PUF Based Authentication Protocol for IoT

IoT devices rely on authentication mechanisms to render secure message exchange. During data transmission, scalability, data integrity, and processing time have been considered challenging aspects for a system constituted by IoT devices. The application of physical unclonable functions (PUFs) ensures secure data transmission among the internet of things (IoT) devices in a simplified network with an efficient time-stamped agreement. This paper proposes a secure, lightweight, cost-efficient reinforcement machine learning framework (SLCR-MLF) to achieve decentralization and security, thus enabling scalability, data integrity, and optimized processing time in IoT devices. PUF has been integrated into SLCR-MLF to improve the security of the cluster head node in the IoT platform during transmission by providing the authentication service for device-to-device communication. An IoT network gathers information of interest from multiple cluster members selected by the proposed framework. In addition, the software-defined secured (SDS) technique is integrated with SLCR-MLF to improve data integrity and optimize processing time in the IoT platform. Simulation analysis shows that the proposed framework outperforms conventional methods regarding the network’s lifetime, energy, secured data retrieval rate, and performance ratio. By enabling the proposed framework, number of residual nodes is reduced to 16%, energy consumption is reduced by up to 50%, almost 30% improvement in data retrieval rate, and network lifetime is improved by up to 1000 msec.

Background: The increasing number of Internet of Things (IoT) devices has raised worries about their susceptibility to different cyber threats. Although there have been improvements in software-level security, hardware measures continue to be essential for strong protection. Objective: The purpose of this study is to thoroughly analyze different architectural methods for ensuring hardware security in IoT devices, assessing how effective and practical they are. Methods: The study conducted a comparative investigation of different hardware security mechanisms, such as Trusted Platform Modules (TPMs), Physical Unclonable Functions (PUFs), and hardware security modules (HSMs). Information was gathered from several Internet of Things (IoT) implementations in industrial, healthcare, and consumer industries. Results: The results suggest that PUFs have notable benefits in terms of distinctiveness and protection against physical tampering, while TPMs offer extensive security capabilities but at a greater expense and level of complexity. High-security modules (HSMs) were determined to be the most effective choice for environments with high stakes that demand strict security measures. Conclusion: The selection of a suitable security method for IoT applications depends on the particular requirements and hazards associated with each application, as there is no one-size-fits-all hardware security mechanism. This paper establishes a fundamental structure for choosing and executing hardware security measures in IoT designs, improving the durability of devices against advancing cyber threats.

The rapid proliferation of the Internet of Things (IoT) leaves terminal devices vulnerable to considerable security challenges, notably the absence of robust yet efficient identity authentication mechanisms. Traditional certificate-based approaches incur substantial management overhead and storage expenditure, whereas Identity-Based Cryptography poses inherent key escrow risks. To tackle these challenges, this paper proposes a PUF and SM2-based certificateless identity authentication mechanism that integrates SM2 Certificateless Public Key Cryptography (a Chinese national cryptographic standard) with Physical Unclonable Functions (PUFs). Initially, the proposed solution utilizes PUF technology to derive a unique hardware-generated “fingerprint” from an IoT device, which functions as a root key to generate a partial user private key. This approach essentially binds the terminal’s identity to its physical hardware, thereby effectively mitigating physical cloning attacks against nodes. Moreover, through the adoption of a Certificateless Public Key Cryptography (CLPKC) framework, the complete user private key is jointly generated by a semi-trusted Key Generation Centre (KGC) and the terminal device itself. The comprehensive security analysis proves that the proposed scheme is provably secure under the random oracle model, capable of resisting various common attacks such as physical cloning, man-in-the-middle, and replay attacks. Performance evaluation confirms that the implemented PUF + SM2 certificateless mechanism significantly reduces the size of user public key identifiers to within 64 bytes, offering a substantial advantage over the 1–2 KB certificates typically required in conventional PKI/CA systems, thereby enhancing efficiency in storage and communication.

