SLACPSS: Secure Lightweight Authentication for Cyber–Physical–Social Systems

Abstract

The concept of Cyber–Physical–Social Systems (CPSSs) has emerged as a response to the need to understand the interaction between Cyber–Physical Systems (CPSs) and humans. This shift from CPSs to CPSSs is primarily due to the widespread use of sensor-equipped smart devices that are closely connected to users. CPSSs have been a topic of interest for more than ten years, gaining increasing attention in recent years. The inclusion of human elements in CPS research has presented new challenges, particularly in understanding human dynamics, which adds complexity that has yet to be fully explored. CPSSs are a base class and consist of three basic components (cyberspace, physical space, and social space). We map the components of the metaverse with that of a CPSS, and we show that the metaverse is an implementation of a Cyber–Physical–Social System (CPSS). The metaverse is made up of computer systems with many elements, such as artificial intelligence, computer vision, image processing, mixed reality, augmented reality, and extended reality. It also comprises physical systems, controlled objects, and human interaction. The identification process in CPSSs suffers from weak security, and the authentication problem requires heavy computation. Therefore, we propose a new protocol for secure lightweight authentication in Cyber–Physical–Social Systems (SLACPSSs) to offer secure communication between platform servers and users as well as secure interactions between avatars. We perform a security analysis and compare the proposed protocol to the related previous ones. The analysis shows that the proposed protocol is lightweight and secure.

1. Introduction

Cyber–Physical–Social Systems (CPSSs) are systems that tightly integrate data processing across physical systems, cyberspace, and social interactions by utilizing diverse resources such as sensors, actuators, and computational systems to create a unified entity within digital environments. CPSSs consist of three classes (cyber systems, physical system, and social systems); these systems depend on communication, processing, and control infrastructures that frequently cross layers in all three systems and contain a variety of resources, such as sensors, actuators, computer resources, services, people, etc. As shown in Figure 1, a CPSS can be described based on its primary elements in the following manner: the cyber system (a system comprising only technical components, such as computers, networks, etc.), the physical elements (controlled entities), and the social elements (e.g., humans).

CPSSs facilitate intelligent interaction across cyber, physical, and social spaces. CPSSs focus on the interaction of human society with other system components; the purpose is to gather and categorize resources in a manner that is beneficial for both machines and humans [1]. These systems collect data from virtual and real spaces by utilizing sensors, mobile crowd sourcing, and social networks. The goal is to offer users information to support their decisions and improve overall results [2].

CPSSs have greatly developed in most areas of life and have become irreplaceable. CPSSs have been applied across numerous domains, including smart cities [3], intelligent transportation [2], healthcare [4], smart tourism [5], behavioral profiling to predict future behaviors [6], and artificial societies. An example of a cyber system is a computer system within a healthcare institution, allowing physicians, nurses, and even patients to access medical data. Interactions between doctors and patients, nurses and patients, doctors and nurses, etc., are examples of social relationships. In particular, data relating to the physical aspects of the system can be discovered and saved, and the data can be transferred using the cyber system. [4].

The concept of a “metaverse” was named by merging the terms “meta” and “universe” and refers to a digital environment existing in three dimensions. In this realm, virtual representations known as avatars engage in a wide range of activities including political, economic, social, and cultural interactions. Such an environment is frequently used to depict a virtual space that reflects real-life elements alongside fantasy components. The physical layer is a vital component in the metaverse, serving to enhance the immersive experience while also posing technical challenges. Despite the rapid progress in metaverse hardware, ongoing development is necessary to achieve the same level of realism as the physical world. The key hardware element in the metaverse is the head-mounted display (HMD).

The cyber layer is indispensable in the operation of the metaverse as it provides software-based services through cyber systems, whether they are on the premises or in the cloud. This includes the underlying infrastructures and platforms. Within the metaverse, the social system is defined by the interaction between users and software applications in a three-dimensional virtual space, where they take on the appearance of avatars. According to the information provided, it can be concluded that the metaverse functions as a Cyber–Physical–Social System. Another example that lends itself to CPSSs is the metaverse, where “metaverse” serves as an umbrella concept for the future Internet, with humans being represented as avatars; by immersing themselves in a three-dimensional environment that accurately replicates the physical world, users and software agents can engage in interactive exchanges with one another [7].

Figure 1. A Cyber–Physical–Social System (CPSS), the image was taken from [8].

Figure 1. A Cyber–Physical–Social System (CPSS), the image was taken from [8].

The metaverse consists of sensors; a computer system with storage; and 3D virtualization technologies such as virtual reality (VR), augmented reality (AR), and mixed reality (MR) with human-controlled devices, as shown in Figure 2. The metaverse has been applied in a variety of areas, including gaming and social research, as well as marketing simulations and education due to its ability to provide an immersive learning experience. These simulations accurately depict real-world tasks, making them a valuable tool for various educational applications.

The metaverse is very popular in gaming, E-learning, healthcare, smart cities, and simulated training and serves as the most popular platform. Before the COVID-19 pandemic, online education was already experiencing consistent growth year after year. The effective provision of education in a virtual setting has long been a subject of research interest [9,10,11,12]. Due to the worldwide spread of the pandemic, the education of many children, especially those in vulnerable situations, has been significantly impacted. UNICEF’s April 2020 report revealed that traditional classroom teaching was interrupted in most countries, leading to more than 91% of students globally being unable to attend physical classes [13]. The emergence of the pandemic constrained individuals’ movement in physical environments, resulting in a marked surge in the dissemination of digital material. E-learning presents a remedy for the obstacles presented by geographical boundaries, although traditional techniques frequently fall short in producing desirable results [14,15]. Various digital technologies, such as computing capabilities and networks, have progressed, resulting in the creation of immersive virtual environments in education. Through the use of XR, cloud computing, and other advancements, educators, mentors, and professionals are able to engage with students in a collaborative virtual learning space [11,16]. The educational metaverse presents numerous possibilities for expansion and discovery. It is essential to prioritize enhancing the quality of portrayals in the metaverse and increasing its accessibility.

