International Journal of Interdisciplinary Telecommunications and Networking

Volume 14 • Issue 1

Secure Protocol for Resource-

Constrained IoT Device Authentication
Vincent Omollo Nyangaresi, Tom Mboya University College, Kenya*
Anthony Joachim Rodrigues, Jaramogi Oginga Odinga University of Science and Technology, Kenya
Ahmad A. Al Rababah, King Abdulaziz University, Saudi Arabia

ABSTRACT

Wireless sensor networks (WSNs) are crucial components of internet of things (IoT) and have been
deployed in numerous fields such as battlefield surveillance. The exploitation of broadcasts in WSNs
renders these networks susceptible to numerous attacks. Consequently, to boost security, reliability,
and successful cooperation, trust must be established among the sensor nodes. Unfortunately, the
current authentication and authorization approaches exhibit high key management overheads, depend
on static digital signatures or trusted third parties, and have both high communication latencies and
computational complexity that render them inefficient. In this paper, challenge-response mutual
authentication protocol is proposed for enhancing security in WSN-based IoT environment. The
simulation results showed that the proposed protocol has the least transaction costs, time complexity,
end-to-end delays, and energy consumptions. It is also resilient against dictionary, side channel,
cloning, man-in-the-middle (MitM), denial of service (DoS), and next password prediction attacks.

Keywords
Attacks, Authentication, IoT, Privacy, Protocol, Security, Sessions, WSN

INTRODUCTION

WSNs are crucial components of IoT and as explained by El-hajj et al. (2019), IoT application spectrum
includes smart cities, homes, wearables, e-health among others. These devices are smart enough to
collect, analyze and even make decisions devoid of human interaction. In this environment, security
and specifically authentication is critical owing to the devastating effects of malicious unauthenticated
device in an IoT system. Depending on the type of application, IoT security requirements may include
authentication, confidentiality or integrity (Nyangaresi et al., 2020). As pointed out by El-hajj et al.,
(2019), authentication is key since trusting devices making up an IoT network is crucial for the better
operation of the network. For instance, if one sensor node (SN) is compromised, then the entire network
can be brought down or result in disasters. Fadi and David (2020) explain that IoT offers connectivity
to internet devices that provide interactivity between physical and cyber objects. This facilitates data
observation and measurement of physical entities. As explained by Harbi et al., (2019), both WSN
and IoT are characterized by decentralization where security measures and authentication procedures
are deployed at both device and network levels to enhance network reliability. However, Kouicem et
al., (2018) explain that IoT devices are resource constrained owing to limited battery power. Their
communication and information access is via open wireless channels, which renders them susceptible

DOI: 10.4018/IJITN.302118 *Corresponding Author


Copyright © 2022, IGI Global. Copying or distributing in print or electronic forms without written permission of IGI Global is prohibited.


1
International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

to threats such as eavesdropping. To boost smart manufacturing and increase productivity, Industrial
Internet of Things (IIoT) has been developed to address the complexity and sophistication of the
manufacturing process. As such, the entire manufacturing process consists of a number of diverse
administrative IoT domains where devices from dissimilar domains collaborate on a similar task. This
brings forth security and privacy issues regarding device to device communications. Worse still, the
current authentication schemes exhibit high key management overheads (Nyangaresi et al., 2020) or
depend on a trusted third party (Shen et al., 2020). Consequently, security and privacy issues during
IoT device communication still present some challenges.
According to Kumar et al., (2020), the development of mobile Internet of Things (IoT) has led to
the invention of many smart mobile services. Unfortunately, Zeng et al., (2018) point out that owing
to their explosive growth and connectivity, malicious attacks can result in an unauthorized access to
these devices. As such, the provision for security has become a very crucial design consideration for
IoT systems that support heterogenous, machines, devices and industry processes. As discussed by
Fang et al., (2020), current authentication and authorization protocols rely on static digital techniques
and have high computational complexity. Therefore, they are insufficient for IoT environment. In
addition, these security designs for diverse layers and link segments are desolate and disregard the
overall protection, causing high communication latencies, overheads and cascaded security risks.
Alladi and Chamola (2020) point out that the application of IoT in healthcare leads to sensitive patient
data being sent over the networks, which calls for the deployment of robust security techniques to
thwart cyber attacks.
It is explained by Mabodi et al., (2020) that due to wide distribution, relatively high processing
power and wide openness, IoT devices are susceptible to gray hole attacks where an adversary
masquerades as being the shortest path to the destination. In addition, Husamuddin and Qayyum
(2017) identify authorization, authentication, integrity, non-repudiation, confidentiality, availability,
and privacy as the main IoT security issues. In terms of the IoT layers, security issues can be at the
perception layer, network layer, or application layer and hence there is need for a multi-layer security
approach. The contributions of this paper include the following:

I. A hardware assisted authentication protocol is developed using Physical Unclonable Function

(PUF) and True Random Number Generator (TRNG).
II. Challenge-response pairs (CRPs) are deployed to secure the transport layer traffic.
III. Dynamic multi-keys coupled with nonce for session keys and CRPs are introduced during mutual
authentication process.
IV. It is shown that (I)-(III) above thwart node falsification, DoS, side-channel and dictionary attacks.

