Efficient Anonymous Key Exchange Protocol for Roaming in Wireless Networks

Transcription

1 Iteratioal Joural of Scietific Research Egieerig & Techology (IJSRET), ISSN Efficiet Aoymous Key Exchage Protocol for Roamig i Wireless Networks 1 Joshua J. Tom, 2 Prof. Boiface K. Alese, 3 Prof. Olumide S. Adewale, 4 Dr. Aderoke F. Thompso 1,2,3,4 Departmet of Computer Sciece, Federal Uiversity of Techology, Akure, Nigeria 1 tomjoshua.tom@gmail.com, 2 bkalese@futa.edu.g, 3 adewale@futal.edu.g, 4 afthompso@futal.edu.g Abstract Group sigature schemes existetially provide aoymity, o-repudiatio ad ca make a mobile device utraceable. But usig group sigature oly i desigig aoymous key exchage system is time wastig ad cosumes much of other computig resources hece the use of it must be miimal especially whe deployed o resources-costraied mobile devices. I.this paper, we propose the combied use of group sigature because of its iheret security properties which are very importat whe a mobile user roams i the isecure wireless etwork ad message autheticatio code to reduce the huge computatioal burde occasioed by group sigature s expesive public key operatios resultig i ubearable autheticatio latecy. I this paper, we built two autheticators, a sigature based autheticator ad a message autheticatio code based autheticator. These models are based o the Caetti-Krawczyk model. We implemeted the desig usig Java 8 o Adroid Studio 2.2 ad tested it o Geymotio based emulator o Oracle VM VirtualBox. The experimet result showed a sigificat reductio i the autheticatio time whe message autheticatio code based autheticator was executed compared to autheticatio time result i the group sigature based autheticator. We further compared our model with a similar model ad fid that ours was superior i efficiecy measured from autheticatio latecy whe a user roams from his home domai to a visited etwork ad other etworks subsequetly while maitaiig same security characteristics. Keywords: Wireless etwork, Roamig, Autheticatio, security, Aoymity, utraceability, Autheticatiolatecy, Groupsigature, message autheticatio code, mobile device, Aoymous key exchage, Visited etwork 1. INTRODUCTION Nowadays we have witessed the expasive deploymet of wireless etworks locally ad iteratioally. This, expectedly, is eabled by availability ad affordability of mobile devices icludig PDAs, smart phoes, etc. This proliferatio ehaces the mobile users mobility as these techologies allow people to get coected seamlessly, have access to, ad ejoy ormal etwork services as they move about from their local domai to a foreig domai without beig limited by geographical coverage of their home etwork. A wireless etwork that provides its subscribers with the ability to access services while outside its coverage is said to provide roamig services. Before access is grated to roamig users by foreig etworks, these users must be autheticated. Autheticatio ivolves esurig that etwork services are ot obtaied frauduletly hece, it is very crucial that the idetities of mobile users egaged i roamig must be autheticated to prevet illegal use of resources, etc. However, the autheticatio credetials of these mobile users must be protected from third parties to esure privacy of users. Aoymous roamig is a key requiremet whe people roam amog visited etworks. Allowig third parties, such as eavesdroppers, access to users roamig data ca have very serious cosequeces to the detrimet of the user. Firstly, the real idetity of the mobile user must ot be kow by ayoe else except the mobile user ad the home etwork. This is referred to as idetity aoymity. Secodly, the locatio of the mobile user should also be kept secret from other etwork users while abroad. We refer to this as locatio aoymity. A privacy policy specificatio ca require the home etwork to gai kowledge of the real idetity of a mobile user oly whe it is extremely ecessary such as whe the foreig etwork bills the home etwork for services ejoyed by the mobile user or whe the mobile user exhibits malicious behavior or breaks oe the rules a warrat of revocatio ca be issued by a costituted authority to reveal such user s real idetity. To realize the sceario above a aoymous autheticatio protocol desig is a good way to achieve it. We must always take cogizace of the limited computatioal resources of mobile termial to keep the protocol ot too complex. I a roamig sceario, there are typically three etities ivolved: the home etwork, the roamig mobile user ad the visited foreig etwork. It is atural for the home etwork that must have a roamig agreemet with the visited etwork. Where this is applicable, the visited etwork must autheticate home etwork s subscribers before gratig them access to its roamig services they roam to visited etwork. Most existig autheticatio protocols such as those of [6], [7], [8], ad [9] require a mobile user, the visited etwork, ad the home etwork to participate i the roamig service. These protocols

