Abstract This paper presents a scalable group authentication and key agreement protocol for dynamic IoT environments that integrates Physical Unclonable Function (PUF)-derived device bases with inner product space projections. During registration, each device is assigned a private basis $${\mathcal {B}}_i$$ B i derived from its PUF responses, enabling efficient group authentication without per-device centralized verification and thereby mitigating long-term reliance on the group manager (GM). The protocol provides single-broadcast operations for member joining and leaving as well as decentralized group key updates. Formal security analysis under the Real-or-Random (ROR) model and experimental evaluation demonstrate robustness against common attacks, low communication overhead (6.5- $$-$$ - 7.9 KB for 100 devices), and low authentication latency (1.135 ms for members and 0.051 ms for guests).
Abstract This paper presents a scalable group authentication and key agreement protocol for dynamic IoT environments that integrates Physical Unclonable Function (PUF)-derived device bases with inner product space projections. During registration, each device is assigned a private basis Bi B i derived from its PUF responses, enabling efficient group authentication without per-device centralized verification and thereby mitigating long-term reliance on the group manager (GM). The protocol provides single-broadcast operations for member joining and leaving as well as decentralized group key updates. Formal security analysis under the Real-or-Random (ROR) model and experimental evaluation demonstrate robustness against common attacks, low communication overhead (6.5- − - 7.9 KB for 100 devices), and low authentication latency (1.135 ms for members and 0.051 ms for guests).
With the rapid development of quantum computing, in response to its disruptive threats to traditional cryptosystems and the urgent demand for lightweight and highly scalable secure group communication among resource-constrained devices in large-scale Internet of Things (IoT) scenarios, this paper proposes a lightweight anonymous group authentication scheme that integrates Physical Unclonable Functions (PUFs), distributed Gossip algorithms, and quantum key distribution. By exploiting the uniqueness and unclonability derived from the inherent physical characteristics of PUF hardware, the scheme fundamentally eliminates attack vectors against quantum computers without requiring devices to pre-store any secret keys in their memory, while the QKCS pre-provisions CRPs and key seeds, which is the standard enrollment procedure in PUF-based systems. Combined with information-theoretically secure quantum keys as session keys, it forms a dual protection mechanism: anti-forgery at the physical layer and anti-quantum attack at the cryptographic layer. Innovatively, the Gossip algorithm is deeply integrated with group key agreement, converting global broadcast into local iterative interactions between nodes, which effectively alleviates broadcast storms and improves the scalability and fault tolerance of the protocol. Meanwhile, a pseudonym mechanism is introduced to achieve anonymous identity protection, and a dynamic key update strategy guarantees forward and backward security when members join or leave the group. Formal verification based on BAN logic and security analysis show that the proposed protocol can resist typical attacks such as replay attacks, man-in-the-middle attacks, and impersonation attacks. Performance evaluations demonstrate that our scheme outperforms existing comparable schemes in terms of computational cost, communication overhead, and dynamic group management efficiency, demonstrating its potential for resource-constrained IoT environments, pending further validation on real hardware platforms.
Securing applications that gather and transfer confidential information has become a critical challenge in the rapidly evolving Internet of Things (IoT) landscape. Such data’s authenticity, integrity, and confidentiality must be guaranteed while reducing security functions’ computation and communication overhead to accommodate the numerous constrained devices involved. Group authentication and key management are essential aspects of IoT security, but existing protocols often need to be more computationally expensive for IoT applications and must take care of anonymization. Consequently, IoT devices may be open to potential cyber-attacks due to the use of simple security primitives. Physically Unclonable Function (PUF) can enable in lightweight approach to authentication and key distribution among group members. The factorial tree and Chinese Remainder Theorem (CRT) can minimize communication messages required to renew the keys. This paper presents a novel protocol, Anonymized Lightweight PUF-based group Authentication with Key distribution (ALPAK) for IoT Devices, which improves the PUF-Based Lightweight Group Authentication and Key Distribution Protocol (PLGAKD) to enhance the anonymity of IoT devices. The paper further presents the formal verification of the ALPAK scheme with the Scyther tool and detailed security analysis.