The rest of this paper is organized as follows: Section II discusses related work while Section III
outlines the system model of this protocol. Section IV presents results and evaluation of this protocol
while Section V concludes the paper and gives future work.

RELATED WORK

A number of schemes have been developed to secure WSN IoT communications. For instance, Mughal
et al., (2019) developed a logical tree-based security mobility management (LTSMM) to minimize
rekeying issues in WSN supported IoT. Since it employs group keys for authentication, management
of group keys becomes complicated when the number of WSN devices increases or when one entity
becomes malicious. To prevent DoS attacks in WSN routing for IoT, Lyu et al., (2019) proposed
an entropy-based selective authentication scheme in WSN routing for IoT. Although it ensures data
integrity and also boosts data delivery rate, its focus was only on DoS prevention, ignoring other attacks.

2
 International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

A middlebox guard (M-G) based on software-defined network (SDN) has been proposed by
Liu et al., (2017) to secure data transfer in IoT. Although it was demonstrated to have reduced
latency and enhanced communication rate, it has high computational complexities. An anonymous
user authentication model for WSN aided IoT has been developed by Zhang and Wen (2019) which
yielded better security and reduced computation complexity. However, its performance evaluation
was only limited to login and authentication phases. On the other hand, based on certificateless
cryptography and public key infrastructure (PKI), Luo et al., (2019) have introduced a secure data
transmission scheme for WSN users in IoT environment. However, its PKI and bilinear pairings lead
to high computational complexities. A lightweight authentication scheme (LAS) based on password,
registration, and verification phases for IoT WSN has been introduced by Xu and Wu (2019). Although
it boosted security and network throughput, only the registration phase is executed over a secured
channel while the rest of the phases take place over public channels. This exposes the exchanged
data to attacks. Based on fuzzy logic (FL), Alshehri and Hussain (2019) have developed a protocol
for IoT device trust management. Unfortunately, performance evaluation of this scheme is missing.
On the other hand, Lu et al., (2019) have developed a location-aware wireless security access for
particular IoT access point region. However, this scheme employs a single commercial access point
which presents a single point of failure, is complex and deals with only access control, ignoring other
security issues such as data integrity. Sheron et al., (2020) have developed a central authority (CA)
based decentralized and scalable security framework (DSSF) using tree hash for device and request
authentication in an IoT environment. Its performance was compared with LTSMM, M-G SDN
and LAS in terms of transaction cost, computation time, end-to-end delay, compromised requests,
and energy. However, it requires a CA which can be a single point of failure and also incorporates
blockchain technology that is both storage and computationally intensive. To mitigate source location
privacy issues in WSNs for IoT, He et al., (2019) proposed sector-based random routing while Qian
et al., (2019) have employed blockchain technology to develop a decentralized IoT security solution.
However, the deployment of blockchain has the same performance issues as the scheme by Sheron
et al., (2019).
Du et al., (2005) have proposed an IoT key pre-distribution scheme while Liu et al., (2005) have
developed a polynomial schema for key management in IoT. However, the scheme by Du et al., (2005)
is energy inefficient while the scheme by Liu et al., (2005) does not consider location privacy. An
enhanced user authentication and key management protocol based on bio- hashing (Choi et al., 2017)
for WSNs has been developed by Srinivas et al., (2017). Although it ensured mutual authentication,
it does not consider both blackhole and wormhole attacks. A wireless networks group authentication
scheme has been developed by Fu et al., (2012) that was shown to attain both mutual authentication
and privacy, but never considered possible threat and attacks. Similarly, Kumari et al., (2016) have
proposed a chaotic maps-based mutual authentication for WSN, but which never considered data
integrity.
A WSN lightweight anonymous authentication scheme has been developed by Chung et al.,
(2016) which attained hop-by-hop authentication and un-traceability for protecting user privacy.
Unfortunately, location privacy and communication costs were not considered. Gope and Hwang
(2016) proposed a WSN authentication protocol that offered user privacy, un- traceability, strong
forward secrecy and backward secrecy. Although it was also robust against key compromise,
impersonation and node capture attacks, it never considered both message and verification delays.
Moreover, Turkanovi´c et al., (2014) have developed a WSN lightweight hash and XOR operations
based mutual authentication between the user, end node, and the gateway node. However, this scheme
has high communication overheads.

3
International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

SYSTEM MODEL OF OUR PROTOCOL

The WSN security schemes discussed above have been noted to have either high computational
complexity or concentrate on few aspects of security while ignoring others. In addition, majority of
them are based on single password- based authentication techniques, which renders them susceptible
to side channel and dictionary attacks. To address these issues, this paper develops a multi-key mutual
authentication protocol using a set of shared secret keys that are dynamically changed after every
communication session. In so doing, even if part of this key set is captured by an adversary, neither
future session keys nor past session keys can be determined. The developed authentication protocol
mutually authenticates WSN sinks and cloud servers. The mobile sink collects data from sensor
nodes to support various services such as fire detection, and enemy or health monitoring. This sink
has high computational power and uses the information collected for further processing or decision
making. The processing and decision making is pushed to the cloud server so as to conserve sink
battery and prolong its lifetime.

