Design and Analysis of a Provable Secure Two-Factor Authentication Protocol for Internet of Things

Recently, Roy et al. proposed a physically unclonable function (PUF)-based authentication and key exchange protocol for Internet of Things (IoT) devices. The PUF protocol is efficient, because it integrates both the Node-to-Node (N2N) authentication and the Node-to-Server (N2S) authentication into a standalone protocol. In this paper, we therefore examine the security of the PUF protocol under the assumption of an insider attack. Our cryptanalysis findings are the following. (1) A legitimate but malicious IoT node can monitor the secure communication among the server and any other IoT nodes in both N2N authentication and N2S authentication. (2) A legitimate but malicious IoT node is able to impersonate a target IoT node to cheat the server and any other IoT nodes in N2N authentication and the server in N2S authentication, respectively. (3) A legitimate but malicious IoT node can masquerade as the server to cheat any other target IoT nodes in both N2N authentication and N2S authentication. To the best of our knowledge, our work gives the first non-trivial concrete security analysis for the PUF protocol. In addition, we employ the automatic verification tool of security protocols, i.e., Scyther, to confirm the weaknesses found in the PUF protocol. We finally consider how to prevent weaknesses in the PUF protocol.

Three party secure data transmission in IoT networks through design of a lightweight authenticated key agreement scheme

With the rapid growth of wireless medical sensor networks (WMSNs) based healthcare applications, protecting both the privacy and security from illegitimate users, are major concern issues since patient’s precise information is vital for the proper diagnosis procedure. So, authentication protocol is one of the efficient mechanisms to deal with trustworthy and authentic users. Several authentication protocols have been proposed in WMSNs environment. However, the most of these protocols are so susceptible to security threats and not suitable for practical use. In this article, recently proposed Amin et al.’s authentication scheme is reviewed and some vulnerabilities like off-line password guessing attack, user impersonation attack, known session-key temporary information attack, the revelation of secret parameters, and identity guessing attack are pointed out. To overcome all the above mentioned vulnerabilities, we have proposed an enhanced three-factor based remote user authentication protocol in WMSNs environment. Further, the proposed protocol is validated using Burrows–Abadi–Needham logic and then simulated using Automated Validation of Internet Security Protocols and Applications tool. Moreover, the security analysis ensures that the proposed protocol is well protected from various types of malicious attacks. In addition, the performance evaluation shows better efficiency and suitability of our protocol over other related protocols.

Internet of Things (IoT) has revolutionized the world with its innovative and precise solutions catering a broad spectrum of applications. Smart cities, smart financial services, smart logistics, smart agriculture systems, smart healthcare management system are few applications worth mentioning. Device authentication and data security is a major concern in IoT networks as the devices used in these networks have inadequate computational processing and memory storage resources. Privacy is of paramount importance in applications such as healthcare and finance. As complex algorithms cannot be implemented on the resource-constrained IoT devices, research in the aforementioned areas is still an active subject. In this paper, we propose a mutual device and server authentication protocol using Physical Unclonable Functions (PUFs) for IoT devices. PUFs can be used to uniquely identify the devices and can also be used to generate random keys. As the name suggests, the keys generated by the PUFs cannot be reproduced. Using this unclonability feature, an authentication protocol has been developed. An IoT based temperature and humidity sensing module is developed to integrate the protocol and validate its effectiveness in providing the device authentication and data security.

In recent years, RFID (radio-frequency identification) systems are widely used in many applications. One of the most important applications for this technology is the Internet of things (IoT). Therefore, researchers have proposed several authentication protocols that can be employed in RFID-based IoT systems, and they have claimed that their protocols can satisfy all security requirements of these systems. However, in RFID-based IoT systems we have mobile readers that can be compromised by the adversary. Due to this attack, the adversary can compromise a legitimate reader and obtain its secrets. So, the protocol designers must consider the security of their proposals even in the reader compromised scenario. In this paper, we consider the security of the ultra-lightweight RFID mutual authentication (ULRMAPC) protocol recently proposed by Fan et al. They claimed that their protocol could be applied in the IoT systems and provide strong security. However, in this paper we show that their protocol is vulnerable to denial of service, reader and tag impersonation and de-synchronization attacks. To provide a solution, we present a new authentication protocol, which is more secure than the ULRMAPC protocol and also can be employed in RFID-based IoT systems.

