# Temperature dependent transport in suspended graphene

K. I. Bolotin1 K. J. Sikes2 J. Hone3 H. L. Stormer1,2,4 P. Kim1 Depts. of
1Physics, 2Applied Physics, 3Mechanical Engineering, Columbia University, New
York, NY 10027  4Bell Labs, Alcatel-Lucent Technologies, Murray Hill, NJ 07974

###### Abstract

The resistivity of ultra-clean suspended graphene is strongly temperature
($T$) dependent for $5$ K$<T<240$ K. At $T\sim 5$ K transport is near-
ballistic in a device of $\sim 2~{}\mu$m dimension and a mobility $\sim
170,000$ cm2/Vs. At large carrier density, $n>0.5\times$1011cm-2, the
resistivity increases with increasing $T$ and is linear above 50 K, suggesting
carrier scattering from acoustic phonons. At $T=240$ K the mobility is $\sim
120,000$ cm2/Vs, higher than in any known semiconductor. At the charge neutral
point we observe a non-universal conductivity that decreases with decreasing
$T$, consistent with a density inhomogeneity $<$108 cm-2.

###### pacs:

73.50.-h; 72.10.-d

Graphene, a single layer of graphite, is a remarkable recent addition to the
family of two-dimensional electronic materials. Its linear dispersion relation
and the chiral nature of its quasiparticles have created intense experimental
and theoretical interest rise_graphene . Central to understanding the
electronic transport properties of graphene is the mechanism causing the
scattering of its charge carriers. While scanning probe studies show little
evidence of intrinsic structural defects in the graphene lattice elena ;
ishigami , scattering may result from extrinsic sources, such as charged
impurities on top of graphene or in the underlying substrate fuhrer_charged ;
dassarma ; nomura , corrugation of the graphene sheet geim_intr , phonons in
graphene chen_limits ; stauber ; vasko ; dassarma_phonons  or remote
interfacial phonons in the substrate chen_limits . The formation of electron
and hole puddles can further contribute to scattering at low carrier density
yacoby ; guinea_ripples .

Recently, dramatically reduced carrier scattering was reported in suspended
graphene devices us ; rutgers . After an annealing treatment to remove the
residual impurities the sample mobility exceeded 200,000 cm2/Vs, an order of
magnitude improvement over graphene devices fabricated on a substrate us . The
exceptional cleanliness of suspended samples allows us to probe previously
inaccessible transport regimes in graphene. In this Letter, we report a strong
temperature ($T$) dependence of electrical transport in ultra-clean suspended
graphene. At low temperatures, the carrier mean free path in our highest
quality devices reaches device dimensions and suggests near-ballistic
transport. When the temperature is increased, the resistivity exhibits two
distinct behaviors, depending on carrier density. At large densities, the
conductivity of graphene exhibits a metallic behavior (i.e., decreasing with
increasing $T$) which can be mostly ascribed to electron-phonon scattering.
The scattering is remarkably weak, allowing the observation of a very high
mobility of $\sim$120,000 cm2/Vs near-room temperature ($T$=240 K). At low
density, near the charge neutrality point, the conductivity of graphene shows
a pronounced non-metallic $T$-dependence (i.e., a decrease with decreasing
$T$), indicating a strongly reduced charge inhomogeneity in suspended samples
as compared to previously studied unsuspended devices.

Figure 1: (color online) Conductance of the suspended graphene sample S1
before (blue line) and after (red line) annealing as a function of carrier
density. Data are shown for $T=40$ K to suppress universal conductance
fluctuations. Note the change from near-linear to sub-linear behavior before
and after annealing, respectively. The dotted red line is the expectation for
ballistic transport (see text). Inset: atomic force microscope image of the
suspended device (S1).

The suspended graphene devices are fabricated using the process described in
us . A mechanically-exfoliated graphene flake pressed onto a SiO2/Si substrate
is contacted by microlithographically patterned gold electrodes and the SiO2
under the flake is subsequently partially removed via a chemical etch. The
fabrication results in flat graphene, suspended $\sim$150 nm above the SiO2/Si
substrate, which serves as a gate (Fig. 1, Inset). The electrical measurements
are performed in a sample-in-vacuum cryostat capable of $T=$5-240 K. At yet
larger $T$ the sample quality can degrade, probably due to a rising background
pressure and absorption of impurities onto the graphene. The measurements
consist of recording the resistivity $\rho$ as a function of gate voltage
$V_{g}$ and temperature $T$. The gate voltage is limited to $|V_{g}|<5$ V to
avoid electrostatic collapse of the suspended graphene us . Multiple
temperature and voltage sweeps are performed to ensure the reproducibility of
the features observed in $\rho(V_{g},T)$. The carrier density $n$ is
determined via Hall measurements. Assuming a parallel plate capacitor
geometry, we find $n=C_{g}(V_{g}-V_{NP})/e$, with $C_{g}=60$ aF/$\mu$m2 and
$V_{NP}$ being the gate voltage position of the charge-neutrality point (NP).
Since $|V_{NP}|<1$ V and is $T$-independent for all devices, we deduce that
the features in $\rho(V_{g},T)$ are intrinsic and not caused by the
absorption/desorption of impurities.

Before current annealing, the low-$T$ conductivity $\sigma=1/\rho$ of our
suspended devices depends linearly on $n$, with mobility $\mu=\sigma/en\sim
28,000$ cm2/Vs (Fig. 1, Sample S1, lower line), comparable to conventional
samples fabricated on a substrate. Sending a large current through the device
and heating the graphene to an estimated 400 ∘C us ; bachtold  improves the
mobility to 170,000 cm2/Vs at $n=2\times 10^{11}$ cm2 (Fig. 1, upper line) us
, while $\sigma(n)$ becomes nonlinear. A similar improvement is observed for
two other suspended devices, sample S2 ($\mu=60,000$ cm${}^{2}/Vs$) and sample
S3 ($\mu=70,000$ cm${}^{2}/Vs$).

