Proposed Authentication Protocol Research Articles

Joint Heterogeneous PUF-Based Security-Enhanced IoT Authentication

This study proposes a novel authentication scheme that provides enhanced security for Internet of Things (IoT) applications by integrating a radio frequency (RF) physical unclonable function (PUF) with a device PUF. While traditional PUF-based authentication methods are lightweight, they are vulnerable to replay attacks because challenge-response pairs (CRPs) are exposed to adversaries over wireless channels. To prevent CRP exposure, we propose a joint scheme that integrates the physical layer features of wireless channels with those of the device PUF. Our authentication process consists of two stages: an enrollment stage and an authentication stage. During the enrollment stage, the physical features of the static random-access memory (SRAM) in the IoT devices are shared with the server, which generates a hashing model using the amplitudes of channel state information (CSI) as the RF-PUF and transfers it to the IoT device. In the authentication stage, the server and IoT devices exchange pilot signals to estimate the shared CSI. Both parties then generate the challenge information using the hashing model, which depends on the CSI. The challenge information is mapped to the response of the device PUF as the cryptographic key. If both parties are legitimate, the proposed model is updated through CSI amplitudes. We evaluated the proposed authentication protocol using a testbed based on Raspberry Pi and acquired a CSI dataset and SRAM-PUF using universal software radio peripheral and Arduino, respectively. Numerical results demonstrate that our method effectively defends against diverse attacks, even in critical CRP exposure scenarios.

Blockchain-based DDoS attack mitigation protocol for device-to-device interaction in smart home

Smart home devices are vulnerable to a variety of attacks. The matter gets more complicated when a number of devices collaborate to launch a colluding attack (e.g., Distributed-Denial-of-Service (DDoS)) in a network (e.g., Smart home). To handle these attacks, most studies have hitherto proposed authentication protocols that cannot necessarily be implemented in devices, especially during Device-to-Device (D2D) interactions. Tapping into the potential of Ethereum blockchain and smart contracts, this work proposes a lightweight authentication mechanism that enables safe D2D interactions in a smart home. The Ethereum blockchain enables the implementation of a decentralized prototype as well as a peer-to-peer distributed ledger system. The work also uses a single server queuing system model and the authentication mechanism to curtail DDoS attacks by controlling the number of service requests in the system. The simulation was conducted twenty times, each with varying number of devices chosen at random (ranging from 1 to 30). Each requester device sends an arbitrary request with a unique resource requirement at a time. This is done to measure the system's consistency across a variety of device capabilities. The experimental results show that the proposed protocol not only prevents colluding attacks, but also outperforms the benchmark protocols in terms of computational cost, message processing, and response times.

A Secure and Efficient Access Control Scheme for Shared IoT Devices over Blockchain

The concept of shared IoT devices has attracted much attention from the industry sector, academia, and financial institutions, providing various benefits, such as saving resources, reducing personal expenses, and providing convenience. Although shared IoT devices facilitate people’s lives and work, the information exchange is over wireless networks that may suffer from some security attacks such as unauthorized access to a shared device or some private information of legitimate users being leaked. It makes the secure access control to the shared IoT devices become an intractable issue. In order to guarantee the access right of the legitimate users, to prevent the problems of privacy leakage and unnecessary economic disputes, a secure decentralized access control scheme for shared IoT devices is proposed leveraging the technologies of blockchain and a proposed authentication protocol in this paper. The new lightweight authentication protocol is proposed to perform mutual authentication between the user and the IoT device. To protect the privacy of the user, the instruction data are encrypted by a temporary session key negotiated between the user and the IoT device with the help of blockchain which enables nontamperable transactions and prevents central corruption and single point of failure. In our scheme, blockchain is maintained by the gateway nodes an acts as a distributed database and a smart contract for shared service is deployed on it. The smart contract has three functions in our scheme: (1) achieving the prepayment of users and settlement for the service contributor, (2) participating in a verification step during the key negotiation to prevent some malicious behaviour from users or devices, (3) recording the workload of the gateway. Finally, a comprehensive analysis on the safety and reliability of the entire scheme is carried out; extensive simulation experiments are conducted to reveal the authentication protocol is efficient and the scheme is feasible.

