Towards Information-Theoretic Security and Privacy in IoT: A Three-Factor AKA Protocol Supporting Forgotten Password...

Area of Science:

• Cybersecurity
• Internet of Things (IoT)
• Network Security Protocols

Background:

• The proliferation of Internet of Things (IoT) devices presents significant security challenges, particularly in establishing secure and efficient authentication and key agreement (AKA) protocols.
• Existing AKA protocols often struggle to balance robust security with the resource constraints inherent in IoT environments.

Purpose of the Study:

• To propose a novel, secure, and efficient three-factor authentication and key agreement (AKA) protocol specifically designed for the Internet of Things (IoT).
• To enhance user anonymity, ensure forward secrecy, and provide resilience against prevalent attacks such as replay, impersonation, and de-synchronization within IoT networks.

Main Methods:

• Development of a three-factor authentication scheme integrating password, biometric, and device-based authentication.
• Integration of a secure lost-password-reset functionality to improve user experience and protocol usability.
• Rigorous security analysis against standard adversaries and performance evaluation comparing computational and communication efficiency.

Main Results:

• The proposed protocol effectively integrates password, biometric, and device factors for robust authentication in IoT.
• The scheme demonstrates strong security guarantees, including user anonymity, forward secrecy, and resilience against replay, impersonation, and de-synchronization attacks.
• Performance evaluations indicate superior computational and communication efficiency compared to existing solutions.

Conclusions:

• The presented three-factor AKA protocol offers a practical, scalable, and secure solution for the Internet of Things (IoT).
• The protocol meets high security standards while respecting the operational constraints of IoT systems, including enhanced usability through password recovery.
• This work contributes a significant advancement in securing IoT ecosystems against sophisticated cyber threats.