1

A Chaotic Maps-based Authentication Scheme for Wireless

Body Area Networks

Gaimei GAO 1,2

, Xinguang PENG 1,Ye TIAN

1,3, Zefeng QIN

4

1. College of Computer Science & Technology, Taiyuan University of Technology, Taiyuan 030024, China;

2. Department of Computer Science and Technology, Taiyuan University of Science and Technology, Tai Yuan

030024, China;

3. Center of Computer, Taiyuan Normal University, Tai Yuan 030012, China;

4. Department of Computer Science, Shanxi Youth Vocational College, Tai Yuan 030032, China.

Correspondence should be addressed to Xinguang PENG; sxgrant@126.com

Abstract: As a technology of monitoring and recording human body

health signals, wireless body area networks (WBANs) plays an

increasingly important role in the field of healthcare. Inspired by the semigroup property of Chebyshev maps, we designed a novel chaotic

maps-based authentication scheme for wireless body area networks. The

study aims to avoid modular exponential computation or scalar multiplication on an elliptic curve and reduce the need for time-consuming.

Compared with the previous schemes, our scheme not only enjoys more

security features, but also has reduced computational cost of client and application provider. Moreover, we present the security model for our

scheme, demonstrate the validity of the protocol by the BAN (Burrows,

Abadi, and Needham) logic in detail, and analyze the software

implementation method of Chebyshev polynomial.

Keywords: Wireless body area networks; Identity authentication; Chaotic

map; Chebyshev polynomial; Semigroup property

1. Introduction

In wireless body area networks (WBANs) [ 1 , 2 ], with the human body as the communication center, some intelligent low-power sensor nodes are integrated in/on, or

around a human body. Low-power sensor nodes can collect important physiological

parameters of human body and surrounding environment data, then send the collected data to the intelligent mobile terminal or the base station near the body in the wireless way, and

finally transfer the data to the server for analysis and processing through the Internet. Through

the network, medical personnel can monitor the physiological information and surrounding

environmental information of users by computer and users may ask for emergency first aid. Moreover, the server can also realize real-time recording of the user data. WBANs is not only

applied in medical and health care but also applied to privacy protection. Security and privacy

are key aspects of the applications in WBANs [3]，so access control and authentication are the

major security services needed. A typical wireless body area networks is shown in Figure 1.

Authentication is to confirm the legitimacy of the two communication entities in an open

network environment; it allows two entities to establish the trust relationship and is an important component of network security technologies. Authentication can be realized via 3W

(What You Know, What You Have, or What You Are). Physiological information and health

privacy data has strict security requirements. As the first barrier, the authentication information protection system also becomes one of the key problems of WBANs. The

2

authentication enables a node to verify the legitimacy of the other sensor nodes involved in

the communication, and only messages sent by authorized nodes can be detected and accepted.

However, the authentication schemes costing more time of computation and communication

are not suitable for WBANs because of the limitations of computation capability, energy, storage space and the battery’s lifetime. Therefore, a WBANs system requires more secure

and practical authentication mechanism.

In 1981, L. Lamport [4] presented a solution to solve the problem of password-based remote authentication using cryptographic hash functions. However, high hash overhead and

the necessary consumption of password resetting lowered its practical applicability. Since

then, several improved password-based authentication schemes had been proposed [5-7]. However, most of these password-based remote user authentication schemes can only prevent

certain kinds of attacks [8-9].The authentication scheme based on symmetric key encryption

was vulnerable to smart card attack [10]. The scheme based on public key password

encryption involving modular exponentiation computation or elliptic curve algorithm [11-13] produced large computational overhead for terminal equipment. In 2009, Tseng et al. [14]

proposed the first authentication scheme based on chaotic maps. However, Niu and Wang [15]

pointed out that the scheme of [14] could not ensure user anonymity and scheme security when there was a malicious user. In order to overcome these disadvantages, Niu and Wang

also presented an improved scheme. Unfortunately, Xue and Hong [16] found that the scheme

of [15] was vulnerable to the man-in-the-middle attack. In 2013, Guo and Chang [17] pointed

out that these schemes [14-16] did not meet the requirements of key agreement, put forward a new authentication scheme based on chaotic maps, and asserted that the scheme could realize

user anonymity and resist a variety of attacks. In the same year, Hao et al. [18] pointed out

that Guo and Chang’s scheme cannot ensure user untraceability and requires the use of double secret keys. To enhance the efficiency and privacy, they presented their modified version.

Unfortunately, Lee [19] found that Hao et al.’s scheme violates the contributory property of

key agreements and it can predetermine the session key alone by a malicious participant. To handle this, Lee presents effective improvements with higher security. In addition, Jiang et

al.[20] identified that the security flaws of Hao et al. scheme is not to resist the stolen smart

card attack, and they also proposed a new chaotic map-based authentication scheme. It is a

regret that Li et al. [21] found that both Lee’s and Jiang et al.’s authentication have a serious security problem which can cause the service misuse attack, so they modified it slightly to

prevent the shortcomings. In [22] the authors proposed a key exchange scheme which worked

like Diffie-Hellman algorithm by utilizing the semigroup property of Chebyshev polynomials. The improved protocol overcomes many drawbacks of the previous chaotic key agreement

protocols. Both analysis and experimental results demonstrate that it was secure and practical.

Theoretically, the authentication schemes in WBANs could be realized by tranditional public key cryptosystem such an RSA algorithm [23] and ELGamal algorithm [24]. But in

Figure1. A Typical Scenario of WBANs

3

these algorithms, a complicated operation called modular exponentiation is needed. Rather,

the computation capability of medical sensors and control nodes in WBANs is very limited.

