At present, extensive research has been conducted both domestically and internationally in the fields of authentication and key agreement, resulting in the proposal of various protocol schemes aimed at ensuring the security of authentication processes and data communications [7–13].

Parai et al. [10] based on Gupta’s [9] research, proposed an identity-based three-party authentication key negotiation protocol for resource-constrained IoT devices. They tested and estimated the execution time of the protocol on a Raspberry Pi 4 device, covering security levels from 80 bits to 256 bits. However, since the protocol is based on bilinear pairings, it still has a high computational cost. In 2023, Mookherji et al. [11] proposed a semi-centralized architecture and a certification and key negotiation scheme for smart healthcare systems. In this scheme, the cloud server delegates user registration functionality to fog servers, and users can complete registration by sending requests to fog servers. This scheme claims to effectively address the threat of server single-point compromise. However, fog servers are typically deployed close to the device edge layer and are considered untrusted. Compared to centralized cloud servers, fog servers have higher key management costs and challenges. Qiu et al. [14] addressed the imbalance between practicality and security in three-factor authentication by proposing a lightweight mobile device authentication scheme using chaotic mapping. The scheme utilizes fuzzy verifiers and honeyword techniques to resist offline password guessing attacks. In 2021, Lin et al. [15] introduced an authentication protocol tailored for 5G healthcare IoT systems, enabling patients to access multiple remote medical services using paired credentials. However, due to the absence of timestamps and the use of a public authentication parameter, the scheme is susceptible to Denial of Service (DoS) attacks. Additionally, storing users’ private keys in plaintext on the smart card leaves it vulnerable to card theft attacks. To address identity verification in Wireless Body Area Networks (WBAN), Alzahrani et al. [16] introduced a lightweight protocol that facilitates session key generation between sensor and hub nodes. Nevertheless, it lacks comprehensive mutual authentication among access points, hubs, and sensors, limiting its practical deployment. Nyangaresi et al. [17] proposed a cheme to secure interactions between body sensor units and administrators in WBAN scenarios, achieving forward secrecy through session key generation. Yet, the protocol fails to preserve user anonymity when the gateway node acts as an insider adversary.

Xie et al. [18] designed a scheme for patient monitoring systems using elliptic curve cryptography (ECC) and validated its security via formal analysis. However, it does not implement mutual authentication between sensor and relay nodes. Deebak et al. [19] designed a framework for cloud-assisted medical cyber-physical systems based on Chebyshev chaotic maps. A major weakness lies in the registration phase, where user credentials are transmitted in plaintext to the gateway, risking identity exposure. Tu et al. [20] also proposed EAKE-WCI, an anonymous authentication protocol for wearable healthcare devices in cloud environments. While the scheme ensures mutual authentication among users, devices, and servers, it lacks adequate password protection during login, making it vulnerable to guessing attacks. Edwards et al. [21] introduced a distributed authentication framework, incorporating physical tokens, biometrics, and cryptographic keys to validate user identity. Lee et al. [22] developed a three-factor authentication method tailored for sensor-based devices operating in IoT settings. Their approach utilizes Physical Unclonable Function (PUF) and honeypot mechanisms to mitigate threats such as ID/password guessing, brute-force, and eavesdropping attacks. Mirsaraei et al. [23] introduced another three-factor authentication protocol suitable for IoT applications, employing elliptic curve cryptography and smart cards for user registration and identity verification within private blockchain environments. This design is particularly effective for resource-constrained IoT devices. Ghose et al. [25] presented two-factor authentication protocol. Initial verification step is based on traditional credentials (username and password), while the second step leverages persistent associations between the user’s device and an auxiliary unit. Ahmad et al. [26] introduced BAuth-ZKP, a multi-factor authentication protocol designed for smart city. By utilizing blockchain smart contracts, the scheme enables secure user verification without revealing personal identity information. Braeken et al. [27] developed a two-way multi-factor authentication and key exchange mechanism aimed at facilitating secure access to remote sensor nodes. Their approach ensures real-time data retrieval and defends against semi-trusted intermediaries, while preserving user anonymity and untraceability, and mitigating risks from session-specific data leakage. In the healthcare sector, Miao et al. [28] proposed a three-factor authentication protocol for medical IoT systems, leveraging blockchain to manage identity-related data and applying Chebyshev chaotic maps to enhance login and authentication robustness. Zhang et al. [29] presented an ECC-based three-factor scheme involving credentials, passwords, and biometrics for secure interaction among administrators, gateways, and industrial IoT devices. This protocol supports identity revocation and online updates, adapting to dynamic industrial requirements. To enhance cloud network security, Bernard et al. [30] designed a mutual authentication protocol utilizing visual cryptography. The approach employs confidential mappings—specifically visual encryption and challenge-response pairs—along with credential-based verification to counteract weaknesses in traditional cryptographic algorithms. Despite its enhanced security features, the scheme incurs significant computational cost, which limits its efficiency on resource-limited platforms.

