The Internet of Things (IoT) represents a dynamic infrastructure, leveraging sensing and network communication technology to establish ubiquitous connectivity among people, machines, and objects. Due to its end devices’ limited computing resources and storage space, it is not feasible to merely transpose traditional internet security technologies directly to IoT endpoints. Maintaining security while concurrently ensuring performance is a particularly challenging endeavor. This paper provides a review of key agreements and authentication protocols pivotal to the security of IoT. First, this survey discusses the applications that need authentication and key agreement to strengthen their security and current research on these application fields. Subsequently, this paper engages in an in-depth exploration of the phase involved in the scheme of authentication and key agreement, including an examination of the cryptographic techniques employed within these processes. This survey also thoroughly studies the scheme’s security services, potential attacks, formal analysis and informal analysis to ensure resilience against such threats. This study aims to provide a profound understanding of the recent research on authentication and key agreement in IoT applications. It strives to contribute towards strengthening security systems for IoT applications, ensuring their sustainability in the face of evolving threats.
The Internet of Things (IoT) represents a dynamic infrastructure, leveraging sensing and network communication technology to establish ubiquitous connectivity among people, machines, and objects. Due to its end devices’ limited computing resources and storage space, it is not feasible to merely transpose traditional internet security technologies directly to IoT endpoints. Maintaining security while concurrently ensuring performance is a particularly challenging endeavor. This paper provides a review of key agreements and authentication protocols pivotal to the security of IoT. First, this survey discusses the applications that need authentication and key agreement to strengthen their security and current research on these application fields. Subsequently, this paper engages in an in-depth exploration of the phase involved in the scheme of authentication and key agreement, including an examination of the cryptographic techniques employed within these processes. This survey also thoroughly studies the scheme’s security services, potential attacks, formal analysis and informal analysis to ensure resilience against such threats. This study aims to provide a profound understanding of the recent research on authentication and key agreement in IoT applications. It strives to contribute towards strengthening security systems for IoT applications, ensuring their sustainability in the face of evolving threats.
The rapid development of Internet of things (IoT) technology has made the IoT applicable in many areas of life and has contributed to the IoT’s improvement. IoT devices are equipped with various sensors that enable them to perform the tasks they were designed for. The use of such devices is associated with securing communication between devices and users. The key stages of communication are the processes of authentication and the process of agreeing on session keys because they are the basis of the subsequent communication phases. The specially designed security protocols are used to secure communication. These protocols define the course of communication and cryptographic techniques employed for securing. In this article, we have reviewed the latest communication protocols designed to secure authentication processes and agree on session keys in IoT environments. We analyzed the proposed protocols’ security level, vulnerability, and computational and communication costs. We showed our observations, describing the requirements that a secure protocol should meet.
The advent of Internet of Things (IoT) ushers in a significant potential to integrate individuals, devices, and data, leading to a profound change in our professional and social environments. The small, resource-constrained IoT devices are usually deployed to collect various types of critical data in remote or unmonitored locations. Due to extensive interconnectivity, limited resources, and inadequate security design, IoT systems are vulnerable to communication-specific cyber threats, which aim to disrupt operations, steal sensitive information, or cause damage. To resolve the security concerns in IoT communications, many recent efforts have been devoted to designing authenticated key agreement protocols for IoT systems. However, not only most of the existing solutions fail to adopt cost-effective techniques for resource-limited IoT devices, but also they ignore the differentiation among various data types in the established session keys. A few approaches use traditional physical unclonable functions (PUFs) to address resource concerns, yet they introduce new security issues into IoT systems. Once the PUF cryptographic information is compromised by machine learning attacks, the entire authentication framework collapses. Therefore, in this paper we propose an authenticated key agreement protocol for device-to-gateway communication in IoT systems based on Chebyshev polynomial and probability-based PUF. We examine the proposed protocol’s security features through formal security validation. We also conduct performance evaluation through a simulation-oriented study, and the results clearly prove that the proposed protocol offers superior security and privacy, while maintaining low computational overhead.
