International ISC Conference on Information Security and Cryptology (ISCISC)

A new lightweight authentication and key agreement protocol for Internet of Things

Sima Arasteh, Seyed Farhad Aghili, Hamid Mala

Published Sep 1, 2016• 33 citations

Abstract

Internet of Things (IoT) is a network of objects which enables them to collect vital information. As a result, privacy and anonymity in IoT are the most important issues. So far, many protocols have been proposed to provide authentication mechanism in IoT networks. Recently, Amin et al proposed a three-factor authenticated protocol for IoT networks that is claimed to be secure. In this paper, we challenge this claim and show that this protocol is vulnerable against the replay attack and DoS attack. Moreover, inspired by this protocol, we propose a secure authenticated key exchange protocol with the same assumptions. Our analysis shows that our proposed protocol is more efficient than Amin et al protocol.

DOI: 10.1109/iscisc.2016.7736451

Related papers

Security of a new lightweight authentication and key agreement protocol for internet of things

Xiaohong Fan, Baoli Niu

The Internet of Things (IoT) consists of all kinds of sensors which collect much information. The privacy and anonymity in IoT is fundamental to the system and must be resolved. Sima proposed a protocol about lightweight authentication and key agreement and claimed to be secure and robust against all existing methods of attack. In this paper, the author points out the vulnerability of Sima's protocol and makes improvements to it which can resist the malicious attack.

IEEE International Conference on Communication Software and NetworksMay 1, 20175 citations

A Security Enhanced Authentication Protocol

Sai Sreekar Vankayalapati, Srijanee Mookherji, Vanga Odelu

Internet of Things (IoT) have gained popularity in recent times. With an increase in the number of IoT devices, security and privacy vulnerabilities are also increasing. For sensitive domains like healthcare and industrial sectors, such vulnerabilities can cause havoc. Thus, authentication is an important aspect for establishing a secure communication between various participants. In this paper, two recent authentication and key exchange protocols are studied. It is demonstrated that these protocols are susceptible to replay attacks, modification attacks, and technical correctness issues. Possible improvements to address these vulnerabilities are also presented. The enhancements are designed to preserve the performance of the original protocols.

arXiv:2312.15250International Conference on Intelligent Communication Technologies and Virtual Mobile Networks (ICICV)Mar 11, 20242 citations

An Improved three-factor anonymous Authentication Protocol for WSN s based IoT System Using Symmetric cryptography

Khwaja Jawad, Khwaja Mansoor, Ahmed Fraz Baig +2 more

The emerging growth of Internet-of-Things(IoT) technology, enable the adoption of many industrial applications. As an infrastructure point of view, Wireless Sensor Networks(WSN) attains utmost importance in industrial IoT. The security threats always remain serious issues for WSN. Recently, Li et al scheme presented a three-factor authentication scheme for IoT environments. This article reviews Li et al. protocol find out that their protocol is vulnerable to stolen-verifier-attacks, Anonymity and Traceability issues. We present, an improved authentication scheme to conquered the flaws in Li et al scheme. Furthermore, the proposed solution is formally verified with ProVerif. Moreover security inspection proves the robustness of the proposed protocol.

International Conference on Communication Technologies (ComTech)Mar 1, 201916 citations

An Enhanced Multifactor Authentication and Key Agreement Protocol in Industrial Internet of Things

Yiran Han, Hua Guo, Jianwei Liu +3 more

The Industrial Internet of Things (IIoT) is the application of the Internet of Things (IoT) in the industrial field. IIoT allows users to remotely access industrial equipment and the data in it, which also brings certain challenges to the security of industrial data. Authentication and key agreement protocols are very effective security technologies in the matter of protecting industrial data. There is a large amount of research work on authentication protocols in IIoT, but most of the protocols have security weaknesses. Recently, Rafique et al. proposed a multi-factor protocol in IIoT that can accomplish authentication and session key establishment through a gateway. Rafique et al. claimed that their protocol is secure, unfortunately, we carefully analyze the protocol of Rafique et al. and find some security flaws, i.e., it is vulnerable to insider attack and known session-specific temporary information (KSSTI) attack, and unable to provide forward security. We explore the factors of insecurity and propose an enhanced multi-factor secure authentication and key agreement protocol in IIoT. The new protocol improves the security of the protocol while using only symmetric cryptography, hash function, and XOR operation. Formal security analysis and informal security discussions demonstrate that the new protocol is resistant to a variety of known attacks. After performance analysis, our protocol has lower computational cost, and increases no significant communication cost, while providing more secure and robust properties.

IEEE Internet of Things JournalFeb 12, 202454 citations

Towards Information-Theoretic Security and Privacy in IoT: A Three-Factor AKA Protocol Supporting Forgotten Password Reset

Yicheng Yu, Kai Wei, Hongtu Li +1 more

The growth of the Internet of Things (IoT) has created many problems. A wise example is presented by the design of secure, efficient authentication and key agreement (AKA) protocols. A novel three-factor AKA protocol for the IoT is presented in this paper. The scheme integrates password, biometric, and device-based factors that achieved strong security, which gives anonymity to the user, achieves forward secrecy, and makes the scheme resilient to various attacks like replay, impersonation, and de-synchronization. It also adds a safe lost-password-reset functionality, which makes the protocol more usable. Security analysis proves its strength against the typical adversary, while performance evaluation shows that the solution is better than existing solutions in terms of computational and communication efficiency. The work proposes a practical and scalable security solution for IoT systems, which satisfies the high security standard but within the constraints of an IoT system.

EntropyFeb 11, 20260 citations

Provable Privacy Preserving Authentication Solution for Internet of Things Environment

Bander A. Alzahrani, Khalid Mahmood

The Internet of Things (IoT) has become an important technology which permits different devices and machines to interconnect with each other using heterogeneous networks. The integration of numerous techniques is expected to offer extraordinary growth in future and current promising applications of IoT. In these days, the secure communication among interconnected IoT components has become an important issue of concern. Therefore, it has become a foremost need to design such authentication protocol which can make the secure communication among IoT components. In this article, we proposed an identity-based authentication and key agreement protocol for the IoT environment in order to offer the secure communication between various IoT entities. The devised protocol utilizes the physically unclonable function which helps to robustly resist the physical attack on IoT components. We analyze the proposed protocol informally which clearly shows that the proposed protocol offers the perfect forward secrecy, device anonymity and untraceability and also resists the desynchronization, IoT node impersonation and server impersonation attacks. The security features of proposed protocol are also analyzed formally using well known Random Oracle Model (ROM). Moreover, the performance of the devised protocol has also been determined in terms of communication and computational overhead. The performance and security analysis shows the supremacy of the devised protocol over the various related protocols.

IEEE AccessJan 1, 202123 citations