PUF is an emerging cryptographic primitive known for its strong resistance to duplication. Min et al. [32] designed an authentication approach that integrates PUF with a dynamic identity mechanism, effectively safeguarding device identities and enhancing privacy at the hardware level. In a subsequent work, Aman et al. [33] developed a PUF-based mutual authentication protocol, enabling secure communication between devices and servers, as well as among devices themselves, thereby expanding its applicability. Shah et al. [34] presented a PUF-enabled authentication mechanism that employs challenge–response pairs and incorporates the AES encryption algorithm to improve overall system security. Zhu et al. [35] introduced a PUF-driven authentication protocol specifically designed for RFID environments, addressing critical security concerns such as unclonability and traceability, while also supporting mutual authentication. In summary, current authentication schemes still have security vulnerabilities and incur high computational and communication costs [24–31].

In this paper, we propose a cloud-based anonymous and secure authentication scheme. Our approach enables mutual authentication between users and access devices, allowing them to securely establish a reliable shared session key. Communication efficiency is also considered in the proposed scheme. The main contributions of this work can be summarized as follows:

The security of the proposed scheme is proven under the Random Oracle Model. Additionally, security analysis demonstrates that the proposed scheme can withstand common attacks. Performance comparisons show that the proposed scheme addresses the security shortcomings of existing solutions and has lower computational and communication overhead.

This paper proposes an anonymous, secure, and efficient authentication scheme for cloud-based in 6G. The proposed scheme employs Chebyshev chaotic mapping and PUF to construct a lightweight key agreement mechanism. Additionally, by integrating hash functions and a session key update strategy, the scheme ensures user anonymity and forward security of session data. PUF technology is incorporated on the device side, leveraging its unique hardware characteristics to provide robust identity verification and resistance to physical attacks.

The structure of this paper is arranged as follows. Section 2 outlines the foundational concepts relevant to the proposed scheme. Section 3 details the authentication protocol in depth. Sections 4 and 5 are dedicated to the security assessment and efficiency analysis of the scheme. The final section concludes the study and highlights potential avenues for future exploration.

As shown in Figure 1, cloud-based authentication protocol proposed in this paper consists of three main components: cloud servers, users, and access devices. These components are interconnected via a high-speed, highly reliable 6G core network, forming a secure communication architecture that supports large-scale heterogeneous device access.

Cloud Servers: Serving as the central management entities, cloud servers are responsible for identity authentication, key management, secure storage, and data processing.

Users: It refers to individuals or organizations utilizing the system services, including system administrators, household users, and industrial control personnel. Users initiate authentication requests via terminals to access cloud resources or remotely control access devices.

Access Devices: These are intelligent terminal devices deployed in various application environments, equipped with communication, control, and response capabilities. Beyond simply connecting to the cloud platform, they can execute task instructions, report status information, and trigger predefined actions. Depending on the application scenario, access devices include the following:

Industrial control terminals, actuators, and robots in factory settings, enabling automated operations and status feedback;

Access devices engage in mutual authentication with both users and cloud servers via the proposed protocol, ensuring that all communications occur in a trusted and secure environment, thereby preventing unauthorized access and data leakage.

Leveraging the high bandwidth and low latency characteristics of 6G core network, proposed system achieves strong security guarantees while meeting real-time performance requirements and supporting massive connectivity.