Hardware Assisted Authentication

In this paper, the physical characteristics of the IoT hardware, including the Physical Unclonable
Function (PUF) and True Random Number Generator (TRNG) are employed to boost device
authentication. The silicon PUF represents a die-unique challenge-response function that is an emerging
hardware primitive for secure applications. PUF exploits manufacturing process disparities in a die to
create unique signatures out of a chip, hence facilitating chip authentication and cryptographic key
generation. On the other hand, random number generators characterize basic cryptographic primitives
that are often employed as classified key generators for symmetric key, public-key crypto-systems
and as password sources. Here, security depends majorly on the randomness of the source generators.

Definition 1: Considering Cx as a challenge input to PUF, Rx as the response obtained from PUF,
these two form a unique challenge-response pair (CRP), (Cx, Rx) for a particular PUF. Here, Cx
and Rx are typically represented as strings of bits.

Rx=PUF(C)x (1)

Definition 2: Uniqueness of PUF provides an estimate of how distinctly it can identify a field-
programmable gate array (FPGA) among a group of FPGAs. Considering F1 and F2 as a pair
of FPGAs, then the Hamming distance between two n-bit responses R1 and R2 generated by a
PUF from F1 and F2 respectively forms a good estimate of the uniqueness of the PUF. Suppose
that a particular PUF is implemented on m FPGA chips, then its uniqueness is the average of
the percentage Hamming distance between the responses from every pair of implementations,
given by (2):

2
i =m −1 j =m
H ij
PUFUniqueness =
m (m − 1)
∑∑ n
* 100% (2)
i =1 j =i +1

where H ij represents the Hamming distance between two n-bit responses from two different FPGAs,
i and j respectively for a challenge C. The relation in (2) is an estimate of inter- die variation.

4
 International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

Definition 3: Consider k chips each producing an X-bit response. Then the probability of response
collision when F1 and F2 have the same or nearly same response for a challenge, is given by (3):

 
Rcollision = 1 − ∏
k
1 − n − 1 (3)
 X 
n =1
2 

Definition 4: Reliability of a PUF measures how consistently a response R is reproduced by a PUF

from an FPGA for a challenge C over several PUF read outs. PUF responses are expected to be
static but factors such as temperature variation, supply voltage fluctuation, and thermal noise
introduce errors that affect responses’ reproducibility. PUF reliability is estimated by first
extracting an n-bit reference response from a chip at normal operating condition (room temperature
using normal supply voltage), and then extracting the same n-bit response at a different operating
condition (different ambient temperature or different supply voltage) with a value . R 'i In essence,
x samples of R 'i . are taken for each of the operating conditions. Thereafter, the PUF reliability
for chip i is computed as in (4):

 ' 
HD R 'i , R i,y 
1  
x
 
PUFReliability = 100% − ∑ * 100% (4)
x y =1 n

’  ' 
where R i,y is the yth sample of R 'i , HD R 'i , R i,y  is chip i’s intra-chip Hamming distance.
  
  
Definition 5: Based on the challenge-response mechanism, PUFs should have the following features:
(a) any two PUFs generated from the same manufacturing process should generate different
responses for the same challenge input to them. (b) The same input challenge Cx to a particular
PUF input multiple times should generate the same response Rx. This implies PUF reliability as
expressed in (4) above. (c) Supplying same challenge Cx to different PUFs should yield different
responses Rx.
Definition 6: Considering the initial variable (IV), the hash function F initialized with its usual fixed
$IV$, inputs x of arbitrary length, inner fixed b-bit constant (i_pad), outer fixed b-bit constant
(o_pad), then the hashed message authentication code (HMAC) is expressed as in (5):

HMAC k (x ) = F (κ ⊕ O _ pad, F (κ ⊕ i _ pad, x )) (5)

Where κ is the completion by adding 0’s of k to a full b-bit block-size of the iterated hash function.

Definition 9: Based on the one-time pad theorem, any value XORed with a random value yields a
random output.

Transport Layer Security

Transport layer security (TLS) is a cryptographic protocol deployed to offer secure and reliable
communication over the internet. It has been standardized by the Internet Engineering Task Force

5
International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

(IETF) to secure connection oriented Internet services such as Transmission Control Protocol (TCP).
Unfortunately, TLS-secured TCP is unsuitable for resource constrained IoT devices due to TCP’s high
communication overheads. On the other hand, since User Datagram Protocol (UDP) is connection-less,
it is light-weight and hence requires low bandwidth and minimal memory usage. As such, UDP is the
ideal transport layer protocol for IoT devices. To secure UDP communications, Datagram Transport
Layer Security (DTLS) is employed. The connectionless services offered by UDP are unreliable, lead
to packet loss and packet fragmentation, and require packet re-ordering. The DTLS was designed
to solve these issues and also counter replay and DoS attacks. It has been standardized by the IETF
and is one of the most suited protocols for securing the IoT. Although it offers strong security, it has
high computation and communication overheads that render it very expensive for energy constrained
IoT devices. The DTLS mutual authentication involves handshaking using digital certificates while
key exchange is through Diffie-Hellman (DH) algorithm. In this paper, a challenge-response mutual
authentication protocol that is devoid of digital certificates is developed.

