1 Introduction

IoT is a new Internet-based technology that includes millions of interconnected embedded smart things. This technology integrates various smart devices with embedded sensors that interact with each other without human intervention (Alaba et al. 2017; Jazebi and Ghaffari 2020; Singh et al. 2017). The security of Wireless Sensor Networks (WSNs) (Azari and Ghaffari 2015; Ghaffari 2014; Ghaffari and Rahmani 2008; Ghaffari and Takanloo 2011; KeyKhosravi et al. 2010; Khabiri and Ghaffari 2018; Mohammadi and Ghaffari 2015) has become a critical challenge due to the widespread deployment of this technology in IoT (Liu et al. 2016). In modern farming, the watering process is one of the most important processes due to shortage of sweet water in most of the area of the world (Burton et al. 2018). Hence, security is the main challenge in IoT devices and the implementation of IoT services depends on protecting this technology against unwanted threats and security attacks (Sharma and Kalra 2018). Cryptography schemes prepare a fundamental security layer for data and various applications. Recently, with the rise of IoT, we need lightweight and efficient cryptographic schemes (Saha et al. 2019).

1.1 Motivation

Misuse of irrigation information, Distributed Denial of Service (DDoS), and Side-Channel Attacks (SCAs) are some common IoT threats (Agale and Gaikwad 2017). Smart irrigation systems use humidity-meter sensors to evaluate whether through soil moisture and the chance of rainfall (Gulati and Thakur 2018). They have a flexible design that allows farmers to appropriately determine irrigation time and plant moisture requirement or even delay irrigation when the chance of rain is high, which saves water and helps boost the harvest (Hendrawan et al. 2019). Despite the advantages offered by smart irrigation systems, there are security challenges that vary by performance and the environment (Babayiğit and Büyükpatpat 2019). IoT infrastructure facilitates the expansion of public spaces and offers a wide range of programmable services, but is also prone to many threats and security attacks.

To have successful access control on the IoT, several principles and features must be considered (Qiu et al. 2020b). The most important features that should be considered in access control are: confidentiality, data accuracy, and information access levels. Access control method can effectively monitor the access activities of resources, and ensure authorized users to access information resources under legitimate conditions (Li et al. 2019; Tian et al. 2020b).

In IoT environment, security of devices, communication protocols and different layers must be considered (Tian et al. 2020a). Unfortunately, a significant number of IoT devices have security vulnerabilities and are vulnerable, which can allow hackers and malicious individuals to damage and disrupt the operation of these devices and destroy users' privacy (Qiu et al. 2020a). Due to the nature and characteristics of the sensors used in IoT and the insecure nature of the Internet, the IoT is vulnerable to various attacks, especially internal routing attacks. The IoT infrastructure should support security of data, software, hardware, and physical devices (Tian et al. 2019). Ensuring data security is a very important factor in building trust on users and using the IoT platform. Users need to make sure that the IoT is secure enough to carry out security activities against threats. Therefore, considering the confidentiality of data means the formation of trust in IoT (Chen et al. 2019).

1.2 Main contributions

The aim of this paper is to develop a new model for protecting sensitive data of IoT based irrigation system. This paper proposes a novel model based on RC4 (Stinson 1995), ECC (Miller 1986), and SHA-256 (Gilbert and Handschuh 2004; Yoshida and Biryukov 2006) algorithms to preserve IoT security. In the proposed model, data are first encrypted by RC4 and ECC, and then transformed into a hash state using SHA-256.

The main contributions of this paper are as follows:

  1. 1)

    Design secure and efficient data transport scheme in the IoT environment.

  2. 2)

    Increasing security with encryption of the RC4 key by ECC.

  3. 3)

    Encrypting RC4 based cipher text using the SHA-256 algorithm to improve data integrity.

  4. 4)

    Improving encryption/decryption time, throughput and desirable confidentiality based on secrecy analysis.

The irrigation sensors, smartphone, data collection, public communication network and the IoT network are exposed to different security threats and most of the time the main reason was the vulnerabilities from the data manipulation. There are various vulnerabilities, threats and attacks in IoT-based smart irrigation system that proposed model prevent to their influence.

