Frontiers in Computing and Intelligent Systems ISSN: 2832-6024 | Vol. 4, No. 2, 2023 104 Analysis and Improvement of PUF‐based Secure Anonymous User Authentication Scheme in Smart Home Environment Xinyu Zuo 1, Zhangang Wang 2, *, Anqian Li 1, Yuyan Huo 1 and Shufang Niu 2 1 School of Software, Tiangong University, Tianjin 300387, China 2 School of Computer Science and Technology, Tiangong University, Tianjin 300387, China * Corresponding author: Zhangang Wang (Email: wangzhangang@tiangong.edu.cn) Abstract: With the rapid development of IoT technology, smart home is attracting much attention due to its convenience and comfort. In 2022, CHO et al. proposed an anonymous user authentication scheme using PUFs in smart home environment. However, this paper conducts a security analysis and finds that CHO et al.'s scheme cannot resist tracking attacks, replay attacks and cannot reach session keys. In order to overcome the shortcomings of CHO et al.'s scheme, this paper proposes an improved PUF-based secure anonymous user authentication scheme. After security analysis and comparison with related authentication schemes in terms of security and computational cost, it is demonstrated that the improved scheme is resistant to a variety of attacks and can achieve secure and efficient authentication. Keywords: Smart Home; Authentication Scheme; Security. 1. Introduction In recent years, Internet of Things (IoT) technology has developed rapidly, and smart home, as a typical application of IoT, has attracted much attention because of its convenient and comfortable features [1]. Smart home system can control various household appliances through mobile phones, TVs, computers and other devices to achieve remote control and management of household appliances and improve people's quality of life. At the same time, smart home system can realize comprehensive monitoring of home security system, which enables people to enjoy a more comfortable, healthy and happy life under the premise of ensuring home security. However, as communication between entities in the smart home environment relies on common channel, which is vulnerable to eavesdropping and impersonation attacks [2-5]. The security of the smart home is an issue. Also, in smart home environment, attackers can use controlled devices to perform malicious acts due to the low security of resource- constrained smart devices. Therefore, authentication as well as communication security in smart home environment is very important. In 1981, Lamport et al. [6] proposed a remote user authentication scheme using a password table. In recent years, with the popularity of IoT applications, scholars have proposed many authentication schemes for smart home environment [7-10]. In 2021, Zou et al. proposed an authentication scheme based on elliptic curve cryptography (ECC) in smart home environment, and in 2022, CHO et al. [11] claimed that Zou et al.'s [12] authentication scheme is vulnerable to forgery and session key compromise attacks and proved that the scheme of Zou et al. does not guarantee mutual authentication between home users and home devices. Then, CHO et al. proposed a secure anonymous authentication scheme using physical unclonable functions (PUFs) [13]. However, after analysis, this paper found several security problems in CHO et al.'s scheme. Firstly, a maliciously controlled home device is able to compute the key credentials for mutual authentication between the user and the gateway as well as the user's updated pseudo-identity. Secondly, certain messages delivered via the public channel are not authenticated. Thirdly, no timestamp is used in CHO et al.'s scheme, which does not guarantee the freshness of the delivered messages. Finally, the gateway does not know the identity of the device when the home device sends a request to the gateway. Therefore, the scheme of CHO et al. is not secure. In order to overcome the shortcomings of CHO et al's scheme, an improved scheme is proposed in this paper. In the user registration phase of the improved scheme, the key credentials for mutual authentication between the user and the gateway are further protected. In the login and authentication phase, the updated pseudo-identity of the user calculated by the gateway is improved, timestamps are added, etc. Also, this paper compares the security and computational cost of the improved scheme with existing similar schemes. 