Frontiers in Computing and Intelligent Systems ISSN: 2832-6024 | Vol. 4, No. 2, 2023 81 Analysis and Improvement on a Three‐Factor Authentication Scheme in IoT Environment Anqian Li 1, *, Baoyuan Kang 1, Yuyan Huo 1, Xinyu Zuo 1, Shufang Niu 2 1 School of Software, Tiangong University, Tianjin 300387, China 2 School of Computer Science and Technology, Tiangong University, Tianjin 300387, China * Corresponding author: Anqian Li (Email: lianqian98@163.com) Abstract: With the development of IoT technology, more and more devices are connected to the Internet, which brings great convenience to people, but also security risks. As a result, IoT authentication scheme has become a research hotspot. In 2020, Lee et al. proposed a three-factor anonymous authentication scheme in IoT environment and claimed that their scheme can resist many known attacks. However, we find that their scheme not only has some drawbacks, but also has difficulty in resisting man- in-the-middle attack and impersonation attack. To overcome these drawbacks, we propose an improved scheme. Through security analysis and computational cost comparison, it is shown that the improved scheme is not only resistant to existing known attacks, but also has a smaller overhead in terms of computational cost and is suitable for resource-constrained IoT environment. Keywords: Internet of Things (IoT); Authentication; Key Agreement. 1. Introduction With the rapid development of sensing and communication technologies, the Internet of Things (IoT) connects real-world objects to the Internet. IoT is a collection of physical devices such as embedded sensors and actuators with computing power that can communicate between devices and systems0. IoT enables seamless communication and automatic management between heterogeneous devices, and can bring significant benefits to social production and human life through a fully intelligent and automated remote management system[2]. However, from a security perspective, the vast majority of IoT devices are exposed to an almost uncontrollable environment. At the same time, the proliferation of smart devices places their connection to the Internet at potential risk, such as unauthorized node tampering or impersonation attack[3]. To ensure the security of the IoT, people have been exploring authentication schemes and carrying out related research. Authentication is not only a key requirement for the development and progress of IoT, but also the "first line of defense" for security protection. Inadequate authentication or the existence of security vulnerabilities will lead to a security crisis for the entire IoT. In recent years, scholars have done a lot of research on authentication schemes in IoT, but many existing schemes have security concerns[4]. In 2014, Chen et al.[4] proposed a smart-card-based password authentication and key negotiation scheme in order to solve the problem of remote user access. They claimed that their scheme is resistant to off- line password guessing attack even if an attacker extracts the information stored in smart card. In 2015, Jiang et al.[5] pointed out that the scheme of Chen et al.[4] is insecure and proposed an improved authentication scheme. In 2016, Das[6] found that Jiang et al.’s scheme[5] was not only vulnerable to internal privilege attack, but also failed to provide correct authentication during the login and authentication phase. Therefore, Das[6] presented a three-factor authentication scheme, especially the use of biometric-based password and smart card, which greatly enhanced the security of the scheme. In 2017, Dhillion et al.[7] proposed a lightweight multi-factor remote user authentication scheme in IoT environment and claimed that their scheme can resist a variety of known attacks such as man-in-the-middle attack, replay attack and so on. In 2018, Kumari et al.[8] presented an ECC-based authentication scheme for IoT and cloud servers. They claimed that their scheme is resistant to known attacks such as impersonation attack, offline password guessing attack, and meets various security objectives. In 2019, Gope et al.[9] proposed a lightweight and privacy-preserving two-factor authentication scheme. The scheme allows IoT devices to communicate anonymously with the server and effectively improves the security of the scheme by exploiting the inherent security properties of physical unclonable functions (PUF). Moreover, they claimed that their scheme is efficient and suitable for resource-constrained IoT devices. In 2020, Lee et al.