The Internet of Things (IoT), as a new type of communication network, is involved in developing and applying secure transmission and storing a large amount of sensitive information. Due to the IoT devices' constrained resources, high connection costs, sluggish transmission speeds, and the inapplicability of security fundamentals like public key methods and digital signatures for simple device authentication, this paper presents a lightweight anonymous key-sharing authentication protocol for IoT devices. The protocol utilizes the tamper-resistant and anti-cloning properties of Hardware Physical Unclonable Functions (PUFs) to generate shared keys. In addition, it incorporates security primitives such as the MASK algorithm and Hash functions. The security analysis and verification using Ban logic and the proper tool ProVerif demonstrate that the protocol can defend against attacks such as man-in-the-middle, de-synchronization, impersonation, and modeling attacks. Compared with other protocols, this protocol exhibits the characteristics of low computational cost, minimal communication overhead and storage capacity, and high-security performance, making it suitable for secure communication and transmission in resource-constrained devices.
The Internet of Things (IoT), as a new type of communication network, is involved in developing and applying secure transmission and storing a large amount of sensitive information. Due to the IoT devices' constrained resources, high connection costs, sluggish transmission speeds, and the inapplicability of security fundamentals like public key methods and digital signatures for simple device authentication, this paper presents a lightweight anonymous key-sharing authentication protocol for IoT devices. The protocol utilizes the tamper-resistant and anti-cloning properties of Hardware Physical Unclonable Functions (PUFs) to generate shared keys. In addition, it incorporates security primitives such as the MASK algorithm and Hash functions. The security analysis and verification using Ban logic and the proper tool ProVerif demonstrate that the protocol can defend against attacks such as man-in-the-middle, de-synchronization, impersonation, and modeling attacks. Compared with other protocols, this protocol exhibits the characteristics of low computational cost, minimal communication overhead and storage capacity, and high-security performance, making it suitable for secure communication and transmission in resource-constrained devices.
The remarkable growth of the Internet of Things (IoT) has paved the way for the interconnection of a wide variety of mobile devices. To protect data confidentiality and user privacy in public networks, most key sharing and management protocols have gained wide attention. Due to the limited resources of IoT devices, relevant security primitives with high communication overhead and slow transmission rates are not suitable for the authentication of lightweight devices. To solve these problems, physical unclonable function (PUF) is lightweight security primitive that exploits the frequency difference during the chip fabrication process for the key generation or device authentication. In this paper, we flexibly configure the oscillation period of the reconfigurable HCRO-PUF to generate a shared key on the hardware side, which solve related security problems such as device cloning and key tampering. Furthermore, we propose a lightweight key sharing and management (LKSM) protocol based on HCRO-PUF for various devices and multi-server architectures. We prove that the proposed protocol satisfies the corresponding security and resistance properties through Ban logic. Compared with existing relevant protocols, security analysis and simulation results show that our protocol defends against multiple attacks. The low computational and communication costs indicate that our protocol is suitable for resource-constrained IoT devices.
With the rapid development of quantum computing, in response to its disruptive threats to traditional cryptosystems and the urgent demand for lightweight and highly scalable secure group communication among resource-constrained devices in large-scale Internet of Things (IoT) scenarios, this paper proposes a lightweight anonymous group authentication scheme that integrates Physical Unclonable Functions (PUFs), distributed Gossip algorithms, and quantum key distribution. By exploiting the uniqueness and unclonability derived from the inherent physical characteristics of PUF hardware, the scheme fundamentally eliminates attack vectors against quantum computers without requiring devices to pre-store any secret keys in their memory, while the QKCS pre-provisions CRPs and key seeds, which is the standard enrollment procedure in PUF-based systems. Combined with information-theoretically secure quantum keys as session keys, it forms a dual protection mechanism: anti-forgery at the physical layer and anti-quantum attack at the cryptographic layer. Innovatively, the Gossip algorithm is deeply integrated with group key agreement, converting global broadcast into local iterative interactions between nodes, which effectively alleviates broadcast storms and improves the scalability and fault tolerance of the protocol. Meanwhile, a pseudonym mechanism is introduced to achieve anonymous identity protection, and a dynamic key update strategy guarantees forward and backward security when members join or leave the group. Formal verification based on BAN logic and security analysis show that the proposed protocol can resist typical attacks such as replay attacks, man-in-the-middle attacks, and impersonation attacks. Performance evaluations demonstrate that our scheme outperforms existing comparable schemes in terms of computational cost, communication overhead, and dynamic group management efficiency, demonstrating its potential for resource-constrained IoT environments, pending further validation on real hardware platforms.