Given an integer n and a variable x , where x ∈ − 1 , 1 , T n x can be defined as: T n x = cos n · ⁡ arccos x (1)

From Equation 1, the recursive formula for Chebyshev polynomials is derived as Equation 2 [36–38]: T n x = 1 , n = 0 x , n = 1 2 x T n − 1 x − T n − 2 x , n ≥ 2 (2)

According to the above formulas, Chebyshev polynomials satisfy the semi-group property. That is, for any two positive integers s , u and x ∈ − 1 , 1 , Equation 3 holds: T s T u x = T s u x = T u T s x (3)

The semigroup property [43]: For n ≥ 2 and x ∈ − ∞ , + ∞ , the enhanced Chebyshev polynomial is defined as Equation 4: T n x = 2 x T n − 1 x − T n − 2 x   mod   p (4) where p is a large prime number. Based on this definition, the enhanced Chebyshev polynomial still satisfies the semi-group property, expressed as Equation 5: T s T u x ≡ T s u x = T u T s x   mod   p (5)

Chebyshev Polynomial-Based Diffie-Hellman Problem ( C M D L P ): For any positive integers s and u , and any c ∈ − ∞ , + ∞ , given T s c and T u c , it is computationally hard to derive T s u c = T s T u c   mod   p , due to the semi-group property of Chebyshev polynomials modulo a large prime p [39–41].

Physical Unclonable Function (PUF) is cryptographic primitives embedded as circuit modules within chips, serving as hardware security mechanisms. They exploit random physical variations introduced during manufacturing, which are uncontrollable and unique to each device. This inherent randomness ensures that producing two identical PUF-enabled devices is practically impossible. Consequently, PUF is increasingly utilized in information security, particularly for lightweight device authentication and as novel factors in multi-factor authentication protocols.

PUF operates using a challenge-response mechanism: input signals, termed challenges, are processed by the PUF to generate unique responses, collectively forming Challenge-Response Pairs (CRPs). In a typical authentication setup, the PUF circuit is embedded within the authentication server. During registration, the server receives challenges from authenticating devices, processes them via its PUF module, and generates corresponding responses, which can be stored as CRPs in a database for future verification. Due to the uniqueness and tamper-resistance of PUF, these responses remain consistent and unforgeable. An ideal PUF satisfies three critical properties:

Uniqueness: Identical challenges input to the same PUF always yield identical responses, while different PUFs produce different responses even when presented with identical challenges.

These characteristics make PUF particularly suitable for secure, hardware-level identity verification in resource-constrained environments.

Cloud server S j selects a large prime number p , generates a random number k ∈ Z p * and hash function h . Then, S j computes T k x , and publicly discloses the parameters T k x , x , h , while keeping k as a long-term private key securely stored. Figure 2 is flowchart for proposed scheme.

At this phase, user and the access device complete authentication and key agreement through the cloud server. The process is illustrated in Figure 3.

Step 1: The user U i inserts the smart card S C i , inputs their I D i , login password P W i , and provides biometric information B i ′ . Then, calculate σ i = R e p B i ′ , δ i , compute R i = P U F c i , and k i = C i ⊕ h I D i , P W i , σ i . Next, calculate R U i = h I D i , P W i , θ i , k i , A i = P C i ⊕ h σ i , I D i , P W i , R i and F i = D i ⊕ h R i , P W i , I D i . Then, calculate Z i ′ = h F i , A i , P I D i , R U i , and check if Z i ′ = Z i . Afterward, S C i generates two random numbers r i and v i . Calculate E i = T r i x , W i = T r i P u b j ⊕ v i and G i = h E i , W i , A i , T 1 , v i . User U i sends the message P I D i , E i , G i , T 1 , W i , F I D j to cloud server S j .

Step 2: S j receives the login request from U i , S j first checks T 1 . Then, S j computes v i = W i ⊕ T s j E i , A i = h P I D i , k j , and G i ′ = h E i , W i , A i , T 1 , v i . The server then verifies if G i ′ = G i . If the equality does not hold, S j rejects session. If the equality holds, S j retrieves the database using F I D i , obtaining S I D j , F I D j , D j . S j generates n j and calculates Q j = T n j E i , P j = h S I D j , k , R j = h D j , P j ⊕ v i , and F j = h D j , T 2 ⊕ Q j . Then, calculate Y D j = h Q j , D j , P j , R j , F j , T 2 , F I D j , v i and send R j , F j , Y D j , T 2 to the access device A D j .

