Secure and anonymous authentication scheme for the Internet of Things with pairing

Abstract

The Internet of Things technology allows devices automatically connect with others or a server for the purposes of exchanging data. People can conveniently integrate data from those devices for a smart home, vehicular ad-hoc network, e-Health, etc. In 2017, Wang et al. proposed a simple authentication scheme for the Internet of Things. Although they formally proved that their scheme is secure, they did not consider the privacy of devices and stolen verifier attack. In this paper, we first demonstrate the weaknesses of Wang et al.’s scheme. Accordingly, we present a higher security level authentication scheme to resist the above weaknesses.

Introduction

Combining the advantages of the IPv6 and IEEE 802.15.4 protocols, the Internet Engineering Task Force (IETF) has established an open standard for IPv6 over Low-Power Wireless Personal Area Networks (6LoWPAN) [1]. IETF 6LoWPAN technology has the characteristics of a wireless, low-power, self-organizing network, and is an important technology of the Internet of Things sensing layer and wireless sensor networks. Therefore, Internet of Things technology has been widely used in various commercial fields in recent years, namely in the areas of smart city, smart home, industrial IoT, connected health, vehicular ad hoc network, etc. According to market research company Gartner, there are 8.4 billion network devices in use, an increase of 31% over 2016. By 2020, there will be an estimated 20.4 billion devices [2]. GrowthEnabler predicts that the global Internet of Things market will reach $45.7 billion in 2020, a compound annual growth rate (CAGR) of 28.5% from 2016’s $15.7 billion [3], [4], [5].

Although the Internet of Things has brought convenience to people, according to the ENISA Threat Situation Report [6], [7], the Internet of Things botnet was considered to be the second-largest threat in 2017. More and more hackers are trying to invade Internet of Things devices to gain unlawful profit. Therefore, mutual authentication in the Internet of Things is an important security issue. Experts and scholars have proposed a series of certification schemes to ensure the security of the Internet of Things [8], [9], [10], [11], [12]. In addition, when an authentication scheme uses the verify-table to verify users, it is important that the scheme can resist stolen-verify attack. According to 2017 ENISA threat landscape report [13], SQL injection [14] is rank number one treat accounted for 51% of the total attacks with 185 million alerts in the second quarter of 2017. Once the hacker extracts the sensitive data entry from the database, he can reverse analysis of the encrypted data. Moreover, if the hacker obtains the cloud server’s verify-table, he can control any data entry in the database, including delete, insert, and modify.

Compare with public encrypted system RSA, Elliptic Curve Cryptography (ECC) can provide minimum key size in same level of security. Therefore, ECC is best suited for embedded devices having constrained environment, i.e. Internet of Things.

ECC based authentication schemes have been proposed by Abichar et al. [15], Hafizul et al. [16], Debiao et al. [17], Ray et al. [18], Granjal et al. [19], Jiang et al. [20], and Moosavi et al. [21]. Abichar et al. [15], Ray et al. [18], Jiang et al. [20], and Moosavi et al. [21] provided mutual authentication using certificates, it means that those authentication schemes lead to increase in cost. In 2015, Salvotore et al. [22] proposed a utility paradigm for the connection of the Internet of Things to the cloud and proved the feasibility of this approach. Subsequently, Kalra and Sood [23] used ECC technology to design a secure mutual authentication scheme for IoT and cloud servers in 2016. According to Kalra and Sood et al.’s functionality comparisons, their scheme is very efficient and has least computation cost among above schemes. However, Chang et al. [24] pointed out that Kalra and Sood’s scheme [23] could not achieve mutual authentication and a session key agreement. In the same year, Wang et al. [25] demonstrated that previous schemes [23], [24] still suffered from impersonation server attacks when adversaries replayed the authentication messages. In this paper, we first show that the above schemes [23], [24], [25] will leak the privacy of devices, and that an adversary could impersonate a server when it obtains the cloud server’s database. We then use a bilinear mapping technique to design a secure and anonymity authentication scheme for fixing those problems.

The rest of this paper is organized as follows. In Section 2, we review and analyze of Wang et al.’s scheme. We also make some secure assumptions for the proposed scheme. Section 3 presents a secure and anonymity authentication scheme. Sections 4 Security analysis, 5 Simulation for formal verification of the proposed scheme using AVISPA, 6 Comparisons among relevant schemes and our scheme provide a security analysis of the proposed scheme and compare it with other relevant schemes. Finally, the conclusions are given in Section 7.