The rapid proliferation of Internet of Things (IoT) devices in Wireless Sensor Networks (WSNs) has introduced a new dimension of connectivity, efficiency, and automation. However, it also presents significant security concerns, particularly in authentication. Strong and trustworthy authentication protocols are required to ensure secure communication and trustworthiness in IoT systems. For instance, Sahoo et al.’s authentication scheme has serious design flaws and lacks forward and backwards secrecy. Similarly, due to inherent design flaws, Mahmood et al.’s protocol is vulnerable to several major attacks. This paper presents a novel, lightweight authentication scheme for IoT-enabled WSNs to address these challenges. We prioritise low computational overhead, scalability, and strong security guarantees like perfect forward secrecy, backwards secrecy, and immunity against replay, MiTM, impersonation attacks, etc. We demonstrate through an extensive security analysis of the ROM model that our scheme addresses the shortcomings of existing methods. The protocol’s security is formally verified using the Scyther tool, and its practical feasibility is demonstrated through ESP32-based simulation on the wokwi platform, confirming correct cryptographic operations and session key management. This paper is a significant step toward designing an efficient and secure authentication system in line with the evolving requirements of modern IoT infrastructures.
The rapid proliferation of Internet of Things (IoT) devices in Wireless Sensor Networks (WSNs) has introduced a new dimension of connectivity, efficiency, and automation. However, it also presents significant security concerns, particularly in authentication. Strong and trustworthy authentication protocols are required to ensure secure communication and trustworthiness in IoT systems. For instance, Sahoo et al.’s authentication scheme has serious design flaws and lacks forward and backwards secrecy. Similarly, due to inherent design flaws, Mahmood et al.’s protocol is vulnerable to several major attacks. This paper presents a novel, lightweight authentication scheme for IoT-enabled WSNs to address these challenges. We prioritise low computational overhead, scalability, and strong security guarantees like perfect forward secrecy, backwards secrecy, and immunity against replay, MiTM, impersonation attacks, etc. We demonstrate through an extensive security analysis of the ROM model that our scheme addresses the shortcomings of existing methods. The protocol’s security is formally verified using the Scyther tool, and its practical feasibility is demonstrated through ESP32-based simulation on the wokwi platform, confirming correct cryptographic operations and session key management. This paper is a significant step toward designing an efficient and secure authentication system in line with the evolving requirements of modern IoT infrastructures.
The emerging growth of Internet-of-Things(IoT) technology, enable the adoption of many industrial applications. As an infrastructure point of view, Wireless Sensor Networks(WSN) attains utmost importance in industrial IoT. The security threats always remain serious issues for WSN. Recently, Li et al scheme presented a three-factor authentication scheme for IoT environments. This article reviews Li et al. protocol find out that their protocol is vulnerable to stolen-verifier-attacks, Anonymity and Traceability issues. We present, an improved authentication scheme to conquered the flaws in Li et al scheme. Furthermore, the proposed solution is formally verified with ProVerif. Moreover security inspection proves the robustness of the proposed protocol.
In recent years, wireless sensor networks (WSNs) have been extensively used in many fields, which provide great convenience for people’s daily work and life. With the popularity of WSNs, people’s demands for related authentication protocols are developing in a comprehensive and perfect direction, and relevant designs are focusing more on two aspects: security and performance. However, current research cannot avoid the problem that security and efficiency are not compatible. Some studies use time-consuming cryptographic structures for security, while most lightweight schemes are designed without considering certain security properties, such as perfect forward secrecy, the resistance to known session-specific temporary information attack, etc. In our view, this conflict can be resolved by using lightweight cryptography primitives with special attention to protocol vulnerabilities and ever-evolving security requirements of people. By abandoning all unnecessary cryptographic structures, we propose a comprehensive lightweight three-factor authentication protocol with various security requirements, including adaptive privacy preservation, which is suitable for the user-friendly scenario in the WSN. Through security analysis, real-or-random (ROR) model proof, Automated Validation of Internet Security Protocols and Applications experimental verification, and security aspect comparison, it is proved that our protocol is superior in the security aspect. The performance experiment under MIRACL library shows that this study has advantages in performance compared with other recent research.
