To improve the quality of service and reduce the possibility of security attacks, a secure and efficient user authentication mechanism is required for Wireless Sensor Networks (WSNs) and the Internet of Things (IoT). Session key establishment between the sensor node and the user is also required for secure communication. In this paper, we perform the security analysis of A.K.Das’s user authentication scheme (given in 2015), Choi et al.’s scheme (given in 2016), and Park et al.’s scheme (given in 2016). The security analysis shows that their schemes are vulnerable to various attacks like user impersonation attack, sensor node impersonation attack and attacks based on legitimate users. Based on the cryptanalysis of these existing protocols, we propose a secure and efficient authenticated session key establishment protocol which ensures various security features and overcomes the drawbacks of existing protocols. The formal and informal security analysis indicates that the proposed protocol withstands the various security vulnerabilities involved in WSNs. The automated validation using AVISPA and Scyther tool ensures the absence of security attacks in our scheme. The logical verification using the Burrows-Abadi-Needham (BAN) logic confirms the correctness of the proposed protocol. Finally, the comparative analysis based on computational overhead and security features of other existing protocol indicate that the proposed user authentication system is secure and efficient. In future, we intend to implement the proposed protocol in real-world applications of WSNs and IoT.
To improve the quality of service and reduce the possibility of security attacks, a secure and efficient user authentication mechanism is required for Wireless Sensor Networks (WSNs) and the Internet of Things (IoT). Session key establishment between the sensor node and the user is also required for secure communication. In this paper, we perform the security analysis of A.K.Das’s user authentication scheme (given in 2015), Choi et al.’s scheme (given in 2016), and Park et al.’s scheme (given in 2016). The security analysis shows that their schemes are vulnerable to various attacks like user impersonation attack, sensor node impersonation attack and attacks based on legitimate users. Based on the cryptanalysis of these existing protocols, we propose a secure and efficient authenticated session key establishment protocol which ensures various security features and overcomes the drawbacks of existing protocols. The formal and informal security analysis indicates that the proposed protocol withstands the various security vulnerabilities involved in WSNs. The automated validation using AVISPA and Scyther tool ensures the absence of security attacks in our scheme. The logical verification using the Burrows-Abadi-Needham (BAN) logic confirms the correctness of the proposed protocol. Finally, the comparative analysis based on computational overhead and security features of other existing protocol indicate that the proposed user authentication system is secure and efficient. In future, we intend to implement the proposed protocol in real-world applications of WSNs and IoT.
In the Internet of Things (IoT), numerous devices can interact with each other over the Internet. A wide range of IoT applications have already been deployed, such as transportation systems, healthcare systems, smart buildings, smart factories, and smart cities. Wireless sensor networks (WSNs) play crucial roles in these IoT applications. Researchers have published effective (but not entirely secure) approaches for merging WSNs into IoT environments. In IoT environments, the security effectiveness of remote user authentication is crucial for information transmission. Computational efficiency and energy consumption are crucial because the energy available to any WSN is limited. This paper proposes a notably efficient and secure authentication scheme based on temporal credential and dynamic ID for WSNs in IoT environments. The Burrows-Abadi-Needham (BAN) logic method was used to validate our scheme. Cryptanalysis revealed that our scheme can overcome the security weaknesses of previously published schemes. The security functionalities and performance efficiency of our scheme are compared with those of previous related schemes. The result demonstrates that our scheme's security functionalities are quantitatively and qualitatively superior to those of comparable schemes. Our scheme can improve the effectiveness of authentication in IoT environments. Notably, our scheme has superior performance efficiency, low computational cost, frugal energy consumption, and low communication cost.
The Internet of Things (IoT) is being applied to various environments such as telecare systems, smart homes, and intelligent transportation systems. The information generated from IoT devices is stored at remote servers, and external users authenticate to the server for requesting access to the stored data. In IoT environments, the authentication process is required to be conducted efficiently, and should be secure against various attacks and ensure user anonymity and untraceability to ensure sustainability of the network. However, many existing protocols proposed in IoT environments do not meet these requirements. Recently, Rajaram et al. proposed a paring-based user authentication scheme. We found that the Rajaram et al. scheme is vulnerable to various attacks such as offline password guessing, impersonation, privileged insider, and known session-specific temporary information attacks. Additionally, as their scheme uses bilinear pairing, it requires high computation and communication costs. In this study, we propose a novel authentication scheme that resolves these security problems. The proposed scheme uses only hash and exclusive-or operations to be applicable in IoT environments. We analyze the proposed protocol using informal analysis and formal analysis methods such as the BAN logic, real-or-random (ROR) model, and the AVISPA simulation, and we show that the proposed protocol has better security and performance compared with existing authentication protocols. Consequently, the proposed protocol is sustainable and suitable for real IoT environments.