Step 3: Access device A D j receives the message from server S j . Access device checks T 2 , then calculates D j = P U F N j , P j = W j ⊕ D j , v i = h D j , P j ⊕ R j and Q j = h D j , T 2 ⊕ F j . Then, F I D j = P U F S I D j and Y D j = h Q j , D j , P j , R j , F j , T 2 , F I D j , v i is verified. If the value is correct, access device A D j generates a random number h i and calculates K j = h D j , P j , v i ⊕ h i , and C j = h Q j , F I D j , K j . Access device A D j then sends K j and C j to cloud server S j .

Step 4: Upon receiving K j and C j , S j computes h i = h D j , P j , v i ⊕ K j , C j = h Q j , F I D j , K j , and verifies the value of C j . Then, S K j i = h Q j , h D j , P j , v i , h i , A j = T n j x and H i = h i ⊕ Q j . Next, calculate Y j = h Q j , S K j i , H i . S j sends the message A j , Y j , H i to user U i via a public channel and calculates M j = h S K j i , h i , sending M j to access device A D j .

Step 5: Upon receiving the message, the user computes h i = T r i A j ⊕ H i , S K j i = h Q j , h D j , P j , v i , h i and Y j ′ = h Q j , S K j i , H i , then verifies whether Y j ′ = Y j . If it holds, then mutual authentication between U i and server S j is successfully completed, and a session key is established.

Step 6: Upon receiving the message, A D j computes S K j i = h Q j , h D j , P j , v i , h i and verifies whether M j ′ = h S K j i , h i . If the equality holds, mutual authentication between U i and A D j is successfully completed, and a session key is established.

The security of session keys can be formally proven through rigorous mathematical analysis of the protocol within the Random Oracle Model (ROM).

Participants: Entities involved in the scheme include the user U i , cloud server S j and the access device A D j . Let I i 1 U i , I i 2 S j , and I i 3 A D j respectively denote instances of the user U i , cloud server S j and access device A D j .

Accepted: Instance I i enters an accepted state when it receives the final scheme message during communication process. The instance I i maintains the sequence of all exchanged messages, forming a session identifier for the current session.

Partnering: Instances I i 1 and I i 2 are regarded as partners when the following criteria are met:

Both instances must be in the accepted state.

Freshness: Instances I i 1 and I i 2 are considered fresh if the adversary A has not obtained their session key using the R e v e a l I i query.

It is assumed that adversary A has complete control over the communication in the system. A can intercept, eavesdrop and modify messages. In the Random Oracle Model, A can perform simulated queries to compromise the authenticity and confidentiality of key agreement and session keys. The types of queries allowed are as follows:

E x e c u t e I i 1 , I i 2 , I i 3 : Simulates a passive attack where A obtains all messages exchanged between user U i , cloud server S j and the access device A D j .

S e n d I i 1 , I i 2 , m : Simulates an active attack. A impersonates instance Π i 1 and sends message m to instance Π i 2 . If m is valid, Π i 2 responds appropriately; otherwise, the simulator terminates the query.

C o r r u p t I i U i , a : If a = 0 , the user’s password is revealed. If a = 1 , the smart card itself is returned. If a = 2 , biometric data is provided.

C o r r u p t AD I i A D j : Allows A to retrieve all information stored in the device node.

R e v e a l I i : Allows A to obtain session key generated by instance I i and its partner.

T e s t I i : A initiates this challenge query on a legitimate instance I i of U i and A D j . A fair coin c is tossed to determine the output; If c = 1, the real session key is returned; If c = 0, a random string is returned; In other cases, the output is null. Only A knows the outcome of the coin toss.