We can gain insight into the dominant low-$T$ scattering mechanism in graphene
by comparing $\sigma(n)$ before and after current annealing. The linearity of
$\sigma(n)$ before annealing suggests the dominance of charged impurity
scattering yanwen ; nomura ; fuhrer_charged . For screened Coulomb potential
scattering, the scattering time is $\tau\propto k_{F}$ nomura ; dassarma
which leads to a conductivity $\sigma=\frac{2e^{2}}{h}k_{F}v_{F}\tau\propto
n$, with $k_{F}$ being the Fermi wavevector. The mean free path in these
devices is $l_{m}=\sigma h/2e^{2}k_{F}\sim 150$ nm, much smaller than the
sample size ($>1~{}\mu$m), justifying the use of the Boltzmann model for
unannealed devices.

In contrast, after current annealing the mean free path in S1 increases to
$\sim$ 1 $\mu$m, comparable to the device dimensions of $\sim$2 $\mu$m and
transport is no longer diffusive. To elucidate the actual transport conditions
in our sample we compare $\sigma(n)$ with the expectation from the extreme
opposite position of purely ballistic propagation. There, the current is
carried by the finite number of longitudinal modes $N=Wk_{F}/\pi$, where $W$
is the width of the sample. Assuming perfect transmission, the ballistic
conductance at vanishing $T$ is given by beenakker ; guinea_ballistic

$\sigma_{bal}(n)=\frac{4e^{2}}{h}N=\frac{4e^{2}}{h}\frac{Wk_{F}}{\pi}\propto\sqrt{n}$
(1)

The dotted curve in Fig. 1 shows the result of Eq. (1) for a width $W$=1.3
$\mu$m, close to the dimensions of the device. From the excellent agreement
both in shape and magnitude, combined with the derived long mean free path, we
conclude that the low-$T$ transport in our current-annealed, suspended devices
is close to the ballistic limit. As an important consequence, the peak
mobility appears to be limited by boundary scattering set by the device
dimensions and not by impurity scattering and yet larger mobilities should be
achievable. Sub-linear behavior of $\sigma(n)$, reminiscent of Fig. 1, was
previously observed in unsuspended samples yanwen ; geim_intr  and interpreted
as a combined contribution of short-range and long-range scatterers. Given
that the device dimension is comparable to the mean free path, such an
interpretation based on the diffusive transport does not seem to be warranted
for our samples.

Figure 2: (color online) $T$-dependence of resistance of suspended device S1
before (a) and after (b) current annealing. Inset: Sketch of gate voltage
dependence of the carrier density in clean (lower curve) and charge
inhomogeneous (upper curve) graphene.

The $T$-dependence of the resistivity provides a tool to investigate the
impact of the current annealing process. Before current annealing, the
resistivity of device S1 exhibits a relatively small ($<30\%$) variation of
the resistivity from 5 K to 240 K (Fig. 2b), similar to conventional
unsuspended devices geim_intr ; yanwen-ejp , whereas after annealing this
variation is very pronounced ($>200\%$) (Fig. 2a, Fig. 4,Inset). These
$T$-dependent data can be divided into two different density regimes,
separated by $n^{*}$, the density at which $\rho(n^{*})$ is $T$-independent
(Fig 2b). For $|n|<n^{*}$ annealed devices exhibit a non-metallic behavior
(increasing $\rho$ for decreasing $T$), with the change in peak resistivity as
large as a factor of three in the vicinity of NP. For $|n|>n^{*}$ the
resistivity exhibits metallic behavior (decreasing $\rho$ for decreasing $T$).
In this regime $\rho(T)$ is generally linear in $T$ above a device specific
crossover temperature $T^{*}$ ($<50$ K), and the slope of $\rho(T)$ increases
for smaller $n$ (Fig. 3).

The $T$-dependence observed in unsuspended graphene is considerably different.
There, $\rho(T)$ is approximately linear for $T\leq 100$ K, while it is
superlinear for $T>100$ K geim_intr ; chen_limits . The lack of such activated
behavior in our suspended devices shows that such activated behavior is not an
intrinsic property of graphene, but rather stems from the external sources,
such as remote interface phonons chen_limits  or static ripples geim_intr . In
fact, suspended graphene shows only a modest increase of the resistivity from
$T\sim$5 K to 240 K maintaining a mobility of $\mu=120,000$ cm2/Vs at T=240 K
and at our highest density of $n=2\times 10^{11}$ cm-2. This value
considerably exceeds the highest reported room-temperature mobility for a
semiconducting material (InSb, 77,000 cm2/Vs insb ).

In order to quantify the linear rise of $\rho(T)$ in Fig. 3 we define the
slope in the high-$T$ range as $\Delta\rho/\Delta
T=[\rho(200K)-\rho(100K)]/100$ K . The inset to Fig. 3 shows
$\Delta\rho/\Delta T$ as a function of $n$ in samples S1 and S2 before (dotted
lines) and after (solid lines) current annealing. Several features stand out.
First, the high mobility states reached in S1 and S2 after current annealing
exhibit very similar $\Delta\rho/\Delta T(n)$ dependencies, in spite of a
mobility difference of a factor of 2. Second, in the large $n$ limit, the
slope $\Delta\rho/\Delta T(n)$ is similar for the samples before and after the
annealing process, indicating that the slope in this limit is rather
insensitive to the sample mobility. Finally, for all devices
$\Delta\rho/\Delta T$ is consistently larger for negative $V_{g}$ than for
positive $V_{g}$.

Figure 3: (color online) $T$-dependence of the resistivity in sample S2
($\blacksquare$) and S1 ($\bigstar$, shifted for clarity) at several different
gate voltages. Inset: Density dependence of slope of $\Delta\rho/\Delta T$
defined as $\Delta\rho/\Delta T=[\rho(200$ K$)-\rho(100$ K$)]/100$ K for
sample S1 and S2 before (dotted line) and after (solid line) current
annealing. Since $\rho(T)$ is linear only for $n>$ 0.5$\times$1011cm-2, the
definition of $\Delta\rho/\Delta T$ is only meaningful outside of the dotted
region.

