With the rapid advancement of Internet of Things (IoT) applications, efficient and secure communication is considered a challenging task. Symmetric authenticated key exchange (AKE) is a promising solution due to its lightweight design. However, existing studies have demonstrated that traditional symmetric AKE schemes are unable to achieve perfect forward secrecy (PFS). Although some improved schemes were proposed based on the evolution of long-term secrets, the analysis indicates that there exists a zero-sum trade-off between PFS and self-synchronization. In addition, privacy preservation remains a critical issue. In response, this paper proposes a novel three-party symmetric AKE scheme. Specifically, the secret evolving mechanism to prevent the reverse inference of crucial secret values is constructed in the scheme. Meanwhile, any reachable session state can be self-transferred to the synchronization state at the end of a complete session. The proposed scheme provides anonymity and pseudonym unlinkability to the required party, while also improving the robustness of conditional identity traceability, avoiding false accusations caused by misdirected requests. The formal analysis, heuristic analysis based on the state transition and secrecy dependency, and performance comparison indicate that the proposed scheme achieves essential properties while maintaining manageable overhead.
With the rapid advancement of Internet of Things (IoT) applications, efficient and secure communication is considered a challenging task. Symmetric authenticated key exchange (AKE) is a promising solution due to its lightweight design. However, existing studies have demonstrated that traditional symmetric AKE schemes are unable to achieve perfect forward secrecy (PFS). Although some improved schemes were proposed based on the evolution of long-term secrets, the analysis indicates that there exists a zero-sum trade-off between PFS and self-synchronization. In addition, privacy preservation remains a critical issue. In response, this paper proposes a novel three-party symmetric AKE scheme. Specifically, the secret evolving mechanism to prevent the reverse inference of crucial secret values is constructed in the scheme. Meanwhile, any reachable session state can be self-transferred to the synchronization state at the end of a complete session. The proposed scheme provides anonymity and pseudonym unlinkability to the required party, while also improving the robustness of conditional identity traceability, avoiding false accusations caused by misdirected requests. The formal analysis, heuristic analysis based on the state transition and secrecy dependency, and performance comparison indicate that the proposed scheme achieves essential properties while maintaining manageable overhead.
By utilizing the sensing and perception capabilities of various devices, the Internet of Things (IoT) enables more precise awareness of the real world, thereby enhancing management and resource utilization efficiency. However, due to their open deployment environments and frequent message exchanges, IoT endpoints are highly vulnerable to a wide range of security threats and privacy breaches, including forgery, data theft, and information leakage. Therefore, to address these challenges and ensure device legitimacy verification and secure data exchange among IoT devices, we propose a privacy-preserving and traceable certificateless anonymous mutual authentication scheme (PPT-CLAMA). PPT-CLAMA not only eliminates the need for a secure channel during key generation but also prevents attackers from tracing the real identity of devices through their own identity or public keys while providing pseudonym and anonymous authentication to devices, demonstrating greater practicality. Furthermore, through security proofs and analysis, PPT-CLAMA satisfies various high-level security properties, including mutual authentication, key agreement, nonrepudiation, unlinkability, perfect forward secrecy, known session-specific temporary information security, traceability, anonymity, and privacy preservation. The simulation results indicate that, compared to authentication and key agreement schemes, PPT-CLAMA reduces the average computational overhead and average communication overhead during the authentication process by 6.73% and 3.31%, respectively, demonstrating higher computational and communication efficiency.
Authenticated key exchange (AKE) allows two parties to authenticate each other and establish a secret session key to build a secure channel, and it has been well studied in the literature. With the approaching of quantum computers, designing post-quantum secure AKE schemes becomes an urgent task. Today, several KE schemes have been proposed while only a small number of AKE schemes exist. Very few of them have considered resource-constrained participants like IoT devices. In this paper, assuming a typical client-server setting where the client is an IoT device, we propose a modular framework that converts any post-quantum secure KE scheme into a post-quantum secure AKE scheme. Equipped with two authentication factors, the resulted AKE scheme provides a number of security guarantees including Perfect forward secrecy (PFS), Key compromise impersonation (KCI) resilience and Server compromise impersonation (SCI) resilience. We further instantiate the framework by selecting the most efficient KE scheme, namely NewHope Compact, and implement the scheme with some optimisation techniques and conduct relevant analysis and comparisons. In a nutshell, the computational time of the server side is 1.11 ms on a PC and 6.22 ms of the IoT device simulated on Raspberry Pi 3B+, and it seems to be efficient enough for most IoT application scenarios.