A Secure and Efficient Multiserver Authentication and Key Agreement Protocol for Internet of Vehicles

Internet of Vehicles (IoV) being a subdivided application of the Internet of Things, is considered as one of the most prominent and emerging technologies for model transportation systems. However, security and privacy remain two key requirements for IoV networks, as communications between vehicles and other Internet-connected things are generally carried out over public channels. Some of the most typical attack issues for the IoV networks include hardware tampering, unauthorized data access, message modification, tracking vehicle locations, etc. Although there have been a number of solutions (e.g., mutual authentication and key agreement protocols) proposed to ensure the secure communication for IoV, most of them still suffer from some vulnerabilities, such as linkability, server spoofing, and replay attacks, in violation of the security requirements of IoV. Hence, it remains challenging to design secure and efficient solutions. In this article, we first take a recently proposed authentication protocol as an example and analyze the weaknesses of it with simple mathematical analysis. We then propose an improved multiserver-based authentication and key agreement protocol for IoV (called SeMAV), which applies the password and smart card to hide the private keys. We also present both formal and informal security proofs to confirm the robustness against those commonly known attacks. The theoretical comparative summary and simulation results also show that SeMAV can achieve a good performance when compared with some other related protocols in the literature.

Enhanced pairing‐free identity‐based broadcast authentication protocol in WSN using ElGamal ECC

AbstractAuthentication among the various communicating devices within wireless sensor networks during broadcasting is most significant among the other primary security services. This authentication during broadcasting services allows multiple mobile end‐devices to transmit messages dynamically and securely for fasten consumer tracking and sustaining privacy of the data transferred in the insecure sensor network. To enhance this authentication protocol for secure end‐users message distribution, this research work has introduced a novel identity (ID) based cryptographic technique that employs ElGmal‐elliptic‐curve cryptography and digital signature without implementing bilinear paring operation to reduce huge burden of computation overhead. Additionally, to accelerate the performance of the proposed authentication protocol, the size of the signature along with the encryption key is minimized. Eventually, the authentication protocol provides comparatively less computational complexity with secure and faster key management. The performance analysis supports the aforesaid claim as well as reflects the supremacy of the proposed scheme over the handover authentication protocol and bilinear pairings based authentication schemes.

A lightweight mutual and transitive authentication mechanism for IoT network

IoT devices are typically authenticated directly by gateways present in the network. However, in large and complex IoT systems like the smart city or smart industry which consist of thousands of connected devices, it may not be always feasible to be directly connected to the gateway while it may be possible to be connected to another device. Therefore, already authenticated devices should facilitate the new device to get authenticated by the gateway. To address this issue, the existing protocols use multiple authentication protocols based on different cryptography techniques, which are difficult to implement and manage in resource constrained IoT devices. In this paper, we propose a Transitive device authentication protocol based on the Chebyshev polynomial. The transitive authentication protocol utilizes the session key established in the mutual authentication between the intermediate device and gateway. Both the mutual authentication and transitive authentication protocols are relying on the same preregistration and authentication mechanism. To ensure the security of the proposed authentication protocol, detailed security analysis is carried out, and the secure session key establishment is verified using the BAN logic. Moreover, the proposed protocol is tested against crucial attacks in the Scyther tool. These formal analyses and Scyther attack simulation show that the proposed protocol is capable of withstanding critical attacks. Finally, to verify the efficiency, the protocol implementation is experimentally compared with similar approaches studied in the literature. The results show that the proposed protocol offers better performance, providing significantly lower response time, handshake duration, memory utilization, and energy consumption.