The metaverse provides a unique opportunity for medical instruction by delivering an immersive encounter and enhanced interoperability. Through the integration of MR and AI technologies, individuals can explore a virtual human body, gaining a comprehensive understanding of organs and engaging in simulated surgical practices [17]. Smart cities use a combination of software, communication networks, and the Internet of Things (IoT) to gather varied data within cities. These data are then scrutinized to derive astute solutions that enrich public life. Numerous countries around the world have already initiated the establishment of clever cities with the aim of refining traffic conditions, preserving energy, enhancing urban safety measures, and providing optimal planning solutions for urban development. Smart city technology improves productivity in manufacturing, urban agriculture, and energy usage while also enabling the merging of different services to offer cooperative solutions for residents. Within the metaverse, the use of digital twin (DT) technology to create digital cities and replicate real-time urban settings can promote economic growth, support efficient human resource management, and enhance the natural environment, ultimately elevating the residents’ quality of life [18,19].

The metaverse shows promising results, but continued growth is hampered by significant challenges due to security and privacy issues. To overcome these security and privacy issues in metaverse systems, and to deal with the heaviness of the authentication processes, we propose a Secure Lightweight Authentication (SLACPSS) protocol to secure avatar interactions and communication in the metaverse environment and conduct an informal study to prove that the proposed Lightweight mutual authentication system is resistant to a number of security risks, such as impersonation, theft of a smart device, man-in-the-middle (MITM) and insider attacks, offline password guessing, server spoofing on platforms, perfect forward secrecy, superior insiders, and ephemeral secret leakage, and provides user anonymity and mutual authentication.

The rest of the paper is organized as follows: We present the metaverse and its security threats in Section 2; in Section 3, we display the related work; in Section 4, we present the proposed protocol for secure lightweight authentication in a Cyber–Physical Social System (SLACPSS); we discuss the security analysis in Section 5; and finally, conclusions are drawn in Section 6.

2. Metaverse and Security Threats

Users can log in whenever they choose to interact with others within a continuous virtual environment with an avatar, where they have the opportunity to take part in a range of activities including gaming, trading, artistic expression, and discovery. Through their avatars, users can explore online pages within 3D virtual environments. The metaverse has the capacity to enhance accessibility and cater to diverse social needs. For example, numerous events have shifted to virtual formats with the assistance of the metaverse. In 2020, UC Berkeley conducted its graduation ceremony in Minecraft. Furthermore, in Fortnite, every day, a lot of virtual events take place, like a Travis Scott concert. Regarding diversity, the real world lacks the ability to bring together different elements in a single location to meet the needs of diverse individuals. In contrast, the metaverse offers a boundless space for expansion and effortless transitions between scenes, making it an effective platform for achieving diversity. The metaverse presents numerous captivating scenarios, such as the popular game Animal Crossing [20].

2.1. Metaverse Architecture

The metaverse is a virtual environment that includes user-controlled avatars, digital entities, simulated environments, and other computer-generated elements. Within this environment, individuals can utilize their virtual identities on various smart devices, represented by their avatars, to interact, collaborate, and engage socially with one another. We will provide a detailed analysis of the interrelations between the three worlds and provide a detailed explanation of the components found in the metaverse.

2.1.1. Human Society

The metaverse is seen as a human-centered system [21]. Human users, along with their internal psychological dynamics and social relationships, comprise the human sphere. The metaverse offers a platform where humans can seamlessly connect with their digital avatars through human–computer interaction (HCI) and extended reality (XR) technologies [22]. This allows for a wide range of experiences, including gaming, work-related tasks, and social interactions.

2.1.2. Physical Infrastructures

The metaverse relies on the physical environment to establish necessary infrastructures, including sensing/control, communication, computation, and storage. These infrastructures enable the metaverse to perceive, transmit, process, and cache multi-sensory data while facilitating effective interactions with the digital and human worlds.

2.1.3. Interconnection of Virtual Worlds

According to the guidelines established by ISO/IEC 23005 and IEEE 2888 [23,24], the digital realm consists of a series of interconnected distributed virtual worlds, referred to as sub-metaverses. Each sub-metaverse can offer unique virtual products/services, such as gaming, social networking, online museums, and virtual concerts, along with virtual settings such as game environments and virtual cities, to users who are depicted as digital avatars—virtual representations of individuals in the metaverse. Users can create a variety of avatars in various metaverse applications, which can resemble humans, animals, or mythical beings.

2.1.4. Metaverse Engine

The metaverse engine [25] employs interactivity, artificial intelligence (AI), digital twin, and blockchain technologies to process real-world big data, enabling the generation, maintenance, and updating of the virtual world.

2.1.5. In-World Information Flow

The human world is interconnected by social networks and established through collective activities and mutual engagements among people as follows:

• In the physical world, sensing and control infrastructure driven by IoT technologies is a key element in the digital transformation of the physical world, utilizing pervasive sensors and actuators. The resulting massive data from IoT devices are transmitted and processed through network and computing infrastructures.
• Within the digital realm, the metaverse engine efficiently processes and organizes digital information gathered from both the physical and human spheres, enabling the construction and presentation of vast metaverses while offering a selection of metaverse services.

2.1.6. Information Flow across Worlds

The Internet and the Internet of things (IoT) are the key platforms among the three domains. Further details are provided below:

• By employing human–computer interface (HCI) technologies, humans can engage with physical objects, and XR technologies allow them to immerse themselves in virtually augmented reality, such as holographic telepresence.
• The connection between the human world and the digital world is facilitated by the Internet, which is the largest computer network globally. Through smart devices like smartphones, wearable sensors, and VR helmets, users can engage with the digital realm for purposes such as knowledge creation, sharing, and acquisition.
• The interconnection of smart devices in the IoT infrastructure facilitates the seamless exchange of information between the physical and digital realms, enabling effective digitalization [26].

2.2. Security Threats to the Metaverse

The subsequent section will present an outline of the threats that exist in the metaverse, specifically focusing on authentication, data management, privacy, the metaverse network, the metaverse economy, the physical world and human society, and metaverse governance, as shown in Figure 3.

