Internet of Things (IoT) devices have restricted resources and energy; however, they require regular updates and identification from other devices and the backend server. Thus, security is also a major concern, and the most common way to do it is mutual authentication between the communicating parties. Provable security aims to provide concrete mathematical proof for ensuring the protocol’s security. Modern cryptographic protocols deploy “game-based” security models, which have an adversary that can carry out potential attacks over the concerned system. The adversary in the universally composable security model interacts with both real-world and ideal-world environments. The adversary can eavesdrop into all the communications and can schedule the activation sequence of the entities. The real spreading of IoT services requires customized security and privacy levels to be guaranteed. K. Ouafi et al. have extended Vaudeney’s model to incorporate the notion of strong privacy.
Internet of Things (IoT) devices have restricted resources and energy; however, they require regular updates and identification from other devices and the backend server. Thus, security is also a major concern, and the most common way to do it is mutual authentication between the communicating parties. Provable security aims to provide concrete mathematical proof for ensuring the protocol’s security. Modern cryptographic protocols deploy “game-based” security models, which have an adversary that can carry out potential attacks over the concerned system. The adversary in the universally composable security model interacts with both real-world and ideal-world environments. The adversary can eavesdrop into all the communications and can schedule the activation sequence of the entities. The real spreading of IoT services requires customized security and privacy levels to be guaranteed. K. Ouafi et al. have extended Vaudeney’s model to incorporate the notion of strong privacy.
Internet-of-things (IoT) is the latest revolution in electronic industry after internet. Smart appliances, portable computing devices, mobile phones and handheld system dominates in IoT, because a large portion of world population use it. Major applications, mainly financial, e-commerce, information security and sensitive data-communication need special attention in terms of security. Device authentication, encryption, and key distribution are of vital importance to any Internet-of-Things (IoT) systems, such as the new smart city infrastructures. This is due to the concern that attackers could easily exploitthe lack of strong security in IoT devices to gain unauthorized access to the system or to hijack IoT devices to perform denial-of-service attacks on other networks. This creates a strong requirement for providing security solutions into these devices. Key Word: IOT; Communication; Data; Application; Server.
The Internet of Things (IoT) is among the most promising technologies of the future, and its development has garnered attention worldwide. However, the rise of the IoT has been accompanied by a proportionate increase in security concerns regarding communication between IoT entities. Recently, Alzahrani et al. proposed an identity-based authentication and key agreement protocol for an IoT environment, wherein a physically unclonable function was employed. They claimed that their protocol can resist various types of attacks; however, after thorough analysis, we determined it to be ineffective against privileged internal attacks, physical IoT device capture attacks, stolen-verifier attacks, and known temporary information exposure attacks. To resolve these security weaknesses, we propose a new authentication and key agreement protocol. In addition, we demonstrate that the proposed protocol is provably secure in real-or-random (ROR) model and Burrows–Abadi–Needham (BAN) logic, resisting known attacks while incurring low communication and computation costs.
The Internet of Things (IoT) has become an important technology which permits different devices and machines to interconnect with each other using heterogeneous networks. The integration of numerous techniques is expected to offer extraordinary growth in future and current promising applications of IoT. In these days, the secure communication among interconnected IoT components has become an important issue of concern. Therefore, it has become a foremost need to design such authentication protocol which can make the secure communication among IoT components. In this article, we proposed an identity-based authentication and key agreement protocol for the IoT environment in order to offer the secure communication between various IoT entities. The devised protocol utilizes the physically unclonable function which helps to robustly resist the physical attack on IoT components. We analyze the proposed protocol informally which clearly shows that the proposed protocol offers the perfect forward secrecy, device anonymity and untraceability and also resists the desynchronization, IoT node impersonation and server impersonation attacks. The security features of proposed protocol are also analyzed formally using well known Random Oracle Model (ROM). Moreover, the performance of the devised protocol has also been determined in terms of communication and computational overhead. The performance and security analysis shows the supremacy of the devised protocol over the various related protocols.
Internet of Things (IoT) is the next era of communication networks. The concept of IoT is that everything within the global communication network is interconnected and accessible. Since IoT has various applications, including Industry 4.0. Therefore, upcoming and existing IoT applications are highly auspicious to enhance the level of automation, efficiency, and comfort for the users. However, to a certain extent, there are numerous challenges while deploying IoT devices in the Industry 4.0, like IoT devices are assumed to have inadequate resources to support security solutions. Therefore, in order to protect the communication environment, an efficient and lightweight security solution is needed. Recently, on the basis of a hierarchical approach, Garget al.presented a lightweight, robust key agreement, and provably secure authentication protocol for the IoT environment. Their introduced protocol relies on lightweight operations, including XOR operation, concatenation, hash function, physically unclonable function (PUF), and elliptic curve cryptography. However, in this comment, we point out the security loopholes of Garget al.’s protocol and show that it is vulnerable to the IoT-node impersonation attack. Moreover, it has irrelevant generation and usage of some parameters. Therefore, we put forward some valuable suggestions for attack resilience.