Hence those algorithms are not suitable for WBANs. In recent years, Liu et al.[25-26]

proposed a certificateless signature (CLS) scheme and designed two certificateless remote anonymous authentication schemes for WBANs. The two schemes involved the bilinear

paring operation, and the computation complexity of a pairing operation is several times of

that of an elliptic curve point multiplication. Moreover, the first scheme did not realize user anonymity because a constant value related to client’s identity should be transferred via the

network, and the second security enhanced authentication scheme was vulnerable to the

stolen-verifier attack. Therefore, the scheme of Liu et al. was not suitable for WBANs. In 2014, Zhao [27] presented an identity (ID)-based efficient anonymous authentication scheme

for WBANs with elliptic curve cryptosystem (ECC), the proposed scheme avoided the

complicated bilinear pairing operation and saved the additional computation to verify the

legality of certificate. However, the proposed scheme requires the elliptic curve point multiplication, thus increasing the computation cost.

In the paper, we studied the intrinsic characteristics of WBANs, compared existing

remote authentication schemes, and proposed a chaotic maps-based authentication scheme for WBANs. Our scheme took full advantage of the semigroup property of Chebyshev chaotic

map. In the new scheme, two entities in communication did not need to establish a public key

encryption system in advance and the modular exponential calculation and elliptic curve

scalar multiplication were avoided in the authentication phase. Besides we analyze validity, security and computational cost of the scheme, and also demonstrate the security model for

the scheme and software implementation of Chebyshev polynomial. We think the proposed

scheme was more suitable for WBANs. The rest of the paper is arranged as follows. Section 2 briefly introduces the preliminaries

of Chebyshev chaotic maps. Section 3 elaborates scheme’s design, including design

architecture, three phases of the authentication scheme, and password change phase. Section 4 is performance analysis, it gives the scheme’s security model, the validity proof of our

scheme by BAN logic in detail, security analysis of defense variety attacks, software

implementation of Chebyshev polynomial and computational cost comparison with recently

published schemes. Section 5 presents the conclusion.

2. Chebyshev chaotic maps

In this section, we firstly described Chebyshev polynomials. The definitions of

Chebyshev polynomials [28] are provided as follows:

Definition 1 Let n be an integer and , [ 1,1]n Z x . The Chebyshev polynomial

( ) :[ 1,1] [ 1,1]nT x is defined as:

( ) cos( arccos( ))nT x n x

Where the trigonometric function [13] cos( )x is defined as cos( ) : [0, ]x R and

arccos( )x is defined as arccos( ) :[ 1,1] [0, ]x .

Then, the recurrence relationship of Chebyshev polynomial is defined as

1 2( ) 2 ( ) ( ), 2n n nT x xT x T x n , where 0 ( ) 1T x and 1( )T x x .

Here are some examples of Chebyshev polynomials: 2

2 ( ) 2 1T x x ; 3

3( ) 4 3T x x x ; 4 2

4 ( ) 8 8 1T x x x ; 5 3

5( ) 16 20 5T x x x x .

Chebyshev polynomials satisfy the following important characteristics [29-31], the

semigroup property and the chaotic property.

(1) Semigroup property

4

One of the most important properties of Chebyshev polynomials is called the semigroup

property:

( ( )) ( )r s rsT T x T x ， , , [ 1,1]r s Z s

According to the semigroup property, Chebyshev polynomial meets the following

conditions:

( ( )) ( ) ( ( ))r s sr s rT T x T x T T x , , , [ 1,1]r s Z s

In 2008, Zhang [32] proved that the semigroup property could be defined within the

interval (−∞,+∞) as:

1 2( ) (2 ( ) ( ))modn n nT x xT x T x p

Here 2, ( , )n x , and p is a large prime number.

Therefore, ( ( )) ( ) ( ( ))modr s sr s rT T x T x T T x p .

(2) Chaotic property

When 1n , the Chebyshev polynomial map ( ) :[ 1,1] [ 1,1]nT x of the degree n is a

chaotic map with the invariant density 2*( ) 1/ ( 1 )f x x and its positive Lyapunov

exponent ln 0n .

Chebyshev polynomials are often to be used to solve the following two kinds of

problems[20,33,35,36], which are intractable to be solved within polynomial time.

Definition 2 Chaotic maps-based discrete logarithm problem(CMDLP) Given two

elements x and y , it is computationally infeasible to find the integer n such that

( )modnT x p y .

Definition 3 Chaotic maps-based Diffe-Hellman Problem (CMDHP) Given three

elements x , ( )modrT x p and ( )modsT x p , it is computationally infeasible to compute

( )modrsT x p .

3. Design Scheme

3.1. Design architecture

As show in Figure 2, three kinds of participation objects are involved in the authentication protocol for WBANs: the WBANs client, the network manager (NM) and the application

provider (AP). WBANs client refers to the users who can obtain certain service from AP

through WBANs terminals or applications such as PDA, smartphone, biosensor or medical

equipment. AP may be a hospital, a clinic or a physician, which can provide medical service through WBANs. NM is responsible for creating the private key between the client and the

application service provider. It is not necessarily the strong trusted third party (TTP) because

it only issues one part of the private key of a legitimate user. However, this part of the private key is not adequate to pretend to be a legitimate client. TTP is a trusted third party in the

network, and it may be a trusted server or a key distribution center. TTP shares different

secret key with each participant and all of these keys will be in place before protocol begins.

In our scheme, we have not employed TTP, because (1) TTP needs to know user’s identity to search the session key which is contrary to the anonymity of the user; (2) more steps will lead

communication burden and computational load, which neglects the resource constraints of

WBANs;(3) even though the server is pretended by malicious user, it could not obtain user’s

random number b because user sends ( )h PW b but not b to server by secure channel in the

registration phase. When malicious user guess a random number to authenticate, it will

arise '

u uX X , so the authentication will be aborted. In a practical application, NM may be a

commercial organization which has been delegated as the private key generator for managing

the registration system.