In the Internet of Things (IoT) environment, more types of devices than ever before are connected to the internet to provide IoT services. Smart devices are becoming more intelligent and improving performance, but there are devices with little computing power and low storage capacity. Devices with limited resources will have difficulty applying existing public key cryptography systems to provide security. Therefore, communication protocols for various kinds of participating devices should be applicable in the IoT environment, and these protocols should be lightened for resources-restricted devices. Security is an essential element in the IoT environment, so for secure communication, it is necessary to perform authentication between the communication objects and to generate the session key. In this paper, we propose two kinds of lightweight authentication and key agreement schemes to enable fast and secure authentication among the objects participating in the IoT environment. The first scheme is an authentication and key agreement scheme with limited resource devices that can use the elliptic curve Qu-Vanstone (ECQV) implicit certificate to quickly agree on the session key. The second scheme is also an authentication and key agreement scheme that can be used more securely, but slower than first scheme using certificateless public key cryptography (CL-PKC). In addition, we compare and analyze existing schemes and propose new schemes to improve security requirements that were not satisfactory.
The Internet of Things (IoT) is an enormous ubiquitous-network, which connects the objects through various sensors. The IoT technology promotes the interconnection and fusion between the physical world and information space, and it facilitates the day-to-day life of people. However, since a lot of equipped sensors are unattended and open, the IoT must face and overcome the main problems of security and privacy. Authentication is one of the paramount security concerns in the IoT environment, in which a user could directly access data from the sensors. Therefore, we propose an authentication and key agreement scheme providing unlinkability for the IoT environment based on bilinear pairings. The formal security proof demonstrates that the proposed protocol is unforgeable under the adaptively chosen message attack, and the session key exchange is semantic secure under the eCK model. In addition, the computation and communication costs of the proposed scheme are evaluated and compared with some existing similar schemes, which exhibits that it pleasantly addresses the needs of the IoT as far as security properties and computation expenses.
The Industrial Internet of Things (IIoT) refers to the expansion and application of the Internet of Things (IoT) in various industrial settings. Despite the numerous applications of the Industrial Internet of Things and its numerous advantages, the security of data exchanged in the Industrial Internet of Things remains one of the challenges facing this emerging technology. When this data is accessed and manipulated by attackers, the consequences may include disruptions to production processes, financial losses, and even threats to human life. Therefore, given the demand not only to protect information but also to ensure the health and safety of industries, the utmost attention should be paid to the security of data and entities involved in the Industrial Internet of Things. In this paper, an innovative protocol for authentication and key agreement between Industrial Internet of Things devices and cloud servers is proposed. This protocol is designed to deal with security threats and meet various security requirements. The Scyther tool has been used to evaluate the performance and security of the proposed scheme. The evaluation results demonstrate that the proposed protocol effectively maintains all security aspects and outperforms similar schemes in terms of efficiency.
The internet of things (IoT) and cloud computing are evolving technologies in the information technology field. Merging the pervasive IoT technology with cloud computing is an innovative solution for better analytics and decision-making. Deployed IoT devices offload different types of data to the cloud, while cloud computing converges the infrastructure, links up the servers, analyzes information obtained from the IoT devices, reinforces processing power, and offers huge storage capacity. However, this merging is prone to various cyber threats that affect the IoT-Cloud environment. Mutual authentication is considered as the forefront mechanism for cyber-attacks as the IoT-Cloud participants have to ensure the authenticity of each other and generate a session key for securing the exchanged traffic. While designing these mechanisms, the constrained nature of the IoT devices must be taken into consideration. We proposed a novel lightweight protocol (Light-AHAKA) for authenticating IoT-Cloud elements and establishing a key agreement for encrypting the exchanged sensitive data was proposed. In this paper, the formal verification of (Light-AHAKA) was presented to prove and verify the correctness of our proposed protocol to ensure that the protocol is free from design flaws before the deployment phase. The verification is performed based on two different approaches, the strand space model and the automated validation of internet security protocols and applications (AVISPA) tool.