# LDA-2IoT : A Level Dependent Authentication using Two Factor for IoT
Paradigm

Chintan Patel*, Nishant Doshi  Department of Computer Science and Engineering,
Pandit Deendayal Energy University, Gandhinagar,India<EMAIL_ADDRESS>
###### Abstract

The widespread expansion of the IoT based services are changing people’s
living habits. With the vast data generation and intelligent decision support
system, an IoT is supporting many industries to improve their products and
services. The major challenge for IoT developers is to design a secure data
transmission system and a trustworthy inter-device and user-device
communication system. The data starts its journey from the sensing devices and
reaches the user dashboard through different medium. Authentication between
two IoT devices provides a reliable and lightweight key generation system. In
this paper, we put forward a novel authentication approach for the IoT
paradigm. We postulate an ECC based two factor Level-Dependent Authentication
for Generic IoT (LDA-2IoT) in which users at a particular level in the
hierarchy can access the sensors deployed at below or the equal level of the
hierarchy. We impart the security analysis for the proposed LDA-2IoT based on
the Dolev-Yao channel and widely accepted random oracle based ROR model. We
provide the implementation of the proposed scheme using the MQTT protocol.
Finally, we set forth a performance analysis for the proposed LDA-2IoT system
by comparing it with the other existing schemes.

###### keywords:

IoT; Level Dependent Authentication; Key agreement; RoR

##  1 INTRODUCTION

Internet of Things (IoT) is a network of an interconnected network of sensing
devices, mobile and laptop users, routing devices, servers, and other
computing devices with the communicating capabilities. An IoT connects
billions of resource-constraint devices with the physical world using a
lightweight communication and security mechanism. An objective of the IoT
system is to provide ”any service” to ”any user” on ”any time” at ”anywhere”.
So overall, the IoT is an integration of all the Cyber-Physical Systems (CPS)
through the internet.

The generic IoT model discussed in Patel Doshi (2018) shows an integration of
the various IoT components and entities. In general, IoT users connect with
the different IoT applications through the internet. The IoT applications like
smart home, smart factory, smart transportation, smart agriculture, smart
health communicate integrated data with the users through intermediate
internet devices such as gateways and switches.

Most of the devices deployed in IoT networks are sensing devices. The sensing
devices are tiny devices capable of detecting the surrounding biological
environment as well as the nonbiological environment. The sensing devices
communicate data in the short-range area and transmit sensed data to the
nearest gateway device through technologies such as Bluetooth, RFID, Zigbee,
and WiFi. The sensing devices are resource constraint devices in terms of
storage cost, power utilization, and computation capabilities. The traditional
security mechanisms of the internet use complex cryptography mathematical
operations. These operations require ample storage space and high computation
memory. Thus, due to the availability of numerous resource constraint devices,
it is indispensable to prototype a lightweight security mechanism for end-to-
end data communication in IoT Model. The proposed lightweight security
mechanism must be efficient in terms of the computation capabilities,
optimized in terms of memory and time utilization, and robust against the
traditional and non-traditional security attacks Gope Sikdar (2019). An
Elliptic Curve Cryptography (ECC) attracts security researchers due to its
lightweight operations, less computation requirement, and limited memory
consumption. The ECC has proven it’s computation efficiency and robust
security against traditional public-key cryptography mechanisms like RSA. The
ECC operations like point multiplication replace the conventional discrete
logarithm mechanisms based on exponential computation. Recently authors in
Abbasinezhad-Mood Nikooghadam (2018) and Roy . (2018) proposed a session key
agreement scheme using the ECC for a sensing environment.

The sensing devices deployed on ”ground” collect data from the environment and
transmit those data to the nearby home agent (gateway). The neighboring home
agents can be a micro-controller, micro-processor, mobile towers, routers, or
any data receiver device which integrates data from the sensing devices and
forwards those data to the users via other internet devices. The recent study
shows that the latest home agents also work like fog devices or edge computing
devices capable of performing the local data processing and converting those
unorganized data into organized raw data. In traditional IoT network, deployed
sensing devices create a local cluster and communicate pieces of information
with the cluster heads (CHs) thorough the short-range protocols like Zigbee,
Z-Wave, Beacon or Bluetooth Low Energy (BLE). In some of the IoT model, the
sensing devices communicate with the cluster head through a wired medium. The
CH connects the gateway devices (GW) with the sensing devices. The gateway
devices are resource capable devices that can perform complex security
operations and can forward the received data to the IoT application users
through a long-range internet protocol like IP or 6LoWPAN. In IoT, users can
access stored data as well as realtime live data. Thus, the gateway devices
transmit data to the cloud server for storage and processing or to the user
for realtime monitoring. Secure storage and processing of the data in the
cloud lead toward intelligent decision making through machine learning. In
numerous recently proposed key agreement schemes, the application users
register with the gateway devices for each sensing device Abbasinezhad-Mood
Nikooghadam (2018); Roy . (2018); Zhou . (2019), but let us take the realtime
scenario in which there are thousands of sensing devices deployed on the
ground. Users like the company owner or the cluster manager want to receive
the data from each sensing device in realtime. Then, they need to register for
each sensing device individually, which is not a practical and feasible
solution. During deployment of the realtime scenario, we found that in the
recently proposed schemes, the gateway needs to create a separate smart card
for each of the sensing devices for each of the application users who require
$N_{u}*N_{sd}$ registrations and $N_{u}*N_{sd}$ time gateway initial
computations. Here $N_{u}$ shows the number of users, and $N_{sd}$ indicates
the number of sensing devices. Thus, in this paper, we reap a novel solution
for the problems mentioned earlier, using a bizarre concept of the Level-
dependent Authentication (LDA).

###  A Related Work

In IoT security, authentication is one of the significant operations which
assures mutual trust between the sensing devices, intermediate network
devices, and the end-user devices. The secure authentication and key agreement
achieve features like an anonymity and unlinkability, lower setup complexity,
fewer computations and communication cost, natural access control, limited
energy consumption, service availability, data confidentiality, communication
integrity, nontraceability, secure ownership transfer, and mutual
authentication. In this subsection, we discuss recently published
authentication schemes designed using ECC Miller (1985) for the generic IoT
model and other IoT applications like smart grid and smart home.

####  A.1 Authentication in Smart Home:

Recently, Shuai et al. published an authentication scheme for the smart home
using an ECC Shuai . (2019). In this Paper, the Registration Authority (RA) is
a trusted entity that performs an initialization step and generates secret
credentials for the sensing device $SD_{j}$ and the gateway node $GW$. The
scheme proposed in Shuai . (2019) is a two-factor authentication scheme in
which the user makes use of the password and smart card to perform the login
and authentication. The other authentication scheme was recently proposed by
Lyu et al. Lyu . (2019) for the intelligent home using ECC.

Authors in Lyu . (2019) put forward an authentication scheme which provides
security against the traceability and useful for the uncertain internet
services and environment like ”If This Than That (IFTTT).” In the same paper,
authors give a formal security analysis using a practical scyther tool. In
2018, Chifor et al. Chifor . (2018) proposed a unique authentication scheme
for the ”Fast IDntity Online (FIDO) model. In the FIDO model, the user does
not use any authentication factors like a password. Still, it uses ECC
generated parameters as keys stored by the trusted party and biometric-based
access for those keys. The other authentication protocol for the smart home
using a password was proposed by Naoui et al. in Naoui . (2019). Authors in
Naoui . (2019) proposed a lightweight and secure password-based authentication
scheme called ”LSP-SHAP” for the smart home monitoring and management.

####  A.2 Authentication in Smart Grid:

In 2016, Jo et al. proposed an authentication mechanism for the smart grid
using ECC. Jo et al. Jo . (2016) proposed an authentication scheme between a
smart meter (SM), Data Collection Unit (DCU), Advanced Metering Infrastructure
(AMI) using ECC based key pair generation. In 2017, Vahedi et al. proposed an
ECC based authentication scheme for the grid in Vahedi . (2017). Authors in
Vahedi . (2017) proposed an authentication mechanism between a smart meter
(which collects an energy consumption from smart appliances), a gateway (which
aggregates the data from all smart meter) and operation center (which works as
a bill generating location) using a Trusted Third Party (TTP).

In 2018, Mahmood et al. Mahmood . (2018) proposed an authentication scheme for
the smart grid in which other registered users and TTP authenticate with the
registered user. The authors in Mahmood . (2018) provided a security analysis
for the proposed authentication using a widely adopted and practical security
analysis tool ”ProVerif.” In 2019, Kumar et al. N. Kumar . (2019) proposed an
ECC based authentication scheme for the smart grid. The network model used by
N. Kumar . (2019) consists of the authentication between the Energy Utility
Center (EUC) and the Smart Grid device (SG) using the Trusted Authority (TA).
The authors performed a security analysis for their proposed scheme using
Automated Verification of Internet Security Protocol and Application (AVISPA)
tool and random oracle based RoR Model. Recently, other authors also presented
authentication schemes using ECC for the smart grid in Zhang . (2019); Khan .
(2019).

####  A.3 Authentication in Smart Healthcare:

In 2018, Jia et al. Jia . (2018) proposed a key agreement scheme for smart
health-care using an ECC. The authors in Jia . (2018) provides an
authentication mechanism for the fog based cloud service dependent network
model in which the critical agreement materializes between a user-fog node
(FN)-cloud service provider (CSP). In 2018, Wu et al. Wu . (2018) proposed an
authentication scheme for the health-care model where the patient with the
mobile device communicates with the nearby home agent to transmit the body
data to the doctors.

The authentication model, followed in Wu . (2018), provides a critical
agreement between the mobile user-foreign agent-home agent. The AVISPA tool is
used for security analysis. Recently in 2019, Ever at al. Kirsal Ever (2019)
proposed an anonymous authentication scheme for the Wireless Medical Sensor
Network (WMSN) where the WMSN user receives a live and stored sensor data
through the gateway. The authors in Kirsal Ever (2019) provides a formal
security analysis of the proposed scheme using a random oracle based model. In
2019, Sureshkumar et al. Sureshkumar . (2019) proposed an authentication
scheme using an ECC for the WMSN in which a sensor-equipped patient with the
smart device transmits data to the user (doctor) through the gateway device
and also store the data in the cloud. The Authors in Sureshkumar . (2019)
implemented the proposed scheme using a Linear Feedback Shift Register (LFSR).
In the IoT based smart health-care system, the privacy of the patient’s
identity and confidentiality of the health data is the critical security
aspects.

####  A.4 Authentication in Generic IoT:

In 2018, Wazid et al. Wazid, Das, Odelu, Kumar, Conti Jo (2018) proposed a
User Authenticated Key Management Protocol (UAKMP) for the smart home IoT
network. Authors in Wazid, Das, Odelu, Kumar, Conti Jo (2018) followed the
user-gateway-sensor based network model and the random oracle based ROR model
for the formal security analysis. In 2019, Das et al. Das . (2019) proposed a
lightweight access control and key agreement protocol for the IoT environment
(LACKA-IoT) using ECC. Recently, in 2019, Gope et al. Gope Sikdar (2019)
proposed a privacy-preserving authentication scheme for the IoT devices using
a Physical unclonable Function (PUF). The PUF provides a lightweight hardware
implementation of the random number generator. In Das . (2019), the ROR based
security model was followed, and the security simulation is produced using the
AVISPA tool. They simulated the proposed protocol using a widely used
simulator Network Simulator 2 (NS2).

