Security Evaluation of Provably Secure ECC-Based Anonymous Authentication and Key Agreement Scheme for IoT.

Area of Science:

• Cybersecurity
• Network Security
• Internet of Things (IoT)

Background:

• The Internet of Things (IoT) presents significant data and user privacy challenges due to device vulnerabilities.
• Robust authentication and key agreement (AKA) protocols are crucial for secure data exchange between IoT devices and servers.
• A previously proposed ECC-based AKA scheme for IoT claimed comprehensive security.

Purpose of the Study:

• To critically analyze the security of a novel ECC-based Anonymous Authentication and Key Agreement (AKA) scheme for IoT.
• To identify and demonstrate vulnerabilities within the previously proposed IoT AKA protocol.
• To propose recommendations for enhancing the security of IoT AKA protocols.

Main Methods:

• Security analysis using the extended Canetti and Krawczyk (eCK) model, simulating a powerful adversary.
• Logical and mathematical validation of the protocol's security assumptions and functionalities.
• Formal verification using the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool.

Main Results:

• The analyzed ECC-based AKA scheme is demonstrated to be vulnerable to various security attacks.
• The protocol fails to meet essential security requirements, including session key security.
• Flawed security assumptions underpin the original protocol's claimed security.

Conclusions:

• The previously proposed ECC-based AKA protocol for IoT is not secure as claimed.
• There is a critical need for improved and rigorously validated AKA protocols for the Internet of Things.
• Recommendations are provided to guide the development of more resilient IoT security solutions.