Secure and Efficient WBAN Authentication Protocols for Intra-BAN Tier

Telecare medical information system (TMIS) is a technology used in a wireless body area network (WBAN), which has a crucial role in healthcare services. TMIS uses wearable devices with sensors to collect patients’ data and transmit the data to the controller node via a public channel. Then, the medical server obtains the data from the controller node and stores it in the database to be analyzed. Unfortunately, an attacker can try to perform attacks via a public channel. Thus, establishing a secure mutual authentication protocol is essential for secure data transfer. Several authentication schemes have been presented to achieve mutual authentication, but there are performance limitations and security problems. Therefore, this study aimed to propose two secure and efficient WBAN authentication protocols between sensors and a mobile device/controller: authentication protocol-I for emergency medical reports and authentication protocol-II for periodic medical reports. To analyze the proposed authentication protocols, we conducted an informal security analysis, implemented BAN logic analysis, validated our proposed authentication protocol using the AVISPA simulation tool, and conducted a performance analysis. Consequently, we showed that our proposed protocols satisfy all security requirements in this study, attain mutual authentication, resist active and passive attacks, and have suitable computation and communication costs for a WBAN.

Design of a secure and privacy preserving authentication protocol for telecare medical information systems

AbstractWith the advancement of communication technology, Telecare Medicine Information Systems (TMIS) provides convenient healthcare services for patients, doctors, and health organizations over the insecure Internet. As a result, when accessing sensitive medical data over an insecure connection, user privacy, data security, and user authentication is very crucial. A secure authentication protocol plays a crucial role in securing communications over TMIS, these environments are very vulnerable to numerous attacks due to resource constraints and the nature of the communication medium. Recently, an efficient authentication framework has been introduced for TMIS to address various security issues. However, the existing mutual authentication and key agreement protocols are vulnerable to replay attacks, insider attacks, impersonation attacks, and password guessing attacks. Furthermore, the current authentication systems do not guarantee user privacy and the fair key agreement between the patient and the medical server. We propose a more robust authentication approach for healthcare information systems to address these security issues. To assess the authentication protocol's security strength, we employ formal verification tools like Automated Validation of Internet Security Protocols and Applications (AVISPA). Finally, a thorough performance analysis demonstrates that the proposed mutual authentication framework not only ensures privacy but also maintains a low computing overhead. As a result, when compared to other related systems, the proposed authentication protocol is both secure and computationally efficient.

A new RFID ultra-lightweight authentication protocol for medical privacy protection in smart living

The widespread application of Radio Frequency Identification (RFID) technology in smart living, especially in smart healthcare, has greatly facilitated patient management, reduced the labor cost of medical services, and provided patients with better medical services. However, improper use of RFID tags is highly likely to threaten the safety and privacy of hospitals and even patients, which may not only cause physical and mental harm to patients but also damage the reputation of hospitals. Medical monitoring system based on RFID technology plays a significant role in guaranteeing the security of medical records as well as the privacy of patients. Nevertheless, due to the resource constraint of RFID tags/readers, it is also challenging to design an efficient and effective authentication protocol for RFID medical monitoring system. Aiming to reduce the resource overhead and meet security requirements of the RFID system, in this paper, we propose an ultra-lightweight RFID security authentication protocol utilizing a cloud server named CRUSAP, which is based on Bit-Crossing XOR rearrangement operations that can effectively resist forgery attacks, replay attacks, desynchronization attacks, and denial of service attacks while certifying the cloud server. The formal logic of BAN proves the safety and feasibility of the protocol. Additionally, the security analysis and experimental results show that the proposed authentication protocol can realize higher security goals at a lower cost and is more suitable for scaling to large-scale authentication.

Multilevel authentication protocol for enabling secure communication in Internet of Things

AbstractThe Internet of Things (IoT) is the domain of interest for researchers with exponential growth in technology. This article develops an authentication protocol based on the Chebyshev polynomial, hashing function, session password, and encryption. The proposed authentication protocol is named as proposed Elliptic, Chebyshev, Session password, and Hash function (ECSH)‐based multilevel authentication. For authenticating the incoming user, there are two phases, registration and authentication. In the registration phase, the user is registered with the server and authentication center (AC), and the authentication follows, which is an eight‐step criterion. The authentication is duly based on the scale factor of the user and server, session password, and verification messages. The authentication at the eight levels assures the security against various types of attacks and renders secure communication in IoT with minimal communication overhead and packet loss. The performance is analyzed using black‐hole, and denial‐of‐service (DOS) attacks with 50 and 100 nodes in the simulation environment. The proposed ECSH‐based multilevel authentication acquired the maximal detection rate, PDR, and QoS of 15.2%, 35.7895%, and 26.4623%, respectively, for 50 nodes with DOS attacks. By contrast, the minimal delay of 135.922 ms is acquired in the presence of 100 nodes and DOS attacks.

