IEEE Transactions on Dependable and Secure Computing

Privacy-Preserving and Traceable Certificateless Anonymous Mutual Authentication Scheme for IoT

Bei Gong, Yong Dong Wu, Akhtar A. Badshah, Muhammad Mohsin Waqas

Published Aug 11, 2025• 6 citations

Abstract

By utilizing the sensing and perception capabilities of various devices, the Internet of Things (IoT) enables more precise awareness of the real world, thereby enhancing management and resource utilization efficiency. However, due to their open deployment environments and frequent message exchanges, IoT endpoints are highly vulnerable to a wide range of security threats and privacy breaches, including forgery, data theft, and information leakage. Therefore, to address these challenges and ensure device legitimacy verification and secure data exchange among IoT devices, we propose a privacy-preserving and traceable certificateless anonymous mutual authentication scheme (PPT-CLAMA). PPT-CLAMA not only eliminates the need for a secure channel during key generation but also prevents attackers from tracing the real identity of devices through their own identity or public keys while providing pseudonym and anonymous authentication to devices, demonstrating greater practicality. Furthermore, through security proofs and analysis, PPT-CLAMA satisfies various high-level security properties, including mutual authentication, key agreement, nonrepudiation, unlinkability, perfect forward secrecy, known session-specific temporary information security, traceability, anonymity, and privacy preservation. The simulation results indicate that, compared to authentication and key agreement schemes, PPT-CLAMA reduces the average computational overhead and average communication overhead during the authentication process by 6.73% and 3.31%, respectively, demonstrating higher computational and communication efficiency.

DOI: 10.1109/tdsc.2025.3597949

Related papers

Provably Secure ECC-Based Anonymous Authentication and Key Agreement for IoT

Shunfang Hu, Shaoping Jiang, Qing Miao +3 more

With the rise of the Internet of Things (IoT), maintaining data confidentiality and protecting user privacy have become increasingly challenging. End devices in the IoT are often deployed in unattended environments and connected to open networks, making them vulnerable to physical tampering and other security attacks. Different authentication key agreement (AKA) schemes have been used in practice; several of them do not cover the necessary security features or are incompatible with resource-constrained end devices. Their security proofs have been performed under the Random-Oracle model. We present an AKA protocol for end devices and servers. The proposal leverages the ECC-based key exchange mechanism and one-way hash function-based message authentication method to achieve mutual authentication, user anonymity, and forward security. A formal security proof of the proposed scheme is performed under the standard model and the eCK model with the elliptic curve encryption computational assumptions, and formal verification is performed with ProVerif. According to the performance comparison, it is revealed that the proposed scheme offers user anonymity, perfect forward security, and mutual authentication, and resists typical attacks such as ephemeral secret leakage attacks, impersonation attacks, man-in-the-middle attacks, and key compromise impersonation attacks. Moreover, the proposed scheme has the lowest computational and communication overhead compared to existing schemes.

Applied SciencesApr 10, 202418 citations

Security Evaluation of Provably Secure ECC-Based Anonymous Authentication and Key Agreement Scheme for IoT

Kisung Park, Myeonghyun Kim, Youngho Park

The proliferation of the Internet of Things (IoT) has worsened the challenge of maintaining data and user privacy. IoT end devices, often deployed in unsupervised environments and connected to open networks, are susceptible to physical tampering and various other security attacks. Thus, robust, efficient authentication and key agreement (AKA) protocols are essential to protect data privacy during exchanges between end devices and servers. The previous work in "Provably Secure ECC-Based Anonymous Authentication and Key Agreement for IoT" proposed a novel AKA scheme for secure IoT environments. They claimed their protocol offers comprehensive security features, guarding against numerous potential flaws while achieving session key security. However, this paper demonstrates through logical and mathematical analyses that the previous work is vulnerable to various attacks. We conducted a security analysis using the extended Canetti and Krawczyk (eCK) model, which is widely employed in security evaluations. This model considers scenarios where an attacker has complete control over the network, including the ability to intercept, modify, and delete messages, while also accounting for the potential exposure of ephemeral private keys. Furthermore, we show that their scheme fails to meet critical security requirements and relies on flawed security assumptions. We prove our findings using the automated validation of internet security protocols and applications, a widely recognized formal verification tool. To strengthen attack resilience, we propose several recommendations for the advancement of more robust and efficient AKA protocols specifically designed for IoT environments.