[10] pointed out that Dhillion et al.'s scheme[7] fails to resist stolen mobile device attack, user impersonation attack, and has no provision for revocation. As a result, they proposed an improved three-factor user authentication scheme to address these security issues. However, we find that there are some security vulnerabilities in Lee et al.'s scheme[10]. On the one hand, Lee et al.'s scheme[10] has some drawbacks in the registration of user, registration of IoT node as well as login and authentication phase. On the other hand, Lee et al.'s scheme[10] cannot resist man-in-the-middle (MITM) attack and user impersonation attack. Section II briefly reviews Lee et al.'s authentication scheme. The analysis of the shortcomings of the Lee et al.'s scheme is in Section III. In Section IV, we propose an improved scheme. The security of the improved scheme is analyzed in Section V. Section VI compares the improved scheme with similar schemes. Section VII concludes the paper. 2. Review of Lee et al.’s Scheme This section briefly reviews Lee et al.’s scheme[10], which mainly consists of the following five phases: (1) registration of user; (2) registration of IoT node; (3) login and authentication phase; (4) password change phase; (5) revocation phase. Since the shortcomings of the scheme of 82 Lee et al.[10] are mainly focused on the first three phases, for the sake of brevity, this section reviews only the registration of user, the registration of IoT node, and the login and authentication phase. Table 1 denotes the notations and descriptions in Lee et al.’s scheme[10]. Table 1. Notations and descriptions used in Lee et al.’s scheme Notations Definition MNi,Nj,GW The ith mobile user, gateway and the jth sensor node IDi, PWi, BIOi Identity, password, biometrics of MNi IDj Identity of Nj PIDi, NIDj Pseudo-identity of MNi, Nj KG Private key only known to GW Ek(·)/Dk(·) Symmetric encryption/decryption algorithm with key nx,rx Random numbers SK, SKij (= SKji) Session key agreed between MNi and Nj Gen(·)/Rep(·) Fuzzy biometric generator/reproduction Tx Timestamps ∆T Maximum transmission delay ⊕ Exclusive-OR operator || Concatenation operator h(·) Hush function H(·) Bio-Hash function 2.1. Registration of User In this phase, a user registers at the gateway by performing the following steps. 1) MNi selects its own identity IDi, password PWi and enters the biometric BIOi. MNi’s mobile device calculates ( || ( ))i i iPWB h PW H BIO , ( || ( ))i i iMID h ID H BIO , and sends a registration message { , , }i i iID PWB MID to GW over a secure channel. 2) GW chooses two random numbers ,D GUr r , and computes ( ) Gi K iRID E ID , ( || ) Gi K i DPID E ID r , , ( || || ) ( || )i i i GU GU iy h ID PWB r h K ID  , where GUK is the secret value chosen by GW for MNi. GW stores { , }i iRID MID in its own database and sends to MNi. 3) MNi stores { , , , }i i i GUPID x y r in its own mobile device. 2.2. Registration of IoT Node The registration process of IoT node is as follows. 1) Nj chooses IDj, jr ,and computes ( || || )j GN j jMP h K r ID , ( || )j j j GNMI r h ID K  , where GUK is the shared key between GW and Nj. Nj sends registration information { , , }j j jID MP MI to GW over the public channel. 2) After receiving the registration information, GW discloses Nj’s identity jID and computes * ( || )j j j GNr MI h ID K  , * *( || || )j GN j jMP h K r ID . GW checks whether * j jMP MP holds or not. If it fails, the current phase is terminated immediately; otherwise, GW computes ( || )j j GNx h ID K , * j j jy x MP  , and sends { }iy to Nj. 3) Nj receives the message from GW and stores { }iy in its own memory. 2.3. Login and Authentication Phase In this stage, MNi and Nj agree on a session key with the help of GW. The specific steps are as follows. 