IEEE Internet of Things Journal

Comments on “Toward Secure and Provable Authentication for Internet of Things: Realizing Industry 4.0”

Muhammad Arslan Akram, Khalid Mahmood, Saru Kumari, Hu Xiong

Published Mar 4, 2020• 17 citations

Abstract

Internet of Things (IoT) is the next era of communication networks. The concept of IoT is that everything within the global communication network is interconnected and accessible. Since IoT has various applications, including Industry 4.0. Therefore, upcoming and existing IoT applications are highly auspicious to enhance the level of automation, efficiency, and comfort for the users. However, to a certain extent, there are numerous challenges while deploying IoT devices in the Industry 4.0, like IoT devices are assumed to have inadequate resources to support security solutions. Therefore, in order to protect the communication environment, an efficient and lightweight security solution is needed. Recently, on the basis of a hierarchical approach, Garget al.presented a lightweight, robust key agreement, and provably secure authentication protocol for the IoT environment. Their introduced protocol relies on lightweight operations, including XOR operation, concatenation, hash function, physically unclonable function (PUF), and elliptic curve cryptography. However, in this comment, we point out the security loopholes of Garget al.’s protocol and show that it is vulnerable to the IoT-node impersonation attack. Moreover, it has irrelevant generation and usage of some parameters. Therefore, we put forward some valuable suggestions for attack resilience.

DOI: 10.1109/jiot.2020.2977475

Related papers

Provable Privacy Preserving Authentication Solution for Internet of Things Environment

Bander A. Alzahrani, Khalid Mahmood

The Internet of Things (IoT) has become an important technology which permits different devices and machines to interconnect with each other using heterogeneous networks. The integration of numerous techniques is expected to offer extraordinary growth in future and current promising applications of IoT. In these days, the secure communication among interconnected IoT components has become an important issue of concern. Therefore, it has become a foremost need to design such authentication protocol which can make the secure communication among IoT components. In this article, we proposed an identity-based authentication and key agreement protocol for the IoT environment in order to offer the secure communication between various IoT entities. The devised protocol utilizes the physically unclonable function which helps to robustly resist the physical attack on IoT components. We analyze the proposed protocol informally which clearly shows that the proposed protocol offers the perfect forward secrecy, device anonymity and untraceability and also resists the desynchronization, IoT node impersonation and server impersonation attacks. The security features of proposed protocol are also analyzed formally using well known Random Oracle Model (ROM). Moreover, the performance of the devised protocol has also been determined in terms of communication and computational overhead. The performance and security analysis shows the supremacy of the devised protocol over the various related protocols.

IEEE AccessJan 1, 202123 citations

A Provably Secure and Practical PUF-Based End-to-End Mutual Authentication and Key Exchange Protocol for IoT

Sensen Li, Tikui Zhang, Bin Yu +1 more

Device authentication and key exchange are essential issues for Internet of Things (IoT) which plays an indispensable role in modern life. Many sensor devices in IoT, with limited resources and poor self-protection capabilities, are deployed in the unattended and open places, making them vulnerable to physical attacks while facing traditional security threats. Despite several researches have been conducted by using the physical unclonable function (PUF) to immune the communication between IoT devices from the security threats above, as per the knowledge of the authors, current solutions rely on the participation of the server to distribute the key parameters, which requires high message overhead and markedly influences the efficiency. To fill this gap, this article proposes an end-to-end mutual authentication and key exchange protocol for IoT by combining PUF with certificateless public key cryptography (CL-PKC) on elliptic curve, which only needs “three handshakes” without the real-time participation of the server. The security analysis shows that the proposed protocol can not only secure the IoT devices from various attacks, but also provide perfect forward secrecy. Moreover, the experimental validation and performance analysis show the proposed protocol outperforms existing related protocols in terms of security features, protocol rounds and communication cost.

IEEE Sensors JournalOct 6, 2020125 citations

Practical and Efficient PUF-Based Protocol for Authentication and Key Agreement in IoT

Sivappriya Manivannan, Rajat Subhra Chakraborty, Indrajit Chakrabarti +1 more

The immense potential of the Internet of Things (IoT) is challenged by grave security vulnerabilities that are easily exploitable in resource-constrained environments. We propose a lightweight Authentication and Key Agreement (AKA) protocol to derive a shared session key for each communicating node in amutually communicating cluster of IoT nodes. Each IoT device is embedded with a Physically Unclonable Function (PUF), and a Fuzzy Extractor (FE) is deployed to correct and reproduce the private key and public helper data pair from the possibly erroneous PUF response. This secret raw PUF response is not stored explicitly in the server. A forward-secure authenticated key agreement is achieved by incorporating Elliptic Curve Diffie-Hellman Key Exchange (ECDH) protocol. The security of the proposed scheme has been formally verified while considering both active and passive attackers using the Verifpal tool. A prototype implementation with the Arbiter PUF circuit, FE, and associated software has successfully demonstrated the efficacy of our scheme.