5

3.2. Authentication scheme

In this section, we will elaborate our remote authentication scheme for WBANs. The proposed scheme has three phases: the initialization phase, the registration phase, and the

authentication phase. The notations used in this scheme are provided below:

Notation Description

U a user or a user’s computing device with the smart card

ID U ’s identity

PW U ’s password

S the remote server for the WBANs

mk The secret key shared betweenU and S when registration

sk the session key established betweenU and S

SC smart card

AU attacker

T time threshold

( )h a secure one-way hash function

the bitwise XOR operation

the concatenation operation

3.2.1. Initialization phase

This phase is also called parameter generation phase. In this phase, S firstly creates the

system parameters, including the secret key mk with the length of at least 256 bits, a random

number ( , )x and a one-way hash function ( )h . The generation process of a random

number is similar to that in the C++ program language. First create a seed, and then provide a

random number.

3.2.2. Registration phase

If the userU wants to be a legal user, the following steps must be executed between

U and S through a secure channel, as shown in Figure 3.

Step 1. U chooses an identity ID , a password PW and a random number b , and then

sends ID and ( )h PW b to server through a secure channel.

Step 2. Upon receiving ID and ( )h PW b , S selects a random number p and

computes ( )uX h ID mk and ( )uY X h PW b , then stores{ , , ( ), , ( ), }u mkX Y h x T x p into

the smart card, and publishes it toU .

Step 3. U computes uY Y b , and replaceY with uY , then stores the random number

b into the smart card and completes the registration phase.

Table1 Notations used in this scheme

Figure2. Working Flow in the Authentication Scheme for WBANs

6

3.2.3. Authentication phase

A legal userU with valid smart card can establish the secure and authorized session with

the server. When the users want to request some services, they firstly carry out the mutual authentication and then consult the session key that will be used in the future for the secure

transmission of data. As shown in Figure 4, the authentication between the user and the server

consists of the following steps.

Step 1. UserU inserts the smart card SC into a card reader, and then enters his/her

password PW . The smart card generates a random number u and computes 1 ( )moduC T x p ,

( ( ))modu mkKA T T x p , ( )uX Y h PW and ( )DID ID h KA , then creates the message

1( )us uM h ID DID X C KA and send the login message 1 1 1{ , , }usM C DID M T

to S through a public channel, where 1T is the current timestamp.

Step 2. Upon receiving the request message, S checks whether 2 1T T T holds, where

2T is the current timestamp. If it does not hold, S terminates the session; otherwise S

computes ' ( ( ))modmk uKA T T X p ,' '( )ID DID h KA ,and ' ( )uX h ID mk .Then S

checks whether ' ' '

1( )u ush ID DID X C KA M ,If not, S also terminates the session;

otherwise S generates a random number r and computes 2 ( )modrC T x p and the session

key ( ( ))modr usk T T x p . Finally S computes ' '

2( )suM h ID C KA sk and sends the

response message 2 2 3{ , }suM C M T to the userU , where 3T is the current timestamp.

Step 3. After receiving the response message 2M , the smart card SC verifies whether

4 3T T T holds, where 4T is the timestamp. If not, SC terminates the session; otherwise

SC computes ' ( ( ))modu rsk T T x p , then SC checks whether '

2( ) suh ID C KA sk M , If

not, SC terminates the session; otherwise U computes '( )skM h KA sk and sends

3 { }skM M to server S .

Step 4. Upon receiving the message 3M , S checks the equation '( ) skh KA sk M whether

holds. if it is true, the verification betweenU and S succeeds and mutual authentication is

accomplished. The session key is correct and bothU and S can use sk to communicate with

each other in safety. Otherwise, this connection will be stopped.

Figure3. Registration phase

7

3.3. Password change phase

In addition to the above three phases, the system also provide the function of changing the

password. A legal user U with smart card can change the password of the smart card in the

following steps:

Step 1. User U inserts his/her smart card SC into a card reader, and enters the old

password PW .

Step 2. In order to verify the correctness of the input, the smart card SC establishes a

certification session with the server S as described in the above authentication phase. If the

user inputs the correct identity and password, the mutual authentication succeeds and then the

userU inputs a new password newPW .

Step 3. Smart card SC computes ( )new u newY X h PW and replaces Y with newY .

4. Performance Analysis

In this section, we will analyze the validity, security and efficiency of our protocol. First,

we demonstrate the security model, and then use Burrows-Abadi-Needham (BAN) logic to confirm the correctness of the proposed protocol. Second, we will explain that our protocol

can withstand various attacks. The third is the discussion of the efficiency about our proposed

protocol.

4.1. Security model

In order to make our scheme resists the known attacks in the authentication protocol, so

the method of provable security is used. The proof of security is in the random oracle model

and is based on the model proposed by Abdalla and Pointcheval [34]. The model [35,36]

which we use is as follows:

Figure 4.Authentication phase

8

4.1.1 Participants

Each participant of an authentication protocol is either a client1 2{ , ,..., ,... }i nU U U U U or

a server S . We refer to the i-th instance ofiU in a session as i

U, and the instance of the server

is denoted byS

4.1.2 Adversary model

The communication network is assumed to be a potentially controlled by an adversary ,

who has the ability to intercept, block, inject, remove or modify any messages transmitted

over the public network. The adversary is allowed to access to the following queries in any

order.

( , )i

U SExecute : This query models passive attacks. It outputs the messages that were

exchanged during the honest execution of the client instance i

Uand server instance

S.

( , )k

cSend M : This query models active attacks. Adversary can send a message

through this oracle to k

c, where ( , )c U S . Then k

creturns some messages, which are

computed by k

cbased on the proposed scheme, to .

Re ( )k

cveal : This query models the misuse of session key. can obtain a session key

from the oracle k

c. If the oracle k

chas accepted, then it returns the session key to .