2 Iteratioal Joural of Scietific Research Egieerig & Techology (IJSRET), ISSN adopt three-party autheticatio techique. The disadvatages of this techique iclude: first, may iteractive message flows are eeded (ot less tha 4 flows). Here it takes a log time for the home server to commuicate with the visited server because they are far away from each other; secod, the home server must always be olie ad available makig it vulerable to autheticatio problem; third, accordig to [10], sice the visited server must verify messages by commuicatig with the home server, there may be a Deial-of-Service (DoS) attack o the protocol because the home server will be verifyig a lot of messages set to it from visited servers. The structure for a three-party autheticatio is show i figure 1. Mobile User Autheticatio ad key establishmet Figure 1: Three-Party Autheticatio Architecture To improve upo the lapses of most three-party autheticatio protocols, recetly aoymous autheticatio schemes ivolvig oly the roamig mobile user ad the visited etwork have received sigificat research attetio ad have made some progress. These protocols which do ot eed the realtime participatio of the home etwork i the autheticatio process are referred to as two-party autheticatio protocols show i figure 2. Examples of two-party protocols iclude those of [11] ad [12]. Mobile User Access Foreig Server Autheticatio data request Autheticatio data respose Mutual Autheticatio ad key establishmet Home Server Foreig Server Figure 2: Two-Party Autheticatio Architecture Although autheticatig a mobile user is pertiet, the privacy of the user is paramout. Roamig autheticatio protocols exposes the users privacy i terms of their idetities ad locatio iformatio at the autheticatio phase. The disclosure of a user s idetity may allow uauthorized etities to track the user s movemet history ad curret locatio ad therefore create users behavior profiles. Ay illegal access to iformatio relatig to the user s locatio without his attetio ca be a serious violatio of his privacy. Idetity ad locatio aoymity are importat properties for roamig services ad these aoymity characteristics are the focus of this paper. 2. RELATED WORKS I [1] a aoymousautheticatio protocol based o group sigature for mobile roamig etworks was carried out.the protocol ivolves oly a mobile user ad theuser s visited server, without the real time ivolvemet of the user shome server util the user s idetity (ID) eeds to be revealed.the protocol gives a method that to reduce the computatioal burde the mobile termials, miimizes expesive pairig operatios. It was show thatthe protocol greatly reduces the average autheticatiolatecy while security ad aoymity are still preserved. The limitatio of this protocol is that foreig servers are give iformatio to idetify revoked users ad this iformatio ca eable the foreig servers to lik other protocol rus ivolvig the revoked user. Hece the protocol does esure ulikability. I [2] the authors proposed a privacy-preservig uiversal autheticatio protocol, called Priauth, which provides strog user aoymity agaist both eavesdroppers ad foreig servers, sessio key establishmet, ad achieves efficiecy. Most importatly, Priauth provides a way to trace users sigatures i idividual period, a approach that adequately tackles the problem of user revocatio ad esures ulikability while supportig strog user utraceability. But the protocol utilized expesice ad resources-hugry biliear pairig-based group sigature both whe the user coects to the first foreig etwork ad i subsequet coectios to other foreig etworks. This has great egative impact o the overall autheticatio process. A short group sigature scheme that supports Verifier- Local Revocatio (VLR) is costructed i [3]. I this model, revocatio messages are oly set to sigature verifiers ad to both sigers ad verifiers. This is appealig for systems