1) MNi enters IDi, PWi and BIOi. MNi's mobile device calculates ( || ( ))i i iPWB h PW H BIO , * ( || )i i ix h ID PWB , and checks the equation * i ix x . If the equation is invalid, the current phase will be terminated immediately. Otherwise, mobile device generates in , 1T , and computes ( || || )i i i i GUA y h ID PWB r  , ( || || )i i i iUN h A PID n , i i iUZ n A  . Then, MNi sends a message 1 1{ , , , }i i iM PID UN UZ T to Nj. 2) Nj verifies whether 1| |freshT T T   is correct or not, and if not, it will immediately terminate the current phase. Otherwise, Nj generates a random number jn and calculates ( || || )j j GN j jx y h K r ID  , ( )j j jA h x n  , ( || )j j jB h x n . Nj sends 2 1{ , , , }j j jM M ID A B to GW. 3) GW firstly checks the correction of 1| |freshT T T   . If not, GW will reject Nj’s request. Otherwise, GW computes * ( || )j j GNx h ID K , * *( )j j jn h x A  , * * *( || )j j jB h x n . Then, GW verifies whether * j jB B is true or not. If fails, the current session will be terminated. Otherwise, GW ( || )i i ix h ID PWB { , , , }i i i GUPID x y r 83 decrypts PIDi using its private key KG to obtain a pair of values , ( ) Gi D K iID r D PID  , and computes * ( || )i GU iA h K ID , * * i i in UZ A  , * * *( || || )i i i iUN h A PID n , GW checks whether * i iUN UN holds or not. If it’s not equal, GW will reject MNi’s request. Otherwise, GW generates new Dr , and calculates *( || )j i iF h ID n , * j j jG F x  , * * ij j iR n n  , * * *( || || || )j j j i jH h x n n F , ( , ) G new new i K i DPID E ID r . GW sends 3 { , , , }new i j ij jM PID G R H to Nj. 4) Nj computes * j j jF G x  , * i ij jn R n  , * * *( || || || )j j j i jH h x n n F , and verifies whether * j jH H is correct or not. If fails, Nj terminates the current session immediately. Otherwise, Nj selects jm , 2T , and computes *( || )j j j iL m h ID n  , * *( || || )ji j i jSK h F n m , 1 2( || || )j jiSV h SK T T . Then, Nj sends 4 2{ , , , }new i j jM PID L SV T to MNi. 5) MNi checks whether 2| |freshT T T   . If it’s not equal, MNi will terminate current phase. Otherwise, MNi computes * ( || )j j j im L h ID n  , *( ( || ) || || )ij i i i jSK h h ID n n m , i 1 2( || || )ijSV h SK T T . MNi verifies whether i jSV SV holds or not. If it holds, then MNi and Nj have successfully agreed on the same session key. 3. Analysis of Lee et al.’s Scheme This section provides a security analysis of Lee et al.’s[10] scheme and identifies the following drawbacks of their scheme. 3.1. Drawbacks Lee et al.'s scheme [10] has some drawbacks in the registration of user, registration of IoT node and login and authentication phase. 3.1.1. Drawbacks of the User Registration Phase 1) In the user registration phase of the Lee et al.’s scheme [10], GW selects a secret value GUK for MNi. However, GW does not store GUK in its own database, which will result in GW not being able to retrieve GUK during the login and authentication phase, and thus not being able to authenticate MNi by equation (1). * * * * * * * ( || ) ( || || ) Checks i GU i i i i i i i i i i A h K ID n UZ A UN h A PID n UN UN      (1) 2) GW calculates ,i iRID PID after receiving the registration information { , , }i i iID PWB MID sent by MNi. ( ) Gi K iRID E ID , ( || ) Gi K i DPID E ID r , GW stores { , }i iRID MID in its own database. During the login and authentication phase, the identity information transmitted by MNi in the public channel is the pseudo- identity iPID . GW computes , ( ) Gi D K iID r D PID  and authenticates the MNi by equation (1), without using the stored values . Therefore, the second drawback is that the user information stored by GW in the registration phase is not fully utilized. On the one hand, storing { , }i iRID MID takes up the GW’s storage space. If too much user information is stored or stored for too long, it will put pressure on the storage resources of GW. On the other hand, there is a risk of information leakage. For example, attackers can obtain user information by attacking GW, which can lead to security problems. 3.1.2. Drawbacks of the IoT Node Registration Phase In the registration phase of the IoT node, GW calculates a secret value for Nj ( || )j j GNx h ID K . During the login and authentication phase, GW checks whether Nj is a registered IoT node according to equation (2), where jx is the key value to authenticate Nj. However, since GNK is a shared key between GW and Nj, and Nj knows its own identity IDj, then Nj can directly calculate jx , which means that Nj can register itself without registering with GW for the subsequent login and authentication phase. * * * * ( || ) Checks j j j j j B h x n B B   (2) 3.1.3. Drawbacks of the Login and Authentication Phase There are numerous nodes in IoT and each IoT node