We separately consider the two density regimes, $|n|>n^{*}$ and $|n|<n^{*}$.
At high densities, the linearly increasing $\rho(T)$ suggests electron-phonon
interaction as the dominant source of carrier scattering chen_limits ; vasko ;
stauber ; dassarma_phonons . Indeed, within a Boltzmann model and for
sufficiently high $T>T_{BG}=2\hbar v_{ph}k_{F}/k_{B}\sim 23$ K (BG=Bloch-
Gruneisen) at $n=2\times 10^{11}$ cm-2, the resistivity is linear in $T$

$\Delta\rho=\frac{\pi D^{2}k_{B}T}{4e^{2}\hbar\rho_{m}v_{F}^{2}v_{ph}^{2}}$
(2)

where $D$ is the deformation potential, $\rho_{m}=7.6\times 10^{-8}$ g/cm2 is
the graphene mass density, $v_{ph}=2\times 10^{4}$ m/s is the LA phonon
velocity phonon_parameters  and $v_{F}=1\times 10^{6}$ m/s is the Fermi
velocity rise_graphene . While our data in Fig. 3 show clearly such a linear
$T$-dependence, indicative of phonon scattering, the slope of $\rho(T)$
displays an unexpected density dependence, not captured by Eq. (1). The origin
of this density dependence is unclear. It may point to additional
contributions from a different $T$-dependent scattering mechanisms at lower
densities, such as screened Coulomb scattering falko . Further experimental
and theoretical work is needed to resolve this issue. However, for large
$|n|$, when $\Delta\rho/\Delta T(n)$ in Fig. 3b reaches a roughly
$n$-independent value (at least for positive $V_{g}$) we may identify this
limiting behavior with exclusively phonon scattering and derive an upper bound
value for $D$. For $n=+2\times 10^{11}$ cm-2 (electrons) Eq. (1) yields
$D\sim$ 29 eV, consistent with $D=10-30$ eV in graphite dassarma_phonons ;
phonon_parameters  and comparable to $D\sim 17$ eV, reported for unsuspended
graphene chen_limits . In contrast, for $n=-2\times 10^{11}$ cm-2 (holes) we
obtain $D\sim 50$ eV. This value may be overestimated, since
$\Delta\rho/\Delta T(n)$ is not fully saturated even at $V_{g}\approx$-5 V,
the experimental limit of hole density. Nevertheless, this large asymmetry is
unusual and presently unresolved and, together with the observed $n$
dependence, may point to a scattering behavior in suspended graphene that is
more complex than simple electron-phonon interaction.

We now turn to the low density regime, $|n|<n^{*}$, and address the
$T$-dependence of the minimum conductivity, $\sigma_{min}$. Figure 4 shows
$\sigma_{min}(T)/\sigma_{min}(5K)$ in samples S1, S2 and S3 before and after
annealing. Before annealing, $\sigma_{min}(T)$ varies only slightly from 5 K
to 240 K ($<30\%$). The variation is similar to $\sigma_{min}(T)$ in
unsuspended samples of similar mobilities yanwen-ejp . This is in a sharp
contrast to the current-annealed devices, where $\sigma_{min}$ acquires a
strong $T$-dependence, as large as a factor of $1.5-3$ for $T=5$ K to 250 K.
This confirms that the $T$-independence of $\sigma_{min}$ observed in low
mobility samples yanwen-ejp ; geim_intr  is not an intrinsic property of
graphene.

Figure 4: (color online) Minimum conductivity normalized to its value at $T=5$
K as a function of $T$ for three devices before (S1:$\square$,S2:$\circ$) and
after (S1:$\blacksquare$,S2:$\bullet$,S3:$\blacktriangle$) annealing. Data for
S3 before current annealing are not available. The $T$-dependence increases
considerably after annealing. Inset: Maximum resistivity for S2 before
($\blacktriangle$) and after ($\blacksquare$) current annealing.

The remarkable property of graphene to exhibit $\sigma_{min}\sim e^{2}/h$ even
at vanishing charge density has been the subject of several experimental and
theoretical investigations geim_intr ; beenakker ; dassarma ;
dassarma_suspended ; fuhrer_charged . In a high mobility sample, a
$T$-dependence is only expected for $k_{B}T>\epsilon_{F}=\hbar
v_{F}k_{F}=\hbar v_{F}\sqrt{\pi C_{g}(V_{g}-V_{NP})/e}$ dassarma_bilayer ;
falko , when $V_{g}\rightarrow V_{NP}$. However, in a realistic sample charged
impurities chen_limits ; nomura ; dassarma ; yacoby  or structural disorder
guinea_ripples  break up the carrier system into puddles of electrons and
holes for $V_{g}\rightarrow V_{NP}$. As a result, the combined (electron plus
hole) carrier density in ”dirty” graphene never drops below a value
$\tilde{n}$ , referred to as inhomogenity density (Fig. 2, Inset).

Estimating the rms chemical potential in the puddle regime to be
$\epsilon_{F}\sim\hbar v_{F}\sqrt{\pi\tilde{n}}$ , we expect a significant
$T$-dependence of $\sigma_{min}(T)$ only for $k_{B}T\gg\hbar
v_{f}\sqrt{\pi\tilde{n}}$. For unsuspended samples $\tilde{n}\sim 10^{11}$
cm-2 yanwen ; dassarma  corresponding to $T_{F}^{*}=\hbar
v_{f}\sqrt{\pi\tilde{n}}/k_{B}\sim 400$ K, which is used to explain why in
”dirty” devices $\sigma_{min}$ lacks a significant $T$-dependence in the range
[0, 300 K]. The weak $T$-dependence in suspended samples before current
annealing implies a similar situation. In contrast, after current annealing
$\sigma_{min}(T)$ shows $T$-dependence down to $T\sim 10$ K (Fig. 4) This
implies an upper bound of $\tilde{n}<10^{8}$ cm-2, consistent with fits to the
density dependence of transport data dassarma_suspended  and represents
further evidence for the high quality of suspended graphene.

