Wireless sensor network has been widely used and plays a vital role in the Internet of Things, smart cities, military, and other fields, and its security has also attracted the attention of many researchers. In view of the security defects in Shin and Kwon’s scheme such as failure to provide three-factor security, lack of anonymity and untraceability, user impersonation attack, desynchronization attack and privileged insider attack, we suggest an improved provably secure three-factor user authentication scheme based on Chebyshev chaotic mapping for wireless sensor network, which employs fuzzy verifier technique to prevent attacker from offline guessing attack on user identity and password when the stolen/lost smartcard is acquired by the attacker. During the authentication phase, a dynamic identity mechanism is used to ensure the anonymity of the user and sensor to prevent desynchronization attack, and the Chebyshev chaotic mapping is introduced to improve security and reduce computation overhead. The rigorous security proof under the random oracle model and the formal verification via ProVerif show that our protocol overcomes the weaknesses in Shin and Kwon’s scheme. In addition, by comparing the performance of our proposed scheme with that of others, we demonstrate that our proposal not only solves the security risks of Shin and Kwon.’s protocol, but also achieves a better tradeoff between security and efficiency, therefore, it is more suitable for user authentication in wireless sensor network environments.
Wireless sensor network has been widely used and plays a vital role in the Internet of Things, smart cities, military, and other fields, and its security has also attracted the attention of many researchers. In view of the security defects in Shin and Kwon’s scheme such as failure to provide three-factor security, lack of anonymity and untraceability, user impersonation attack, desynchronization attack and privileged insider attack, we suggest an improved provably secure three-factor user authentication scheme based on Chebyshev chaotic mapping for wireless sensor network, which employs fuzzy verifier technique to prevent attacker from offline guessing attack on user identity and password when the stolen/lost smartcard is acquired by the attacker. During the authentication phase, a dynamic identity mechanism is used to ensure the anonymity of the user and sensor to prevent desynchronization attack, and the Chebyshev chaotic mapping is introduced to improve security and reduce computation overhead. The rigorous security proof under the random oracle model and the formal verification via ProVerif show that our protocol overcomes the weaknesses in Shin and Kwon’s scheme. In addition, by comparing the performance of our proposed scheme with that of others, we demonstrate that our proposal not only solves the security risks of Shin and Kwon.’s protocol, but also achieves a better tradeoff between security and efficiency, therefore, it is more suitable for user authentication in wireless sensor network environments.
Wireless sensor networks (WSNs) are of prominent use in unmanned surveillance applications. This peculiar trait of WSNs is actually the underlying technology of various applications of the Internet of Things (IoT) such as smart homes, smart cities, smart shopping complexes, smart traffic, smart health, and much more. Over time, WSNs have evolved as a strong base for laying the foundations of IoT infrastructure. In order to address the scenario in which a user wants to access the real-time data directly from the sensor node in wireless sensor networks (WSNs), Das recently proposed an anonymity-preserving three-factor authentication protocol. Das's protocol is suitable for resource-constrained sensor nodes because it only uses lightweight cryptographic primitives such as hash functions and symmetric encryption schemes as building blocks. Das's protocol is claimed to be secure against different known attacks by providing formal security proof and security verification using the Automated Validation of Internet Security Protocols and Applications tool. However, we find that Das's protocol has the following security loopholes: (1) By using a captured sensor node, an adversary can impersonate a legal user to the gateway node, impersonate other sensor nodes to deceive the user, and the adversary can also decrypt all the cipher-texts of the user; (2) the gateway node has a heavy computational cost due to user anonymity and thus the protocol is vulnerable to denial of service (DoS) attacks. We overcome the shortcomings of Das's protocol and propose an improved protocol. We also prove the security of the proposed protocol in the random oracle model. Compared with the other related protocols, the improved protocol enjoys better functionality without much enhancement in the computation and communication costs. Consequently, it is more suitable for applications in WSNs.
Because sensor nodes are deployed in public areas, these sensors are easy to capture by adversaries. Once a sensor is stolen, the sensitive information stored in it is likely to be exposed. Accordingly, designing a secure authentication protocol should consider this issue. Sadri et al. recently proposed a two-factor authentication protocol with anonymity for wireless sensor networks. Unfortunately, we found that their protocol had a design flaw in the user and sensor authentication phase. Besides, their protocol can not resist stolen smart card attacks, sensor capture attacks, and user impersonation attacks. In addition, their protocol does not provide perfect forward security. This paper proposes a provably secure authentication to overcome these weaknesses and flaws. By comparing the security and performance of the proposed protocol with other related protocols, we find that our work has reasonable computation overhead and better security.
