Security Analysis of Out‐of‐Band Device Pairing Protocols: A Survey

Abstract

Numerous secure device pairing (SDP) protocols have been proposed to establish a secure communication between unidentified IoT devices that have no preshared security parameters due to the scalability requirements imposed by the ubiquitous nature of the IoT devices. In order to provide the most user-friendly IoT services, the usability assessment has become the main requirement. Thus, the complete security analysis has been replaced by a sketch of a proof to partially validate the robustness of the proposal. The few existing formal or computational security verifications on the SDP schemes have been conducted based on the assessment of a wide variety of uniquely defined security properties. Therefore, the security comparison between these protocols is not feasible and there is a lack of a unified security analysis framework to assess these pairing techniques. In this paper, we survey a selection of secure device pairing proposals that have been formally or computationally verified. We present a systematic description of the protocol assumptions, the adopted verification model, and an assessment of the verification results. In addition, we normalize the used taxonomy in order to enhance the understanding of these security validations. Furthermore, we refine the adversary capabilities on the out-of-band channel by redefining the replay capability and by introducing a new notion of delay that is dependent on the protocol structure that is more adequate for the ad hoc pairing context. Also, we propose a classification of a number of out-of-band channels based on their security properties and under our refined adversary model. Our work motivates the future SDP protocol designer to conduct a formal or a computational security assessment to allow the comparability between these pairing techniques. Furthermore, it provides a realistic abstraction of the adversary capabilities on the out-of-band channel which improves the modeling of their security characteristics in the protocol verification tools.

Multi Model Establishment of Enterprise Case Aided Decision-making Based on Data Analysis

“…In order to ensure the data quality of enterprise case auxiliary decision information source, this paper first uses data cleaning technology to preprocess the data.In the process of data cleaning [21][22][23], noise data can be effectively eliminated so that the data in the data set can meet the requirements of enterprise case auxiliary decision-making. The schematic diagram of data cleaning is shown in Figure 1 below.…”

Efficient and Secure Pairing Protocol for Devices with Unbalanced Computational Capabilities

“…In 2015, Nguyen and Leneutre [25] proposed a lightweight scheme for device pairing with only four messages. However, a brute-force attack was found by Khalfaoui et al [26]. Later, in 2017, Taparia, Panigrahy, and Jena [27] proposed AKE based on a commitment scheme and authentication strings to withstand MITM (man-in-the-middle) attacks.…”

“…If the nonce is revealed, the attacker could obtain the value used for OOB checking in advance, rendering the protocol insecure. Therefore, their protocol cannot resist the brute-force attack [26].…”