While qualitatively our data suggest that the $T$-dependence of
$\sigma_{min}(T)$ in suspended samples results from a low $\tilde{n}$, a
quantitative description of $\sigma_{min}$ is complicated by the fact that
$k_{F}l_{m}>1$ at small $n$ and a Boltzmann description may no longer be
applicable. Such complicating factors are evident from a comparison between
different annealed devices, which exhibit both a different magnitude and a
different functional $T$-dependence as seen in Fig. 4. This suggests that the
transport at the neutrality point in the suspended samples is dominated by
extrinsic scattering. Interestingly, $\sigma_{min}(T)$ exhibits a
$T$-dependence, which is much weaker than the $\sigma_{min}\propto T^{2}$
(solid line in Fig. 4), expected from a Boltzmann model geim_intr ;
dassarma_bilayer .

In conclusion, we demonstrate that at low $T$, suspended, current annealed
graphene can sustain near-ballistic transport over micron dimensions. At high
temperatures, the resistivity of such high-quality graphene increases linearly
with $T$. The origin is likely phonon scattering, but a density and carrier-
type dependence raises questions as to our present understanding of transport
in such devices. The deduced upper bound of the deformation potential, $D$, in
the high density limit is comparable to values from graphite, but varies
considerably between electron and hole transport. Finally, the observed strong
$T$-dependence of $\sigma_{min}$ in high mobility suspended devices is
consistent with very low inhmogeneity density $\tilde{n}<10^{8}$ cm-2.

We acknowledge experimental help from and discussions with E. Henriksen, M.
Foster, S. Adam, I. Aleiner, V. Fal’ko, M. Fuhrer and A. Geim. This work is
supported by the NSF (No. DMR-03-52738), NSEC grant CHE-0641523, NYSTAR, DOE
(No. DE-AIO2-04ER46133 and No. DEFG02-05ER46215), ONR (No. N000150610138),
FENA MARCO, W. M. Keck Foundation, and the Microsoft Project Q.

## References

  * (1) A. K. Geim and K. S. Novoselov _Nature Materials_ 6, 183 (2007).
  * (2) E. Stolyarova _et al._ , _Proc. Nat. Acad. Sci._ 104, 9209 (2007).
  * (3) M. Ishigami _et al._ , _Nano Lett._ 7 1643 (2007).
  * (4) E. H. Hwang, S. Adam, and S. Das Sarma, _Phys. Rev. Lett._ 98, 186806 (2007).
  * (5) J. H. Chen _et al._ , _Nature Phys._ doi:10.1038/nphys935.
  * (6) K. Nomura and A. H. MacDonald, _Phys. Rev. Lett._ 96, 256602 (2006).
  * (7) S. V. Morozov _et al._ , _Phys. Rev. Lett._ 100, 016602 (2008).
  * (8) E. H. Hwang and S. Das Sarma, _Phys. Rev. B_ 77, 115449 (2008).
  * (9) F.T. Vasko and V. Ryzhii, _Phys. Rev. B_ 76, 233404 (2007).
  * (10) T. Stauber, N. M. R. Peres, and F. Guinea, _Phys. Rev. B_ 76, 205423 (2007).
  * (11) J. H. Chen, C. Jang, S. Xiao, M. Ishigami, and M. S. Fuhrer, _Nature Nanotech._ 3, 206 (2008).
  * (12) F. Guinea, M. I. Katsnelson, and M. A. H. Vozmediano, _Phys. Rev. B_ 77, 075422 (2008).
  * (13) J. Martin _et al._ , _Nature Phys._ 4, 144 (2008).
  * (14) K. I. Bolotin _et al._ , _Solid State Comm._ 146, 351 (2008).
  * (15) X. Du, I. Skachko, A. Barker, and E. Y. Andrei, arXiv:0802.2933.
  * (16) J. Moser, A. Barreiro, and A. Bachtold, _Appl. Phys. Lett._ 91, 163513 (2007).
  * (17) Y. -W. Tan _et al._ , _Phys. Rev. Lett._ 99, 246803 (2007).
  * (18) J. Tworzydlo, B. Trauzettel, M. Titov, A. Rycerz, and C.W.J. Beenakker, _Phys. Rev. Lett._ 96, 246802 (2006).
  * (19) N. M. R. Peres, A. H. Castro Neto, and F. Guinea, _Phys. Rev. B_ 73, 195411 (2006).
  * (20) Y. -W. Tan, Y. Zhang, H. L. Stormer, and P. Kim, _Eur. Phys. J._ 148, 15 (2007).
  * (21) H. J. Hrostowski, F. J. Morin, T. H. Geballe, G. H. Wheatley, _Phys. Rev._ 100, 1672 (1955).
  * (22) S. Adam and S. Das Sarma, arXiv:0803.0735
  * (23) V. V. Cheianov and V. I. Fal’ko, _Phys. Rev. Lett._ 97, 226801 (2006).
  * (24) S. Adam and S. Das Sarma, _Phys. Rev. B_ 77, 115436 (2008).
  * (25) S. Ono and K. Sugihara, _J. Phys. Soc. Jpn._ 21, 861 (1966); K. Sugihara, _Phys. Rev. B_ 28, 2157 (1983).