Mutual Authentication Process

In this protocol, each WSN sink (WSNS) device is equipped with a PUF chip that assigns it a unique
identification number. The goal is then to mutually authenticate each WSNS with the cloud server.
The modified DTLS is employed to secure the signaling as well as the payload passed between the
WSNS devices and the cloud server. Table 1 gives the notations used in this paper and their description.

Table 1. Symbols and description

Symbol Description

WSNS WSN sink device

CS Cloud server

PK Public key

SK Shared symmetric keys

Бthresh Threshold session duration

БMeas Measured session duration

ʩset Set of keys for CS & WSNS authentication

ʩ*set New Set of keys for CS & WSNS authentication

ʩBuffered Encrypted & buffered ʩset

CRP (C , R )x x
Challenge-response pairs

CI Concealed identifiers

ʦ Initial session key

ʦ* New session key

ʦ
ID
Session ID

Randi Random numbers for challenge

RNi Random numbers for session key generation

AuthReq WSNS authentication request

Chi Handshaking challenges

CMi Handshake challenge messages

CS_CM CS handshake challenge response

K
tempi
Temporary keys
IoT
DRes WSNS handshaking challenge response

║ Concatenation

Å XOR operation

6
 International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

The proposed protocol is shown in Algorithm 1, and whose first step is the setting of a threshold
session duration Бthresh followed by the generation of a set of keys in step 2 that are then encrypted
and buffered at both the server and WSNS (step 3). The session duration facilitated keys updates
while encryption secured them from attacks. This is followed by the generation and buffering of
CRPs (step4) which are encrypted using public key PK (part of ʩset) to yield CIs (phase 5). In stage
6, the session key is generated while in phase 7 TRNG is employed to generate both challenge and
session random numbers, Randi and RNi respectively. The session key served to protect exchanged
data from attacks while random numbers introduced dynamism in the generated keys. In phase 8, the
WSNS sends authentication request message, AuthReq to server CS. The AuthReq contains shared
key encrypted session ID, ʦID and the WSN’s CI which is then decrypted at the server to obtain its
plain text contents (step 9). Provided that ʦID and the WSNS’s CI are valid (phase 10), then the server
sends challenge message CM1 to WSNS (phase 11). Here CM1 contains the server first challenge,
Ch1 and its random number, Rand1. The challenge Ch1 denote a set of s distinct numbers where each
of these numbers represents an index of a key stored in both the server and WSNS (in step 2 above).
This Ch1 is represented as {C11, C12, C13,…C1s}, where the value of s is less than n. Upon receipt of
CM1, the WSNS generates temporary key, Ktemp1 of m bits (step 12) by executing XOR operation on
all the keys whose indices are in challenge Ch1. Afterwards, the WSNS generate response WSNSRes
for the CS challenge (step 13) by executing shared key encryption on Rand1║RN1 using Ktemp1 as the
encryption key. This sis followed by the WSNS generating the second challenge Ch2 for CS (phase
14) in a process similar to step 11 above. Here, challenges Ch1 and Ch2 are quite distinct such that
an adversary who is able to capture the key used for Ch1 is unable to reuse it for Ch2. In step 15,
temporary key Ktemp2 for encryption is derived in a process similar to phase 12 above.

Algorithm 1, Proposed Protocol

INPUT: SK, Cx, Rx, PK, ʦ
OUTPUT: ʩset, CI, ʦ, AuthReq, CM1, Ktemp1, IoTDRes, CM2, Ktemp2, IoTD_CM,
Ktemp3, CS_CM, ʦ*, HHMAC, ʩ*set
BEGIN:
/* Initial keys generation */
1)      Set threshold session duration, Ƃthresh
2)      Generate a set of n keys of m length
ʩset = {ʩ[0], ʩ[1], ʩ[2], ʩ[3]….. ʩ[n-1]}
3)      Encrypt and buffer ʩset at cloud server and IoT WSNS
4)      Generate and buffer CRP (Cx, Rx) from PUF
5)      Using public key PK, encrypt CRP to generate concealed
identifier, CIs
CI=PK (Cx, Rx)
6)      Derive session keys, ʦ
7)      Using TRNG, generate challenge and session key random
numbers, Randi and RNi
/* WSNS & CS Authentication*/
8)
      WSNS sends authentication request message, AuthReq to CS
WSNS ®CS: AuthReq = SK(ʦ , CI)
ID
9)      CS decrypts AuthReq to obtain ʦID, CI
10)      IF ʦID & CI are invalid THEN:
Terminate request
11)      ELSE: CS sends challenge message CM1 to WSNS
CS ®WSNS: CM1= {Ch1, Rand1} /* Ch1={C11, C12, C13,…C1S}, s<n */
/* WSNS response generation*/
12)      WSNS generates temporary key Ktemp1 of m bits

7
International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

Ktemp1=PK[C11] ÅK[C12] ⊕ K[C13] ⊕ … ⊕ K[C1S]

