A Formally Validated Authentication Algorithm for Secure Message Forwarding in Smart Home Networks

Abstract

The many devices connected in smart homes increase the attack surfaces from which adversaries can invade the network. In addition, majority of these smart devices have numerous vulnerabilities that can be exploited to wreck havoc in smart homes. As such, a myriad of security schemes have been presented based on technologies such as bilinear pairing operations, public key infrastructure, blockchains and elliptic curve cryptosystems. However, some of these protocols are not robust against conventional smart home attacks. In addition, some of the deployed techniques inadvertently result in excessive processing at the smart devices. It is, therefore, imperative that provably secure protocols be developed to offer efficiency and sufficient protection to the exchanged packets. In this paper, an elliptic curve symmetric key-based algorithm for secure message forwarding is presented. Formal security verification is executed using the Burrows–Abadi–Needham (BAN) logic which demonstrates strong mutual authentication and session negotiation among the communicating entities. In addition, the informal security analysis carried out shows the robustness of this scheme under the Canetti–Krawczyk threat model. Moreover, it is relatively efficient in terms of storage, communication, energy and computation requirements.

Introduction

Smart homes offer users enhanced quality of life, convenience as well as comfort through the exchange of real-time data. A typical Smart Home (SH) can provide intelligent and automated remote monitoring of the various activities [1]. It may comprise of remote users, registration authority, gateways and smart devices [2]. The smart devices in these networks may include refrigerators, cameras, television sets, motion sensors, lighting systems, doorbells, voice assistants and thermostats [3]. The smartness in these devices is reflected in their ability to monitor and control activities, as well as offering the required support to the users. As pointed out in [4], the smart homes can potentially result in energy efficiency and, hence, reduction in power bills. Another significant technique for improving safety as well as energy efficiency is through the incorporation of Artificial Intelligence (AI). Here, the big data generated by sensors and other smart devices can be deployed to train machine learning algorithms to distinguish between normal and anomalous smart home activities. Essentially, any network traffic or events that are flagged as anomalous can be indicators of possible attacks in these smart homes. Once attacks are detected, various actuators can be activated to protect the smart homes. Evidently, AI can be deployed to offer safety, boost productivity as well as the well-being of users [5]. It is also possible to deploy AI for home users’ behavior analysis, which can help predict their needs and optimize both device and resource usage. To accomplish this, machine algorithms such as decision trees, support vector machines and neural networks can be trained and deployed [6]. Thereafter, any behavioral change may be construed to imply anomalies.

Although smart homes have numerous benefits, many threats, vulnerabilities and attacks lurk in these networks. This may be attributed to the massive number of heterogeneous connected devices which increase the surfaces from which attacks can be launched. In addition, majority of the connected devices do not adhere to security practices as well as standards of typical computing systems. As such, they can be hacked and deployed to spread malware. The message exchange between the smart devices and the remote users is via the public internet and hence is open to several attacks [7]. As such, smart homes inadvertently create new privacy, security and authentication challenges [8]. The possible attacks in this environment include unauthorized access, data forgery, tampering, impersonation, Distributed Denial of Service (DDoS) and offline-guessing attacks [9, 10]. Since most of the communication is through the gateways, this presents a single point of failure. As such, any successful attack on this centralized architecture can lead to user privacy leaks, device malfunction and even harm to the home occupiers [11].

Based on the discussion above, it is evident that smart home devices have become pervasive with increased connectivity. As such, vulnerabilities in any of these devices may lead to unauthorized access to entire home networks. For instance, any adversarial access to the smart home heating system may raise the house temperature. This may lead to fires, smart home hardware failures or even death. Therefore, it is clear that the security and privacy of the users need to be protected [1]. Failure to accomplish this may result in slow uptake of this important technology. Strong mutual authentication presents one of the most promising mechanisms of protecting against the aforementioned attacks [12]. For anomaly detection, there is need for highly efficient and accurate detection models capable of adapting to novel attacks, increasing number of devices as well as threat landscape. Blockchain technology has been proposed as another most effective way of enhancing privacy, security and transparency in smart homes [13]. Unfortunately, majority of the smart devices are resource constrained [14] to handle the high processing required in blockchains.

Research Contributions

Smart homes enhance quality of life and convenience to its users. However, the sensed data from the smart home devices are relayed to remote users over public channels. As such, the exchanged data are exposed to numerous threats and attacks. Due to the existence of many interconnected devices, any successful compromise of a single smart device can have devastating ripple effect to all other devices. Although proper authentications can prevent these attacks, the resource constrained nature of smart devices such as sensors limit the deployment of strong cryptographic primitives. In addition, majority of the conventional smart home protocols only mutually authenticate smart devices to the servers but fail to execute authentication among the devices. To this end, this paper makes the following major contributions.

• Elliptic curve cryptography is amalgamated with symmetric key and one-way hashing operations to develop a scheme that thwarts most of the conventional smart home attacks.

• The algorithm executes mutual authentication and key negotiation among the smart devices, in addition to authenticating the smart devices to the trusted authority. Here, the trusted authority cannot derive session keys negotiated among the smart home devices. In addition, other devices can never derive session keys established between a particular smart device and the trusted authority. As such, privileged insider, impersonation, session hijacking, denial of service, man-in-the-middle and stolen verifier attacks are prevented.

• Session delay tolerance and time-stamping are incorporated in the generated security tokens to avert packet replay attacks.

• Extensive formal security validation is executed on this scheme using BAN logic, which shows the existence of strong mutual authentication and session key negotiation among the communicating entities.

• Informal security analysis is carried out to demonstrate the robustness of this scheme under the Canetti–Krawczyk threat model.

As discussed in “Security Analysis” and “Performance Evaluation”, these approaches advance the state of the art authentication protocols in two ways. First, the deployed cryptographic primitives are fairly lightweight, and hence the developed scheme boosts network efficiency. Second, the negotiated session keys help in establishing secure communication channels among smart home devices as well as with the trusted authority.

Paper Organization

In “Related Work”, the authentication and key agreements protocols that have been presented to curb security and privacy issues in smart homes are discussed, including their shortcomings. “Mathematical Preliminaries”, “Security Goals and Requirements” and “Motivation” present mathematical preliminaries, security goals and requirements, as well as the motivation of this work, respectively. This is followed by the description of the proposed protocol in“The Proposed Scheme”. On the other hand, the security and performance analyzes are presented in “Security Analysis” and “Performance Evaluation”, respectively. Finally, “Conclusion” concludes the paper and offers some insights on future work in this particular domain.

Related Work

Security challenges in smart homes have prompted a lot of research, resulting in numerous schemes for anomaly detection and authentication. For example, authors in [15] have presented a scheme to distinguish between normal and anomalous activities. Similarly, the techniques in [10] and [16] deploy Hidden Markov Model (HMM) and are trained on sensor data. On the other hand, the approaches in [17] and [18] utilize Bayesian networks in their anomaly detection. In addition, flow-based attack detection scheme is presented in [19]. Using inbound and outbound sensor packets, a neural network-based anomaly detection scheme is developed in [20]. The attacks detected this way include Man-in-the-Middle (MitM) and Distributed Denial of Service (DDoS). However, authors in [21] have utilized a combination of machine learning and statistical techniques for behavioral analysis in smart homes. On the other hand, artificial neural networks and support vector machines have been utilized in [22] for network intrusion detection.