Otherwise, k

c returns a null value to .

( )Corrupt U : This query models the adversary to corrupt a protocol participantU , i.e.,

can get the secret information aboutU .

( )k

cTest : This query measures the semantic security of the session key sk . To respond

to this query, the oracle k

c chooses a random bit {0,1}b . If 1b , then k

c returns the

session key sk . Otherwise, it returns a random value. Adversary can send only a single

query of this form to k

c .

( )ih m : In this query, when an adversary does this hash query with message im , k

c returns a random number ir and add ( , )i im r into a list hL . From the every beginning,

the list is empty.

4.1.3 Security proof

Here we show that the proposed scheme can provide the secure authentication and key

agreement under the assumption of CMDHP.

Theorem 1 Suppose that can violate the proposed protocol with a non-negligible

probability. makes uq query to the oracle of the user i

U , sq query to the oracle of the

server S and hq query to ( )h .Then we can design an algorithm to solve the Chaotic

maps-based Diffie-Hellman Problem(CMDHP) with a non-negligible probability.

Proof Firstly, we assume the type of attack which forges the user to communicate with

server. Then we can construct an algorithm to solve the CMDHP, i.e., returns

( )modurT x p from an instance of{ , ( )mod , ( )mod }u rx T x p T x p by CMDHP, where *, pu r Z .

For an instance of CMDLP is { , ( ), }mkx T x mk . B simulates the system initializing

algorithm and registration phase to generate the parameters{ , ( ), ( )}mkx T x h to . B interacts

with as follows.

( )h query: B holds a list hL of tuples ( , )i istr h . When queries the oracle ( )h on ( , )i istr h ,

B responds as follows:

9

Ifistr is on

hL , B returnsih to . Otherwise, B randomly chooses an integer

ih which is the

only inhL , and adds ( , )i istr h into

hL , then responds withih .

Re ( )veal query: When the adversary makes a Re ( )u

cveal query, B responds as

follows.

If u

cis not accepted, B returns a null value to . Otherwise, B examines the list

hL and

responds with the correspondingih .

( )Send query: When the adversary makes a query ( ," ")u

cSend start , B responds as

follows. If u u

c U, B follows the proposed steps. Otherwise, B generates a random

number *mk , computes * ( )mk

T x and replaces ( )mkT x with * ( )mk

T x . completes the subsequent

certification by using * ( )mk

T x . B responds with *

*

1{ , , }us

C DID M .The simulation works

successfully since cannot distinguish whether*

*

1{ , , }us

C DID M is correct or not only

when knows the identity ID and the password PW .

When the adversary makes a *

*

1( ,( , , ))u

c usSend C DID M query, B responds as follows.

If u u

c U, B cancels the game. Otherwise, B computes 'KA , 'ID ,and '

uX with *mk . B checks

whether *

* ' '

1( ' || || || || )u ush ID DID X C KA M holds or not. If it holds, B computes

2 ( )modrC T x p , ( ( ))modr usk T T x p , and responds message*2{ , }

suC M according to the

proposed protocol.

When the adversary makes a query *2( ,( , ))u

c suSend C M , B responds as follows. If

u u

c U, B cancels the game. Otherwise, B computes * ( ( ))modr usk T T x p .

If can violate a user to the authentication, it means that can get mk from ( , ( ))mkx T x ,

get ( ( ))modr usk T T x p from ( , ( )mod , ( )mod )u rx T x p T x p , and get ( || )h ID PW from the list

hL . Therefore, if can violate a user to authenticate with server, B must solve the CMDHP

problem with a non-negligible probability. This is contradiction to the computation infeasible

to the CMDHP problem.

To sum up, we can see that the possibility of pretend to be the user authenticate with

the server is negligible.

4.2. Authentication proof based on BAN logic

BAN logic [37-39] is a formal logic analysis method based on the belief, it achieves from the initial belief to the final purpose of the operation through sending and receiving of the

message during the running of authentication protocol. It is a well-known formal model used

to analyze the security of authentication and key agreement schemes. In this section, we first present the notations, rules, goals and assumptions. Then we verify the validity of our

protocol. The details are shown as follows.

4.2.1 Notations and rules

First of all, let us define P , Q as participators, and X as a formula. In order to use the

BAN logic, some notations and rules used in BAN logic analysis are given below.

• |P X : P believes that in the current run of the protocol that the formula X is true.

• P X : P sees or holds formula X .

• P X : P has complete control over the formula X . This can be used to express a

certificate authority.

• |~P X : P has once said the formula X .

• #( )X : The formula X is fresh, which means that X is recent or X is a nonce.

10

•k

P Q : P and Q share a secret key k . The secret key is only usable in the

communication between P and Q , and is only known to P and Q .

•{ }kX : The formula X is encrypted by key k .

• ( , )X Y : X or Y is one part of formula ( , )X Y .

Rule 1 The message meaning rule (for shared secret keys):

| , { }

| |~

k

k

P Q P P X

P Q X

When P sees a message which is encrypted with the shared key k of P and Q , then P

believes that Q has said the X .

Rule 2 The nonce verification rule

| #( ), | |~

| |

P X P Q X

P Q X

If P believes that X is a recent message and that Q once said X , then P believes that

Q believes X .

Rule 3 The jurisdiction rule

| , | |

|

P Q X P Q X

P X

If P believes that Q has jurisdiction over X , and P believes that Q believes the X , then

P believes X .

Rule 4 The freshness rule

| #( )

| #( , )

P X

P X Y

If one part of a formula X is known to be fresh, then the entire formula must also be fresh.

