Abstract
Wireless sensor networks (WSNs) are of prominent use in unmanned surveillance applications. This peculiar trait of WSNs is actually the underlying technology of various applications of the Internet of Things (IoT) such as smart homes, smart cities, smart shopping complexes, smart traffic, smart health, and much more. Over time, WSNs have evolved as a strong base for laying the foundations of IoT infrastructure. In order to address the scenario in which a user wants to access the real-time data directly from the sensor node in wireless sensor networks (WSNs), Das recently proposed an anonymity-preserving three-factor authentication protocol. Das’s protocol is suitable for resource-constrained sensor nodes because it only uses lightweight cryptographic primitives such as hash functions and symmetric encryption schemes as building blocks. Das’s protocol is claimed to be secure against different known attacks by providing formal security proof and security verification using the Automated Validation of Internet Security Protocols and Applications tool. However, we find that Das’s protocol has the following security loopholes: (1) By using a captured sensor node, an adversary can impersonate a legal user to the gateway node, impersonate other sensor nodes to deceive the user, and the adversary can also decrypt all the cipher-texts of the user; (2) the gateway node has a heavy computational cost due to user anonymity and thus the protocol is vulnerable to denial of service (DoS) attacks. We overcome the shortcomings of Das’s protocol and propose an improved protocol. We also prove the security of the proposed protocol in the random oracle model. Compared with the other related protocols, the improved protocol enjoys better functionality without much enhancement in the computation and communication costs. Consequently, it is more suitable for applications in WSNs
Highlights
Wireless sensor networks (WSNs) play a pivotal role in the origin and propagation of the Internet of Things (IoT), the notion that each object can be sensed, identified, accessed and interconnected via the Internet within a dynamic ubiquitous network
Das proposed a multi-factor authentication protocol combining password, smart card and biological information [18]. Their protocol only adopts lightweight cryptographic components, such as hash function and symmetric encryption algorithm, so it confirms to the characteristics of limited resource of sensor nodes in wireless sensor network
We found that Das’s protocol has the following security vulnerabilities: (1) the attacker can impersonate the user to the gateway node by using the captured sensor node, and can decrypt all the encrypted data of the user; (2) anonymity requires a lot of computing by the gateway node, which will lead to denial of service attack on the gateway node
Summary
Wireless sensor networks (WSNs) play a pivotal role in the origin and propagation of the IoT, the notion that each object (virtual or physical) can be sensed, identified, accessed and interconnected via the Internet within a dynamic ubiquitous network. Chen et al pointed out that the Das protocol failed to realize two-way authentication and made corresponding improvements [5] He et al found that Das’s protocol could not resist insider attacks and internal malicious user impersonation attacks [6]. Wu et al [12] designed a provably secure three-factor user authentication protocol for wireless sensor networks Their scheme attains a number of desirable features but the computational and communication overheads are high. Das proposed a multi-factor authentication protocol combining password, smart card and biological information [18] Their protocol only adopts lightweight cryptographic components, such as hash function and symmetric encryption algorithm, so it confirms to the characteristics of limited resource of sensor nodes in wireless sensor network.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have