Although anomaly detection techniques play a significant role in securing smart homes, they are mainly concerned with activity detection. As such, they cannot execute the required access control in this environment. To address this shortcoming, many authentication and key negotiation protocols have been introduced based on various techniques. For instance, a three-factor authentication scheme based on Elliptic Curve Cryptography (ECC) is developed in [23] while a two-factor user authentication protocol is presented in [24]. However, the scheme in [23] cannot mutually authenticate all network entities and fails to uphold forward key secrecy. On the other hand, the protocol in [24] is susceptible to both stolen user device and insider attacks [25]. To offer decentralization [26] and prevent single point of failure in schemes based on centralized architectures, many protocols based on blockchain technology have been proposed in [8] and [27,28,29,30,31]. The security goals attained by these schemes include data integrity, availability, authentication, access control, user and data privacy. Unfortunately, these schemes have extensive computation requirements which are detrimental for majority of resource-limited smart home devices [32]. In addition, the protocol in [31] deploys a pair of private and public keys which further require high execution time.

The scheme in [33] can potentially address performance issues in blockchain-based techniques due to its reduced registration overheads. However, it is vulnerable to stolen smart device attacks. Similarly, the protocol in [2] is vulnerable to stolen smart device, impersonation, offline password guessing, privileged insider and packet replay attacks. In addition, it fails to provide anonymity and the usage of simple password exposes it to shoulder-surfing attacks [34]. To address some of the issues in [2], a two-factor authentication technique is developed in [25]. However, this protocol is still susceptible to session key disclosure and impersonation attacks. In addition, it has excessive communication and computation overheads [35]. On the other hand, the failure to incorporate random nonces and timestamps in [36] renders it susceptible to replay attacks. Similarly, the schemes in [37] and [38] are vulnerable to MitM and DoS attacks.

A scheme for remote user authentication is introduced in [39], while an identity-based security framework is presented in [40]. However, the protocol in [39] fails to offer forward key secrecy and cannot withstand stolen device, session key compromise and replay attacks [25]. On the other hand, identity-based scheme in [40] has key escrow issues [41]. To boost performance in smart home networks, a lightweight authentication protocol is developed in [35]. However, this scheme cannot provide integrity protection of the exchanged messages, leading to DoS [34]. Although the scheme in [42] is lightweight and hence applicable in most smart home devices, it cannot provide perfect forward key secrecy. This is because any compromise of its long terms key can facilitate adversarial computation of the session keys. On the other hand, the context-aware authentication approach developed in [43] has excessive execution time. Similarly, the multi-factor mutual authentication protocol in [44] has high computation overheads due to the bilinear pairing operations [45]. On its part, the protocol in [46] offers mutual authentication only between the devices and the server.

Mathematical Preliminaries

In this section, the cryptographic primitives for one-way hashing are provided, together with their collision resistant properties. The mathematical formulations for the deployed elliptic curve cryptography can be found in [7]. The second part of this section provides the mathematical preliminaries for symmetric key primitives, as elaborated below.

Symmetric Primitives

Symmetric algorithms (SA) comprise of symmetric key encryption algorithms (SKEA) and cryptographic hash functions. Here, SKEA can be stream or block ciphers. In the former, encryption is through the combination of plaintext and pseudo-random sequences. Each stream cipher takes key δ and initial value σ to produce pseudo-random key stream that is utilized in data encryption and decryption through bitwise exclusive or (XOR) operations.

Taking l as the block length and m as the cipher key size, then a block cipher is a transformation:

$$F:{\mathbb{C}}_{2}^{l} X {\mathbb{C}}_{2}^{m} \to {\mathbb{C}}_{2}^{l} ,$$

(1)

where $F_{m} \underline{\underline{{{\text{def}}}}} F\left( {.,m} \right)$ is a bijection of ${\mathbb{C}}_{2}^{l}$ for $m \in {\mathbb{C}}_{2}^{m}$.

Suppose that y = $F_{m} \left( {\mathbbm{r}} \right)$; then r becomes the plaintext, while m and y are the key and cipher-text of ${\mathbbm{r}}$ under key m, respectively.

One-Way Hashing

A cryptographic hash function denotes a map F whose input is a string of arbitrary length. It then transforms this input string into an output string of fixed length l. Every one-way hash function:

• (a) Takes argument a of arbitrary length and outputs h(a) that is of some fixed length l bits.

• (b) Given that b is the image of h, it is computationally infeasible to find message x such that h (a) = b. This one-way property is referred to as the pre-image resistance.

• (c) Given a in the domain of h and h (a), it is computationally cumbersome to find message a’ ≠ a such that h (a’) = h(a). In terms of F, this can also be written as F (a’) = F (a). This one-way property is referred to as the second pre-image resistance.

Suppose that ℕ is a set of all integers and a binary alphabet is denoted as ⅀ = {0, 1}. Then, for l $\in {\mathbb{N}}$, the set of all binary strings of length l is denoted as ⅀^l. On the other hand, the set of all strings of arbitrary length is expressed as ⅀^*. Let F be a function whose domain and range are denoted as Ή = ⅀^* and Ḡ = ⅀^l, respectively. Let us consider only inputs of bit length ḱ(l), where ḱ(l) is a function satisfying the condition ḱ(l) > l. With these definitions, the pre-image and second pre-image resistances can be written as follows:

• (d) A one-way hash function h is a function whose domain Ή = ⅀ ^ḱ(l) and range Ḡ = ⅀^l satisfy the following conditions:

Pre-image resistance: Suppose that x is uniformly chosen in Ή and let Ẵ be an attacker, who on inputting h(x), he utilizes time ≤ t to output Ẵ(h(x))ϵ Ή. For every attacker Ẵ:

$$\begin{array}{*{20}c} {P_{r} } \\ {x \in ^{\prime}H} \\ \end{array} \left\{ {h\left( {\tilde{\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\smile}$}}{A} }\left( {h\left( x \right)} \right)} \right) = h\left( x \right)} \right\} < \theta .$$

(2)

In (2), the probability is taken over some stochastically selected attacker Ẵ.

Second pre-image resistance: Suppose that x is uniformly chosen in ⅀ ^ḱ(l) and let Ẵ^* be an attacker, who on inputting x, he utilizes time ≤ t to output $x^{*} \in$ Ή and x ^* ≠ x. For every attacker Ẵ^*:

$$\begin{array}{*{20}c} {P_{r} } \\ {x \in ^{\prime}H} \\ \end{array} \left\{ {\tilde{\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\smile}$}}{A} }^{*} \left( x \right) = h\left( x \right)} \right\} < \theta .$$

(3)

In (3), the probability is taken over some stochastically selected attacker Ẵ. The pre-image and second pre-image resistance conditions are significant when $t/\theta$ is large and $t/\theta \le 2^{n}$

• (e) A collision-resistance hash function is a function h that satisfies condition (a), is one way (satisfies conditions (b) and (c)) and it is infeasible to find two distinctive messages that produce the same hash value.

Security Goals and Requirements

Massive and sensitive information flows in smart home networks. It is therefore paramount that proper security and privacy measures be instituted before the remote users can begin accessing data in these smart home devices. In light of this, the following security goals and requirements are pursued in this paper:

Backward and Forward Key Secrecy

An attacker located between the remote user and the smart home devices may have the ability of capturing the session key deployed for traffic encryption. As such, it should be infeasible for an adversary to derive the session key used for the previous and subsequent authentication sessions based on the current session key.

Mutual Authentication

To ensure that only legitimate entities access the smart home networks, all the entities initializing any connection requests should have their identities verified before any such access is granted.

Resilience Against Attacks

To ensure strong security in smart home networks, it should be infeasible for an adversary to launch typical smart home network attacks such as MitM, packet replays, privileged insider, session hijacking, DoS, impersonation, offline dictionary and stolen verifier.

