Design of a Secure Password-Based Authentication Scheme for M2M Networks in IoT Enabled Cyber-Physical Systems

Abstract

The Internet of Things (IoT) forms a foundation for cyber-physical systems. We propose an efficient and secure authentication scheme for machine-to-machine (M2M) networks in IoT enabled cyber-physical systems. Smart objects and smart devices over CPS are capable of capturing a variety of multimedia contents; interact with each other and also with the physical world in a fully automatic manner without human interference. The proposed scheme allows any pair of entities in an M2M network to mutually authenticate each other and agree on a session key for communicating data in a secure and efficient way. The authentication process does not incorporate the M2M service provider, and hence eliminates the burden of managing the authentication of massive scale devices at the edge of the network. The burden of the authentication process is offloaded and distributed on the gateways under the authority of this M2M service provider. The proposed scheme requires the mobile user to hold only one secret key provided by the M2M service provider, by which, he can roam randomly in the M2M network and authenticate to any of the gateways in the domain. Then, this authenticated gateway allows the mobile user to authenticate with any sensor node in the domain. In the proposed scheme, the authentication process does not rely on any public key cryptographic operations. Authentication is achieved using very few hash invocations and symmetric key encryptions. Therefore, the scheme is suitable for environmental sensors which are limited in resources (computation, storage, and energy). We analyze the security of the proposed scheme using BAN logic, which is widely accepted as a framework for the assessment of authentication protocols and also using ProVerif. We assess the efficiency of the proposed scheme and compare with some recently proposed schemes.

Highly Efficient Symmetric Key Based Authentication and Key Agreement Protocol Using Keccak

“…It is not clear in their protocol how the gateway remains synchronized with the sensor node and how it can resist synchronization attacks. They show that their scheme outperforms other related work in literature [11][12][13][14] with respect to computational performance. Only [7] is slightly more efficient.…”

“…Only [7] is slightly more efficient. In addition, the communication cost of [6] is still lower compared to [12][13][14], but slightly higher than [7,11,14]. However, it has also been clearly shown that all of the schemes [7,[11][12][13][14] suffer significant weaknesses with respect to attacks like for instance tracking attack [7,11,13,14], offline identity guessing attack [7,11,12,14], impersonation attack [7,14], denial of service attack [7,[11][12][13][14], etc.…”

Lightweight Authentication Protocol for M2M Communications of Resource-Constrained Devices in Industrial Internet of Things

“…The execution-cost of LAKD protocol is presented in Table 5, together with that of protocols [22,[60][61][62][63], which were also designed for M2M communication. Concerning the Case 1 measurement, the proposal has less execution-time than the other protocols, except for the schemes of Esfahani et al [22] and Joshitta et al [63].…”

Cyber-Physical Trust Systems Driven by Blockchain

“…Unfortunately, the shared master key can easily experience severe risks if a CPS node is compromised, leading to several attacks in the group. Renuka et al proposed three security mechanisms for machine-to-machine network in CPS [9]. These mechanisms include: (i) mobile-gateway authentication, (ii) mobile-sensor authentication and (iii) sensor-sensor authentication.…”

“…In the mobile-gateway approach, the authors included a human-inloop approach where the user is being authenticated using a password. However, in [16], Lara et al claimed that the approaches proposed in [9] require high computational complexities and are vulnerable to several attacks, e.g., offline guessing attack, privileged insider, and denial-of-service (DoS). In addition, Lara et al proposed another solution to mitigate the issues in [9].…”