The Internet of Things (IoT) consists of a range of devices that communicate with other devices that are surrounding them. Secure communications between IoT devices have been an essential requirement. However, most existing authentication protocols fail to provide privacy protection for devices such that sensitive information including device owner’s identity and device type can be leaked. In this paper, based on attribute-based encryption (ABE), we propose two private and mutual authentication protocols to protect the privacy of IoT devices. The first protocol is a three-message key exchange protocol, following the public-key encryption mode of the Internet Key Exchange (IKE). The second protocol is a one-round key exchange protocol, thereby providing simplicity and efficiency of messages communicated between the participants. Both of our protocols can be proved secure in the defined model. Finally, we implement the two protocols in an open source framework.
The Internet of Things (IoT) consists of a range of devices that communicate with other devices that are surrounding them. Secure communications between IoT devices have been an essential requirement. However, most existing authentication protocols fail to provide privacy protection for devices such that sensitive information including device owner’s identity and device type can be leaked. In this paper, based on attribute-based encryption (ABE), we propose two private and mutual authentication protocols to protect the privacy of IoT devices. The first protocol is a three-message key exchange protocol, following the public-key encryption mode of the Internet Key Exchange (IKE). The second protocol is a one-round key exchange protocol, thereby providing simplicity and efficiency of messages communicated between the participants. Both of our protocols can be proved secure in the defined model. Finally, we implement the two protocols in an open source framework.
By utilizing the sensing and perception capabilities of various devices, the Internet of Things (IoT) enables more precise awareness of the real world, thereby enhancing management and resource utilization efficiency. However, due to their open deployment environments and frequent message exchanges, IoT endpoints are highly vulnerable to a wide range of security threats and privacy breaches, including forgery, data theft, and information leakage. Therefore, to address these challenges and ensure device legitimacy verification and secure data exchange among IoT devices, we propose a privacy-preserving and traceable certificateless anonymous mutual authentication scheme (PPT-CLAMA). PPT-CLAMA not only eliminates the need for a secure channel during key generation but also prevents attackers from tracing the real identity of devices through their own identity or public keys while providing pseudonym and anonymous authentication to devices, demonstrating greater practicality. Furthermore, through security proofs and analysis, PPT-CLAMA satisfies various high-level security properties, including mutual authentication, key agreement, nonrepudiation, unlinkability, perfect forward secrecy, known session-specific temporary information security, traceability, anonymity, and privacy preservation. The simulation results indicate that, compared to authentication and key agreement schemes, PPT-CLAMA reduces the average computational overhead and average communication overhead during the authentication process by 6.73% and 3.31%, respectively, demonstrating higher computational and communication efficiency.
Device authentication and key exchange are essential issues for Internet of Things (IoT) which plays an indispensable role in modern life. Many sensor devices in IoT, with limited resources and poor self-protection capabilities, are deployed in the unattended and open places, making them vulnerable to physical attacks while facing traditional security threats. Despite several researches have been conducted by using the physical unclonable function (PUF) to immune the communication between IoT devices from the security threats above, as per the knowledge of the authors, current solutions rely on the participation of the server to distribute the key parameters, which requires high message overhead and markedly influences the efficiency. To fill this gap, this article proposes an end-to-end mutual authentication and key exchange protocol for IoT by combining PUF with certificateless public key cryptography (CL-PKC) on elliptic curve, which only needs “three handshakes” without the real-time participation of the server. The security analysis shows that the proposed protocol can not only secure the IoT devices from various attacks, but also provide perfect forward secrecy. Moreover, the experimental validation and performance analysis show the proposed protocol outperforms existing related protocols in terms of security features, protocol rounds and communication cost.
With the rise of the Internet of Things (IoT), maintaining data confidentiality and protecting user privacy have become increasingly challenging. End devices in the IoT are often deployed in unattended environments and connected to open networks, making them vulnerable to physical tampering and other security attacks. Different authentication key agreement (AKA) schemes have been used in practice; several of them do not cover the necessary security features or are incompatible with resource-constrained end devices. Their security proofs have been performed under the Random-Oracle model. We present an AKA protocol for end devices and servers. The proposal leverages the ECC-based key exchange mechanism and one-way hash function-based message authentication method to achieve mutual authentication, user anonymity, and forward security. A formal security proof of the proposed scheme is performed under the standard model and the eCK model with the elliptic curve encryption computational assumptions, and formal verification is performed with ProVerif. According to the performance comparison, it is revealed that the proposed scheme offers user anonymity, perfect forward security, and mutual authentication, and resists typical attacks such as ephemeral secret leakage attacks, impersonation attacks, man-in-the-middle attacks, and key compromise impersonation attacks. Moreover, the proposed scheme has the lowest computational and communication overhead compared to existing schemes.
In the Internet of Things (IoT) environment, more types of devices than ever before are connected to the internet to provide IoT services. Smart devices are becoming more intelligent and improving performance, but there are devices with little computing power and low storage capacity. Devices with limited resources will have difficulty applying existing public key cryptography systems to provide security. Therefore, communication protocols for various kinds of participating devices should be applicable in the IoT environment, and these protocols should be lightened for resources-restricted devices. Security is an essential element in the IoT environment, so for secure communication, it is necessary to perform authentication between the communication objects and to generate the session key. In this paper, we propose two kinds of lightweight authentication and key agreement schemes to enable fast and secure authentication among the objects participating in the IoT environment. The first scheme is an authentication and key agreement scheme with limited resource devices that can use the elliptic curve Qu-Vanstone (ECQV) implicit certificate to quickly agree on the session key. The second scheme is also an authentication and key agreement scheme that can be used more securely, but slower than first scheme using certificateless public key cryptography (CL-PKC). In addition, we compare and analyze existing schemes and propose new schemes to improve security requirements that were not satisfactory.
Abstract Internet of Things (IoT) is a developing technology in our time that is prone to security problems as it uses wireless and shared networks. A challenging scenario in IoT environments is Device-to-Device (D2D) communication that an authentication server as a trusted third-party, does not involve in the authentication and key agreement process. It is only involved in the process of allocating long-term secret keys and their update. A lot of authentication protocols have been suggested for such situations. This article demonstrated that three state-of-the-art related protocols failed to remain anonymous, insecure against key compromise impersonation (KCI) attack, and clogging attack. To counter the pitfalls of them, a new D2D mutual authentication and key agreement protocol is designed here. The proposed protocol is anonymous, untraceable, and highly secure. Moreover, there is no need for a secure channel to generate a pair of private and public keys in the registration phase.) Formal security proof and security analysis using BAN logic, Real-Or-Random (ROR) model, and Scyther tool showed that our proposed protocol satisfied security requirements. Furthermore, communication cost, computation cost, and energy consumption comparisons denoted our schema has better performance, compared to other protocols.
Device to device (D2D) communication is a peer-to-peer communication mechanism between devices without intermediate nodes. In view of the different application scenarios, the security requirements of D2D communication are also very different. Nevertheless, most secure D2D communications emphasize the importance of device privacy protection and efficiency. D2D communication is a challenging task of the Internet of Things (IoT) scenarios and designing an efficient and anonymous authentication scheme for the IoT D2D authentication is crucial to the application of the IoT. At this stage, although D2D communication in the IoT scenario has received widespread attention, some existing schemes cannot meet the requirements of efficiency and privacy protection. In view of this, a secure and efficient D2D anonymous authentication key agreement scheme is proposed based on identity-based cryptography. To illustrate the security of the scheme, we show the informal security analysis and the formal verification by the analysis tool Tamarin. The verification results show that the scheme is secure.