# A Security Enhanced Authentication Protocol

Sai Sreekar Vankayalapati  Computer Science and Engineering
Indian Institute of Information Technology
Sri City, Chittoor, India
<EMAIL_ADDRESS>
Srijanee Mookherji  Computer Science and Engineering
Indian Institute of Information Technology
Sri City, Chittoor, India
<EMAIL_ADDRESS>
Vanga Odelu  Computer Science and Engineering
Indian Institute of Information Technology
Sri City, Chittoor, India
<EMAIL_ADDRESS>

###### Abstract

Internet of Things (IoT) have gained popularity in recent times. With an
increase in the number of IoT devices, security and privacy vulnerabilities
are also increasing. For sensitive domains like healthcare and industrial
sectors, such vulnerabilities can cause havoc. Thus, authentication is an
important aspect for establishing a secure communication between various
participants. In this paper, we study the two recent authentication and key
exchange protocols. We prove that these protocols are vulnerable to replay
attack and modification attack, and also suffer from technical correctness. We
then present the possible improvements to overcome the discussed
vulnerabilities. The enhancement preserves performance of the original
protocols.

###### Index Terms:

Security, Privacy, Authentication, Internet of Things.

##  I Introduction

With technology on a rise, Internet of Things (IoT) have become popular. Smart
environment with IoT devices are used in almost every field in today’s world.
It is predicted that by the year 2030, the total number of connected devices
would be around 24 billion [1]. Smart industries uses IoT devices to collect
information about monitoring and tracking of goods, machinery automation and
so on. Similarly, healthcare is another domain that has vastly incorporated
IoT technologies to efficiently provide medical services to the users.
Evidently, these fields contain sensitive and confidential information of the
users. Leakage of such data can lead to hazardous consequences. Data Breaches
can cause severe operational disruption and financial losses for industries.
There have been several incidents of big corporations facing losses due to
data leakages, including Tesla where 75000 individuals’ private data got
leaked [2]. Healthcare data leakages are an even bigger issue, because this
could be potentially life-threatening for the patients [3]. Communication of
data in these sectors is an extremely sensitive matter that needs to give
utmost importance to data privacy. Thus, secure authentication and key
exchange plays a major role in providing security to sensitive communications.
Recently, Masud $et$ al. proposed authentication protocols for industrial IoT
[4] and healthcare [5]. However, the works suffer from various security flaws
and correctness issues. A secure authentication scheme is important for
sensitive domains like smart industry and healthcare. This motivated us to
crypt-analyse the works and provide possible modification suggestions in order
to address the security flaws and correctness issues.

The paper is further organised as follows: Table 1 I provides an overview of
the mathematical notations used in the paper. Section II provides an in-depth
analysis of Masud et al’s. [4] proposed scheme. In the following Section III,
crypt-analysis of the protocol is presented. Next, in Section IV we explore a
similar protocol by Masud et al. [5] and discuss the protocol, followed by
it’s crypt-analysis in Section V. In Section VI we present some possible
enhancements in order to over come the existing vulnerabilities. Finally, the
paper is concluded in Section VII.

##  II Review of Masud et al’s protocol [4]

In this section, we summarize the recent physically secure and authenticated
key establishment protocol proposed by Masud et al.. [4]. The scheme aims to
establish secret session keys between a User Device (UD) and a Sensor Node
(SN) via a Gateway (GW), which it does in three phases, namely the User
Registration Phase, the Sensor Node Registration Phase and the Mutual
Authentication and Key Agreement Phase. The phases are discussed in detail
below. Note that the notations used in this paper are listed in Table I.

TABLE I: Notations and Description Notation | Description
---|---
$P(\cdot)$ | Physically Unclonable Function
$\oplus,\parallel,h(.)$ | Bitwise XOR, Concatenation, Hash Function respectively
$ID_{u},ID_{s_{n}}$ | Real Identities of User and sensor node respectively
$\beta_{u},\beta_{sn}$ | Temporary Identities of user and sensor node respectively
$B_{m},H_{t},N$ | Biometric, hard token, nonce
$SK$ | Secret session key
$(C,R)$ | Challenge response pairs
$K_{u},K_{s_{n}}$ | Random secret keys
$M_{i}$ | Message
UD | User device
GW | Gateway
SN | Sensor node
$S_{1},S_{2}$ | Extraction and helper string for biometrics

###  II-A User Registration Phase (Over Secure Channel)

In this phase, the user proves their legitimacy to the GW and registers
themselves over a secure channel in the following way:

  1. 1.

User sends their actual identity $(ID_{u})$ to the GW as a registration
request ($M_{1}=ID_{u}$)

  2. 2.

GW generates a challenge $C_{u}$ that will be used for authentication. In
order to address the issues of DoS and desynchronization, it generates
additional challenges $C_{uadd}=(C_{u1},C_{u2},\ldots,C_{un})$. Finally, the
GW sends back $M_{2}=C_{u},C_{us}$.

  3. 3.

UD calculates the responses using its Physically Unclonable Function (PUF) as
$R_{u}=P(C_{u})$ and $R_{uadd}=(C_{u1},C_{u2},...C_{un})$ and sends them back
to the GW.

  4. 4.

The GW generates and sends temporary identity and a random secret key
$\beta_{u}andK_{u}$ respectively.

  5. 5.

The user enters their biometric and attaches a hard token, after which UD
computes $X=h(B_{m}||H_{t})$ for future authentication. Lastly, UD stores
${X,\beta_{u},K_{u}}$

###  II-B Sensor Node Registration Phase (Over Secure Channel)

Similar to the User Registration, the sensor nodes also register themselves
with the GW over a secure channel through the following steps:

  1. 1.

The GW generates challenges $C_{sn}andC_{snadd}={C_{sn1},...C_{snN}}$ and,
along with them, a random secret key $K_{s}n$ and sends all of them to the
sensor node.

  2. 2.

SN stores $R_{s}n$ and computes responses for the challenges $R_{sn}$ and
$R_{snadd}$ and sends them to the GW.

  3. 3.

The GW generates a temporary ID $\beta_{sn}$ for the sensor node and sends it.

###  II-C Mutual Authentication and Key Agreement Phase (Over Public Channel)

The final phase of the protocol is where the GW assigns secret session keys to
the user and the sensor node by making use of One Time Pad encryption
technique and a hash function in the following way:

  1. 1.

