[Paper Review] Secure Lightweight Authentication for Multi User IoT Environment

Chintan Patel|arXiv (Cornell University)|Jul 21, 2022

Advanced Authentication Protocols Security4 citations

TL;DR

This paper proposes a lightweight, secure remote authentication protocol for multi-user IoT environments using Elliptic Curve Cryptography (ECC) and the MQTT protocol. It achieves strong security through formal verification using AVISPA and BAN logic, while reducing computation and communication costs—demonstrating 4.5003 ms computation cost and 992-bit communication cost, outperforming existing schemes in efficiency and resilience to common cryptographic threats.

ABSTRACT

The Internet of Things (IoT) is giving a boost to a plethora of new opportunities for the robust and sustainable deployment of cyber physical systems. The cornerstone of any IoT system is the sensing devices. These sensing devices have considerable resource constraints, including insufficient battery capacity, CPU capability, and physical security. Because of such resource constraints, designing lightweight cryptographic protocols is an opportunity. Remote User Authentication ensures that two parties establish a secure and durable session key. This study presents a lightweight and safe authentication strategy for the user-gateway (U GW) IoT network model. The proposed system is designed leveraging Elliptic Curve Cryptography (ECC). We undertake a formal security analysis with both the Automated Validation of Internet Security Protocols (AVISPA) and Burrows Abadi Needham (BAN) logic tools and an information security assessment with the Delev Yao channel. We use publish subscribe based Message Queuing Telemetry Transport (MQTT) protocol for communication. Additionally, the performance analysis and comparison of security features show that the proposed scheme is resilient to well known cryptographic threats.

Motivation & Objective

• Address the challenge of securing resource-constrained IoT devices in multi-user environments with minimal computational and communication overhead.
• Design a secure, scalable authentication mechanism for user-gateway (U-GW) communication in IoT systems.
• Ensure resistance to common cryptographic attacks such as replay, impersonation, and key leakage under realistic constraints.
• Optimize performance in terms of computation cost, communication cost, end-to-end delay, packet loss, and throughput.
• Enable practical deployment using lightweight hardware (e.g., Raspberry Pi) and standard protocols like MQTT.

Proposed method

• Leverages Elliptic Curve Cryptography (ECC) for efficient key generation and secure authentication, reducing computational load compared to traditional public-key systems.
• Employs a publish/subscribe-based Message Queuing Telemetry Transport (MQTT) protocol for lightweight, low-bandwidth communication between users and gateways.
• Uses a two-message authentication exchange involving user identity, nonce, timestamp, and ECC-based public key operations to establish a shared session key.
• Applies formal security analysis using AVISPA and BAN logic to verify mutual authentication and key secrecy.
• Conducts an informal security assessment using the Dolev-Yao model to evaluate threat resistance in a symbolic threat model.
• Implements the protocol on Raspberry Pi and nodeMCU devices using Python, with Wireshark and custom scripts for performance and networking metric collection.

Experimental results

Research questions

• RQ1 How can a lightweight authentication protocol be designed to meet the stringent resource constraints of IoT sensing devices while ensuring strong security guarantees?
• RQ2 To what extent does the proposed scheme resist well-known cryptographic attacks such as replay, impersonation, and key disclosure?
• RQ3 How does the proposed scheme compare in performance—particularly in computation cost, communication cost, end-to-end delay, and throughput—against existing related schemes?
• RQ4 Can formal verification tools like AVISPA and BAN logic effectively validate the security properties of the proposed protocol in an IoT context?
• RQ5 What is the real-world performance of the protocol when implemented on low-power IoT devices using MQTT as the communication layer?

Key findings

• The proposed scheme achieves a total computation cost of approximately 4.5003 ms, significantly lower than existing schemes such as [31] (8.9339 ms) and [12] (13.4078 ms).
• The communication cost is reduced to 992 bits per session, which is lower than schemes in [12], [28], [29], [30], and [31], demonstrating superior bandwidth efficiency.
• The protocol reduces round-trip delay and packet loss while increasing throughput, as validated through Wireshark and Python-based network analysis on real IoT hardware.
• Formal verification using AVISPA and BAN logic confirms the protocol’s resistance to common threats such as replay and impersonation attacks.
• The implementation on Raspberry Pi and nodeMCU confirms the feasibility of deploying the scheme on low-resource IoT devices with minimal performance degradation.
• The use of ECC-based operations (2 $T_{Pm}$, 5 $T_{Syn}$, 11 $T_{h}$) enables strong security with minimal computational overhead, making it suitable for battery-powered and embedded IoT systems.