An authenticated key exchange for the Internet of Things (IoT) sensor layer is discussed in this paper. This paper presents an enhanced key exchange protocol to provide an authentication scheme and data confidentiality for IoT sensor layer. In our approach, we incorporate an identity-based authentication scheme into the existing key exchange protocol based on Elliptic Curve Diffie Hellman (ECDH). We utilize two communication channels for the process, main channel and auxiliary channel. The main channel is used to exchange key and sensor data and the auxiliary channel is used to exchange the identity information prior to the key exchange process. To provide the data confidentiality, AES encryption algorithm is implemented with a key derived from shared secret key to ensure the Perfect Forward Secrecy. For the evaluations, there are four parameters that are evaluated: the protocol resistance, formal verification of protocol, the protocol security, and performance testing. The protocol resistance was evaluated using security analysis against common security threats on IoT sensor layer. The formal verification of the proposed protocol was evaluated using Scyther, and the protocol security was evaluated using attack scenarios (i.e., authentication and sniffing attack) to prove the authentication and confidentiality. The performance testing was conducted to measure time complexity and memory complexity of the protocol. The experiment results show that the proposed protocol is able to provide an authentication mechanism, data confidentiality, and resilience against common security threats at IoT sensor layers.
An authenticated key exchange for the Internet of Things (IoT) sensor layer is discussed in this paper. This paper presents an enhanced key exchange protocol to provide an authentication scheme and data confidentiality for IoT sensor layer. In our approach, we incorporate an identity-based authentication scheme into the existing key exchange protocol based on Elliptic Curve Diffie Hellman (ECDH). We utilize two communication channels for the process, main channel and auxiliary channel. The main channel is used to exchange key and sensor data and the auxiliary channel is used to exchange the identity information prior to the key exchange process. To provide the data confidentiality, AES encryption algorithm is implemented with a key derived from shared secret key to ensure the Perfect Forward Secrecy. For the evaluations, there are four parameters that are evaluated: the protocol resistance, formal verification of protocol, the protocol security, and performance testing. The protocol resistance was evaluated using security analysis against common security threats on IoT sensor layer. The formal verification of the proposed protocol was evaluated using Scyther, and the protocol security was evaluated using attack scenarios (i.e., authentication and sniffing attack) to prove the authentication and confidentiality. The performance testing was conducted to measure time complexity and memory complexity of the protocol. The experiment results show that the proposed protocol is able to provide an authentication mechanism, data confidentiality, and resilience against common security threats at IoT sensor layers.
With the rise of the Internet of Things (IoT), maintaining data confidentiality and protecting user privacy have become increasingly challenging. End devices in the IoT are often deployed in unattended environments and connected to open networks, making them vulnerable to physical tampering and other security attacks. Different authentication key agreement (AKA) schemes have been used in practice; several of them do not cover the necessary security features or are incompatible with resource-constrained end devices. Their security proofs have been performed under the Random-Oracle model. We present an AKA protocol for end devices and servers. The proposal leverages the ECC-based key exchange mechanism and one-way hash function-based message authentication method to achieve mutual authentication, user anonymity, and forward security. A formal security proof of the proposed scheme is performed under the standard model and the eCK model with the elliptic curve encryption computational assumptions, and formal verification is performed with ProVerif. According to the performance comparison, it is revealed that the proposed scheme offers user anonymity, perfect forward security, and mutual authentication, and resists typical attacks such as ephemeral secret leakage attacks, impersonation attacks, man-in-the-middle attacks, and key compromise impersonation attacks. Moreover, the proposed scheme has the lowest computational and communication overhead compared to existing schemes.
The immense potential of the Internet of Things (IoT) is challenged by grave security vulnerabilities that are easily exploitable in resource-constrained environments. We propose a lightweight Authentication and Key Agreement (AKA) protocol to derive a shared session key for each communicating node in amutually communicating cluster of IoT nodes. Each IoT device is embedded with a Physically Unclonable Function (PUF), and a Fuzzy Extractor (FE) is deployed to correct and reproduce the private key and public helper data pair from the possibly erroneous PUF response. This secret raw PUF response is not stored explicitly in the server. A forward-secure authenticated key agreement is achieved by incorporating Elliptic Curve Diffie-Hellman Key Exchange (ECDH) protocol. The security of the proposed scheme has been formally verified while considering both active and passive attackers using the Verifpal tool. A prototype implementation with the Arbiter PUF circuit, FE, and associated software has successfully demonstrated the efficacy of our scheme.