UD $\rightarrow$ GW : $M_{1}=\langle\beta_{u},N_{1}\rangle$

     * •

UD verifies the identity of the user using his biometric and a hard token

     * •

Generates nonce $N_{1}$

     * •

Finally sends $M_{1}={\beta_{u},N_{1}}$ to the GW.

  2. 2.

GW $\rightarrow$ UD : $M_{2}=\langle
N_{2},K_{u}^{*},C_{u}^{*},SK_{u}^{*},\beta^{new}_{u}\rangle$

     * •

The GW finds the $\beta_{u}$ and fetches the respective $K_{u}$

     * •

The GW computes $K_{u}^{*}=h(\beta_{u}||K_{u})$ and validates the nonce for
freshness.

     * •

Now, the GW fetches the challenge response $(C_{u},R_{u})$ pair corresponding
to the user.

     * •

The session key is being encrypted using the challenge response pair as
$SK_{u}^{*}=SK_{u}\oplus h(C_{u}||R_{u})$. It encrypts the challenges as
$C_{u}^{*}=C_{u}\oplus R_{u}$

     * •

The GW generates $\beta_{u}^{new}=h(\beta_{u}||K_{u})$

     * •

GW generates $N_{2}$ and it stores $SK_{u},\beta_{u}^{new}$ and finally the GW
sends $M_{2}={N_{2},K_{u}^{*},C_{u}^{*},SK_{u}^{*},\beta^{new}_{u}}$

  3. 3.

UD $\rightarrow$ GW : $M_{3}=\langle R^{*}_{u},N_{3},\beta_{sn}\rangle$

     * •

UD validates $N_{2}$ and it verifies $K_{u}^{*}$ by computing
$h(\beta_{u}||K_{u})$

     * •

UD, then, derives $C_{u}=C^{*}_{u}\oplus K_{u}$

     * •

UD computes $R_{u}=P(C_{u})$ and then it decrypts $SK_{u}$ as
$SK_{u}=SK_{u}^{*}\oplus h(C_{u}||R_{u})$

     * •

UD stores $SK_{u},\beta^{new}_{u}$ and calculates $R^{*}_{u}=R_{u}\oplus
K_{u}\oplus SK_{u}$ and generates a nonce $N_{3}$

     * •

Finally, UD sends back $M_{3}={R^{*}_{u},N_{3},\beta_{sn}}$

  4. 4.

GW $\rightarrow$ SN : $M_{4}=\langle
N_{4},\beta_{u},K_{sn}^{*},C_{sn}^{*},SK_{sn}^{*},\beta_{sn}^{new}\rangle$

     * •

The GW validates $N_{u}$, and then calculates $R_{u}\oplus K_{u}\oplus SK_{u}$
and verifies it with $R_{u}^{*}$ after which the GW computes
$K_{sn}^{*}=h(\beta_{sn}||K_{sn})$.

     * •

The GW then fetches $C_{sn},R_{sn}$ and computes $C_{sn}^{*}=C_{sn}\oplus
K_{sn}$ and $SK_{sn}^{*}=SK_{sn}\oplus h(C_{sn}||R_{sn)}$.

     * •

GW generates a new identity $\beta_{sn}^{new}=h(\beta_{sn}||K_{sn})$

     * •

GW sends a
$M_{4}={N_{4},\beta_{u},K_{sn}^{*},C_{sn}^{*},SK_{sn}^{*},\beta_{sn}^{new}}$

  5. 5.

SN $\rightarrow$ GW : $M_{5}=\langle N_{5},R^{*}_{sn}\rangle$

     * •

SN computes $h(\beta_{sn}||K_{sn})$ and verifies it with $K_{sn}^{*}$.

     * •

Then it validates $N_{4}$ and if found fresh, it proceeds to derive $C_{sn}$
from $C_{sn}^{*}$.

     * •

SN computes $R_{sn}=P(C_{sn})$. Once it has the responses, it can decrypt
$SK_{sn}=SK_{sn}^{*}\oplus h(C_{sn}||R{sn})$.

     * •

SN stores $SK_{sn},\beta_{sn}^{new}$ and computes $R^{*}_{sn}=R_{sn}\oplus
SK_{sn}\oplus K_{sn}$

     * •

Finally, SN sends $M_{5}={N_{5},R^{*}_{sn}}$ to GW

     * •

The session ends with the GW validating $N_{5}$ and $R^{*}_{sn}$

##  III Comment on Masud et al.’s Protocol [4]

The proposed scheme performs authentication and delivers encrypted session key
through a single random secret key, while using one time pad encryption.
However, the protocol suffers from the following vulnerabilities and
correctness issues.

###  III-A Hashing a Biometric

In the final step of the User Registration Phase II-A, as well as the very
first step of the Mutual Authentication Phase II-C, biometric $B_{m}$ is
hashed along with $H_{t}$ and this value is used for verifying the identity of
the User. This is not practical as it is infeasible to hash biometrics. The
reason for this is that if the user places their, say, fingerprint in a
slightly different position the binary value of the biometric will be
different, which will generate a new hash value. Thus, an user will not be
able to proceed further.

###  III-B User’s Session Key is Available as Plain Text

  * •

When GW sends $M_{2}=\langle
N_{2},K_{u}^{*},C_{u}^{*},SK_{u}^{*},\beta^{new}_{u}\rangle$, it computes
$C_{u}^{*}$ as $C_{u}^{*}=C_{u}\oplus R_{u}$

  * •

After receiving $M_{2}$, UD derives $C_{u}=C_{u}^{*}\oplus K_{u}$. This is
only possible if $(R_{u}\oplus K_{u})=0$.

  * •

In the next step, UD computes $R_{u}^{*}=(R_{u}\oplus K_{u})\oplus SK_{u}$.