2.2.1. Threats to Authentication in the Metaverse

Within the metaverse, unauthorized acquisition, impersonation, and authentication discrepancies can pose significant challenges across virtual worlds. The threats are described below:

• Identity Theft: If a user’s identity is stolen in the metaverse, their avatars, digital belongings, social connections, and digital life may be at risk of being exposed and lost, posing a more significant threat than in traditional information systems.
• Impersonation Attack: Within the metaverse, an impersonation attack can be executed when an attacker pretends to be an authorized entity, allowing the attacker to gain access to services or systems without proper authorization [28].
• Avatar Authentication Issue: Verifying the authenticity of avatars, such as confirming friends’ avatars, presents a more complex task in the metaverse than real-world identity authentication. This complexity arises from the necessity to validate facial features, voice, video recordings, and similar aspects.
• Trusted and Interoperable Authentication: To achieve the security, efficiency, and reliability of diverse service domains and virtual worlds in the metaverse, users and avatars must promptly establish a robust cross-platform and cross-domain identity verification system. This system should be able to operate seamlessly across various platforms, including blockchains.

2.2.2. Threats to Data Management in the Metaverse

In the metaverse, both the data collected or generated by wearable devices and users/avatars are exposed to threats such as data tampering, false data injection, low-quality user-generated content, challenges in tracing ownership/provenance, and potential violations of intellectual property. These threats are explained below:

• Data Tampering Attacks: Integrity characteristics play a crucial role in ensuring the efficient monitoring and identification of changes that occur during data exchange across ternary worlds and diverse sub-metaverses. Adversaries can manipulate, counterfeit, substitute, and eliminate unprocessed data throughout the metaverse data services’ lifecycle to disrupt the normal activities of users, avatars, or physical entities [29].
• False Data Injection Attacks: Attackers can inject falsified information, including false messages and incorrect instructions, to mislead metaverse systems [30]. For example, the use of AI-aided content creation can contribute to an enhanced user experience during the initial phase of the metaverse. However, adversaries can exploit this by injecting adversary training samples or poisoned gradients into centralized or distributed AI training, thereby generating biased AI models.
• Issues in Managing New Types of Metaverse Data: When examining the metaverse in relation to the existing Internet, it becomes evident that new hardware and devices are necessary to collect diverse forms of data (e.g., eye movement, facial expression, and head movement) that were previously uncollected. Data collection is vital for enabling fully immersive user experiences [31].
• Threats to the Data Quality of User-Generated Content (UGC) and Physical Input: In the metaverse, self-centered users or avatars might upload low-quality content in UGC mode to reduce expenses, consequently impacting user experience by creating an artificial environment.
• Threats to User-Generated Content (UGC) Ownership and Provenance: Contrary to the government’s regulated asset registration process in the physical realm, the metaverse exists as an open and fully autonomous domain with no centralized authority in place.
• Threats to Intellectual Property Protection: In contrast to the real world, the definition of intellectual property in the metaverse should be modified to establish clear licensing boundaries and usage rights for owners as the metaverse expands [32].

2.2.3. Privacy Threats in the Metaverse

The protection of user privacy, which encompasses location privacy, habits, living styles, and other personal data, may be jeopardized throughout the lifecycle of data services in the metaverse, including data perception, transmission, processing, governance, and storage. The privacy threats are as follows:

• Pervasive Data Collection: For a truly immersive experience with an avatar, it is essential to conduct comprehensive user profiling at an exceedingly granular level [33], which includes facial expressions, eye and hand movements, speech patterns, biometric features, and even brainwave patterns.
• Privacy Leakage in Data Transmission: Personally identifiable information obtained from wearables such as Head-Mounted Displays (HMDs) is extensively gathered in metaverse systems and then transmitted through wired and wireless means, with strict measures in place to safeguard the confidentiality of these data from unauthorized parties [34].
• Privacy Leakage in Data Processing: Metaverse services rely on the collection and analysis of large amounts of data from people and their environments to develop avatars and virtual settings, posing a risk of sensitive information exposure [35].
• Privacy Leakage in Cloud/Edge Storage: Storing private and sensitive information, such as user profiling, for a significant number of users on cloud servers or edge devices can give rise to privacy disclosure concerns. Hackers can potentially deduce users’ privacy information by leveraging frequent queries through differential attacks [36].
• Rogue or Compromised End Devices: In the metaverse, an increased number of wearable sensors will be utilized on human bodies and their surroundings to enable avatars to establish natural eye contact, interpret hand gestures, mirror facial expressions, and more in real-time.
• Threats to Digital Footprints: Avatars in the metaverse can exhibit behavior patterns, preferences, habits, and activities that mirror those of their physical counterparts, enabling attackers to gather digital footprints and exploit the similarity to real users for accurate user profiling and potentially illegal activities [37].
• Identity Linkability in Ternary Worlds: As the metaverse incorporates reality within itself, the seamless integration of the human, physical, and virtual worlds gives rise to concerns regarding identity linkability across these ternary realms [32].
• Threats to Accountability: XR and HCI devices inherently capture a higher degree of sensitive data, such as user locations, behavior patterns, and surroundings, than traditional smart devices.
• Threats to Customized Privacy: Different users within specific sub-metaverses [38] tend to have unique privacy preferences for various services or interaction objects, similar to what is seen on other service platforms on the Internet.

2.2.4. Threats to Metaverse Network

In the metaverse, there are traditional threats (such as physical-layer security). Enhancing communication networks can also prove to be efficient as the metaverse advances beyond the current Internet and integrates current wireless communication technologies and threats such as SPoF, DDoS, and Sybil attacks.

2.2.5. Threats to the Metaverse Economy

The integrity of the creator economy in the metaverse is at risk due to potential attacks that undermine service trust, digital asset ownership, and economic fairness.

• Service Trust Issues in UGC and Virtual Object Trading: Avatars in the open metaverse marketplace can be considered untrustworthy entities due to the absence of prior interactions. This poses inherent risks of fraud, such as repudiation and refusal to pay, during user-generated content and virtual object trading among various stakeholders in the metaverse. Additionally, when constructing virtual objects using digital twin technologies, the metaverse must ensure the authenticity and trustworthiness of the produced and deployed digital copies [39].
• Threats to Digital Asset Ownership: The distributed metaverse system, lacking a central authority and featuring intricate circulation and ownership structures such as collective ownership and shared ownership [40], poses substantial challenges in the lifecycle of digital assets within the creator economy. These challenges encompass the generation, pricing, trusted trading, and ownership traceability of such assets.