The immense potential of the Internet of Things (IoT) is challenged by grave security vulnerabilities that are easily exploitable in resource-constrained environments. We propose a lightweight Authentication and Key Agreement (AKA) protocol to derive a shared session key for each communicating node in amutually communicating cluster of IoT nodes. Each IoT device is embedded with a Physically Unclonable Function (PUF), and a Fuzzy Extractor (FE) is deployed to correct and reproduce the private key and public helper data pair from the possibly erroneous PUF response. This secret raw PUF response is not stored explicitly in the server. A forward-secure authenticated key agreement is achieved by incorporating Elliptic Curve Diffie-Hellman Key Exchange (ECDH) protocol. The security of the proposed scheme has been formally verified while considering both active and passive attackers using the Verifpal tool. A prototype implementation with the Arbiter PUF circuit, FE, and associated software has successfully demonstrated the efficacy of our scheme.
The advent of Internet of Things (IoT) ushers in a significant potential to integrate individuals, devices, and data, leading to a profound change in our professional and social environments. The small, resource-constrained IoT devices are usually deployed to collect various types of critical data in remote or unmonitored locations. Due to extensive interconnectivity, limited resources, and inadequate security design, IoT systems are vulnerable to communication-specific cyber threats, which aim to disrupt operations, steal sensitive information, or cause damage. To resolve the security concerns in IoT communications, many recent efforts have been devoted to designing authenticated key agreement protocols for IoT systems. However, not only most of the existing solutions fail to adopt cost-effective techniques for resource-limited IoT devices, but also they ignore the differentiation among various data types in the established session keys. A few approaches use traditional physical unclonable functions (PUFs) to address resource concerns, yet they introduce new security issues into IoT systems. Once the PUF cryptographic information is compromised by machine learning attacks, the entire authentication framework collapses. Therefore, in this paper we propose an authenticated key agreement protocol for device-to-gateway communication in IoT systems based on Chebyshev polynomial and probability-based PUF. We examine the proposed protocol’s security features through formal security validation. We also conduct performance evaluation through a simulation-oriented study, and the results clearly prove that the proposed protocol offers superior security and privacy, while maintaining low computational overhead.
The Internet of Things (IoT) is among the most promising technologies of the future, and its development has garnered attention worldwide. However, the rise of the IoT has been accompanied by a proportionate increase in security concerns regarding communication between IoT entities. Recently, Alzahrani et al. proposed an identity-based authentication and key agreement protocol for an IoT environment, wherein a physically unclonable function was employed. They claimed that their protocol can resist various types of attacks; however, after thorough analysis, we determined it to be ineffective against privileged internal attacks, physical IoT device capture attacks, stolen-verifier attacks, and known temporary information exposure attacks. To resolve these security weaknesses, we propose a new authentication and key agreement protocol. In addition, we demonstrate that the proposed protocol is provably secure in real-or-random (ROR) model and Burrows–Abadi–Needham (BAN) logic, resisting known attacks while incurring low communication and computation costs.
Peer to Peer (P2P) or direct connection IoT has become increasingly popular owing to its lower latency and higher privacy compared to database-driven or server-based IoT. However, wireless vulnerabilities raise severe concerns on IoT device-to-device communication. This is further aggravated by the challenge to achieve lightweight direct mutual authentication and secure key exchange between IoT peer nodes in P2P IoT applications. Physical unclonable function (PUF) is a key enabler to lightweight, low-power and secure authentication of resource-constrained devices in IoT. Nevertheless, current PUF-enabled authentication protocols, with or without the challenge-response pairs (CRPs) of each of its interlocutors stored in the verifier’s side, are incompatible for P2P IoT scenarios due to the security, storage and computing power limitations of IoT devices. To solve this problem, a new lightweight PUF-based mutual authentication and key-exchange protocol is proposed. It allows two resource-constrained PUF embedded endpoint devices to authenticate each other directly without the need for local storage of CRP or any private secrets, and simultaneously establish the session key for secure data exchange without resorting to public-key algorithm. The proposed protocol is evaluated using the Mao and Boyd logic as well as the automatic security analysis tool ProVerif to corroborate its mutual authenticity, secrecy, and resistance against replay and man-in-the-middle attacks. Using two Avnet Ultra96-V2 boards to emulate the two IoT endpoint devices of a network, a physical prototype system is also constructed to demonstrate and validate the feasibility of the proposed secure P2P connection scheme.