1.3 Organization of the paper

The rest of the paper is organized as follows: Sect. 2 provides a review of the literature. Section 3, describes the proposed model based on RC4, ECC, and SHA-256. Section 4, evaluates and compares the results of the proposed model. Finally, Sect. 5 concludes the paper and provides some future works.

2 Related works

To tackle security problems in IoT environment, researchers have presented various and numerous security solutions using cryptography schemes. This section describes previous and related works in the area of IoT security.

KP-ABE algorithm is used as an appropriate security mechanism for heterogeneous encryption, and is widely deployed for implementing access control solutions. Touati and Challal (2016) used this algorithm for IoT security through three phases: initialization and key generation, data encryption, data decryption and extraction. Encryption is vital for privacy in healthcare plans. IoT demands an efficient and low-energy cryptographic algorithm, Khader et al. (Khader et al. 2017) used modified AES algorithm to propose a low-energy cryptographic mechanism for IoT sensors. AES is a common method that uses a 128, or 192, or 256-bits key for encryption and decryption.

A hidden ciphertext policy Attribute-based Encryption (ABE) was proposed in (Belguith et al. 2018) that preserved privacy and had low processing overhead. Similarly, an ABE-based model has proposed in (Yang et al. 2017) for health system to prevent unauthorized access and protected security. In (Yao et al. 2015), a cryptographic scheme based on ABE and ECC has proposed to deal with security and privacy issues in IoT. Results demonstrated high productivity and low computational costs of the proposed model. The ABE to prevent hidden access to IoT data was offered in (Han et al. 2018). A new CP-ABE scheme has proposed which can protect the user’s attribute values against the attacks. A KP-based encryption model has proposed for access control in IoT (Lee et al. 2015). A biometric system to develop healthcare system based on IoT with high data accessibility was offered that identifies users by certain physiologic attribute vectors. The attributes vector is saved in database. This system features a high confidence coefficient (Hamidi 2019).

Privacy and security issues of IoT users were considered in (Wei and Zhou 2018). One essential problem is access to server to obtain information through mobile phones. To this end, homomorphic encryption and ABE were used. Homomorphic encryption allows for direct encryption of an infinite number of calculations without disclosing the secret keys. Diffie–Hellman (DH) encryption is also used for IoT security and privacy. It uses RSA heterogeneous encryption to generate keys between the application and the server, and then uses symmetric AES algorithm to encrypt communications between them by the generated key (Xu et al. 2019a). Diffie–Hellman encryption is used to deal with security and privacy challenges in IoT cloud. A fast encryption protocol has proposed in cloud servers (Wu et al. 2018). An AES-based encryption scheme with a 128-bit key for building a secure session between things was proposed with high computational efficiency, los costs and proved strong against different attacks like service denial, response attack, and physical manipulation attack (Jan et al. 2019). RSA algorithm is used for improving the security of IoT information. It is noticeably fast and is applied in many electronics (Hu 2011). RSA is also used for security infrastructure of IoT (Kothmayr et al. 2012). It is mounted on a hardware platform with low power for IoT.

Data security is also important in cloud computing. Some mechanisms like access control are used for this purpose. In (Pant et al. 2015), RSA was used for protecting data while sharing or storing data in cloud environment. Security of MQTT protocol was also provided by RSA. It is a binary and lightweight machine-to-machine protocol to transmit data with high confidence to resource-constrained clients. As a data-centric protocol, MQTT is better than other existing web protocols like HTTP because it has the least package overhead and is suitable for short message transfer while HTTP is document-centered and is used for sending video files, etc. (Mektoubi et al. 2016).

IoT implementation in healthcare centers is usually based on radio frequency. RFID authenticates RFID tags and readers. An authentication scheme based on ECC&RSA between RFID tags and readers and the server was proposed in (Jisha and Philip 2016) to promote data security. RSA, AES, and TDES have been proposed for IoT data encryption (Matsemela et al. 2017). A proper security algorithm for IoT is adopted in terms of time, memory, and processing. Data are encrypted, decrypted and encrypted once again, yielding a 168-bit key that is long enough for many sensitive data. Thus, Triple-DES is a stronger standard than DES. Results of testing the security algorithms show that AES has a better performance in terms of computational time, memory use and processing. The large key length in AES ensures higher protection levels. However, it has some deficits such as inability to authenticate and encrypt different data types including videos, photos, and audio files. Therefore, we used a combination of the above algorithms.