Confidentiality

The smart home network-based sensors collect high volumes of sensitive and private data. As such, only authorized and fully authenticated entities should be allowed to access the sensed data.

Integrity

During data transmission across the public networks, the communicating parties should ensure that no malicious modifications are made to the data.

Availability

Within the smart home network, the remote users should be able to access the sensed data anywhere and at any time.

Scalability

It should be easy for the smart home to support additional smart devices without compromising the underlying security and privacy architecture.

Motivation

The transmission of senses data to the remote users over public wireless channels opens up the smart home networks to numerous attacks. Any successful attack on the smart devices may lead to malfunction of other devices or malicious control of the smart home devices. For instance, hacked heating systems may result in temperature increments that can endanger the lives of home occupiers. In addition, due to the interconnectivity of the smart home devices, any successful compromise of a single device can lead to privacy leaks and attacks on other devices. Although many protocols have been developed for smart home authentications, majority of them only authenticate the smart devices to the servers. As such, authentication among the smart home devices is largely ignored. This is detrimental as it facilitates attacks on other systems using vulnerabilities in other devices. In addition, the security solutions developed to address these issues are either inefficient or have security holes that can be exploited. Therefore, the inefficiency, privacy and security holes in most of the current authentication protocols need urgent solution.

The Proposed Scheme

The network entities in the proposed algorithm include the Smart Home Owners (SHOs), Trusted Authority (TA), the Smart Home Devices (SHDs) and the Mobile Devices (MDs) through which remote users interact with their SHDs. As shown in Fig. 1, the smart home devices may include smart doors, TV, thermostats, cameras, lighting systems and refrigerators.

Fig. 1

Network architecture

All smart home devices as well as mobile devices are registered at the trusted authority before they are permitted to communicate with each other. After registration, all MDs and SHDs have to execute mutual authentication with the TA and negotiate a session key. Similarly, the MDs and the SHDs must also mutually authenticate each other before exchanging any messages. As such, the proposed scheme is highly scalable to support additional smart devices within this authentication architecture. The communication channel between the MDs and the SHDs may be cellular network such as the Fifth Generation (5G). Table 1 presents the symbols used in this paper together with their brief descriptions.

Table 1 Notations and their descriptions

In terms of the actual execution, the proposed algorithm comprises of the registration phase, SHDs-TA authentication, MD-TA authentication, and SHDs-MD authentication. The sub-sections below describe these phases in more details.

Registration Phase

In this phase, the smart home devices as well as the remote user mobile devices are registered at the trusted authority. Basically, the MD and SHD registration procedures are the same and hence only the SHD registration is described here. This is a three-step process as detailed below.

Step 1: The smart home device selects ID_SHD as its unique identity, which it forwards to the trusted authority over secure channels.

Step 2: Upon receiving ID_SHD, the trusted authority generates random number R₁ which it utilizes to derive A₁ = h (R₁||TA_SV||T₁||ID_SHD), A₂ = A₁ × G, A₃ = R₁ ⊕ h (TA_SV), A₄ = h (R₁ ⊕ h (TA_SV)||A₂) and A₅ = A₄ × G. Finally, the trusted authority stores parameter set {ID_SHD, T₁, A₃, A₅} before sending A₂ to the smart home device as shown in Fig. 2.

Fig. 2

Registration and device–TA authentication

Step 3: After getting A₂ from the TA, the SHD stores it in its memory for use in the authentication phase.

Device–TA Authentication Phase

In this phase, both the SHD and the MD mutually authenticate themselves to the TA. After successful authentication, they negotiate session keys between themselves and the TA. This is a five-step process as discussed below.

Step 1: The SHD generates random number R₂ that it uses to compute security parameters B₁ = R₂ × G and B₂ = h (B₁||R₂ × A₂). Next, it sends these two parameters in authentication message AM₁ = {B₁, B₂} to the TA for verification as shown in Fig. 2.

Step 2: On receiving parameters B₁ and B₂, the TA deploys T₁, TA_SV and A₃ to compute A₁ and utilize it to confirm the validity of both B₁ and B₂. To accomplish this, parameter B₂^* is computed as B₂^* = h (B₁||A₁ × B₁). Next, it checks if B₂^* $\stackrel{?}{=}$ B₂ such that the session is terminated when this verification fails. Otherwise, it generates random number R₃ that is used to derive parameters B₃ = R₃ × G and B₄ = h (B₂^*||R₃ × A₅). Finally, the TA sends authentication response message AM₂ = {A₃, B₃, B₄} back to the SHD over public channels.

Step 3: After obtaining {A₃, B₃, B₄} from the TA, the SHD validates the TA by computing parameter A₄ as A₄ = h (A₃ × A₂). On condition that the computed A₄ is legitimate, the SHD proceeds to derive parameter B₄^* = h (B₂||A₄ × B₃). Next, it checks whether B₄^*$\stackrel{?}{=}$ B₄ such that the session is terminated if the two parameters do not match.

Step 4: The SHD uses B₃ and B₄^* to compute parameter C₁ and the ℚ_ST as C₁ = h (B₄^*||R₂ × B₃) and ℚ_ST = h (B₃||R₂ × B₃). Finally, it sends the computed parameters to the TA in authentication message AM₃ = {C₁, ℚ_ST} over public channels.

Step 5: After getting parameter C₁ and session key ℚ_ST from the SHD, the TA re-computes them as C₁^* = h (B₄||R₂ × B₃) and ℚ_ST^* = h (B₃||R₃ × B₁). Next, it confirms whether C₁^*$\stackrel{?}{=}$ C₁ and ℚ_ST ℚ_ST^*$\stackrel{?}{=}$ ℚ_ST. Here, the session is terminated when these verifications are unsuccessful.

Otherwise, the TA and SHD set ℚ_ST ^* = ℚ_ST as the session key for the current session. Similar procedures are followed by the MD and the TA to authenticate themselves and establish session key ℚ_MT between themselves.

SHD–MD Authentication Phase

At the onset of the SHD and MD communication process, they have to mutually authenticate each other. As stated earlier, the SHD and the MD must have authenticated themselves to the trusted authority and agreed on session keys ℚ_ST and ℚ_MT. The next task is for the SHD and the MD to authenticate themselves to each other. Before the commencement of data exchanges between the SHD and the MD, the following 7 procedures are executed. Here, it is assumed that the session is initiated by the remote MD to access some data on the SHD.

Step 1: The MD generates random number R₄ that it deploys to derive parameters C₂, C₃ and C₄ as C₂ = R₄ × G, C₃ = R₄.h (ℚ_MT) and C₄ = h (C₂||C₃ × G). It then constructs authentication request AM_SM1 = {C₂, C₄, ID_MD, T₁} that it transmits to SHD as shown in Fig. 3.

Fig. 3

SHD–MD authentication

Step 2: Upon receiving message AM_SM1, the SHD checks its freshness using timestamp T₁ and delay tolerance ∆T. It then generates random number R₅ for the derivation of security parameter D₁ = R₅ × G. Next, it composes authentication response message AM_SM2 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MT}}}$(C₂, C₄, D₁, ID_MD, T₁) which it then sends to the TA for verification. Evidently, this message is protected using session key ℚ_MT to prevent against eavesdropping and tampering.