A publish-subscribe based MQTT protocol is widely accepted for IoT based
applications. The Lohachab et al. Lohachab Karambir (2019), in 2019, proposed
an ECC based authentication and access control scheme for the MQTT based
communications. The Machine to Machine communication through the MQTT protocol
plays a significant role in automated service developments. The authors in
Esfahani . (2019) proposed an authentication scheme between the sensing device
and routing device (device-device) using lightweight operations like hash
function and XOR operation. The Internet of Drones (IoD) is a network of
uncrewed areal vehicles called Drones. In IoD based interface, the secure live
streaming and reliable access control of the drone devices are essential
security aspects. The authors in Wazid . (2019) set forth a crucial
lightweight agreement scheme for the drone deployment in which the ground user
securely communicates with the Drone Data Transmitter (DDT) through the server
as a trusted entity.

Due to the widespread growth of the IoT based devices and their deployments,
the attack space is also expanded as well as new attack vectors are also
created for the attackers. The layered wise security analysis of the IoT is
briefly discussed in Mosenia Jha (2017). The physical attack, side-channel,
and DoS attack are major attacks through which IoT nodes pass through. The
side-channel attack faced by IoT devices, user devices, or network devices,
which can leak certain critical information such as communication time,
communication frequency, communication direction, communication modulation to
the attacker. The significant attacks through which the IoT authentication
schemes pass through are replay attack, Sybil attack, flooding attack, DoS
attack, stolen smart card attack, forward secrecy, password guessing attack,
eavesdropping, forged user attack, masquerading server attack, man-in-the-
middle attack, stolen verifier attack, session-specific secret loss attack,
device compromised and device impersonation attack, insider attack and so on.

###  B Research Contribution

There are multitudinous research contributions from this paper.

  * •

In this paper, we provide a solution for the problem of ”multiple
registrations by the single user for the different sensing devices” using a
Level-Dependent Authentication (LDA). The LDA algorithm is straightforward but
highly efficient to use in the massive IoT industrial deployment. The LDA
protocol significantly reduces the access control complexity for large
industries. To the best of our knowledge, the LDA is a novel and unique
concept that is proposed for the first time in this paper.

  * •

The proposed LDA scheme uses only hash-functions ECC based computations and
ECC encryption/decryption function, which make the proposed scheme a
lightweight compared to the other existing schemes.

  * •

The security analysis of the proposed LDA scheme is performed in two-fold. One
fold is through the informal way; we prove that the proposed LDA scheme is
secured against various traditional and non-traditional IoT attacks over the
Dolev-Yao channel. In the second fold, we prove the security of the proposed
scheme using a widely accepted and recognized random oracle based security
model ”Real or Random (RoR) model.” Along with the RoR, we also provide
security simulation for the proposed scheme using an AVISPA tool. The security
standardization authorities widely recognize the AVISPA tool like IETF and
others for their security simulations.

  * •

The comparative analysis of the proposed scheme with the other existing
systems proves that the proposed LDA scheme is more reliable, efficient, and
convenient in-terms of computation cost, communication cost, energy
consumption, and deployment in a massive industry. The implementation validity
of the proposed scheme is verified through the deployment of NodeMCU as
sensing devices, raspberry-pis as gateway devices and laptops as a user
device. The proposed LDA-2IoT scheme is performed using the MQTT as an
application layer protocol and 6LoWPAN as a network layer protocol.

###  C Paper Organization

The rest of the paper is organized as follows: In section 2, we provide a
brief introduction about the network model followed for designing of the
proposed scheme. We introduce readers with the basic preliminaries like the
one-way hash function, ECC, level-dependent authentication, and threat model.
Section 3 presents a proposed LDA-2IoT scheme using an ECC. In section 4, we
provide a detailed security analysis for the proposed scheme using the formal
model and the informal method. The performance analysis for the proposed
scheme and its comparison with the other existing schemes is discussed in
section 5. In section 6, we provide the implementation methodology and the
output for a proposed scheme. Lastly, we conclude the article with the future
directions in section 7.

##  2 PRELIMINARIES AND THREAT MODEL

In this Section, we put forward the essential preliminaries and threat model
used for the designing of the proposed protocol.

###  A System Model

The generic IoT system is a network of heterogeneous tiny resource constraint
devices. In generic IoT, the end-user wants a data sensed by the resource
constraint sensing devices. Therefore, in general, any IoT system provides two
types of data services. The first type of facility where the user wants quick
realtime live data. Examples of this type of application are smart disaster
management, intelligent home/industry monitoring, smart energy monitoring, and
so on. The second type of service where the user does not want realtime live
data, but he/she retrieves stored data for analysis and smart decision making.
Examples of this type of application include smart automated decision-making,
intelligent recommender systems, intelligent learning-based security
mechanisms, and so on. Thus, we tried to design and implement a proposed
authentication scheme in such a way that it can be used for both the scenario.
We discuss the system model in two ways. One is a network model where we
highlight the topology on network and second as a communication model where we
present the discussion about network layer and application layer protocols.

####  A.1 Network Model

As shown in Fig. 1, the network model involves four basic entities, the
sensing device ($SD$), the cluster head ($CH$), the user devices ($U$) and the
gateway node ($GWN$).

  * •

User Device ($U$): These devices have the end-user application installed,
which provides a dashboard to the user for monitoring and controlling of the
deployed system. The user device must be able to capture live data as well as
stored data. The user device is built-in with limited resources and can still
perform the basic cryptography operations. The smart card reader is a software
program that is installed with the user devices that also communicates with
the gateway device during authentication.

  * •

Gateway Node ($GWN$): The gateway node is a trusted party for the proposed IoT
topology. The gateway node is a resource capable device and can perform
complex cryptographic operations. The gateway device receives data from the
sensing devices and forwards those data to the user devices after completing
the user verification and data validation. Thus, the gateway device works as
an aggregator, as well as a forwarder of the data. In the fog computing/edge
computing concept, the gateway devices perform as a critical service provider.
In the proposed scheme, we focus on the uni gateway model. In the subsequent
future work, we plan to implement a multi-gateway model with a more realistic
approach to complete IoT deployment.

Figure 1: Network Model and Level Dependent Authentication

  * •

Sensing Device ($SD$): The sensing devices are tiny, and most resource
constraint devices in the IoT hierarchy. These devices are highly confined in
terms of memory, transmission bandwidth, communication range, computational
capability, and power capability. Thus, the security operations performed by
these devices must be lightweight and efficient enough.

  * •

Cluster Heads ($CH$): The cluster head is a device that works as a networking
hub or a switch that receives the data from multiple sensing devices deployed
in-the network and forwards those data to the nearby in range gateway device.

In the proposed network model, we assume that the gateway device is the most
trusted, highly computationally capable, and physically secured machine P.
Kumar . (2016) Wazid, Das, Odelu, Kumar Susilo (2018). Thus, the essential
responsibilities like initialization, key generation, level verification are
taken care of by the gateway devices.

####  A.2 Communication Model

In any IoT network, communication is performed in two ways: long-range
communication and short-range communication. The short-range communication
between the sensing device-cluster head or sensing device-gateway node uses
protocols like Z-Wave, Zigbee, Beacons, Bluetooth Low Energy (BLE). The long-
range communication between two gateway devices, CH device-gateway device, or
gateway device-user device, uses networking protocols like IPv4, IPv6,
6LoWPAN, etc. The primary application layer protocols used by the IoT network
are Message Queuing Telemetry Transport (MQTT), Light HTTP, Constrained
Application Protocol (COAP), and Extensible Messaging and Presence Protocol
(XMPP).

###  B Level-Dependent Authentication

To achieve successful access control in the IoT scenario is also one of the
principal challenges. Essential factors that affect the liberty of access
control is the availability of the tonnes of sensing devices and heterogeneity
of their technical capabilities. Thus, for every user, if we maintain the
access control list or perform the registration, then it will be an unvaried
task. As per the current literature, the user registers for individual
sensors. If the user is eligible for hundreds of sensing devices, then he/she
needs to maintain hundreds of smart cards. This is a significant challenge to
reduce the space requirement with less complexity and wipe out the user’s
multiple registrations.

Rather than the traditional approach, we highlight a novel concept of the
Level-Dependent Authentication (LDA) to tackle the above said challenges using
a less computation cost, low energy consumption, fewer operations, and little
memory requirement. The working of the LDA concept is highlighted in Fig. 1.
The following algorithm provides a working mechanism of the LDA concept.

Result: Access of Sensing Device to User

User-level = i;

Sensor-level = j;

while  _Gateway received request from user_ do

if  _j $\leq$ i_ then

Access-Allowed;

else

Access-Not-Allowed;

end if

end while

Algorithm 1 Level Dependent Authentication

Therefore, the major advantages of using LDA can be listed as follows:

  * •

Reduction in the access control complexity.

  * •

Number of registration phases and initialize phases will be reduced to the
number of users rather than the number of sensing devices.

  * •

Smooth replacement of the user device, sensing device, and gateway device
compare to the existing traditional approach.

  * •

Reduction of the computation cost, energy consumption, and memory utilization
at user devices, gateway devices, and sensing devices.

The major challenges and future research directions related to LDA concept can
be listed as follows:

  * •

Little increase in the computation cost at the gateway device.

  * •

In the proposed scheme, the decision for users and sensors’ level will be
taken by gateway. The proposed scheme can get further extension where separate
authority like registration authority can be created for the purpose of
initial parameter computation as well as level decision.

We validated the LDA algorithm for the MQTT based communication environment
with user devices, gateway devices, and the sensing devices. We created a
secure channel through the MQTT over TLS. We deployed numerous sensing devices
on the university campus at different locations like computer labs, faculty
cubicles, canteens, and admin offices (total fifty sensing devices). We
considered the user’s level, such as level 1 for the director, level 2 for the
deans, level 3 for the faculties, level 4 for the admin staff, and level 5 for
the clerical staff. As a gateway device, we used Raspberry pi 3 Model B with 1
GB RAM. The proposed scheme is verified, and we firmly realized that the
proposed LDA optimizes the authentication process by storage, memory, and
computation significantly.

###  C One-way Hash Function

The one-way hash function is a very essential and useful cryptographic
operation that takes an arbitrary length of input and produces a fixed-length
output. Thus, we can define the hash function H:$\\{0,1\\}^{*}$ $\Rightarrow$
$\\{0,1\\}^{n}$. Any hash function is deterministic, and the output of the
hash function is also called a message digest or hash output. So for any
binary message m $\in$ $\\{0,1\\}^{*}$, the message digest n $\in$
$\\{0,1\\}^{n}$ can be computed as n = H(m).