A security scheme based on RSA and ECC for IoT data has proposed that used RSA security blocks to promote security level (Chhabra and Arora 2017). A hybrid and secure algorithm for data storage and transmission in IoT cloud was proposed where the data are encrypted by AES before transmission. AES key is encrypted using RSA system. Moreover, RSA encryption key with authorized users is shared through email (Chandu et al. 2017). IoT are vulnerable to malware attacks such as buffer overflows, denial-of-service, and Trojan horse, worms, viruses and malicious codes. These attacks are modified by RSA and AES algorithms (Abinaya et al. 2018). TLS protocol was tested by RSA in terms of security measures, scalability, power consumption and data usage. The results were the compared to ECC. Key length in ECC provides a reasonable security level. TLS is mostly applied in transmission layer in wired and mobile networks and is used to provide a secure communication. Its specific mechanisms help establish data confidentiality, integrity and privacy (Suárez-Albela et al. 2018).

Network layer in IoT are vulnerable to probable attacks which disturb the connection between devices in the absence of encryption algorithms. To solve this, an RSA-based access protocol was designed that offers a safe interface in network layer. In such cases, the controller and the recipient device verify each other and generate a session key for next communications (Mao et al. 2018). RSA and DES encryption techniques are used for encrypting data frames. DES is a mathematics algorithm used for encrypting and decrypting coded information. It is computationally efficient and is executed by slow processors. 64-bits data are encrypted and decrypted by 56-bits keys. RSA is used to enhance cryptography and privacy processes (Hussain et al. 2017). CP-ABE-based RSA was proposed to guarantee a secure communication between IoT server and devices (Odelu et al. 2017). In (Xu et al. 2019b), an access control based on attributes on IoT cloud has used that allows the data owners to effectively manage the validity of data users and block unauthorized users.

Table 1 summarizes the proposed models of IoT security.

Table 1 Proposed models for IoT security

3 Proposed scheme

Security is a crucial challenge in IoT based irritation systems because they include databases, information files, and interconnected sensors and devices. This paper proposes a secure scheme for IoT environment in smart irrigation systems using RC4 and ECC algorithms. In the proposed scheme, RC4 and ECC algorithms are used for encryption and SHA-256 is used for hashing the irrigation data. Figure 1 demonstrates the IoT-Based smart irrigation system.

Fig. 1
figure 1

IoT-Based smart irrigation system

3.1 ECC scheme

ECC is an algebraic structure of elliptic curves scheme on finite fields. The basic advantage of ECC to other asymmetric algorithms is the small key length that improves processing time. The security of ECC is based on an exponential discrete logarithm that is hard to break. ECC is applied in finite fields. Assume p is a prime number and \(Fp\). as a set of integers smaller than p, the two-dimensional coordinate of elliptical bend E is defined by Eq. (1) as follows (Miller 1986):

$${\mathbf{y}}^{2} = {\mathbf{x}}^{3} + {\mathbf{ax}} + {\mathbf{b}}.$$
(1)

where \(a,b \in F_{p}\). and \(4a^{3} + 27b^{2} \ne 0 \left( {mod p} \right)\).. If a point in (x, y) is te in Eq. (1), it belongs to elliptical bend. Moreover, \(E\left( {F_{p} } \right)\). is a set of all points on the elliptical bend, and Q is a point on E. in ECC encryption, a random number x in the interval [1, n-1] from \(Fp\). field is selected as the private key. Then, public key H is calculated as \(H = x.Q\). In ECC, a character is converted to bites that are then converted to (x, y) bites. These pnts are encrypted on an elliptical bend which is finally converted to bites. Encryption of an elliptical bend is performed as the following:

  1. (1)

    Initialization: Sides of the elliptical bend E and generator Q of order p agree with each other.

  2. (2)

    Pubic key generation: The public key is generated as \(H = x.Q\). and H is shared as the public key between the sender and receiver. x is the private key that the sender uses for decryption.