1.1. Contribution The contributions of this paper are summarized as follows: (1) The scheme of CHO et al. [11] is improved, and the security and privacy problems inherent in smart home security schemes are solved. (2) Time stamps and random numbers are added to the improved scheme to enhance the security of the scheme. (3) The security and computational cost of the improved scheme are compared with other similar schemes. The results show that the improved scheme is superior to other similar schemes in terms of security and computational cost. 1.2. Organization The rest of the paper is organized in the following way. Section II reviews the scheme of CHO et al. [11], Section III analyses the safety problems in the CHO et al.'s scheme, Section IV proposes a new and improved scheme, Section V analyses the safety of the improved scheme, and Section VI analyses the performance of the improved scheme. Finally, 105 Section VII is the conclusion. 2. Review of CHO et al.’s Scheme In this section, the paper quickly reviews CHO et al.’s scheme. In this scheme, four entities are included: registration center (RC), user (Ui), gateway (GW), and home device (HDj). In this case, Ui and HDj are register through RC, and GW helps Ui and HDj to authenticate with each other and agree on a session key. The scheme of CHO et al. [11] consists of five phases namely: system establishment phase, home device registration phase, user registration phase, login and authentication phase and password update phase. For the sake of brevity, we do not describe password update phase here. The symbols used in this paper and their definitions are shown in Table 1. Table 1. Symbols 2.1. System Establishment Phase. Before deploying GW and HDj, RC generates t as the master key for the gateway GW and Cj as the challenge value for HDj. Afterwards, RC stores Cj securely in the memory of HDj. RC selects the hash function, and generates b as the secret value for HDj. 2.2. Home Device Registration Phase. Step 1. HDj calculates ( )j jX h SID b  , ( )j jR PUF C , ( ) ( , )j j jGen R D HS , where SIDj is the unique identity of HDj and transmits {SIDj, Cj, Xj} to RC over a secure channel. Step2. On receiving {SIDj, Cj, Xj}, RC calculates and stores ( )j jHDC h SID s  , and then calculates ( ) jHD j jK h h SID s   , ( ) jj j j HDDID h SID h K   , ( ) jj HD jPD h K X  , ( )j j jB h h DID t   . Thereafter, RC transmits {DIDj, Cj, PDj, Bj} to GW over a secure channel for GW to store, and then transmits {DIDj, KHDj, hj} securely to HDj. Step 3. On receiving them, HDj calculates jj jH D h  and stores {HSj, Hj, KHDj} into the its memory. 2.3. User Registration Phase. Step 1. Ui selects IDi and PWi and generates random number ri, then calculates the ( )i i iPID h ID r  , ( )i i i iPPW h PID PW r   and transmits {IDi, PIDi} to RC over a secure channel. Step 2. Upon receiving {IDi, PIDi}, RC calculates and verifies that ( )i iUC h PID s  existed in its database. If it exists, RC terminates the registration phase. Otherwise, RC saves UCi into its database, selects a fuzzy verification value ω, calculates: ( )i iPU h ID s  , ( ) iUG iK h PU t  , ( ) ii i UGRID h PID K  , ( )i iy h RID t  , and then stores {RIDi, PIDi, PUi, yi} into GW’s memory , and sends {ω, RIDi, KUGi, yi} to Ui over the secure channel. Step 3. After receiving the message, Ui calculates: ( ) mod i i iV h PID PPW   , 1 ( )i i iA RID h r PID   , 