providig attestatio capabilities. Their sigatures are as short as stadard RSA sigatures with comparable security. The security of their group sigature scheme is based o the Strog Diffie-Hellma assumptio ad the Decisio Liear assumptio i biliear groups. They gave a precisemodel for VLR group sigatures. The weakess of their protocol lies i the fact that protocol rus ivolvig the same user could be liked. Therefore the scheme does ot satisfy the backward ulikability. Agai, sice the protocol does ot cosider differetiatio i applicatio of the group sigature durig differet stages of the autheticatio, the computatioal load ivolved is boud to be high. I [4] the authors idetified verifier-local revocatio as a approach of membership revocatio i group sigatures. I the approach, oly verifiers are ivolved i the revocatio mechaism, while sigers have o

3 Iteratioal Joural of Scietific Research Egieerig & Techology (IJSRET), ISSN ivolvemet. They proposed VLR group sigature schemes with the backward ulikability from biliear maps ad asserted that their protocol is suitable for mobile eviromets sice sigers have o load. Here, we do or seem to agree totally with this assert sice group sigature schemes are kow to be aturally computatioally demadig i terms of computig resources. We believe that aoymity, utraceability, revocatio, etc. could still be achieved by usig a scheme which is computatioally less demadig. The authors i [5] proposed a ovel protocol to achieve privacy-preservig uiversal autheticatio protocol for wireless commuicatios. This is to secure the commuicatio as the data are sesitive or to esure that the user is billed for services redered i their scheme, revokig multiple users is to associate a key with every oempty subset of users i the group such that if oe or more users are revoked, the VA uses the key associated with the subset of the remaiig users to ecrypt the ew key ad trasmits the ew group key to them. The advatage of this approach is that the commuicatio overhead is oly oe message for revokig ay umber of users. However, the umber of keys stored by the VA ad the users is expoetial i the size of the group. Also, this approach suffers from all the users i the subgroup beig automatically revoked. I such case, their protocol rus ca be likable. This approach has two cots overheads;storage is computed i terms of keys that each user (respectively, VA) maitais ad revocatio cost is computed i terms of the ecryptios performed, ad the umber of messages trasmitted, by the VA. I view of related literatures, it is obvious that the focus of most of the literatures is either choosig primitives to esure privacy while tradig off computatioal expese o the commuicatig parties or beig resource efficiet while tradig off privacy cocers. Hece, this paper proposes a ew model that pays attetio to both privacy of the mobile user ad computatioal efficiecy through reduced latecy. 3. MODELLING AND SIMULATION 3.1 Methodology We divide the autheticatio process ito two; (1) whe the mobile user first roams to foreig etwork (2) whe the mobile user subsequetly roams to a differet foreig etwork. We propose to use these differet approaches because group sigature is quite a expesive cryptographic scheme therefore miimal usage is advised. Our protocol deploys group sigature scheme message autheticatio code i the two autheticatio processes respectively. The reaso for this combiatio is that group sigature existetially provides aoymity ad utraceability ad message autheticatio code is less expesive i terms of computatioal complexity. I the group sigature scheme, whe U roams to a visited etwork V, U ca sig messages o behalf of the group without showig its ID. By verifyig the group sigature, V is sure that U is oe of the valid users of H. The home server does ot eed to be always olie ad few message flows are eeded for autheticatio [12]. I cosideratio of the resources restrictiveess of mobile devices, the foreig server is made to sig messages destied for a mobile user usig the Elliptic Curve Digital Sigature Algorithm (ECDSA) scheme sice ECDSA sigature verificatio takes less time compared to its group sigature couterpart. Details of our protocol model are as follows. Our protocol is based o the system architecture is show i figure 3 ad is cosists of two phases: a iitializatio ad autheticatio phases. The autheticatio phase is divided ito two parts as earlier stated: autheticatio