has a unique identity to identify itself and authenticate with other entities. During the login and authentication phase of Lee et al.’s scheme [10], as shown in equation (3), each value contained in the message 1 1{ , , , }i i iM PID UN UZ T sent by MNi to Nj does not incorporate Nj's identity IDj, i.e., MNi does not indicate which IoT node it wants to contact. { , }i iRID MID 84 ( || ) ( || || ) Gi K i D i i i i i i i PID E ID r UN h A PID n UZ n A     (3) 3.2. Man-in-the-Middle (MITM) Attack After Nj has contacted MNi once, Nj obtains MNi's updated pseudo-identity PIDi new. Then, Nj can track MNi when MNi contact another IoT node Ns with PIDi new. Assuming that Nj knows the identity IDi of MNi, and since Nj has obtained { , }i in UZ while contacting with MNi. In that case, Nj can launch the MITM attack based on the information *{ , }i sUZ L intercepted from this contact between MNi and Ns. The specific steps of the attack are as follows. 1) In the login and authentication phase where MNi and Nj are interconnected, Nj receives the message 1 1{ , , , }i i iM PID UN UZ T sent by MNi and obtains iUZ . Nj computes in by i ij jn R n  according to the message 3 { , , , }new i j ij jM PID G R H sent by GW. 2) The random number generated by MNi during the current round of contact with Ns is noted as ** in , then * ** i i iUZ n A  . Nj intercepts the message * * 1 1{ , , , }i i iM PID UN UZ T sent by MNi to GW, and thus obtains * iUZ . Nj can get ** i in n by dissimilarizing * iUZ with the iUZ obtained by Nj in the previous round of contact with MNi. 3) Since Nj obtained in in the last contact between Nj and MNi, Nj can calculate ** in based on ** i in n and in , then Nj can compute **( || )s i iF h ID n for the current contact between MNi and Ns. 4) At this time when MNi contacts Ns, Nj intercepts the message 4 2{ , , , }new i s sM PID L SV T sent by Ns to MNi, thus obtaining sL . Due to **( || )s s s iL m h ID n  , and the identity IDs of Ns are public, Nj can calculate sm . 5) In summary, Nj can calculate the session key **( || || )is si s i sSK SK h F n m  reached between MNi and Ns in the current round of MNi- Ns contact. 3.3. Impersonation Attack According to Section 3.2, Nj records the obtained values { , , }new i i in UZ PID when contacting MNi. Therefore, Nj can then act as an attacker to impersonate MNi to Nk when MNi wants to contact another IoT node Nk, 1) Since Nj knows MNi's updated pseudo-identity PIDi new, Nj can track MNi based on PIDi new in ' ' 1 1{ , , , }new i i iM PID UN UZ T and tamper with 1M when MNi contacts Nk using PIDi new. Nj chooses a random number ' in . when MNi contacts Nk using PIDi new. Then, Nj can calculate iA by i i iA UZ n  based one { , }i in UZ obtained in the previous round of contacting MNi. From ( || )i G iA h K ID , iA is constant in each contact, so Nj can continue to use iA for the following calculations in the current round when MNi contacts Nk ' '( || || )new i i i iUN h A PID n , ' ' i i iUZ n A  . Nj sends ' ' ' 1 1{ , , , }new i i iM PID UN UZ T to Nk. 2) Nk firstly checks the validity of timestamp T1 based on the receipt of message ' 1M . If T1 is invalid, Nk terminates the current phase. Otherwise, Nk generates a random number kn , calculates ( || || )k k GN k kx y h K r ID  , ( )k k kA h x n  , k ( || )k kB h x n , and send ' ' 2 1{ , , , }k k kM M NID A B to GW. 3) When GW receives ' 2M , it first checks if 1| |freshT T T   is valid. GW will terminate the current phase, if it fails. Otherwise, GW calculates * ( || )k k GNx h ID K , * ( )k k kn h x A  , * * *( || )k k kB h x n . GW verifies equation * k kB B and finds that equations hold, i.e., GW can authenticate Nk. 4) GW computes , ( ) G new new i D K iID r D PID  , * ( || )i G iA h K ID , '* ' * i i in UZ A  , '* * '*( || || )new i i i iUN h A PID n . After GW validates equation '* ' i iUN UN and finds that the equation is correct, then it means that GW authenticates the user impersonated by Nj. Then, both GW and Nk will proceed normally with the rest of the login and authentication phase. 