2.2.6. Threats to the Physical World and Human Society

The metaverse represents an expanded version of a CPSS [41]. It involves complex interactions and interconnections between physical systems, human society, and cyber systems. Threats in virtual worlds can have severe implications for physical infrastructures, personal safety, and human society:

• Threats to Personal Safety: In the metaverse, hackers can exploit wearable devices, XR helmets, and indoor sensors like cameras to gather information on users’ daily routines and monitor their live locations, ultimately aiding in criminal activities such as burglary and endangering their safety [42].
• Threats to Infrastructure Safety: The identification of software or system vulnerabilities within the complex metaverse allows hackers to use compromised devices as entry points for launching APT attacks on critical national infrastructures like power grid systems and high-speed rail systems.
• Social Effects: Despite the appeal of the metaverse as a digital society, it can lead to severe side effects in human society, such as addiction, the spread of rumors, child exploitation, biased outcomes, extortion, cyberbullying, cyberstalking, and even simulated terrorist activities [43].

2.2.7. Threats to Metaverse Governance

The interactions among avatars in the metaverse, such as content creation, social activities, and the virtual economy, should mirror the social norms and regulations observed in the physical world to maintain compliance with digital norms and regulations [44]. In overseeing and governing the metaverse, it is crucial to address threats that could compromise system efficiency and security.

3. Related Works

The aims of this section are to examine the existing literature on metaverse security. References [45,46,47,48] address the security and privacy issues within the metaverse area. In addition, a study conducted by O’Brolchain et al. [49] in 2017 addressed the concerns surrounding security and privacy within the metaverse area, focusing on the communication between users and platform servers. In 2018, privacy was emphasized by Falchuk et al. [28]. They highlighted the significance of using avatars for communication between users. However, it was cautioned that if a malicious avatar is involved, it could potentially exploit and obtain sensitive information.

The security of the device utilized by the user to access the virtual world was examined by Guzman et al. [50] in 2019. Tan et al. [51] highlighted the utilization of blockchain technology in the metaverse for protecting user data and platform server security in 2022. Furthermore, the advantages of blockchain technology are also addressed in [52]. References [45,46,47,48,49,50,51,52] exclusively highlight the security concerns that arise in the metaverse environment when users interact with virtual realms. They do not suggest any authentication method to protect users’ communication when connecting to virtual worlds. A virtual reality teaching platform was proposed by Gan et al. [53] in 2021, aiming to offer users an immersive educational experience. This mechanism relies on the use of Elliptic Curve Cryptography (ECC) and asserts its ability to defend against all forms of attacks.

However, the security analysis indicates that the scheme is vulnerable to impersonation attacks in the presence of a malicious platform server, assuming the CK adversary model. On the other hand, there are only a few articles that can be utilized in the metaverse environment as well [54].

The authentication mechanisms utilizing ECC discussed in references [55,56,57] were found to be vulnerable to various types of attacks according to the security analysis conducted in [58,59]. In a study conducted in 2018, Falchuk et al. [33] highlighted the necessity of privacy in metaverse environments. They identified personal information, behavior, and communication data as major areas of concern when it comes to privacy.

The researchers cautioned that sharing personal information while interacting with potentially harmful avatars, such as through trading or chatting in virtual worlds, could make individuals susceptible to privacy violations. This could result in privacy invasion, impersonation, and identity theft by malicious actors who take advantage of the disclosed personal information. Yang et al. [60] declared in 2022 that by employing blockchain technology, data transparency, openness, authenticity, and efficiency can be achieved in metaverse environments. Ryn et al. [54] declared in 2022 that a system model would be developed using blockchain technology to guarantee secure communication and efficiently manage user identification data in metaverse environments. Additionally, they suggested a mutual authentication method incorporating biometric data and Elliptic Curve Cryptography (ECC).

4. Preliminaries

In this section, we go over basic preliminaries such as Biohashing and Elliptic Curve Cryptography (ECC).

4.1. Elliptic Curve Cryptography (ECC)

ECC uses an elliptic curve over a vast finite field, resulting in higher security performance with smaller key sizes than earlier public-key encryption techniques [61,62]. Assume that p is a large prime, that Fp is an abbreviation for prime fields, and that 4u3 + 27 r2 ≠ 0 (mod p). EP (u, r):y2 = x3 + u x + r (mod p) denotes a nonsingular elliptic curve that follows over Fp. Consider Q as the basis point for EP (u, r) as well as a positive integer t € Fp, where t stands for point multiplication. Q is equal to Q + ···+Q (t times).

4.2. Biohashing

The user’s biometric data can be utilized as an additional authentication factor and is an appropriate technique to recognize a genuine user. To validate users, Jin et al. [63] presented the biohashing function and showed how it may be used to transform user fingerprint data into a bit form:

• A vector, V € R_n, is used to represent a biometric characteristic derived from the fingerprint.
• Using the Blum–Blum–Shub method, a set of r_i € Rn (i = 1···n) pseudo-random numbers is generated.
• The Gram–Schmidt procedure is used to change the basis r_i into an or_i € Rn (i = 1, ···n) using generated pseudo-random numbers.
• The inner product between V and ori is obtained, followed by the calculation for the biohash code bi:

$$\mathrm{b}\mathrm{i}=\left\{\begin{array}{c}0 \mathrm{if} \left(\mathrm{V}\right|\mathrm{ori})\le \tau \\ 1 \mathrm{if} \left(\mathrm{V}\right|\mathrm{ori})>\tau \end{array}\right.$$

where $\tau$ is a threshold.

5. Proposed Secure Lightweight Authentication for Cyber–Physical–Social System (SLACPSS)

The process flow of the proposed protocol is categorized into five phases, namely initialization, user setup, avatar creation, login and authentication, and avatar authentication, to provide secure avatar-to-avatar interactions in virtual environments.