Due to the outbreak of COVID-19, the Internet of Medical Things (IoMT) has enabled the doctors to remotely diagnose the patients, control the medical equipment, and monitor the quarantined patients through their digital devices. Security is a major concern in IoMT because the Internet of Things (IoT) nodes exchange sensitive information between virtual medical facilities over the vulnerable wireless medium. Hence, the virtual facilities must be protected from adversarial threats through secure sessions. This article proposes a lightweight and physically secure mutual authentication and secret key establishment protocol that uses physical unclonable functions (PUFs) to enable the network devices to verify the doctor’s legitimacy (user) and sensor node before establishing a session key. PUF also protects the sensor nodes deployed in an unattended and hostile environment from tampering, cloning, and side-channel attacks. The proposed protocol exhibits all the necessary security properties required to protect the IoMT networks, like authentication, confidentiality, integrity, and anonymity. The formal AVISPA and informal security analysis demonstrate its robustness against attacks like impersonation, replay, a man in the middle, etc. The proposed protocol also consumes fewer resources to operate and is safe from physical attacks, making it more suitable for IoT-enabled medical network applications.

Modern embedded electronic devices are gradually becoming an essential part of everyday lives, proving indispensable for daily activities. The growth of the Internet of things (IoT) technology fuels this phenomenon. IoT devices are found everywhere around us – smartphones, smartwatches, home automation, autonomous cars, and medical implants for human bodies. These devices find widespread use in medical imaging, video surveillance as embedded vision, cloud computing platforms, and military applications. Ensuring the reliability and safety of these devices is of prime importance, since these devices store sensitive data. A wide range of such embedded devices is a common target for intellectual property (IP) theft and reverse-engineering attacks by hackers to access confidential information and counterfeit integrated circuits. Physically unclonable functions (PUFs) are innovative hardware defense techniques that promise a fundamental change in our approach to many security problems. PUFs possess desirable properties like low cost, simple architectures, a light weight, versatility, and the valuable advantage of unclonability. This unclonable property is a consequence of intrinsic random variations at the micro- and nanoscale levels in the manufacturing processes and cannot be controlled or removed. This characteristic also serves as a unique fingerprint for the integrated circuit chips, similar to humans. The widespread usage of PUF techniques in security applications makes it imperative for hardware designers to appreciate its working and understand its uses in practice fully. This chapter aims to address these and other topics by presenting a detailed introduction of the concepts, evaluation parameters, and various ramifications of physically unclonable functions. PUF techniques also provide an economical alternative to ciphers and hash functions for secure cryptographic protocols. It is also necessary to provide security of IoT devices, have economic viability, and fit well with embedded devices’ heterogeneous nature. PUF circuits receive challenges as a sequence of bits and generate matching responses called a challenge-response pair, which can be thought of as a secret key or unique fingerprint. It also obviates the need for storing the keys in nonvolatile memories with dedicated protection, which is a costly affair. In this chapter, different PUFs, including optical PUF, delay-based PUFs, weak and strong PUFs, etc., the maturity of this technology, and their various applications are investigated. This chapter also emphasizes critical challenges toward PUF utilization in IoT and related fields and significant future development areas like critical public infrastructure, reconfigurability, and bit-specific reliability. The unique IoT domain protection criteria and how PUFs can be used to fulfill them are also examined. The chapter’s emphasis is on proven and well-understood strategies involving their benefits and shortcomings.

Internet of Things (IoT) has revolutionized the world with its innovative and precise solutions catering a broad spectrum of applications. Smart cities, smart financial services, smart logistics, smart agriculture systems, smart healthcare management system are few applications worth mentioning. Device authentication and data security is a major concern in IoT networks as the devices used in these networks have inadequate computational processing and memory storage resources. Privacy is of paramount importance in applications such as healthcare and finance. As complex algorithms cannot be implemented on the resource-constrained IoT devices, research in the aforementioned areas is still an active subject. In this paper, we propose a mutual device and server authentication protocol using Physical Unclonable Functions (PUFs) for IoT devices. PUFs can be used to uniquely identify the devices and can also be used to generate random keys. As the name suggests, the keys generated by the PUFs cannot be reproduced. Using this unclonability feature, an authentication protocol has been developed. An IoT based temperature and humidity sensing module is developed to integrate the protocol and validate its effectiveness in providing the device authentication and data security.