Security in the Industrial Internet of Things (IIoT) is vital as there are some cases where IIoT devices collect sensory information for crucial social production and life. Thus, designing secure and efficient communication channels is always a research hotspot. However, end devices have memory, computation, and power-supplying capacities limitations. Moreover, perfect forward secrecy (PFS), which means that long-term key exposure still discloses previous session keys, is a critical security property for authentication and key exchange (AKE). This article proposes an AKE protocol named SAKE* for the IIoT environment, where two types of keys (i.e., a master key and an evolution key) guarantee PFS. In addition, the SAKE* protocol merely uses concatenation, XOR, and hash-function operations to achieve lightweight authentication, key exchange, and message integrity. We also compare the SAKE* protocol with seven current and IoT-related authentication protocols regarding security properties and performance. Comparison results indicate that the SAKE* protocol consumes the least computation resource and third-least communication cost among eight AKE protocols while equipping 12 security properties.
With the rise of the Internet of Things (IoT), maintaining data confidentiality and protecting user privacy have become increasingly challenging. End devices in the IoT are often deployed in unattended environments and connected to open networks, making them vulnerable to physical tampering and other security attacks. Different authentication key agreement (AKA) schemes have been used in practice; several of them do not cover the necessary security features or are incompatible with resource-constrained end devices. Their security proofs have been performed under the Random-Oracle model. We present an AKA protocol for end devices and servers. The proposal leverages the ECC-based key exchange mechanism and one-way hash function-based message authentication method to achieve mutual authentication, user anonymity, and forward security. A formal security proof of the proposed scheme is performed under the standard model and the eCK model with the elliptic curve encryption computational assumptions, and formal verification is performed with ProVerif. According to the performance comparison, it is revealed that the proposed scheme offers user anonymity, perfect forward security, and mutual authentication, and resists typical attacks such as ephemeral secret leakage attacks, impersonation attacks, man-in-the-middle attacks, and key compromise impersonation attacks. Moreover, the proposed scheme has the lowest computational and communication overhead compared to existing schemes.
The Internet of Things (IoT) has become an important technology which permits different devices and machines to interconnect with each other using heterogeneous networks. The integration of numerous techniques is expected to offer extraordinary growth in future and current promising applications of IoT. In these days, the secure communication among interconnected IoT components has become an important issue of concern. Therefore, it has become a foremost need to design such authentication protocol which can make the secure communication among IoT components. In this article, we proposed an identity-based authentication and key agreement protocol for the IoT environment in order to offer the secure communication between various IoT entities. The devised protocol utilizes the physically unclonable function which helps to robustly resist the physical attack on IoT components. We analyze the proposed protocol informally which clearly shows that the proposed protocol offers the perfect forward secrecy, device anonymity and untraceability and also resists the desynchronization, IoT node impersonation and server impersonation attacks. The security features of proposed protocol are also analyzed formally using well known Random Oracle Model (ROM). Moreover, the performance of the devised protocol has also been determined in terms of communication and computational overhead. The performance and security analysis shows the supremacy of the devised protocol over the various related protocols.
By the drone capturing attacks, the adversaries can extract the long-term secret keys stored in the drones. Therefore, it is necessary to consider forward secrecy and forward unlinkability to minimize the damage by the drone capturing attacks. Forward secrecy protects the secrecy of the past sessions between users and drones, and forward unlinkability guarantees the strong anonymity of users and drones participated in the past sessions, even when the long-term secret keys are revealed to the attackers via the drone capturing attacks. In 2022 Jeong et el. suggested a three-party key agreement scheme for internet of drones which provides forward secrecy and forward unlikability. However, their scheme has some shortcomings. Especially, in their scheme a drone (or a user) can not run concurrently multiple key exchange sessions with multiple users (or drones). And their scheme provides only weak forward secrecy, not standard forward secrecy. In this paper, we propose a key exchange protocol resolving all the shortcomings of the Jeong et al.’s scheme. That is, our key exchange protocol provides the standard forward secrecy and forward unlinkability. And a drone can run concurrently multiple sessions with users without communication with the server. We also suggest a formal model for the forward unlinkability, and prove the forward unlinkability of our scheme in the formal model.