5.1. System Model

As shown in Figure 4, the certificate authority, users, platform servers, and database make up the system paradigm for a metaverse environment. They are explained below:

• Certificate authority (CA): The certificate authority is a completely reliable entity that sets the initial system parameters and shares public information. The certificate authority obtains the user’s pseudo-identity, public key, and personal details from the user, which will be used to verify the user’s identity and are then stored in the database. Moreover, the certificate authority generates user credentials that need to be authenticated by the user and the platform servers. These credentials are then delivered to the user.
• User: The user submits their pseudo-identity, public key, and personal details to the certificate authority for verification of their identity in order to join the metaverse. Subsequently, the user can interact with different platform servers by undergoing an authentication procedure that relies on the user’s pseudo-identity and credential information. Following that, the user can design an avatar and enter different virtual environments overseen by the platform servers. Moreover, the user can verify their identity with other avatars by utilizing the pseudo-identity and public key saved in the database, ensuring secure interactions between avatars in virtual spaces.
• Platform Server: Each platform server offers a range of immersive services, including education and gaming, to users within virtual spaces. When a user tries to log into the platform server, their credentials and pseudo-identity are verified using the database and the public key of the certificate authority.

Figure 4. System model for metaverse as a Cyber–Physical–Social System.

Figure 4. System model for metaverse as a Cyber–Physical–Social System.

Furthermore, each platform server is tasked with handling request and response messages within their virtual spaces for avatar authentication procedures, and the notations and parameters used in the proposed scheme are given in

Table 1. Notations and parameters.

No.	Notation	Description
1	UGC	User-Generated Content
2	MITM	Man in the Middle
3	HMDs	Head-Mounted Displays
4	CA	Certificate Authority
5	U i	User
6	St	Platform Server
7	ID i	Identity of Ui
8	PIDi	Pseudo-Identity of Ui
9	PWi	Password of Ui
10	B i	Biometric Information of Ui
11	SD i	Smart Device of Ui
12	Avatari	Avatar Identity of U i
13	info i	Personal Information of U i
14	PK ca, PK i, PK st	Public Key of CA, U i, and St
15	K ca, K i, K st	Private Key of CA, U i, and St
16	Sig i_ca	Signature Value Generated by CA
17	RNi, xi, ni, n1, n2, n3, n4	Random Numbers
18	T1, T2, T3, T4	Timestamp
19	SK	Session Key
20	SYE K, SYD K	Symmetric Encryption and Dec
21	h (·)	One-Side Hashing Method
22	h b (·)	Biohash Function
23	⊕	Exclusive OR Operation
24	||	Concatenation

.

The technique of the proposed system model is as follows:

• The certificate authority requires users to share their pseudo-identity, public key, and personal information to verify their identity and grant access credentials for interacting with metaverse environments.
• On each platform server, an avatar can be created using the user’s pseudo-identity, public key, and credential information. The user then sends an authentication message to the suitable platform server to gain access to the pertinent virtual spaces.
• If the authentication process goes well, the platform server will provide the user with a session key.
• The session key will then be used to establish a secure connection between the user and the platform server.
• A user can communicate with other avatars after entering a virtual environment using an avatar. The avatar authentication phase can be handled by the user for safe interactions between avatars.

5.1.1. Initialization Step

As shown in

Table 2. Initialization phase.

Certificate Authority (CA)
Over Fp, CA chooses a nonsingular Elliptic Curve EP (u, r). A base point is chosen using CA (P on EP (u, r)). CA chooses a secret key, k ca PK ca = kca + P is created by CA. The following system parameters are published by CA: EP (u, r); P; PK ca; h (•); h b (•)

over Fp, CA chooses a nonsingular Elliptic Curve EP (u, r); a base point, P, is chosen using CA on EP (u, r), and CA chooses a private key, k ca.

The public key (PK; ca = kca·P) is created by CA. The following system parameters are published by {EP (u, r), P, PK ca, h (·); h b (·)}.

5.1.2. User Setup Step

Ui must verify the identification with the CA during the user setup procedure in order to obtain the credentials required to interact in the metaverse environment. The process for the user setup step, which is shown in

Table 3. User setup step.

User (Ui)                     Certificate Authority (CA)

Input ID i, PW i, B i Generate random number, RN i Generate private key, k i PK i = k i·P Compute PID i = h (ID i|| RN i)                 { PIDi, PK i, info i}                               Check the uniqueness (PID i, PK i) in database                   Verify info i                   Generate random number x i                   Compute X i = x i·p                   Sig i_ca = x i + h (PID i || PK i||X i) · kca                   V i = (Xi, Sig i_ca)                   saves (PID i, PK i) in database          {Vi}     Compute Z = Vi ⊕ h (IDi || PW i || RN i) save {Z} in SD i

, is described below.

• ID i, PW i, and B i are entered by the Ui into SDi, which then makes a random integer, RN i, and a private key, ki. The public key (PK i = k i · P) and pseudo-identity (PID i = h (ID i || RN i)) are then calculated by Ui. Then, the Ui transmits the message {PID i, PK i, info i } to CA across a trust line, where info (i) is the Ui’s private information.
• CA verifies the information and examines the database’s (PID I; PK i) uniqueness. If this process is finished successfully, CA makes a random number, xi, and calculates X i = x i · p, Sig i_ca = x i + h (PID i || PK i || X i) · k ca, where Sig i_ca is the signature value used to verify that Ui has been approved by the CA. Afterward, the CA transmits V i = (X i, Sig i-ca) and saves (PID i, PK i) in the database.
• The CA transmits {Vi} to U i by the trusted line.
• U i calculates Z = Vi ⊕ h (ID i || PW i|| RN i) and then saves Z in SD.

5.1.3. Creating an Avatar

• To enter the virtual environment managed by the St, the Ui creates an avatar using SDi during the creating an avatar stage, and the avatar making process is shown in

  Table 4. Creating an avatar.