As defined in Wazid . (2017); Wazid, Das, Odelu, Kumar, Conti Jo (2018), for
any adversary $\mathcal{A}$, $Adv_{A}^{Hash}$(et): Prob[Rand(a,b),
$\mathcal{A}$: $p\neq q$ and H(p) = H(q)] denotes advantage of $\mathcal{A}$
in finding a hash collision where, Prob[$\chi$] highlights a probability for
the event $\chi$ and Rand(a,b) denotes that a and b are randomly generated by
an adversary $\mathcal{A}$ and et is the execution time. The adversary
$\mathcal{A}$ is a probabilistic adversary whose advantage is decided by the
random choices done by the adversary $\mathcal{A}$ within an execution time
et. Thus, if A’s running time is at most et then ($\rho$, t) shows
$\mathcal{A}$ attacking the collision resistance of H(.). Thus, within maximum
run-time et, $Adv_{A}^{Hash}(et)\leq\rho$.

###  D Elliptic Curve Cryptography

An Elliptic Curve Cryptography (ECC) is an example of the lightweight public-
key cryptography. The comparative analysis of the ECC and other public-key
cryptography protocols like RSA is briefly discussed in Patel Doshi (2018) by
Patel et al. The 160 bit of the ECC key provides a security equivalent to 1024
bit of RSA key. An Elliptic curve is a cubical curve with the non-repeatable
roots defined over a finite field F(p) where p is a prime number greater than
three. A curve is represented as a (x,y) $\in$ F(p)*F(p) for the equation,

$y^{2}=x^{3}+ax+bmodp$ (1)

where $4a^{3}+27b^{2}\neq$ 0 mod p. If $G_{p}$($G_{x}$,$G_{y}$) is a base
point or generator point than any point ($x_{p}$,$y_{p}$) generated by the
$G_{p}$ will be on curve along with the point of infinity ”$\mathcal{O}$”.

For any two curve points, P($X_{p}$,$Y_{p}$) and Q($X_{q}$,$Y_{q}$) the sum R
= P + Q which is R($X_{r}$,$Y_{r}$) where $P\neq-Q$. For any $\Lambda$ =
($\frac{Y_{q}-Y_{p}}{X_{q}-X_{p}}$) mod p if P $\neq$ Q and $\Lambda$ =
($\frac{3X_{p}^{2}+a}{2Y_{p}}$) mod p if P = Q. $X_{r}$ = ($\Lambda^{2}$ \-
$X_{p}$ \- $X_{q}$) mod p and $Y_{r}$ = ($\Lambda(X_{p}-X_{r})-Y_{p}$) mod p.
ECC Encryption: The ECC encryption invokes an encoding for the message $m$ in
to the curve point $P_{m}$. For any random private key $K_{x}$ generated by
the user $U_{x}$, the relative public key $KP_{x}$ = $K_{x}$ * $G_{p}$, where
$G_{p}$ is any group point on the elliptic curve. To encrypt the $P_{m}$, user
$U_{x}$ selects the random number k and computes $C_{m}$ = (k*$G_{p}$, $P_{m}$
\+ k * $KP_{y}$) where $KP_{y}$ is a public key of the receiver $U_{y}$. User
$U_{x}$ sends $C_{m}$ to $U_{y}$ over a public channel.

ECC Decryption: The ECC decryption invokes a computation for the $P_{m}$ =
$P_{m}$ \+ k * ($K_{y}$ * $G_{p}$) - ($K_{y}$*(k*$G_{p}$)) where $K_{y}$ is
Y’s private key. The advantage of adversary $\mathcal{A}$ in computing k from
the k*$G_{p}$ can be defined as, $Adv_{A}^{Dec}$(et) = Pr[Rand(k, $G_{p}$),
$\mathcal{A}$: $\chi_{x}$] where $Adv_{A}^{Dec}$(et) $\leq$ $\rho$, for any
$\rho$ $\textgreater$ 0 and randomly generated pair (k, $G_{p}$) with
execution time et in such a way that $\chi_{x}$ = k*$G_{p}$.

###  E Threat Model

The threat model used in this paper is contemplated from the homogeneous model
discussed in Dolev Yao (1981). An adversary $\mathcal{A}$ is an eavesdropper
who controls the complete public communication channel. In the IoT based
network model, it is possible to define an adversary $\mathcal{A}$ with the
robust capabilities for improvement in the designing of the reliable protocol
and also to perform the better security validation for the proposed
authentication concept. We follow the following adversarial model in this
paper:

  1. $G_{1}$.

An Adversary $\mathcal{A}$ can compute valid pair of the $identity*password$
offline in polynomial time using dictionary Wazid, Das, Odelu, Kumar, Conti Jo
(2018), Gope Sikdar (2019).

  2. $G_{2}$.

An Adversary $\mathcal{A}$ can extract the data from the user’s smart card
after receiving smart card in either ways Gope Sikdar (2019), Shuai . (2019).

  3. $G_{3}$.

An Adversary $\mathcal{A}$ have full access on the communication channel
between a User - Gateway, Sensor node - Gateway, and User - Sensor node Wazid,
Das, Odelu, Kumar, Conti Jo (2018), Gope Sikdar (2019), Shuai . (2019).

  4. $G_{4}$.

An Adversary $\mathcal{A}$ can get the previously computed session key between
the user and sensor. $\mathcal{A}$ can use this key to compute the next
session key P. Kumar . (2016).

  5. $G_{5}$.

An Adversary $\mathcal{A}$ can have the level information of the user device
or the sensing device at a time but can’t have the level of both at a time
Vahedi . (2017), Shuai . (2019).

  6. $G_{6}$.

An Adversary $\mathcal{A}$ can have the secrets of a gateway node during the
system failure situations. $\mathcal{A}$ can use this old secrets to break the
newly established system after failure.

  7. $G_{7}$.

An Adversary $A$ can perform the physical attacks on sensor nodes and can
retrieve the information stored into it N. Kumar . (2019), P. Kumar . (2016).

  8. $G_{8}$.

An Adversary $\mathcal{A}$ can generate bot nodes and can send the
simultaneous ping messages to the sensor node with the aim to perform DoS
attacks P. Kumar . (2016).

##  3 LEVEL-DEPENDENT AUTHENTICATION FOR GENERIC IoT (LDA-2IoT)

In this section, we put forward the proposed Level-Dependent Authentication
Scheme for Generic IoT (LDA-2IoT). We offer an LDA-2IoT between the user
device and the sensing device through the intermediary gateway node. As
earlier said, we consider the gateway device as a trusted and secure node. We
assume that the universal clock for all the devices in the system is
synchronized. The proposed vital agreement scheme consists of three phases:
system initialization phase, user registration phase, and login and key-
agreement phase. We consider the gateway as a master device, and the key-
agreement is also going to carry through the gateway device. The necessary
notations used for designing of the proposed scheme are highlighted in Table
1.

Table 1: Symbols and Notations Symbols |  Description
---|---
$R_{x}$ |  Random Number
$T_{x}$ |  Time-stamp
$l_{i}$ |  User Level
$l_{j}$ |  Sensor Level
$U_{i}$ |  User Device
$S_{j}$ |  Sensor Device
$GW$ |  Gateway Node
$SID_{j}$ |  Sensor Identity
$UID_{i}$ |  User Identity
$GWID$ |  Gateway Identity
$G_{p}$ |  Elliptic Curve Generator
$\Delta T$ |  Time-stamp Threshold
$K_{s}$ |  Gateway Node Master Secret
H(.) |  One-way Hash Function
Enc(.)/Dec(.) |  ECC Encryption/Decryption
$\bigoplus$, $||$ |  XOR and Concatenation Respectively

###  A System Initialize Phase

In this subsection, we discuss the system’s initialization phase. All steps in
the initialization phase of the system are carried out by the gateway node in
an offline manner. Thus, message generation and message communication in this
phase occur in a secure environment. The gateway device computes parameters
for the user devices and sensing devices. The gateway device decides level for
the user device based on the position of the user in an organizational
hierarchy and the level of sensing device based on its location of deployment
in the environment. It is necessary to observe that none of the devices store
their levels in any format.

####  A.1 Gateway Initialize Phase

The gateway initialize phase occurs as follow,

  * •

Generates random private key $RGWN_{k}$ from the range of 1 to n where n is
the large prime order of the elliptic curve.

  * •

Generates a gateway random master key $K_{s}$.

  * •

Computes gateway node public key as a $PUB_{GW_{k}}$ = $RGWN_{k}$ * P, where P
is the curve point.

####  A.2 User Device Initialize Phase

The user device initialize phase occurs as follow,

  * •

Generates a random private key for each $i^{t}h$ user as $RU_{i}$ from the
range of 1 to n where n is a large prime order of the curve, and i ranges from
1 to the number of users in the IoT network.

  * •

Computes public key for the user $U_{i}$ as a $PUB_{U_{i}}$ = $RU_{i}$ * P,
where P is curve point.

  * •

Generates random identity for each user $U_{i}$ as $UID_{i}$.

  * •

Computes $X_{1}$ = H($RU_{i}||UID_{i}||K_{s}$).

  * •

Computes $X_{2}$ = H($UID_{i}||PUB_{U_{i}}||K_{s}$).

  * •

Stores $X_{1}$, $X_{2}$, $RU_{i}$ in the secret memory of the user $U_{i}$.

####  A.3 Sensor Device Initialize Phase

The sensor device initialize phase occurs as follow,

  * •

Generates a random number as a private key for each sensor node $S_{j}$ called
as a $RSN_{j}$.

  * •

Computes public key for the sensing device $S_{j}$ as a $PUB_{S_{j}}$ =
$RSN_{j}$ * P, where P is the curve point.

  * •

Generates random identity for each sensor node $S_{j}$ as a $SID_{j}$.

  * •

Computes $Y_{1}$ = H($RSN_{j}||SID_{j}||K_{s}$).

  * •

Computes $Y_{2}$ = H($SID_{j}||PUB_{S_{j}}||K_{s}$).

  * •

Computes $D_{j}$ = H($l_{j}||K_{s}||SID_{j})$ where $l_{j}$ is the level of
jth sensor based on its deployment in network.

  * •

Stores $Y_{1}$, $Y_{2}$, $RSN_{j}$, $D_{j}$ in the secret memory of the
sensing device $S_{j}$.

Gateway node fly parameters $PUB_{GW_{k}}$, $PUB_{U_{i}}$, $PUB_{S_{j}}$ as a
public parameters. We like to point out that during the implementation process
of the proposed LDA-2IoT, we stored all these parameters in all the devices as
a publicizing process.

###  B User Registration Phase

In this section, we discuss the user registration process carried out in a
secured manner between user device and the gateway device. The user
registration phase follows following steps:

  1. 1.

$U_{i}$ $\xrightarrow{Request}$ $GW$: The user $U_{i}$ selects the password
$UPW_{i}$, generates the random numbers $R_{a}$, $R_{b}$, computes the
$TPW_{i}$ = H($UPW_{i}||R_{a}$) $\bigoplus$ $R_{b}$ and sends Request =
{$UID_{i}$} to the gateway $GW$.