Rule 5 The message of elimination of multipart rules

( , )P X Y

P X, YP X

P X,

| , { }k

k

P Q P P X

P X,

| ( , )

|

P X Y

P X,

| |~ ( , )

| |~

P Q X Y

P Q X,

| | ( , )

| |

P Q X Y

P Q X

These rules show that how principal handle multipart message.

The idealized forms for our protocol, as illustrated in Figure 4, expressed by the BAN

logic are as follows.

Message 1: .: ,{ } , ( ,{ } ,{ } )u u u mkU S DID X h DID X X

Message 2: :{ } , ({ } ,{ } , )sk

r r mk uS U X h X X U S

Message 3: : ({ } , )sk

uU S h X U S

4.2.2 Goals

According to the analytic procedures of BAN logic, the proposed protocol has the

following four goals, the goals of our protocol are shown as formula 1 4G G in the language

of the BAN logic.

1: |sk

G U U S

2: |sk

G S U S

3: | |sk

G U S U S

4: | |sk

G S U U S

11

4.2.3Assumptions

The following assumptions about the initial state are made to analyze our protocol by

using the BAN logic.

1: | #( )A U u

2: | #( )A S r

3: |mk

A U U S

4: |mk

A S U S

5: | |mk

A U S U S

6: | |mk

A S U U S

7 : | |sk

A U S U S

8: |sk

A S U S

4.2.4 Verification

We use the rules and assumptions based on the BAN logic to analyze the idealized form

of the proposed protocol, the main steps of the proof are described as follows.

Message 1: .: ,{ } , ( ,{ } ,{ } )u u u mkU S DID X h DID X X

According to the message1, we obtain:

S1: .,{ } , ( ,{ } ,{ } )u u u mkS DID X h DID X X

According to the assumption 4A , Rule 1, and Rule 5, we obtain:

S2: | |~{ }uS U X

S computes the session key :{ }sk

r uU S X

Message 2: :{ } , ({ } ,{ } , )sk

r r mk uS U X h X X U S

According to the message 2, we obtain:

S3: ({ } ,{ } , ),{ }sk

r mk u rU h X X U S X

According to the assumption 3A , Rule 1, and Rule 5, we obtain:

S4: | |~ ({ } ,{ } , )sk

r mk uU S X X U S

According to the assumption 1A , S4, and Rule 2, we obtain:

S5: | | ({ } ,{ } , )sk

r mk uU S X X U S

According to S5 and Rule 5, we obtain:

S6: | | ( )sk

U S U S (This is 3G .)

According to the assumption 7A ,S5, and Rule 3, we obtain:

S7: | ( )sk

U U S (This is 1G .)

Message3. : ({ } , )sk

uU S h X U S

According to the message 3, we obtain:

S8: ({ } , )sk

uS h X U S

According to the assumption 2A and Rule 4, we obtain:

S9: | #( )sk

S U S

According to the assumption 8A and Rule 1, we obtain:

S10: | |~ ( )sk

S U U S

12

According to S9, S10, and Rule 2, we obtain:

S11: | | ( )sk

S U U S (This is 4G .)

Therefore, we can sure that our proposed protocol is capable of achieving the goals

from 8A , S6, S7, and S11.

4.3. Security analysis

4.3.1. Anonymity

User anonymity refers to the condition that an attackerAU cannot discover anything about

the registered userU from the transmitted information. In our proposed authentication phase,

the login information1 1 1{ , , }usM C DID M T includes the dynamic ( ( ))DID ID h KA

other than ID , user’s real identity ID implicitly involved in DID , where

( ( ))modu mkKA T T x p . Thus, if the attackerAU wants to forgeU , he/she must compute KA

and derive ID from DID . However, it is computationally infeasible to find

out ( ( ))modu mkT T x p directly from ( )moduT x p and ( )modmkT x p based on the CMDHP.

Therefore, the adversary cannot retrieve ID from DID . Moreover, the login request

1 1 1{ , , }usM C DID M T is independent and different in every session because KA and random

number u is randomly selected and updated in every session. In brief, our scheme can achieve

user anonymity.

4.3.2. Mutual authentication

Mutual authentication means that the server and the user can verify each other, and establish mutual trust before visiting the patient privacy information. In our scenario, only the

legitimate user who possesses the right password and authenticated information can send the

request to the server, and only the authorized server who owns the correct secret key can verify the user’s request. Therefore, this scheme can provide mutual authentication between

the user and the server. That is to say, our proposed scheme achieves mutual authentication

between the legal user and the server.

4.3.3. Replay attack

Replay attack means that the attacker captures the message before running the protocol or

being run to attack the current agreement. In the process of authentication, both the user’s

request 1 1 1{ , , }usM C DID M T and the server’s response 2 2 3{ , }suM C M T contain a

timestamp. The valid period of each message is limited by the timestamp. Even if the attacker had intercepted the transmitted information and pretended to be a legitimate user, it will be

easily detected by checking the freshness of the timestamp. In addition, the adversary cannot

bypass the timestamp verification, because the transmitted message has been protected by the hash function. Therefore, this scheme can resist replay attack.

4.3.4. Perfect forward secrecy

Perfect forward secrecy means that the previously claimed session key remains safe even

if the long-term private keys of the server and the user are disclosed. In our scenario, it is assumed that even the current session key is compromised, and then the previously

established session key ( ( ))modu rsk T T x p remains secure because different sessions have

different random numbers, and it is computationally infeasible to calculate the session key

with ( )moduT x p and ( )modrT x p directly.

13

4.3.5. Man-in-the-middle attack

Man-in-the-middle attack refers to the condition that the attacker disguises herself as a

legitimate participant, thus making the other communication terminal think that they are

performing a direct dialogue through the secret connection. In our scheme, the attackerAU

cannot compute the value ( )uX Y h PW which is related to the random number u and the

private key mk . In addition, the attackerAU also cannot calculate the value

( ( ))modu mkKA T T x p because u is the temporarily generated random number in every

session. Therefore, the attacker cannot disguise himself/herself as a legitimate user. That is to say, our scheme can resist man-in-the-middle attack.

