Authentication For Internet Of Things Research Articles

Blockchain-Assisted Secure Intra/Inter-Domain Authorization and Authentication for Internet of Things

Blockchain-Assisted Secure Intra/Inter-Domain Authorization and Authentication for Internet of Things

Design and Implementation of Efficient IoT Authentication Schemes for MQTT 5.0

<p>MQTT (Message Queue Telemetry Transport) is one of the most popular Internet of Things (IoT) communication protocols, owing to its lightweight and easiness to use. The previous MQTT standards (including version 3.1 and its precedents) do not provide proper security functions; instead, they assume the adoption of SSL/TLS in the underlying layer. However, it not only incurs larger overhead but also hinders the development of suitable authentication/confidentiality protection to suit various MQTT deployment scenarios. The newest MQTT standard called MQTT 5.0 responds to these challenges by supporting the Enhanced Authentication framework in which designers can design and implement any secure authentication mechanisms within the framework. This paper designs and implements two efficient authentication protocols, using the MQTT 5.0 Enhanced Authentication framework. One is simple challenge-response authentication scheme, and the other is an anonymous challenge-response authentication scheme. We extend HiveMQ platform to implement the schemes and evaluate the performance. The results show that the proposed schemes demand only hundred few more milliseconds to achieve much robust authentication, compared to the simple identity-password authentication.</p> <p> </p>

A Lightweight, Secure Big Data-Based Authentication and Key-Agreement Scheme for IoT with Revocability

With the rapid development of Internet of Things (IoT), designing a secure two-factor authentication scheme for IoT is becoming increasingly demanding. Two-factor protocols are deployed to achieve a higher security level than single-factor protocols. Given the resource constraints of IoT devices, other factors such as biometrics are ruled out as additional authentication factors due to their large overhead. Smart cards are also prone to side-channel attacks. Therefore, historical big data have gained interest recently as a novel authentication factor in IoT. In this paper, we show that existing big data-based schemes fail to achieve their claimed security properties such as perfect forward secrecy (PFS), key compromise impersonation (KCI) resilience, and server compromise impersonation (SCI) resilience. Assuming a real strong attacker rather than a weak one, we show that previous schemes not only fail to provide KCI and SCI but also do not provide real two-factor security and revocability and suffer inside attack. Then, we propose our novel scheme which can indeed provide real two-factor security, PFS, KCI, and inside attack resilience and revocability of the client. Furthermore, our performance analysis shows that our scheme has reduced modular exponentiation operation and multiplication for both the client and the server compared to Liu et al.’s scheme which reduces the execution time by one third for security levels of λ = 128 . Moreover, in order to cope with the potential threat of quantum computers, we suggest using lightweight XMSS signature schemes which provide the desired security properties with λ = 128 bit postquantum security. Finally, we prove the security of our proposed scheme formally using both the real-or-random model and the ProVerif analysis tool.

Trust and Voice Biometrics Authentication for Internet of Things

In recent years, IoT adoption has been higher, and this causes lots of security concerns. One of the fundamental security concerns in IoT adoption is the question, “Are you who you say you are?” Thus, authentication forms the gateway for a secure communication system with IoT. So far, the human voice is one of the most natural, non-intrusive, and convenient behavioural biometric factors compared to other biometric authentication methods. Despite the non-intrusive characteristics of voice as a biometric authentication factor when accessing IoT technologies, there is a concern of a general societal trust and distrust with IoT technology and the risk of theft of users' data and imitation. This study derived a realistic trust evaluation model that incorporates privacy, reliability, security, usability, safety, and availability factors into a trust vector for a flexible measurement of trust in the user accessing IoT technologies.

