The number of Internet of Things (IoT) devices is expected to grow exponentially in the near future and produce large amounts of potentially sensitive data. The simple and low cost nature of IoT devices makes them an attractive target for spoofing or impersonation attacks. To solve this issue, this paper proposes a two-factor authentication protocol using physically unclonable functions and the characteristics of the wireless signal from an IoT device. The security analysis and results on MICAz motes shows that the proposed protocol can be used as an effective tool to secure IoT systems from spoofing as well as various other attacks. A performance analysis of the proposed protocol shows that it has a significantly lower computational overhead and energy consumption compared to existing techniques.

Two-Factor Authentication for IoT With Location Information

A survey on physical unclonable function (PUF)-based security solutions for Internet of Things

One of the most important and critical requirements for the Internet of Vehicles (IoV) is security under strict latency. Typically, authentication protocols for vehicular ad hoc networks need to authenticate themselves frequently. This results in reduced application traffic and increased overhead. Moreover, the mobile nature of vehicles makes them a prime target for physical, side channel, and cloning attacks. To address these issues, this article presents an efficient protocol for authentication in the IoV. The proposed protocol uses physical unclonable functions to provide the desired security characteristics. To reduce the overhead of authentication and improve the throughput of application layer packets, the proposed protocol uses a three-layered infrastructure architecture for IoVs, i.e., roadside units (RSUs), RSU gateways, and trusted authority. A vehicle needs to authenticate only once when it enters the area of an RSU gateway which may engulf multiple RSUs. A performance analysis of the protocol shows that the proposed strategy significantly reduces the number of authentication packets and MAC/PHY overhead while the security analysis demonstrates its robustness against various types of attacks.

A Privacy-Preserving and Scalable Authentication Protocol for the Internet of Vehicles

The Internet of Things (IoT) has many applications, including Industry 4.0. There are a number of challenges when deploying IoT devices in the Industry 4.0 setting, partly due to the low-cost IoT devices/nodes with limited capacity to run/support security solutions. Hence, there is a need for a lightweight and efficient security solution to protect the environment. Thus, in this article, we present a robust, lightweight, and provably secure authentication and key agreement protocol specifically for the IoT environment based on a hierarchical approach. The proposed protocol relies on lightweight operations, such as elliptic curve cryptography, physically unclonable functions, hash functions, concatenation, and XOR operations. We then evaluate the security of the designed protocol, including the widely used automated validation of Internet security protocols and applications (AVISPA), and demonstrate that it supports mutual authentication between IoT nodes and server, and is resilient against a number of common security attacks [denial of service (DoS), replay, spoofing, etc.]. The computational and communication overhead analysis shows that the proposed protocol is comparatively less expensive than three other recently published, competing protocols.

Toward Secure and Provable Authentication for Internet of Things: Realizing Industry 4.0

The rapid improvement in the global connectivity standards has escalated the level of trade taking place among different parties. Advanced communication standards are allowing the trade of all types of commodities and services. Furthermore, the goods and services developed in a particular region are transcending boundaries to enter into foreign markets. Supply chains play an essential role in the trade of these goods. To be able to realize a connected world with no boundary restrictions in terms of goods and services, it is imperative to keep the associated supply chains transparent, secure, and trustworthy. Therefore, some fundamental changes in the current supply chain architecture are essential to achieve a secure trade environment. This article discusses the supply chain’s security-critical application areas and presents a detailed survey of the security issues in the existing supply chain architecture. Various emerging technologies, such as blockchain, machine learning (ML), and physically unclonable functions (PUFs) as solutions to the vulnerabilities in the existing infrastructure of the supply chain have also been discussed. Recent studies reviewed in this work reveal a growing sentiment in the industry toward new and emerging technologies, such as Internet of Things (IoT), blockchain, and ML. While many organizations have already adopted IoT applications and artificial intelligence systems in their businesses, widespread adoption of blockchain remains distant. It has also been found that over the past decade, PUF-based authentication systems have gained much ground. However, a proper reference model for their implementation in complex supply chains is still missing.