2 ( ) iUG i i iA K h ID PPW r    , ( )i i i iX r h ID PW   , ( )i i i iY y h ID r   , and stores {Xi, Yi, Vi, ω, A1, A2} into the smart card. 2.4. Login and Authentication Phase. Step 1. Ui enters the ' ',i iID PW into the smart card. The smart card calculates  ' ' i i i ir X h ID PW   , ' '( )i i iPID h ID r  , ' ' '( )i i i iPPW h PID PW r   , ' ' '( ) mod i i iV h PID PPW   and verifies that Vi' is equal to Vi. If it is not equal, this phase is terminated. Otherwise, Ui generates random number a1 and calculates ( )i i i iy Y h ID r   , 1 ( ) i i iRID A h r PID   , 2 ( ) iUG i i iK A h ID PPW r    , 1 ( ) ij UG iM DID h K PID   , 2 1 ( ) iUG jM a h K DID   , 1 1( ) j iV h a DID PID   , and transmits {RIDi, M1, M2, V1} to GW over the public channel. Step 2. On receiving {RIDi, M1, M2, V1}, GW retrieves {PIDi, PUi} from the database according to RIDi and calculates 1 ( ( ) )j i iDID M h h PU t PID    , 1 2 ( ( ) )i ja M h h PU t DID    , ' 1 1( )j iV h a DID PID   . and checks if V1' is equal to V1, if not, terminate this phase. If equal, GW retrieves { , , }j j jC PD B from the database according to DIDj and generates random number a2. Then, GW calculates ( )j j jh B h D ID t   , 3 1 2( )j jM a a C PD   , 4 ( )i jM h PU t h  , 2 1 2( )j iV h a a C RID    and transmits {RIDi, M3, M4, V2} to HDj. Step 3. After receiving {RIDi, M3, M4, V2}, HDj calculates 1 2 3( ) ( ( )) jj HD ja a C M h K h SID b     , 2 ' 1 2( )j iV h a a C RID    and checks whether V2 ' is equal to V2, and terminates this phase if it is not. Otherwise, HDj generates random number a3 and calculates ( )j jR PUF C , ( , )j j jD Rep R HS , j j jh D H  , 4( )i jh PU t M h  , 1 2 3( ( ) )iSK h h PU t a a a     , 106 5 3 ( ( ( )) ) jHD j jM a h h K h SID b h     , 3 3( ( ))iV h SK a h PU t    , and transmits {M5, V3} to GW. Step 4. After receiving {M5, V3}, GW calculates 3 5 ( )j ja M h PD h   , 1 2 3( ( ) )iSK h h PU t a a a     ; ' 3 3( ( ))iV h SK a h PU t s    , and checks whether V3' is equal to V3, and terminates this phase if it is not. Otherwise, GW calculates 2( )n e w i iR ID h a R ID  , 6 2 3( ) ( ( ) )i iM a a h h PU t y    , 4 2 3( )new iV h SK RID a a    , and transmits {M6, V4} to Ui. Step 5. After receiving {M6, V4}, Ui computes 2 3 6( ) ( ) iUG ia a M h K y   , 2( )new i iRID h a RID  , 1 2 3( ) iUGSK h K a a a    , ' 4 2 3( )new iV h SK RID a a    . If V4' is equal to V4, Ui computes 1 ( )new new i i iA RID h r PID   , then replaces 1A with 1 newA . 3. Weaknesses of CHO et al.’s Scheme 3.1. Tracking Attack In the login and authentication phase of the CHO et al.’s [11] scheme, Ui transmits {RIDi, M1, M2, V1} to GW over the public channel, where 1 ( ) ij UG iM DID h K PID   . Since DIDj, KUGi and PIDi are invariant, M1 can be tracked. Furthermore, GW transmits RIDi and 3 1 2( )j jM a a C PD   to HDj via the public channel in the second step of the login and authentication phase, and then HDj calculates 1 2 3( ) ( ( )) jj HD ja a C M h K h SID b     . After obtaining a2, HDj is able to calculate 2( )new i iRID h a RID  of Ui. Assuming that HDj is controlled, a malicious attacker can perform a tracking attack on Ui when it next authenticates with other home devices. 3.2. Replay Attack Since no timestamp is used in the scheme of CHO et al. [11] to guarantee the freshness of the transmitted messages, an attacker can intercept {RIDi, M3, M4, V2} transmitted by GW to the HDj in the second step of the login and authentication phase, and thereafter pretends that GW transmits again to HDj. On receiving {RIDi, M3, M4, V2}, HDj computes 1 2 3( ) ( ( )) jj HD ja a C M h K h SID b     , ' 2 1 2 ( )j iV h a a C RID    , and verifies ' 2 2 ? V V , the verification can be passed and HDj will continue with subsequent computations. Therefore, the scheme of CHO et al. [11] is not resistant to replay attacks. 