A Survey on Zero-Knowledge Authentication for Internet of Things

The Internet of Things (IoT) is ubiquitous in our lives. However, the inherent vulnerability of IoT smart devices can lead to the destruction of networks in untrustworthy environments. Therefore, authentication is a necessary tool to ensure the legitimacy of nodes and protect data security. Naturally, the authentication factors always include various sensitive users’ information, such as passwords, ID cards, even biological information, etc. How to prevent privacy leakage has always been a problem faced by the IoT. Zero-knowledge authentication is a crucial cryptographic technology that uses authenticates nodes on the networks without revealing identity or any other data entered by users. However, zero-knowledge proof (ZKP) requires more complex data exchange protocols and more data transmission compared to traditional cryptography technologies. To understand how zero-knowledge authentication works in IoT, we produce a survey on zero-knowledge authentication in privacy-preserving IoT in the paper. First, we overview the IoT architecture and privacy, including security challenges and open question in different IoT layers. Next, we overview zero-knowledge authentication and provide a comprehensive analysis of designing zero-knowledge authentication protocols in various IoT networks. We summarize the advantages of ZKP-based authentication in IoT. Finally, it summarizes the potential problems and future directions of ZKP in IoT.

Efficient hybrid centralized and blockchain-based authentication architecture for heterogeneous IoT systems

With the rapid increase in the number of Internet of Things (IoT) devices in recent years, massive amounts of sensitive IoT data are being generated and transmitted over the Internet. Despite its growing adoption in various fields, IoT security remains a major challenge requiring further research. IoT authentication is an essential security mechanism for building trust in IoT systems. However, conventional authentication approaches use expensive cryptographic primitives that do not align with the resource-constrained nature of IoT devices. Furthermore, centralized authentication schemes have proven to be inapplicable for cross-domain authentication and do not limit the scalability of IoT networks. Recently, blockchain technology has been applied to building decentralized authentication between IoT devices. Nevertheless, most existing blockchain-based authentication approaches incur high overhead in IoT computation, storage, and energy consumption. Authentication time is another critical issue in real-time IoT systems. When numerous IoT authentication requests are transferred to the blockchain, an additional time delay is imposed, in addition to the high computational cost of the blockchain caused by the consensus mechanism. This study proposes a hybrid centralized and blockchain-based authentication architecture for IoT systems. Edge servers are deployed to provide centralized authentication for associated IoT devices. A blockchain network of centralized edge servers is then established to ensure decentralized authentication and verification of IoT devices that belong to different and heterogeneous IoT systems. Lightweight cryptographic methods are implemented to achieve efficient authentication, in which limiting the consumption of IoT resources is required. The architecture is demonstrated using a local Ethereum blockchain network. The results indicate that the proposed method achieves significant improvements in terms of computation cost, execution time, and power consumption for IoT compared with centralized and blockchain-based authentication schemes. A security analysis proves the ability of our architecture to mitigate attacks and satisfy the IoT security requirements.

Integration of IoT and Blockchain for user Authentication

The proliferation of Internet of Things (IoT) devices has ushered in a new era of connectivity, necessitating robust solutions for user authentication to address security and trust challenges. This paper explores an innovative approach to user authentication in IoT environments by leveraging the unique capabilities of Non-Fungible Tokens (NFTs) and 9NM (9NFTMANIA) tokens, with a specific focus on utilizing contract addresses. The proposed system involves the tokenization of user identities through the creation of contract addresses on blockchain networks. Each user is assigned a unique digital identity represented by an NFT or 9NM token, providing a tamper-proof association between the user and their cryptographic keys. Blockchain smart contracts are employed to manage authentication processes, dictating access control policies based on the user's contract address. The research underscores the importance of industry-wide collaboration to develop common standards for user authentication in IoT environments. By offering a comprehensive exploration of user authentication in IoT using contract address-based NFTs and 9NM tokens that are developed on Satoshi core based blockchain, this paper contributes to the advancement of secure and user-centric practices in the rapidly evolving landscape of IoT technology. The proposed framework not only enhances the overall security posture of IoT networks but also lays the foundation for a more transparent and interoperable authentication ecosystem. This paper has discussed the mechanism where web 3.0 based programming is made using Javascript, Python, ASP.NET and PHP for user authentication considering presence of smart contracts in user wallet.

A review of multi-factor authentication in the Internet of Healthcare Things.

