Lightweight and Anonymous Mutual Authentication Protocol for Edge IoT Nodes with Physical Unclonable Function

Abstract

Internet of Things (IoT) has been widely used in many fields, bringing great convenience to people’s traditional work and life. IoT generates tremendous amounts of data at the edge of network. However, the security of data transmission is facing severe challenges. In particular, edge IoT nodes cannot run complex encryption operations due to their limited computing and storage resources. Therefore, edge IoT nodes are more susceptible to various security attacks. To this end, a lightweight mutual authentication and key agreement protocol is proposed to achieve the security of IoT nodes’ communication. The protocol uses the reverse fuzzy extractor to acclimatize to the noisy environment and introduces the supplementary subprotocol to enhance resistance to the desynchronization attack. It uses only lightweight cryptographic operations, such as hash function, XORs, and PUF. It only stores one pseudo-identity. The protocol is proven to be secure by rigid security analysis based on improved BAN logic. Performance analysis shows the proposed protocol has more comprehensive functions and incurs lower computation and communication cost when compared with similar protocols.

Extremely Lightweight PUF-based Batch Authentication Protocol for End-Edge-Cloud Hierarchical Smart Grid

“…Te former ignores the actual architecture and the authority fltering function of gateway, while the latter exaggerates the security assumption of gateway. And only several schemes [6,13,14,17,20,[24][25][26] take physical attack into consideration. A comparison of recent schemes is shown in Table 1.…”

“…However, this is infeasible in reality (violates condition P2 in Table 1) since gateways residing at open environment are also prone to various attacks. Following the concept of computational asymmetry, Wang et al proposed a PUF-based lightweight AKA protocol for edge IoT nodes [26]. To acclimatize environmental noise, the reverse fuzzy extractor is employed, which also mitigated the computation burden at end devices.…”

On Security Best Practices, Systematic Analysis of Security Advice, and Internet of Things Devices

“…We note that, beyond the device identification process (our focus) per se, the resulting classification of device instances is often used in subsequent management or processing tasks as observed in our literature review (e.g., applying policies to specific classes of devices). ✓ Noguchi [161] ✓ Perdisci [167] ✓ Ray [171] ✓ AA3 Yousefnezhad [225] ✓ AA3 Aneja [19] ✓ AA3 Chowdhury [52] ✓ AA3 Hamad [100] ✓ ✓ AA3 Anantharaman [18] ✓ ✓ Kotak [126] ✓ ✓ Ammar [15] ✓ Ammar [16] ✓ Santos [183] ✓ Meidan [150] ✓ Singla [190] ✓ Marchal [144] ✓ Bao [28] ✓ Thomsen [203] ✓ Miettinen [152] ✓ Yu [227] ✓ Bezawada [40] ✓ Salman [181] ✓ Marchal [144] ✓ Aksoy [6] ✓ Kumar [130] ✓ AA4 Anantharaman [17] ✓ AA1, AA4 Mukhandi [155] ✓ AA1 Bin-Rabiah [41] ✓ AA1 Gritti [91] ✓ AA1 Kalra [119] ✓ AA1 Malche [143] ✓ AA1 Nashwan [157] ✓ AA1 Kim [122] ✓ AA2 Kim [123] ✓ AA1, AA2 Wang [214] ✓ AA2 Niya [160] ✓ AA2…”

“…Reviewed AA2 proposals include the following. Anantharaman [17] AA1, AA4 ✓ ✓ Nashwan [157] AA1 ✓ ▲ Bin-Rabiah [41] AA1 ✓ ▲ Kalra [119] AA1 ✓ ▲ Gritti [91] AA1 ✓ Malche [143] AA1 ✓ Mukhandi [155] AA1 ✓ Kumar [130] AA4 ✓ ▲ Kim [123] AA1, AA2 ✓ Wang [214] AA2 ✓ ▲ Kim [122] AA2 ✓ ▲ Niya [160] AA2 ✓ revocation of key pairs (a similar challenge as in certificate-based approaches, Section 7.4). The primitives used to facilitate authentication and encryption in JEDI and authorization with macaroons may be lightweight, but the infrastructure and management requirements are non-trivial.…”

“…Kim et al[123] also add PUF-based authentication to the OCF IoTivity framework[114] by using PUFs to authenticate devices with CR-pairs and public/private key pairs. Wang et al[214], with the goal of reducing device resource use, use CR-pairs from PUFs to authenticate resource-constrained devices and generate session keys. Niya et al[160] use smart contracts on the 2: Authentication approaches used in the three phases of device authentication (Section 7.1.3) based on authentication papers from Table7.1 on page 141.…”