3.3. Man in the Middle Attack. In the second step of the login and authentication phase, GW transmits {RIDi, M3, M4, V2} to the HDj, where 4 ( )i jM h PU t h  is not authenticated. Since there is no timestamp, a malicious attacker can intercept M4 and tamper it to M4 ’. HDj receives it and computes the wrong ' ' 4( )i jh PU t M h  ; then computes ' ' 1 2 3( ( ) )iSK h h PU t a a a     , ' ' ' 3 3( ( ) )iV h SK a h PU t    and sends {M5, V3 '} to GW. On receiving it, GW recovers 3 5 ( )j ja M h PD h   and computes 1 2 3( ( ) )iSK h h PU t a a a     . Since the SK computed by HDj and GW do not match, GW fails in verifying V3 ' and terminates this phase. As a result, HDj and Ui cannot agree on a session key. 3.4. Not Working Properly. In the third step of the login and authentication phase, CHO et al.’s [11] scheme does not work properly because {M5, V3} transmitted from HDj to GW lacks the identity information of Ui and HDj. When HDj transmits {M5, V3} to GW, GW computes 3 5 ( )j ja M h PD h   , 1 2 3( ( ) )iSK h h PU t a a a     . However, GW does not know which HDj is transmitting the message at this point. If GW wants to find PDj and PUi, it must ask HDj for its identity information as well as that of Ui with whom it has agreed on a session key. The message {M5, V3} sent by HDj to GW is clearly missing RIDi, DIDj. Therefore, the scheme does not work properly. 4. Proposed Scheme In order to overcome the security vulnerabilities of the CHO et al.’s scheme, an improved scheme is proposed in this paper. The system establishment and home device registration phases of the improved scheme are the same as those of CHO et al.’s scheme, so we only describe user registration phase and login and authentication phase in this section, as follows. 4.1. User Registration Phase. Ui is registered via its own mobile device and the registration process is as follows:       Secure Chan , , RC elects , Generates r Computes . Computes i i i i i i i i i i i i i i ID PID r U ID PW PID h ID r PPW h PID PW r      S ,     nel ( ) i i i U i i PU h ID s K h PU t r       ， ，   ( ) ( ) Stores , , , ii i U i i i i i i RID h PID K y h RID t RID PID PU r     ， ，         Secure Channel 1 2 , , into the GW Computes i iUi i i i i i i RID K y V h PID PPW A RID h r PID A        ， ，      1 2 ( ) Stores , , , , into the terminal device iU i i i i i i i i i i i i i i K h ID PPW r X r h ID PW Y y h ID r X Y V A A          ， ， ， Fig 1. User registration phase Step 1. Ui selects IDi and PWi and generates random number ri via its mobile device, calculates ( )i i iPID h ID r  and ( )i i i iPPW h PID PW r   and transmits {IDi, PIDi, ri} to the RC via a secure channel. Step 2. After receiving {IDi, PIDi, ri}, RC calculates the secret value ( )i iPU h ID s  and the secret credential 107 ( ) iU i iK h PU t r   for Ui, where s is the master key of RC and t is the master key of GW, and then calculates ( ) ii i URID h PID K  and ( )i iy h RID t  . Afterwards, RC transmits {RIDi, PIDi, PUi, ri} to GW over a secure channel, and GW receives the information and stores it in memory. Then, RC sends {RIDi, PIDi, KUi, yi} to Ui over the secure channel. Step 3. After receiving the message, Ui's mobile device calculates  i i iV h PID PPW  , and computes:  1 i i iA RID h r PID   ,  2 iU i i iA K h ID PPW r    , ( )i i i iX r h ID PW   ,  i i i iY y h ID r   , and finally stores {Xi, Yi, Vi, A1, A2} into the mobile device. The detailed process is shown in Figure 1. 