process whe U coects to V 1 ad autheticatio process whe U coects to V 2. Figure 3: Protocol System Architecture Model To achieve revocatio ad ulikability, the verifier local revocatio with backward ulikability (VLR-GS BU) group sigature variat is used whe U coects to the first visited server, V 1 ad mutual autheticatio code (MAC) whe U roams to the secod visited server, V Protocol Iitializatio Phase H (also kow as the group maager) computes iitializatio parameters. The parameters iclude (i) H selects a radom umber γ Z ad computes a group maager private key (gmpk) computed as: gmsk = γ (1) (ii) The group maager public key (gmpk) is give as, gmpk = (g, g, h, h, h, w) (2) where give Fq a fiite field with a elliptic curve E, G a multiplicative cyclic group of prime order p ad G a multiplicative group of expoet p, with some power of p as its order, g is a geerator of G ad g is a order-p elemet of G. The elemets g ad g will be selected at radom as part of system setup. h, h,

4 Iteratioal Joural of Scietific Research Egieerig & Techology (IJSRET), ISSN h represet radomly selected h G for each iterval j ad w is give as w= g γ. (iii) H uses the above computed parameters to geerate a vector of N user s secret keys usk ad a vector of N x T revocatio tokes (urt) for each registered user with curret time itervals to esure ulikability as follows: usk = (usk[1], usk[2],, usk[n]) (3) urt = (urt[1][1],, urt[1][t],, urt[n][t]) (4) (iv) The user secret key for N users is give as: usk[i] = (A, ) (5) Where Ai = g / γ+x i for all i [, N] ad Z is selected radomly. (v) Next, radomly selected h [, ] is used to compute the revocatio toke at time iterval j of with secret key (A, ) as: B = h x i for all i [, N] ad j N (6) (vi) H computes a alias for each registered user itedig to roam usig secret splittig mechaism from: a a = H H (7) Where ID H is the Home Server idetity, ID is the idetity of the user, U ad is a Exclusive-Or operator. 3.3 Autheticatio Phase (1) Autheticatio Process whe U coects to V 1 : A pairig-based verifier-local revocatio group sigature with backward ulikability ad the covetioal digital sigature scheme, ECDSA are used i this process. The process is show i figure 4 ad illustrated as follows: (i) U selects a radom umber, N ad computes N (we assume = =, from biliear map) ad seds ( H, N ) to. (ii) selects a radom umber N, computes a ECDSA sigature, σ with its secret key, sk as follows: σ =ECDSA.sig(sk, N G,NUG) (8) ad seds (ID, N G, σ ) to U. ID is the idetity of the first etwork visited by U. After that, computes a sessio key used betwee ad U as follows k = N (N ) (9) (iii) U verifies V s sigature, σ with s public key, pk by ruig ECDSA verificatio algorithm, ECDSA.ver(pk, N G, NUG, σ ) ad accept or reject coectio based o the verificatio result as follows:, σ a a σ = {, σ a If the sigature σ equals to 1, U computes a sessio key to betwee U ad as follows: k =N (N G) (10) It the computes a temporary alias by ecryptig a a give to it by its home etwork usig its sessio key. The it computes a group sigature, σ with usk[i] as: σ = G.Sig(gmpk, usk[i], j, alias, N G) (11) ad seds (alias, σ ) to. Otherwise, if the sigature σ = 0, coectio rejected. (iv) verifies the sigature from U with home server s public key, gmpk by ruig verificatio algorithm, G.Ver(gmpk, usk[i], j, alias, N G, σ u )., σ a, allow σ = {, h disallow allows coectio if σ =1 ad disallow otherwise. (2) Autheticatio Process whe U coects to : Message Autheticatio Code (MAC) reduces roamig autheticatio time whe U coects to. This is show i figure 5 ad illustrated as follows: (i) passes (alias, ID H, k ) to (ii) U selects a ew radom umbern, ecrypts the message (alias, ID, N ) usig its sessio key, k, ad sed E (alias, ID, N ) to. (iii) takes out, from message i (i) above ad use it to decrypt alias to get a a. The it selects a radom umber N, computes a sessio key k ad a ew alias by decryptig the alias received from from: = N (N ) ad alias' = (a a u) the, it computes a message autheticatio code (MAC) value σ usig σ = MAC K (N, N G) ad seds, N G, σ to U (iv) U computes a sessio key betwee U ad as k = N (N G) It the verifies the MAC valueσ by computig σ = MAC K (N, N G) ad compare it with σ received from. If σ = MAC value σ, the σ is valid ad U updates its ID ad computes a ew MAC value as: alias" = E (alias ) σ = MAC K (alias", N, N G) ad seds (alias", σ ) to. Otherwise U rejects the coectio.

