The internet of things offers a rich set of options and applications in different fields, such as smart home, agriculture, security, transportation, and health issues. The IoT aims at organizing the interactions between items that are both sensors and actuators, known as objects. These objects acquire new applications in our lives that facilitate the remote control of smart devices via the open channel. However, this makes the sensitive transmitted data easily reachable and vulnerable to many attacks. With this in mind, security and privacy become an essential requirement that precedes the deployment of any IoT network. In this paper, the authors provide an IoT authentication and key agreement scheme using ECC and a fuzzy extractor and then they use BAN logic model and AVISPA tool to demonstrate the security of the scheme. They show that the proposed scheme is resistant to various attacks. Furthermore, the security analysis of the proposed scheme and its comparison with some other related works have shown that the proposed scheme is both more efficient and more secure than the other ones.
The internet of things offers a rich set of options and applications in different fields, such as smart home, agriculture, security, transportation, and health issues. The IoT aims at organizing the interactions between items that are both sensors and actuators, known as objects. These objects acquire new applications in our lives that facilitate the remote control of smart devices via the open channel. However, this makes the sensitive transmitted data easily reachable and vulnerable to many attacks. With this in mind, security and privacy become an essential requirement that precedes the deployment of any IoT network. In this paper, the authors provide an IoT authentication and key agreement scheme using ECC and a fuzzy extractor and then they use BAN logic model and AVISPA tool to demonstrate the security of the scheme. They show that the proposed scheme is resistant to various attacks. Furthermore, the security analysis of the proposed scheme and its comparison with some other related works have shown that the proposed scheme is both more efficient and more secure than the other ones.
The proliferation of the Internet of Things (IoT) has worsened the challenge of maintaining data and user privacy. IoT end devices, often deployed in unsupervised environments and connected to open networks, are susceptible to physical tampering and various other security attacks. Thus, robust, efficient authentication and key agreement (AKA) protocols are essential to protect data privacy during exchanges between end devices and servers. The previous work in "Provably Secure ECC-Based Anonymous Authentication and Key Agreement for IoT" proposed a novel AKA scheme for secure IoT environments. They claimed their protocol offers comprehensive security features, guarding against numerous potential flaws while achieving session key security. However, this paper demonstrates through logical and mathematical analyses that the previous work is vulnerable to various attacks. We conducted a security analysis using the extended Canetti and Krawczyk (eCK) model, which is widely employed in security evaluations. This model considers scenarios where an attacker has complete control over the network, including the ability to intercept, modify, and delete messages, while also accounting for the potential exposure of ephemeral private keys. Furthermore, we show that their scheme fails to meet critical security requirements and relies on flawed security assumptions. We prove our findings using the automated validation of internet security protocols and applications, a widely recognized formal verification tool. To strengthen attack resilience, we propose several recommendations for the advancement of more robust and efficient AKA protocols specifically designed for IoT environments.
With the rise of the Internet of Things (IoT), maintaining data confidentiality and protecting user privacy have become increasingly challenging. End devices in the IoT are often deployed in unattended environments and connected to open networks, making them vulnerable to physical tampering and other security attacks. Different authentication key agreement (AKA) schemes have been used in practice; several of them do not cover the necessary security features or are incompatible with resource-constrained end devices. Their security proofs have been performed under the Random-Oracle model. We present an AKA protocol for end devices and servers. The proposal leverages the ECC-based key exchange mechanism and one-way hash function-based message authentication method to achieve mutual authentication, user anonymity, and forward security. A formal security proof of the proposed scheme is performed under the standard model and the eCK model with the elliptic curve encryption computational assumptions, and formal verification is performed with ProVerif. According to the performance comparison, it is revealed that the proposed scheme offers user anonymity, perfect forward security, and mutual authentication, and resists typical attacks such as ephemeral secret leakage attacks, impersonation attacks, man-in-the-middle attacks, and key compromise impersonation attacks. Moreover, the proposed scheme has the lowest computational and communication overhead compared to existing schemes.
