Provably secure ECC-based anonymous authentication and key Agreement for IoT

Source abstract

With the rise of the Internet of Things (IoT), maintaining data confidentiality and protecting user privacy have become increasingly challenging. End devices in IoT are often deployed in unattended environments and connected to open networks, which can make them vulnerable to physical tampering and other security attacks. Different authentication key agreement (AKA) schemes have been validated to date, but most schemes do not cover the necessary security features or are incompatible with resource-constrained end devices. Besides, their security proofs have been performed under the real-or-random model, which is not guaranteed to be secure in real applications. To reduce the weaknesses, we present an AKA protocol for end devices and servers. The proposal leverages the ECC-based key exchange mechanism and one-way hash function-based message authentication method to achieve mutual authentication, user anonymity, and forward security. Formal security proof of the proposed scheme is performed under the standard model with the elliptic curve encryption computational assumptions, and an automatic formal verification was performed with ProVerif. Further, the performance comparison verifies that our scheme reduces computation and communication costs while providing improved security features.