5) Eventually, Nk and attacker Nj agree on a session key, i.e., attacker Nj successfully impersonates the user. 4. Proposed Scheme In order to overcome the shortcomings of Lee et al.'s scheme [10], an improved scheme is proposed in this section. Firstly, the improved scheme protects the key values stored in the mobile device against the stolen mobile device attack during the user registration phase. Secondly, in the 85 registration phase of IoT node, the improved scheme transmits information through a secure channel and simplifies the registration process. Thirdly, messages transmitted over the public channel are added with timestamps to resist replay attacks during the login and authentication phase of the improved scheme. In addition, the updated user pseudo- identity PIDi new will not be transmitted to the user through the public channel, thus ensuring the untrace ability of the scheme. For the sake of brevity, this section only describes the registration for user, the registration for IoT node, the login and the key agreement phase. The specific steps are as follows. 4.1. Registration for User As soon as a new user wants to access an IoT service and contact one of the IoT nodes, he/she must first register with GW. GW stores the user's registration information in order to verify his/her identity during the login phase. As shown in Figure 1, this phase is divided into three steps. 1) MNi enters his/her identity IDi, password PWi and biometric BIOi. The mobile device selects a random number * m qn Z . The mobile device extracts two strings Gen( ) ( , )i i iBIO   from the BIOi using Gen (·) of the fuzzy extractor and computes ( || )i i iPWB h PW  . Then, MNi sends the registration information { , , }i i mID PWB n to GW through a secure channel. 2) Once GW receives the registration information from MNi, it generates the pseudo-identity PIDi of MNi and chooses a random number * G qn Z . GW calculates some values by equation (4) and then stores{ , , , }i i G mPID ID n n in its own database, which will be sent to MNi through a secure channel. ( || || ) ( || || ) ( || ) i i i m i G i G i i m i x h ID PWB n A h K ID n y h ID n A     (4) 3) MNi protects the random number mn of its choice by ' m m in n   and stores '{Gen( ),Rep( ), , , , , }i i i i mPID x y n   in the mobile device. Fig 1. Registration for user 4.2. Registration for IoT Node As shown in Figure 2, the registration for IoT node is divided into three steps as follows. 1) IoT node Nj selects its own identity IDj and sends the registration information j{ }ID to GW through a secure channel. 2) After receiving the registration information from Nj, GW selects a random number * w qn Z , calculates Nj's pseudo- identity NIDj and a secret value xj by equation (5), and stores { , , }j j wID NID n in its own database. Then, GW sends { , }j jNID x to Nj through a secure channel and discloses Nj's pseudo-identity NIDj. ( || ) ( || || ) j j w j j G w NID h ID n x h NID K n   (5) 3) After receiving { , }j jNID x from GW, Nj stores { , }j jNID x into its own memory. Fig 2. Registration for IoT node 4.3. Login and Key Agreement Phase As shown in Figure 3, MNi and Nj authenticate with each other with the help of GW and establish a session key. The detailed steps are as follows. 1) MNi inputs his/her identity IDi, password PWi and biometric BIOi. MNi's mobile device uses the stored values i , BIOi and Rep (·) algorithm of the fuzzy extractor to retrieve the string Rep( , )i i iBIO  and compute *, ,i m iPWB n x by equation (6). ' * ( || ) ( || || ) i i i m m i i i i m PWB h PW n n x h ID PWB n      (6) The mobile device verifies whether MNi is a registered user by checking whether * i ix x holds. If fails, the mobile device rejects MNi's login request. Otherwise, the mobile device generates a random number * i qr Z and the current timestamp T1, and calculates 1 1, ,iA F V by equation (7). 86 1 1 1 1 ( || ) ( || ) ( || || || || ) i i i m i i i i j i A y h ID n F r h A T V h ID A NID r T      (7) MNi sends 1 1 1 1{ , , , }iM PID F V T through a public channel to the IoT node Nj. 2) Nj checks the validity of T1 by 1| |freshT T T   , where Tfresh is the current timestamp. If T1 is invalid, Nj terminates the current phase. Otherwise, Nj generates a random number * j qr Z and the current timestamp T2, and computes 2 2,F V by equation (8) 2 2 2 2 ( || ) ( || || || || ) j j j j j j F h x T r V h ID x NID r T     (8) Nj transmits 2 1 2 2 2{ , , , , }jM M NID F V T over a public channel. 