13)      At WSNS, generate response for the CS challenge
WSNSRes= Ktemp1 (Rand1║RN1) /* RN1 is the WSNS generated random
number */
14)      Generate challenge Ch2 for CS
CM2= {Ch2, Rand2} /* Ch2={C21, C22, C23,…C2S}; Ch2 1 Ch1*/
15)      Derive temporary key Ktemp2 for encryption
Ktemp2=PK[C11] ÅK[C12] ⊕ K[C13] ⊕ … ⊕ K[C1S]
16)      WSNS concatenates WSNSRes and Ch2 and sends them to
CS
17)      WSNS ®CS: WSNSCM = SK(Ktemp2, Rand1║RN1║{ Ch2, Rand2})
18)      Upon receipt of WSNSCM, CS decrypts it using its
own generated temporary key
19)      IF CS cannot successfully retrieves Rand1 from WSNSCM
THEN:

Terminate request
20)      ELSE: Generate temporary encryption key Ktemp3
Ktemp3= PK[C21] ⊕ K[C22] ⊕ K[C23] ⊕ … ⊕ K[C2S]
21)      Generate response to challenge Ch2 and sends
it to the WSNS
CS ®WSNS: CS_CM= SK(Ktemp3ÅRN1, Rand2║RN2)
22)      Upon receipt of CS_CM, WSNS decrypts it using
Ktemp3 ⊕ RN1 to retrieve Rand2
23)      IF Rand
2
is invalid THEN:
Terminate request
24)      ELSE: WSNS and CS derive new session key, ʦ*
/* Authentication successful*/
ʦ*= CRP ⊕ RN1 ⊕ RN2 /* to encrypt further
communication*/
/* Re-generation of the set of keys, ʩset */
25)      Measure session duration, ƂMeas
26)      IF ƂMeas > Ƃthresh THEN:
27)      Compute HMAC of ʩset
HMAC
= HMAC ({ʩ[0], ʩ[1], ʩ[2], ʩ[3]….. ʩ[n-1]})
28)      Divide ʩset into b partitions of k-bits
29)      IF ʩset size is not divisible by k-bits
THEN:
30)      Pad ʩset with zeros to create b equal
partitions
31)      Generate a new set of n keys of m length
ʩ*set =bi ⊕ (i ⊕ HHMAC)
32)      Encrypt and buffer ʩ*set at CS and IoTD
ʩ*Buffered= SK(ʩ*set)
33)      ENDIF
34)      ENDIF
35)      ENDIF
36)      ENDIF
37)      ENDIF
END

8
 International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

Next, WSNS concatenates its response WSNSRes and challenge Ch2 to form WSNSCM which is
then sent to CS (phase 16), encrypted using shared secret key, SK which is part of ʩset secretly shared
between the server and the WSNS. Upon receipt of WSNSCM, CS decrypts it using its own generated
temporary key (step 18) and if Rand1 is successfully retrieved from WSNSCM, then temporary encryption
key Ktemp3 is generated in a process similar to step 12 and 15 above but under a different challenge,
Ch2 (phase 20). In step 21, the server generates response to challenge Ch2, CS_CM and sends it to the
WSNS. Here, CS_CM contains the encrypted temporary encryption key Ktemp3, RN1, second random
number for challenge Ch2, Rand2 and second random number for session key generation, RN2. Upon
receipt of CS_CM, WSNS decrypts it using Ktemp3Å RN1 to retrieve Rand2 (phase 22). Provided that the
retrieve Rand2 is valid, WSNS and CS mutual authentication is successful and hence they proceed to
derive new session key, ʦ*(step 24) by performing XOR operations on CRP, RN1 and RN2. This new
session key serves to encrypt subsequent communications. Afterwards, the set of keys used by WSNS
and the server are renewed to prevent any replay and dictionary attacks as shown in step 27 to 32. It
starts by the measurement of the session duration БMeas (step 25) and provided its value if more than
the set threshold, Бthresh, HMAC of ʩset is computed (step 27). Then, ʩset is portioned into b partitions
of k-bits (phase 28) such that if its length is not divisible by k, then it is padded to make it divisible by
k (phase 30).Steps 27 to 30 renders the new set of keys random from their previous values. In step 31,
new set of n keys of m length are generated while in phase 32, they are encrypted and buffered both
in WSNS and server CS. Figure 1 gives a summary of this three-way mutual authentication process.
As shown in Figure 1, mutual authentication is initiated by an IoT device transmitting a connection
request to the server, which then sends back a challenge to the initiating IoT device. This is followed
by the IoT device sending authentication challenge as a response to server’s challenge. The server then
verifies the device’s response and if it is legitimate, it responds to the device’s challenge. Meanwhile
the IoT server and device derive a shared secret referred to as a session key, ʦ* which serves to not
only encrypt the exchanged messages between the server and the device but also as an encryption
key for the message authentication code (MAC) employed for message authentication.

Figure 1. Three-Way Mutual Authentication

9
International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

RESULTS AND EVALUATION

In this section, the obtained simulation results are presented. This is followed by the evaluation of
the developed protocol from the performance as well as the security perspectives.

