Cryptanalysis and Security Enhancement of Three Authentication Schemes in Wireless Sensor Networks

Abstract

Nowadays wireless sensor networks (WSNs) have drawn great attention from both industrial world and academic community. To facilitate real-time data access for external users from the sensor nodes directly, password-based authentication has become the prevalent authentication mechanism in the past decades. In this work, we investigate three foremost protocols in the area of password-based user authentication scheme for WSNs. Firstly, we analyze an efficient and anonymous protocol and demonstrate that though this protocol is equipped with a formal proof, it actually has several security loopholes been overlooked, such that it cannot resist against smart card loss attack and violate forward secrecy. Secondly, we scrutinize a lightweight protocol and point out that it cannot achieve the claimed security goal of forward secrecy, as well as suffering from user anonymity violation attack and offline password guessing attack. Thirdly, we find that an anonymous scheme fails to preserve two critical properties of forward secrecy and user friendliness. In addition, by adopting the “perfect forward secrecy (PFS)” principle, we provide several effective countermeasures to remedy the identified weaknesses. To test the necessity and effectiveness of our suggestions, we conduct a comparison of 10 representative schemes in terms of the underlying cryptographic primitives used for realizing forward secrecy.

Physically Secure Lightweight Anonymous User Authentication Protocol for Internet of Things Using Physically Unclonable Functions

“…Amin et al [47] presented a user authentication protocol for distributed cloud computing environment composed of IoT devices. However, Challa et al [48] and Li et al [49] demonstrated several security pitfalls in the scheme [47], such as privileged-insider and impersonation attacks. Apart from these, Amin et al's scheme [47] fails to guarantee some important requirements like user anonymity and forward secrecy properties.…”

A Provably Secure Three-Factor Authentication Protocol Based on Chebyshev Chaotic Mapping for Wireless Sensor Network

“…Privileged insider attack is a security threat that has been ignored for a long time, and even protocol designers are not aware of the serious consequences of such attack [52], which has been mentioned in [52,53]. When scrutinizing scheme [42], we find that neither Jung et al's scheme can resist the security risk of privileged insider attack, nor can Shin and Kwon's scheme, which is an improved version of Jung et al's scheme, defend against privileged insider attack.…”

Provable Secure Group Key Establishment Scheme for Fog Computing

“…The operations mainly include exclusive-or, symmetric keys and hash functions and thus the communication overhead is low even for the resourceconstrained IoTs devices. However, Li, Wenting, et al [16] pointed out that the method cannot specifically solve the problem about user anonymity and forward secrecy since some private information is preserved by the smart card. In addition, Aman, Muhammad Naveed, et al [17] and Guin, Ujjwal, et al [18] proposed mutual authentication schemes with physically unclonable function (PUF) in the environment of IoTs.…”