3) GW checks the validity of T1 and T2 by 1 2| | ,| |fresh freshT T T T T T     . If T1 and T2 are invalid, GW terminates the current phase. Otherwise, GW retrieves { , }j wID n from its own database using NIDj and calculates * * * 2, ,j jx r V by equation (9) * * * 2 2 * * * 2 2 ( || || ) ( || ) ( || || || || ) j j G w j j j j j j x h NID K n r h x T F V h ID x NID r T     (9) GW verifies whether the equation * 2 2V V holds. If not, GW will terminate the current session; otherwise, GW extracts { , , }i G mID n n from its own database according to PIDi and computes * * * 1,i iA r V, by equation (10). * * * 1 1 * * * 1 1 ( || || ) ( || ) ( || || || || ) i G i G i i i i j i A h K ID n r F h A T V h ID A NID r T     (10) GW authenticates MNi by checking whether * 1V and 1V are equal. If not, GW will terminate the current session. Otherwise, GW generates the current timestamp T3, calculates 3 4 3, ,F F V and the updated user's pseudo-identity new iPID by equation (11). After that, GW will save new iPID to its own database and replace iPID . * 3 3 * * * 4 3 3 * * 3 j 3 3 3 ( || || ) ( || ) ( || || ) ( || || || || ) ( || ) Stores and replaces i i i j j j i new i i m new i i F h ID r T F F r h x r T V h x r r F T PID PID h n T PID PID        (11) Finally, GW delivers 3 4 3 3{ , , }M F V T over a public channel. 4) Nj checks the validity of T3 by 3| |freshT T T   . If T3 is fresh, Nj recovers the key value * ** 3 4 3( || ) ( || || )i j jF r F h x r T  used in the subsequent computation and computes * ** * 3 3 3( || || || || )j j iV h x r r F T . Nj verifies that equation * 3 3V V is correct. If it is incorrect, Nj will terminate the current phase. Otherwise, Nj generates a random number * n qr Z and the current timestamp T4, and calculates 5F ,session key SKji and the verification value V4. ** 5 4 * ** 3 4 ** 4 4 ( || || ) ( || || || ) ( || || || ) n j i ji i n ji n i F r h NID r T SK h F r r T V h SK r r T     (12) Nj transmits 4 5 4 3 4{ , , , }M F V T T to MNi via a public channel. 5) MNi checks the validity of T3 and T4 according to 3| |freshT T T   , 4| |freshT T T   . If T3 and T4 are invalid, MNi terminates the current phase. Otherwise, MNi calculates * * 4,nr V and session key ijSK by equation (13). * 5 4 * 3 4 * * 4 4 ( || || ) ( ( || || ) || || || ) ( || || || ) n j i ij i i i n ij n i r F h NID r T SK h h ID r T r r T V h SK r r T     (13) MNi checks if * 4V is the same as 4V . If not, MNi will terminate the current session. If the two values are equal, it proves that MNi and Nj establish the same session key. Then, MNi calculates the updated pseudo-identity 3( || )new i i mPID PID h n T  and replaces PIDi. 5. Security Analysis This section provides a security analysis of the improved scheme. As described below, the improved scheme satisfies user anonymity and untraceability, and is also resistant to known attacks. 5.1. User Anonymity In the improved scheme, user MNi's identity IDi is neither stored in the mobile device nor transmitted in the public channel, but a pseudo-identity PIDi is transmitted. PIDi is generated by GW for each user during the user registration phase. Even if an attacker intercepts PIDi, he/she cannot obtain the user's real identity information. In summary, the improved scheme satisfies user anonymity. 5.2. User Untraceability The attacker can intercept the message M1. However, as shown in equation (14), the values 1 1 1{ , , , }iPID F V T contained in M1 are associated with random numbers nm, ri, respectively, and these random numbers vary from session to session. That is, all values in M1 are not associated with a 87 specific user. Therefore, the attacker cannot trace the user's actions in the login and authentication phase. Fig 3. Login and key agreement phase 1 1 1 1 ( || ) ( || || || || ) i i i i j i F r h A T V h ID A NID r T    (14) Meanwhile, as shown in equation (15), GW will update and store PIDi after each session. Moreover, the updated pseudo- identity PIDi new is not directly transmitted over the public channel. MNi can calculate the PIDi new by itself to be used in the next session. In a word, the attacker cannot obtain the correlation between PIDi and PIDi new by intercepting them. Therefore, the improved scheme has untraceability. 