Step 3: After getting message AM_SM2, the TA decrypts it using ℚ_MT. Next, it retrieves SHD and MD data from its database to determine whether the two had been registered and authenticated themselves with it. Using timestamp T₁ and ∆T, the TA also establishes the freshness of the received request. If all these verifications are successful, TA proceeds to derive C₄^* = h (C₂||h(ℚ_MT) × C₂). It then checks if C₄^*$\stackrel{?}{=}$ C₄. This proof proceeds as follows:

C₄^* = h (C₂||h(ℚ_MT) × C₂)

= h (C₂||h(ℚ_MT)×(R₄×G)); since C₂ = R₄×G

= h (C₂||(h(ℚ_MT). R₄) × G

= h (C₂||C₃×G); since C₃ = R₄.h (ℚ_MT)

= C₄; since C₄ = h (C₂||C₃×G).

As such, the TA will terminate the authentication session between the SHD and MD whenever C₄^*$\ne$ C₄. Otherwise, it computes parameter D₂ = h (D₁||h (ℚ_MT) × C₂). Finally, it encrypts D₂ using session key ℚ_ST in authentication message AM_SM3 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{ST}}}$(D₁, D₂) that is forwarded to the SHD.

Step 4: On obtaining message AM_SM3, the SHD is assured that MD is a legitimate entity. As such, it proceeds to determine the current timestamp T₂ before deriving session key ℚ_SM = h (C₂||R₅ × C₂). However, it waits for the confirmation message from MD before storing ℚ_SM in its memory. This is particularly important in ensuring that both the SHD and MD have generated the same session key. Next, it constructs authentication message AM_SM4 = {D₁, D₂}. Finally, it forwards AM_SM4 to the MD over public channels.

Step 5: After obtaining message AM_SM4, the MD re-computes parameter D₂^* = h (D₁||C₃ × G) and compares it with parameter D₂ it received from the SHD. This is important for authenticating SHD such that the MD is sure it is communicating with a legitimate SHD. This proof proceeds as follows:

D₂^* = h (D₁||C₃× G)

= h (D₁||(R₄.h (ℚ_MT))×G); since C₃ = R₄.h (ℚ_MT)

= h (D₁||h(ℚ_MT)×(R₄× G))

= h (D₁||h(ℚ_MT)×C₂); since C₂ = R₄×G

= D₂; since D₂ = h (D₁||h (ℚ_MT)×C₂).

Here, only the TA can generate D₂ using session key ℚ_MT before transmitting it to SHD. As such, the MD is sure that SHD is a legitimate entity and not any other entity impersonating it.

Step 6: The MD computes session key ℚ_MS = h (C₂||R₄ × D₁), which is then validated against session key ℚ_SM = h (C₂||R₅ × C₂) derived at the SHD. This proof is elaborated below:

ℚ_MS = h (C₂||R₄ × D₁),

= h (C₂||R₄× (R₅× G)); since D₁ = R₅× G

= h (C₂||(R₄.R₅)×G)

= h (C₂||R₅× C₂); since C₂ = R₄× G.

Provided that ℚ_SM = ℚ_MS, the SHD and MD have successfully established a common session key. Next, it determines the current timestamp T₃ before storing parameter set {ID_SHD, T₃, ℚ_SM} in its memory. Finally, it encrypts parameter C₂ using session key ℚ_MS and sends it to SHD in authentication message AM_SM5 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MS}}}$(C₂).

Step 7: Upon receiving confirmation message AM_SM5, from the MD, the SHD decrypts it using ℚ_MS. Provided that parameter C₂ can be retrieved successfully from AM_SM5, the SHD updates ID_MD, session key ℚ_MS and timestamp T₂ in its memory. This serves to thwart any adversarial packet replay attacks. This confirmation is critical since the SHD might mistakenly update an invalid session key, hence compromising its current communication session with the MD.

Security Analysis

In this section, both formal and informal security analyses are carried out to demonstrate the resilience of the proposed protocol against conventional smart home attacks.

Formal Security Analysis

The Burrows–Abadi–Needham logic (BAN logic) has proofed to be the widely deployed formal analysis model for the correctness of many authentication and key negotiation protocols. As such, the aim of this analysis here is to demonstrate that this protocol successfully attains mutual authentication and session key negotiation between the communicating entities. To achieve this, the notations in Table 2 are utilized.

Table 2 BAN Logic Notation

As shown in Table 2, eleven notations are critical during the execution of the BAN logic proofs (BLPs). On the other hand, Table 3 gives the BAN logic postulates that are applied during these security proofs.

Table 3 BAN Logic postulates

To show the existence of strong mutual authentication between SHD and MD, the following four goals are formulated:

Goal 1:$\mathrm{MD}|\equiv \mathrm{MD}\stackrel{ {\mathbb{Q}}_{\mathrm{MS}} }{\leftrightarrow }\mathrm{SHD};$

Goal 2:$\mathrm{MD}\left|\equiv \mathrm{SHD}\right|\equiv \mathrm{MD}\stackrel{ {\mathbb{Q}}_{\mathrm{MS}} }{\leftrightarrow }\mathrm{SHD};$

Goal 3:$\mathrm{SHD}|\equiv \mathrm{MD}\stackrel{ {\mathbb{Q}}_{\mathrm{MS}} }{\leftrightarrow }\mathrm{SHD};$

Goal 4:$\mathrm{SHD}\left|\equiv \mathrm{MD}\right|\equiv \mathrm{MD}\stackrel{ {\mathbb{Q}}_{\mathrm{MS}} }{\leftrightarrow }\mathrm{SHD}.$

The five messages that are exchanged during MD and SHD mutual authentication are thereafter translated into idealized format as follows:

MD → SHD: AM_SM1 {C₂, C₄, ID_MD,T₁}

Idealized format: ${E}^{{R}_{4}}$, ${\langle {E}^{{R}_{4}}\rangle }_{{\mathbb{Q}}_{\mathrm{MT}}}$

SHD → TA: AM_SM2 {${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MD}}}$(C₂, C₄, D₁, ID_MD, T₁)}

Idealized format: {${E}^{{R}_{4}}$,${\langle {E}^{{R}_{4}}\rangle }_{{\mathbb{Q}}_{\mathrm{MT}}}{\}}_{{\mathbb{Q}}_{\mathrm{ST}}}$

TA → SHD: AM_SM3 {${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{ST}}}$(D₁, D₂)}

Idealized format: {${E}^{{R}_{5}}$,${\langle {E}^{{R}_{4}},{E}^{{R}_{5}}\rangle }_{{\mathbb{Q}}_{\mathrm{MT}}}$

SHD → MD: AM_SM4 {D₁, D₂}

Idealized format: {${E}^{{R}_{5}}$,${\langle {E}^{{R}_{4}},{E}^{{R}_{5}}\rangle }_{{\mathbb{Q}}_{\mathrm{MT}}}\}$

MD → SHD: AM_SM5 {${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MS}}}$(C₂)}

Idealized format:${\langle {E}^{{R}_{4}}\rangle }_{{\mathbb{Q}}_{\mathrm{MS}}}$

For effective proofs using the BAN logic, the following Initial Assumptions (IAs) are then made:

IA₁: MD $|\equiv$ MD $\stackrel{{\mathbb{Q}}_{\mathrm{MT}}}{\leftrightarrow }$ TA

IA₂: MD $|\equiv \mathrm{MD}{}_{\leftrightharpoons }{}^{ {\mathbb{Q}}_{\mathrm{MT}}}\mathrm{ TA}$

IA₃: SHD $|\equiv$ SHD $\stackrel{{\mathbb{Q}}_{\mathrm{ST}}}{\leftrightarrow }$ TA

