Efficient and Anonymous Two-Factor User Authentication in Wireless Sensor Networks: Achieving User Anonymity with Lightweight Sensor Computation

Abstract

A smart-card-based user authentication scheme for wireless sensor networks (hereafter referred to as a SCA-WSN scheme) is designed to ensure that only users who possess both a smart card and the corresponding password are allowed to gain access to sensor data and their transmissions. Despite many research efforts in recent years, it remains a challenging task to design an efficient SCA-WSN scheme that achieves user anonymity. The majority of published SCA-WSN schemes use only lightweight cryptographic techniques (rather than public-key cryptographic techniques) for the sake of efficiency, and have been demonstrated to suffer from the inability to provide user anonymity. Some schemes employ elliptic curve cryptography for better security but require sensors with strict resource constraints to perform computationally expensive scalar-point multiplications; despite the increased computational requirements, these schemes do not provide user anonymity. In this paper, we present a new SCA-WSN scheme that not only achieves user anonymity but also is efficient in terms of the computation loads for sensors. Our scheme employs elliptic curve cryptography but restricts its use only to anonymous user-to-gateway authentication, thereby allowing sensors to perform only lightweight cryptographic operations. Our scheme also enjoys provable security in a formal model extended from the widely accepted Bellare-Pointcheval-Rogaway (2000) model to capture the user anonymity property and various SCA-WSN specific attacks (e.g., stolen smart card attacks, node capture attacks, privileged insider attacks, and stolen verifier attacks).

A Privacy Protection User Authentication and Key Agreement Scheme Tailored for the Internet of Things Environment: PriAuth

“…Therefore, it is also necessary to keep the doctor's identity confidential in order to protect the privacy of the patient. In PriAuth, Elliptic Curve Cryptography (ECC) is adopted as the method used to protect the identities of the data transmission participants, which is similar to [15][16][17][18][19][20][21].…”

“…Some of the schemes fail to enable the anonymity of the user or sensor, such as [37][38][39]. We adopt the ECC based method to enable the anonymity, which is similar to [15][16][17][18][19][20][21] because "ECC requires smaller keys compared to non-ECC cryptography (based on plain Galois fields) to provide equivalent security" [40]. The gateway has a public key that is known by every user; all the identities are encrypted by an XOR method with a new key which is generated from gateway's public key before the identities are sent to the gateway.…”

Secure Authentication and Prescription Safety Protocol for Telecare Health Services Using Ubiquitous IoT

“…A user anonymous authentication scheme has been presented to handle remote medical services applying in WSN to resolve this issues. Nam et al [22] pointed out some flaws in [21] for user anonymity and smart card theft. By exploiting symmetric encryption and secure key management for message integrity, Xue et al [23] presented a temporary credential-based secure key using a one-way hash function and XOR operations.…”

CP-ABE Based Privacy-Preserving User Profile Matching in Mobile Social Networks

“…Especially in recent years, a lot of authentication and key exchange protocols have been proposed for various kinds of wireless networks to establish secure communication channels between their entities. For example, literature [26] presented a smart-card based user authentication scheme for Wireless Sensor Networks. Literature [27] presented an authenticated key exchange protocol for Wireless Body Area Network.…”