Two-factor authentication in industrial Internet-of-Things: Attacks, evaluation and new construction

Abstract

Due to the sensitiveness of the physical environments and resource-constrained nature of edge devices, how to securely and efficiently access real-time data in Industrial Internet-of-Things (IIoT) is becoming an increasingly imperative concern. Though intensive efforts have been made to design password-based user authentication schemes for IIoT environments, the majority of them are subject to weaknesses, either suffering from various known attacks or lack of critical features. To ameliorate this situation, firstly, we put forward a criteria set on the basis of related state-of-art evaluation set to fairly assess authentication schemes for IIoT environments. The effectiveness and practicality of our criteria are tested by 42 representative schemes. Secondly, we revisit two representative schemes, namely Amin et al.’s scheme and Gope–Hwang’s scheme, as case studies to demonstrate the common pitfalls in designing robust schemes. Finally, we propose a practical authentication scheme for Industrial Internet-of-Things with provable security, and shed light on how to tackle node capture attack by using the “honeywords” technique. The security and performance evaluation results show that our new scheme is superior to other related ones, and thus, more suitable for IIoT environments.