Almost all IoT applications require secure user authentication protocols. Due to the limitations of most IoT devices and the possibility of physical attacks, lightweight authentication protocols based on Physical Unclonable Functions (PUF) are widely used. To design an efficient scheme, it is helpful to learn weaknesses of existing protocols and provide guidelines for future protocol designers. In this letter, using a formal framework, we discuss the vulnerabilities of a recent PUF-based protocol proposed by Gope et al. We prove our claims concerning protocol vulnerabilities in this framework according to propositional logic. Moreover, we suggest countermeasures for improving the protocol’s security.
Almost all IoT applications require secure user authentication protocols. Due to the limitations of most IoT devices and the possibility of physical attacks, lightweight authentication protocols based on Physical Unclonable Functions (PUF) are widely used. To design an efficient scheme, it is helpful to learn weaknesses of existing protocols and provide guidelines for future protocol designers. In this letter, using a formal framework, we discuss the vulnerabilities of a recent PUF-based protocol proposed by Gope et al. We prove our claims concerning protocol vulnerabilities in this framework according to propositional logic. Moreover, we suggest countermeasures for improving the protocol’s security.
As the core subject of IoT applications, IoT devices have faced numerous security challenges. Especially for IoT devices deployed in remote or harsh environments, they are often unattended for long periods, making it difficult to share the sensing data and susceptible to potential physical attacks. While aerial assistance methods represented by unmanned aerial vehicles (UAVs) can solve the problem of data sharing at a low cost, it is necessary to establish a secure channel between ground control stations, UAVs, and IoT devices due to the sensitivity of the sensing data. Recently, Physical Unclonable Function (PUF) has been proven to provide unique identity identification for devices using its tamper-proof feature. In this paper, we propose a lightweight UAV-assisted authentication and key agreement protocol for unattended IoT devices, ensuring secure communication and physical tamper-proof requirements. However, our work does not stop there. We noticed that some existing PUF-based authentication schemes misunderstand the ability of PUF, which leads to these schemes cannot actually provide physical protection. We analyzed the security vulnerabilities of these schemes and proposed rules that should be followed when designing authentication protocols using PUF. In addition, for the first time, we put forward the formal definitions and proof methods for PUF in the formal proof of the security protocol, which avoided the unreasonable initial assumptions adopted in the proof of the existing schemes. We extended Mao-Boyd (MB) logic and comprehensively analyzed the proposed protocol. We also evaluate the performance of the proposed scheme, and the results show that the proposed scheme has certain advantages in communication and computation overhead compared with existing schemes.
The advent of Internet of Things (IoT) ushers in a significant potential to integrate individuals, devices, and data, leading to a profound change in our professional and social environments. The small, resource-constrained IoT devices are usually deployed to collect various types of critical data in remote or unmonitored locations. Due to extensive interconnectivity, limited resources, and inadequate security design, IoT systems are vulnerable to communication-specific cyber threats, which aim to disrupt operations, steal sensitive information, or cause damage. To resolve the security concerns in IoT communications, many recent efforts have been devoted to designing authenticated key agreement protocols for IoT systems. However, not only most of the existing solutions fail to adopt cost-effective techniques for resource-limited IoT devices, but also they ignore the differentiation among various data types in the established session keys. A few approaches use traditional physical unclonable functions (PUFs) to address resource concerns, yet they introduce new security issues into IoT systems. Once the PUF cryptographic information is compromised by machine learning attacks, the entire authentication framework collapses. Therefore, in this paper we propose an authenticated key agreement protocol for device-to-gateway communication in IoT systems based on Chebyshev polynomial and probability-based PUF. We examine the proposed protocol’s security features through formal security validation. We also conduct performance evaluation through a simulation-oriented study, and the results clearly prove that the proposed protocol offers superior security and privacy, while maintaining low computational overhead.