IA₄: SHD $|\equiv$ $\mathrm{SHD}|{}_{\leftrightharpoons }{}^{ {\mathbb{Q}}_{\mathrm{ST}}}\mathrm{ TA}$

IA₅: TA $|\equiv$ MD $\stackrel{{\mathbb{Q}}_{\mathrm{MT}}}{\leftrightarrow }$ TA

IA₆: TA $|\equiv$ $\mathrm{MD}|{}_{\leftrightharpoons }{}^{ {\mathbb{Q}}_{\mathrm{MT}}}\mathrm{ TA}$

IA₇: TA $|\equiv$ SHD $\stackrel{{\mathbb{Q}}_{\mathrm{ST}}}{\leftrightarrow }$ TA

IA₈: TA $|\equiv$ $\mathrm{SHD}|{}_{\leftrightharpoons }{}^{ {\mathbb{Q}}_{\mathrm{ST}}}\mathrm{ TA}$

IA₉: MD $|\equiv$ $\mathrm{SHD}\Rightarrow$ R₅

IA₁₀: MD $|\equiv$ $\mathrm{SHD}\Rightarrow {\mathrm{E}}^{{\mathrm{R}}_{5}}$

IA₁₁: SHD $|\equiv$ $\mathrm{MD}\Rightarrow$ R₅

IA₁₂: SHD $|\equiv$ $\mathrm{SHD}\Rightarrow {\mathrm{E}}^{{\mathrm{R}}_{4}}$

IA₁₃: If MD $|\equiv$ TA $|\equiv$ N then MD $|\equiv$ SHD $|\equiv$ N.

Afterwards, the BAN logic notations, rules, idealized messages and initial assumptions are deployed to execute the BAN logic proofs as follows:

Since the MD is charged with the generation of random number R₄, then:

BLP₁: MD $|\equiv$ R_4.

Applying RR to the MD’s selection of random number R₄, BLP₂ is obtained:

BLP₂: MD $|\equiv$ #(R₄).

The application of FPR₂ to BLP₂ yields BLP₃:

BLP₃: MD $|\equiv$ # (${\mathrm{E}}^{{\mathrm{R}}_{4}}$).

Since the random number R₅ is generated by the SHD, then:

BLP₄: SHD $|\equiv$ R_5.

The application of RR to the SHD’s selection of random number R₅, BLP₅ is obtained:

BLP₅: SHD $|\equiv$ # (R₅).

Using FPR₂ in BLP₅ results in BLP_6:

BLP₆: SHD $|\equiv$ # (${\mathrm{E}}^{{\mathrm{R}}_{5}}$).

Based on message AM_SM4, it is clear that:

BLP₇: MD $\triangleleft \{{E}^{{R}_{5}}, {\langle {(E}^{{R}_{4}},{E}^{{R}_{5}})\rangle }_{{\mathbb{Q}}_{\mathrm{MT}}}\}.$

The application of SER₁ to BLP₇ yields BLP₈:

BLP₈: MD $\triangleleft {\langle {(E}^{{R}_{4}},{E}^{{R}_{5}})\rangle }_{{\mathbb{Q}}_{\mathrm{MT}}}.$

Using MMR₃ in IA₂ and BLP₈ yields BLP₉:

BLP₉: MD $|\equiv$ TA|$\sim$ ${(E}^{{R}_{4}},{E}^{{R}_{5}}$).

On the other hand, the application of FPR₁ in IA₂ and BLP₃ results in BLP₁₀:

BLP₁₀: MD $|\equiv$ #${(E}^{{R}_{4}},{E}^{{R}_{5}}$).

To obtain BLP₁₁, NVR is applied to both BLP₉ and BLP₁₀:

BLP₁₁: MD $|\equiv$ TA $|\equiv$ ${(E}^{{R}_{4}},{E}^{{R}_{5}}$).

However, to obtain BLP₁₂ and BLP₁₃, BR₁ is applied to BLP₁₁:

BLP₁₂: MD $|\equiv$ TA $|\equiv$ ${\mathrm{E}}^{{\mathrm{R}}_{4}},$

BLP₁₃: MD $|\equiv$ TA $|\equiv$ ${\mathrm{E}}^{{\mathrm{R}}_{5}}.$

Considering IA₁₃, BLP₁₂ and BLP₁₃, it is evident that:

BLP₁₄: MD $|\equiv$ SHD $|\equiv$ ${\mathrm{E}}^{{\mathrm{R}}_{4}},$

BLP₁₅: MD $|\equiv$ SHD $|\equiv$ ${\mathrm{E}}^{{\mathrm{R}}_{5}}.$

On the other hand, the application of SKR to both BLP₁₅ and IA₁₀ yields BLP₁₆:

BLP₁₆: MD $|\equiv$ ${\mathrm{E}}^{{\mathrm{R}}_{5}}.$

Since session key ℚ_MS can be expressed as ℚ_MS = h (${\mathrm{E}}^{{\mathrm{R}}_{4}}$||${\mathrm{E}}^{{{\mathrm{R}}_{4}\mathrm{R}}_{5}}$), then based on both BLP₂ and BLP₁₆:

BLP₁₇: MD $|\equiv$ # (ℚ_MS).

However, the application of SKR to both BLP₁₅ and BLP₁₇ results in BLP₁₈:

BLP₁₈: $\mathrm{MD}|\equiv \mathrm{MD}\stackrel{ {\mathbb{Q}}_{\mathrm{MS}} }{\leftrightarrow }\mathrm{SHD}$, and as such, Goal 1 is attained.

To obtain BLP₁₉, BR₂ is applied to BLP₁₅:

BLP₁₉: MD $|\equiv$ SHD $|\equiv$ R_5.

On the other hand, BLP₂₀ is easily obtained from BLP₁₄ and BLP₁₉:

BLP₂₀:$\mathrm{MD}|\equiv \mathrm{SHD}|\equiv \mathrm{MD}\stackrel{ {\mathbb{Q}}_{\mathrm{MS}} }{\leftrightarrow }\mathrm{SHD}$, achieving Goal 2.

Based on the difficulty of solving both the elliptic curve discrete logarithm and the elliptic curve Diffie–Hellman problems, then the belief of MD and SHD can be expressed as in BLP₂₁ and BLP₂₂:

BLP₂₁: MD $|\equiv$ $\mathrm{MD} {}_{\leftrightharpoons }{}^{{\mathrm{E}}^{{{\mathrm{R}}_{4}\mathrm{R}}_{5}}} \mathrm{SHD},$

BLP₂₂: SHD $|\equiv$ $\mathrm{MD} {}_{\leftrightharpoons }{}^{{\mathrm{E}}^{{{\mathrm{R}}_{4}\mathrm{R}}_{5}}} \mathrm{SHD}.$

Regarding idealized message AM_SM5, it can be re-written as:

AM_SM5^*: ${\langle {\mathrm{E}}^{{\mathrm{R}}_{4}},{\mathrm{E}}^{{\mathrm{R}}_{5}}\rangle }_{{\mathrm{E}}^{{{\mathrm{R}}_{4}\mathrm{R}}_{5.}}}$

Based on AM_SM5^*, BLP₂₃ can be obtained:

BLP₂₃: SHD $\triangleleft {\langle {\mathrm{E}}^{{\mathrm{R}}_{4}},{\mathrm{E}}^{{\mathrm{R}}_{5}}\rangle }_{{\mathrm{E}}^{{{\mathrm{R}}_{4}\mathrm{R}}_{5.}}}$

Using MMR₃ in both BLP₂₂ and BLP₂₃, it is clear that:

BLP₂₄: SHD $|\equiv$ $\mathrm{MD}$|$\sim$ (${\mathrm{E}}^{{\mathrm{R}}_{4}},{\mathrm{E}}^{{\mathrm{R}}_{5}}$).