The authentication system plays a crucial role in the context of GLObal MObility NETwork (GLOMONET) where Mobile User (MU) often need to seamless and secure roaming service over multiple Foreign Agents (FA). However, designing a robust and anonymous authentication protocol along with a user privacy is essential and challenging task. Due to the resource constrained property of mobile terminals, the broadcast nature of a wireless channel, mobility environments are frequently exposed to several attacks. Many researchers focus their interests on designing an efficient and secure mobile user authentication protocol for mobility networks. Very recently (in 2018), Xu et al presented the novel anonymous authentication system for roaming in GLOMONET, and insisted that their protocol is more secure than existing authentication protocols. The security strength of Xu et al.’s authentication protocol is analysed and identified that the protocol is vulnerable to stolen verifier attack, privileged insider attack, impersonation attack and denial of service attack. In-fact, the protocol suffers from clock synchronization problem and cannot afford local password-verification to detect wrong passwords quickly. As a remedy, we proposed an efficient and robust anonymous authentication protocol for mobility networks. The proposed mobile user authentication protocol achieves the provable security and has the ability to resist against numerous network attacks. Besides, the correctness of the novel authentication protocol is validated using formal security tool called AVISPA (Automated Validation of Internet Security Protocols & Applications). Finally, the performance analysis and simulation results reveals that the proposed authentication protocol is computationally efficient and practically implementable in resource limited mobility environments.

DKSM: A Decentralized Kerberos Secure Service-Management Protocol for Internet of Things

Internet of Things (IoT) is a network of objects which enables them to collect vital information. As a result, privacy and anonymity in IoT are the most important issues. So far, many protocols have been proposed to provide authentication mechanism in IoT networks. Recently, Amin et al proposed a three-factor authenticated protocol for IoT networks that is claimed to be secure. In this paper, we challenge this claim and show that this protocol is vulnerable against the replay attack and DoS attack. Moreover, inspired by this protocol, we propose a secure authenticated key exchange protocol with the same assumptions. Our analysis shows that our proposed protocol is more efficient than Amin et al protocol.

With the great development of network technology, the multiserver system gets widely used in providing various of services. And the two-factor authentication protocols in multiserver system attract more and more attention. Recently, there are two new schemes for multiserver environment which claimed to be secure against the known attacks. However, after a scrutinization of these two schemes, we found that (1) their description of the adversary’s abilities is inaccurate; (2) their schemes suffer from many attacks. Thus, firstly, we corrected their description on the adversary capacities to introduce a widely accepted adversary model and then summarized fourteen security requirements of multiserver based on the works of pioneer contributors. Secondly, we revealed that one of the two schemes fails to preserve forward secrecy and user anonymity and cannot resist stolen-verifier attack and off-line dictionary attack and so forth and also demonstrated that another scheme fails to preserve forward secrecy and user anonymity and is not secure to insider attack and off-line dictionary attack, and so forth. Finally, we designed an enhanced scheme to overcome these identified weaknesses, proved its security via BAN logic and heuristic analysis, and then compared it with other relevant schemes. The comparison results showed the superiority of our scheme.