5 Iteratioal Joural of Scietific Research Egieerig & Techology (IJSRET), ISSN (v) verifies the MAC value σ by computig σ = MAC (alias", N'UG, N G) the it compares it with MAC value σ received from U. If σ = σ, takes alias" as U s temporary idetity ad k as ew sessio key. Otherwise rejects the coectio. If k = K ad alias' = alias'' secure re-autheticatio. 4. IMPLEMENTATION AND RESULTS The Protocol is implemeted usig Java 8 o Adroid Studio 2.2, ad tested i a Geymotio supported VirtualBox to provide the eeded virtualizatio support. Figure 4 shows the key geeratio iterface, where the home server geerates the group public key gpk, a vector of N user secret keys usk, a vector of NxT user revocatio tokes urt, ada group master secret key gmsk. These keys are store i MySQL database amed roamig_table (see figure 5 below). Figure 6 shows the output of the implemeted key geeratio algorithm icludig a secret key for a roamig user, revocatio tokes for the iterval, i this case oe week (7 days). Figure 4: The Key Geeratio Iitial Iterface Figure 7: Group sigature verified by V 1. This shows group sigature received from mobile subscriber for verificatio. The result of implemetatio of the verificatio algorithm is show i figure 7 as the received group sigature is verified by the FS-Autheticator. The total sigature-based autheticatio is also show to be millsecods. Figure 5: roamig_table Desig Structure Figure 6: The Key Geeratio Result Iterface Figure 8: ECDSA sigature verificatio

6 Iteratioal Joural of Scietific Research Egieerig & Techology (IJSRET), ISSN The implemeted ECDSA sigature is show i figure 8 as the mobile user received the sigature from FS- Autheticator for verificatio 8. Whe mobile user roams to V 2, V 1 seds mobile user s autheticatio iformatio to V 2. Figure 9 ad 10 show key exchages betwee V 1 ad V 2. Figure 9: MAC-Based Autheticatio V 2. It ca be see from figure 9 that the total MAC based autheticatio time is 339 millisecods. The results of autheticatio usig the Sigature based autheticator ad the MAC Based autheticator cofirms that group sigature based autheticatio is very expesive ad resource cosumig tha the MAC based autheticatio resultig i autheticatio times as show i figure 9 ad 10. This justifies the deploymet of MAC based autheticatio i subsequet autheticatio after the user roams from the first foreig etwork. Figure 10: MAC-Based Autheticatio Mobile User. 5. ANALYSIS 5.1 Security Aalysis The desig of our protocol is based o the CK-Model [13]. Based o this, we desig we ca desig our keyexchage protocol i a idealized model, ad the traslate it usig geeral tools to obtai security i the realistic model. It icludes three parts: Autheticatedliks Adversarial model (AM); Uautheticated-liks adversarial model (UM); Autheticators. AM is cosidered as a idealized model where the commuicatio liks are perfectly autheticated; UM is the realistic settig of adversary-cotrolled liks; Autheticators are the so-called geeral algorithm tools that traslate a protocol which is Sessio-key secure (SK-secure) i AM ito a protocol which is SK-secure i UM. Sice the protocol desig i this paper follows from the CK model, our protocol guaratees security. 5.2 Aoymity ad Ulikability User aoymity is achieved due to the existetial aoymity of a special group sigature algorithm which employs verifier local revocatio. With this algorithm, is ot able to obtai the idetity of the real siger sice it does ot have s revocatio toke [ ][ ], oly s home server has. User utraceability is also achieved by the aoymity of the deployed scheme. Whe exists i the revocatio list, RL of durig a particular iterval, ca obtai [ ][ ] ad uses it to make sure that is revoked for iterval. caot lik s protocol ru durig ay iterval 1 to [ ][ ], because the revocatio toke of each user chages for every iterval j where 1. Based o this, our autheticatio ad key exchage system ca achieve aoymity ad ulikability of s protocol rus durig past ad future periods. Besides, obody icludig V 1 kows U s ew temporary ID, so oe of the etities takig part i the commuicatio protocol ca idetify ad trace U. Eve if V 1 gets N G ad N U G, it still caot compute K U = N N G due to DDH assumptio, ad thus caot get alias which is ecrypted usig K U. From the above aalysis, our protocol ca esure secure ad aoymous key exchage betwee the commuicatig parties. 6. EVALUATION AND COMPARISON The differece betwee our protocol ad that of [12] is that whe U roams subsequetly to other foreig etworks, UPK operatios are costat (still ECSM Pairig) but oly 11.5ECSM are eeded i our protocol. The authors i [1] did a similar work ad obtaied a better result tha the result i this work but i their protocol whe a user is revoked, the users previous caot protocol rus are likable. This meas that their protocol does ot provide backward ulikability which our protocol provides.