The emerging growth of Internet-of-Things(IoT) technology, enable the adoption of many industrial applications. As an infrastructure point of view, Wireless Sensor Networks(WSN) attains utmost importance in industrial IoT. The security threats always remain serious issues for WSN. Recently, Li et al scheme presented a three-factor authentication scheme for IoT environments. This article reviews Li et al. protocol find out that their protocol is vulnerable to stolen-verifier-attacks, Anonymity and Traceability issues. We present, an improved authentication scheme to conquered the flaws in Li et al scheme. Furthermore, the proposed solution is formally verified with ProVerif. Moreover security inspection proves the robustness of the proposed protocol.
To improve the quality of service and reduce the possibility of security attacks, a secure and efficient user authentication mechanism is required for Wireless Sensor Networks (WSNs) and the Internet of Things (IoT). Session key establishment between the sensor node and the user is also required for secure communication. In this paper, we perform the security analysis of A.K.Das’s user authentication scheme (given in 2015), Choi et al.’s scheme (given in 2016), and Park et al.’s scheme (given in 2016). The security analysis shows that their schemes are vulnerable to various attacks like user impersonation attack, sensor node impersonation attack and attacks based on legitimate users. Based on the cryptanalysis of these existing protocols, we propose a secure and efficient authenticated session key establishment protocol which ensures various security features and overcomes the drawbacks of existing protocols. The formal and informal security analysis indicates that the proposed protocol withstands the various security vulnerabilities involved in WSNs. The automated validation using AVISPA and Scyther tool ensures the absence of security attacks in our scheme. The logical verification using the Burrows-Abadi-Needham (BAN) logic confirms the correctness of the proposed protocol. Finally, the comparative analysis based on computational overhead and security features of other existing protocol indicate that the proposed user authentication system is secure and efficient. In future, we intend to implement the proposed protocol in real-world applications of WSNs and IoT.
In the Internet of Things (IoT), numerous devices can interact with each other over the Internet. A wide range of IoT applications have already been deployed, such as transportation systems, healthcare systems, smart buildings, smart factories, and smart cities. Wireless sensor networks (WSNs) play crucial roles in these IoT applications. Researchers have published effective (but not entirely secure) approaches for merging WSNs into IoT environments. In IoT environments, the security effectiveness of remote user authentication is crucial for information transmission. Computational efficiency and energy consumption are crucial because the energy available to any WSN is limited. This paper proposes a notably efficient and secure authentication scheme based on temporal credential and dynamic ID for WSNs in IoT environments. The Burrows-Abadi-Needham (BAN) logic method was used to validate our scheme. Cryptanalysis revealed that our scheme can overcome the security weaknesses of previously published schemes. The security functionalities and performance efficiency of our scheme are compared with those of previous related schemes. The result demonstrates that our scheme's security functionalities are quantitatively and qualitatively superior to those of comparable schemes. Our scheme can improve the effectiveness of authentication in IoT environments. Notably, our scheme has superior performance efficiency, low computational cost, frugal energy consumption, and low communication cost.
The Internet of Things (IoT) is being applied to various environments such as telecare systems, smart homes, and intelligent transportation systems. The information generated from IoT devices is stored at remote servers, and external users authenticate to the server for requesting access to the stored data. In IoT environments, the authentication process is required to be conducted efficiently, and should be secure against various attacks and ensure user anonymity and untraceability to ensure sustainability of the network. However, many existing protocols proposed in IoT environments do not meet these requirements. Recently, Rajaram et al. proposed a paring-based user authentication scheme. We found that the Rajaram et al. scheme is vulnerable to various attacks such as offline password guessing, impersonation, privileged insider, and known session-specific temporary information attacks. Additionally, as their scheme uses bilinear pairing, it requires high computation and communication costs. In this study, we propose a novel authentication scheme that resolves these security problems. The proposed scheme uses only hash and exclusive-or operations to be applicable in IoT environments. We analyze the proposed protocol using informal analysis and formal analysis methods such as the BAN logic, real-or-random (ROR) model, and the AVISPA simulation, and we show that the proposed protocol has better security and performance compared with existing authentication protocols. Consequently, the proposed protocol is sustainable and suitable for real IoT environments.