An Anonymous Authentication and Key Update Mechanism for IoT Devices Based on EnOcean Protocol

Area of Science:

• Computer Science
• Cybersecurity
• Network Protocols

Background:

• EnOcean is a smart lighting control protocol offering authentication and integrity but vulnerable to device identity interception.
• Attackers can exploit intercepted data to analyze user habits and compromise security.
• Existing protocols lack robust mechanisms for device anonymity and dynamic key updates.

Purpose of the Study:

• To formally analyze the security vulnerabilities of the EnOcean protocol.
• To propose a novel, enhanced protocol (EnOcean-A) addressing identified security weaknesses.
• To ensure anonymity, untraceability, and resistance to key compromise impersonation attacks (KCIA).

Main Methods:

• Formal security analysis using Colored Petri Net (CPN) theory.
• Application of the Dolev-Yao attacker model.
• Development and formal verification of the proposed EnOcean-A protocol.

Main Results:

• The original EnOcean protocol is susceptible to KCIA due to unanonymized device identities and lack of key update mechanisms.
• The EnOcean-A protocol effectively anonymizes device identities using homomorphic hash functions.
• EnOcean-A introduces a trusted third-party server for dynamic key distribution, achieving forward security and resisting KCIA.

Conclusions:

• The EnOcean protocol has significant security flaws regarding device identity and key management.
• The proposed EnOcean-A protocol provides enhanced security, including anonymity, untraceability, and resistance to sophisticated attacks.
• EnOcean-A represents a more secure alternative for smart lighting systems.