Ensuring data security in Internet of Things (IoT) networks is a major challenge due to the limited computational resources and energy constraints of these devices. Physical unclonable functions (PUFs) are hardware-based security tools that can provide unique identification for lightweight devices, making PUFs ideal for IoT applications. While PUFs have traditionally been used for authentication, in this paper, we propose a novel PUF protocol that can provide data integrity. Maintaining data integrity is crucial in many applications, including finance, healthcare, and energy. The proposed integrity based-PUF protocol is especially suitable for power constraint devices as it offers low computational overhead, execution time, and efficient communication overhead. In addition, we introduce a threat model called Physically Active Attack (PAA), a security requirement called Integrity Preserving (IP), to provide a comprehensive range of attacks and security goals specific to the context of our protocol. We then formally prove that our protocol preserves IP under PAA. We show that our proposed protocol is resistant to various attacks, including replay attacks, Man-in-the-middle attacks (MITM), cloning, brute force attacks, and physical attacks.
The Internet of Things (IoT) has ushered in significant advancements in networked technologies, yet it simultaneously raises concerns about the security and privacy of connected devices. Traditional authentication methods based on cryptographic protocols are increasingly vulnerable to attacks as the number of devices grows and attackers develop more sophisticated strategies. In this paper, we propose a novel quantum-based authentication method using Quantum Physical Unclonable Functions (QPUFs) to address the security challenges in IoT devices. Quantum PUFs exploit the inherent quantum properties of devices to generate unique, unclonable responses to challenges, providing a high level of security and resilience against attacks such as cloning, spoofing, and interception. We present the architecture of the proposed quantum authentication system, discuss the challenge-response protocol, and evaluate the system’s performance. Experimental results show that this approach offers strong security guarantees with minimal computational overhead. We Evaluate the Security, Scalability of our approach in simulated adverse IoT environment.
Recently, Roy et al. proposed a physically unclonable function (PUF)-based authentication and key exchange protocol for Internet of Things (IoT) devices. The PUF protocol is efficient, because it integrates both the Node-to-Node (N2N) authentication and the Node-to-Server (N2S) authentication into a standalone protocol. In this paper, we therefore examine the security of the PUF protocol under the assumption of an insider attack. Our cryptanalysis findings are the following. (1) A legitimate but malicious IoT node can monitor the secure communication among the server and any other IoT nodes in both N2N authentication and N2S authentication. (2) A legitimate but malicious IoT node is able to impersonate a target IoT node to cheat the server and any other IoT nodes in N2N authentication and the server in N2S authentication, respectively. (3) A legitimate but malicious IoT node can masquerade as the server to cheat any other target IoT nodes in both N2N authentication and N2S authentication. To the best of our knowledge, our work gives the first non-trivial concrete security analysis for the PUF protocol. In addition, we employ the automatic verification tool of security protocols, i.e., Scyther, to confirm the weaknesses found in the PUF protocol. We finally consider how to prevent weaknesses in the PUF protocol.
Recently, Zerrouki et al. proposed a Physically Unclonable Function (PUF) mutual authentication and session key establishment protocol for IoT (Internet of Things) devices. Zerrouki et al.’s PUF protocol is interesting because it does not require the storage of any sensitive information on the local memory of the IoT device, which avoids many potential attacks, especially side-channel attacks. Therefore, we carefully investigate the security of Zerrouki et al.’s PUF protocol under the leakage assumption of the session key. Our findings are in the following. First, Zerrouki et al.’s PUF protocol fails to provide known-key security. That is, the adversary can impersonate not only the server to cheat the IoT device but also the IoT device to cheat the server when the adversary corrupts a session key between the server and the IoT device. Second, Zerrouki et al.’s PUF protocol suffers from the key-compromise impersonation attack. It means that the adversary can impersonate the IoT device to cheat the server if the adversary discloses the server’s secret key. Third, Zerrouki et al.’s PUF protocol does not support backward secrecy for the session key. That is, the adversary is always able to derive the session key from the previous session key. We also suggest the root cause of these security flaws in Zerrouki et al.’s PUF protocol. As a case study, our cryptanalysis results would promote a security model for more robust and efficient PUF authentication and session key establishment protocol. Moreover, our idea of the key compromise can be used to evaluate other novel PUF protocol designs.