Lightweight Three-Factor-Based Privacy- Preserving Authentication Scheme for IoT-Enabled Smart Homes

Abstract

Smart homes are an emerging paradigm of Internet of Things (IoT) in which users can remotely control various home devices via the internet anytime and anywhere. However, smart home environments are vulnerable to security attacks because an attacker can inject, insert, intercept, delete, and modify transmitted messages over an insecure channel. Thus, secure and lightweight authentication protocols are essential to ensure useful services in smart home environments. In 2021, Kaur and Kumar presented a two-factor based user authentication protocol for smart homes using elliptic curve cryptosystems (ECC). Unfortunately, we demonstrate that their scheme cannot resist security attacks such as impersonation and session key disclosure attacks, and also ensure secure user authentication. Moreover, their scheme is not suitable in smart home environments because it utilizes public-key cryptosystems such as ECC. Hence, we design a secure and lightweight three-factor based privacy-preserving authentication scheme for IoT-enabled smart home environments to overcome the security problems of Kaur and Kumar's protocol. We prove the security of the proposed scheme by using informal and formal security analyses such as the ROR model and AVISPA simulation. In addition, we compare the performance and security features between the proposed scheme and related schemes. The proposed scheme better provides security and efficiency compared with the previous schemes and is more suitable than previous schemes for IoTenabled smart home environments.

Lightweight and Privacy-Preserving Remote User Authentication for Smart Homes

“…The communication cost of our scheme for the message sent from the gateway to the smart device is 544 bits (68 bytes) (128 + 128 + 128 + 160 = 544). Similarly, the communication costs of the existing protocols proposed by Wazid et al [21] is 986 bits, Yu et al [40] is 794 bits, Challa et al [36] is 711 bits and Shuai et al [24] is 960 bits. Table 5 shows the communication overhead at the smart device, which includes the number of messages received and sent and the total cost in bits.…”

“…Public key based authentication protocols [22], [36]- [39] are computationally expensive than symmetric key based approaches. Besides, almost all of the existing schemes are designed using timestamps, making them vulnerable to clock synchronization problems [21], [32], [36], [40]. In particular, IoT devices are more prone to such problems as they are deployed in a broad range of operating conditions and are resource-constrained [41].…”

“…The scheme proposed by Yu et al [40] does not provide integrity protection to verify whether messages are modified in transit. Hence, entities have to perform computations to authenticate the message.…”

ASM-ROBOT: A Cyber-Physical Home Automation Controller with Memristive Reconfigurable State Machine

“…The design supports end-users by allowing for demand-side management and automation. In [50], the authors developed a secured but lightweight three-factor driven privacy-preserving authentication model specifically for IoT-enabled smart home environments. The authors [51], presented a scheme that automates home appliances in three modes viz: local, web, and app-based automation.…”

Loki: A Physical Security Key Compatible IoT Based Lock for Protecting Physical Assets

“…Biometric locks [28] are vulnerable to biometric cloning. Smart locks [29] do not have user-defined keys or support biometric authentication. There are locks that allow resettable keys for better security [30],however, to reset this type of a lock, the previous key is needed.…”