A Model to Evaluate Reliability of Authentication Protocols in C-ITS Safety-Critical Applications

In the near future, Vehicle-to-Vehicle (V2V) transmission will enable wireless broadcast communication among nearby vehicles. Benefits for users include improved driver safety and potentially optimized traffic. However, this communication is vulnerable to cyber attacks involving message manipulation. Research aimed at tackling this problem has resulted in the proposal of multiple authentication protocols. The security, privacy, and other desirable features of authentication in vehicular networks have been widely studied. However, the efficiency of such authentication schemes has not been suitably addressed. There is no model to evaluate the efficiency of the proposals in a practical context, where the delay introduced by V2V authentication may impact on driver safety. In this paper, we provide such a model for evaluation. We explicitly present the key factors involved to evaluate the computational delay in the V2V authentication protocols. Our model has clearly defined metrics for computing the delay and evaluating the impact. Developing this model enables future research in the design of secure and efficient V2V authentication protocols suitable for practical application. Applying the model to assess proposed authentication protocols permits categorization based on safety service they can support. We demonstrate the applicability of our model through case studies. Our model can effectively analyze the delay introduced by an authentication protocol, and determine whether this would result in a crash, in the real world vehicular environments.

Learning with error‐based key agreement and authentication scheme for satellite communication

SummarySatellite communication is one of the essential communication mechanisms that can be used for significant distance and under circumstances where the other communication mechanisms cannot work. Therefore, the security of this communication method is highly needed. Because in this era where information plays an important role, information security becomes the first priority for everyone. When we talk about information security, the key exchange and authentication are two key factors of information security. Whitfield Diffie and Martin Hellman1 proposed the first key exchange protocol. In the last two or three decades, various authentication schemes have been proposed to create a secure network that mainly depends on classical number–theoretical hard assumptions (factorization or discrete logarithm), but due to the Shor's2 algorithm, above‐mentioned scheme is no longer secure because any discrete logarithm or factorization problems can be solved by Shor's algorithm in polynomial time if the quantum computer becomes the reality soon. As far as our knowledge goes, there is no authentication protocol for satellite communication, which is secure against quantum computer attacks. Therefore, in this paper, we first proposed authentication protocol for satellite communication based on ring learning with error which is secure against quantum attacks.

A Novel Privacy-Preserving Authentication Protocol Using Bilinear Pairings for the VANET Environment

With the rapid development of communication and microelectronic technology, the vehicular ad hoc network (VANET) has received extensive attention. However, due to the open nature of wireless communication links, it will cause VANET to generate many network security issues such as data leakage, network hijacking, and eavesdropping. To solve the above problem, this paper proposes a new authentication protocol which uses bilinear pairings and temporary pseudonyms. The proposed authentication protocol can realize functions such as the identity authentication of the vehicle and the verification of the message sent by the vehicle. Moreover, the proposed authentication protocol is capable of preventing any party (peer vehicles, service providers, etc.) from tracking the vehicle. To improve the efficiency of message verification, this paper also presents a batch authentication method for the vehicle to verify all messages received within a certain period of time. Finally, through security and performance analysis, it is actually easy to find that the proposed authentication protocol can not only resist various security threats but also have good computing and communication performance in the VANET environment.