  2. 2.

$GW$ $\xrightarrow{SmartCard}$ $U_{i}$: The gateway computes, $Reg_{i}$ =
H($UID_{i}||K_{s}$), computes $B_{i}$ = H($l_{i}||K_{s}||UID_{i})$ where
$l_{i}$ is the level of ith user based on its role in the organization and
$K_{s}$ is the gateway master secret. Generate smart card SC = {$Reg_{i}$,
$B_{i}$, H(.), $E_{p}(a,b)$} and sends to the user $U_{i}$.

  3. 3.

The user computes $L_{1}$ = $H(UID_{i})$ $\bigoplus$ $R_{a}$,
$TPW_{i}^{\prime}$ = $TPW_{i}$ $\bigoplus$ $R_{b}$, $L_{2}$ =
H($UID_{i}||TPW_{i}^{\prime}$), $Reg_{i}*$= $Reg_{i}$ $\bigoplus$ $R_{b}$,
replaces $Reg_{i}$ by $Reg_{i}*$ in SC and creates final SC = {$Reg_{i}*$,
$L_{1}$, $L_{2}$ ,$B_{i}$, H(.), $E_{p}(a,b)$}

###  C Login and Session Key Agreement Phase

In this subsection, we discuss two phases, the login phase and the session key
agreement phase in which the user device $U_{i}$ wants to access the data from
the sensing device $S_{j}$, and for that, it tries to establish a session key
with the $S_{j}$. In the login phase, the user provides $UID_{i}$, $UPW_{i}$
and SC to the Smart Card Reader (SCR), the SCR verifies all the parameter and
computes new parameters for the key agreement phase. All the steps of the
session key agreement phase perform through the public channel. In this phase,
$U_{i}$ sends a request to the $GW$. The $GW$ verifies level and other
parameters of the $U_{i}$ and prove it’s access capabilities. Later on,
through the $GW$ device, $U_{i}$ and $S_{j}$ generates a mutually
authenticated session key $SK$. The login phase and the session key agreement
consist of the following steps:

  1. 1.

$U_{i}$ $\xrightarrow{Request}$ $SCR$: The user provides $UID_{i}$ and
$UPW_{i}$ and SC to the SCR. The SCR computes $R_{a}*$ = $L_{1}$ $\bigoplus$
H($UID_{i}*$), $TPW_{i}*$ = H($UPW_{i}||R_{a}*$), $L_{2}*$ =
H($UDI_{i}||TPW_{i}*$) and verifies $L_{2}*$ = $L_{2}$. If verification gets
success, SCR allows $U_{i}$ for the further key agreement else abort the
procedure.

  2. 2.

$U_{i}$ $\xrightarrow{Message1}$ $GW$: The user device $U_{i}$ gets current
time-stamp $T_{1}$, random $r_{t}$ and computes $M_{1}$ = $Enc_{PUB_{GW_{k}}}$
($Temp_{0}$, $Pub_{U_{i}}$,$PUB_{S_{j}}$,$r_{t}$,$B_{i}$), $Temp_{0}$ =
H($X_{2}||T_{1}||r_{t}$). The $U_{i}$ sends Message 1 = {$M_{1}$,$Temp_{0}$
$T_{1}$} to $GW$.

  3. 3.

$GW$ $\xrightarrow{Message2}$ $S_{j}$: The gateway device $GW$ gets current
time-stamp $T_{1}*$ and verifies $\Delta$T $\leq$ $T_{1}*$ \- $T_{1}$. Gets
{H($X_{2}||r_{t}||T_{1}$), $r_{t}$, $Pub_{U_{i}}$,$PUB_{S_{j}}$,$B_{i}$} =
$Dec_{RGWN_{k}}$($M_{1}$), extracts valid $UID_{i}*$ for $Pub_{U_{i}}$ from
it’s secret memory and verifies
H($H(PUB_{U_{i}}||UID_{i}*||K_{s})||T_{1}||r_{t}$)$\stackrel{{\scriptstyle?}}{{=}}$
$Temp_{0}$. If yes, Move on. Get current timestamp $T_{2}$, $SID_{j}$ using
$PUB_{S_{j}}$ and computes $Temp_{1}$ =
H($PUB_{S_{j}}||H(SID_{j}||K_{s}||PUB_{S_{j}})||PUB_{GW_{k}}||T_{2}$). The
$GW$ sends Message 2 = {$Temp_{1}$,$T_{2}$} to $S_{j}$.

  4. 4.

$S_{j}$ $\xrightarrow{Message3}$ $GW$: The sensing device $S_{j}$ gets current
timestamp $T_{2}*$ and verifies $\Delta$T $\leq$ $T_{2}*$ \- $T_{2}$. Verifies
H($PUB_{S_{j}}||Y_{2}||PUB_{GW_{k}}||T_{2}$)$\stackrel{{\scriptstyle?}}{{=}}$
$Temp_{1}$. After successful verification, $S_{j}$ gets current timestamp
$T_{3}$ and computes $M_{2}$ = H($Y_{2}||T_{3}||PUB_{S_{j}}$), $M_{3}$ =
$Enc_{PUB_{GW_{k}}}$($M_{2}$, $D_{j}$). The $S_{j}$ sends Message 3 =
{$M_{3}$,$T_{3}$} to $GW$.

  5. 5.

$GW$ $\xrightarrow{Message4}$ $S_{j}$: The gateway device $GW$ gets current
timestamp $T_{3}*$ and verifies $\Delta$T $\leq$ $T_{3}*$ \- $T_{3}$. Get
{$M_{2}$, $D_{j}$} = $Dec_{RGWN_{k}}$($M_{3}$) and verifies
H($PUB_{S_{j}}||T_{3}||H(SID_{j}||K_{s}||PUB_{S_{j}})$)$\stackrel{{\scriptstyle?}}{{=}}$
$M_{2}$. Gets $l_{i}$ and $l_{j}$ from $B_{i}$ and $D_{j}$ respectively by
computing: $B_{i}*$=H($l_{i}||K_{s}||H(UID_{i})$) till $B_{i}*$
$\stackrel{{\scriptstyle?}}{{=}}$ $B_{i}$ satisfies for valid $l_{i}$ and
$D_{j}*$=H($l_{j}||K_{s}||H(SID_{j})$) till $D_{j}*$
$\stackrel{{\scriptstyle?}}{{=}}$ $D_{j}$ satisfies for valid $l_{j}$. Now the
$GW$ verifies if $l_{i}\leq l_{j}$, then continues else transmits 0 signal to
$U_{i}$, $S_{j}$ and abort the connection. The $GW$ generates random number
$r_{1}$ and gets current timestamp $T_{4}$. The $GW$ computes $M_{4}$ =
H($PUB_{U_{i}}||T_{4}||PUB_{GW_{k}}||r_{1}||H(PUB_{S_{j}}||SID_{j}||K_{s})$),
$M_{5}$ = $Enc_{PUB_{S_{j}}}$($M_{4}$, $SID_{j}$,$r_{1}$). The $GW$ sends
Message 4 = {$M_{5}$,$PUB_{U_{i}}$,$T_{4}$} to $S_{j}$.

  6. 6.

$S_{j}$ $\xrightarrow{Message5}$ $GW$: The sensing device $S_{j}$ gets current
timestamp $T_{4}*$ and verifies $\Delta$T $\leq$ $T_{4}*$ \- $T_{4}$. Gets
{$M_{4}$,$SID_{j}$,$r_{1}$} = $Dec_{RSN_{j}}$($M_{5}$) and verifies
H($PUB_{U_{i}}||T_{4}||PUB_{GW_{k}}||r_{1}||H(Y_{2})$)
$\stackrel{{\scriptstyle?}}{{=}}$ $M_{4}$. if yes, move on. The $S_{j}$
generates random number $r_{2}$, gets current timestamp $T_{5}$ and computes
$M_{6}$ = H($PUB_{S_{j}}||PUB_{GW_{k}}||PUB_{U_{i}}||r_{2}||T_{5}$), $M_{7}$ =
H($r_{1}||M_{6}||SID_{j}||PUB_{S_{j}}||T_{5}$). The $S_{j}$ sends Message 5 =
{$M_{6}$,$M_{7}$,$T_{5}$} to $GW$.

  7. 7.

$GW$ $\xrightarrow{Message6}$ $U_{i}$: The $GW$ gets current time-stamp
$T_{5}*$ and verifies $\Delta$T $\leq$ $T_{5}*$ \- $T_{5}$. The $GW$ verifies
H($r_{1}||M_{6}||SID_{j}||PUB_{S_{j}}||T_{5}$)
$\stackrel{{\scriptstyle?}}{{=}}$ $M_{7}$. If yes, Move on. The $GW$ generates
random number $r_{3}$ and gets current timestamp $T_{6}$. The $GW$ computes
$M_{8}$ = H($r_{3}||M_{6}||M_{7}||T_{6}$), $M_{9}$ =
H($SID_{j}||PUB_{S_{j}}||K_{s}$), $M_{10}$ = H($PUB_{U_{i}}||UID_{i}||K_{s}$),
$M_{11}$ = H($PUB_{U_{i}}||UID_{i}||PUB_{GW_{k}}||T_{6}$), $M_{12}$ =
H($PUB_{GW_{k}}||SID_{j}||PUB_{S_{j}}||T_{6}$), $M_{13}$ = $Enc_{PUB_{U_{i}}}$
($M_{8}$,$M_{9}$,$M_{11},r_{1},r_{2}$), $M_{14}$ = $Enc_{PUB_{S_{j}}}$
($M_{8}$,$M_{10}$,$M_{12},r_{t}$). The $GW$ sends Message 6 =
{$M_{13}$,$T_{6}$} to $U_{i}$.

  8. 8.

$GW$ $\xrightarrow{Message7}$ $S_{j}$: The $GW$ sends Message 7 =
{$M_{14}$,$T_{6}$} to $S_{j}$.

  9. 9.

The $U_{i}$ gets current timestamp $T_{6}*$ and verifies $\Delta$T $\leq$
$T_{6}*$ \- $T_{6}$. Gets {$M_{8}$,$M_{9}$,$M_{11},r_{1},r_{2}$} =
$Dec_{RU_{i}}$($M_{13}$), verifies
H($PUB_{U_{i}}||UID_{i}||PUB_{GW_{k}}||T_{6}$)
$\stackrel{{\scriptstyle?}}{{=}}$ $M_{11}$ and computes session key SK =
H($M_{8}||M_{9}||T_{6}||X_{2}||r_{1}||r_{2}||r_{t}$).

  10. 10.

The $S_{j}$ gets current timestamp $T_{6}*$ and verifies $\Delta$T $\leq$
$T_{6}*$ \- $T_{6}$. Gets {$M_{8}$,$M_{10}$,$M_{12},r_{t}$} =
$Dec_{RU_{i}}$($M_{14}$), verifies
H($PUB_{S_{j}}||SID_{j}||PUB_{GW_{k}}||T_{6}$)
$\stackrel{{\scriptstyle?}}{{=}}$ $M_{12}$ and computes session key SK =
H($M_{8}||M_{10}||T_{6}||Y_{2}||r_{1}||r_{2}||r_{t}$).