4.2. Login and Authentication Phase. In this phase, Ui and HDj achieve mutual authentication with the assistance of GW and agree on a session key SK, which is used to complete future confidential communication between Ui and HDj. The specific steps are as follows: Step 1. Ui enters ' ' and i iID PW in its mobile device, and the mobile device calculates ' '( )i i i ir X h ID PW   , ' '( )i i iPID h ID r  , ' ' '( )i i i iPPW h PID PW r   , ' ' '( )i i iV h PID PPW  , and compares it with Vi stored in the mobile device, if they are equal, Ui logs in successfully. The mobile device then initiates the authentication process, the mobile device generates random number a1 and timestamp T1, calculates ( )i i i iy Y h ID r   , 1 ( )i i iRID A h r PID   , 2 ( ) iU i i iK A h ID PPW r    , and selects DIDj of HDj to be accessed and calculates 1 1( ) ij U iM D ID h K PID T    , 2 1 ( ) iU jM a h K D ID   , 1 1 1( )j iV h a DID PID T    , and transmits {RIDi, M1, M2, V1, T1} to GW over public channel. Step 2. Upon receiving {RIDi, M1, M2, V1, T1}, GW first checks 1 cT T T   , where Tc is the current timestamp. If the message is fresh, GW retrieves the corresponding { , , }i i iPID PU r stored in memory based on RIDi, and computes ( ) iU i iK h PU t r   , 1 ( ) ij U iDID M h K PID   , 1 2 ( ) iU ja M h K DID   , ' 1 1 1( )j iV h a DID PID T    and verifies ' 1 1 ? V V , if the condition is not valid, GW terminates this phase. Otherwise, GW successfully authenticates Ui and retrieves { , , }j j jC PD B according to DIDj and generates random number a2 and timestamp T2, calculates ( )j j jh B h DID t   , 3 1 2( )j jM a a C PD   , 4 ( )i jM h PU t h  , 2 1 2 4 2( )j iV h a a C M RID T      , and finally, transmits {RIDi, M3, M4, V2, T2} to HDj over the public channel. Step 3. Upon receiving {RIDi, M3, M4, V2, T2}, HDj checks 2 cT T T   , If the message is fresh, HDj computes ( )j jX h SID b  , 1 2 3( ) ( ) jj D ja a C M h K X    , ' 2 1 2 4 2( )j iV h a a C M RID T      , verifies ' 2 2? V V , and if the verification passes, GW authentication is successful. HDj generates random number a3 and timestamp T3, computes ( )j jR PUF C , Re ( , )j j jD p R HS , j j jh D H  , 4( )i jh P U t M h  , 1 2 3( ( ) )iSK h h PU t a a a     , 5 3 ( ( ) ) jD j jM a h h K X h    , 3 3 3( ( ) )iV h SK a h PU t T     , and transmits {M5, V3, T3, RIDi, DIDj} to GW over the public channel. Fig 2. Login and authentication phase Step 4. Upon receiving {M5, V3, T3, RIDi, DIDj}, GW checks 3cT T T   , If the message is fresh, GW computes 3 5 ( )j ja M h PD h   , 1 2 3( ( ) )iSK h h PU t a a a     , ' 3 3 3( ( ) )iV h SK a h PU t T     , verifies ' 3 3? V V , and if the condition is not valid, GW terminates this phase. Otherwise, GW successfully authenticates HDj and generates random number a4 and timestamp T4, computes 4( )new i iRID h a RID  for Ui as well as 6 2 3 4( ) ( ) iU iM a a a h K y    , 7 4( ) ( ) ii UM h PU t h a K   , 4 2 3 4( )new iV h SK RID a a T     , and replaces iRID in the database with new iRID and finally, transmits {M6, M7, V4, T4} to Ui over the public channel. Step 5. upon receiving {M6, M7, V4, T4}, Ui checks 4cT T T   . If the message is fresh, the Ui computes 2 3 4 6( ) ( ) iU ia a a M h K y    , 4( )new i iR ID h a R ID  , 7 4( ) ( ) ii Uh PU t M h a K   , 1 2 3( ( ) )iSK h h PU t a a a     and 108 ' 4 2 3 4( )new iV h SK RID a a T     , verifies ' 4 4? V V , If they are not equal, Ui terminates this phase, otherwise, it indicates that the Ui successfully authenticates HDj and agrees on the session key, and then computes 1 ( )new new i i iA RID h r PID   and updates it in the mobile device to update it. 5. Security Analysis In this section, the paper presents security analysis of the improved scheme, demonstrating that our scheme is secure and resistant to known attacks. 5.1. Anonymity and Untraceability Section 3.1 of this paper refers to a tracing attack on the CHO et al.’s [11] scheme. In this case, attacker A can intercept the message {RIDi, M1, M2, V1} transmitted by Ui to GW, because M1 is invariant, attacker A can perform a tracing attack on Ui. Furthermore, attacker A can take control of HDj and use its a2 which calculated in the third step of the login and authentication phase and the RIDi received from GW to calculate the updated Ui's identity RIDi new. Thus, the next time Ui authenticates with other home devices, a tracking attack is carried out. However, the improved