Security mechanism for maritime territory and frontier surveillance in naval operations using wireless sensor networks

SummaryIn an underwater environment, wireless sensor networks (WSNs) have more potential applications such as homeland safety, naval surveillance, and pollution & exploration monitoring. Underwater wireless sensor networks (UWSNs) help in decreasing the rate of causalities and provide efficient ways for monitoring the underwater activities of the other countries. UWSNs can be efficiently used by the navy to monitor suspicious activities and also to counter‐attack any terrorist or enemy attacks. As usual, deploying wireless sensor networks underwater is not only challenging due to environment and constrained resources but also is vulnerable to security attacks. Thus, security is an unexplored and crucial aspect of UWSNs. Here, we define a node authentication mechanism for UWSNs for securing frontier lines, maritime territory, and naval surveillance. The proposed authentication protocol is based on symmetric‐key cryptography and secures against impersonation, masquerade, Sybil, and many more other attacks. We have analyzed the proposed protocol both formally and automatedly and were unable to find any possible security attack on the proposed protocol. The experimental analysis of the mechanism proved that the proposed mechanism consumes less energy compared to the existing mechanisms. Hence, the proposed mechanism can be easily adopted for maintaining the security of maritime territory and reduce the causalities in naval operations.

Authenticated secret session key using elliptic curve digital signature algorithm

AbstractElliptic curve Diffie‐Hellman (ECDH) scheme is the basic key exchange used in elliptic curve cryptography. ECDH is a public key cryptosystem based on the discrete logarithm problem, but is vulnerable to man‐in‐the‐middle attack because it does not authenticate the secret session key. The integration of the elliptic curve digital signature allows authenticating the secret session key of the ECDH scheme (A‐ECDH). However, it is a technique (A‐ECDH) that uses a single random variable and it has been shown in the literature that a single random variable does not make the system secure. Therefore, the use of two random variables has been suggested to secure an authentication scheme. In this paper, a new authentication scheme using the elliptic curve digital signature algorithm is proposed. The performance analysis of the proposed authentication protocol is performed. The comparative results from the perspective of security and computation time showed that the proposed authentication protocol is more efficient in terms of computation time compared to the related works and it provides all the security features.

Challenge-response mutual authentication protocol for EMV contactless cards

Europay MasterCard and Visa (EMV) is the most popular payment protocol with almost 7.1 billion EMV based credit and debit cards around the world. This payment protocol supports different kinds of payment transactions such as Chip & PIN, Chip & signature, contactless card, and mobile payment transactions. This paper focuses on the EMV contactless card transactions and highlights one of such transactions’ vulnerabilities that allows attackers to gain access to most of the EMV card sensitive information using off-the-shelf hardware and software. In the EMV card payment protocol, the EMV card must authenticate itself as a genuine card to the point of Sale (POS) in each transaction while the reverse is not happening. An attacker can take an advantage of such vulnerabilities in the EMV specifications especially in contactless cards due to the wireless connectivity between the cards and POSs. In this paper, we propose a cost-effective mutual-authentication solution that relies on two-way challenge-response between EMV contactless cards and POSs in order to prevent sniffing attacks launched by NFC enabled readers or smartphones. To demonstrate the viability of the proposed authentication protocol, we present a Java framework to illustrate the practicality of the proposed solution. The paper argues that the proposed protocol can be easily integrated into the EMV infrastructure with minor changes at the personalization and transaction phases.

On the Design of Lightweight and Secure Mutual Authentication System for Global Roaming in Resource-Limited Mobility Networks

A secure authentication protocol plays a crucial role in securing communications over wireless and mobile networks. Due to resource-limitations and the nature of the wireless channel, the global mobile networks are highly susceptible to various attacks. Recently, an efficient authentication system for global roaming has been proposed in the literature. In this article, we first show that the analyzed authentication system is vulnerable man-in-the-middle attack, replay attack and Denial-of-Service (DoS) attack, and it does not ensure untraceability and local password-verification process to identify wrong passwords. To fix these security flaws, we propose a more efficient and robust authentication system for roaming in mobility networks. We use the formal verification tools like ProVerif, Automated Validation of Internet Security Protocols and Applications (AVISPA) and Burrows-Abadi-Needham (BAN) logic to check the regularity of the authentication protocol. Moreover, we prove the secrecy of a session key through the formal security using the random oracle model, known as Real-Or-Random (ROR) model. Finally, a detailed performance evaluation proves that the security protocol not only provides a security strength, but also preserves the low computational overhead. Thus, the proposed authentication protocol is secure and computationally efficient as compared to other relevant schemes.

