A secure and effective biometric‐based user authentication scheme for wireless sensor networks using smart card and fuzzy extractor

Abstract

SUMMARYUser authentication is a prominent security requirement in wireless sensor networks (WSNs) for accessing the real-time data from the sensors directly by a legitimate user (external party). Several user authentication schemes are proposed in the literature. However, most of them are either vulnerable to different known attacks or they are inefficient. Recently, Althobaiti et al. presented a biometric-based user authentication scheme for WSNs. Although their scheme is efficient in computation, in this paper, we first show that their scheme has several security pitfalls such as (i) it is not resilient against node capture attack; (ii) it is insecure against impersonation attack; and (iii) it is insecure against man-in-the-middle attack. We then aim to propose a novel biometric-based user authentication scheme suitable for WSNs in order to withstand the security pitfalls found in Althobaiti et al. scheme. We show through the rigorous security analysis that our scheme is secure and satisfies the desirable security requirements. Furthermore, the simulation results for the formal security verification using the most widely used and accepted Automated Validation of Internet Security Protocols and Applications tool indicate that our scheme is secure. Our scheme is also efficient compared with existing related schemes.

Fuzzy Extractor and Elliptic Curve Based Efficient User Authentication Protocol for Wireless Sensor Networks and Internet of Things

“…In 2016, Alizadeh et al [20] presented a comprehensive survey of authentication schemes of mobile cloud computing (MCC) to explain MCC authentication and differentiate it with that of cloud computing schemes. However, in this paper we performed the cryptanalysis of A.K.Das [17] scheme and found that it is susceptible to stolen smart card attack. Similarly, we found that Choi et al [21] (proposed in 2016), Park et al [22] (introduced in 2016), and Moon et al's [23] (proposed in 2017) schemes are also insecure against various security attacks as we have illustrated in Section 4 of this paper.…”

“…In 2015, A.K. Das [17] proposed fuzzy extractor based authentication scheme which resists well known security attacks of WSNs and have more security features compared to Althobaiti et al (2013) [18] scheme. Sharaf et al [19] proposed (in 2016) an object authentication system in order to exploit device-specific data, known as fingerprints, to authenticate the objects associated with the IoT.…”

“…A.K.Das [17] performed the security analysis of Althobaiti et al's [18] scheme and proposed an improved scheme of user authentication using the fuzzy extractor in order to resist node capture attack, impersonation attack, man-in-the-middle attack. A.K.Das [17] proposed a novel approach (considering the resource constraints of sensor node) for bio-metric based user authentication using the fuzzy extractor.…”

A Privacy Protection User Authentication and Key Agreement Scheme Tailored for the Internet of Things Environment: PriAuth

“…In some schemes, [5] √ × √ Jung et al [6] √ × × Fan et al [7] × × × Amin and Biswas [8] × × × Nam et al [9] × × √ Lu et al [10] √ √ × Zhao et al [11] √ × × Hou et al [12] × × × Farash et al [13] × × × Turkanović et al [14] × × × PriAuth √ √ √ all the users share the same key to encrypt their identities, this means the encrypted identity could be decrypted by a malicious or curious user using the same key [5,6,10,13]. Some of the schemes fail to enable the anonymity of the user or sensor, such as [37][38][39]. We adopt the ECC based method to enable the anonymity, which is similar to [15][16][17][18][19][20][21] because "ECC requires smaller keys compared to non-ECC cryptography (based on plain Galois fields) to provide equivalent security" [40].…”

Secure biometric-based authentication scheme with smart card revocation/reissue for wireless sensor networks

“…Therefore, biometricbased user authentication is inherently more secure and reliable than conventional authentication schemes. [20][21][22] In 2010, Yuan et al 18 proposed the first biometricbased user authentication scheme for WSNs. Their scheme was very efficient because it used only the hash function.…”