Wireless sensor networks (WSNs) are of prominent use in unmanned surveillance applications. This peculiar trait of WSNs is actually the underlying technology of various applications of the Internet of Things (IoT) such as smart homes, smart cities, smart shopping complexes, smart traffic, smart health, and much more. Over time, WSNs have evolved as a strong base for laying the foundations of IoT infrastructure. In order to address the scenario in which a user wants to access the real-time data directly from the sensor node in wireless sensor networks (WSNs), Das recently proposed an anonymity-preserving three-factor authentication protocol. Das's protocol is suitable for resource-constrained sensor nodes because it only uses lightweight cryptographic primitives such as hash functions and symmetric encryption schemes as building blocks. Das's protocol is claimed to be secure against different known attacks by providing formal security proof and security verification using the Automated Validation of Internet Security Protocols and Applications tool. However, we find that Das's protocol has the following security loopholes: (1) By using a captured sensor node, an adversary can impersonate a legal user to the gateway node, impersonate other sensor nodes to deceive the user, and the adversary can also decrypt all the cipher-texts of the user; (2) the gateway node has a heavy computational cost due to user anonymity and thus the protocol is vulnerable to denial of service (DoS) attacks. We overcome the shortcomings of Das's protocol and propose an improved protocol. We also prove the security of the proposed protocol in the random oracle model. Compared with the other related protocols, the improved protocol enjoys better functionality without much enhancement in the computation and communication costs. Consequently, it is more suitable for applications in WSNs.
The Internet of Things (IoT) is being applied to various environments such as telecare systems, smart homes, and intelligent transportation systems. The information generated from IoT devices is stored at remote servers, and external users authenticate to the server for requesting access to the stored data. In IoT environments, the authentication process is required to be conducted efficiently, and should be secure against various attacks and ensure user anonymity and untraceability to ensure sustainability of the network. However, many existing protocols proposed in IoT environments do not meet these requirements. Recently, Rajaram et al. proposed a paring-based user authentication scheme. We found that the Rajaram et al. scheme is vulnerable to various attacks such as offline password guessing, impersonation, privileged insider, and known session-specific temporary information attacks. Additionally, as their scheme uses bilinear pairing, it requires high computation and communication costs. In this study, we propose a novel authentication scheme that resolves these security problems. The proposed scheme uses only hash and exclusive-or operations to be applicable in IoT environments. We analyze the proposed protocol using informal analysis and formal analysis methods such as the BAN logic, real-or-random (ROR) model, and the AVISPA simulation, and we show that the proposed protocol has better security and performance compared with existing authentication protocols. Consequently, the proposed protocol is sustainable and suitable for real IoT environments.
To improve the quality of service and reduce the possibility of security attacks, a secure and efficient user authentication mechanism is required for Wireless Sensor Networks (WSNs) and the Internet of Things (IoT). Session key establishment between the sensor node and the user is also required for secure communication. In this paper, we perform the security analysis of A.K.Das’s user authentication scheme (given in 2015), Choi et al.’s scheme (given in 2016), and Park et al.’s scheme (given in 2016). The security analysis shows that their schemes are vulnerable to various attacks like user impersonation attack, sensor node impersonation attack and attacks based on legitimate users. Based on the cryptanalysis of these existing protocols, we propose a secure and efficient authenticated session key establishment protocol which ensures various security features and overcomes the drawbacks of existing protocols. The formal and informal security analysis indicates that the proposed protocol withstands the various security vulnerabilities involved in WSNs. The automated validation using AVISPA and Scyther tool ensures the absence of security attacks in our scheme. The logical verification using the Burrows-Abadi-Needham (BAN) logic confirms the correctness of the proposed protocol. Finally, the comparative analysis based on computational overhead and security features of other existing protocol indicate that the proposed user authentication system is secure and efficient. In future, we intend to implement the proposed protocol in real-world applications of WSNs and IoT.
The Internet has a significant impact on contemporary society, enabling a wide range of applications, including advanced cellular networks such as 4G, 5G, and 6G. Since these communications occur over shared or open channels, ensuring secure data exchange is of critical importance, as any weakness in the communication infrastructure may compromise system reliability. Device authentication in the Internet of Things (IoT) and user authentication in smart environments, such as smart homes, remain fundamental security challenges. As the first line of defense, authentication mechanisms must be robust, since vulnerabilities at this stage can expose the entire system to serious threats. To address these challenges, numerous authentication schemes based on cryptographic primitives, including Elliptic Curve Cryptography (ECC), have been proposed. In this paper, we present a comprehensive security analysis of an ECC-based three-factor authentication protocol proposed by Yuan et al. Our analysis shows that the protocol is vulnerable to desynchronization, user impersonation, traceability, and insider attacks, all of which succeed with probability 1 by exploiting at most two protocol phases. To mitigate these weaknesses, we propose an improved authentication scheme, called HEIoT. The proposed scheme is formally analyzed under the Real-or-Random (RoR) model to establish session-key security and is further verified using the Scyther tool. Moreover, a Python-based implementation is provided to demonstrate the practicality of the proposed protocol. Comparative results indicate that HEIoT achieves stronger security while maintaining acceptable communication, computational, and storage overhead.