3( || )new i i mPID PID h n T  (15) 5.3. Resistance to Man-in-the-middle (MITM) Attack If an attacker attempts to manipulate a message transmitted in the public channel, he/she will be caught by the mutual authentication mechanism of each of the entities involved in the authentication. GW authenticates Nj and MNi through V1 and V2 in equation (16), respectively. Nj achieves authentication to the GW by verifying V3 in equation (16). MNi checks whether the same session key is reached with Nj by validating V4 in equation (16). Therefore, malicious attempts by attackers will not succeed and the improved scheme can resist MITM attacks. 1 1 2 2 * * 3 j 3 3 ** 4 4 ( || || || || ) ( || || || || ) ( || || || || ) ( || || || ) i i j i j j j j j i ji n i V h ID A NID r T V h ID x NID r T V h x r r F T V h SK r r T       (16) 5.4. Resistance to Impersonation Attack In the improved scheme, MNi uses a pseudo-identity PIDi to transmit identity information over the public channel, which is updated at the end of each session. Therefore, it is difficult for the attacker to use an outdated pseudo-identity to impersonate a legitimate user. Even if the attacker happens to guess the identity of MNi, it is impossible for the attacker to send a valid message to GW for proving his/her identity. It is because that the attacker cannot obtain a secret value 88 ( || || )i G i GA h K ID n calculated by GW for MNi during the registration phase, and Ai contains GW's private key KG, MNi's identity IDi, and a random number Gn chosen by GW. Therefore, the improved scheme can resist the impersonation user attack. 5.5. Resistance to Replay Attack During the login and authentication phase of the improved scheme, each entity performs a series of calculations to generate the current timestamp Tx, and adds Tx to each value transmitted over the public channel to ensure the freshness of the message. After each entity receives the message, it first verifies the validity of Tx and then proceeds to subsequent operations. Therefore, an attacker cannot create a session key by intercepting the information transmitted in the public channel and send the message through the session key. In summary, the improved scheme can resist replay attack. 6. Performance Analysis This section compares the improved scheme with Lee et al.'s scheme[10] and other schemes of the same type in terms of computational cost and security. 6.1. Implementation Setup This section refers to the experimental results of Xie et al.[11]. For convenience, only four main cryptographic operations are considered in this section: (1) one-way hash function (2) point operation (3) symmetric encryption/ decryption (4) fuzzy extraction function. Their respective estimated times are shown in Table 2. Table 2. Estimated time Operation Description Estimated time/ms Th Unit calculated cost of hash function 0.068 Ts Unit calculated cost of encryption/decryption 0.56 Te Unit calculated cost of operation 2.501 Tf Unit calculated cost of fuzzy extraction function 2.501 6.2. Computation Comparisons The comparison between the improved scheme and the same type of scheme in terms of computational cost is shown in Table 3. Although the running time of the improved scheme is slightly longer than that of the Lee et al.’s scheme [10], the improved scheme solves the defects in the Lee et al.’s scheme[10] and significantly improves the safety. It can be more intuitively seen from Fig. 4 that the difference in computational cost between improved scheme and Lee et al.’s scheme[10] is small. Meanwhile, the computational cost of the improved scheme is significantly lower than that of the schemes of Rafique et al.[12], Sahoo et al.[13], Chaudhry et al.[14], and Srinivas et al.[15]. Table 3. Computational cost of the schemes Schemes User IoT nodes Gateway Total Estimated time/ms Lee et al.[10] 9Th 7Th 7Th+2Ts 23Th+2Ts 2.684 Rafique et al.[12] 10Th+Ts+Tf 4Th+2Ts 8Th+4Ts 22Th+7Ts+ Tf 7.917 Sahoo et al.[13] 10Th+4Te+ 2Ts+Tf 5Th+2Te+2 Ts 5Th+2Te+Ts 20Th+8Te+ 5Ts+Tf 26.669 Chaudhry et al.[14] 17Th+Tf 13Th 8Th 38Th+Tf 5.085 Srinivas et al.[15] 17Th+6Te+ Tf 8Th+4Te 12Th+3Te 37Th+13Te +Tf 37.53 Improved scheme 10Th+Tf 7Th 10Th 27Th+Tf 4.337 Fig 4. Comparison of computation cost 6.3. Comparison of Safety Features and Functions In this section, the improved scheme is compared with Lee et al.’s [10] scheme and similar schemes in recent years for safety. As shown in Table 4, the existing schemes are not resistant to some attacks and their security needs to be enhanced. Compared with these schemes, the improved scheme has great security advantages and is suitable for resource-constrained IoT devices. R1: User anonymity; R2: User untrace ability; R3: Mutual authentication; R4: Resistance to reply attack; R5: Resistance to MITM attack; R6: Resistance to DOS attack; R7: Forward security; R8: Resistance to impersonation attack; R9: Resistance to stolen smart card attack; R10: Resistance to known session key attack; R11: Resistance to off-line password guessing attack; √: denotes the scheme can provide the corresponding attribute; ×: denotes the scheme cannot provide the corresponding attribute. 