A survey on user access control in wireless sensor networks with formal security verification

A novel and efficient user access control scheme for wireless body area sensor networks

With the booming integration of IoT technology in our daily life applications such as smart industrial, smart city, smart home, smart grid, and healthcare, it is essential to ensure the security and privacy challenges of these systems. Furthermore, time‐critical IoT applications in healthcare require access from external parties (users) to their real‐time private information via wireless communication devices. Therefore, challenges such as user authentication must be addressed in IoT wireless sensor networks (WSNs). In this paper, we propose a secure and lightweight three‐factor (3FA) user authentication protocol based on feature extraction of user biometrics for future IoT WSN applications. The proposed protocol is based on the hash and XOR operations, including (i) a 3‐factor authentication (i.e., smart device, biometrics, and user password); (ii) shared session key; (iii) mutual authentication; and (iv) key freshness. We demonstrate the proposed protocol’s security using the widely accepted Burrows–Abadi–Needham (BAN) logic, Automated Validation of Internet Security Protocols and Applications (AVISPA) simulation tool, and the informal security analysis that demonstrates its other features. In addition, our simulations prove that the proposed protocol is superior to the existing related authentication protocols, in terms of security and functionality features, along with communication and computation overheads. Moreover, the proposed protocol can be utilized efficiently in most of IoT’s WSN applications, such as wireless healthcare sensor networks.

In mobile communication networks, when a user roams to and accesses a foreign network, the foreign operator needs to request the user’s subscription data from a centralized authentication server, which is managed by the user’s home operator. However, centralized authentication introduces single point of failure. Meanwhile, the real-time participation of the home operator and the trust relationship between the foreign operator and the home operator are difficult to guarantee. In this paper, by adopting blockchain and smart contracts, we propose a secure and efficient access control scheme of user subscription data in roaming scenarios. We further design a flexible user authentication scheme, which utilizes derivable tokens based on the proposed access control scheme. By using blockchain to store and manage user subscription data, access control can be decentralized without any trusted third party. Besides, by implementing automatic verification of access privilege through smart contracts, the limitation of the home operators’ real-time participation is eliminated. In addition, to further improve security and reduce the on-chain storage overhead, we optimize the data encryption and storage scheme utilizing threshold secret sharing. Our security and performance analysis show that the proposed user subscription data access control scheme for roaming service provides high-level security while causing acceptable time and storage overhead.

We propose a new dynamic ID-based remote user authentication scheme using smart cards, which it is based on one-way hash function, ElGamal’s public key cryptosystem and nonce. The scheme achieves the following security requirements: 1) users can choose and change their password freely, 2) mutual authentication between the user and the server, 3) the user and the server establish a session key after successful authentication process, 4) the server does not maintain a verification table, 5) the login request message does not contain the user’s identity, and 6) the authentication phase does not require time-synchronization, making it more secure than previous schemes. In order to verify the security characteristics of our protocol, we have modelled and analysed the proposal using High-level Protocol Specification Language (HLPSL) and Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. The results demonstrate that our protocol achieves more security requirements than previous works.

Secure information exchange in wireless sensor networks (WSN) is a continuing issue since the resource-constrained sensors generally deployed over an unattended environment. To access the real-time data from the sensors, user authentication and key agreement as an important tool for secure communications in WSN plays a vital role. Recently, Das proposed an efficient biometrics based security scheme by only using lightweight symmetric-key primitives. Their scheme is efficient in computation, but we find the scheme of Das is not actually achieve the three-factor security, thus failing to prevent the user impersonation attack. Additionally, the failure of user anonymity also gives an opportunity for the adversary to mount impersonation attacks. With the purpose of mitigating all the problems in Das’s scheme, we present an anonymous three-factor key agreement using Elliptic Curve Cryptography. Using the Burrows–Abadi–Needham logic to ensure the mutual authentication properties. Through the rigorous security analysis, we show that the proposed scheme withstands various attacks. In addition, Automated Validation of Internet Security Protocols and Applications (AVIPSA) tool is used to verify its security.

Anonymous mutual authentication and key agreement scheme for wearable sensors in wireless body area networks

Power control in wireless networks is useful for minimizing channel congestion (hence increasing network capacity). In this work, we show how the distributed power control algorithm with active link protection (DCP-ALP) can be used as a channel probing tool that allows a new link trying to access a channel to quickly and autonomously determine whether it can be admitted to it (i.e. whether there is a feasible power configuration for the transmitters such that the link quality requirements on all links are met), which significantly improves the capacity and access time of the network.