4.3.6. Smart card stolen attack

An attackerAU who steals a smart card can retrieve the stored data

{ , , ( ), , ( ), , }u mkX Y h x T x p b from the smart card and guess a password *PW . However, the

attacker cannot get the real information1 1 1{ , , }usM C DID M T to validate the correctness

of *PW , because ( ( ))DID ID h KA and ( ( ))modu mkKA T T x p , where the random

number u is temporarily generated for each session and different sessions has different u .

Therefore, our scheme can resist the smart card stolen attack.

4.3.7. Efficient password change phase

A user can make a denial of service attack if he/she did a little mistake which may be due to incorrect password input in the password change phase. The invalid detection of incorrect

input can lead to denial of service scenario, so we should give efficient password change

phases. In our scheme, the smart card first verifies the correctness of identity and password with the server by establishing an authorized session. Then owing to entering correct identity

and password, the authorized session can successfully established. As long as the session has

established, the smart card request a new password and initiate the password change phase.

This process shows that our proposed scheme has efficiency to detect incorrect input.

4.3.8. Privileged insider attack

A malicious privileged insider in server’s system may try to obtain a legitimate user’s

password. In the registration phase of our proposed protocol, the user U sends

{ , ( ) }ID h PW b to the server instead of PW in its original form. Therefore, a malicious

insider cannot derive the user’s password PW because hash function ( )h cannot be reverted.

Furthermore, an insider attacker cannot do password guessing attack as user submit

( )h PW b instead of the random number b itself. So our scheme can avoid the privileged

insider attack.

4.3.9. Session key verification

In the step 3 and step 4 of the authentication phase, the user sends message 3 { }skM M to

the medical server and upon receiving it, the server checks the verification whether '( || ) skh KA sk M or not. If the verification equation is true, it ensures that the session

key sk is verified. Therefore, the proposed scheme provides session key verification property.

14

4.4. Software implementation analysis and comparison

4.4.1. Software implementation

The main problem of our scheme in software implementation is computation time of the

Chebyshev polynomials ( )nT x . During the computation, a high-order polynomial is involved

in the Chebyshev chaotic map. If we directly compute the high-order polynomial according to

the definition or recursive sequence, then we can find that the computation error will be very large for the high-order polynomial. Moreover, the computation load will increase with the

increase in the order of the polynomial. In reality, the security of our proposed scheme does

not largely depend upon the high-order polynomials. Therefore, we can select a certain large

number as s in order to reduce the time for factorizing s to get ( 1,2,3...)iK i . The method

adopted in this paper is described below.

Let the Chebyshev polynomial order be 1 2

1 2 ... ikk k

is s s s ,

Then

1 1

1

( ) (... ... (... ( )))i i

i

s s s s s

k k

T m T T T T m

Therefore, the computation of ( )sT m only requires 1 2 ik k k iterations of the

Chebyshev map other than s iterations [40].

With the existing high-precision libraries, the correctness of numerical algorithms in finite

precision arithmetic may be solved. In the practical application, the security of this agreement does not completely rely on the difficulty of high-order polynomial number problem anymore.

Therefore, we may not take the most maximum values of u and r , thus further enhancing the

security of the protocol.

4.4.2. Comparison

In this section, we will compare the security and the computational cost of the proposed

scheme with the recently published scheme. In the WBANs applications, resource constraint in low cost devices must be given priority

to consider in addition to security and privacy. The used sensors for medical service are

limited with storage space, computation power and the lifetime of a battery. Firstly, we

defined some computational parameters as follows. H denotes the time for the hash operation;

S denotes the time for the encryption/decryption operation; T denotes the time for the

Chebyshev polynomial computing. As show in Table 2, comparing with the chaotic maps-based authentication, the proposed

scheme can satisfy the desirable security attributes of authentication, and overcome the

weaknesses of the existing schemes. The number of Chebyshev chaotic maps operations used in our scheme equals that in [20], but our scheme does not need symmetric en/decryption

operations. Moreover, the proposed scheme needs one more Chebyshev polynomial operation

than that in [21], but it can better guarantee the authentication on both communication sides. In addition, the proposed scheme supports the function of session key verification and

efficient password changing, however, the schemes [18-21] not provide efficient password

changing phase and the schemes [18-21,40] lack the verification of session key.

15

Hao et al.

[18]

Lee

[19]

Jiang et al.

[20]

Li et al.

[21]

Mishra et al.

[40]

Our scheme

Registration phase

User side

1H 2H H 2H H H

Server side

1 1 1H S T 2H 1 1S T 3H 2 1H T 1 1H T

Authentication phase

User side

3 2 2H S T 7 2H T 2 1 3H S T 8 2H T 5 1H T 4 3H T

Server side

2 3 2H S T 8 2H T 1 2 3H S T 9 2H T 5 1H T 4 3H T

User anonymity

Privileged insider attack

Mutual authentication

Replay attack - -

Perfect forward secrecy - -

Man-in-the-middle attack -

Smart card stolen attack

Efficient password chan-

ge phase

Session key verification

Table 3 shows the comparison of computational cost among our proposed scheme and the

other two schemes in WBANs. Here, we established the simulation hardware environment and evaluated the computation overhead of this scheme. The simulation environment of AP is

Windows 7 OS (a Pentium(R) E5300 2.6 GHz processor and 2GB RAM). The simulated

WBANs client is run in Android OS 5.0 (64-bit processor and 32GB memory). Otherwise, Table 3 shows the computational cost comparison at the client and application provider in the

authentication phase among three related schemes in WBANs. In our proposed scheme, it is

obvious that the computational overhead is superior to the other two schemes both at the WBANs client and the application provider. In our authentication protocol based on

Chebyshev polynomials, the semigroup property of Chebyshev polynomials is utilized to

achieve the mutual authentication and acquire the common session key. At the beginning of

the authentication, we do not need to establish the public key cryptographic system. In the authentication phase, we save the time for modular exponential computing and scalar

multiplication on elliptic curves which are involved in previous agreements. Therefore, in our

scheme, the calculation load is decreased. It is obviously seen from Table 4 that the proposed scheme not only satisfy the existing

security attribute of [26, 27] but also satisfy the efficient password change. So it can achieve

the desirable safety demands of WBANs. Moreover, the proposed scheme has the less

computational cost than previous results [26,27]. In conclusion, our proposed scheme takes into account not only the security properties but also the computation overhead of APs and

WBANs client.