IEEE Embedded Systems LettersAug 2, 202315 citations

Authenticated Key Agreement Protocol for Device-to-Gateway Communication in IoT

Cong Pu, Jongho Seol, Nohpill Park +1 more

The advent of Internet of Things (IoT) ushers in a significant potential to integrate individuals, devices, and data, leading to a profound change in our professional and social environments. The small, resource-constrained IoT devices are usually deployed to collect various types of critical data in remote or unmonitored locations. Due to extensive interconnectivity, limited resources, and inadequate security design, IoT systems are vulnerable to communication-specific cyber threats, which aim to disrupt operations, steal sensitive information, or cause damage. To resolve the security concerns in IoT communications, many recent efforts have been devoted to designing authenticated key agreement protocols for IoT systems. However, not only most of the existing solutions fail to adopt cost-effective techniques for resource-limited IoT devices, but also they ignore the differentiation among various data types in the established session keys. A few approaches use traditional physical unclonable functions (PUFs) to address resource concerns, yet they introduce new security issues into IoT systems. Once the PUF cryptographic information is compromised by machine learning attacks, the entire authentication framework collapses. Therefore, in this paper we propose an authenticated key agreement protocol for device-to-gateway communication in IoT systems based on Chebyshev polynomial and probability-based PUF. We examine the proposed protocol’s security features through formal security validation. We also conduct performance evaluation through a simulation-oriented study, and the results clearly prove that the proposed protocol offers superior security and privacy, while maintaining low computational overhead.

IEEE Consumer Communications and Networking ConferenceJan 9, 20261 citation

An Efficient and Provably Secure Certificateless Protocol for Industrial Internet of Things

Farva Rafique, Mohammad S. Obaidat, Khalid Mahmood +3 more

The Internet of Things (IoT) has a wide range of applications that influence the life of people expeditiously. In recent years, IoT becomes an emerging technology in a number of fields. Different devices with divergent functionality are applied in IoT to work in several domains. These domains include smart home, smart farming, and Industrial Internet of Things (IIoT). Among these territories, the IIoT obtains more attention. In an IIoT environment, a legitimate user can control and access devices remotely. Legitimate users can access real-time data and share confidential information. The information is transmitted via public communication channel, which can be vulnerable to security attacks. In this article, we present a provably secure multifactor authenticated key agreement scheme to offer security regarding transmission of data in IIoT environment. This scheme will support the legitimate user to remotely access the sensing devices. Our presented scheme uses only symmetric cryptographic, bitwise XOR operation, and hash function to be resource-constrained. Our scheme is found to be resource efficient through communication and computation analysis. The performance analysis illustrates that the cost of computation and communication of our scheme is comparatively low as compared to other relevant schemes. The formal and informal security analysis proved that our scheme is secure and efficient as it can withstand several known adversarial attacks. We have used some cryptographic operations like XOR and hashing to provide security and privacy to legitimate entities.

IEEE Transactions on Industrial InformaticsMar 7, 202261 citations

An Enhanced Multifactor Authentication and Key Agreement Protocol in Industrial Internet of Things

Yiran Han, Hua Guo, Jianwei Liu +3 more

The Industrial Internet of Things (IIoT) is the application of the Internet of Things (IoT) in the industrial field. IIoT allows users to remotely access industrial equipment and the data in it, which also brings certain challenges to the security of industrial data. Authentication and key agreement protocols are very effective security technologies in the matter of protecting industrial data. There is a large amount of research work on authentication protocols in IIoT, but most of the protocols have security weaknesses. Recently, Rafique et al. proposed a multi-factor protocol in IIoT that can accomplish authentication and session key establishment through a gateway. Rafique et al. claimed that their protocol is secure, unfortunately, we carefully analyze the protocol of Rafique et al. and find some security flaws, i.e., it is vulnerable to insider attack and known session-specific temporary information (KSSTI) attack, and unable to provide forward security. We explore the factors of insecurity and propose an enhanced multi-factor secure authentication and key agreement protocol in IIoT. The new protocol improves the security of the protocol while using only symmetric cryptography, hash function, and XOR operation. Formal security analysis and informal security discussions demonstrate that the new protocol is resistant to a variety of known attacks. After performance analysis, our protocol has lower computational cost, and increases no significant communication cost, while providing more secure and robust properties.

IEEE Internet of Things JournalFeb 12, 202454 citations