  User (Ui)                                  Platform Server (St)

  Input ID i, PW i, B i Compute Vi* = Z + h (ID i|| PW i|| RN i) Verify Vi* = Vi Generate avatar i and random number, n i Compute Ni = n i · P EM i = (N i||Sig i_ca) ⊕ h (avatar i || PID i || RN i)                     { avatari, PID i, EM i}                                        Check PID in database and retrieve PK i                     Check uniqueness (avatar i, PK i) in database                       Compute (N i|| Sig i_ca) = EM i ⊕ h (avatar i|| PIDi ||RNi)                       Sig i – ca · P = x i · P + h (PID i|| PK i ||Xi) · k ca · P                       Sig i_ca·P =X i + h (PID i || PK i|| X i) · Pk ca                       save {avatar i, PK i} in database                       Publish { avatar i, PK i } in virtual space

  , which is detailed below.
• ID i, PW i, and B i are entered by the U i into SDi and then they create and calculate a random number, RN I, and a private key (k i) and public key (PK i = k i · P). Then, Vi* = Z + h (IDi ||PWi||RNi) is calculated, and the user creates a random number (n i) and calculates Ni = ni · P and EM i = (N i||Sig i_ca) ⊕ h (avatar i||PID i||RN i).
• Through a secure channel, the Ui transmits {avatar i, PID i, EM i } to the St.
• The St retrieves PK i after checking PID i in the database, the St confirms the database’s uniqueness of (avatar i, PK i), and the St calculates (Ni ||Sig i_ca) = EMi ⊕ h (avatar i || PID i|| RN i) and Sig i_ca · P = x i · P + h (PID i ||PK i || X i) · PK ca.
• The St saves (avatar i, PK i) in the database and publishes (avatar i, PK i).

5.1.4. Login and Authentication Step

In order to access the virtual area, a user must log in using an avatar. The processes that the U i and St undergo to obtain the session key to implement secure communication are listed below. The phase of login and authentication is shown in Table 5.

• ID i, PW i, and B i are entered by the U i into SDi, and then a random number (n 1 and T1) is created and calculated.
• The U i calculates N 1 = n 1 · P, Ver i - st = h (avatar i||PID i||T1) · K i, and EM 1 = (avatar i|| PID i|| Ver i - st) + h (N1||T1).
• The U i transmits {EM 1, T 1} to St by a public channel.
• Then, St receives {EM 1, T 1} from U i.
• T1 is checked by the condition |T1* − T1|.
• St calculates Ver i - st · P = ? h (avatar i|| PID i||T1) · PK i.
• St creates T2 and n 2 and calculates N 2 = n 2 ·P.
• SKi- st = h (avatar i||N2||T2) ·K st.
• St calculates EM 2 = h (avatar i||PID i||N 2||T 2) ⊕ (SKi- st||T 2).
• St transmits {EM 2, T 2} to U i by a public channel.
• As soon as the U i receives {EM 2, T 2} from St, T2 is checked by the condition |T2* − T2|, and the user calculates SKi- st · P = h (avatar i||N2||T2) · PK st and EM*2 = h (a vatar i||PID i || N2||T 2) ⊕ (SKi- st||T 2) and verifies EM*2 =? EM 2.

Table 5. Login and authentication step.

User (Ui)                           Platform Server (St)

Input ID i, PW i, B i Generate random number, n1 and T1 Compute N1 = P· n1 Compute Ver i – st = h (avatar i|| PID i||T1) · K i EM 1 = (avatar i|| PID i||Ver i - st) + h (N1 ||T1)                          { EM1, T 1}                                      Check | T1* − T1|                          Ver i - st·P =? h (avatar i|| PID i|| T1) · PK i                        Generate T2 and n2                        Compute N2 = P · n2                        SKi - st = h (avatar i|| N2||T2) · K st                        EM 2 = h (avatar i || PID i || N2||T 2) ⊕ (Ski – st || T 2)             { EM2, T 2}             Check |T2* − T2| SKi - st · P = h (avatar i|| N2 || T2) · PK st EM*2 = h (avatar i||PID i||N2||T 2) ⊕ (SKi - st||T 2) Verifies EM*2 = ? EM 2

Table 5. Login and authentication step.

User (Ui)                           Platform Server (St)

Input ID i, PW i, B i Generate random number, n1 and T1 Compute N1 = P· n1 Compute Ver i – st = h (avatar i|| PID i||T1) · K i EM 1 = (avatar i|| PID i||Ver i - st) + h (N1 ||T1)                          { EM1, T 1}                                      Check | T1* − T1|                          Ver i - st·P =? h (avatar i|| PID i|| T1) · PK i                        Generate T2 and n2                        Compute N2 = P · n2                        SKi - st = h (avatar i|| N2||T2) · K st                        EM 2 = h (avatar i || PID i || N2||T 2) ⊕ (Ski – st || T 2)             { EM2, T 2}             Check |T2* − T2| SKi - st · P = h (avatar i|| N2 || T2) · PK st EM*2 = h (avatar i||PID i||N2||T 2) ⊕ (SKi - st||T 2) Verifies EM*2 = ? EM 2

5.1.5. Avatar Authentication Step

Users have access to the avatar authentication stage only after exchanging session keys with the platform server and logging in, which ensures safe avatar interaction in the virtual environment. The platform server is simply in charge of forwarding request and response messages during this stage.

Avatars can execute mutual authentication in the virtual world using the procedure shown in

Table 6. Avatar authentication step.

User (U)          Platform Server (St)          User (Uj)

Generate n3 and T3 Compute N3 = P · n3 Compute Ver i = h (avatar i|| avatar j || PID i|| PID j||T3) · K i EM 3 = (PID i||Ver i) ⊕ h (N3 ||T3) Req = SYE SK i-st (avatar j, EM 3, T3)                { Req }                             Computes                (avatar j, EM 3,T3) = SYD SK i-st (Req)                Req i j = SYE SKj-st (EM 3,T3)                           { Req i j}                                             Compute (EM 3, T3) = SYD SK j-st(Reqi j)                         Check PID in database and retrieve PKi                         Verify                            Ver i · P = ? h (avatar i||avatar j ||PID i||PID j||T3) ·PK i                         Generate n 4 and T4                         Compute N4 = P· n4                         ver j = h (avatar j || avatar i|| PID j || PID i||T4) · K j                         EM 4 = (PID j|| Ver j) ⊕ h (N4||T4)                      {Res }   Res = SYE SK j-st(avatar i, EM 4, N4, T4)                              Compute                 (avatar i, EM 4, N4, T4) = SYD SK j-st(Res)                 Res i j = SYE SKi-st (EM 4, N4, T4)    { Resij} Compute (EM 4, N4, T4) = SYD SK i-st(Res i j) (PID j|| Ver j) = EM 4 ⊕ h (N4||T4) Check PID j in database and retrieves PK j Verifies ver j · P = ?h (avatar j || avatar i|| PID j || PID i||T4) · PK j If okay, U i and U j can demonstrate that avatars i and j are authenticated

.