Simulation Parameters
The simulations were executed in NS3 where the WSN IoT network environment was modeled with
13 WSN sinks and 180 IoT devices that communicated with a single cloud server. Table 2 gives the
simulation parameters that were employed in this paper.
The performance of the proposed protocol was assessed using transaction costs, time complexity,
end-to-end delays and energy consumption.

Table 2. Simulation parameters

Parameter Value
Size of control messages 64 bytes
Peak requests 250
Size of request messages 128 bytes
Hashing scheme HMAC
WSN sink energy 1 joule
Number of IoT Devices 180
Number of cloud servers 1
Number of WSN sinks 13

Transaction Costs
The transaction costs denoted the number of bits required for complete mutual authentication between
the server and IoT devices. In this paper, the integrity of all requests between IoT devices and the cloud
server is verified using CRPs. This served to minimize the volume of control messages exchanged
between the server and IoT devices. Figure 2 shows the transaction cost comparison of the developed
protocol against DSSF, LAS, LTSMM, and M- G-SDN.

Figure 2. Transaction Costs Comparisons

10
 International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

Based on the results in Figure 2, all the five schemes had different transaction costs for different
number of IoT devices. Whereas M-G-SDN had the largest transaction costs, the proposed protocol
had the least transaction costs. The DSSF, M-G-SDN and the proposed protocol had peak transaction
costs when the number of devices was around 90 while LAS and LTSMM had their peak transaction
costs when the number of IoT devices was 120.

Time Complexity
The evaluation of the five schemes was also executed in terms of the duration it took to successfully
mutually authenticate the server and the IoT devices as shown in Figure 3. It is evident from Figure
3 that M-G-SDN scheme had the highest time complexity while the proposed protocol had the least
time complexity.

Figure 3. Time Complexity Comparisons

Generally, as the number of IoT devices was increased, the time complexity was also increased.
This can be attributed to the increased volume of authentication messages and hence the increment
in the time needed to handle these messages. It can be seen that the M-G-SDN scheme had their
peak time complexity when device volume was around 140 while proposed protocol, DSSF, LAS,
and LTSMM schemes had peak time complexities as the number of IoT devices approached 180.

End to End Delays

The end-to-end delay represents the time difference between request transmission and reception
between the server and the IoT devices. Figure 4 shows the end-to-end delay comparisons of the
proposed protocol against DSSF, LAS, M-G-SDN, and LTSMM schemes. It is clear from these results
that the M-G-SDN scheme had the largest delays while the proposed protocol had the smallest delays.
The DSSF scheme and the proposed protocol had largest delays when the number of IoT devices
was around 120. On the other hand, LTSMM, LAS and M-G-SDN had largest delays when the number
of IoT devices approached 180.

11
International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

Figure 4. End-to-end Delay Comparisons

Energy Consumption
In the current DTLS, elliptic curve digital signature algorithm (ECDSA) certificates contribute the
highest bulk of the handshake energy consumption. In the developed protocol, energy-constrained
nature of IoT applications was taken into consideration by having the IoT devices and the cloud server
cache each other’s public keys as part of ʩset to authenticate the key exchanges. This eliminated the need
to verify certificate authority signatures in the certificates and hence reduced energy consumptions
as shown in Figure 5. Based on the results in Figure 5, generally the M-G-SDN scheme had highest
energy consumptions followed by LTSMM, LAS, DSSF and the proposed protocol respectively.

Figure 5. Energy Consumption Comparisons

It is also clear that as the number of requests passed across the network increases so does the
energy consumptions. This can be attributed to the increased mutual authentications required for these
requests. The adopted CRP-based authentication eliminated the high energy computations required
for digital certificate verifications exhibited in the current DTLS based schemes. This renders our
protocol ideal for battery-powered IoT device.

12
 International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

Security and Privacy Evaluation

In the proposed protocol, a set of keys ʩset are employed for both server and IoT devices authentication.
Here, ʩset is initially shared between devices and server such that after the set session duration threshold,
it is changed to thwart dictionary and replay attacks. It is evident from the algorithm in Algorithm
1, that there were no extra messages exchanged between the server and the IoT device during the
renewal process. As such, the three-way mutual authentication adopted in this protocol is bandwidth
efficient. Further, attack models such as side channel attack, man-in-the-middle (MitM), cloning,
dictionary attack, denial of service (DoS) attack and next password prediction were employed to
evaluate the security of the proposed protocol. The rationale for this choice is that they are the most
common techniques for the breach of the security of any authentication protocol.
DoS attacks: to prevent an adversary from flooding either the server or IoT devices, three way
mutual authentication was executed between the server and the devices before channel allocation as
shown in Figure 1 above.
Key prediction and dictionary attacks: in the proposed protocol, different session keys are
employed for different sessions and the set of keys ʩset is renewed at the onset of a new session. The
bitwise XOR operation, padding and portioning executed during the renewal process for both session
keys and ʩset make them random. As such, even if an attacker retrieves current values of these keys,
their next values cannot be predicted based on the current values.
MitM attack: all messages exchanged after authentication are validated using the session key ʦ
generated using random numbers RN1and RN2 exchanged between the server and devices in encrypted
messages (IoTD_CM & CS_CM). The key for these encrypted messages SK is a part of ʩset secretly
shared between the server and the devices. Since it is impossible for an adversary to derive ʦ from
the captured messages, MitM attack is not feasible. Based on the properties of the random oracle in
Definition 7, all random oracle outputs are random and from these outputs, it is not possible to predict
the input. During the generation of ʩ*set, the keyed hash (HMAC), HHMAC of previous ʩset is taken as
the key. Each random oracle creates a new random value every time ʩset value is fed to it (Definition
7). This newly created random value is XORed with the HHMAC and hence the newly generated ʩ*set
values are random from ʩset values (Definition 9). Consequently, even if some parts of ʩset are known,
an adversary is unable to predict any value of the next oracle.
Side-channel and cloning attacks: the PUF based CRPs deployed in the proposed protocol were
random and unique to the hardware of the underlying WSN device, and hence could not be cloned
or learnt through side-channel attacks.

