Search

IoT is emerging as a massive web of heterogeneous networks estimated to interconnect over 41 billion devices by 2025, generating around 79 zettabytes of data. The heterogeneous network shall bring in a plethora of digital services leveraging cloud and communication technologies to drive smart city applications. As users access these services remotely in a ubiquitous environment over public channels, it becomes imperative to secure their communication. Both entity and message authentication emerge as a critical security primitive to thwart unauthorized access and prevent the falsification of messages. While researchers have given due attention to achieving mutual authentication between the subscriber (remote user) and gateway node (broker), the mutual authentication between the gateway node and an IoT sensor node is left to be desired. It could be done at the peril of a rogue or a shadow IoT device unauthorizedly joining an IoT-based network. Some of the widely used IoT-specific application layer protocols like constrained application protocol (COAP) and message queue telemetry transport (MQTT) protocol are not inherently equipped with adequate security safeguards. They, therefore, rely on underlying transport layer security protocols, which are highly computationally intensive. To address this issue, this paper proposes a three-factor authentication framework suitable for IoT-driven critical applications based upon identity, password and a digital signature scheme. The framework employs publish-subscribe pattern leveraging elliptical curve cryptography (ECC) and computationally low hash chains. The formal and informal security analysis shows that the framework is resistant to different types of cryptographic attacks. Furthermore, the automated validation performed with the Scyther tool verifies that there are no cryptographic attacks found on any of the claims stated in the proposed framework. Finally, a comparison of the framework security features, computational, and communication overheads is carried out with other existing protocols. [ABSTRACT FROM AUTHOR]

The present authentication solutions employed in the Internet of Things (IoT) are either inadequate or computationally intensive, given the resource-constrained nature of IoT devices. This challenges the researchers to devise efficient solutions to embed an important security tenet like authentication. In IoT, the most popular machine-to-machine communication protocol used at the application layer is Message Queuing Telemetry Transport (MQTT). However, the MQTT protocol inherently lacks security-related functions, like authentication, authorization, confidentiality, access control, and data integrity , which is unacceptable for IoT-driven mission-critical applications when connected over public networks. In such a situation, the security is hardened by employing a transport layer security protocol like TLS, which entails significant computational overheads. This paper presents a novel scheme to enhance MQTT security by providing a lightweight multi-factor authentication scheme based on Elliptical curve cryptography. The proposed scheme uses a low-cost signature and a fuzzy extractor to correct errors in imprinted biometrics in noisy environments. This scheme attains mutual authentication, generates a securely agreed-upon session key for secret communication, and guarantees perfect forward secrecy. Furthermore, the rigorous informal security analysis shows the proposed scheme resists cryptographic attacks, including known session critical attacks. Furthermore, an empirical study has been carried out to assess the effectiveness of the proposed scheme in the Cooja simulated environment. [ABSTRACT FROM AUTHOR]