  3. (3)

    Encryption: To encrypt the message \(m \in EQ\)., random number r is selected and encrypted by Eq. (2). The data owner sends C to the receiver in order to deliver message m (Miller 1986).

    $${\varvec{C}} = {\mathbf{Enc}}\left( {\varvec{m}} \right) = \left\{ {\begin{array}{l} {{\varvec{c}}_{1} = {\varvec{rQ}}} \\ {{\varvec{c}}_{2} = {\varvec{m}} + {\varvec{rH}}} \\ \end{array} } \right..$$
    (2)
  4. (4)

    Decryption: The receiver uses C and the private key(x) for the decryption phase tough E (3) (Miller 1986).

    $${\mathbf{Dec}}\left( {\varvec{C}} \right) = {\varvec{c}}_{2} - {\varvec{x}}.{\varvec{c}}_{1} = {\varvec{m}} + {\varvec{rH}} - {\varvec{xrQ}} = {\varvec{m}} + {\varvec{rxQ}} - {\varvec{xrQ}} = {\varvec{m}}$$
    (3)

3.2 RC4 and SHA-256 algorithms

RC4 algorithm includes two phases: (1) the Key Scheduling Algorithm (KSA) phase and (2) the Pseudo Random number Generation Algorithm (PRGA) phase. KSA phase extends the S-box to 256 bytes. Finally, PRGA phase produces a pseudo-random key stream and XOR encryption with the plain text to form a cipher text. Algorithm-1 and Algorithm-2 define the KSA and PRGA respectively.

figure a
figure b

The SHA-256 scheme includes seven logical functions that work on 32-bits words represented by x, y, and z. SHA-256 input may be a string of 264 with a block size of 512-bits divided to 16 words of 32-bits. Messages are divided into blocks. A, B, C, D, E, F, G, and H variables are used as initial states of hashing. SHR operator moves data bits to the right. It shifts all target operand bits to the right. ROTR rotates its target bit operands to the right. A bit exported from the right enters the operand from the left.

3.3 Proposed secure scheme

The proposed scheme uses ECC to encrypt the key of RC4 algorithm. Then, the encrypted key of RC4 is transformed to SHA-256 scheme for hashing purpose and generating an enigmatic data. SHA-256 algorithm hashes the RC4 based cipher text to improve data integrity. Figure 2 depicts the flowchart of the proposed scheme based on hybrid of RC4, ECC, and SHA-256.

Fig. 2
figure 2

Flowchart of the proposed scheme

Due to small key size of ECC, this algorithm is appropriate for encrypting information of IoT sensors. In the proposed scheme, a combination of RC4 and ECC is used for high security levels. Figure 3 shows the encryption/decryption steps of the proposed model.

Fig. 3
figure 3

Encryption/ Decryption steps for the proposed scheme

Weak Key Scheduling Algorithm (KSA) will make the encrypted data under risk. To secure data transmission, a secure channel must be guaranteed between the user and the server of IoT. In this regard, lightweight ECC is a critical component for constructing the security system of IoT (Liu et al. 2016). Encryption is done on a data file D = (M1,…, Mn) where M is the text. The data must be encrypted using the encryption RC4 with a key K' (Encrypted key by ECC) where K ≠ K'. To preserve the RC4 key, the proposed scheme uses ECC encryption. Finally, SHA-256 scheme use for hashing the encrypted data.

4 Performance evaluation

The simulation experiments will compare the confidentiality of the proposed encryption algorithm, the encryption and decryption time, the encryption and decryption throughput, the average secrecy value and the amount of encrypted data.

The hardware facilities of the simulation experiments are Intel Core i7(2.0 GHZ), 8G memory, equipped with 64-bit Windows 8 operating system, the programming language is C#.NET 2017. Table 2 shows simulation parameters value.

Table 2 Simulation parameters value

In this paper, small file size, the key size has not important impact on the encryption/decryption time. But it is important for the level of security. In this paper, AES-128 algorithm (128 bits key size) is used.

4.1 Cipher text Size

Figure 4 shows a comparison of the plaintext size and ciphertext size based on different models. The X-axis represents the plaintext size and the Y-axis represents the cipher text size. In the proposed model, the ciphertext size is smaller than other models, which indicates an important improvement for the proposed model. The size of the data is changed from 20 to 1000 KB and ciphertext is calculated.