On the other hand, using FPR₁ in BLP₆ results in BLP₂₅:

BLP₂₅: SHD $|\equiv$ $\#$(${\mathrm{E}}^{{\mathrm{R}}_{4}},{\mathrm{E}}^{{\mathrm{R}}_{5}}$).

To obtain BLP₂₆, NVR is applied to both BLP₂₄ and BLP₂₅:

BLP₂₆: SHD $|\equiv$ MD $|\equiv$ (${\mathrm{E}}^{{\mathrm{R}}_{4}},{\mathrm{E}}^{{\mathrm{R}}_{5}}$).

However, to get BLP₂₇ and BLP₂₈, BR₂ is applied to BLP₂₆:

BLP₂₇: SHD $|\equiv$ MD $|\equiv$ ${\mathrm{E}}^{{\mathrm{R}}_{4}}.$

BLP₂₈: SHD $|\equiv$ MD $|\equiv$ ${\mathrm{E}}^{{\mathrm{R}}_{5}}.$

The application of JR to both BLP₂₇ and IA₁₂ yields BLP₂₉:

BLP₂₉: SHD $|\equiv$ ${\mathrm{E}}^{{\mathrm{R}}_{4}}.$

Since session key can be expressed as ℚ_MS = h (${\mathrm{E}}^{{\mathrm{R}}_{4}}$||${\mathrm{E}}^{{{\mathrm{R}}_{4}\mathrm{R}}_{5}}$), then based on both BLP₂ and BLP₁₆, BLP₃₀ is obtained.

BLP₃₀: SHD $|\equiv$ # (ℚ_MS).

In addition, using SKR in both BLP₂₇ and BLP₃₀ results in BLP₃₁:

BLP₃₁: $\mathrm{SHD}|\equiv \mathrm{MD}\stackrel{ {\mathbb{Q}}_{\mathrm{MS}} }{\leftrightarrow }\mathrm{SHD}$, effectively attaining Goal 3.

However, using BR₂ in BLP₁₅ results in BLP₃₂:

BLP₃₂: SHD $|\equiv$ MD $|\equiv$ R_4.

Based on both BLP₂₈ and BLP₃₂, BLP₃₃ is obtained:

BLP₃₃:$\mathrm{SHD}|\equiv \mathrm{MD}|\equiv \mathrm{MD}\stackrel{ {\mathbb{Q}}_{\mathrm{MS}} }{\leftrightarrow }\mathrm{SHD}$, hence Goal 4 is realized.

The successful attainment of all the four goals formulated earlier shows the existence of mutual authentication between the MD and the SHD. In addition, it demonstrates the existence of a session key that enciphers traffic exchanged between these entities.

Informal Security Analysis

In this section, it is demonstrated that the proposed scheme is secure under the Canetti–Krawczyk threat model. The assumptions of the CK threat model are given in [7]. To accomplish these security proofs, the following lemmas are formulated and proofed.

Lemma 1

The proposed algorithm prevents man-in-the-middle attacks.

Proof

The goal of this attack is to capture the exchanged messages, modify and forward them to the unsuspecting receivers. Suppose that the attacker has captured parameters C₂, C₄, D₁ and D₂. Here, C₂ = R₄ × G, C₄ = h (C₂||C₃ × G), D₁ = R₅ × G and D₂ = h (D₁||h (ℚ_MT) × C₂). Next, an adversary tries to construct messages AM_SM1 = {C₂, C₄, ID_MD,T₁}, AM_SM2 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MT}}}$(C₂, C₄, D₁, ID_MD, T₁), AM_SM3 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{ST}}}$(D₁, D₂), AM_SM4 = {D₁, D₂} and AM_SM5 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MS}}}$(C₂). Clearly, the construction of valid messages require additional parameters such as random numbers R₄ and R₅, the MD’s real identity, session key between MD and TA (ℚ_MT), session key between SHD and TA (ℚ_ST) and the session key between SHD and MD (ℚ_MS). Since these security parameters are unavailable to the adversary, this attack flops. In addition, the derivation of R₄ from C₂ is computationally infeasible.

Lemma 2

The communicating entities are properly authenticated to each other.

Proof

In this protocol, upon receiving message AM_SM2 from the SHD, the TA utilizes ℚ_MT to decrypt it. Afterwards, it retrieves SHD and MD data from its database to determine whether the two had been registered and authenticated themselves with it. In addition, the TA authenticates the SHD by checking whether C₄^*$\stackrel{?}{=}$ C₄. On the other hand, on obtaining message AM_SM4 from the SHD, the MD re-computes D₂^* = h (D₁||C₃ × G) and compares it with parameter D₂ it received in AM_SM4. Here, it is only legitimate TA that can derive D₂ using ℚ_MT before forwarding it to SHD. Consequently, the MD is confident that SHD is a legitimate entity and not any other masquerading entity.

Lemma 3

Packet replay attacks are effectively thwarted in this scheme.

Proof

The purpose of this attack is to intercept the transmitted messages, store them and re-transmit them later to the intended receivers. Suppose that an adversary captures message AM_SM1 = {C₂, C₄, ID_MD, T₁} sent from the MD towards the SHD. After sometimes, the attacker re-sends it to the SHD in an effort to fool the SHD that the MD is requesting another communication session. However, any replayed message will fail the freshness checks at the SHD. Similarly, any adversarial effort to replay message AM_SM2 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MT}}}$(C₂, C₄, D₁, ID_MD,T₁) will be detected at the TA using T₁. As such, the proposed protocol is robust against packet replay attacks.

Lemma 4

This protocol offer backward and forward key secrecy.

Proof

At the SHD, the session key ℚ_SM is derived as ℚ_SM = h (C₂||R₅ × C₂), where C₂ = R₄ × G. Similarly, session key ℚ_MS is computes as ℚ_MS = h (C₂||R₄ × D₁) at the MD. Here, D₁ = R₅ × G and C₂ = R₄ × G. Evidently, these session keys incorporate random numbers R₄ and R₅. As such, they are stochastic such that different sessions have different keys. Consequently, the capture of any key belonging to the current session cannot facilitate the derivation of keys used in the previous and subsequent communication sessions. Similarly, an attacker with captured session keys cannot utilize them to decrypt messages for the current as well as subsequent communication sessions.

Lemma 5

Privileged insider attacks are prevented in this scheme.

Proof

In this protocol, the trusted authority mediates the authentication and key agreement between the MD and the SHD. In this attack, it is assumed that the TA is a privileged entity that may attempt to derive the MD-SHD session keys using the security parameters it has access to. Here, the SHD derives session key ℚ_SM, where ℚ_SM = h (C₂||R₅ × C₂) and C₂ = R₄ × G. On the other hand, the MD computes session key ℚ_MS, where ℚ_MS = h (C₂||R₄ × D₁) and D₁ = R₅ × G. Evidently, the derivation of session keys ℚ_SM and ℚ_MS requires random numbers R₄ and R₅. Here, random number R₄ is generated at the MD while random number R₅ is generated at the SHD. As such, although the TA supervises the authentication between the MD and SHD, it cannot derive the session keys for traffic enciphering between the two entities. Consequently, it is unable to encrypt or decrypt the exchanged messages between the MD and the SHD.

Lemma 6

The proposed protocol is robust against session hijack and denial of service attacks.