##  4 SECURITY ANALYSIS

In this section, we provide the security analysis for the proposed LDA-2IoT.
Security comparison of the proposed scheme with existing schemes shown in
Table 2.

###  A Informal Security Analysis using Dolev-Yao Channel

The Dolev-Yao channel Dolev Yao (1981) is a communication model based on snd
and rcv operations. In this subsection, we set forth the informal security
analysis for the proposed protocol based on a Dolev-Yao channel. The
polynomial time adversary $\mathcal{A}$ can access and control the Dolev-Yao
channel. In the proposed scheme, we consider that the initialize phase
implemented over the secure channel, and the gateway device is a trusted
secure device. In this subsection, we discuss how the proposed system provides
security against the most well-known attacks.

####  A.1 Anonymity and Tracebility

The anonymity for the security algorithm assures that an identity of the user
is secured against the adversary’s knowledge. In the initialize phase of the
proposed scheme, the trusted $GW$ generates an identity of the $i^{t}h$ user
as $UID_{i}$ and $j^{t}h$ sensing device as $SID_{j}$. Later on $GW$ computes
$X_{1}$ = H($RU_{i}||UID_{i}||K_{s}$) and $X_{2}$ =
H($UID_{i}||PUB_{U_{i}}||K_{s}$) for each $U_{i}$. During the login and key-
exchange phase, user communicates message $M_{1}$ =
$Enc_{PUB_{GW_{k}}}$(H($X_{2}||T_{1}$), $r_{t}$, $Pub_{U_{i}}$, $PUB_{S_{j}}$,
$B_{i}$) which is secured through the public-key of gateway. Now, let us
assume that an adversary $\mathcal{A}$ intercepts other messages $Temp_{1}$ =
H($PUB_{S_{j}}||SID_{j}||PUB_{GW_{k}}||T_{2}$), $M_{3}$ =
$Enc_{PUB_{GW_{k}}}$($M_{2}$, $D_{j}$), $M_{5}$ =
$Enc_{PUB_{S_{j}}}$($M_{4}$,$r_{1}$), $M_{6}$ =
H($PUB_{S_{j}}||PUB_{GW_{k}}||PUB_{U_{i}}||r_{2}||T_{5}$), $M_{7}$ =
H($r_{1}||M_{6}||SID_{j}||PUB_{S_{j}}||T_{5}$), $M_{13}$ = $Enc_{PUB_{U_{i}}}$
($M_{8}$,$M_{9}$,$M_{11}$). All the intercepted messages are either protected
through the one-way hash function H(.) or the encryption. Thus, no
vulnerability exists which helps an adversary $\mathcal{A}$ to achieve the
$UID_{i}$. In many realtime application, it is expected that an adversary
$\mathcal{A}$ must not be able to trace the user and messages communicated by
him/her. The $\mathcal{A}$ can trace $U_{i}$ if and only if an identity of the
$U_{i}$ is revealed. Thus, the proposed LDA-2IoT scheme achieves anonymity and
tracebility.

####  A.2 Achieves Mutual Authentication and Session Key Agreement

The mutual authentication property assures each party that the message is
received from the valid source. After receiving of the first message from
$U_{i}$, the $GW$ device retrieves it’s identity and performs verification of
H(H($PUB_{U_{i}}||UID_{i}||K_{s})||T_{1}||r_{t}$)
$\stackrel{{\scriptstyle?}}{{=}}$H($H(PUB_{U_{i}}||UID_{i}*||K_{s})||T_{1}||r_{t}$).
Any adversary $\mathcal{A}$ uses $PUB_{U_{i}}$ to prove himself/herself as a
valid user, $\mathcal{A}$ does not get success due to presence of parameters
like $X_{2}$ and $K_{s}$ in the verification which are not available with
$\mathcal{A}$. Similarly, verification
H($PUB_{S_{j}}||T_{3}||H(SID_{j}||K_{s}||PUB_{S_{j}})$)
$\stackrel{{\scriptstyle?}}{{=}}$ $M_{2}$ assure about the authenticity of
$S_{j}$ to the $GW$. The verification
H($PUB_{S_{j}}||SID_{j}||PUB_{GW_{k}}||T_{2}$)
$\stackrel{{\scriptstyle?}}{{=}}$ $Temp_{1}$ helps sensing device $S_{j}$ to
authenticate the $GW$ and the verification
H($PUB_{U_{i}}||UID_{i}||PUB_{GW_{k}}||T_{6}$)
$\stackrel{{\scriptstyle?}}{{=}}$ $M_{11}$ helps $U_{i}$ to authenticate the
$GW$. The computed session key SK =
H($M_{8}||M_{9}||T_{6}||X_{2}||r_{1}||r_{2}||r_{t}$) also includes identities
of each entity in indirect manner thus the proposed LDA-2IoT protocol achieves
mutual authentication and session key agreement.

####  A.3 Secure against Replay Attack

In the replay attack, an adversary $\mathcal{A}$ replays previously
communicated messages after some time or in the next session. To provide
security against the replay attack, we use random parameters and timestamps in
the proposed scheme. Each communicated message contains time-stamp $T_{i}$
which is validated by the receiving entity through $\Delta$T $\leq$ $T_{i}*$
\- $T_{i}$ verification where $T_{i}*$ is the current time at receiver side
and $\Delta$T predefined maximum threshold time. Even though $\mathcal{A}$
replays any message, the LDA-2IoT receiver will catch that the received
message is replayed. Thus, the proposed LDA-2IoT scheme is secure against the
replay attack.

####  A.4 Secure against User/Sensor Level Side Channel Attack

In this paper, we propose a LDA-2IoT which reduces numerous user registrations
and achieves hierarchical security. The level $l_{i}$ defines the level of
user $U_{i}$ in the hierarchy and $l_{j}$ defines the level of sensing device
$S_{j}$ in the deployment. If an adversary $\mathcal{A}$ gets the level
$l_{i}$ then he/she can guess the role of $U_{i}$ in the organization,
similarly if $l_{j}$ is available to the $\mathcal{A}$ then he/she can guess
the sensing device deployment location. Thus, it is important to secure
$l_{i}$ and $l_{j}$. In the proposed LDA-2IoT, none of the entity (not even
$GW$) stores $l_{i}$ and $l_{j}$. The $U_{i}$ stores $l_{i}$ in parameter
$B_{i}$ = H($l_{i}||K_{s}||H(PUB_{U_{i}}))$ and the $S_{j}$ stores $l_{j}$ in
parameter $D_{j}$ = H($l_{j}||K_{s}||H(PUB_{RSN_{j}}))$ which are protected by
one-way hash function and the gateway master $K_{s}$. Hence, the proposed
LDA-2IoT scheme is secured against a level side channel attack.

####  A.5 Key Establishment with Perfect Forward Secrecy

In perfect forward secrecy, we assume that the adversary $\mathcal{A}$ somehow
obtains the user secret key $RU_{i}$ and sensing device secret key $RSN_{j}$,
then the adversary $\mathcal{A}$ can retrieve the {$M_{4}$,$r_{1}$} from the
message $M_{5}$ through the knowledge of $RSN_{j}$. The hash function protects
the message $M_{4}$, and $r_{1}$ is an unknown random number that does not
provide any useful information. Similarly, through the $RU_{i}$, an adversary
$\mathcal{A}$ can obtain the {$M_{8}$,$M_{10}$,$M_{12}$}. These all the
parameters are secured through the one-way hash function and do not provide
any useful information. The session key computed using SK =
H($M_{8}||M_{9}||T_{6}||X_{2}||r_{1}||r_{2}||r_{t}$) where parameter $X_{2}$
is not available to $\mathcal{A}$ and $\mathcal{A}$ can not get $X_{2}$ or
$Y_{2}$ by just knowing a $RU_{i}$ and $RSN_{j}$. We assume that the user
device’s physical capturing and the user’s secret key relieve will not
coincide, and this assumption is valid because one is a physical attack while
the other is a guessing attack. Thus the proposed LDA-2IoT scheme achieves the
perfect forward secrecy.

####  A.6 Gateway Device Bypass Attack

In the gateway device bypass attack, an adversary $\mathcal{A}$ tries to
behave as a $GW$ or any one of the device $U_{i}$ or $S_{j}$ try to behave as
a $GW$. In the proposed scheme, during the initialize phase, the $GW$ computes
$X_{1}$ = H($RU_{i}||UID_{i}||K_{s}$), $X_{2}$ =
H($UID_{i}||PUB_{U_{i}}||K_{s}$) and $B_{1}$ =
H($l_{i}||K_{s}||H(PUB_{U_{i}}))$ for $U_{i}$ while $Y_{1}$ =
H($RSN_{j}||SID_{j}||K_{s}$), $Y_{2}$ = H($SID_{j}||PUB_{S_{j}}||K_{s}$),
$D_{j}$ = H($l_{j}||K_{s}||H(PUB_{RSN_{j}}))$ for $S_{j}$. All these
computation involves gateway master secret $K_{s}$. Thus, neither
$\mathcal{A}$ nor the $U_{i}$ or $S_{j}$ can compute the above parameters.
Hence, the proposed LDA-2IoT scheme is secured against gateway device bypass
attack.

####  A.7 Stolen User Device Attack

In this attack, an adversary $\mathcal{A}$ gets physical user device and
retrieves stored parameters {$X_{1}$,$X_{2}$,$B_{1}$,$RU_{i}$}. Now the
session key is computed as SK =
H($M_{8}||M_{9}||T_{6}||X_{2}||r_{1}||r_{2}||r_{t}$) where $r_{1}$, $r_{2}$
and $r_{t}$ are the random parameters. If an adversary $\mathcal{A}$ gets the
user secret $RU_{i}$ then also he can not guess random $r_{t}$. By capturing
the user device, an adversary $\mathcal{A}$ can not capture the user identity
also. Thus, it is computationally nonfeasible for an adversary to compute the
session key $SK$ in polynomial time.

####  A.8 Sensing Device Capture Attack

In this attack, an adversary $\mathcal{A}$ gets the physical user device and
gets stored parameters {$Y_{1}$,$Y_{2}$,$D_{1}$,$RSN_{j}$}. Now if an
adversary $\mathcal{A}$ tries to compute the session key SK =
H($M_{8}||M_{10}||T_{6}||Y_{2}||r_{1}||r_{2}||r_{t}$) then it requires three
random numbers $r_{1}$,$r_{2}$ and $r_{t}$ as well as the timestamp $T_{6}$.
Thus, even though an adversary $\mathcal{A}$ physically attacks the sensing
device as well as track the messages, he can not obtain the $r_{1}$ and
$r_{t}$ from it. The sensing device does not store the sensing device
identity; thus, through the sensing device attack, $\mathcal{A}$ can not track
the sensing device also; thus the proposed scheme is secured against the
sensing device capture attack.