• U i creates a random number (n 3 and T3) and calculates N 3 = n 3 · P.
• Ui calculates Ver i = h (avatar i|| avatar j || PID i|| PID j ||T3) · K i.
• EM 3 = (PID i|| Ver i) ⊕ h (N3|| T3) is calculated.
• U i calculates Req = SYE SK_i-st (avatar j, EM 3, T3).
• U i transmits {Req} to St by a public channel.
• St calculates (avatar j, EM 3, T3) = SYD _SKi-st (Req).
• St calculates Req i j = SYE SK_j-st (EM 3, T3).
• St transmits {Req ij} to U j by a public channel.
• U j calculates (EM 3, T3) = SYD _SKj-st (Req i j).
• PK i is retrieved by Uj after U j verifies PID in database.
• U j verifies Ver i · P = ? h (avatar i ||avatar j ||PID i || PID j ||T3) · PK i.
• U j creates T4 and n 4 and calculates N 4 = n 4 · P.
• ver j = h (avatar j||avatar i||PID j ||PID i||T4) · K j.
• EM 4 = (PID j || Ver j) h (N4|| T4).
• Res = SYE _{SK j – st} (avatar i, EM 4, N4, T4).
• U j transmits {Res} to St by a public channel.
• St calculates (avatar i, EM 4, N4, T4) = SYD _{SK j – st} (Res).
• Res i j = SYE _{SK i-st} (EM 4, N4, T4).
• St transmits {Res i j} to U i.
• User i calculates (EM 4, N4, T4) = SYD _{SK i- st} (Res i j).
• (PID j ||Ver j) = EM 4 ⊕ h (N4||T4).
• PK j is retrieved by Ui after Ui verifies PID j in database.
• ver j · P = ? h (avatar j ||avatar i ||PID j||PID i||T4) · PK j is verified.
• If every stage is successfully performed, the U i and U j can demonstrate their ownership of avatar i and avatar j.

6. Security Analysis

An informal security analysis of the proposed system is conducted similar to the one in [55]. The analysis shows that the proposed approach is resistant to various attacks, such as impersonation, a stolen smart device, MITM and insider attacks, offline password guessing, platform server spoofing, privileged insiders, and ephemeral secret leakage. In addition, our scheme provides perfect forward secrecy, user anonymity, and mutual authentication. Siddhartha et al. [64] proposed a Lightweight Authentication Protocol using Implicit Certificates for Securing IoT Systems (LAPIC) and evaluated the suggested protocol against several existing protocols. LAPIC is resistant to various attacks. We compared the proposed protocol (SLACPSS) with LAPIC and previous protocols used in [64] by the same attacks, as presented in

Table 7. Evaluation and comparison of prevention protocols.

Protocols	Theft of a Smart Device	Offline Guessing of Passwords	Impersonation	Platform Server Spoofing Attacks	Ephemeral Secret Leakage Attack	Insider Attack
Sciancalepore et al. [65], 2015	×	√	×	×	×	√
Porambage et al. [66], 2013	×	√	√	√	×	√
Kumar et al. [67], 2016	√	√	×	√	×	√
Kumar et al. [68], 2017	×	√	√	×	×	√
Li et al. [69], 2013	×	√	√	×	×	×
Vaidya et al. [70], 2011	√	√	√	×	√	×
Han et al. [71], 2013	×	×	×	√	×	√
Sciancalepore et al. [72], 2017	×	√	√	×	×	√
Patel et al. [73], 2016	×	×	×	√	×	×
Hossain et al. [74], 2017	×	×	×	×	×	×
Siddhartha et al. [64], 2019	√	√	√	√	×	√
RYU et al. [54], 2022	√	√	√	√	√	√
Proposed protocol (SLACPSS)	√	√	√	√	√	√
Protocols	Superior Insiders Attacks	Forward Secrecy		User Anonymity	Mutual Authentication
Sciancalepore et al. [65], 2015	×	×		√	√
Porambage et al. [66], 2013	×	√		√	√
Kumar et al. [67], 2016	√	√		√	√
Kumar et al. [68], 2017	×	√		√	√
Li et al. [69], 2013	×	×		√	√
Vaidya et al. [70], 2011	×	×		√	√
Han et al. [71], 2013	√	√		×	√
Sciancalepore et al. [72], 2017	×	×		√	√
Patel et al. [73], 2016	×	√		√	√
Hossain et al. [74], 2017	×	×		√	√
Siddhartha et al. [64], 2019	√	√		×	√
RYU et al. [54], 2022	√	√		√	√
Proposed protocol (SLACPSS)	√	√		√	√

.

6.1. The Theft of a Smart Device

Assume, using the adversary paradigm, that an opponent has access to the SDi and is able to obtain the stored parameter, Z. To ensure that the opponent cannot discover important information about the Ui, using IDi, PWi, and Bi, all of the arguments are hashed and XORed. Our system (SLACPSS) can therefore defend against attacks involving the theft of a smart device.

6.2. Offline Guessing of Passwords

Assume that a malicious party intercepts the messages {EM1, T1} and {EM2, T2} as they are being transmitted over the public channel, as shown in Figure 5, to obtain the parameter, Z, that is kept on the SDi. Following that, the attacker can attempt to compute the Ui’s sensitive information. However, without knowledge of IDi, PWi, and Bi, the adversary is unable to derive any sensitive data, such as Z = Vi ⊕ h (IDi|| PWi|| RNi). As a result, our system (SLACPSS) is protected against offline guessing of passwords.