Semantic Security: A can perform multiple T e s t queries on I i and guess a bit value c. Let P denote the authentication and key agreement protocol. If c = c, A wins the game and breaks the semantic security of P . The event where A wins is denoted as Succ. Thus, we have: A d v P A K A t ≤ q h 2 2 l + 2 ⁡ max C ′ q s e n d s ′ , q s e n d 2 l , ε q s e n d + 2 A d v C M D L P t (6) where q h , q s e n d , l and ε respectively denote the number of random oracle queries, the number of Send queries, the output length of random oracle and the probability of a false positive by the simulation extractor. The parameters c ′ and s ′ are those of the Zipf distribution.

Proof: Five distinct games G M i are defined for formal analysis. Let Succ i denote the success event in game G M i , and Pr S u c c i represent the probability that adversary A correctly guesses the value of c and wins the game in G M i . A initiates the Test query and attempts to guess the value of c .

Game G M 0 :

G M 0 simulates a real-world attack on the proposed protocol P . Adversary A must randomly choose a bit ccc before the game begins. By definition, we obtain: A d v P A K A = 2 ⁡ Pr S u c c 0 − 1 (7)

Game G M 1 :

In this game, within the random oracle model, adversary A performs a passive eavesdropping attack. However, based on the messages transmitted over the public channel, A is still unable to compute the session key or obtain any other secret information. Therefore, we have: Pr S u c c 1 = P r S u c c 0 (8)

Game G M 2 :

Building upon the previous game, G M 2 additionally includes simulations of the Send and Hash queries. Assuming that A attempts to find a collision in the hash function, the collision probability based on the birthday paradox is given by: Pr S u c c 2 − Pr S u c c 1 ≤ q h 2 2 l + 1 (9)

Game G M 3 :

Building upon Game G M 2 , Game G M 3 introduces the C o r r u p t query to simulate the security of multi-factor authentication. Through this query, adversary A can interact with the user U i and S j to attempt to obtain the session key. Assume that adversary A can compromise at most two authentication factors. This leads to the following three scenarios:

A obtains the smart card and the user password: That is, by issuing C o r r u p t I i U i , 0 and C o r r u p t I i U i , 1 , adversary A gains access to the smart card and password. In this case, A may attempt to retrieve the biometric feature B i through Send queries. The success probability is: q s e n d 2 l .

In addition, due to the use of fuzzy extractors, false positives may occur. The probability that adversary A successfully deceives the reproduction function Rep(⋅) is bounded by ε , and the success rate for such deception through Send queries is: ε q s e n d .

Therefore, we obtain the following result: Pr S u c c 3 − Pr S u c c 2 ≤ max C ′ q s e n d s ′ , q s e n d 2 l , ε q s e n d (10)

Game G M 4 :

In Game G M 4 , adversary A is allowed to perform the C o r r u p t AD query, which simulates the physical capture of a sensor node. Through this query, A obtains the information stored in A D j . In addition, A can use the Execute query to eavesdrop on all messages exchanged during the authentication and key agreement process. Although adversary A attempts to compute the session key, decryption is not possible because A lacks the user’s secret paramaters. Furthermore, the adversary cannot obtain the necessary random values used in key generation. As a result, in order to derive the session key, A must solve the CMDLP problem. Let A d v C M D L P denote the advantage of adversary A in solving the CMDLP problem within time t. Therefore, we conclude: Pr S u c c 4 − Pr S u c c 3 ≤ A d v C M D L P t (11)

In Game G M 4 , all random oracle simulation queries are executed. Therefore, we have: Pr S u c c 4 = 1 2 (12)

According to Equations 6–12, we obtain: A d v P A K A t ≤ q h 2 2 l + 2 ⁡ max C ′ q s e n d s ′ , q s e n d 2 l , ε q s e n d + 2 A d v C M D L P t . The above sequence of games demonstrates that the protocol is provably secure under the Random Oracle Model (ROM).

In this section, we discuss the main safety features. We have conducted a comprehensive analysis of the plan to demonstrate that the proposed approach can achieve these safety features [48].