Modeling security for protocols running in the complex network environment of the Internet can be a daunting task. Ideally, a security model for the Internet should provide the following guarantee: a protocol that implements a particular task specification will retain all the same security properties as the specification itself, even when an arbitrary set of protocols runs concurrently on the same network. This guarantee must hold even when other protocols are maliciously designed to interact badly with the analyzed protocol, and even when the analyzed protocol is composed with other protocols. The popular Universal Composability (UC) security framework aims to provide this guarantee.
Unfortunately, such strong security guarantees come with a price: they are impossible to achieve without the use of some trusted setup. Typically, this trusted setup is global in nature, and takes the form of a Public Key Infrastructure (PKI) and/or a Common Reference String (CRS). However, the current approach to modeling security in the presence of such setups falls short of providing expected security guarantees. A quintessential example of this phenomenon is the deniability concern: there exist natural protocols that meet the strongest known security notions (including UC) while failing to provide the same deniability guarantees that their task specifications imply they should provide.
We introduce the Generalized Universal Composability (GUC) framework to extend the UC security notion and enable the re-establishment of its original intuitive security guarantees even for protocols that use global trusted setups. In particular, GUC enables us to guarantee that secure protocols will provide the same level of deniability as the task specification they implement. To demonstrate the usefulness of the GUC framework, we first apply it to the analysis and construction of deniable authentication protocols. Building upon such deniable authentication protocols, we then prove a general feasibility result showing how to construct protocols satisfying our security notion for a large class of two-party and multi-party tasks (assuming the availability of some reasonable trusted setup). Finally, we highlight the practical applicability of GUC by constructing efficient protocols that securely instantiate two common cryptographic tasks: commitments and zero-knowledge proofs.
Evolution of internet had connected millions of devices across the globe, including smart gadgets for home uses like Smart TV, thermostat, and CCTV camera, etc. It had made the entire human community connected and access gadgets from every corner of the world through cloud infrastructure. An increase in Internet of Things (IoT) devices leads to a decrease in computational performance during machine interaction while computing and makes the IoT framework as a failure model. Other biggest challenges faced by the IoT devices are privacy and security of personal information due to adversary attack during device communication. The current safety measures like frequent password change, updating IoT devices regularly, secondary network usage Virtual Private Network (VPN), and avoiding plug and play features can be reliable up to a certain threshold but can't guarantee 100% security. The public key cryptography algorithm (Rivest, Shamir, Adleman [RSA]) that is considered to be a safe algorithm in the current era is in threat due to the invention of new technology. One-time pad (OTP) is considered an efficient encryption technique in secure communication in classical cryptography but lags in distributing the key between parties. The trade-off between increasing IoT devices and classical security measures is unbalanced, so required new technology to solve the problem. Development of cutting-edge technology, known as quantum computing, will be helpful in providing a sustainable solution for computational speed during machine communication and solving security issues in millions of IoT devices. Quantum technology work based on the principle of quantum physics works differently from current technology, which depends on classical physics. The classical cryptography works based on bits, which is predictable in nature, can be easily hacked but quantum uses qubits, which is superposition of 0 and 1. The measurement of unknown qubit that gives 1/2 probabilities to measure either in bit “0” or bit “1” makes difficult to predict the data. Grover's algorithm helps to search an unsorted database in O( https://www.w3.org/1998/Math/MathML"> √ n https://s3-euw1-ap-pe-df-pch-content-public-p.s3.eu-west-1.amazonaws.com/9781003268796/ff7c0afb-bead-450a-a822-68dbcc013133/content/math16_1.tif" xmlns:xlink=" https://www.w3.org/1999/xlink "/> ) as it takes O(n) in classical algorithm and Shor's algorithm in quantum computing, solving the factoring a large number in polynomial time as it takes exponential time by classical model. Heisenberg principles and no-cloning theorem are the properties of quantum mechanics and will solve the privacy issue and provide high-level security by identifying the involvement of unauthorized user in current communication. The uncertainty principle given by Heisenberg states that it's impossible to measure the unknown quantum states without disturbing it, which leads to identification of involvement of third party in it. Another quantum property is no-cloning theorem that means it's difficult to make the duplicate of the unknown states. So it's impossible for an adversary to clone the quantum state in order to snoop the quantum information in secure communication. Another variant of communication in quantum computing in entanglement where a third party will generate an entangled photon and send qubit to communicating parties. Measurement of qubit by one party will correlated with the measurement of other party which leads to generation of secure key. Quantum communications have various phases like quantum state preparation, state transmission, and state measurement which are entirely different from classical communication. Quantum secure direct communication (QSDC) is a two-way communications where two parties will transfer information directly in secure manner without the key. Another way is transferring the secure key between user using quantum key distribution (QKD) and OTP used to secretly share the information between them using ciphertext. Quantum and classical security approach should be joined together to obtain high-level security for the IoT security framework.