A Survey on Supply Chain Security: Application Areas, Security Threats, and Solution Architectures

Physically Unclonable Functions (PUFs) promise to be a critical hardware primitive to provide unique identities to billions of connected devices in Internet of Things (IoTs). In traditional authentication protocols a user presents a set of credentials with an accompanying proof such as password or digital certificate. However, IoTs need more evolved methods as these classical techniques suffer from the pressing problems of password dependency and inability to bind access requests to the “things” from which they originate. Additionally, the protocols need to be lightweight and heterogeneous. Although PUFs seem promising to develop such mechanism, it puts forward an open problem of how to develop such mechanism without needing to store the secret challenge-response pair (CRP) explicitly at the verifier end. In this paper, we develop an authentication and key exchange protocol by combining the ideas of Identity based Encryption (IBE), PUFs and Key-ed Hash Function to show that this combination can help to do away with this requirement. The security of the protocol is proved formally under the Session Key Security and the Universal Composability Framework. A prototype of the protocol has been implemented to realize a secured video surveillance camera using a combination of an Intel Edison board, with a Digilent Nexys-4 FPGA board consisting of an Artix-7 FPGA, together serving as the IoT node. We show, though the stand-alone video camera can be subjected to man-in-the-middle attack via IP-spoofing using standard network penetration tools, the camera augmented with the proposed protocol resists such attacks and it suits aptly in an IoT infrastructure making the protocol deployable for the industry.

Building PUF Based Authentication and Key Exchange Protocol for IoT Without Explicit CRPs in Verifier Database

PUF+IBE: Blending Physically Unclonable Functions with Identity Based Encryption for Authentication and Key Exchange in IoTs.

Connected devices in Internet-of-Things (IoT) framework have become more functional and commonplace in modern day-to-day living recently. One of the major security challenges in IoT framework is authentication and key management and hence, rigorous security analysis of these networked devices has been surfaced on demand. In this work, first we show how our recent work on designing certificate-less authentication and key exchange scheme using Physically Unclonable Functions (PUF) and Identity based Encryption (IBE) aptly fits this scenario and can be integrated with TLS layer for widespread deployment. Next, we propose an idea to modify the Handshake Protocol in the SSL/TSL layer for authentication of client-server pair and secret key share, substituting the RSA/DSA certificate exchange with the proposed PUF based scheme. For validation, we implement the proposed client-server authentication and key exchange modules in OpenSSL and compare it with RSA/DSA/ECDSA certificate sign and verify modules along with ECDH key generation module which already exist in OpenSSL. We finally discuss the pros and cons of of the proposed approach in the paper.

PUFSSL: An OpenSSL Extension for PUF based Authentication

A digital communication network is typically the backbone of world wide web and web based applications. Security protocols, specifically in wireless network has undergone several rounds of modifications and upgrades in order to prevent supplicants (or clients) or authenticators (or access points) from attackers either sitting physically around the wireless coverage area or being hooked up to a wired network connected to wireless clients. The latest security protocol in the series is WPA2 (Wi-Fi Protected Access II) which has been implemented in most of the Wi-Fi stations (clients or access points) that are being used in traditional wireless networking as well as recent IoT and CPS devices. Recently a severe replay attack named Key Reinstallation AttaCK (KRACK) has shown that the handshake in WPA2 protocol suite can be compromised and enforce the stations to reuse an old set of initialization vectors (IVs). In this work, we propose to use an unconventional hardware security primitive named Physically Unclonable Functions (PUFs) to nullify the impact of KRACK attack by ensuring a mutual authentication before establishing the communication between the authenticators and the supplicants. In this demo, we show i) how the hardware intrinsic properties of a device can be leveraged to embed a PUF instance in each device, ii) a working prototype of PUF based authentication protocol using Z-Turn board integrated with dual-core ARM Cortex-A9 processor and Artix-7 FPGA, iii) how this protocol can be integrated with existing handshake protocol in WiFi network to resist against KRACK attacks.

Stupify: A Hardware Countermeasure of KRACKs in WPA2 using Physically Unclonable Functions

The present disclosure is related in general to performance assessment and a method and a system for determining performance of an application installed on mobile stations. An application performance detection system configures each of the mobile stations upon receiving a performance assessment request to ensure deactivation of hardware and software modules that cause additional network traffic and resource utilization. Further, the application performance detection system receives application data from the mobile stations thus configured and determine Key Performance. Indices (KPIs) based on the application data. Rating of the application is determined based on the KPIs that can efficiently detect low rated application design that requires re-engineering. Finally, performance of the application is verified that helps in achieving significant reduction in operational data costs, improved device battery life, improved user experience and efficient network resource usage. Further, the present disclosure suggests an optimized application to users based on their geographic location.

Debashis Mahata

Papers

Building PUF Based Authentication and Key Exchange Protocol for IoT Without Explicit CRPs in Verifier Database

PUF+IBE: Blending Physically Unclonable Functions with Identity Based Encryption for Authentication and Key Exchange in IoTs.

PUFSSL: An OpenSSL Extension for PUF based Authentication

Stupify: A Hardware Countermeasure of KRACKs in WPA2 using Physically Unclonable Functions

Method and system for determining performance of an application installed on mobile stations