Fig. 4
figure 4

Comparison of different models based on plaintext and ciphertext

From Fig. 4, it is clear that the cipher text file size for the proposed model is 1370 KB for 1000 KB, 3DES&ECC&SHA-256 takes 2436 KB, RC4&3DES&SHA-256 takes 1827 KB, AES&RC4&SHA-256 takes 1827 KB, AES&3DES &SHA-256 takes 2436 KB, RC4&AES&SHA-256 takes 1827 KB.

4.2 Encryption/decryption time

Table 3 compares encryption time of the proposed model and other models. It is clear the proposed model is the most time-efficient model, and AES&3DES&SHA-256 has an average shorter encryption time than other models.

Table 3 A comparison of encryption time of the proposed model and other models

Figure 5 shows the chart of encryption time of the proposed model and other models. It is concluded that encryption time is directly related to file size, i.e., larger file demand longer encryption time.

Fig. 5
figure 5

Encryption time of the proposed model and other models based on file size

Table 4 compares decryption time of the proposed model and other models. As can be seen, decryption time in the proposed model is shorter than other models. A 1 MB file is decrypted at 97 ms, which is shorter than other models.

Table 4 A comparison of decryption time of the proposed model and other models

Figure 6 shows decryption time of the proposed model and other models based on file size. The proposed model has a better performance than others.

Fig. 6
figure 6

Decryption time of the proposed model and other models based on file size

Figure 7 compares average encryption/decryption time of the proposed model and other models for different file sizes, such as (20–1000 KB based on average).

Fig. 7
figure 7

A comparison of average encryption/decryption time of the proposed model and other models

4.3 Encryption/decryption throughput

Encryption throughput is calculated based on plaintext divided by total encryption time. Higher throughput indicates algorithm strength and efficiency. Encryption throughput of the proposed model is higher than other models. Table 5 shows encryption throughput of the proposed model. Decryption throughput is calculated based on plaintext divided by total decryption time. Decryption throughput of the proposed model is higher than other models. Table 6 shows decryption throughput of the proposed model based on file size. Encryption and decryption throughputs of the proposed model are calculated using Eqs. (4) and (5) as follows:

$${\text{Encryption Throughput}} \left( {KB{\text{/ms}}} \right) = \frac{{\sum \left( {\text{Input file}} \right)}}{{\sum \left( {\text{Encryption time}} \right)}}$$
(4)
$${\text{Decryption Throughput}} \left( {\frac{KB}{{{\text{ms}}}}} \right) = \frac{{\sum \left( {\text{Input file}} \right)}}{{\sum \left( {{\text{Decryption}}} \right)}}$$
(5)
Table 5 Encryption throughput of the proposed model and other models
Table 6 Decryption throughput of the proposed model and other models

Figure 8 shows encryption throughput of the proposed model which has a superior performance than other models.

Fig. 8
figure 8

Encryption throughput of the proposed model and other models based on file size

Figure 9 shows decryption throughput of the proposed model which has a better performance than other models.

Fig. 9
figure 9

Decryption throughput of the proposed model and other models based on file size

Figure 10 compares encryption/decryption throughput of the proposed model and other models based on file size.

Fig. 10
figure 10

A comparison of encryption/decryption throughput of the proposed model and other models based on file size

4.4 Secrecy of cipher

This section deals with the security analysis of the proposed model and other algorithms. The principle of privacy is calculated using Shannon's law (Weerasinghe 2013). The purpose of this metric is to verify the confidentiality of data. Secrecy is one of the most essential metrics in confidentiality. Figure 11 shows the average secrecy value acquired by proposed model, 3DES & ECC & SHA-256, RC4 & 3DES & SHA-256, AES & RC4 & SHA-256, AES & 3DES & SHA-256, and RC4 & AES & SHA-256 are about 1.1715, 0.9828, 0.8443, 1.097, 0.9988, 0.8455 respectively for 1000 KB. It can be seen from Fig. 11 that the proposed scheme has obvious advantages over other schemes in terms of confidentiality, and the secrecy value.

Fig. 11
figure 11

Secrecy of Ciphers Vs Data Size

4.5 Security properties

In this section, the security analysis on the basis of six parameters has been done in order to compare the proposed scheme with the other models. Table 7 shows the detailed comparison between the proposed model and other models for securing data communication in IoT.