Enhancement in Wireless sensing technology had widened its application scope and deployment possibilities. Since 2004, Wireless Sensor Network(WSN) became one of the top interesting topics for the researchers due to its advantages and futuristic aspects. After the emergence of the Internet of Things(IoT), WSN became an integral part of IoT. IoT is the technology which aims to provide any service to anyone at any time with the improved quality of service. IoT invites many entities to communicate in its large scale application and allow entities to share collected information in either wired or wireless manner. After studying most of the literature, we found out that most communication in IoT scenario occurred over public channel rather than secured channels and this aspect approached many researchers to focus on the security part of IoT communication. Billions of devices/humans do the communication with each other as well as provide the critical data to each other on public channels so it becomes important for the communicating parties to validate each other as well as generate a communication secret for sharing a secret or critical information. Since 2009, many authors had focused on Remote User Authentication(RUA) for Wireless Sensor Network. In this paper, we have reviewed the RUA scheme provided by Chen et al. [1] and listed out some shortcoming of their scheme. Authors have made use of famous light weight and secured cryptographic approach called as Elliptic Curve Cryptography(ECC) for their protocol design but due to adversary capabilities, we have found their there scheme is not secured against node capturing attack and gateway node bypassing attack. We have also discussed the network model followed by authors in their paper which may help other researchers to study and apply in their RUA protocol design. This activity would help other protocol designers to improve their approaches in the field of RUA protocol designing for IoT environment.
Wireless sensor networks (WSNs) are of prominent use in unmanned surveillance applications. This peculiar trait of WSNs is actually the underlying technology of various applications of the Internet of Things (IoT) such as smart homes, smart cities, smart shopping complexes, smart traffic, smart health, and much more. Over time, WSNs have evolved as a strong base for laying the foundations of IoT infrastructure. In order to address the scenario in which a user wants to access the real-time data directly from the sensor node in wireless sensor networks (WSNs), Das recently proposed an anonymity-preserving three-factor authentication protocol. Das's protocol is suitable for resource-constrained sensor nodes because it only uses lightweight cryptographic primitives such as hash functions and symmetric encryption schemes as building blocks. Das's protocol is claimed to be secure against different known attacks by providing formal security proof and security verification using the Automated Validation of Internet Security Protocols and Applications tool. However, we find that Das's protocol has the following security loopholes: (1) By using a captured sensor node, an adversary can impersonate a legal user to the gateway node, impersonate other sensor nodes to deceive the user, and the adversary can also decrypt all the cipher-texts of the user; (2) the gateway node has a heavy computational cost due to user anonymity and thus the protocol is vulnerable to denial of service (DoS) attacks. We overcome the shortcomings of Das's protocol and propose an improved protocol. We also prove the security of the proposed protocol in the random oracle model. Compared with the other related protocols, the improved protocol enjoys better functionality without much enhancement in the computation and communication costs. Consequently, it is more suitable for applications in WSNs.
The emergence of Internet of Things (IoT) is turning common conceptions of the current Internet into a dream of smart objects that communicate with each other. Wireless Sensor Networks (WSNs) play an important role in such an environment, since they include a wide range of applications. Researchers are already working on how WSN can be effectively integrated into the IoT environment. One part of the integration is the security aspect. In recent years, Farash et al. proposed an efficient user authentication and key agreement scheme for Heterogeneous WSN (HWSN) tailored for the IoT environment. Although their scheme is efficient, we found that this scheme is vulnerable to several cryptographic attacks. This paper first demonstrates all security weaknesses of the Farash et al.'s scheme and then proposes a secure and improved mutual authentication and key agreement scheme.
A security protocol for wireless transmission is essential to defend sensitive information from malicious enemies by providing a variety of facilities such as privacy of the user's information, secure session key, associated authentication, and user-repeal facility when a person's authorizations are suddenly disclosed. Singh et al. proposed an improved user authentication and key agreement system for wireless sensor networks (WSNs). Authors are sure that their protocol is secure from various attacks. Here, we find several security pitfalls in their scheme, such as an offline password-guessing attack, failure to protect the session key, and a man-in-the-middle attack. To remove the identified pitfalls found in Singh et al.'s scheme, we design an enhanced authentication scheme for WSNs tailored for IoT. We prove the reliability of our proposed protocol using the real or random (RoR) model. We also evaluate the proposed scheme with the associated schemes and show its superior efficacy as compared to its counterparts.