Device authentication and key exchange are essential issues for Internet of Things (IoT) which plays an indispensable role in modern life. Many sensor devices in IoT, with limited resources and poor self-protection capabilities, are deployed in the unattended and open places, making them vulnerable to physical attacks while facing traditional security threats. Despite several researches have been conducted by using the physical unclonable function (PUF) to immune the communication between IoT devices from the security threats above, as per the knowledge of the authors, current solutions rely on the participation of the server to distribute the key parameters, which requires high message overhead and markedly influences the efficiency. To fill this gap, this article proposes an end-to-end mutual authentication and key exchange protocol for IoT by combining PUF with certificateless public key cryptography (CL-PKC) on elliptic curve, which only needs “three handshakes” without the real-time participation of the server. The security analysis shows that the proposed protocol can not only secure the IoT devices from various attacks, but also provide perfect forward secrecy. Moreover, the experimental validation and performance analysis show the proposed protocol outperforms existing related protocols in terms of security features, protocol rounds and communication cost.
To improve the quality of service and reduce the possibility of security attacks, a secure and efficient user authentication mechanism is required for Wireless Sensor Networks (WSNs) and the Internet of Things (IoT). Session key establishment between the sensor node and the user is also required for secure communication. In this paper, we perform the security analysis of A.K.Das’s user authentication scheme (given in 2015), Choi et al.’s scheme (given in 2016), and Park et al.’s scheme (given in 2016). The security analysis shows that their schemes are vulnerable to various attacks like user impersonation attack, sensor node impersonation attack and attacks based on legitimate users. Based on the cryptanalysis of these existing protocols, we propose a secure and efficient authenticated session key establishment protocol which ensures various security features and overcomes the drawbacks of existing protocols. The formal and informal security analysis indicates that the proposed protocol withstands the various security vulnerabilities involved in WSNs. The automated validation using AVISPA and Scyther tool ensures the absence of security attacks in our scheme. The logical verification using the Burrows-Abadi-Needham (BAN) logic confirms the correctness of the proposed protocol. Finally, the comparative analysis based on computational overhead and security features of other existing protocol indicate that the proposed user authentication system is secure and efficient. In future, we intend to implement the proposed protocol in real-world applications of WSNs and IoT.
The rapid proliferation of the Internet of Things (IoT) has connected billions of devices that continuously exchange sensitive data over public wireless channels, making secure authentication a critical requirement. However, most IoT end devices are severely resource-constrained, which renders conventional public-key infrastructures based on RSA, bilinear pairings, or digital certificates impractical. Although many authentication and key agreement schemes have been proposed, recent cryptanalytic studies show that they often either omit essential security properties such as perfect forward secrecy or resistance to ephemeral secret leakage or incur overhead that is unacceptable for low-power nodes. To address this gap, this paper proposes a lightweight Elliptic Curve Cryptography (ECC)-based authentication and key agreement protocol for a three-tier IoT architecture consisting of a user, a semi-trusted gateway server, and an IoT sensor. The protocol relies solely on elliptic-curve scalar multiplication, one-way hash functions, and bitwise XOR operations, avoiding bilinear pairings and certificate management. It achieves mutual authentication among all three parties through timestamped, hash-based authenticators and establishes a contributory session-key derived from fresh ephemeral keys, ensuring perfect forward secrecy. The security of the protocol is established through a detailed informal analysis, demonstrating resistance to major attacks, and is formally verified using the AVISPA tool, where both the OFMC and CL-AtSe back-ends report the protocol as SAFE under the Dolev–Yao adversary model. A comparative performance evaluation against several recent ECC-based authentication schemes shows that the proposed protocol maintains low cost requirements suitable for constrained IoT devices, and resulting in a communication overhead of 1828 bits, which is competitive with most recent ECC-based schemes evaluated, and imposing a minimal storage burden on end devices. The results demonstrate that the proposed protocol achieves a favorable balance between security and efficiency, making it well suited to resource-constrained IoT environments.
The rapid expansion of Internet of Things (IoT) ecosystems has introduced significant security challenges due to resource-constrained devices, heterogeneous network architectures, and largescale connectivity. Traditional authentication and key exchange mechanisms, primarily based on classical cryptographic algorithms such as RSA and ECC, are vulnerable to future quantum computing attacks. The emergence of quantum algorithms, particularly Shor’s algorithm, threatens the long-term confidentiality and integrity of IoT communications. This paper proposes a Quantum-Resistant Authentication and Key Exchange Protocol specifically designed for secure IoT architectures. The proposed framework integrates post-quantum cryptographic primitives, including lattice-based key exchange mechanisms and hash-based authentication schemes, optimized for low computational overhead suitable for constrained IoT devices. The protocol ensures mutual authentication, forward secrecy, and resistance against quantum adversaries while maintaining minimal communication latency. Security analysis demonstrates robustness against replay, man-in-the-middle, and key-compromise attacks. Performance evaluation shows that the proposed solution achieves a balance between quantum security strength and resource efficiency, making it suitable for next-generation IoT deployments in smart cities, healthcare systems, and industrial automation.