HMACCE: Establishing Authenticated and Confidential Channel From Historical Data for Industrial Internet of Things

Abstract

Industrial Internet of Things (IIoT) is a new paradigm for building intelligent industrial control systems, and how to establish a secure channel in IIoT for machine-to-machine (M2M) communication is a critical problem because the devices in IIoT suffer from various attacks and may leak confidential information. Traditional authenticated and confidential channel establishment (ACCE) protocols neither apply for resource-constrained IIoT devices nor satisfy leakage resilience. In this paper, we introduce a new security notion: historical data based multi-factor ACCE (HMACCE) to address this issue and propose two HMACCE protocols. Our HMACCE protocols use three authentication factors, i.e., a symmetric secret key, historical data, and a set of secret tags associated with the historical data, to establish a secure communication channel between the client and the server. The key idea is to use the secret key managed by an IIoT edge device to quickly verify the relationship between the historical data and its associated tags stored on the server. Our HMACCE has the following remarkable features. First, it is lightweight and tailored for resource-constrained IIoT devices. Second, it is bounded historical tag leakage resilience, which means that if a small portion of the secret tags is leaked to an adversary, it will not affect its security with an overwhelming probability. Moreover, as a security enhancement service, our HMACCE can be easily integrated with legacy IIoT devices by running simple authenticated key exchange protocols.

Exploring Authentication Paradigms in the Internet of Things: A Comprehensive Scoping Review

“…Some studies opt for mutual authentication protocols to address privacy protection problems [45,70], while others are dependent on highly flawed centralized authentication [78,79]. Others were motivated to have the authentication process in IoT integrated into another practical, real-world system or hardware (such as pollution detection systems [39], digital health solutions [11,35,48], medical devices [34,37], automated monitoring systems [49,54], intelligent transport systems [49], multiple integrated access control systems [32], and the vulnerability of servers in cyber-physical systems [75,76]. Some emerging problems involve addressing cross-domain authentication in IoT devices [12,42,69,70], multi-layered architecture communication [8,69], resource-friendly security mechanisms [36,58,64], and Internet-enabled smart devices [9,27,60].…”

“…Studies in [13,[46][47][48][49]76], use an IoT device authentication scheme based on ambient access points, utilizing broadcast message data for authentication and affirming proximity between devices in an ad hoc IoT network. The authors in [50,51], both present a secure, lightweight authentication and key agreement protocol for IoT environments, achieving semantic security and critical properties like anonymity, robust synchronization, and forward security secrecy without using public-key cryptographic primitives.…”

“…The second most adopted performance metric was the communication cost (or communication overhead), which encompasses the overhead associated with the communication process that transmits security parameters between interacting entities [7,10,12,40,43,44,47,65], such as the size of the network bandwidth [39], data transmis-sion amount [36,51,64,67,69,76] or transmission delays [52], network latency [28,42,69,75], key exchange protocols [27], and cryptographic processes associated with it [32,38,50]. Meanwhile, time consumption involves key performance that involves the average execution time of critical steps in the information sharing protocol (such as sharing processing, reputation value computation, and voting mechanism) [6] or execution protocol [31,53], period of physical presence such as on time on air [39] or alive time that crucial for network longevity [52,61], the response time for signature, verification, execution, or analysis time of associated encryption or decryption processes [11,30,34,[43][44][45]60,73,79,80], certificate validation time [58]...…”

“…Store costs were also considered by several studies, which included considerations such as storing credentials that facilitate the authentication process [7], device information and device-user binding information [69], the space required to store the necessary data and cryptographic keys for the protocol's operation [10,[26][27][28]31,36,76], storing associated authentication key parameters [27][28][29]40,42,65], and the size of compiled programs and memory areas of certificates [9,29,58].…”

“…One performance measure was focused on usability, which is associated with the IoT system's consideration of integrating readily available infrastructure without the need for new hardware to be installed. Some studies focused on such metrics due to proximity-related restrictions [46], avoiding misdetection or false positive outcomes [48,66,74], mitigating rogue or shadow devices [50], features associated with access control (context-awareness, granularity, scalability, and interoperability) [76], and a feature-rich approach [51].…”