This review paper aims to evaluate existing solutions in healthcare authentication and provides an insight into the technologies incorporated in Internet of Healthcare Things (IoHT) and multi-factor authentication (MFA) applications for next-generation authentication practices. Our review has two objectives: (a) Review MFA based on the challenges, impact and solutions discussed in the literature; and (b) define the security requirements of the IoHT as an approach to adapting MFA solutions in a healthcare context. To review the existing literature, we indexed articles from the IEEE Xplore, ACM Digital Library, ScienceDirect, and SpringerLink databases. The search was refined to combinations of 'authentication', 'multi-factor authentication', 'Internet of Things authentication', and 'medical authentication' to ensure that the retrieved journal articles and conference papers were relevant to healthcare and Internet of Things-oriented authentication research. The concepts of MFA can be applied to healthcare where security can often be overlooked. The security requirements identified result in stronger methodologies of authentication such as hardware solutions in combination with biometric data to enhance MFA approaches. We identify the key vulnerabilities of weaker approaches to security such as password use against various cyber threats. Cyber threats and MFA solutions are categorised in this paper to facilitate readers' understanding of them in healthcare domains. We contribute to an understanding of up-to-date MFA approaches and how they can be improved for use in the IoHT. This is achieved by discussing the challenges, benefits, and limitations of current methodologies and recommendations to improve access to eHealth resources through additional layers of security.

A Provable Secure Cybersecurity Mechanism Based on Combination of Lightweight Cryptography and Authentication for Internet of Things

Internet of Things devices, platform programs, and network applications are all vulnerable to cyberattacks (digital attacks), which can be prevented at different levels by using cybersecurity protocol. In the Internet of Things (IoT), cyberattacks are specifically intended to retrieve or change/destroy sensitive information that may exceed the IoT’s advantages. Furthermore, the design of a lightweight cybersecurity mechanism experiences a critical challenge that would perfectly fit resource-constrained IoT devices. For instance, identifying the compromised devices and the users’ data and services protection are the general challenges of cybersecurity on an IoT system that should be considered. This paper proposes a secure cybersecurity system based on the integration of cryptography with authentication (ELCA) that utilizes elliptic curve Diffie–Hellman (ECDH) to undertake key distribution while the weak bits problem in the shared secret key is resolved. In this paper, three systems of integration are investigated, while ELCA proposes secure integration between authentication and encryption to facilitate confidentiality and authenticity transfer messages between IoT devices over an insecure communication channel. Furthermore, the security of ELCA is proven mathematically using the random oracle model and IoT adversary model. The findings of the emulation results show the effectiveness of ELCA performance in terms of a reduced CPU execution time by 50%, reduced storage cost by 32–19.6%, and reduced energy consumption by 41% compared to the baseline cryptographic algorithms.

Application of Physical Unclonable Function for Lightweight Authentication in Internet of Things

IoT devices rely on authentication mechanisms to render secure message exchange. During data transmission, scalability, data integrity, and processing time have been considered challenging aspects for a system constituted by IoT devices. The application of physical unclonable functions (PUFs) ensures secure data transmission among the internet of things (IoT) devices in a simplified network with an efficient time-stamped agreement. This paper proposes a secure, lightweight, cost-efficient reinforcement machine learning framework (SLCR-MLF) to achieve decentralization and security, thus enabling scalability, data integrity, and optimized processing time in IoT devices. PUF has been integrated into SLCR-MLF to improve the security of the cluster head node in the IoT platform during transmission by providing the authentication service for device-to-device communication. An IoT network gathers information of interest from multiple cluster members selected by the proposed framework. In addition, the software-defined secured (SDS) technique is integrated with SLCR-MLF to improve data integrity and optimize processing time in the IoT platform. Simulation analysis shows that the proposed framework outperforms conventional methods regarding the network’s lifetime, energy, secured data retrieval rate, and performance ratio. By enabling the proposed framework, number of residual nodes is reduced to 16%, energy consumption is reduced by up to 50%, almost 30% improvement in data retrieval rate, and network lifetime is improved by up to 1000 msec.

