A Secure and Anonymous User Authentication Scheme for IoT-Enabled Smart Home Environments Using PUF

Abstract

With the continuous development of Internet of Things (IoT) technology, research on smart home environments is being conducted by many researchers. In smart home environments, home users can remotely access and control a variety of home devices such as smart curtains, lights, and speakers placed throughout the house. Despite providing convenient services, including home monitoring, temperature management, and daily work assistance, smart homes can be vulnerable to malicious attacks because all messages are transmitted over insecure channels. Moreover, home devices can be a target for device capture attacks since they are placed in physically accessible locations. Therefore, a secure authentication and key agreement scheme is required to prevent such security problems. In 2021, Zou et al. proposed a two-factor-based authentication and key agreement scheme using elliptic curve cryptography (ECC) in smart home environments. They claimed that their scheme provides user anonymity and forward secrecy. However, we prove that their scheme suffers from forgery, ephemeral secret leakage, and session key disclosure attacks. To overcome the security vulnerabilities of Zou et al.'s scheme and provide home users with secure communication in smart home environments, we propose a secure user authentication scheme using physical unclonable functions (PUF). We utilize Real-or-Random (ROR) model and Burrows-Abadi-Needham (BAN) logic to verify the session key security and mutual authentication of the proposed scheme, respectively. Furthermore, we use the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool to simulate the resistance of our scheme to security attacks. After that, we analyze and compare the communication costs, computational consumption, and security functionalities along with related schemes.

Smart Home System: A Comprehensive Review

“…PV-based smart homes now play an active role in the national grid. Extra energy generated through photovoltaic cells in smart homes can now be traded through an electric grid [153,154]. 10.3.…”

Toward Designing a Secure Authentication Protocol for IoT Environments

“…Another class of protocols has been developed to include the device's fingerprint throughout the authentication process to prevent such attacks. Such a fingerprint may be produced by a physically unclonable function(PUF) [43][44][45][46][47][48]. The security of such protocols may seem promising if the PUF being used behaves in an ideal manner (i.e., behave fully reliable and random); however, the PUF response relies on the environment and is not entirely random.…”

“…Protocol Class [4][5][6][7][8][9][10][11][12][13] Ultralightweight [43][44][45][46][47][48] PUF based [52][53][54][55] Smartcard based [56][57][58][59] Biometric based [40][41][42] Blockchain based…”

Overview of the Methods and Tools for Situation Identification and Decision-Making Support in the Cyberphysical System «smart House»

“…The paper [28] proposed the secure user authentication and key agreement scheme using physical unclonable functions for preventing the security problems, used Real-or-Random model and Burrows-Abadi-Needham logic for verification of the session key security and mutual authentication, used too the Automated Validation of Internet Security Protocols and Applications tool for simulation of the scheme resistance to security attacks.…”