7 Iteratioal Joural of Scietific Research Egieerig & Techology (IJSRET), ISSN The protocol developed i this paper is compared with the protocol i [12] i terms of user public key (UPK) operatios ad UPK computatio latecy. Whe U first coects to a etwork, 8.75 Elliptic curve scalar multiplicatio (ECSM) plus 12.95Pairig operatios are eeded i both protocols. Whe U roams to aother etwork, UPK operatios are still 8.75ECSM plus 3Pairig i [12], but oly 2ECSM operatios are eeded i our protocol. Let X be UPK operatios whe U coects to V1, ad ( X, X,, X ) be UPK operatios whe U roams to etworks (V 2, V 3,, V ), the we calculate the average UPK operatios as follows: X + X + X + + X X A erage = (12) where is the umber of etworks the user has roamed. Goig by equatio (12), X A erage i [12] is 9. ECSM Pairig. I the case of the protocol developed i this paper, X A erage = 9. EC +.9 Pa r g + EC =. ECSM + (13) I equatio (13) above ECSM Pairig represets the user public key operatios ivolved i autheticatio process whe the user roams to the first visited etwork usig group sigature scheme i [14]. The time of autheticatio obtaied i our case is millisecods (0.12 secods approx.). Let L be computatio latecy for UPK operatios whe U coects to V1, ad ( L, L,, L ) be that whe U roams to etworks (V 2, V 3,, V ), the the average latecy is computed as follows: L A erage = 9. EC +.9 Pa r g (14) Based o the autheticatio delay of millisecods obtaied i this work (see figure 7), 1ECSM ad 1Pairig eed 2300 millisecods ad 3800 millisecods respectively i a termial with a 2.20GHz processor, so L Average i [12] would be permaetly millisecods, but i our protocol it is: = L A erage = 9 + x 9 + = + 9 = 9 + (15) I this evaluatio it ca be see from equatio (15) that the bigger is the smaller the computatio latecy. This is ot the case for a scheme employig oly the expesive group sigature example [16]. Figure 11 is the average latecy compariso betwee the protocol developed i [12] ad our protocol accordig to the user s roamig frequecy. From the figure we ca see that, the more frequetly the user roams amog differet etworks, the less time it will take i autheticatio. Average latecy i ms Our protocol Figure 11: Average latecy comparisos [12] Roamig frequecy 7. CONCLUSION Accordig to the results obtaied i this work, geeratig a group sigature imposes a sigificat burde o the computig termial ad eeds 117,095 millisecods for autheticatio. O first coectio to a foreig etwork, it may be bearable for U to wait this log. Whe U roams to aother etwork such as V 2, reautheticatio process has to restart, ad U has to wait aother 117,095 millisecods. It will become ubearable for U to be iterrupted regularly whe U roams amog foreig etworks frequetly. Because group sigature weighs so much o computig resources miimal usage of it is eeded. It ca be adequate to make use of a group sigature whe U coects to V 1, but it is ot ecessary to do that agai whe U roams to V 2. This is the reaso why this work employs message autheticatio code which greatly reduces roamig autheticatio time to 339 millisecods. User aoymity is easy to be revoked by its home server; utraceability is achieved because whe a user is revoked i a particular time iterval, say j, he caot be liked to ay of his previous protocol rus; the foreig servers do ot have to commuicate with the home server to autheticate the user, so it eeds few message flows. The aalysis shows that the protocol is practical for roamig i wireless etworks i which users are roamig frequetly.