Table 2 Comparisons among our scheme and other related chaotic maps-based schemes

: Scheme prevents this attack or satisfies the attribute

: Scheme fails to prevent the attack or does not satisfy the attribute

-: Not mentioned

16

Liu et al.’s [26] Zhao et al.’s [27] Our scheme

Client (s) ≈0.18619 ≈0.09201 ≈0.06853

Application provider(s)

≈0.03983 ≈0.03829 ≈0.03623

Security attribute Liu et al.’s [26] Zhao et al.’s [27] Our scheme

User anonymity

Privileged insider attack -

Mutual authentication

Replay attack -

Perfect forward secrecy -

Man-in-the-middle attack -

Smart card stolen attack -

Efficient password change phase - -

Session key verification

5. Conclusion

In this paper, we proposed a chaotic maps-based authentication scheme for WBANs. This

scheme can not only realize user anonymity but also resist a variety of attacks. Moreover, the scheme makes full use of Chebyshev polynomial’s semigroup feature to create the session

key. In the authentication phase, it reduces the computation time by eliminating the modular

exponential and the scalar multiplication on elliptic curve. In addition, it is not required to

create a public cryptographic system in advance. We presented the security model for our scheme and verified the validity of the protocol,

demonstrated its security property, analyzed the key implementation point of Chebyshev

polynomial and compared computation overhead of the related schemes. Through the above analysis, we think the proposed scheme is more suitable for WBANs.

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this

paper.

References

Table 3 A comparison of computational cost of different schemes in WBANs

Table 4 Security attributes comparison with some recently proposed schemes in WBANs

: Scheme prevents this attack or satisfies the attribute

: Scheme fails to prevent the attack or does not satisfy the attribute

- : Not mentioned

17

[1] T.G. Zimmerman, “Personal area networks: near-field intrabody communication”, IBM System Journal, vol. 35, no. 3-4, pp. 609–617, 1996.

[2] Y. Tian, Y. Peng, X. Peng, and H. Li, “An Attribute-Based Encryption Scheme with Revocation for Fine-Grained Access Control in Wireless Body Area Networks”, International Journal of Distributed Sensor Networks, Volume 2014, Article ID713541.

[3] M.A. Ameen, J. Liu, and K. Kwak, “Security and privacy issues in wireless sensor networks for healthcare applications”, Journal of Medical Systems, vol.36, no. 1, pp. 93–101, 2012.

[4] L. Lamport, “Password authentication with insecure communication”, Communications of the ACM, vol. 24,

pp. 770–772, November 1981. [5] M. Sandirigama, A. Shimizu, and M.T. Noda, “Simple and secure password authentication protocol(sas)”,

IEICE TransActions on Communication, vol. 83, no. 6, pp. 1363–1365, 2000. [6] N. Haller, “The s/key one-time password system”, in Proceedings Internet Society Symposium on Network and

Distributed System Security, pp. 151-158, 1994. [7] T.H. Chen and W.B. Lee, “A new method for using hash function to solve remote user authentication”,

Computers and Electrical Engineering, vol. 34, no.1, pp.53–62, 2008. [8] G. Jaspher, W. Kathrine, E. Kirubakaran, and P. Prakash, “Smart card based remote user authentication schemes:

A survey”, in Proceedings of the 3rd International Conference on Computing Communication & Networking Technologies (ICCCNT’11), pp.1-5, IEEE, 2012.

[9] R. Madhusudhan and R.C. Mittal, “Dynamic ID-based remote user password authentication schemes using smart cards: A review”, Journal of Network and Computer Applications, vol. 35, No. 4, pp. 1235–1248, 2012.

[10] C.G. Ma, D. Wang, and S. Zhao, “Security flaws in two improved remote user authentication schemes using smart cards”, International Journal of Communication Systems, vol. 27, pp.2215-2227, 2014.

[11] D. Xiao, X. Liao, and S. Deng, “A novel key agreement protocol based on chaotic maps”, Information Sciences, vol. 177, no. 1, pp. 1136-1142, 2007.

[12] J. C. Mason and D. C. Handscomb, “Chebyshev polynomials”, Chapman & Hall/CRC, Boca Raton, 2003.

[13] P. Bergamo, P. D’Arco, A. Santis, and L. Kocarev, “Security of public-key cryptosystems based on Chebyshev polynomials”, Circuits and Systems I: Regular Papers, vol. 52, no.7, pp. 1382–1393, IEEE, 2005.

[14] H. Tseng, R. Jan, and W. Yang, “A chaotic maps-based key agreement protocol that preserves user anonymity”, In Proceedings of the IEEE International Conference on Communications (ICC’09), pp.1–6, 2009.

[15] Y.J. Niu and X.Y. Wang, “An anonymous key agreement protocol based on chaotic maps”, Communications in Nonlinear Science and Numerical Simulation, vol. 16, no. 4, pp.1986–1992, 2011.