####  A.9 User Device Impersonation Attack

In this attack, an adversary $\mathcal{A}$ intercepts all the messages send by
user $U_{i}$ and tries to replace those messages by other manually generated
messages. Let $\mathcal{A}$ intercepts Message 1 = {$M_{1}$,$Temp_{0}$
$T_{1}$}. The $M_{1}$ is secured through an encryption while $Temp_{0}$ is
secured through the hash function, still let us assume that $\mathcal{A}$
creates Message 1* = {$M_{1}*$,$Temp_{0}*$ $T_{1}$} and forwards it to
gateway. Now the gateway device $GW$ extracts data from the message $M_{1}$*
and performs the verification
H($H(PUB_{U_{i}}||UID_{i}*||K_{s})||T_{1}||r_{t}$)
$\stackrel{{\scriptstyle?}}{{=}}$ $Temp_{0}$ which contains the fresh random
number generated by $U_{i}$ and the gateway master secret $K_{s}$ which is
computationally unfeasible to generate same $K_{s}*$ = $K_{s}$ in a polynomial
time for an adversary $\mathcal{A}$.

Table 2: Security Comparison

Scheme |  $S_{1}$ |  $S_{2}$ |  $S_{3}$ |  $S_{4}$ |  $S_{5}$ |  $S_{6}$ |  $S_{7}$ |  $S_{8}$ |  $S_{9}$ |  $S_{10}$ |  $S_{11}$
---|---|---|---|---|---|---|---|---|---|---|---
Farash . (2016) |  ✓ |  ✓ |  ✓ |  ✗ |  ✓ |  ✓ |  ✓ |  ✗ |  ✓ |  ✓ |  ✗
Wazid, Das, Odelu, Kumar, Conti Jo (2018) |  ✓ |  ✓ |  ✓ |  ✗ |  ✓ |  ✓ |  ✗ |  ✓ |  ✓ |  ✗ |  ✗
Zhou . (2019) |  ✓ |  ✓ |  ✓ |  ✗ |  ✓ |  ✓ |  ✓ |  ✓ |  ✗ |  ✓ |  ✗
Shin Kwon (2020) |  ✓ |  ✗ |  ✓ |  ✓ |  ✓ |  ✗ |  ✓ |  ✓ |  ✗ |  ✓ |  ✗
Jangirala . (2020) |  ✓ |  ✓ |  ✗ |  ✓ |  ✓ |  ✓ |  ✗ |  ✓ |  ✓ |  ✗ |  ✗
LDA-2IoT |  ✓ |  ✓ |  ✓ |  ✓ |  ✓ |  ✓ |  ✓ |  ✓ |  ✓ |  ✓ |  ✓

  * •

Legends: $S_{1}$: Tracebility, $S_{2}$: Anonymity, $S_{3}$: Mutual
authentication and Integrity, $S_{4}$: Replay attack , $S_{5}$: Man-in-The-
Middle Attack, $S_{6}$: Forward secrecy, $S_{7}$: Gateway by pass attack,
$S_{8}$: Gateway impersonation attack , $S_{9}$: Sensing device capture
attack, $S_{10}$: Privilege insider attack, $S_{11}$: Level Dependent
Authentication, ✓: the protocol supports this feature, ✗: the protocol doesn’t
support this feature.

####  A.10 Sensing Device Impersonation Attack

In this attack, an adversary $\mathcal{A}$ intercepts all the messages send by
the sensing device $S_{j}$ to the gateway device $GW$. Let $\mathcal{A}$
intercepts Message 3 = {$M_{3}$,$T_{3}$} and Message 5 =
{$M_{6}$,$M_{7}$,$T_{5}$} and try to replace these messages by Message 3* =
{$M_{3}*$,$T_{3}$} and Message 5* = {$M_{6}*$,$M_{7}*$,$T_{5}$}. The message
$M_{3}$ = $Enc_{PUB_{GW_{k}}}$($M_{2}$, $D_{j}$) is encrypted through the
public-key of $GW$. At the other side after receiving this message, $GW$
performs H($PUB_{S_{j}}||T_{3}||H(SID_{j}||K_{s}||PUB_{S_{j}})$)
$\stackrel{{\scriptstyle?}}{{=}}$ $M_{2}$ which includes secure sensor
identity $SID_{j}$ and master secret $K_{s}$. Thus, it is infeasible to
generate a Message 3* which is similar to Message 3. Thus, the proposed
LDA-2IoT scheme is secured against a sensing device impersonation attack.

####  A.11 Gateway Device Impersonation Attack

In this attack, an adversary $\mathcal{A}$ intercepts all the messages send by
the gateway device $GW$ and trie to impersonate as a gateway device. Now let
an adversary $\mathcal{A}$ captures Message 2 = {$Temp_{1}$,$T_{2}$} , Message
4 = {$M_{5}$,$PUB_{U_{i}}$,$T_{4}$} , Message 6 = {$M_{13}$,$T_{6}$} and
generates new messages Message 2* = {$Temp_{1}*$,$T_{2}$} , Message 4* =
{$M_{5}*$,$PUB_{U_{i}}$,$T_{4}$} , Message 6* = {$M_{13}*$,$T_{6}$} and
forwards Message 2* and Message 4* to sensing device $S_{j}$ and Message 6* to
user device $U_{i}$. Now the message $Temp_{1}$ =
H($PUB_{S_{j}}||H(SID_{j}||K_{s}||PUB_{S_{j}})||PUB_{GW_{k}}||T_{2}$) includes
the gateway master secret $K_{s}$ and $SID_{j}$. The $M_{5}$ =
$Enc_{PUB_{S_{j}}}$($M_{4}$, $SID_{j}$,$r_{1}$) and $M_{13}$ =
$Enc_{PUB_{U_{i}}}$ ($M_{8}$,$M_{9}$,$M_{11},r_{1},r_{2}$) are encrypted by
the sensing device secret and the user device secret respectively. Thus it is
infeasible to get these both the secrets in polynomial time for an adversary
$\mathcal{A}$. Hence, the proposed LDA-2IoT scheme is secured against the
gateway device impersonation attack.

###  B Formal Security Proof Using Random Oracle

In this section, we perform the formal security analysis for the proposed
scheme using a widely accepted and proved secure random oracle based model
proposed by Abdalla et al. Abdalla . (2005). The authors in Abdalla . (2005)
proposed the Real-Or-Random (ROR) model, which helps security designers to
prove that the proposed scheme achieves polynomial-time security against an
adversary $\mathcal{A}$’s advantage of breaking the security. A similar
security model is also used in Roy . (2018); Das . (2018).

  1. a.

Random Oracle: The random oracle defined as a H(.) also called as a hash
function which takes message $m_{i}$ as a input and computes the one-way
irreversible output $r_{i}$ Wazid, Das, Odelu, Kumar, Conti Jo (2018); Wazid,
Das, Odelu, Kumar Susilo (2018). Whenever an adversary $\mathcal{A}$ generates
a challenge with $m_{i}$, random oracle challenger $\mathcal{C}$ computes
$r_{i}$ = H($m_{i}$) and stores it in the list L initialized with NULL value
as a pair of ($m_{i}$, $r_{i}$).

  2. b.

Oracle Participants: There are three participants in the proposed LDA-2IoT
scheme, The user $U_{i}$, the gateway device $GW$, and the sensing device
$S_{j}$.

  3. c.

Oracles: ${\chi^{p}_{U_{i}}}$, ${\chi^{q}_{GW}}$, and ${\chi^{r}_{S_{j}}}$ are
oracles with the instances $p$, $q$ and $r$ for the $U_{i}$, $GW$ and $S_{j}$
respectively, which are also called as a participants for the protocol
$LDA-P$.

  4. d.

Oracle Freshness If using the reveal query $\mathcal{R}$($\chi^{x}$), an
adversary $\mathcal{A}$ does not get success in receiving original session key
$\mathcal{SK}$ then the oracles, ${\chi^{p}_{U_{i}}}$, ${\chi^{q}_{GW}}$, and
${\chi^{r}_{S_{j}}}$ are considered as a fresh oracles.

  5. e.

Oracles Partnering: Oracle instances ${\chi^{x}}$ and ${\chi^{y}}$ are called
partner oracles if and only if they fulfill the following criteria
simultaneously:

     * •

Both instances ${\chi^{x}}$ and ${\chi^{y}}$ are in the acceptance state.

     * •

Both ${\chi^{x}}$ and ${\chi^{y}}$ share the common session id $sid$ and
achieve the mutual authentication. ”$sid$” is transcript of all the
communicated messages between oracles.

     * •

Both ${\chi^{x}}$ and ${\chi^{y}}$ satisfy the partner identification and
vice-versa.

     * •

No instance other than ${\chi^{x}}$ and ${\chi^{y}}$ accept with the partner
identification equal to ${\chi^{x}}$ and ${\chi^{y}}$.

  6. f.

Adversary: Let us assume that an adversary $\mathcal{A}$ is an eavesdropper
who controls the complete communication channel defined over the Dolev-Yao
model Dolev Yao (1981). An adversary $\mathcal{A}$ can read, modify, inject,
or fabricate the messages on the communication channel for the proposed
network model. An adversary $\mathcal{A}$ has access for the following random
oracle queries, which gives numerous capabilities to $\mathcal{A}$ for
capturing and modifying the communicated messages and data.

    1. 1.

$\mathcal{R}$ ($\chi^{x}$) The Reveal query $\mathcal{R}$ provides current
session key SK to the adversary $\mathcal{A}$ which is created by oracle
instance $\chi^{x}$ and it’s partnering instance.

    2. 2.

$\mathcal{E}$ ($\chi^{x}$,$\chi^{y}$) The Execute query is formed as a passive
attack on the communication between oracle participants $\chi^{x}$ and
$\chi^{y}$. This query provides all communicated messages to the adversary
$\mathcal{A}$.

    3. 3.

$\mathcal{S}$ ($\chi^{x}$,$m_{i}$) The Send query is formed as an active
attack performed by $\mathcal{A}$ on instance $\chi^{x}$ where $\chi^{x}$ can
receive the message $m_{i}$ as well as send the reply as a message $m_{i}$ to
$\mathcal{A}$.

    4. 4.

CorruptUserDevice($\chi^{x}$) The CorruptUserDevice query models that the user
$U_{i}$’s device is available with $\mathcal{A}$ and $\mathcal{A}$ can capture
all the data stored in it.

    5. 5.

CorruptSensingDevice ($\chi^{y}$) The CorruptSensingDevice query models that
the sensing device $S_{j}$ is available with $\mathcal{A}$ and $\mathcal{A}$
can capture all the data stored in it using power analysis or reverse
engineering attack Messerges . (1999); Kocher . (1999).

    6. 6.

CorruptUserLevel ($\chi^{x}$) The CorruptUserLevel query models that the level
of user $U_{i}$ is available with an adversary $\mathcal{A}$.

    7. 7.

CorruptSensingLevel ($\chi^{y}$) The CorruptSensingLevel query models that the
level of sensing device $S_{j}$ is available with an adversary $\mathcal{A}$.

