34T_H$. In [42], the computation overhead at each node is $2T_{ECC}+8T_H$, $1T_{ECC}+4T_H$ and $4T_H$, respectively. The total time consumed is $3T_{ECC}+16T_H$. In [43], the computation overhead at each node is $1T_{ED}+8T_H$, $2T_{ED}+3T_H$ and $1T_{ED}+4T_H$, respectively. The total time consumed is $4T_{ED}+15T_H$. For the proposed protocol, the computation overhead at each node is $3T_{CM}+1T_{ED}+14T_H$, $1T_{CM}+1T_{ED}+13T_H$ and $2T_{CM}+7T_H$, respectively. The total time consumed during the entire authentication negotiation process is $6T_{CM}+2T_{ED}+34T_H$.

Analysis shows that this protocol is higher than that of [41,43]. However, security analysis reveals that [41] does not satisfy user anonymity and replay attack resistance, and [43] fails to meet impersonation and man-in-the-middle attack resistance. This protocol meets these security requirements. Therefore, in Figure 5, Figure 6, Figure 7 and Figure 8, compared with [39,40,42], this protocol has advantages in computation overhead and is better suited for deployment and application in wireless sensor network.

Figure 5. U comparison [39,40,41,42,43].

Figure 6. GWN comparison [39,40,41,42,43].

Figure 7. SN comparison [39,40,41,42,43].

Figure 8. Num of U comparison [39,40,41,42,43].

6.2. Analysis of Communication Overhead

In the authentication, the communication overhead is determined by the bandwidth of the information transmitted over the channel. We assumed that the hash function is 160 bits, timestamps and temporary values are 32 bits, random numbers are 128 bits, user and sensor node identifiers are 128 bits and 16 bits, respectively, ECC requires 320 bits, symmetric encryption/decryption requires 160 bits and the Chebyshev chaotic map requires 160 bits.

The communication overhead in related works was calculated, resulting in the comparison presented in Table 4. As shown in Table 4, the proposed protocol is 1504 bits, while the related works are 3072 bits, 1428 bits, 2256 bits, 1440 bits and 864 bits, respectively. A comparison reveals that the communication overhead of the proposed protocol is higher than those of references [40,41,42,43]. However, in terms of security, the references have several security flaws, such as vulnerabilities to user anonymity and impersonation attacks, whereas the authentication system designed based on this protocol can resist all common security threats.

Table 4. Communication Overhead.

Scheme	Communication Overhead
[39]	3072
[40]	1428
[41]	2256
[42]	1440
[43]	864
Ours	2720

Therefore, from the perspective of overall performance and efficiency in authentication technology, it is entirely reasonable to sacrifice some communication overhead to achieve higher security in the design of user authentication schemes in Figure 9.

Figure 9. Communication overhead [39,40,41,42,43].

7. Conclusions

This paper systematically investigates the security issues of WSN, with a focus on their resource constraints and insecure communication characteristics. A provably secure and lightweight two-factor authentication protocol is proposed. By employing a Chebyshev chaotic map and a two-factor authentication mechanism, the protocol effectively addresses the balance between security and authentication efficiency in WSNs. Through rigorous security validation and performance evaluation, this paper demonstrates that the proposed protocol ensures data reliability and integrity while significantly reducing computational and communication overhead. It provides reliable security assurance for the application of WSN in various fields such as military, healthcare and agriculture. Future work will focus on further optimizing protocol design and we will introduce blockchain technology to enhance data security, so as to promote the continuous progress and development of WSN technology.