A Multi-Stage Secure IoT Authentication Protocol

The Internet of Things (IoT) is a network of heterogeneous and smart devices that can make decisions without human intervention. It can connect millions of devices across the universe. Their ability to collect information, perform analysis, and even come to meaningful conclusions without human capital intervention matters. Such circumstances require stringent security measures and, in particular, the extent of authentication. Systems applied in the IoT paradigm point out high-interest levels since enormous damage will occur if a malicious, wrongly authenticated device finds its way into the IoT system. This research provides a clear and updated view of the trends in the IoT authentication area. Among the issues covered include a series of authentication protocols that have remained research gaps in various studies. This study applies a comparative evaluation of authentication protocols, including their strengths and weaknesses. Thus, it forms the foundation in the IoT authentication field of study. In that direction, a multi authentication architecture that involves secured means is proposed for protocol authentication. Informal analysis can affect the security of the protocols. Burrows-Abadi-Needham (BAN) logic provides proof of the attainment of mutual authentication. NS3 simulator tool is used to compare the performance of the proposed protocol to verify the formal security offered by the BAN logic.

Privacy‐preserving hands‐free voice authentication leveraging edge technology

AbstractAlthough speech recognition technology has improved significantly over the past few years, the absence of reliable voice authentication methods has negatively affected the Internet of Things (IoT). Voice‐activated devices, by design, rely on personal voice biometrics for access‐level security, and insecure voice authentication techniques limit the development of voice interfaces that can deal with multiple users with different privileges. Furthermore, public concerns surrounding biometric systems have been reported. Outsourcing biometric data are liable to various privacy breaches, increasing vulnerability to cyberattacks from both criminal organizations and government agencies. In this article, we address the security and privacy challenges of voice authentication for IoT by presenting an edge‐based, hands‐free, single‐factor authentication scheme that consists of three security‐based features: random phrase verification, anti‐spoof verification, and text‐independent speaker recognition. The use of edge technology allows the integration of this authentication scheme with resource contained IoT devices such as voice assistants. Additionally, privacy is ensured by a novel security protocol that uses chaffing and encryption techniques to protect the users' biometric data stored locally on the edge device. Finally, the scheme does not compromise the user experience as it requires only two short voice inputs.

Database Watermarking Algorithm Based on Decision Tree Shift Correction

With the transmission and sharing of data in the Internet of Things (IoT), while bringing development to life and the economy, it also inevitably threatens the data copyright protection and authentication. Digital watermarking technology can provide an effective solution for copyright protection by embedding the watermark in the data to prove the copyright attribution. The existing methods of digital watermarking in IoT mainly target multimedia, without considering the copyright authentication in database data. Unlike multimedia information, the database does not focus on the subjective visual perception when using the data, but rather on the potential values unlocked from the data through algorithms such as data mining. Therefore, we propose a new database watermarking algorithm based on decision tree shift correction (DTSC), considering the data copyright authentication and usability when applying for data mining algorithm. The algorithm adjusts the watermarked data by the DTSC method and makes the watermarked decision tree identical to the original in the iteration process. It solves the problem of database data copyright authentication in IoT and ensures the usability of the data when used for decision tree model construction. From the simulation results, it can be seen that the proposed method ensures the usability of the data for the classification and regression tree decision tree algorithm while embedding the watermark in the database data, and the data distortion of the proposed method does not differ from that of the traditional watermarking algorithm.

Co-Learning to Hash Palm Biometrics for Flexible IoT Deployment

Security enhancement via trustworthy identity authentication in Internet of Things (IoT) has soared recently. Biometrics offers a promising remedy to improve the security and utility of IoT and play a role in securing a variety of low-power and limited computing capability IoT devices to address identity management challenges. This article proposes an IoT-compliant co-learned biometric hashing network derived from palm print and palm vein dubbed PalmCohashNet. The PalmCohashNet comprises two hashing subnetworks, one for each palm modality, and is trained collaboratively to generate shared hash codes for respective modality (co-hash codes). A cross-modality hashing (CMH) loss is devised to encourage co-hash codes of palm vein and palm print from the same identity to be adjacent and consistent; meanwhile, pull the co-hash codes of each identity to a preassigned identity-specific hash centroid that is shared by both palm modalities. Two palm-based co-hash codes of a person can be generated simultaneously for deployment. The binary co-hash code is IoT compliant attributed to its highly compact form for storage and fast matching. A trained PalmCohashNet can be flexibly deployed under four operation modes: single-modality matching (print versus print or vein versus vein), multimodality matching where both print and vein are utilized, and cross-modality matching (print versus vein) depending on the IoT service context. Our empirical results on four publicly available palm databases show that the proposed method consistently outperforms state-of-the-art methods.