    8. 8.

$\mathcal{T}$ ($\chi^{x}$) Before starting of this oracle game, an unbiased
coin b get tossed. The output of this toss decides the return value for the
Test query $\mathcal{T}$. If the recently generated session key between the
user $U_{i}$ and the sensing device $S_{j}$ is $SK$ and an adversary
$\mathcal{A}$ performs the test query on an instance $\chi^{p}$ which is the
instance of $U_{i}$ or its partner instance $\chi^{r}$ which is an instance of
$S_{j}$ than if the toss output is b = 1 than the participant instance
$\chi^{x}$ returns an original session key. In contrast, if the output is b =
0, then the $\chi^{x}$ returns a random value of the session key $SK$’s size
to an adversary $\mathcal{A}$. If none of the condition matches, then an
instance $\chi^{x}$ returns NULL. The semantic security of the session key is
designed based on the Test query.

  7. g.

Session key symmetric security: The semantic security of the session key $SK$
generated between the user $U_{i}$ and the sensing device $S_{j}$ depends on
an adversary $\mathcal{A}^{\prime}s$ capability of indistinguishability
between the actual session key and the random number. The output of a test
query $\mathcal{T}$ depends on the value of b’ guessed by an adversary
$\mathcal{A}$. If the value of b’ is similar to the value of b which is a
hidden bit set by an oracle instance $\chi^{x}$ and used by
$\mathcal{T}(\chi^{x})$ to retrieve the original session key. Overall, the
game depends on the correct guess by $\mathcal{A}$ for the bit b. If an
adversary guesses the correct value of b, then it gets the correct session
key.

Let $\mathcal{SC}$ define the position in which an adversary gets the success
in this game. The advantage of an adversary $\mathcal{A}$ in capturing the
correct session key $SK$ for the proposed protocol $LDA_{P}$ is defined as a
$Adv^{LDA}_{p}$. $Adv^{LDA}_{p}$ represents the success of an adversary, and
if the $Adv^{LDA}_{p}$ is negligible, then we can say that the proposed scheme
is secured under the ROR model. Thus, we can define $Adv^{LDA}_{p}$ as
$Adv^{LDA}_{p}$($\mathcal{A}$) = 2*Pr[$\mathcal{SC}$] - 1 which is similar to
$Adv^{LDA}_{p}$($\mathcal{A}$) = 2*Pr[b’= b] - 1. Where Pr[$\mathcal{SC}$]
represents the probability for the success of an adversary $\mathcal{A}$. If
we can prove that the $Adv^{LDA}_{p}$ is negligible under the proposed scheme
$LDA_{P}$, then we can say that the proposed scheme is secure.

Semantic Security for the Password based protocol: The semantic security for
the password based protocol $LDA-P_{pw}$ defines an adversary $\mathcal{A}$’s
capability of guessing the correct password. A password based protocol $LDA-
P_{pw}$ is semantically secure if the advantage function $Adv_{LDA-P_{pw}}$ is
negligible under the condition: $Adv_{LDA-
P_{pw},|\mathcal{D}|}$($\mathcal{A}$) $\geq$ max($q_{s}$,
($\frac{1}{|\mathcal{DS}|}$, $\rho_{fp}$)). In this equation, $q_{s}$
represents the number of send queries($\mathbfcal{S}$), $|\mathcal{DS}|$ shows
the finite size of the password dictionary, $\rho_{fp}$ shows probability of
the false positive occurrence by an adversary $\mathcal{A}$ Wazid, Das, Odelu,
Kumar, Conti Jo (2018); Wazid, Das, Odelu, Kumar Susilo (2018).

Security Proof: We use security model discussed above for to prove formal
security of the proposed scheme. Authors in Wazid, Das, Odelu, Kumar Susilo
(2018); Wazid, Das, Odelu, Kumar, Conti Jo (2018); Das . (2018) also provided
formal proof using random oracle for their schemes.

######  Theorem 1.

If $\mathcal{A}$ is a polynomial time attacker running against the proposed
protocol $LDA-P$ within a limited time $t$. Let $q_{h}$ determines the range
space of hash ($\mathcal{H}$) queries, $q_{s}$ denotes the number of send
($\mathcal{S}$) queries, $q_{e}$ represents the number of execute
($\mathcal{E}$) query, the uniformly distributed password dictionary is
defined as DC either against the user $U_{i}$ or the sensing device $S_{j}$
and $Adv_{\rho}^{ECDLP}$ defines the advantage of $\mathcal{A}$ of breaking
the discrete logarithm problem of $\mathcal{A}$ then we can say that the
proposed protocol is secured if,

$\begin{split}\textit{$Adv^{LDA}_{p}$}(\mathcal{A})\leq\frac{q^{2}_{h}}{2^{l_{h}}}+max(q_{s},(\frac{1}{|\mathcal{DC}|},\rho_{fp}))\\\
+Adv_{\rho}^{ECDLP}+(\frac{1}{2^{l_{j}}})\end{split}$ (2)

In equation 2, $l_{h}$ is the size of the return value of a hash
($\mathcal{H}$) query generated by an adversary $\mathcal{A}$ in bits, $l_{r}$
is the size of the random nonce generated by the protocol $LDA-P$.
$|\mathcal{DC}|$ shows the finite size of a password dictionary, and
$\rho_{fp}$ shows the probability of a false positive occurrence by
$\mathcal{A}$.

###### Proof.

The proposed protocol is secured if the $Adv^{LDA}_{p}$($\mathcal{A}$) is
negligible using the ROR model. Similar proof is also discussed in Wazid, Das,
Odelu, Kumar Susilo (2018); Wazid, Das, Odelu, Kumar, Conti Jo (2018); Das .
(2018). We define five games, say $Gm_{0}$, to $Gm_{4}$ to prove the security
of the proposed scheme. Now, let us define an event $SC_{i}$ which represents
the correct guess for the bit $b$ in each game $Gm_{i}$ via the test query
$\mathcal{T}$ by an adversary $\mathcal{A}$. ∎

$Gm_{0}$: The first game $Gm_{0}$ is the original security game which is
corresponding to an original attack performed by an adversary $\mathcal{A}$ on
the LDA-P. At the beginning of the game, adversary $\mathcal{A}$ chooses bit
$b$. Hence it follows that,

$\textit{$Adv^{LDA}_{p}$}(\mathcal{A})=2*Pr[\mathcal{SC}_{0}]-1.$ (3)

$Gm_{1}$: The $Gm_{1}$ is modelled as a passive attack in which $\mathcal{A}$
performs execute query $\mathcal{E}$(${\chi^{p}_{U_{i}}}$, ${\chi^{q}_{GW}}$,
${\chi^{r}_{S_{j}}}$) and captures all communicated messages (Message 1 to
Message 7). Based on all these messages $\mathcal{A}$ tries to determine the
session key $SK$ and after completion of the game $\mathcal{A}$ performs a
test query $\mathcal{T}$. The output of $\mathcal{T}$ determines weather it is
veritable session key or the random number. The session key is computed by the
user $U_{i}$ and the sensing device $S_{j}$ as SK =
H($M_{8}||M_{9}||T_{6}||X_{2}||r_{1}||r_{2}||r_{t}$) and SK =
H($M_{8}||M_{10}||T_{6}||Y_{2}||r_{1}||r_{2}||r_{t}$) respectively. The
session key computation involves $M_{8}$, $M_{9}$, $M_{10}$ and random numbers
which are secured through the $RU_{i}$ and $RSN_{j}$. Since, interception of
the messages Message 1 to Message 7 does not lead to compromise of the session
key $SK$ or any other secret credentials. Thus, the winning probability of the
adversary $\mathcal{A}$ does not increase in $Gm_{1}$.

$Pr[\mathcal{SC}_{0}]=Pr[\mathcal{SC}_{1}].$ (4)

$Gm_{2}$: The $Gm_{2}$ involves two more queries in the $Gm_{1}$. The $Gm_{2}$
executes Send query and Hash H(.) through which an adversary $\mathcal{A}$
communicates with the user $U_{i}$ and the sensor $S_{j}$. Through the several
H(.) queries, $\mathcal{A}$ verifies hash digest. Thus, $Gm_{2}$ is an active
attack in which $\mathcal{A}$ tries to convince the $U_{i}$ and $S_{j}$ to
accept the forged messages. The messages $M_{8}$ =
H($r_{3}||M_{6}||M_{7}||T_{6}$), $M_{9}$ = H($SID_{j}||PUB_{S_{j}}||K_{s}$),
$M_{10}$ = H($PUB_{U_{i}}||UID_{i}||K_{s}$), $M_{11}$ =
H($PUB_{U_{i}}||UID_{i}||PUB_{GW_{k}}||T_{6}$), $M_{12}$ =
H($PUB_{GW_{k}}||SID_{j}||PUB_{S_{j}}||T_{6}$) involves throughout the use of
random numbers, time-stamps, sensing device identity, gateway master secret,
user identity which will not provide any success to an adversary $\mathcal{A}$
in collusion verification of the generated message digest. Thus, through the
birthday paradox, it follows that,

$Pr[\mathcal{SC}_{1}]-Pr[\mathcal{SC}_{2}]\leq\frac{q^{2}_{h}}{2^{l_{h}}}.$
(5)

$Gm_{3}$: The $Gm_{3}$ translated from $Gm_{2}$. The $Gm_{3}$ performs all the
Corrupt queries. Through the query CorruptUserDevice, an adversary
$\mathcal{A}$ receives all the stored parameters like $X_{1}$, $X_{2}$,
$K_{1}$, $B_{1}$ and the other curve parameters. Now, $\mathcal{A}$ tries to
guess the correct user ID and password PW for the user $U_{i}$ through the
dictionary attack. To guess the correct password, $\mathcal{A}$ needs $TPW$
and $R_{a}$ to validate the TPW* = H($UPW_{i}*||R_{a}*$). The value of $R_{a}$
is random value and it’s correct guess depends on the correct guess for an
identity $UID_{i}$. Thus, due to these limitations for the Send query access
in a polynomial time, it is infeasible to guess the correct pair of
($UID_{i}$, $UPW_{i}$) in a polynomial time. In similar way, Thus we obtain
that,

$Pr[\mathcal{SC}_{3}]-Pr[\mathcal{SC}_{2}]\leq
max(q_{s},(\frac{1}{|\mathcal{DS}|},\rho_{fp}))$ (6)

$Gm_{4}$: The $Gm_{4}$ is translated from the $Gm_{3}$. In this game an
adversary $\mathcal{A}$ performs CorruptUserLevel($\chi^{x}$),
CorruptSensingLevel($\chi^{y}$), CorruptSensingDevice. Through these queries,
$\mathcal{A}$ tries to get the level of the user device or the sensor device.
Now, let us assume that the probability of guessing the correct level is
$\frac{1}{2^{l_{j}}}$ where $2^{l_{j}}$ represents the number of bits used for
the level. Thus, after guessing the level of user device or sensing device,
$\mathcal{A}$ tries to validate it’s guess. To validate the user level
$l_{i}$, an adversary $\mathcal{A}$ requires $B_{i}$ =
H($l_{i}||K_{s}||UID_{i})$ and to validate the sensing device level $l_{j}$,
an adversary $\mathcal{A}$ needs $D_{j}$ = H($l_{j}||K_{s}||SID_{j})$. To get
these parameters, $\mathcal{A}$ must need the secret key of the user device
($RU_{i}$) or sensing device ($RSN_{j}$) which is computationally infeasible
for an adversary to get in polynomial time as per Definition
LABEL:Definition:Def-2. Thus, we have,