[16] K.P. Xue and P.L. Hong, “Security improvement on an anonymous key agreement protocol based on chaotic maps”, Communications in Nonlinear Science and Numerical Simulation, vol. 17, no. 7, pp. 2969-2977, 2011.

[17] C. Guo and C.C. Chang, “Chaotic Maps-Based Password-Authenticated Key Agreement Using Smart Cards”, Communications in Nonlinear Science and Numerical Simulation, vol. 18, no. 6, pp. 1433-1440, 2013.

[18] X. Hao, J. Wang, Q. Yang, X. Yan, and Li, P., “A Chaotic Map-Based Authentication Scheme for Telecare Medicine Information Systems”, Journal of Medical Systems,vol.37, no.2, pp.1-7, 2013.

[19] T.F. Lee, “An Efficient Chaotic Map-Based Authentication and Key Agreement Scheme Using Smartcards for telecare Medicine Information Systems”, Journal of medical Systems,vol.37, no.6, pp. 1-9, 2013.

[20] Q.Jiang, J.Ma, X.Lu, and Y.Tian, “Robust Chaotic Map-Based Authentication and Key Agreement Scheme with Strong Anonymity for Telecare Medicine Information Systems”, Journal of medical Systems,vol.38,

no.12, pp.1-12, 2014. [21] C.T. Li, C.C. Lee, and C.Y. Weng, “A Secure Chaotic Maps and Smart Cards Based Password Authentication

and Key Agreement Scheme with User Anonymity for Telecare Medicine Information Systems”, Journal of medical Systems,vol.38, no.77, pp. 1-11, 2014.

[22] X. Wang and J. Zhao, “An improved key agreement protocol based on chaos”, Communications in Nonlinear Science and Numerical Simulation, Vol. 15, no. 12, pp. 4052–4057, 2010.

[23] R.L. Rivest, A. Shamir, and L. Adleman, “A method for obtaining digital signatures and public key cryptosystems”, Communications of the ACM, vol. 21, no.2, pp.120–126, 1978.

[24] T. ElGamal, “A public key cryptosystem and a signature scheme based on discrete logarithms”, IEEE Transactions on Information Theory, vol.31, no.4, pp.469–472, 1985.

[25] J. Liu, Z. Zhang, X. Chen, and K. Kwak, “An Efficient Certificateless Remote Anonymous Authentication Scheme for Wireless Body Area Networks”, in proceedings of IEEE international conference on Communications (ICC’12), pp.3404-3408, 2012.

[26] J.Liu, Z. Zhang, X.Chen, and K. Kwak, “Certificateless remote anonymous authentication schemes for wireless body sensor networks”. IEEE TransActions on Parallel Distributed System, Vol. 25, no. 2, pp. 332–342, 2014.

[27] Zh. Zhao, “An Efficient Anonymous Authentication Scheme for Wireless Body Area Networks Using Elliptic

Curve Cryptosystem”, Journal of Medical Systems, vol. 38, no. 13, pp. 1-7,2014. [28] C.C. Lee, C.W. Hsu, and Y.M. Lai, A. Vasilakos, “An Enhanced Mobile-Healthcare Emergency System Based

on Extended Chaotic Maps”, Journal of medical Systems, vol. 37, no. 5, pp.1-12, 2013. [29] S. Han and E. Chang, “Chaotic map based key agreement with/out clock synchronization”, Chaos, Solitons &

Fractals, vol. 39, no. 3, pp. 1283–1289, 2009. [30] C.C. Lee, C.L. Chen, C.Y. Wu, and S.Y. Huang, “An extended chaotic maps-based key agreement protocol

with user anonymity”, Nonlinear Dynamics, vol. 69, no. 1–2, pp.79–87, 2012.

18

[31] D. He, Y. Chen, and J. Chen, “Cryptanalysis and improvement of an extended chaotic maps-based key agreement protocol”, Nonlinear Dynamics, vol. 69, no.3, pp.1149–1157, 2012.

[32] L. Zhang, “Cryptanalysis of the public key encryption based on multiple chaotic systems”, Chaos, Solitons & Fractals, vol. 37, no. 3, pp. 669–674, 2008.

[33] C.C. Lee and C.W. Hsu, “A secure biometric-based remote user authentication with key agreement scheme using extended chaotic maps”, Nonlinear Dynamics, vol. 71, no.1-2, pp. 201–211, 2013.

[34] M. Abdalla, D. Pointcheval, “Interactive Diffie-Hellman assumptions with applications to password-based authentication”, In: Proceedings of FC’05, LNCS 3570, pp 341–356, 2005.

[35] H. Zhu and X. Hao, “A provable authenticated key agreement protocol with privacy protection using smart card based on chaotic maps”, Nonlinear Dynamics, vol. 81, no.1-2, pp. 311–321, 2015.

[36] S.K. Hafizul, “Provably secure dynamic identity-based three-factor password authentication scheme using extended chaotic maps”, Nonlinear Dynamics, vol. 78, no.3, pp. 2261–2276, 2014.

[37] M. Burrows, M. Abadi, and R.M. Needham, “A logic of authentication”, Proceedings of the Royal society of London A-Mathematical and Physical Sciences, 1989(426), 233-271.

[38] J. Wessels, “Application of BAN-logic”, CMG Public Sector B.V.(2001), Available at http://www.win.tue.nl/ ipa/ archive/springdays2001/banwessels.pdf, Access date:2015/12/11.

[39] D. Mishra, J. Srinivas, S. Mukhopadhyay, “A secure and efficient chaotic map-based authenticated key agreement scheme for telecare medicine information systems”, Journal of medical Systems, vol. 38, no. 10, pp. 1-12, 2014.

[40] L. Kocarev, J. Makraduli, and P. Amato, “Public-key encryption based on Chebyshev polynomials”, Circuits systems signal processing, vol. 24, No.5, 2005, pp.497-517.