8 Iteratioal Joural of Scietific Research Egieerig & Techology (IJSRET), ISSN REFERENCES [1] JIANG Chuli, JIA Weijia, GU Ke ad XU Nig Aoymous Autheticatio without Home Server i Mobile Roamig Networks Chiese Joural of Electroics, Vol.22, No.2, Apr [2] Daojig He, Jiaju Bu, Sammy Cha, Chu Che, ad Migjia Yi, Privacy-Preservig Uiversal Autheticatio Protocol for Wireless Commuicatios. IEEE Trasactios O Wireless Commuicatios, Vol. 10, NO. 2, February [3] Boeh, D. Shacham, H. Group sigatures with verifier-local revocatio. I Proceedigs of the 11th ACM coferece o Computer ad commuicatios security, Washigto, DC, USA, pp [4] T. Nakaishi ad N. Fuabiki, Verifier-local revocatio group sigature schemes with backward ulikability from biliear maps, Proc. ASIACRYPT 2005, LNCS 3788, pp , [5] M Saraya, P Dhivya A Optimized Secure Commuicatio Usig VLR-GS-BU o Wireless Network, Idia Joural of Computer Sciece ad Egieerig, idia, Vol.3 No.3 Ju-Jul 2012 [6] G.M. Yag, Q. Huag, D.S. Wog, X. T. Deg Uiversal autheticatio protocols for aoymous wireless commuicatios, IEEE Trasactios o Wireless Commuicatios, Vol.9, No.1, pp , CCS 06, New York, NY, USA: ACM 2006, ISBN , pp [12] Yag, G. Huag, Q. Wog, D. S. Deg, X. Uiversal autheticatio protocols for aoymous wireless commuicatios, IEEE Trasactios o Wireless Commuicatios 2010, vol. 9, o. 1: pp [13] Caetti, R. Krawczyk, H. Aalysis of keyexchage protocols ad their use for buildig secure chaels (Full Versio), [14] Boeh, D. Shacham, H. Group sigatures with verifier-local revocatio. I Proceedigs of the 11th ACM coferece o Computer ad commuicatios security, Washigto, DC, USA, pp [15] Ateiese, G. Tsudik, G. ad Sog, D. Quasiefficiet revocatio of group sigatures. I M. Blaze, editor, Proceedigs of Fiacial Cryptography 2002, volume 2357 of LNCS, pages Spriger-Verlag, [16] He, D. Bu, J. Cha, S. Che, C. Yi, M. Privacypreservig uiversal autheticatio protocol for wireless commuicatios. Wireless Commuicatios, IEEE Trasactios o, vol. 10, o. 2, 2011: pp [7] Lee W. B., Yeh C. K.: A New Delegatio-based Autheticatio Protocol for Use i Portable Commuicatio Systems. IEEE Tras. Wireless Commu., 4(1),57 64 (2005) [8] Tag C., Wu D. O.: A Efficiet Mobile Autheticatio for Wireless Networks. IEEE Tras. Wireless Commu., 7(4), (2008) [9] Zhou T, Xu J. Provable secure autheticatio protocol with aoymity for roamig service i global mobility etworks. ComputNetw 2011;55(1):205e13. [10] Wa, C.S. Hu, A.Q. Zhag, J. A elliptic curve based hadoff autheticatio protocol for WLAN, Acta Electroica Siica, Vol.39, No.1, pp [11] Cameisch, J. Hoheberger, S. Kohlweiss, M. Lysyaskaya, A. Meyerovich, M. How to wi the cloewars: efficiet periodic -times aoymous autheticatio. I Proceedigs of the 13th ACM coferece o Computer ad commuicatios security,