Internet of Things (IoT), is an interconnection of heterogeneous devices in terms of computational, communication, energy efficient competences over public insecure communication channel called Internet. Through advancement in mobile and communication technologies, users can connect to remote servers ubiquitously through a 'thing' or device which is a part of IoT. Insecure nature of Internet and resource constrained nature of devices or things which are part of IoT demands for remote user authentication protocols which are extremely secure, light weight and energy efficient. In this context, C.G MA et al proposed a new dynamic ID based authentication scheme. In this manuscript we will illustrate that C.G MA et al. scheme cannot preserve user anonymity under their hypothesis and susceptible to stolen verifier attack. In addition, we will confirm that their scheme is heavy weight and needs more energy. We then present our improved scheme which is a generalized one, which is secure, light weight and energy efficient, while protecting the merits of different dynamic identity based authentication schemes.
Internet of Things (IoT), is an interconnection of heterogeneous devices in terms of computational, communication, energy efficient competences over public insecure communication channel called Internet. Through advancement in mobile and communication technologies, users can connect to remote servers ubiquitously through a 'thing' or device which is a part of IoT. Insecure nature of Internet and resource constrained nature of devices or things which are part of IoT demands for remote user authentication protocols which are extremely secure, light weight and energy efficient. In this context, C.G MA et al proposed a new dynamic ID based authentication scheme. In this manuscript we will illustrate that C.G MA et al. scheme cannot preserve user anonymity under their hypothesis and susceptible to stolen verifier attack. In addition, we will confirm that their scheme is heavy weight and needs more energy. We then present our improved scheme which is a generalized one, which is secure, light weight and energy efficient, while protecting the merits of different dynamic identity based authentication schemes.
Rapid growth of mobile and networking technologies, resulted in new paradigms of networking like Internet of Things (IoT) etc, which allows user to connect to insecure public communication channel through various devices and can access the services and data provided by remote server. Thus, remote user authentication and key agreement for wireless, wired, IoT communications becoming more challenging task. In this context many researchers have proposed authentication schemes. In 2013, An et al. proposed a dynamic ID-based remote user authentication scheme which is secure, even if the secret values stored in the smart card is revealed. In 2014, Troung et al claimed that An et al scheme is vulnerable to server forgery attack and proposed an improved scheme. In this manuscript, we validate that Troung et al's scheme is vulnerable to known session specific temporary information attack, replay and impersonation attack. Furthermore, we also propose the improved scheme to overcome these limitations without increase in the cost front.
In recent years, the Internet of things (IoT) has become an encouraging communication paradigm that has numerous applications including smart city, smart home and intelligent transportation system. The information sensed by several IoT smart devices can be security stored at the (cloud) servers. An external user, being a client, can access the services from a server for the sensing information, provided that a mutual authentication happens among them. Using the established session key among the user and the server, encrypted information with the help of session key can be delivered to the user by the server securely. Recently, Rana et al. proposed a smart-card based remote user authentication scheme using user password. In this comment paper, we carefully analyzed the scheme of Rana et al. and tracked down that their scheme is insecure against serious attacks, including stolen smart card attack, privileged-insider attack, user impersonation attack, password change attack and Ephemeral Secret Leakage (ESL) attack. Furthermore, their scheme does not preserve untraceability feature. To remedy these security pitfalls, we also provide some remedies that can help in building more secure and effective user authentication scheme to apply in securing next generation IoT infrastructure.
The Internet of Things (IoT) is being applied to various environments such as telecare systems, smart homes, and intelligent transportation systems. The information generated from IoT devices is stored at remote servers, and external users authenticate to the server for requesting access to the stored data. In IoT environments, the authentication process is required to be conducted efficiently, and should be secure against various attacks and ensure user anonymity and untraceability to ensure sustainability of the network. However, many existing protocols proposed in IoT environments do not meet these requirements. Recently, Rajaram et al. proposed a paring-based user authentication scheme. We found that the Rajaram et al. scheme is vulnerable to various attacks such as offline password guessing, impersonation, privileged insider, and known session-specific temporary information attacks. Additionally, as their scheme uses bilinear pairing, it requires high computation and communication costs. In this study, we propose a novel authentication scheme that resolves these security problems. The proposed scheme uses only hash and exclusive-or operations to be applicable in IoT environments. We analyze the proposed protocol using informal analysis and formal analysis methods such as the BAN logic, real-or-random (ROR) model, and the AVISPA simulation, and we show that the proposed protocol has better security and performance compared with existing authentication protocols. Consequently, the proposed protocol is sustainable and suitable for real IoT environments.
Remote user authentication is an essential part in electronic commerce to identify legitimate users over the Internet. However, how to protect user privacy in the authentication has become an important issue recently. Therefore, many secure authentication schemes with smart cards have been proposed. In this paper, we will analyze the security weaknesses of two recently proposed authentication schemes for preserving user privacy. First, Chang et al. (2011) proposed a robust and efficient remote user authentication scheme to provide user anonymity. However, this scheme fails to protect user privacy in terms of anonymity and traceability. In addition, it is vulnerable to the server counterfeit attack and it does not provide perfect forward secrecy for session keys. Furthermore, if the smart card is lost, it will suffer from the offline password guessing attack as well as the user impersonation attack. Second, Wen and Li (2012) recently presented an improved dynamic ID-based authentication scheme with key agreement. However, this scheme is vulnerable to traceability. In addition, it does not support perfect forward secrecy for session keys. Furthermore, the insecure offline password change phase and online secret renewal phase will result in the denial of service attack.
Password based authentication schemes have been widely used to verify the legitimacy of a user over an insecure communication channel. A common feature among most of the published schemes is that user's identity (ID) is static in all the transaction sessions, which may leak some information about the user and can create risk of identity theft during message transaction. Therefore, to provide user anonymity, many dynamic ID based remote users authentication schemes have been proposed. Recently, Khan et al. proposed an efficient and secure dynamic ID based remote user authentication scheme and claimed that their scheme can provide strong security against various attacks. In this paper, we have demonstrated that Khan et al.'s scheme is vulnerable to server spoofing attack and insider attack, and has some flaws in login and authentication phase as well and also proposed an enhanced scheme to overcome the identified weaknesses.
The Internet of Things (IoT) has become an important technology which permits different devices and machines to interconnect with each other using heterogeneous networks. The integration of numerous techniques is expected to offer extraordinary growth in future and current promising applications of IoT. In these days, the secure communication among interconnected IoT components has become an important issue of concern. Therefore, it has become a foremost need to design such authentication protocol which can make the secure communication among IoT components. In this article, we proposed an identity-based authentication and key agreement protocol for the IoT environment in order to offer the secure communication between various IoT entities. The devised protocol utilizes the physically unclonable function which helps to robustly resist the physical attack on IoT components. We analyze the proposed protocol informally which clearly shows that the proposed protocol offers the perfect forward secrecy, device anonymity and untraceability and also resists the desynchronization, IoT node impersonation and server impersonation attacks. The security features of proposed protocol are also analyzed formally using well known Random Oracle Model (ROM). Moreover, the performance of the devised protocol has also been determined in terms of communication and computational overhead. The performance and security analysis shows the supremacy of the devised protocol over the various related protocols.