User Anonymity: During the registration phase, message is transmitted over a secure channel. Therefore, if an attacker attempts to launch an illegal attack, their only option is to perform cryptanalysis using the information intercepted from the user’s smart card (SC) and non-secure channel. Suppose the attacker has stolen the user’s smart card SC and conducted a power analysis attack to extract the parameters stored in the card. Even so, the SC does not contain the user’s identity information. Any attempt to recover the identity would inevitably encounter the difficulty of inverting the hash function. Moreover, even if the attacker intercepts communication over the non-secure channel, the use of anonymous identities by the user prevents the attacker from obtaining the user’s real identity.

In this subsection, the proposed scheme is compared with other existing protocols. The proposed scheme can effectively resist various types of attacks and largely meets the relevant security and functional requirements. In the table, a check mark (√) indicates that the protocol satisfies the corresponding security or functional requirement, while a cross mark (×) indicates that it does not. F1–F10 represent abbreviations for different attack types and functional features, with corresponding explanations provided below Table 2.

This subsection presents a comparison of the computational overhead of the proposed schemes. The comparison is based on the computational efforts required by the protocol entities during the authentication and key agreement processes. The computation times are uniformly defined as follows: hash function, elliptic curve scalar multiplication, and chaotic map computation cost are denoted as T h ≈ 0.00038 m s , T e c m ≈ 0.5078 m s and   T c m ≈ 0.3118 m s , respectively.

As shown in Table 3 and Figure 4, the proposed scheme exhibits significant advantages in multiple aspects. In terms of total computational cost, the Our scheme has a total of 6 T c m + 25 T h , which is among the lowest compared to other schemes. Although the usage of T h is slightly higher, the amount of T c m is relatively lower, indicating a well-balanced design between complex and regular computations, thus leading to higher efficiency in resource utilization.

Regarding total execution time, the Our scheme achieves a time of 1.88030, which is only slightly higher than that of [46] (1.53252) and [43] (1.87992), but significantly better than other schemes such as [42] (4.07076) and [44] (5.59188). This demonstrates that the Our scheme performs excellently in terms of efficiency and can meet high-performance requirements.

Furthermore, in terms of task distribution, the Our scheme maintains a balanced computational load among the user, cloud server, and access device. Specifically, the user side is responsible for 3 T c m + 8 T h , the cloud server handles 3 T c m + 10 T h , and the access device takes 7 T h . Compared to other schemes where one component may bear a disproportionate load, the Our scheme avoids performance bottlenecks, contributing to more stable and scalable system operation.

In summary, our scheme demonstrates strong overall advantages in computational efficiency, execution time, and load distribution, making it well-suited for practical deployment and widespread application.

Table 4 and Figure 5 present a comparison of the communication overhead between the proposed protocol and five related protocols. For the sake of a fair comparison, the lengths of various parameters are uniformly set as follows: 160 bits for the Chebyshev polynomial, 320 bits for points on the elliptic curve, 160 bits for hash values, 128 bits for random nonces, 32 bits for the identities of the user and the access device node, 32 bits for timestamps, and 128 bits for blocks used in symmetric encryption and decryption. In addition, the communication process in the proposed protocol involves several potential components, including the user terminal, the PUF module embedded in the device, the encryption/decryption unit, the secure communication channel (e.g., TLS/SSL), and the core cloud server with its key management and auditing modules. These components together ensure the reliability, confidentiality, and integrity of message exchanges, forming the foundation for a fair and meaningful comparison of communication overhead.

As shown in Table 4, the proposed scheme demonstrates a significant advantage in terms of communication cost, achieving a total of 2,144 bits, which is relatively low compared to all the referenced schemes.

Specifically, compared to the highest communication cost in [43] (3,232 bits), the proposed scheme reduces the overhead by approximately 33.7%. It also achieves reductions of about 24.7% compared to [42] (2,848 bits), 21.2% compared to [44] (2,720 bits), and 23.9% compared to [46] (2,816 bits). Although [45] has the lowest communication cost (1,760 bits), it likely involves trade-offs in terms of computational complexity, security mechanisms, or functional completeness; otherwise, it would not be outperformed by more efficient schemes.

Overall, the proposed scheme effectively reduces communication overhead while maintaining system security and functional integrity. It achieves a communication cost optimization of approximately 20%–35% compared to most existing schemes, making it well-suited for bandwidth- and energy-constrained environments such as the Internet of Things and edge computing.