Enhancement in Wireless sensing technology had widened its application scope and deployment possibilities. Since 2004, Wireless Sensor Network(WSN) became one of the top interesting topics for the researchers due to its advantages and futuristic aspects. After the emergence of the Internet of Things(IoT), WSN became an integral part of IoT. IoT is the technology which aims to provide any service to anyone at any time with the improved quality of service. IoT invites many entities to communicate in its large scale application and allow entities to share collected information in either wired or wireless manner. After studying most of the literature, we found out that most communication in IoT scenario occurred over public channel rather than secured channels and this aspect approached many researchers to focus on the security part of IoT communication. Billions of devices/humans do the communication with each other as well as provide the critical data to each other on public channels so it becomes important for the communicating parties to validate each other as well as generate a communication secret for sharing a secret or critical information. Since 2009, many authors had focused on Remote User Authentication(RUA) for Wireless Sensor Network. In this paper, we have reviewed the RUA scheme provided by Chen et al. [1] and listed out some shortcoming of their scheme. Authors have made use of famous light weight and secured cryptographic approach called as Elliptic Curve Cryptography(ECC) for their protocol design but due to adversary capabilities, we have found their there scheme is not secured against node capturing attack and gateway node bypassing attack. We have also discussed the network model followed by authors in their paper which may help other researchers to study and apply in their RUA protocol design. This activity would help other protocol designers to improve their approaches in the field of RUA protocol designing for IoT environment.
The rapid proliferation of the Internet of Things (IoT) has connected billions of devices that continuously exchange sensitive data over public wireless channels, making secure authentication a critical requirement. However, most IoT end devices are severely resource-constrained, which renders conventional public-key infrastructures based on RSA, bilinear pairings, or digital certificates impractical. Although many authentication and key agreement schemes have been proposed, recent cryptanalytic studies show that they often either omit essential security properties such as perfect forward secrecy or resistance to ephemeral secret leakage or incur overhead that is unacceptable for low-power nodes. To address this gap, this paper proposes a lightweight Elliptic Curve Cryptography (ECC)-based authentication and key agreement protocol for a three-tier IoT architecture consisting of a user, a semi-trusted gateway server, and an IoT sensor. The protocol relies solely on elliptic-curve scalar multiplication, one-way hash functions, and bitwise XOR operations, avoiding bilinear pairings and certificate management. It achieves mutual authentication among all three parties through timestamped, hash-based authenticators and establishes a contributory session-key derived from fresh ephemeral keys, ensuring perfect forward secrecy. The security of the protocol is established through a detailed informal analysis, demonstrating resistance to major attacks, and is formally verified using the AVISPA tool, where both the OFMC and CL-AtSe back-ends report the protocol as SAFE under the Dolev–Yao adversary model. A comparative performance evaluation against several recent ECC-based authentication schemes shows that the proposed protocol maintains low cost requirements suitable for constrained IoT devices, and resulting in a communication overhead of 1828 bits, which is competitive with most recent ECC-based schemes evaluated, and imposing a minimal storage burden on end devices. The results demonstrate that the proposed protocol achieves a favorable balance between security and efficiency, making it well suited to resource-constrained IoT environments.
To improve the quality of service and reduce the possibility of security attacks, a secure and efficient user authentication mechanism is required for Wireless Sensor Networks (WSNs) and the Internet of Things (IoT). Session key establishment between the sensor node and the user is also required for secure communication. In this paper, we perform the security analysis of A.K.Das’s user authentication scheme (given in 2015), Choi et al.’s scheme (given in 2016), and Park et al.’s scheme (given in 2016). The security analysis shows that their schemes are vulnerable to various attacks like user impersonation attack, sensor node impersonation attack and attacks based on legitimate users. Based on the cryptanalysis of these existing protocols, we propose a secure and efficient authenticated session key establishment protocol which ensures various security features and overcomes the drawbacks of existing protocols. The formal and informal security analysis indicates that the proposed protocol withstands the various security vulnerabilities involved in WSNs. The automated validation using AVISPA and Scyther tool ensures the absence of security attacks in our scheme. The logical verification using the Burrows-Abadi-Needham (BAN) logic confirms the correctness of the proposed protocol. Finally, the comparative analysis based on computational overhead and security features of other existing protocol indicate that the proposed user authentication system is secure and efficient. In future, we intend to implement the proposed protocol in real-world applications of WSNs and IoT.
Summary Because of the exponential growth of Internet of Things (IoT), several services are being developed. These services can be accessed through smart gadgets by the user at any place, every time and anywhere. This makes security and privacy central to IoT environments. In this paper, we propose a lightweight, robust, and multi‐factor remote user authentication and key agreement scheme for IoT environments. Using this protocol, any authorized user can access and gather real‐time sensor data from the IoT nodes. Before gaining access to any IoT node, the user must first get authenticated by the gateway node as well as the IoT node. The proposed protocol is based on XOR and hash operations, and includes: (i) a3‐factorauthentication (ie, password, biometrics, and smart device); (ii)mutual authentication; (iii)shared session key; and (iv)key freshness. It satisfies desirable security attributes and maintains acceptable efficiency in terms of the computational overheads for resource constrained IoT environment. Further, the informal and formal security analysis using AVISPA proves security strength of the protocol and its robustness against all possible security threats. Simulation results also prove that the scheme is secure against attacks.