Abstract Advances in communication technologies as well as the availability of the Internet and Internet of Things (IoT) devices enable users to access various services on the internet. However, open communication with IoT devices can be attacked. Recently, Rana et al. proposed a secure key agreement protocol using RLWE. In this paper, we exploited the vulnerability of Rana et al.'s protocol by using a key mismatch attack. Moreover, it has been shown how an adversary who plays a user's role recovers the server's long-term secret key.
Abstract Advances in communication technologies as well as the availability of the Internet and Internet of Things (IoT) devices enable users to access various services on the internet. However, open communication with IoT devices can be attacked. Recently, Rana et al. proposed a secure key agreement protocol using RLWE. In this paper, we exploited the vulnerability of Rana et al.'s protocol by using a key mismatch attack. Moreover, it has been shown how an adversary who plays a user's role recovers the server's long-term secret key.
Abstract The increasing interconnectedness of devices via the Internet of Things (IoT) highlights the growing importance of addressing IoT security issues. Authenticated Key Agreement (AKA) protocols ensure secure communication between IoT devices, users, and central servers. Preserving anonymity in AKA protocols is especially crucial given privacy issues and user preferences. The emergence of Shor's algorithm in 1994 and recent advancements in quantum computing have posed a threat to the security of classical AKA schemes relying on integer factorization, discrete logarithm, and other number theory problems. Consequently, researchers have turned their attention to developing quantum-resistant AKA schemes. In this context, Rana and Mishra introduced a lattice-based key agreement protocol under ring-LWE problem for IoT-enabled smart devices. However, a thorough security assessment uncovered vulnerabilities in their protocol, specifically susceptibility to replay and Key Compromise Impersonation (KCI) attacks. Furthermore, their approach reveals potential weaknesses in user impersonation if the user's identity is compromised.
The authenticated key agreement is one of the major security services that can be used to secure an Internet of Things (IoT) environment, where the devices collect the data and the data is then aggregated at the cloud server, and then a user needs to access the data stored at the server(s) securely. For this purpose, after a mutual authentication performed between a user and the accessed server, a session key needs to be established among them for secure communication. In this article, we design an efficient lattice-based authenticated key exchange protocol using ring-based version of learning with errors assumption for the IoT-enabled smart devices. The proposed protocol is basically a key exchange that uses the reconciliation mechanism. The detailed security analysis under the standard model has been performed along with the informal security analysis to show that the proposed protocol is robust against different attacks. We then simulate the proposed protocol under the NS-3 simulator to measure the network performance parameters like network throughput and latency. A comparative analysis shows that the proposed protocol has superior security, less computational cost, and comparable communication cost when compered these parameters with the other competing schemes.
Abstract The authenticated key agreement (AKA) method used in the Internet of Things (IoT) provides identity authentication and agreed symmetric keys to encrypt large amounts of communication messages for devices and servers. With the development of the quantum computing techniques and corresponding algroithms, classical authenticated key agreement methods based on public key, such as RSA and ECC become vulnerable. Many scholars have proposed lattice-based authenticated key agreement schemes to achieve post-quantum security and address this issue. However, these scheme's security models (such as BR, CK, and ROR) only can capture limited types of adversary attacks and require many communication rounds. To this end, we propose a lower communication rounds lattice-based anonymous authenticated key agreement (LA-AKA) protocol under the seCK model, which can capture a wider range of adversary attacks. The LA-AKA scheme utilizes an identity-based public key system for key agreement, and this system avoids complex resource consumption caused by certificate verification. During the identity authentication and key agreement phase, the communication entities do not need to transmit static public keys; they only need to engage in two communication rounds to generate the session key. Furthermore, the LA-AKA scheme can resist signal leakage attacks caused by key reuse in the ring learning with errors (RLWE) security assumption. The LA-AKA scheme provides higher security, as security analysis proves. The performance evaluation shows that as the number of devices and servers in the system increases, the computational advantage of the LA-AKA scheme in the broadcast channel becomes more significant.
In recent years, the Internet of things (IoT) has become an encouraging communication paradigm that has numerous applications including smart city, smart home and intelligent transportation system. The information sensed by several IoT smart devices can be security stored at the (cloud) servers. An external user, being a client, can access the services from a server for the sensing information, provided that a mutual authentication happens among them. Using the established session key among the user and the server, encrypted information with the help of session key can be delivered to the user by the server securely. Recently, Rana et al. proposed a smart-card based remote user authentication scheme using user password. In this comment paper, we carefully analyzed the scheme of Rana et al. and tracked down that their scheme is insecure against serious attacks, including stolen smart card attack, privileged-insider attack, user impersonation attack, password change attack and Ephemeral Secret Leakage (ESL) attack. Furthermore, their scheme does not preserve untraceability feature. To remedy these security pitfalls, we also provide some remedies that can help in building more secure and effective user authentication scheme to apply in securing next generation IoT infrastructure.
In recent years, the Internet of Things (IoT) has gained immense popularity in various aspects of work, learning, and daily life. Within the IoT realm, there is a growing concern regarding communication security issues between users and servers. However, addressing the communication security between servers is equally imperative, which has not received as much attention. To this end, we propose a certificateless anonymous authenticated key agreement (AKA) algorithm based on learning with errors (LWEs) and inhomogeneous small integer solution (ISIS) security assumptions. Our scheme provides strong resistance to quantum attacks and protects the privacy of communication servers. It also has constant communication costs and lower computational requirements than existing lattice-based anonymous AKA algorithms on the broadcast channel. Additionally, the proposed scheme eliminates the resource consumption of managing complex certificates and addresses the security risks associated with key escrow in the key generation center (KGC). Through security and performance analysis, we demonstrate that our approach can enhance the security of IoT-based healthcare systems while significantly improving communication efficiency. Our proposed scheme provides a promising solution to security issues related to server communication in IoT systems.
Enhancement in Wireless sensing technology had widened its application scope and deployment possibilities. Since 2004, Wireless Sensor Network(WSN) became one of the top interesting topics for the researchers due to its advantages and futuristic aspects. After the emergence of the Internet of Things(IoT), WSN became an integral part of IoT. IoT is the technology which aims to provide any service to anyone at any time with the improved quality of service. IoT invites many entities to communicate in its large scale application and allow entities to share collected information in either wired or wireless manner. After studying most of the literature, we found out that most communication in IoT scenario occurred over public channel rather than secured channels and this aspect approached many researchers to focus on the security part of IoT communication. Billions of devices/humans do the communication with each other as well as provide the critical data to each other on public channels so it becomes important for the communicating parties to validate each other as well as generate a communication secret for sharing a secret or critical information. Since 2009, many authors had focused on Remote User Authentication(RUA) for Wireless Sensor Network. In this paper, we have reviewed the RUA scheme provided by Chen et al. [1] and listed out some shortcoming of their scheme. Authors have made use of famous light weight and secured cryptographic approach called as Elliptic Curve Cryptography(ECC) for their protocol design but due to adversary capabilities, we have found their there scheme is not secured against node capturing attack and gateway node bypassing attack. We have also discussed the network model followed by authors in their paper which may help other researchers to study and apply in their RUA protocol design. This activity would help other protocol designers to improve their approaches in the field of RUA protocol designing for IoT environment.