  * •

If $(R_{u}\oplus K_{u})=0$ then $R_{u}^{*}=SK_{u}$ and $SK_{u}$ is available
as plain text

If it is assumed that $C_{u}=C_{u}^{*}\oplus R_{u}$ is mistakenly written as
$C_{u}=C_{u}^{*}\oplus K_{u}$, there still prevail some issues, as discussed
in the upcoming section.

###  III-C Updated Temporary Identities Not Being Verified

In order to counter Impersonation attacks, the temporary identity $\beta_{u}$
gets updated and a $\beta^{new}_{u}$ and $\beta^{new}_{sn}$ are generated for
the user and the sensor node respectively, after every session. However, after
the GW assigns the new identities, the devices store them with no verification
of the values. As it is over a public channel, this makes the
$\beta^{new}_{u}$ and $\beta^{new}_{sn}$ vulnerable to modification attacks.
Let us assume an adversary captures $M_{2}$ and/or $M_{4}$ and tries to modify
it as follows:

  1. 1.

GW $\rightarrow$ UD : $M_{2}=\langle
N_{2},K_{u}^{*},C_{u}^{*},SK_{u}^{*},\beta^{new}_{u}\rangle$

     * •

Let’s say the Adversary ($\mathcal{A}$) captures
$M_{2}=\langle\beta^{new}_{u},N_{2},K_{u}^{*},C_{u}^{*},SK_{u}^{*}\rangle$ and
modifies it as
$M_{2}^{{}^{\prime}}=\langle\beta^{new^{\prime}}_{u},N_{2},K_{u}^{*},C_{u}^{*},SK_{u}^{*}\rangle$

     * •

UD stores the modified value $\beta^{new^{\prime}}_{u}$ with no verification.

For a future session:

     * •

UD sends their identity $\beta^{new^{\prime}}_{u}$ to GW in $M_{1}$

     * •

There is a mismatch between $\beta^{new^{\prime}}_{u}$ and the stored
$\beta^{new}_{u}$ which causes the service to disrupt.

  2. 2.

GW $\rightarrow$ SN : $M_{4}=\langle
N_{4},\beta_{u},K_{sn}^{*},C_{sn}^{*},SK_{sn}^{*},\beta_{sn}^{new}\rangle$

     * •

Let’s say the Adversary ($\mathcal{A}$) captures $M_{4}=\langle
N_{4},\beta_{u},K_{sn}^{*},C_{sn}^{*},SK_{sn}^{*},\beta_{sn}^{new}\rangle$ and
modifies it as $M_{4}^{{}^{\prime}}=\langle
N_{4},\beta_{u},K_{sn}^{*},C_{sn}^{*},SK_{sn}^{*},\beta_{sn}^{new^{\prime}}\rangle$

     * •

SN stores the modified value $\beta^{new^{\prime}}_{sn}$ with no verification.

For a future session:

     * •

Assuming that $\beta_{sn}^{new^{\prime}}$ is public information, UD sends the
$\beta_{sn}^{new^{\prime}}$ that it wants to communicate with to GW in $M_{3}$

     * •

There is a mismatch between $\beta_{sn}^{new^{\prime}}$ and the stored
$\beta_{sn}^{new}$ which leads to service disruption.

###  III-D Nonce Validation Problem Resulting in Replay Attack

A freshness check is performed on the nonces in the protocol. However, the
freshness is validated by checking the randomness of the nonces. As a result,
any random number can be used by the Adversary ($\mathcal{A}$) to perform a
replay attack. Even if there is a possibility of storing the older nonces,
there is high probability that the selected random number is new, thus will be
considered as fresh.

##  IV Review of Masud et al.’s protocol [5]

A protocol similar to Masud $et$ al.’s [4] protocol (Section II) was proposed
by Masud et al. [5] incorporating the following additions:

  * •

This protocol is proposed for the Healthcare industry and has a decentralized
blockchain architecture to increase trust between parties.

  * •

The information in blockchain is stored as transactions which are further
contained in blocks. Each block in the blockchain stores information such as
the nonce, parent hash, current hash, timestamp, etc. whereas each transaction
comprises of transaction fee, transaction hash, timestamp, input data, nonce,
etc.

  * •

The protocol has three phases namely, User Registration Phase, Sensor Node
Registration Phase and Mutual Authentication and Key Agreement Phase. A smart
contract is used in the User Registration and the Sensor Node Registration
Phases to establish trust in order to register them onto a blockchain network.

  * •

The biometric information in the User Registration Phase is handled using a
fuzzy extractor, which generates and replicates two strings containing the
biometric information in the User Registration Phase and the Mutual
Authentication Phase respectively.

  * •

The additions in the Mutual Authentication and Key Establishment Phase as
compared to Masud $et$ al.’s protocol is as follows:

    * –

After the user identity is located and the challenge response pair is fetched
from the gateway device’s memory, the gateway generates a $J=h(R_{u}||K_{u})$
additionally for the user device to verify the gateway device.

    * –

After the user and gateway authentication, the gateway device generates
$G_{1}=h(S_{1}||ID_{u})||h(R_{u})$ and sends it to the blockchain, along with
a transaction hash and contract address, in order to establish a smart
contract, after which the blockchain network replies with a success or failure
response accordingly.

    * –

Similarly, the sensor node also verifies the authenticity of the gateway
through $h(K_{sn}||R_{sn})$ and after the gateway and sensor node
authentication, the gateway sends $G_{2}=h(ID_{sn}||R_{sn})$ to the blockchain
network, along with a transaction hash and contract address, in order to
establish the smart contract with sensor node.

    * –

Finally after all the above steps, the gateway shares one session key with
both user and sensor node, unlike the discussed protocol in which two distinct
session keys were shared after the authentication. Additionally, new temporary
identities are generated and sent to the user and sensor node.