89 Table 4. Security comparison among relevant schemes 7. Conclusion The paper first reviews a three-factor anonymous authentication scheme proposed by Lee et al. in an IoT environment and points out that their scheme not only has shortcomings in the user registration phase, the IoT node registration phase, and the login and authentication phases, but also fails to resist man-in-the-middle attacks and impersonation attacks. In order to overcome these shortcomings, this paper proposes an improved scheme to address the security vulnerabilities of Lee et al.'s scheme. Through security analysis, it proves that the improved scheme can resist various known attacks and meet all security requirements. In addition, this paper also compares and analyzes the security and computational effort of the proposed scheme with similar schemes in recent years. The analysis results show that the improved scheme achieves the expected efficiency and is suitable for the IoT environment. References [1] Rao P M, Deebak B D. A Comprehensive Survey on Authentication and Secure Key Management in Internet of Things: Challenges, Countermeasures, and Future Directions. Ad Hoc Networks, 2023: 103159. [2] Nguyen D C, Ding M, Pathirana P N, et al. 6G Internet of Things: A comprehensive survey. IEEE Internet of Things Journal, 2021, 9(1): 359-383. [3] Chen Z, Jiang Y, Song X, et al. A Survey on Zero-Knowledge Authentication for Internet of Things. Electronics. 2023, 12 (5): 1145. [4] Chen B, Kuo W , Wuu L . Robust smart‐card‐based remote user password authentication scheme. International Journal of Communication Systems. 2014, 27 (2): 377‐389. [5] Jiang Q, Ma J, Li G, et al. Improvement of robust smart-card- based password authentication scheme. International Journal of Communication Systems. 2015, 28 (2): 383‐393. [6] Das A K. A secure and robust temporal credential-based three- factor user authentication scheme for wireless sensor networks. Peer-to-Peer Networking and Applications. 2016,9(1): 223- 244. [7] Dhillon PK , Kalra S . Secure multi-factor remote user authentication scheme for internet of things environments. International Journal of Communication Systems. 2017, 30 (16): e3323. [8] Kumari S, Karuppiah M , Das A K , et al. A secure authentication scheme based on elliptic curve cryptography for IoT and cloud servers. Journal of Supercomputing, 2018, 74 (12): 6428-6453. [9] Gope, Prosanta, Sikdar, et al. Lightweight and Privacy- Preserving Two-Factor Authentication Scheme for IoT Devices. IEEE Internet of Things Journal, 2019, 6(1):580-589. [10] Lee H , Kang D , Ryu J, et al. A three-factor anonymous user authentication scheme for Internet of Things environments. Journal of Information Security and Applications, 2020, 52: 2214-2126. [11] Xie Q, Wong D S, Wang G, et al. Provably secure dynamic ID- based anonymous two-factor authenticated key exchange protocol with extended security model. IEEE Transactions on Information Forensics and Security, 2017, 12(6): 1382-1392. [12] F. Rafique, M. Obaidat, K. Mahmood et al. An efficient and p rovably secure certificateless protocol for industrial internet of things, IEEE Transaction Industrial Informatics, 2022,18(11): 8039-8046. [13] Sahoo S S, Mohanty S, Majhi B. A secure three factor based authentication scheme for health care systems using IoT enabled devices. Journal of Ambient Intelligence and Humanized Computing, 2021, 12: 1419-1434. [14] Chaudhry S A, Irshad A, Yahya K , et al. Rotating behind Privacy: An Improved Lightweight Authentication Scheme for Cloud-based IoT Environment. ACM Transactions on Internet Technology (TOIT), 2021,21(3): 1–19. [15] Srinivas J, Das A K, Wazid M, et al. Designing secure user authentication protocol for big data collection in IoT-based intelligent transportation system. IEEE Internet of Things Journal, 2020, 8(9): 7727-7744.