Wireless sensor networks (WSN) are widely used to provide users with convenient services such as health-care, and smart home. To provide convenient services, sensor nodes in WSN environments collect and send the sensing data to the gateway. However, it can suffer from serious security issues because susceptible messages are exchanged through an insecure channel. Therefore, secure authentication protocols are necessary to prevent security flaws in WSN. In 2020, Moghadam et al. suggested an efficient authentication and key agreement scheme in WSN. Unfortunately, we discover that Moghadam et al.’s scheme cannot prevent insider and session-specific random number leakage attacks. We also prove that Moghadam et al.’s scheme does not ensure perfect forward secrecy. To prevent security vulnerabilities of Moghadam et al.’s scheme, we propose a secure and lightweight mutual authentication protocol for WSNs (WSN-SLAP). WSN-SLAP has the resistance from various security drawbacks, and provides perfect forward secrecy and mutual authentication. We prove the security of WSN-SLAP by using Burrows-Abadi-Needham (BAN) logic, Real-or-Random (ROR) model, and Automated Verification of Internet Security Protocols and Applications (AVISPA) simulation. In addition, we evaluate the performance of WSN-SLAP compared with existing related protocols. We demonstrate that WSN-SLAP is more secure and suitable than previous protocols for WSN environments.

In this paper, we propose a secure two-factor remote user authentication protocol using Elliptic curve cryptography. The proposed protocol provides the mutual authentication of participants, session key agreement and user anonymity. The security of our proposed protocol is based on one way hash function and elliptic curve cryptosystem and it is secure against all relevant security attacks. Compared with other relevant protocol, the security analysis and performance evaluation show that our proposed protocol can provide high level of security with less communication and computation cost. In addition, the BAN logic is applied to demonstrate the validity of the proposed protocol.

SE-AKA: A secure and efficient group authentication and key agreement protocol for LTE networks

Cross-domain authentication of drones has played an important role in emergency rescue, collaborative missions, and so on. However, the existing cross-domain authentication protocols for drones may cause privacy leakages and stolen-verifier attacks due to the storage of drone information by ground stations, and drones and ground stations are susceptible to capture attacks, which may suffer from impersonation attacks. To address these problems, we propose a lightweight cross-domain authentication protocol based on physical unclonable function (PUF). In the proposed protocol, the control center is not involved in the authentication process, preventing bottleneck problems when multiple drones authenticate simultaneously. Ground stations do not store drone information, effectively safeguarding against privacy leakage and stolen-verifier attacks. PUF is utilized to protect drones from capture attacks. We conduct both informal security analysis and formal security proof to demonstrate the protocol’s security. In terms of performance, compared with relevant schemes, our protocol shows remarkable efficiency improvements. Computationally, it is 5–92% more efficient. Regarding communication overhead, it is 9–68% lower than relevant schemes. For storage, it is 22–48% lower than relevant schemes. We simulated the proposed protocol using a Raspberry Pi 4B, which emulates the computational capabilities of actual UAV and ground stations. During the simulation, a large number of authentication requests were generated. We monitored key performance indicators such as authentication success rate, response time, and resource utilization. To test its security, we simulated common attacks like replay, forgery, and impersonation. The protocol’s timestamps effectively identified and rejected replayed messages. Meanwhile, the PUF mechanism and unique signature scheme foiled our attempts to forge authentication messages. These simulation results, combined with theoretical security proofs, confirm the protocol’s practical viability and security in real-world-like scenarios.

Physically Unclonable Functions (PUFs) are lightweight hardware primitives that provide an effective secure-by-design solution for mutual authentication of the resource-constrained Internet of Things (IoT) devices. By embedding PUFs in the design of each IoT device, the identity of devices could be validated using unique device fingerprints, known as challenge and response pairs (CRPs). Unfortunately, PUF-based authentication protocols are susceptible to CRP disclosure which could be exploited to model the PUF and allow impersonation of the associated device by either an external adversary or compromised nodes. This paper presents a Distributed Unclonable Hardware-assisted Authentication and Key Agreement Protocol (DUHAP). DUHAP presents a novel and effective mitigation for CRP disclosure, PUF modeling, and device impersonation. In particular, the PUF responses are obfuscated using varying salt that is dependent on the verifier and the actual PUF response. Such an identity- and response-based obfuscation technique withstands CRPs disclosure attempts by a compromised node or multiple colluding nodes through reverse engineering. The security of DUHAP is analyzed using a prominent protocol validation tool, and its resiliency against modeling is validated using data collected from a popular PUF cryptanalysis toolbox.

A secure light weight scheme for user authentication and key agreement in multi-gateway based wireless sensor networks