##  V Comment on Masud et al.’s Protocol [5]

The protocol proposed by Masud $et$ al. [5] suffers from security flaws
similar to that of Masud $et$ al. [4] (Section III). They are discussed as
follows:

###  V-A Updated Temporary Identities Not Being Verified

At the end of the key establishment, new temporary identities are generated
for both the user and sensor node in a similar manner to the first protocol.
However, upon receiving them, there is no validation for the new identities
being done by UD and SN as they are stored immediately as they are. This makes
the new identities susceptible to adversarial modifications that would go
unnoticed by the devices and would cause the future sessions to fail.

###  V-B Nonce Validation Problem Resulting in Replay Attack

Similar to the protocol discussed in Section II, freshness of the nonce is
validated by checking the randomness of the nonce. Thus, any modified random
number would still be considered fresh and would enable the possibility of
replay attacks.

##  VI Proposed Enhancements

Masud $et$ al.’s work [4] suffer from technical correctness error of hashing a
biometric along with being vulnerable to replay and modification attack.
Whereas, Masud $et$ al.’s work [5] suffers from vulnerability to replay attack
and modification attack. In this section, we discuss the possible
modifications for Masud $et$ al.’s [4, 5] works.

###  VI-A Handling Biometrics

In Masud $et$ al.’s work [4], biometrics is hashed, which is infeasible. Thus,
in order to accommodate the small changes in biometric values and ensure that
they can be hashed, a fuzzy extractor [6] can be used. Two strings
$(S_{1},S_{2})$ can be generated from the biometrics using the fuzzy extractor
and those can be used for the further authentication purposes as follows:

    * –

In the User Registration Phase:

      * *

At UD: $Gen(B_{m})=(S_{1},S_{2})$

      * *

$UD\rightarrow GW$: $\delta=h(S_{1}||H_{t})$. $S_{1}$ can be concatenated with
anything else that is required for authentication. In the case of Masud et
al’s [4] protocol it is the hard token.

    * –

In the Mutual Authentication Phase: Whenever there is a need for biometric
authentication, a Replicate function can be used to replicate the $S_{1}$ as
$Rep(B_{m},S_{2})=S_{1}$ and this can be hashed and sent again as follows:

      * *

$S_{1}=Rep(B_{m},S_{2})$

      * *

$\delta=h(S_{1}||H_{t})$

In the enhancement, we use fuzzy extractor to utilize biometrics for login and
authentication. This overcomes the technical correctness issue in Masud $et$
al.’s work [4].

###  VI-B Updating Temporary Identities

In Masud $et$ al.’s works [4, 5] the temporary identities are updated and sent
to the respective parties, which is stored in the device memories without
validation. Since the updated identities are sent over insecure channel, an
adversary can modify the identities and thus, stop any future communication.
In order to overcome the flaws, the following enhancement can be made:

After the end of every session, the gateway computes new temporary identities
$\beta_{u}=h(\beta_{u}||K_{u})$ and $\beta_{sn}=h(\beta_{sn}||K_{sn})$ and
they get sent to the respective parties. Before storing the new identities
directly, UD and SN can perform a validation to check if the new identities
are valid by computing $h(\beta_{u}||K_{u})$ at UD and $h(\beta_{sn}||K_{sn})$
at SN and validating them with $\beta^{new}_{u}$ and $\beta^{new}_{sn}$
respectively so that modification attacks are not possible. In the proposed
enhancement, we use cryptographic hash function in order to prevent
modification attack.

###  VI-C Nonce Validity Check

In Masud $et$ al.’s works [4, 5], random nonces are generated along with every
message during communication to prevent replay attacks, i.e, if a repeated
nonce is found, the communication is disconnected. However, in the discussed
protocols, any new random number could pass as being a fresh nonce, which
would still make replay attacks possible. Instead of a random nonce, or along
with it, the current timestamp could also be sent that would ensure that
replay attacks are not possible [7].

##  VII Conclusion

In this paper, we study the authentication and key establishment protocols
proposed by Masud $et$ al. [4, 5]. The protocols suffer from technical
correctness of hashing biometric and vulnerable to replay attack and
modification attack. We present a set of possible enhancement in order to
overcome the vulnerabilities.

## References

  * [1] M. Hatton, “The iot in 2030-24 billion connected things generating $1.5 trillion,” 2020.  [Online accessed 23.12.2023].
  * [2] “Tesla Data Breach.” https://techcrunch.com/2023/08/21/tesla-breach-employee-insider/, 2023.  [Online accessed 23.12.2023].
  * [3] S. Challa, A. K. Das, V. Odelu, N. Kumar, S. Kumari, M. K. Khan, and A. V. Vasilakos, “An efficient ecc-based provably secure three-factor user authentication and key agreement protocol for wireless healthcare sensor networks,” Computers & Electrical Engineering, vol. 69, pp. 534–554, 2018\.
  * [4] M. Masud, M. Alazab, K. Choudhary, and G. S. Gaba, “3p-sake: privacy-preserving and physically secured authenticated key establishment protocol for wireless industrial networks,” Computer Communications, vol. 175, pp. 82–90, 2021.
  * [5] M. Masud, G. S. Gaba, P. Kumar, and A. Gurtov, “A user-centric privacy-preserving authentication protocol for iot-ami environments,” Computer Communications, vol. 196, pp. 45–54, 2022.
  * [6] Y. Dodis, L. Reyzin, and A. Smith, “Fuzzy extractors: How to generate strong keys from biometrics and other noisy data,” in Advances in Cryptology-EUROCRYPT 2004: International Conference on the Theory and Applications of Cryptographic Techniques, Interlaken, Switzerland, May 2-6, 2004\. Proceedings 23, pp. 523–540, Springer, 2004.
  * [7] A. K. Das, M. Wazid, N. Kumar, A. V. Vasilakos, and J. J. Rodrigues, “Biometrics-based privacy-preserving user authentication scheme for cloud-based industrial internet of things deployment,” IEEE Internet of Things Journal, vol. 5, no. 6, pp. 4900–4913, 2018.