scheme concatenates the timestamp T1 in the calculation of the message M1, so that M1 is different for each transmission. Also, GW uses a random number a4 that only the Ui can compute when updating the pseudo-identity of Ui. Therefore, in the improved scheme, even the same user has different identity information in different sessions. From the above analysis, it is easy to see that the improved scheme achieves anonymity and untraceability of the user. 5.2. Mutual Authentication. In the login and authentication phase, Ui and HDj authenticate each other with the assistance of the GW. Firstly, GW verifies that V1' is equal to V1, if it is, then both Ui and GW have the correct secret credentials KUi and GW successfully authenticates Ui's identity. Similarly, HDj, GW and Ui authenticate ' 2 2 ? V V , ' 3 3 ? V V and ' 4 4? V V respectively in each session. When all authentication passes, the three achieve mutual authentication and compute the session key. Thus, the improved scheme provides mutual authentication between Ui, GW, and HDj. 5.3. Impersonation Attack. Since attacker A does not know the secret credentials KUi and KDj for authentication between Ui and HDj and GW, it cannot successfully impersonate legitimate Ui and HDj to generate authentication request and response messages, so the improved scheme can resist impersonation attacks. 5.4. Replay Attack. In the improved scheme, because each received message is authenticated with a timestamp, attacker A cannot perform a replay attack. For example, Ui adds the current timestamp T1 to each message transmitted, GW will determine whether 1cT T T   holds, if it does, it will continue to authenticate the other messages received, otherwise, it will terminate this phase. 5.5. Man in the Middle Attack Section 3.3 of this paper mentions a man-in-the-middle attack on the CHO et al.’s scheme [11]. In this case, attacker A can tamper with M4 by intercepting the message {RIDi, M3, M4, V2} transmitted by GW to HDj in the second step of the login and authentication phase, and making it impossible for Ui and HDj to agree on a session key. However, in the improved scheme, M4 is added to the authentication message V2, and if attacker A intercepts and tampers with message M4, HDj will fail at authentication and terminate this phase. Thus, the improved scheme is resistant to man-in-the-middle attacks. 5.6. Forward Confidentiality The session key computed between Ui and HDj may be corrupted by attacker A. However, attacker A cannot find significant correlations between past, present and future session keys because they contain random numbers a1, a2 and a3 that are different in each session of the improved scheme. Thus, the improved scheme guarantees forward security. 6. Performance Evaluation In this section, the performance of the improved scheme is evaluated and we compare it with the schemes of Naoui et al. [14], Shuai et al. [15], Zou et al. [12], and CHO et al. [11] in terms of both safety characteristics and computational cost. 6.1. Security Features As shown in Table 2, the security features of the improved solution were compared with the other solutions. The result shows that the other solutions have one or more security vulnerabilities. Therefore, the security of the improved scheme has a great advantage over the other schemes. Table 2. Security features comparisons Note.A1: Anonymity; A2: Untraceability; A3: Mutual authentication; A4: Terminal device lost/stolen attack; A5: Session key disclosure attack; A6: Impersonation attack; A7: Replay attack; A8: Man in the Middle Attack; A9: Offline password guessing attack; A10: Forward confidentiality. 6.2. Computation Cost In this subsection, this paper uses Th, Tf, Tepm, Tpuf, and Ts to denote the consumption time for one-way hash functions, fuzzy extractors, ECC point multiplication, PUF, and symmetric key encryption/decryption, respectively. 