SensorsJan 3, 20256 citations

A Provably Secure and Practical PUF-Based End-to-End Mutual Authentication and Key Exchange Protocol for IoT

Sensen Li, Tikui Zhang, Bin Yu +1 more

Device authentication and key exchange are essential issues for Internet of Things (IoT) which plays an indispensable role in modern life. Many sensor devices in IoT, with limited resources and poor self-protection capabilities, are deployed in the unattended and open places, making them vulnerable to physical attacks while facing traditional security threats. Despite several researches have been conducted by using the physical unclonable function (PUF) to immune the communication between IoT devices from the security threats above, as per the knowledge of the authors, current solutions rely on the participation of the server to distribute the key parameters, which requires high message overhead and markedly influences the efficiency. To fill this gap, this article proposes an end-to-end mutual authentication and key exchange protocol for IoT by combining PUF with certificateless public key cryptography (CL-PKC) on elliptic curve, which only needs “three handshakes” without the real-time participation of the server. The security analysis shows that the proposed protocol can not only secure the IoT devices from various attacks, but also provide perfect forward secrecy. Moreover, the experimental validation and performance analysis show the proposed protocol outperforms existing related protocols in terms of security features, protocol rounds and communication cost.

IEEE Sensors JournalOct 6, 2020125 citations

A Forward-Secure Symmetric Authenticated Key Exchange Scheme With Privacy Preservation for Internet of Things Applications

Guosong Yu, Qiong Li, Haokun Mao +2 more

With the rapid advancement of Internet of Things (IoT) applications, efficient and secure communication is considered a challenging task. Symmetric authenticated key exchange (AKE) is a promising solution due to its lightweight design. However, existing studies have demonstrated that traditional symmetric AKE schemes are unable to achieve perfect forward secrecy (PFS). Although some improved schemes were proposed based on the evolution of long-term secrets, the analysis indicates that there exists a zero-sum trade-off between PFS and self-synchronization. In addition, privacy preservation remains a critical issue. In response, this paper proposes a novel three-party symmetric AKE scheme. Specifically, the secret evolving mechanism to prevent the reverse inference of crucial secret values is constructed in the scheme. Meanwhile, any reachable session state can be self-transferred to the synchronization state at the end of a complete session. The proposed scheme provides anonymity and pseudonym unlinkability to the required party, while also improving the robustness of conditional identity traceability, avoiding false accusations caused by misdirected requests. The formal analysis, heuristic analysis based on the state transition and secrecy dependency, and performance comparison indicate that the proposed scheme achieves essential properties while maintaining manageable overhead.

IEEE Internet of Things JournalJan 1, 20253 citations

Provable Privacy Preserving Authentication Solution for Internet of Things Environment

Bander A. Alzahrani, Khalid Mahmood

The Internet of Things (IoT) has become an important technology which permits different devices and machines to interconnect with each other using heterogeneous networks. The integration of numerous techniques is expected to offer extraordinary growth in future and current promising applications of IoT. In these days, the secure communication among interconnected IoT components has become an important issue of concern. Therefore, it has become a foremost need to design such authentication protocol which can make the secure communication among IoT components. In this article, we proposed an identity-based authentication and key agreement protocol for the IoT environment in order to offer the secure communication between various IoT entities. The devised protocol utilizes the physically unclonable function which helps to robustly resist the physical attack on IoT components. We analyze the proposed protocol informally which clearly shows that the proposed protocol offers the perfect forward secrecy, device anonymity and untraceability and also resists the desynchronization, IoT node impersonation and server impersonation attacks. The security features of proposed protocol are also analyzed formally using well known Random Oracle Model (ROM). Moreover, the performance of the devised protocol has also been determined in terms of communication and computational overhead. The performance and security analysis shows the supremacy of the devised protocol over the various related protocols.

IEEE AccessJan 1, 202123 citations

A Secure, Lightweight, and Anonymous User Authentication Protocol for IoT Environments

Seunghwan Son, Yohan Park, Youngho Park

The Internet of Things (IoT) is being applied to various environments such as telecare systems, smart homes, and intelligent transportation systems. The information generated from IoT devices is stored at remote servers, and external users authenticate to the server for requesting access to the stored data. In IoT environments, the authentication process is required to be conducted efficiently, and should be secure against various attacks and ensure user anonymity and untraceability to ensure sustainability of the network. However, many existing protocols proposed in IoT environments do not meet these requirements. Recently, Rajaram et al. proposed a paring-based user authentication scheme. We found that the Rajaram et al. scheme is vulnerable to various attacks such as offline password guessing, impersonation, privileged insider, and known session-specific temporary information attacks. Additionally, as their scheme uses bilinear pairing, it requires high computation and communication costs. In this study, we propose a novel authentication scheme that resolves these security problems. The proposed scheme uses only hash and exclusive-or operations to be applicable in IoT environments. We analyze the proposed protocol using informal analysis and formal analysis methods such as the BAN logic, real-or-random (ROR) model, and the AVISPA simulation, and we show that the proposed protocol has better security and performance compared with existing authentication protocols. Consequently, the proposed protocol is sustainable and suitable for real IoT environments.

SustainabilityAug 17, 202140 citations