Table 7 Comparison of the proposed model based on various security properties

A replay attack involves retransmitting previously intercepted packets. A replay attack occurs when the attacker has information such as keys as well as previous messages. When the connection is disconnected, the attacker uses this information to connect the system and to introduce himself as one of the trusted users. In the proposed scheme, due to the encryption of RC4 scheme key by the ECC algorithm, the attacker cannot access the original key and original message.

Man-in-the-Middle (MiM) attack where the attacker interrupts the communication between user and server of IoT and redirects or may modify the exchange messages without knowledge of them. The ECC algorithm prevents the MiM attack. SA is sending kA, the attacker generates \(\hat{k}_{A}\) and sent \(\hat{k}_{A}\) to SB and SB generates kB and sent kB to SA but attacker intercepts that message and sends \(\hat{k}_{A}\) to SA. Now, SA compute KAB, SB compute KBA. The MiM attack is detected based on following rules:

$$SA - kA.P \to {\text{Attacker}} \to SA = \widehat{k}_{A} .P$$
$$SB = kB.P$$
$$KAB = \hat{k}A.SB$$
$$KBA = kB.SA$$
$$KAB \ne KBA$$

Because the attacker has no awareness of the random number, the session key cannot be directly calculated, as it is protected by a high entropy ECC point. Thus, the proposed model commitment the session key security.

Data integrity guarantees that the data to be sent has not been changed or modified during transmission. Integrity includes maintaining the consistency, accuracy, and validity of the data.

4.6 Comparison and analysis

Table 8 compares the proposed model with other models. Encryption and decryption times are shorter than ECC (Ragab et al. 2019b) and RSA (Ragab et al. 2019a, b) algorithms. File sizes of 1 MB, 20 MB, 50 MB, and 100 MB, along with a 128-bits key length, were used. The key length in TEA&ECC (Ragab et al. 2019b) was 32-bits. Results show that the encryption time of a 100 MB file in TEA&ECC is 10.42 s and the proposed model is 10.98 s with 128-bits key length. Encryption time of the proposed model was shorter than XXTEA&ECC, XTEA&ECC which are developed from TEA&ECC. Decryption times of the same file for TEA&ECC and the proposed model were 6.01 s and 10.82 s. The decryption time of the proposed model is shorter than XXTEA&ECC, XTEA&ECC.

Table 8 A comparison of the proposed model with other models

Table 8 shows that a 100 Mb file is encrypted in TEA&RSA model in 12.12 s, which is done in 10.98 s in the proposed model. The same file is decrypted in 6.29 s and 10.82 s, respectively. Encryption and decryption times of the proposed model are shorter than XXTEA&ECC (Ragab et al. 2019a, b), XTEA&ECC (Ragab et al. 2019a, b) models. Figures 12 and 13 compare encryption/decryption time of the proposed model and other models (Ragab et al. 2019a, b) based on file size.

Fig. 12
figure 12

A comparison of encryption time of the proposed model and other models based on file size

Fig. 13
figure 13

A comparison of decryption time of the proposed model and other models based on file size

Table 9 compares encryption/decryption throughput of the proposed model with other models. It is revealed that efficiency of the proposed model compared to XXTEA&ECC (Ragab et al. 2019b), XXTEA&RSA (Ragab et al. 2019a, b), XXTEA&RSA (Ragab et al. 2019a, b), 3DES & ECC & SHA-256, RC4 & 3DES & SHA-256, AES & RC4 & SHA-256, AES & 3DES & SHA-256, and RC4 & AES & SHA-256 is 28%, 57% and 50%, 28%, 42%, 38%, 19%, 23% respectively. Hence, the proposed scheme has obvious advantages over other algorithms in terms of encryption/decryption throughput, and has excellent encryption efficiency.

Table 9 A comparison of encryption/decryption throughput of the proposed model and other models

5 Conclusion and future works

In this paper we focus, on the security of IoT based irrigation system using RC4, ECC, and SHA-256 algorithms. Firstly, we use The ECC algorithm for improving the security of RC4 scheme by encrypting the key of this scheme. Then, SHA-256 algorithm is used to hashing the encrypted data. We then proved the security of the proposed scheme, as well as demonstrating the utility of the scheme in comparison to other related works in the literature. Extensive simulations validate the effectiveness of the proposed scheme on performance, encryption/decryption time, throughput, and security. Future works will focus on evaluating and refining the proposed scheme to make it applicable for real irrigation system.