Security of a PUF Mutual Authentication and Session Key Establishment Protocol for IoT Devices

Recently, Zerrouki et al. proposed a Physically Unclonable Function (PUF) mutual authentication and session key establishment protocol for IoT (Internet of Things) devices. Zerrouki et al.’s PUF protocol is interesting because it does not require the storage of any sensitive information on the local memory of the IoT device, which avoids many potential attacks, especially side-channel attacks. Therefore, we carefully investigate the security of Zerrouki et al.’s PUF protocol under the leakage assumption of the session key. Our findings are in the following. First, Zerrouki et al.’s PUF protocol fails to provide known-key security. That is, the adversary can impersonate not only the server to cheat the IoT device but also the IoT device to cheat the server when the adversary corrupts a session key between the server and the IoT device. Second, Zerrouki et al.’s PUF protocol suffers from the key-compromise impersonation attack. It means that the adversary can impersonate the IoT device to cheat the server if the adversary discloses the server’s secret key. Third, Zerrouki et al.’s PUF protocol does not support backward secrecy for the session key. That is, the adversary is always able to derive the session key from the previous session key. We also suggest the root cause of these security flaws in Zerrouki et al.’s PUF protocol. As a case study, our cryptanalysis results would promote a security model for more robust and efficient PUF authentication and session key establishment protocol. Moreover, our idea of the key compromise can be used to evaluate other novel PUF protocol designs.

Graphical-based password for user authentication in internet of things

Internet of Things has become a significant and evolving technology that cannot be avoidable in most of the sectors. However, the Internet of Things security became a concern due to the huge amount of the sensitive data that transferring through IoT resources. Secure the users' authentication process of the IoT is the first line of defense to protect the users' data from violation. Typically, the alphanumeric-based password is the popular method to authenticate the users of the IoT. But it is a vulnerable mechanism that can be violated easily. For that, this research aims to develop a graphical-based password scheme to support the traditional text password in the IoT technology. The proposed scheme is a hybrid (Two-factor) approach, based on two types of Knowledge-based Authentication method (alphanumeric-based password and graphical-based password) naming as IoT-GP. IoT-GP aims to improve the users' authentication security considering the usability enhancement. The results obtain from the conducted field study indicated that IoT-GP significantly improved the security and the usability. The results of the password entropy and password space indicated that IoT-GP obtained a high rate comparing to another schemes, which reflected on the IoT-GP ability to resist the guessing and brute force attacks.

Distributed privacy-preserving nested compressed sensing for multiclass data collection with identity authentication

With the increase of new sensing devices in Internet of things (IoT), data dimensions and types have risen dramatically. The traditional data collection structure cannot satisfy the requirements for multiclass data and access control. By integrating fog computing, we design a layer-aware fog computing model which supports a distributed privacy-preserving compressed sensing (CS) for multiclass data with identity authentication in fog-assisted IoT. In our model, a novel distributed nested CS scheme samples and compresses the encrypted multiclass data in the sensing layer. The encrypted sampling data is transmitted to the fog node. Subsequently, the fog node embeds the identity watermark for later VIP user authentication in the cloud. Then, the fog uploads the watermarked data to the cloud for storage and reconstruction. When receiving the request, all results returned by the cloud are encrypted versions. In particular, the cloud performs the designed reconstruction transformation task on the sensing data for security. Specifically, the cloud only reconstructs sensing data for general users, but returns all multiclass data to the authenticated VIP users. In the experiment, we analyze the security of our scheme, discuss the impact of parameters on the reconstruction performance of different data, and summarize the recommended parameter settings.