109 According to the scheme of Xia et al. [1], each time is defined as Th=0.0026ms, Tf=1.989ms, Tepm=1.989ms, Tp=0.12ms and Ts=0.00325ms. Table 3 depicts the computational costs of the improved scheme compared to several other schemes for different entities in the login and authentication phase. Although the improved scheme has a slightly higher computational cost than CHO et al.’s scheme, it is more secure than CHO et al.’s scheme and can resist various attacks. In addition, the improved scheme also has an advantage in terms of computational cost compared to several other schemes, satisfying the requirement of lightweight and able to be applied to resource-constrained smart home environment. Table 3. Computation cost comparisons 7. Summary In this paper, we first review the scheme of CHO et al. and perform a security analysis on it, pointing out that it cannot resist a variety of malicious attacks such as tracking attacks and replay attacks. To address these security problems, we propose an improved PUF-based secure anonymous authentication scheme in a smart home environment, and demonstrate that the improved scheme is secure and has a low computational cost. References [1] Xia Y, Qi R, Ji S, et al. PUF-assisted lightweight group authentication and key agreement protocol in smart home. Wireless Communications and Mobile Computing, 2022, 2022: 1-15. [2] Kwon D K, Yu S J, Lee J Y, et al. WSN-SLAP: Secure and lightweight mutual authentication protocol for wireless sensor networks. Sensors, 2021, 21(3): 936. [3] Sutrala A K, Obaidat M S, Saha S, et al. Authenticated key agreement scheme with user anonymity and untraceability for 5G-enabled softwarized industrial cyber-physical systems. IEEE Transactions on Intelligent Transportation Systems, 2021, 23(3): 2316-2330. [4] Abbas G, Tanveer M, Abbas Z H, et al. A secure remote user authentication scheme for 6LoWPAN-based Internet of Things. PloS one, 2021, 16(11): e0258279. [5] Chen C M, Deng X, Kumar S, et al. Blockchain-based medical data sharing schedule guaranteeing security of individual entities. Journal of Ambient Intelligence and Humanized Computing, 2021: 1-10. [6] Lamport L. Password authentication with insecure communication. Communications of the ACM, 1981, 24(11): 770-772. [7] Kumar P, Gurtov A, Iinatti J, et al. Lightweight and secure session-key establishment scheme in smart home environments. IEEE Sensors Journal, 2015, 16(1): 254-264. [8] Wazid M, Das A K, Odelu V, et al. Secure remote user authenticated key establishment protocol for smart home environment. IEEE Transactions on Dependable and Secure Computing, 2017, 17(2): 391-406. [9] Wazid M, Das A K, Kumar N, et al. Design and analysis of secure lightweight remote user authentication and key agreement scheme in Internet of drones deployment. IEEE Internet of Things Journal, 2018, 6(2): 3572-3584. [10] Alzahrani B A, Barnawi A, Albarakati A, et al. SKIA-SH: A symmetric key-based improved lightweight authentication scheme for smart homes. Wireless Communications and Mobile Computing, 2022, 2022. [11] Cho Y, Oh J, Kwon D, et al. A secure and anonymous user authentication scheme for IoT-Enabled smart home environments using PUF. IEEE Access, 2022, 10: 101330-101 346. [12] Zou S, Cao Q, Wang C, et al. A robust two-factor user authentication scheme based ECC for smart home in IoT. IEEE Systems Journal, 2021, 16(3). [13] Nyangaresi V O. Lightweight anonymous authentication protocol for resource-constrained smart home devices based on elliptic curve cryptography. Journal of Systems Architecture, 2022, 133: 102763. [14] Naoui S, Elhdhili M E, Saidane L A. Lightweight and secure password based smart home authentication protocol: LSP- SHAP. Journal of Network and Systems Management, 2019, 27: 1020-1042. [15] Shuai M, Yu N, Wang H, et al. Anonymous authentication scheme for smart home environment with provable security. Computers & Security, 2019, 86: 132-146.