CONCLUSION AND FUTURE WORK

This paper sought to develop challenge-response mutual authentication protocol for enhancing security
in WSN- based IoT environment. To achieve this, a protocol comprising of public keys, shared
symmetric keys, concealed identifiers, session keys, nonce and temporary keys was developed. Its
performance was the compared with conventional schemes such as LTSMM, LAS, DSSF and MG-
SDN in terms of transaction costs, time complexity, end-to-end delays and energy consumption. The
security analysis demonstrated that the proposed protocol is robust against conventional WSN attacks.
In terms of performance, it showed better transaction costs, time complexity, end to end delays and
energy consumption compared to conventional techniques. Future work will involve the evaluation
of the developed protocol using metrics that were not within the scope of this paper.

13
International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

REFERENCES

Alladi, T., & Chamola, V. (2020). HARCI: A two-way authentication protocol for three entity healthcare IoT
networks. IEEE Journal on Selected Areas in Communications.
Alshehri, M. D., & Hussain, F. K. (2019). A fuzzy security protocol for trust management in the internet of
things (Fuzzy-IoT). Computing, 101(7), 791–818.
Choi, Y., Lee, Y., Moon, J., & Won, D. (2017). Security enhanced multi-factor biometric authentication scheme
using bio-hash function. PLoS One, 12(5), e0176250.
Chung, Y., Choi, S., Lee, Y., Park, N., & Won, D. (2016). An enhanced lightweight anonymous authentication
scheme for a scalable localization roaming service in wireless sensor networks. Sensors (Basel), 16(10), 1653.
Du, W., Deng, J., Han, Y. S., Varshney, P. K., Katz, J., & Khalili, A. (2005). A pairwise key predistribution
scheme for wireless sensor networks. ACM Transactions on Information and System Security, 8(2), 228–258.
El-Hajj, M., Fadlallah, A., Chamoun, M., & Serhrouchni, A. (2019). A survey of internet of things (IoT)
authentication schemes. Sensors (Basel), 19(5), 1141. doi:10.3390/s19051141 PMID:30845760
Fadi, A. T., & David, D. B. (2020). Seamless authentication: For IoT-big data technologies in smart industrial
application systems. IEEE Transactions on Industrial Informatics.
Fang, H., Qi, A., & Wang, X. (2020). Fast authentication and progressive authorization in large-scale IoT: How
to leverage ai for security enhancement. IEEE Network, 34(3), 24–29. doi:10.1109/MNET.011.1900276
Fu, A., Lan, S., Huang, B., Zhu, Z., & Zhang, Y. (2012). A novel group-based handover authentication scheme
with privacy preservation for mobile WiMAX networks. IEEE Communications Letters, 16(11), 1744–1747.
Gope, P., & Hwang, T. (2016). A realistic lightweight anonymous authentication protocol for securing real-
time application data access in wireless sensor networks. IEEE Transactions on Industrial Electronics, 63(11),
7124–7132.
Harbi, Y., Aliouat, Z., Harous, S., Bentaleb, A., & Refoufi, A. (2019). A review of security in internet of things.
Wireless Personal Communications, 108(1), 325–344. doi:10.1007/s11277-019-06405-y
He, Y., Han, G., Wang, H., Ansere, J. A., & Zhang, W. (2019). A sector-based random routing scheme for
protecting the source location privacy in WSNs for the Internet of Things. Future Generation Computer Systems,
96, 438–448.
Husamuddin, M., & Qayyum, M. (2017). Internet of Things: A study on security and privacy threats. In 2017
2nd International Conference on Anti-Cyber Crimes (ICACC) (pp. 93-97). IEEE.
Kouicem, D. E., Bouabdallah, A., & Lakhlef, H. (2018). Internet of things security: A top-down survey. Computer
Networks, 141, 199–221. doi:10.1016/j.comnet.2018.03.012
Kumar, V. V., Devi, M., Raja, P. V., Kanmani, P., Priya, V., Sudhakar, S., & Sujatha, K. (2020). Design of peer-
to-peer protocol with sensible and secure IoT communication for future internet architecture. Microprocessors
and Microsystems, 78, 103216. doi:10.1016/j.micpro.2020.103216
Kumari, S., Li, X., Wu, F., Das, A. K., Arshad, H., & Khan, M. K. (2016). A user friendly mutual authentication
and key agreement scheme for wireless sensor networks using chaotic maps. Future Generation Computer
Systems, 63, 56–75.
Liu, D., Ning, P., & Li, R. (2005). Establishing pairwise keys in distributed sensor networks. ACM Transactions
on Information and System Security, 8(1), 41–77.
Liu, Y., Kuang, Y., Xiao, Y., & Xu, G. (2017). SDN-based data transfer security for Internet of Things. IEEE
Internet of Things Journal, 5(1), 257–268.
Lu, B., Wang, L., Liu, J., Zhou, W., Guo, L., Jeong, M. H., & Han, G. et al. (2019). LaSa: Location aware wireless
security access control for IoT systems. Mobile Networks and Applications, 24(3), 748–760.
Luo, M., Wen, Y., & Hu, X. (2019). Practical data transmission scheme for wireless sensor networks in
heterogeneous IoT environment. Wireless Personal Communications, 109(1), 505–519.

