一個增強的IoT無線感測網路遠端認證機制

An Enhanced IoT Wireless Sensing Network Remote Authentication Scheme

余平(Ping Yu) ； 黃詩蓉(Shih-Jung Huang)

《資訊管理學報》 27卷1期 (2020/01) Pp. 111-141

摘要

近年來IoT的發展應用越來越貼近我們的日常生活，根據研究顯示在醫療照護上將佔IoT整體應用的四成，顯示出IoT在醫療照護上的潛力。但無論在醫療照護、企業生產或生活應用上，常需由遠端存取各項需保密的資訊，若IoT感測器遭到攻擊或傳送的資訊被竊取，將會造成個人或企業的生命及財產權益受損，因此一個安全的IoT無線感測網路遠端認證機制有其必要性。本研究發現Wu等人於2018年提出認證機制中，匿名性保護及感測器取得攻擊的安全性不夠完善，本文除指出其機制存在的弱點及提出一個新的IoT無線感測網路遠端認證機制外，並以Proverif形式化及非形式化的安全性分析證明新機制的安全性，及利用與現有機制的效能及安全性比較證明新機制的實用性，以提供更佳的安全性及未來實用價值的IoT無線感測網路遠端認證機制。

關鍵字

物聯網 ； 無線感測網路 ； 遠端認證 ； 安全性分析

並列摘要

Purpose-The IoT (Internet of Thing) is a broad field with many different technologies and applications. In the last few years, they have collected the data into analytics to create value deriving from combining and analyzing from various sources. But these data have to be continuously available from a secure and flexible architecture. This study aims to design an enhanced IoT wireless sensing network(WSN) remote authentication scheme for accessing the IoT data through the gateway over a public channel. The result of security and performance analysis proves the scheme secure and efficient that can implement in real-life applications. Design/methodology/approach-In this study, We review the researches that design for remote user authentication of IoT architecture. We use the security analysis to find the weakness of the proposed practiced scheme. Based on that scheme, we offer a new IoT WSN remote authentication scheme to avoid their leaks. The formal security analysis of Proverif tool and informal security analysis approaches id used to prove the security and the practicability of the new scheme. Findings-The IoT has widely adopted in many applications. However, there exist various security and privacy issues. Notably, one of the most severe threats is to clone IoT devices for the goal of counterfeiting goods, which causes significant loss and danger to users. Lots of authentication protocols are proposed based on physical functions. However, most of the existing schemes require secret parameters in IoT, which are vulnerable to physical attacks. In this study, we find the authentication scheme proposed by Wu et al. (2018) has practical value for multi-gateway based on WSNs. But we also find their scheme cannot resist several attacks. The findings also showed that design a remote user authentication scheme with secure and efficient is necessary. Research limitations/implications-In this study, we follow three assumptions regarding the capabilities of an attacker. Firstly, an attacker has total control over the public channel connecting the users and the remote server that the adversary can intercept or modify any message. Secondly, an attacker may steal or get a smart device or IoT devices. Thirdly, the adversary attacker can retrieve the information from a smart device or IoT devices. From the previous three assumptions, we analyze the existing scheme and proposed scheme. Practical implications-The WSNs of IoT provides practical security aspects are the challenging area in the research field, and many researchers still try to improve the efficiency of the system. Though, this paper presents relatively better efficiency compared with the related systems. Originality/value-Since the IoT devices are constrained by battery power; The energy consumption should be minimum to increase the life-time of the network. It is noticeable that the efficiency of our scheme is relatively better in terms of computation cost than other related schemes. Therefore, it can be applied in practical implementation in the WSNS environment. We will try to improve the scheme more efficient without compromising several security aspects in the future.

並列關鍵字

Internet of Things ； wireless sensing network ； remote authentication ； security analysis

參考文獻

Amin, R., Islam, S.K.H., Biswas, G.P., Khan, M.K., Leng, L. and Kumar, N. (2016), ‘Design of an anonymity-preserving three-factor authenticated key exchange protocol for wireless sensor networks’, Computer Networks, Vol.101, pp. 42-62.

Blanchet, B., Smyth, B., Cheval, V. and Sylvestre, M. (2018), ‘ProVerif 2.00: Automatic cryptographic protocol verifier, user manual and tutorial’, available at https://ics.upjs.sk/~jirasek/krp/manual.pdf.

Chang, C.C. and Wu, T.C. (1991), ‘Remote password authentication with smart cards’, IEE Proceedings E-Computers and Digital Techniques, Vol. 138, No. 3, pp. 165-168.

Chaudhry, S.A., Farash, M.S., Naqvi, H., Kumari, S. and Khan, M.K. (2015), ‘An enhanced privacy preserving remote user authentication scheme with provable security’, Security and Communication Networks, Vol. 8, No. 18, pp. 3782-3795.

Chen, T.H., Hsiang, H.C. and Shih, W.K. (2011), ‘Security enhancement on an improvement on two remote user authentication schemes using smart cards’, Future Generation Computer Systems, Vol. 27, No. 4, pp. 377-380.