Securing applications that gather and transfer confidential information has become a critical challenge in the rapidly evolving Internet of Things (IoT) landscape. Such data’s authenticity, integrity, and confidentiality must be guaranteed while reducing security functions’ computation and communication overhead to accommodate the numerous constrained devices involved. Group authentication and key management are essential aspects of IoT security, but existing protocols often need to be more computationally expensive for IoT applications and must take care of anonymization. Consequently, IoT devices may be open to potential cyber-attacks due to the use of simple security primitives. Physically Unclonable Function (PUF) can enable in lightweight approach to authentication and key distribution among group members. The factorial tree and Chinese Remainder Theorem (CRT) can minimize communication messages required to renew the keys. This paper presents a novel protocol, Anonymized Lightweight PUF-based group Authentication with Key distribution (ALPAK) for IoT Devices, which improves the PUF-Based Lightweight Group Authentication and Key Distribution Protocol (PLGAKD) to enhance the anonymity of IoT devices. The paper further presents the formal verification of the ALPAK scheme with the Scyther tool and detailed security analysis.
With the rise of the Internet of Things (IoT), maintaining data confidentiality and protecting user privacy have become increasingly challenging. End devices in the IoT are often deployed in unattended environments and connected to open networks, making them vulnerable to physical tampering and other security attacks. Different authentication key agreement (AKA) schemes have been used in practice; several of them do not cover the necessary security features or are incompatible with resource-constrained end devices. Their security proofs have been performed under the Random-Oracle model. We present an AKA protocol for end devices and servers. The proposal leverages the ECC-based key exchange mechanism and one-way hash function-based message authentication method to achieve mutual authentication, user anonymity, and forward security. A formal security proof of the proposed scheme is performed under the standard model and the eCK model with the elliptic curve encryption computational assumptions, and formal verification is performed with ProVerif. According to the performance comparison, it is revealed that the proposed scheme offers user anonymity, perfect forward security, and mutual authentication, and resists typical attacks such as ephemeral secret leakage attacks, impersonation attacks, man-in-the-middle attacks, and key compromise impersonation attacks. Moreover, the proposed scheme has the lowest computational and communication overhead compared to existing schemes.
Abstract Internet of Things (IoT) is a developing technology in our time that is prone to security problems as it uses wireless and shared networks. A challenging scenario in IoT environments is Device-to-Device (D2D) communication that an authentication server as a trusted third-party, does not involve in the authentication and key agreement process. It is only involved in the process of allocating long-term secret keys and their update. A lot of authentication protocols have been suggested for such situations. This article demonstrated that three state-of-the-art related protocols failed to remain anonymous, insecure against key compromise impersonation (KCI) attack, and clogging attack. To counter the pitfalls of them, a new D2D mutual authentication and key agreement protocol is designed here. The proposed protocol is anonymous, untraceable, and highly secure. Moreover, there is no need for a secure channel to generate a pair of private and public keys in the registration phase.) Formal security proof and security analysis using BAN logic, Real-Or-Random (ROR) model, and Scyther tool showed that our proposed protocol satisfied security requirements. Furthermore, communication cost, computation cost, and energy consumption comparisons denoted our schema has better performance, compared to other protocols.
The Internet of Things (IoT) is being applied to various environments such as telecare systems, smart homes, and intelligent transportation systems. The information generated from IoT devices is stored at remote servers, and external users authenticate to the server for requesting access to the stored data. In IoT environments, the authentication process is required to be conducted efficiently, and should be secure against various attacks and ensure user anonymity and untraceability to ensure sustainability of the network. However, many existing protocols proposed in IoT environments do not meet these requirements. Recently, Rajaram et al. proposed a paring-based user authentication scheme. We found that the Rajaram et al. scheme is vulnerable to various attacks such as offline password guessing, impersonation, privileged insider, and known session-specific temporary information attacks. Additionally, as their scheme uses bilinear pairing, it requires high computation and communication costs. In this study, we propose a novel authentication scheme that resolves these security problems. The proposed scheme uses only hash and exclusive-or operations to be applicable in IoT environments. We analyze the proposed protocol using informal analysis and formal analysis methods such as the BAN logic, real-or-random (ROR) model, and the AVISPA simulation, and we show that the proposed protocol has better security and performance compared with existing authentication protocols. Consequently, the proposed protocol is sustainable and suitable for real IoT environments.