Proof

The ultimate objective of these attacks is to cut off the communication between the MD or SHD and the TA. To carry out this attack, an adversary tries to derive legitimate session keys ℚ_MT and ℚ_ST. Here, ℚ_ST = h (B₃||R₂ × B₃) and B₃ = R₃ × G. The session key between the MD and the TA is derived in a similar version. Clearly, the derivation of any legitimate session key requires knowledge of the random numbers R₂ and R₃. Here, R₂ is generated at the SHD and MD while R₃ is generated at the TA. As such, adversarial computation of these session keys will fail due to the difficulty of deriving R₃ from B₃. Suppose that an attacker attempts to construct authentication messages AM₁, AM₂ and AM₃. Here_, AM₁ = {B₁, B₂}, AM₂ = {A₃, B₃, B₄}, AM₃ = {C₁, ℚ_ST}, A₁ = h (R₁||TA_SV||T₁||ID_SHD), A₂ = A₁ × G, A₃ = R₁ ⊕ h (TA_SV), A₄ = h (R₁ ⊕ h (TA_SV)||A₂), A₅ = A₄ × G B₂ = h (B₁||R₂ × A₂), B₁ = R₂ × G, B₂ = h (B₁||R₂ × A₂), B₃ = R₃ × G, B₄ = h (B₂^*||R₃ × A₅), C₁ = h (B₄^*||R₂ × B₃), B₄^* = h (B₂||A₄ × B₃) and ℚ_ST = h (B₃||R₂ × B₃). It is evident that in addition to random numbers R₁, R₂ and R₃, the attacker needs TA’s secret value TA_SV, timestamp T₁ and the SHD’s unique identity ID_SHD to construct these messages. Since all these parameters are unavailable to the adversary, the construction of these messages fails. Therefore, the sessions of the MD and SHD are sufficiently protected and cannot be hijacked. Ultimately, availability is upheld and the remote users are able to access the sensed data anytime and from any location.

Lemma 7

Impersonation attacks are prevented in this protocol.

Proof

The aim of these attacks is to send connection requests using the identities of other network entities. Suppose that an adversary wants to impersonate the SHD and send connection request AM₁ to the TA. Here, AM₁ = {B₁, B₂}, B₁ = R₂ × G, B₂ = h (B₁||R₂ × A₂), A₂ = A₁ × G and A₁ = h (R₁||TA_SV||T₁||ID_SHD). It is clear that to construct a legitimate connection request AM₁, the adversary requires the TA’s secret value TA_SV, timestamp T₁ and the SHD’s unique identity. In addition, random numbers R₁ and R₂ are needed. In this protocol, one-way hashing operations prevent an attacker from obtaining T₁, TA_SV and ID_SHD from parameter A₁. Although hashing functions can have collisions, only the underlying hashing algorithm can be discerned while the protected data remains secure. On the other hand, the stochastic nature of random numbers makes it computationally infeasible for the attacker to derive them with high success probability.

Lemma 8

This protocol preserves the confidentiality and integrity of the communication process.

Proof

To uphold confidentiality, all exchanged messages are sufficiently enciphered using the derived session keys. These session keys can only be derived between the communicating devices after successful mutual authentication process. For instance, authentication message AM_SM2 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MT}}}$(C₂, C₄, D₁, ID_MD,T₁) is encrypted using the session key set between MD and TA (ℚ_MT). Similarly, authentication message AM_SM3 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{ST}}}$(D₁, D₂) is enciphered using the session key set between SHD and TA (ℚ_ST). On the other hand, authentication message AM_SM5 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MS}}}$(C₂) is encrypted using Session key set between SHD and MD (ℚ_MS). As such, the enciphered parameters cannot be modified on transit and hence, their integrity is preserved.

Lemma 9

Offline dictionary attacks are thwarted in this scheme.

Proof

The goal of an adversary in this attack is to capture the exchanged messages and attempt to discern sensitive information in them. Finally, the learned messages are utilized to compute the session keys ℚ_SM, ℚ_MS, ℚ_ST and ℚ_MT. Here, ℚ_ST = h (B₃||R₂ × B₃), ℚ_SM = h (C₂||R₅ × C₂) and ℚ_MS = h (C₂||R₄ × D₁). On the other hand, the exchanged messages between the MD and SHD include AM_SM1, AM_SM2, AM_SM3, AM_SM4 and AM_SM5. Here, AM_SM1 = {C₂, C₄, ID_MD, T₁}, AM_SM2 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MT}}}$(C₂, C₄, D₁, ID_MD,T₁), AM_SM3 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{ST}}}$(D₁, D₂), AM_SM4 = {D₁, D₂} and AM_SM5 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MS}}}$(C₂). Here, both ℚ_ST and ℚ_MT were derived in early device-TA authentication phase. As such, the attacker lacks random number R₂ and security parameter B₃ needed to derive them. In addition, the one-way hashing function renders it infeasible to obtain these two parameters through reverse engineering. Although messages AM_SM1 and AM_SM4 are transmitted in plaintext, their contents do not contain random numbers R₄ and R₅ required to derive session keys ℚ_MS and ℚ_SM. Consequently, the proposed protocol is resilient against offline-guessing attacks.

Lemma 10

The proposed protocol is robust against stolen verifier attacks.

Proof

Suppose that an attacker manages to steal the session keys ℚ_SM and ℚ_MS used to encrypt and decrypt traffic between the MD and the SHD. An attempt may then be made to derive session keys ℚ_MT and ℚ_ST deployed to secure device–TA communication. Here, ℚ_MS = h (C₂||R₄ × D₁), ℚ_SM = h (C₂||R₅ × C₂) and ℚ_ST = h (B₃||R₂ × B₃). Evidently, the captured session keys can only be deployed to encrypt and decrypt MD–SHD traffic for only the current session. They cannot be deployed for encryption and decryption in the past or subsequent sessions due to the random numbers R₄ and R₅ which imply that these session keys are different for dissimilar sessions. The one-way hashing operation prevents an attacker from sniffing the contents of these session keys for other malicious verifications. It is also evident that session keys ℚ_ST derivations requires random number R₂ and security parameter B₃, all of which cannot be discerned from the captured session keys.

Performance Evaluation

In this section, the lightweight nature of the proposed algorithm is demonstrated. To accomplish this, performance metrics such as computation and communication overheads, memory requirements and energy consumption are used. In addition, experiments are run to investigate energy consumption variations under different transmission loads. Moreover, the security features provided by this scheme are compared with the ones offered by other related schemes.

Computation Overhead

In this sub-section, the execution time of the various cryptographic primitives during the MD–SHD mutual authentication is taken into consideration. During this phase, only three cryptographic operations are executed. These are elliptic curve point multiplication (T_EP), symmetric encryption and decryption (T_SED), and one-way hash function (T_H). At the MD, 4T_H + 3T_EP + 4T_SED operations are carried out. On the other hand, 1T_H + 2T_EP + 14T_SED operations are executed at the SHD. Similarly, 4T_H + 2T_EP + 14T_SED operations are carried out at the TA. As such, the total computation overhead of this algorithm is 9T_H + 7T_EP + 32T_SED. Based on the values in [2], Table 4 gives the execution time for the various cryptographic primitives.

Table 4 Cryptographic primitives execution time

Based on the values in Table 4, the total computation overhead in the proposed protocol is 3.728 ms. On the other hand, Table 5 presents the computation overheads of other related schemes.