Quality of Service aware secure data transmission model for Internet of Things assisted wireless sensor networks

AbstractWireless sensor networks (WSNs) are the most critical networks in developing various Internet of Things (IoT) based applications. However, such intelligent devices have drawbacks for energy, memory, processing, and computation resources. In addition, achieving Quality of Service (QoS) with secure data transmission (DT) is a significant challenge for WSNs. This article proposes efficient IoT authentication and energy‐aware safe DT models for achieving better QoS and security with lower energy consumption (EC) in WSNs. Initially, the network randomly deploys the sensor nodes (SNs) and performs the registration of the SNs with the base station (BS). Second, the Entropy‐based Jaccard similarity induced fuzzy C‐means clustering (EJS‐FCM) model clusters the SNs based on the intrinsic qualities of nodes. Then the boosted grasshopper optimization algorithm (BGOA) selects the cluster heads (CHs) optimally by considering major fitness parameters such as communication distance, energy, and distance centroid. Following that, an Adler‐32 hashing‐based authentication scheme performs authentication of every IoT node deployed in the network to provide safer DT. After successful authentication, secure hash elliptical curve cryptography (SHECC) encrypts the data collected from the CHs by incorporating a hashing function both in encryption and decryption, enhancing the IoT data's security level. Finally, in a cloud server (CS), the decentralized blockchain (BC) stores the encrypted data and the authentication credentials of the IoT devices from the BS, which provide additional security to the network. The results of the presented model show its performance efficiency over existing approaches for energy efficiency (EE), QoS, and security.

An Improved Lightweight PUF–PKI Digital Certificate Authentication Scheme for the Internet of Things

Prosanta and Biplab presented a lightweight two-factor authentication scheme for the Internet of Things (IoT) devices based on the physical unclonable function (PUF). Their presented scheme was based on the fuzzy extractor and analyzed various security reasonings, such as mutual authentication, session key agreement, privacy and protection against impersonation, message tampering, and replay attacks. In this article, we present sufficient security analysis to demonstrate that the scheme has various security and privacy issues in its setup and authentication phases. We propose a highly secure and robust authentication protocol based on a public key infrastructure (PKI) digital certificate based on two certificate authorities (CAs) for cloud IoT systems. The proposed authentication method is verified and validated using the Tamarin prover and supported with a detailed security and performance analysis discussion. The scheme security and privacy attributes are compared with other IoT authentication schemes. The analysis has proved that the proposed authentication scheme is more secure and highly reliable as compared to the Prosanta and Biplab authentication scheme.

AutoCert: Automated TOCTOU-secure digital certification for IoT with combined authentication and assurance

The Internet of Things (IoT) network is comprised of heterogeneous devices which are part of critical infrastructures throughout the world. To enable end-to-end security, the Public Key Infrastructure (PKI) is undergoing advancements to incorporate IoT devices globally which primarily provides device authentication. In addition to this, integrity of the software-state is vital, where Remote Attestation (RA) and Integrity Certificates play an important role. Though, Integrity Certificate verifies the software-state integrity of the device at the time of execution of the remote attestation process, it does not provide mechanisms to validate that the current software-state corresponds to the attested state. This issue is referred to as the Time-Of-Check to Time-Of-Use (TOCTOU) problem and remains unsolved in the context of Integrity Certificates.In this paper, we propose AutoCert, the first TOCTOU-secure mechanism to combine software-state integrity with PKI for IoT which resolves the TOCTOU problem in RA and Integrity Certificates. To this end, we utilize the IETF Remote Attestation Procedures architecture and standard X509 IoT profile certificates to ensure both device authentication and software assurance for IoT. We implement and evaluate the performance of the AutoCert proof-of-concept on a real IoT device, the OPTIGA TPM Evaluation Kit, to show its practicality and usability. AutoCert can validate the attested state of an IoT device in approximately 4746 milliseconds, with a minimal network overhead of 350 bytes.