A paradigm that combines cloud computing and the Internet of Things (IoT) allows for more impressive services to be provided to users while addressing storage and computational resource issues in the IoT environments. This cloud-based IoT environment has been used in various industries, including public services, for quite some time, and has been researched in academia. However, various security issues can arise during the communication between IoT devices and cloud servers, because communication between devices occurs in open channels. Moreover, issues such as theft of a user's IoT device or extraction of key parameters from the user's device in a remote location can arise. Researchers interested in these issues have proposed lightweight mutual authentication key agreement protocols that are safe and suitable for IoT environments. Recently, a lightweight authentication scheme between IoT devices and cloud servers has been presented. However, we found out their scheme had various security vulnerabilities, vulnerable to insider, impersonation, verification table leakage, and privileged insider attacks, and did not provide users with untraceability. To address these flaws, we propose a provably secure lightweight authentication scheme. The proposed scheme uses the user's biometric information and the cloud server's secret key to prevent the exposure of key parameters. Additionally, it ensures low computational costs for providing users with real-time and fast services using only exclusive OR operations and hash functions in the IoT environments. To analyze the safety of the proposed scheme, we use informal security analysis, Burrows-Abadi-Needham (BAN) logic and a Real-or-Random (RoR) model. The analysis results confirm that our scheme is secure against insider attacks, impersonation attacks, stolen verifier attacks, and so on; furthermore, it provides additional security elements. Simultaneously, it has been verified to possess enhanced communication costs, and total bit size has been shortened to 3776 bits, which is improved by almost 6% compared to Wu et al.'s scheme. Therefore, we demonstrate that the proposed scheme is suitable for cloud-based IoT environments.

The Internet of Things (IoT) devices is able to communicate with another IoT devices in heterogeneous environments. They are also able to create a network by their own using wireless capabilities without a centralized approach. This network is called wireless mobile ad hoc network (MANET). The MANET facilitate IoT devices to communicate with each other in an infrastructure less network of the Internet of Things environment. The IoT devices can dynamically join, create connection and exchange information among them. The role of cloud in this framework is to store and process the data by IoT devices. The communication Security has been raised as one of the most critical issues of cloud computing where resolving such an issue would result in a constant growth in the use and popularity of cloud. Our purpose of this study is to create a framework for providing the communication in an integrated framework of Cloud and MANET among IoT devices. Our main contribution links a new study that integrates cloud computing to the MANET and provides communication to the internet of things. This study can be used in the framework of the Internet of Things in future.

Fog computing is an emerging paradigm that provides confluence facilities between Internet of Things (IoT) devices and cloud. The fog nodes process the information collected by the IoT devices, thereby providing services to the cloud. With the addition of an extra layer, the environment achieves better latency, mobility support, location-awareness, and real-time data handling. Further research in this area also draws attention to the existing quality of fog computing, and emerging security and privacy challenges. The increasing number of IoT devices and the introduction of middle-layer over public network introduces performance, correctness, accountability and security challenges. To ensure accountability along with privacy, a key agreement scheme is proposed for fog supported IoT environment. The proposed scheme is competent in term of security and efficiency. The security proof is proclaimed using the widely recognized random oracle model, which indicates that the proposed scheme is provably secure under any probabilistic polynomial time adversary. Moreover, the comparative analysis of performances is also satisfactory.

Billions of IoT (Internet of Things) devices are being introduced to our everyday life each year. Most of them have little to no security features embedded in them. But these devices connect to internet and communicate with other devices all the time which pose a great security and privacy risk. Due to the resource constraint nature of these devices, initially security was not being considered as an essential feature. Therefore, any security features to be included in these devices should be minimal in area, energy consumption and added delay. Physical unclonable function (PUF) has emerged as a low-overhead solution for a variety of security concerns in recent years. In this paper, we have presented a simple security method for small IoT devices based on PUFs. The idea is to secure the backup data during sleep mode of an embedded processor or when power is unavailable for a batteryless system. With the emergence of nano-technology, memristors are being widely explored due to their non-volatility, low footprint among other advantages. Our proposed security system utilizes a memristor based PUF along with memristors as a non-volatile backup memory. The proposed system is very lightweight as this domain demands and provide reasonable security.