Table 5 Computation overheads

As shown in Fig. 4, the protocol in [39] has the highest computation overheads of 7.84 ms. This is followed by the protocol in [24] with execution time of 6.93 ms. The proposed scheme is third, followed by the schemes in [35, 43] and the schemes in [2] and [25], respectively. Although the schemes in [2] and [25] have low computation complexities, they have a number of security issues. For instance, the scheme in [2] is vulnerable to session hijacking, privileged insiders, packet replays, offline dictionary and stolen verifier attacks. In addition, its design doesn’t consider confidentiality, integrity and MitM attacks. Similarly, the scheme in [25] fails to consider MitM, integrity and confidentiality in its design. On its part, the protocol in [35] cannot withstand DoS attacks.

Fig. 4

Computation overheads

In addition, its design fails to consider communication integrity and confidentiality, as well as attack models such as offline dictionary, privileged insiders and session hijacking. Similarly, the protocol in [43] cannot offer confidentiality, integrity and protection against session hijacking attacks.

Communication Overheads

In this section, the bandwidth requirement of the proposed scheme is derived. During MD and SHD mutual authentication, messages AM_SM1, AM_SM2, AM_SM3, AM_SM4 and AM_SM5 are exchanged. Here, AM_SM1 = {C₂, C₄, ID_MD, T₁}, AM_SM2 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MT}}}$(C₂, C₄, D₁, ID_MD,T₁), AM_SM3 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{ST}}}$(D₁, D₂), AM_SM4 = {D₁, D₂} and AM_SM5 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MS}}}$(C₂). Table 6 gives the output sizes of the various cryptographic primitives.

Table 6 Cryptographic output sizes

Using the values in Table 6, the derivation of the communication overheads of the proposed scheme is carried out as shown in Table 7. Based on these derivations, the cumulative communication overhead of this scheme is 1472 bits.

Table 7 Message sizes derivations

However, the communication costs for the protocols in [2, 24, 25, 35, 39] and [43] are 1728 bits, 3296 bits, 1856 bits, 794 bits, 986 bits and 2304 bits, respectively, as shown in Table 8.

Table 8 Communication overheads

Based on the values in Fig. 5, the protocol in [24] has the highest communication overheads. This is followed by the scheme in [25, 43] and [2]. On the other hand, the proposed protocol has the third lowest communication costs, followed by the protocols in [39] and [35], respectively.

Fig. 5

Communication overheads

Although the protocol in [35] has the lowest communication costs, it is susceptible to DoS attacks. In addition, it does not consider attack models such as offline dictionary, privileged insiders and session hijacking. Moreover, communication integrity and confidentiality are never catered for in this scheme. On the other hand, the scheme in [39] is vulnerable to packet replay attacks. In addition, it cannot offer key secrecy as well as communication integrity and confidentiality.

Memory Requirements

The number of bytes stored during the MD and SHD authentication process is considered in this section. Here, each device is required to store only the session key for each of the other device. As such, MD needs to store ℚ_SM while the SHD is required to store ℚ_MS. For packet replay prevention, the delay tolerance time may also need to be stored in both the SHD and MD. Based on the values in [47], ℚ_SM = ℚ_MS = 160 bits. On the other hand, timestamp T₁ = T₂ = T₃ = 32 bits. As such, both the SH and MD require 192 bits of storage each, which is equivalent to 24 bytes. Consequently, the total memory requirement of this protocol during MD–SHD mutual authentication is 48 bytes as shown in Table 9.

Table 9 Memory Requirements

It is evident from Fig. 6 that the protocol in [24] has the largest memory requirements. This is followed by the schemes in [39] and [2], respectively. On the other hand, the proposed scheme together with the protocols in [25] and [43] have the lowest memory requirements.

Fig. 6

Memory requirements

As such, the proposed scheme together with these two other protocols put the least strain on the sensor memory. Consequently, they are the most suitable for deployments in smart home networks.

Energy Consumptions

In this section, the number of bits exchanged during the mutual authentication and key agreement between the MD and the SHD are deployed to derive the energy consumption of these two devices. The messages transmitted and received are as follows.

MD → SHD: AM_SM1 = {C₂, C₄, ID_MD, T₁}

SHD → TA: AM_SM2 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MT}}}$(C₂, C₄, D₁, ID_MD,T₁)

TA → SHD: AM_SM3 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{ST}}}$(D₁, D₂)

SHD → MD: AM_SM4 = {D₁, D₂}

MD → SHD: AM_SM5 = ${\mathrm{E}}_{{\mathbb{Q}}_{\mathrm{MS}}}$(C₂)

Based on the values in Table 7, AM_SM1 = 416 bits, AM_SM2 = 256, AM_SM3 = 256, AM_SM4 = 288, and AM_SM5 = 256. As such, the MD sends and receives a total of 672 bits and 288 bits, respectively. On the other hand, the TA sends and receives 256 bits in each case. However, the SHD sends and receives 544 bits and 928 bits, respectively. As pointed out in [42], single-bit transmission and reception on TelosB requires 0.00072 mJ and 0.00081 mJ, respectively. Using these values, Table 10 presents the energy consumptions of these three entities.

Table 10 Energy consumptions

Based on the values in Table 10, the MD consumes more energy to send requests than to receive and process requests. On the other hand, both the SHD and TA consume more energy to receive and process requests than to send requests. In the face of active DoS attacks, the MD will be least affected, while the SHD will be the most affected. This is because the SHD will commit sufficient computational resources to process and authenticate incoming requests when compared with the MD. To further investigate the implication of concurrent requests on the energy consumptions, experimentations were run in Python programming language. The specifications of the host machine were as follows: i5-4210U, Windows 10 Pro 64-bit, CPU1.70 Ghz × 4 and 4G RAM. Figure 7 shows the variation of the energy consumptions as a function of the number of concurrent requests and number of SHDs.

Fig. 7

Energy variations at varying loads

As shown in Fig. 7, as the number of SHDs increase, there is a corresponding increase in energy consumptions. This is attributed to the increased processing at the terminals. It is also evident that at a particular SHDs density, there is more energy consumed when the number of concurrent requests surge.

Security Features

To appreciate the security features offered by the proposed scheme, comparisons are made with other related schemes as shown in Table 11. It is clear that the scheme in [2] supports only 5 security features while the protocol in [35] offers 7 security features. This was followed by the scheme in [24, 25, 39] and [43] which provide 8, 8,10 and 10 security features, respectively.

Table 11 Security features

On the other hand, the proposed scheme supports 14 security features, which is the highest number. As such, although this scheme has relatively higher computation and communication overheads, it is the most secure among all these other schemes.

Conclusion

Smart homes introduce convenience, comfort and energy consumptions through automated management and control of activities. However, security and privacy challenges are very pertinent setbacks that may hamper the adoption of smart homes. Although many authentication techniques have been developed to address these issues, these schemes have some performance challenges. In addition, none of these schemes addresses all the required security and privacy goals. Consequently, security and privacy provisioning in smart homes is still a challenging issue. The presented scheme has been demonstrated to have lower computation and communication overheads compared to other conventional approaches. On the other hand, its memory requirement is the lowest among other similar protocols. The security features such as strong mutual authentication, backward and forward key secrecy, session key agreement, as well as the preservation of both integrity and confidentiality make it attractive for deployment in smart homes. On the other hand, its resilience against impersonations, denial of service, session hijacking, privileged insiders, packet replays, man-in-the-middle, offline dictionary and stolen verifier attacks render it superior to other related schemes. Future work will involve the evaluation of the proposed scheme using security attack models and performance metrics that were not within the scope of this paper. There is also need to come up with new innovative techniques for reducing the communication and computation costs of this scheme.