This paper introduces the design, implementation, and performance analysis of the scalable and mobility-aware hybrid protocol named boarder node medium access control (BN-MAC) for wireless sensor networks (WSNs), which leverages the characteristics of scheduled and contention-based MAC protocols. Like contention-based MAC protocols, BN-MAC achieves high channel utilization, network adaptability under heavy traffic and mobility, and low latency and overhead. Like schedule-based MAC protocols, BN-MAC reduces idle listening time, emissions, and collision handling at low cost at one-hop neighbor nodes and achieves high channel utilization under heavy network loads. BN-MAC is particularly designed for region-wise WSNs. Each region is controlled by a boarder node (BN), which is of paramount importance. The BN coordinates with the remaining nodes within and beyond the region. Unlike other hybrid MAC protocols, BN-MAC incorporates three promising models that further reduce the energy consumption, idle listening time, overhearing, and congestion to improve the throughput and reduce the latency. One of the models used with BN-MAC is automatic active and sleep (AAS), which reduces the ideal listening time. When nodes finish their monitoring process, AAS lets them automatically go into the sleep state to avoid the idle listening state. Another model used in BN-MAC is the intelligent decision-making (IDM) model, which helps the nodes sense the nature of the environment. Based on the nature of the environment, the nodes decide whether to use the active or passive mode. This decision power of the nodes further reduces energy consumption because the nodes turn off the radio of the transceiver in the passive mode. The third model is the least-distance smart neighboring search (LDSNS), which determines the shortest efficient path to the one-hop neighbor and also provides cross-layering support to handle the mobility of the nodes. The BN-MAC also incorporates a semi-synchronous feature with a low duty cycle, which is advantageous for reducing the latency and energy consumption for several WSN application areas to improve the throughput. BN-MAC uses a unique window slot size to enhance the contention resolution issue for improved throughput. BN-MAC also prefers to communicate within a one-hop destination using Anycast, which maintains load balancing to maintain network reliability. BN-MAC is introduced with the goal of supporting four major application areas: monitoring and behavioral areas, controlling natural disasters, human-centric applications, and tracking mobility and static home automation devices from remote places. These application areas require a congestion-free mobility-supported MAC protocol to guarantee reliable data delivery. BN-MAC was evaluated using network simulator-2 (ns2) and compared with other hybrid MAC protocols, such as Zebra medium access control (Z-MAC), advertisement-based MAC (A-MAC), Speck-MAC, adaptive duty cycle SMAC (ADC-SMAC), and low-power real-time medium access control (LPR-MAC). The simulation results indicate that BN-MAC is a robust and energy-efficient protocol that outperforms other hybrid MAC protocols in the context of quality of service (QoS) parameters, such as energy consumption, latency, throughput, channel access time, successful delivery rate, coverage efficiency, and average duty cycle.

In this paper, we evaluate the options for a viable security architecture for the 3GPP Home (evolved) NodeB (H(e)NB) and present the trade‐off between the level of security provided and the associated cost of a H(e)NB device. Low cost of the H(e)NB device is one of the key factors to achieve high market penetration and the major contributor to the cost of the H(e)NB device is the security architecture. It is of interest to analyse the security challenges, security requirements and security mechanisms for (i) H(e)NB authentication, (ii) provisioning of security credentials, (iii) backhaul link protection, (iv) location verification and (v) user access control in the H(e)NB. It is required that the H(e)NB architecture mitigates the threats foreseen by opting a comprehensive security mechanisms amenable to both the operators and the subscribers, while satisfying the acceptable level of security required. Copyright © 2009 John Wiley & Sons, Ltd.

Nowadays, there are large amount of data generated by the IoT objects. For that, big data and Cloud and Fog Computing technologies have become increasingly important. Unfortunately, these environments still present many difficulties. And according to the statistics, we note that the major percentages of attacks come mainly from end users. Hence, we need an access control system. So, we focus our work on user access control. In fact, our contribution in this paper is mainly focused on securing user access to Fog Computing networks. For this, we propose, an efficient and complete protocol for access control service, which based on the trust assessment and the monitoring of the user's activities. Afterwards, we aim to improve our protocol by integrating the concept of certificates. We have shown through analysis studies and simulation results that the proposed scheme provides both security requirements in terms of confidentiality, integrity, availability, and anonymity; and network performance in terms of access response latency.

The traditional multicast model has some problems, such as access control, address allocation and protocol extensibility. To solve these problems, we provide a new group communication model named MixCast, which is suitable for large-scale heterogeneous networks. MixCast uses unicast between different access networks and use multicast in the same access network; at the same time, MixCast uses IEEE 802.1X protocol to provide user access control and billing scheme for carriers. We also analyze the cost of MixCast communication in the network equipments.