6.3. Impersonation Attacks

Consider the possibility that someone with bad intentions can listen to a message being transmitted using a public channel. If an adversary seeks to impersonate the Ui, they should make a login request message that contains the characters {EM1,T1}. The adversary does not have permission to access the Ui’s private key (ki), random numbers (RNi; n1), identity (Idi), or password (PWi); therefore, they are unable to construct the login request message. Therefore, our system (SLACPSS) prevents impersonation attacks.

6.4. Platform Server Spoofing Attacks

Assume an adversary can show these messages ({EM1, T1}, {EM2, T2}) using an insecure channel to spoof the St. The attacker can then try to deceive legitimate users to create a replay message {EM*2, T*2}. However, the suggested approach protects against replay messages because the adversary lacks access to the private key (kst) and does not know the random number (n2). Consequently, our proposed system (SLACPSS) can withstand server spoofing on platform attacks.

6.5. Attacks by Replay and MITM

Assume the adversary captures the messages being transmitted ({EM1, T1}; {EM2, T2}) through the public channel. However, the adversary must validate the timestamps (T1; T2) and random numbers (n1; n2) to ensure the messages are current, For the login and authentication phase, the adversary cannot utilize the same messages. Additionally, the adversary has to know the random integers (n1; n2) and private keys (ki; kst) in order to calculate EM1 and EM2. Therefore, both replay and MITM attacks cannot be used against our approach (SLACPSS).

6.6. Forward Secrecy

Assume that the adversary captures the messages ({EM1, T1} and {EM2, T2}) through the public channel and acquires permanent secret keys {ki, kst}. After that, the adversary can attempt to calculate the SKi- st = h (avatar i || N2||T2) · Kst, but the adversary cannot calculate the SKi- st without knowing n2. Thus, our approach (SLACPSS) offers perfect forward secrecy.

6.7. Insider Attacks

An adversary can attempt to establish a malicious avatar, gain access to the St, and read the messages ({EM1, T1}, {EM2, T2}). However, the adversary is unable to determine the parameters needed to pass for the Ui, such as Ver i -st = h (avatar i || PID i ||T1) · PK i, without the private key (ki) and random number (n1). Additionally, suppose the adversary acquires the messages (Req, Reqij, Res, and Resij). Because the adversary does not know the SKi- st and SK j- st, they are unable to obtain the data needed to spoof avatars. Thus, insider assaults will not succeed against our scheme.

6.8. Superior Insiders Attacks

Assume that the adversary is one of the insider users of the St and the adversary captures the message {avatar i, PIDi, EM i}. In the avatar generation phase, the adversary captures the two messages ({EM1, T1} and {EM2, T2}) through the insecure channel. Without knowing n1 and ki, the adversary cannot make any data to impersonate the Ui, such as Ver i-st and EM1. Assume, furthermore, that the opponent has access to the messages (Req, Reqij, Res, and Resij). However, without n3, n4, ki, and kj, the adversary cannot gain the crucial information needed to impersonate avatars. As a result, our approach (SLACPSS) can defend against superior insider attacks.

6.9. Temporary or Ephemeral Secret Leakage Attack

An adversary tries to make ephemeral and long-part secret values. Then, they try to calculate the SKi-st = h (avatar i||N2||T2) · Kst generated between the Ui and St as follows:

• An adversary obtains the ephemeral secret values n1 and n2 to compute SKi-st.
• Assume that the adversary captures the long-part secret values Xi, ki, and K st to compute SKi-st.
• Without knowing the ephemeral numbers n1 and n2, S1 cannot be obtained.

Therefore, to calculate SKi-st, the adversary needs to possess both the short-part and long-part secret values. As a result, our approach (SLACPSS) can stop temporary secret leak attacks.

6.10. User Anonymity

Assume the adversary has the ability to obtain SDi through intercepting sent signals. They are unable to obtain the true identity (Idi) though the proposed system, so the Ui makes use of a pseudo-identity PID i = h (ID i || RN i) instead of ID i in the metaverse settings to ensure that ID i is never made public to any entities. Our approach (SLACPSS) can guarantee user anonymity.

6.11. Mutual Authentication

In the login and authentication step, the Ui transmits the login request message {EM1, T1} to the St. Then, the St obtains Veri- st by decrypting EM1 and retrieves PKi from the database using PIDi. Then, the St verifies (Ver i - st · P = ? h (avatar i || PID i ||T1) · PK i). If it is equal, the St can authenticate the Ui, and the St transmits messages {EM2, T2} to the Ui. The Ui calculates EM*2 and authenticates the St by checking that EM*2 = ? EM 2. Our approach (SLACPSS) also includes a phase for avatar authentication to enable safe interactions between avatars in virtual environments. When avatar i and avatar j desire to verify each other, they communicate over the St and exchange the request message (Reqij) and response message (Resij). Avatar i then acquires Ver j via EM4 and uses PIDj to extract PKj from the database. Then, the Ui verifies (Ver i · P = ? h (avatar i || avatar j||PID i || PID j ||T3) · PK i). Avatar i can verify avatar j if the equation is correct. Comparably, avatar j can confirm avatar i’s identity by checking (Ver i = h (avatari ||avatar j||PID i||PID j ||T3) · K i).

7. Conclusions

A CPSS is a base class and consists of three basic components (cyber space–physical space–social space). We have proven that the metaverse is an element derived from a CPSS and consists of the same components that a CPSS is composed of. Therefore, the metaverse is an example of a CPSS. We proposed a lightweight authentication approach (SLACPSS) that is based on hash and XOR operations using Elliptic Curve Cryptography (ECC) and biometric data. The proposed approach achieves mutual authentication (user i and user j can demonstrate their ownership of avatar i and avatar j), session key agreement, the device’s identity confidentiality, and resistance to many attacks while having low computing cost, communication, and storage overhead. We conducted an informal study to prove that the proposed Lightweight mutual authentication system (SLACPSS) is resistant to various attacks, such as impersonation, stolen smart devices, MITM, insider attacks, offline password guessing, platform server spoofing, privileged insiders, and ephemeral secret leakage. In addition, our proposal provides perfect forward secrecy, user anonymity, and mutual authentication. We compared the proposed protocol (SLACPSS) with previous protocols, and the analysis shows that the proposed protocol is lightweight and secure.