A Multifactor Multilevel and Interaction Based (M2I) Authentication Framework for Internet of Things (IoT) Applications

Abstract

Existing authentication solutions proposed for Internet of Things (IoT) provide a single Level of Assurance (LoA) regardless of the sensitivity levels of the resources or interactions between IoT devices being protected. For effective (with adequate level of protection) and efficient (with as low overhead costs as possible) protections, it may be desirable to tailor the protection level in response to the sensitivity level of the resources, as a stronger protection level typically imposes a higher level of overhead costs. In this paper, we investigate how to facilitate multi-LoA authentication for IoT by proposing a multi-factor multi-level and interaction based (M2I) authentication framework. The framework implements LoA linked and interaction based authentication. Two interaction modes, P2P (Peer-to-Peer) and O2M (One-to-Many), are investigated via the design of two corresponding protocols. Evaluation results show that adopting the O2M interaction mode in authentication in the related use-case scenarios can cut communication cost significantly; compared with that of the Kerberos protocol, the O2M protocol reduces the communication cost by 42%∼45%. The protocols are also more efficient. The P2P and O2M protocol, respectively, reduce the computational cost by 70%∼72% and 81%∼82%, in comparison with that of Kerberos. The evaluation results also show that the two-factor authentication option costs twice as much as that of the one-factor option.INDEX TERMS Internet of Things (IoT), level of assurance (LoA), interaction based authentication, multilevel authentication, re-authentication.

A Problem Analysis of Smart Home Automation: Toward Secure and Usable Communication-Based Authorization

“…An example use case is a smart air conditioner (ControllerActuator) that makes an automated decision based on the room temperature data received from a temperature sensor (Sensor), and switches itself on when the temperature exceeds a threshold. In our previous work [62,63], we have identified three types of device-to-device interactions showing three communication patterns, i.e., one-to-one, many-to-one, and one-to-many communication patterns. In this work, we expand this concept of interactions in two ways.…”

До Питання Безпечної Багатофакторної Аутентифікації У Веб-Застосунках

“…Цікавою є система автентифікації для додатків Інтернету речей, що реалізована як багатофакторна та багаторівнева і ґрунтується на взаємодії між пристроями ІоТ [9]. В праці [10] розглянуто метод автентифікації для регенерації JWT (веб-токен JSON) при кожному клієнтському запиті на основі випадкових значень мітки часу для підвищення автентичності клієнта на сервері. Багатофакторна автентифікація розгорнута новим механізмом на основі браузера, що використовує відбитки пальців і графічні паролі [11].…”

A Lightweight Multifactor Authentication Scheme for Wireless Sensor Networks in the Internet of Things

“…They found out that their new scheme performed better than other relevant schemes for maintaining efficient performance, meanwhile satisfying the security criteria. Similarly, [3] is concerned about a high security level that normally imposes a greater degree of overhead costs of any IoT authentication solution. As a result, they suggested a framework for multi-factor, multi-level, and interaction-based (M2I) authentication.…”