Providing a mechanism to authenticate users in healthcare applications is an essential security requirement to prevent both external and internal attackers from penetrating patients’ identities and revealing their health data. Many schemes have been developed to provide authentication mechanisms to ensure that only legitimate users are authorised to connect, but these schemes still suffer from vulnerable security. Various attacks expose patients’ data for malicious tampering or destruction. Transferring health-related data and information between users and the health centre makes them exposed to penetration by adversaries as they may move through an insecure channel. In addition, previous mechanisms have suffered from the poor protection of users’ authentication information. To ensure the protection of patients’ information and data, we propose a scheme that authenticates users based on the information of both the device and the legitimate user. In this paper, we propose a Robust Authentication Model for Healthcare Users (RAMHU) that provides mutual authentication between the server and clients. This model utilizes an Elliptic Curve Integrated Encryption Scheme (ECIES) and PHOTON to achieve strong security and good overall performance. RAMHU relies on multiple-pseudonym, physical address, and one-time password mechanisms to authenticate legitimate users. Moreover, extensive informal and formal security analysis with the automated validation of Internet security protocols and applications (AVISPA) tool demonstrate that our model offers a high level of security in repelling a wide variety of possible attacks.

In recent years, the research in generic Internet of Things (IoT) attracts a lot of practical applications including smart home, smart city, smart grid, industrial Internet, connected healthcare, smart retail, smart supply chain and smart farming. The hierarchical IoT network (HIoTN) is a special kind of the generic IoT network, which is composed of the different nodes, such as the gateway node, cluster head nodes, and sensing nodes organized in a hierarchy. In HIoTN, there is a need, where a user can directly access the real-time data from the sensing nodes for a particular application in generic IoT networking environment. This paper emphasizes on the design of a new secure lightweight three-factor remote user authentication scheme for HIoTNs, called the user authenticated key management protocol (UAKMP). The three factors used in UAKMP are the user smart card, password, and personal biometrics. The security of the scheme is thoroughly analyzed under the formal security in the widely accepted real-or-random model, the informal security as well as the formal security verification using the widely accepted automated validation of Internet security protocols and applications tool. UAKMP offers several functionality features including offline sensing node registration, freely password and biometric update facility, user anonymity, and sensing node anonymity compared to other related existing schemes. In addition, UAKMP is also comparable in computation and communication costs as compared to other existing schemes.

The convenience and flexibility of wireless networks to allow clients (user nodes) to be connected to the network at any place and any time have resulted in the growth and increased popularity of wireless networks. Access control in wireless networks is very important to prevent unauthorized users from accessing the network. Besides this, client anonymity and resistance to Denial-of-Service (DoS) attacks are also important and should be provided by access control protocols for wireless networks. Password-based authentication provide good solutions for access control protocols, however they usually do not provide client identity confidentiality and DoS resistance. In this paper, we review a DoS-resistant anonymous access control (AAC) protocol and point out that the protocol does not provide protection against three different DoS attacks. We then propose a new DoS-resistant AAC protocol that avoids the flaws of the previous protocol. Our proposed protocol also provides client anonymity and protection against DoS attacks. A security and complexity analysis shows that our proposed protocol is secure and efficient for access control in wireless networks.

Wireless Sensor Networks (WSNs), comprising of tiny nodes with limited energy, computational and communication resources, are being widely used in various application areas ranging from pollution and weather monitoring to military. Even though every application may not require data to be exchanged in a secure manner, few WSN applications may have certain security requirements. The data is encrypted by a sender and sent over the wireless links and the same is decrypted at the receiver. To meet this purpose, symmetric key cryptographic (SKC) algorithms may be used. Such SKC primitives require keys to be made available before carrying out the data transfer between the nodes. Alternately, Public Key Cryptographic techniques, such as RSA algorithm can be considered. Even though, RSA is a popular algorithm providing good security level, it is computationally intensive involving large key sizes. The RSA can not be used in WSNs, as the nodes have limited resources. Presently, it is infeasible to implement the RSA algorithm using any of the WSN nodes commercially available. Elliptic curve cryptography (ECC), another public key cryptographic (PKC) algorithm providing same level of security with smaller key size requirements, can be used as an alternative in order to provide security in WSN applications. ECC encryption and decryption use domain parameters, which includes the Generator point to be published. In most of the outdoor WSN applications, the deployment of the nodes is random and the nodes could be captured and an attacker could launch man-in-middle (MIM) attack, and break the public key thereby leading to security breach in the network. A technique to overcome such an attack is proposed in this work and the same is compared with two other similar approaches.