An ECC-based authentication protocol for fog-IoT enabled smart home environment

Internet of things (IoT)-enabled smart home means all the home appliances are connected to the internet. All these devices are monitored and controlled using a mobile device, iPhone, or iPad regardless of location or time constraint. In an IoT-based smart home network, associated users and devices need to be recognised otherwise unauthorised access reduce the security and privacy of the smart environment. In this paper, contributions are first proposed as an elliptical curve cryptography-based authentication protocol for fog nodes and users in the IoT-based smart home environment. Secondly, the simulation for security analysis of the proposed authentication protocol using AVISPA tools has been done. Thirdly, BAN logic is used to verify that the devices in the smart home environment have achieved the security goals. Finally, a comparison with some existing works has been done and it has been seen that proposed protocol achieved better security goals in a smart home environment.

BIOMETRIC BASED THREE-FACTOR MUTUAL AUTHENTICATION SCHEME FOR ELECTRONIC PAYMENT SYSTEM USING ELLIPTIC CURVE CRYPTOGRAPHY

Electronic payment system plays a vital role in e-commerce and other financial transactions with ever-increasing acceptance of smart device based applications. To ensure secure transactions, various authentication schemes have been proposed in recent times. But existing password and smart card-based traditional e-payment systems have some limitations and also raises security concerns. However, they consume more energy and are not feasible for the e-payment system as it consists of resource constraint devices like mobile devices. Furthermore, it is prone to security issues if the password is guessed or smart card is stolen. Thus to enhance the security and to reduce the computational cost, biometric authentication based payment protocol using elliptic curve cryptography is proposed. Since biometric features are unique and also cannot be stolen or reproduced. The proposed system resists various security attacks like impersonation attack, replay attack, session key agreement, man-in-the-middle attack, and user anonymity. Furthermore, it reduces computational and communication costs when compared to other protocols as it exploits ECC. Thus the proposed authentication protocol is convenient for the electronic payment system. A simulation tool, AVISPA is utilized to verify the security of designed payment protocol and BAN logic for formal security analysis.

Analysis of the authentication scheme based on the use of QR-code and webcam for Smart-Mobile devices

The paper analyzes the necessity and expediency of using the method of user authentication based on QR-code and webcam for Smart-Mobile devices. Phishing attacks are one of the most serious threats faced by Internet users. Existing authentication schemes are not able to provide an adequate protection from these attacks, as evidenced by statistics collected by the companies researching cybersecurity. Therefore, the task of developing a secure authentication scheme for users, which can effectively counteract various types of phishing attacks is very important. The paper proposes a new authentication scheme for users, which allows them to log in to their accounts without remembering passwords or presenting other authentication tokens. According to the messaging protocol in the proposed scheme, the user must scan the dynamically generated QR-code using a smartphone application, then take their own photo via the webcam, and send it to the smartphone via a message from the server. Thus, the full authentication procedure requires minimal user involvement and is performed automatically. The results of evaluation and practical testing show that the proposed authentication scheme is quite reliable and can be used as a secure user authentication scheme for Smart-Mobile devices. The proposed authentication protocol is not only able to cope with attacks such as Real Time Man-In-The-Middle and Controlled Relay Man-In-The-Middle, but can also protect users from the effects of malicious browser extensions and substitution of authentic applications by malicious variants. In addition, the proposed scheme does not require users to have any authentication tokens or credentials, as all they need is to scan the QR-code and verify the image taken by their own webcam. That makes the use of the proposed scheme more convenient and easy for users as compared to other known authentication schemes. Currently, the application of the proposed scheme requires the use of HTTPS websites for the exchange of all data involved. Thus, the proposed protocol can be implemented to manage cookies securely in order to prevent the interception of session data.