Seeing is not always believing: Insights on IoT manufacturing from firmware composition analysis and vendor survey

With the advancement in science and technology, the demand for electronic Internet of Things (IoT) devices has increased to store and process digital data. With the advancement in IoT technology, we are more reliant on IoT devices to perform our regular tasks. IoT Forensics deals with the investigation of IoT devices such as smartphones, tablets, smart watches, or any device which is connected to the Internet. The data on these devices can still be retrieved via IoT forensics even if they are destroyed, resold, or misplaced. Before discarding any IoT device, we must consider how to secure the data stored on them. We are then going to discuss the several types of personal data that could be retrieved from discarded IoT devices. Finally, we are going to discuss the protection measures for the safe disposal of IoT devices.

Internet of Things (IoT) is an emerging technology that consists of tiny sensors embedded with IoT devices used in e-Health, smart cities and assisted living. IoT devices are equipped with constrained power, memory, and computing capabilities, which creates new security challenges. By integrating sensors and wireless technologies, this cutting-edge technology automates numerous routine tasks in different domains. The main goal of advancing IoT in the existing healthcare system is to automate the monitoring of hospitals and patients’ health by spreading goodwill toward the IoT vision. IoT has gained popularity on practically all platforms that are available. This paper presents a remote patient health monitoring and diagnosis system that uses Message Queuing Telemetry Transport protocol (MQTT) and Internet of Things (IoT) devices with one time pad cryptography. The proposed plan offers end-to-end data secrecy for an IoT system using MQTT that enables e-health and mobility. Patients’ movements inside nursing homes and healthcare facilities are also managed safely without the need for periodic reconfigurations. Prior to communicating through the MQTT protocol, this secure crypto scheme encrypts the message on both the publisher and subscriber ends. According to the results, the proposed scheme is more efficient than delegation-based architecture in terms of security and lightweight communication. The proposed system established communication between patients and medical experts using IoT technologies to alleviate the hospital strain caused by congestion in medical treatment and enable an expressway of medical responses. According to our results the proposed scheme has low computational overhead compared to other solutions that use conventional encryption to guarantee robust protection against most of the IoT security attacks.

The number of Internet of Things (IoT) devices has increased recently and will increase further in the future. IoT devices are vulnerable, so vendors update and distribute firmware. At the time of firmware distribution, a huge number of IoT devices may connect to the firmware server and excessive network traffic may occur. Consequently, a method using a peer-to-peer file sharing system and a blockchain has been proposed. One study proposed an update scheme considering incentives for distributors to help with updating. However, this method requires the IoT devices, which have limited processing power, to decrypt encrypted files, and the distribution nodes to pay the transaction cost. This paper proposes a firmware distribution method that provides incentives for distributors to help with distribution to reduce the gas costs, using a smart contract and access control based on update records. The additional computations performed by IoT devices and distributors key management were reduced compared to those in previous studies by using access control instead of encryption. Further, the proposed approach was implemented and evaluated using a Raspberry Pi and laptop. The evaluation demonstrated that the gas cost per update was successfully lowered compared to the costs in previous studies.

Recently, Roy et al. proposed a physically unclonable function (PUF)-based authentication and key exchange protocol for Internet of Things (IoT) devices. The PUF protocol is efficient, because it integrates both the Node-to-Node (N2N) authentication and the Node-to-Server (N2S) authentication into a standalone protocol. In this paper, we therefore examine the security of the PUF protocol under the assumption of an insider attack. Our cryptanalysis findings are the following. (1) A legitimate but malicious IoT node can monitor the secure communication among the server and any other IoT nodes in both N2N authentication and N2S authentication. (2) A legitimate but malicious IoT node is able to impersonate a target IoT node to cheat the server and any other IoT nodes in N2N authentication and the server in N2S authentication, respectively. (3) A legitimate but malicious IoT node can masquerade as the server to cheat any other target IoT nodes in both N2N authentication and N2S authentication. To the best of our knowledge, our work gives the first non-trivial concrete security analysis for the PUF protocol. In addition, we employ the automatic verification tool of security protocols, i.e., Scyther, to confirm the weaknesses found in the PUF protocol. We finally consider how to prevent weaknesses in the PUF protocol.