The emerging growth of Internet-of-Things(IoT) technology, enable the adoption of many industrial applications. As an infrastructure point of view, Wireless Sensor Networks(WSN) attains utmost importance in industrial IoT. The security threats always remain serious issues for WSN. Recently, Li et al scheme presented a three-factor authentication scheme for IoT environments. This article reviews Li et al. protocol find out that their protocol is vulnerable to stolen-verifier-attacks, Anonymity and Traceability issues. We present, an improved authentication scheme to conquered the flaws in Li et al scheme. Furthermore, the proposed solution is formally verified with ProVerif. Moreover security inspection proves the robustness of the proposed protocol.
The emerging growth of Internet-of-Things(IoT) technology, enable the adoption of many industrial applications. As an infrastructure point of view, Wireless Sensor Networks(WSN) attains utmost importance in industrial IoT. The security threats always remain serious issues for WSN. Recently, Li et al scheme presented a three-factor authentication scheme for IoT environments. This article reviews Li et al. protocol find out that their protocol is vulnerable to stolen-verifier-attacks, Anonymity and Traceability issues. We present, an improved authentication scheme to conquered the flaws in Li et al scheme. Furthermore, the proposed solution is formally verified with ProVerif. Moreover security inspection proves the robustness of the proposed protocol.
Wireless sensor networks (WSNs) are of prominent use in unmanned surveillance applications. This peculiar trait of WSNs is actually the underlying technology of various applications of the Internet of Things (IoT) such as smart homes, smart cities, smart shopping complexes, smart traffic, smart health, and much more. Over time, WSNs have evolved as a strong base for laying the foundations of IoT infrastructure. In order to address the scenario in which a user wants to access the real-time data directly from the sensor node in wireless sensor networks (WSNs), Das recently proposed an anonymity-preserving three-factor authentication protocol. Das's protocol is suitable for resource-constrained sensor nodes because it only uses lightweight cryptographic primitives such as hash functions and symmetric encryption schemes as building blocks. Das's protocol is claimed to be secure against different known attacks by providing formal security proof and security verification using the Automated Validation of Internet Security Protocols and Applications tool. However, we find that Das's protocol has the following security loopholes: (1) By using a captured sensor node, an adversary can impersonate a legal user to the gateway node, impersonate other sensor nodes to deceive the user, and the adversary can also decrypt all the cipher-texts of the user; (2) the gateway node has a heavy computational cost due to user anonymity and thus the protocol is vulnerable to denial of service (DoS) attacks. We overcome the shortcomings of Das's protocol and propose an improved protocol. We also prove the security of the proposed protocol in the random oracle model. Compared with the other related protocols, the improved protocol enjoys better functionality without much enhancement in the computation and communication costs. Consequently, it is more suitable for applications in WSNs.
The rapid proliferation of Internet of Things (IoT) devices in Wireless Sensor Networks (WSNs) has introduced a new dimension of connectivity, efficiency, and automation. However, it also presents significant security concerns, particularly in authentication. Strong and trustworthy authentication protocols are required to ensure secure communication and trustworthiness in IoT systems. For instance, Sahoo et al.’s authentication scheme has serious design flaws and lacks forward and backwards secrecy. Similarly, due to inherent design flaws, Mahmood et al.’s protocol is vulnerable to several major attacks. This paper presents a novel, lightweight authentication scheme for IoT-enabled WSNs to address these challenges. We prioritise low computational overhead, scalability, and strong security guarantees like perfect forward secrecy, backwards secrecy, and immunity against replay, MiTM, impersonation attacks, etc. We demonstrate through an extensive security analysis of the ROM model that our scheme addresses the shortcomings of existing methods. The protocol’s security is formally verified using the Scyther tool, and its practical feasibility is demonstrated through ESP32-based simulation on the wokwi platform, confirming correct cryptographic operations and session key management. This paper is a significant step toward designing an efficient and secure authentication system in line with the evolving requirements of modern IoT infrastructures.
The emergence of Internet of Things (IoT) is turning common conceptions of the current Internet into a dream of smart objects that communicate with each other. Wireless Sensor Networks (WSNs) play an important role in such an environment, since they include a wide range of applications. Researchers are already working on how WSN can be effectively integrated into the IoT environment. One part of the integration is the security aspect. In recent years, Farash et al. proposed an efficient user authentication and key agreement scheme for Heterogeneous WSN (HWSN) tailored for the IoT environment. Although their scheme is efficient, we found that this scheme is vulnerable to several cryptographic attacks. This paper first demonstrates all security weaknesses of the Farash et al.'s scheme and then proposes a secure and improved mutual authentication and key agreement scheme.
Internet of Things (IoT) is a network of objects which enables them to collect vital information. As a result, privacy and anonymity in IoT are the most important issues. So far, many protocols have been proposed to provide authentication mechanism in IoT networks. Recently, Amin et al proposed a three-factor authenticated protocol for IoT networks that is claimed to be secure. In this paper, we challenge this claim and show that this protocol is vulnerable against the replay attack and DoS attack. Moreover, inspired by this protocol, we propose a secure authenticated key exchange protocol with the same assumptions. Our analysis shows that our proposed protocol is more efficient than Amin et al protocol.
Internet of Things (IoT) is an expanding technology that facilitate physical devices to inter-connect each other over a public channel. Moreover, the security of the next-generation wireless mobile communication technology, namely 5G with IoT, has been a field of much interest among researchers in the last several years. Previously, Sharif et al. had suggested an IoTbased lightweight three-party authentication scheme proclaiming a secured scheme against different threats. However, it was found that the scheme could not achieve user anonymity and guarantee session key security. Additionally, the scheme fails to provide proper authentication in the login phase, and it s unable to update a new password in the password change phase. Thus, we propose an improved three-factor-based data transmission authentication scheme (TDTAS) to address the weaknesses. The formal security analysis has been proved using the Real-or-Random (RoR) model. The informal security analysis demonstrates that the scheme is secure against several known attacks and achieves more security features. In addition, the comparison of the work with other related schemes demonstrates the proposed scheme has less communicational and storage costs.
Because sensor nodes are deployed in public areas, these sensors are easy to capture by adversaries. Once a sensor is stolen, the sensitive information stored in it is likely to be exposed. Accordingly, designing a secure authentication protocol should consider this issue. Sadri et al. recently proposed a two-factor authentication protocol with anonymity for wireless sensor networks. Unfortunately, we found that their protocol had a design flaw in the user and sensor authentication phase. Besides, their protocol can not resist stolen smart card attacks, sensor capture attacks, and user impersonation attacks. In addition, their protocol does not provide perfect forward security. This paper proposes a provably secure authentication to overcome these weaknesses and flaws. By comparing the security and performance of the proposed protocol with other related protocols, we find that our work has reasonable computation overhead and better security.