14
 International Journal of Interdisciplinary Telecommunications and Networking
Volume 14 • Issue 1

Lyu, C., Zhang, X., Liu, Z., & Chi, C. H. (2019). Selective authentication based geographic opportunistic routing
in wireless sensor networks for Internet of Things against DoS attacks. IEEE Access: Practical Innovations,
Open Solutions, 7, 31068–31082.
Mabodi, K., Yusefi, M., Zandiyan, S., Irankhah, L., & Fotohi, R. (2020). Multi-level trust-based intelligence
schema for securing of internet of things (IoT) against security threats using cryptographic authentication. The
Journal of Supercomputing, 1–26.
Mughal, M. A., Shi, P., Ullah, A., Mahmood, K., Abid, M., & Luo, X. (2019). Logical tree based secure rekeying
management for smart devices groups in IoT enabled WSN. IEEE Access: Practical Innovations, Open Solutions,
7, 76699–76711.
Nyangaresi, V. O., Rodrigues, A. J., & Abeka, S. O. (2020). Neuro-Fuzzy Based Handover Authentication
Protocol for Ultra Dense 5G Networks. In 2020 2nd Global Power, Energy and Communication Conference
(GPECOM) (pp. 339-344). IEEE.
Nyangaresi, V. O., Rodrigues, A. J., & Abeka, S. O. (2020). Efficient Group Authentication Protocol for
Secure 5G Enabled Vehicular Communications. In 2020 16th International Computer Engineering Conference
(ICENCO) (pp. 25-30). IEEE.
Qian, Y., Jiang, Y., Chen, J., Zhang, Y., Song, J., Zhou, M., & Pustišek, M. (2018). Towards decentralized IoT
security enhancement: A blockchain approach. Computers & Electrical Engineering, 72, 266–273.
Shen, M., Liu, H., Zhu, L., Xu, K., Yu, H., Du, X., & Guizani, M. (2020). Blockchain-assisted secure device
authentication for cross-domain industrial IoT. IEEE Journal on Selected Areas in Communications, 38(5),
942–954. doi:10.1109/JSAC.2020.2980916
Sheron, P. F., Sridhar, K. P., Baskar, S., & Shakeel, P. M. (2020). A decentralized scalable security framework
for end‐to‐end authentication of future IoT communication. Transactions on Emerging Telecommunications
Technologies, 31(12), e3815.
Srinivas, J., Mukhopadhyay, S., & Mishra, D. (2017). Secure and efficient user authentication scheme for multi-
gateway wireless sensor networks. Ad Hoc Networks, 54, 147–169.
Turkanović, M., Brumen, B., & Hölbl, M. (2014). A novel user authentication and key agreement scheme for
heterogeneous ad hoc wireless sensor networks, based on the Internet of Things notion. Ad Hoc Networks, 20,
96–112.
Xu, L., & Wu, F. (2019). A lightweight authentication scheme for multi-gateway wireless sensor networks under
IoT conception. Arabian Journal for Science and Engineering, 44(4), 3977–3993.
Zeng, X., Xu, G., Zheng, X., Xiang, Y., & Zhou, W. (2018). E-AUA: An efficient anonymous user authentication
protocol for mobile IoT. IEEE Internet of Things Journal, 6(2), 1506–1519. doi:10.1109/JIOT.2018.2847447
Zhang, X., & Wen, F. (2019). An novel anonymous user WSN authentication for Internet of Things. Soft
Computing, 23(14), 5683–5691.

Vincent Omollo Nyangaresi holds a PhD in Information Technology Security and Audit and has 11 years of
experience as a lecturer in the areas of computer science and I.T Security. His research interest include mobile
security, data communication, IoT security and artificial intelligence among others.

Anthony Joachim Rodrigues is a full professor in Computer Science. Research Interests: Computational
Mathematics, Systems Modeling, IT & Society.

Ahmad A. Al Rababah received Ph.D in 1998 in computer engineering and now he is a full professor at King
Abdulaziz University, he has around 23 experience years of teaching and research in different fields of computing
technology and engineering, his research interests are information technology, software engineering, IoT, block
chain technologies, artificial Intelligence and others. He is a chief editor of Asian Journal of Information Technology,
also he is an editorial member in many of specialized indexed international journals in fields of computing.

15