$Pr[\mathcal{SC}_{4}]-Pr[\mathcal{SC}_{3}]\leq\frac{1}{2^{l_{j}}}+Adv_{\rho}^{ECDLP}$
(7)

Now, after completion of all the games, $\mathcal{A}$ doesn’t get success. Now
$\mathcal{A}$ have only one option left in which $\mathcal{A}$ try to guess
the correct value of bit ”b” and perform the $\mathcal{T}$ query. The success
probability of this query is $\frac{1}{2}$. So after all the games, it is
clear that,

$Pr[\mathcal{SC}_{4}]=\frac{1}{2}$ (8)

Now, from equation 3, we get $\frac{1}{2}$*$Adv_{LDA-P}$ = [Pr[$SC_{0}$] -
$\frac{1}{2}$]. So by using the triangular inequality, we can get the
following [Pr[$\mathcal{SC}_{1}]$ \- [Pr[$\mathcal{SC}_{4}]$ $\leq$
[Pr[$\mathcal{SC}_{1}]$ \- [Pr[$\mathcal{SC}_{2}]$ \+ [Pr[$\mathcal{SC}_{2}]$
\- [Pr[$\mathcal{SC}_{4}]$ $\leq$ [Pr[$\mathcal{SC}_{1}]$ \-
[Pr[$\mathcal{SC}_{2}]$ \+ [Pr[$\mathcal{SC}_{2}]$ \- [Pr[$\mathcal{SC}_{3}]$
$\leq$ $\frac{q^{2}_{h}}{2^{l_{h}}}$ \+ max($q_{s}$,
($\frac{1}{|\mathcal{DC}|}$, $\rho_{fp}$)) + ($Adv_{\rho}^{ECDLP}$) +
($\frac{1}{2^{l_{j}}}$). Using equations 6-8,

$\begin{split}|Pr[\mathcal{SC}_{0}]-\frac{1}{2}|\leq\frac{q^{2}_{h}}{2^{l_{h}}}+max(q_{s},(\frac{1}{|\mathcal{DC}|},\rho_{fp}))\\\
+Adv_{\rho}^{ECDLP}+(\frac{1}{2^{l_{j}}})\end{split}$ (9)

So finally, from the equation 3 and 9, we can derive,

$\begin{split}\textit{$Adv_{LDA-P}$}(\mathcal{A})\leq\frac{q^{2}_{h}}{2^{l_{h}}}+max(q_{s},(\frac{1}{|\mathcal{DC}|},\rho_{fp}))\\\
+Adv_{\rho}^{ECDLP}+(\frac{1}{2^{l_{j}}})\end{split}$ (10)

##  5 PERFORMANCE ANALYSIS AND COMPARISON

In this section, we examine and collate the performance of the proposed
LDA-2IoT based on communication cost, computation cost, energy consumption,
round trip delay and the throughput.

###  A Communication Cost

The communication cost defines the total number of bits transmitted on the
public channel. During the implementation of the proposed LDA-2IoT, we used a
python-based programming approach. Table 3 shows the total number of bits
communicated in the cited schemes over the public channel. The computation of
the communication cost is done as follows: to compute the communication cost,
we brought the output size for each parameter in the unit of ”bits” using
python. In our implementation, the size of the generated identity and password
is 160 bits. We used SHA-256 as a hash function; thus, the size of the hash
output is 256 bits. The timestamp size is 32 bits, and the size of the
generated random number is 128 bits. Table 3 summarizes communication cost
comparison between the proposed scheme and other existing scheme.

Table 3: Communication Costs Comparison in bits Scheme |  User |  Gateway |  Sensor |  Total Cost
---|---|---|---|---
Farash . (2016) |  632 |  792 |  2048 |  3472
Wazid, Das, Odelu, Kumar, Conti Jo (2018) |  736 |  1344 |  512 |  2592
Zhou . (2019) |  832 |  2048 |  672 |  3552
Shin Kwon (2020) |  1158 |  1560 |  678 |  3552
Jangirala . (2020) |  1012 |  1127 |  517 |  2656
LDA-2IoT |  512 |  1344 |  704 |  2560

###  B Computation Cost

The computation cost highlights the number of cryptographic operations used in
the proposed scheme during the login and authentication stage. It also gives
the total time required by those operations at each participant’s devices. Let
$T_{h}$, $T_{E}$/$T_{D}$, $T_{P}$ and $T_{fe}$ represent the computation cost
of one-way hash function H(.), ECC encryption/decryption operation, ECC Point
multiplication and fuzzy extractor respectively. We do not consider the
computation of bitwise XOR operation because it takes very little time (almost
0 ms) compare to other operations. Though we implemented the proposed protocol
in realtime, we use the self-observations to compute the computation cost for
the proposed LDA scheme and other existing schemes. During our implementation,
we observe that,

  * •

For user device, $T_{E}$/$T_{D}$ operation takes 0.07083 seconds, $T_{h}$
operation takes 0.00041 seconds, the $T_{P}$ operation takes 0.0607 seconds
and $T_{fe}$ operation takes 0.0503 seconds.

  * •

For sensing device, $T_{E}$/$T_{D}$ operation takes 0.08883 seconds, $T_{h}$
operation takes 0.00084 seconds and the $T_{P}$ operation takes 0.0703
seconds.

  * •

For gateway device, $T_{E}$/$T_{D}$ operation takes 0.06783 seconds, $T_{h}$
operation takes 0.00034 seconds and the $T_{P}$ operation takes 0.0589
seconds.

Above all the costs are an average of 100 times verified outputs. Table 4
summarizes computation cost comparison between the proposed scheme and other
existing scheme.

Table 4: Computation Costs Comparison

Scheme |  User |  Gateway |  Sensor |  Time(ms)
---|---|---|---|---
Farash . (2016) |  11*$T_{h}$ |  14*$T_{h}$ |  7*$T_{h}$ |  10.4341
Wazid, Das, Odelu, Kumar, Conti Jo (2018) |  $T_{fe}$ \+ 13*$T_{h}$ \+ 2*$T_{e}$ |  5*$T_{h}$ \+ 4*$T_{e}$ |  4*$T_{h}$ \+ 2*$T_{e}$ |  8.99
Zhou . (2019) |  4*$T_{P}$ \+ 5*$T_{h}$ |  3*$T_{P}$ \+ 7*$T_{h}$ |  4*$T_{P}$ \+ 6*$T_{h}$ |  10.693
Shin Kwon (2020) |  3*$T_{P}$ \+ 14*$T_{h}$ |  $T_{P}$ \+ 12*$T_{h}$ |  2*$T_{P}$ \+ 5*$T_{h}$ |  8.66
Jangirala . (2020) |  5*$T_{P}$ \+ 13*$T_{h}$ |  3*$T_{P}$ \+ 23*$T_{h}$ |  2*$T_{P}$ \+ 9*$T_{h}$ |  22.5
LDA-2IoT |  6*$T_{h}$ \+ 2*$T_{e}$ |  13*$T_{h}$ \+ 6*$T_{e}$ |  6*$T_{h}$ \+ 3*$T_{e}$ |  7.92

  * •

Legends: $T_{h}$: One-way hash function cost, $T_{E}$/$T_{D}$: ECC
Encryption/Decryption cost, $T_{P}$: ECC point multiplication cost

###  C Round-trip Delay

We computed Round-Trip Delay (RTD) as an average time required by a
communicated packet to arrive at the destination from the source Challa .
(2017). The round-trip delay involves queuing delay, processing delay,
transmission delay, and the propagation delay. The processing delay includes
cryptographic operations, while the propagation delay includes travel time
required by a packet. For the experimental purpose, through our scenario of
numerous users, uni gateway, and multiple sensing devices, we generated
simultaneous requests to the gateway device from the user devices for
accessing the sensors at different levels. Then, The average RTD at the
sensing device, which includes the time between the sensor’s reply to the
gateway and gateway’s response to the sensor, is 0.4825 second. The average
RTD at a user device, which includes the time required between sending a
request to receiving a reply from the gateway via sensing devices, is 0.5282
seconds. If we send some requests in which the user is not eligible to access
the sensor at a particular level, then the RTD gets a little hike due to the
gateway node taking little more verification time. If the gateway device does
not find a valid user, subsequently, it communicates 0 signal to both the user
and sensor to indicate invalid requests received.

###  D Throughput

We define throughput in either way. The first way is based on the number of
bits communicated in unit-time, and the second way is the number of packets
transmitted in unit-time. During the implementation of the proposed LDA-2IoT,
we gathered data for numerous static users, uni gateway, and numerous static
sensors. The throughput is 162 bps, 233 bps, and 91bps at the user, gateway,
and sensor. Thus, if we consider the computation cost required for the
proposed scheme, then the average transmission time as per the throughput will
be 4.28 seconds, 5.16 seconds, and 8.69 seconds needed for the user, gateway,
and sensor, respectively. We like to highlight here that we installed
”MOSQUITTO” Light . (2017) broker at the gateway for implementation, and we
collected the data from the gateway device. Now, if we consider the number of
packets transmitted per unit time, then the throughput can be computed as
$\frac{totalpacketreceived*packetsize}{totaltime}$ Challa . (2017). Thus, by
computed using this formula, the average number of MQTT packet received at the
user is 7, the sensor is 12 and gateway is 42 where packet size communicated
from the user to gateway is 7 byte, gateway to user and sensor is 9 byte and
sensor to the gateway is 5 byte through MQTT. Thus, the average throughput for
the proposed scheme is 19.48 bps.

##  6 IMPLEMENTATION OF LDA-2IoT

An environment for the implementation of the proposed LDA scheme is
highlighted in the following Table 5. We use the laptop and desktop as a user
device, the raspberry pi as a gateway device and the NodeMCU connected with
the sensors as a sensing device.

Table 5: Implementation Environment Network Model |  Generic IoT Model
---|---
Broker |  Mosquitto
Protocol |  Using MQTT
Language |  Python
ECC Curve |  NIST P-256 Curve
Secure channel |  By Enabling TLS communication in Mosquitto
ECC Multiplication |  Using double and Add method
Message format |  JSON Type
User Device |  Intel (R) Core (TM) i3-7500 CPU with 2.80 GHz.
Gateway System |  Raspberry Pi 3 Model B, 1 GB RAM.
Sensing device |  NodeMCU + Raspberry Pi

The following Fig. 2 shows the computed session key between the user device
and the sensing device.

Figure 2: LDA-2IoT Session Key

##  7 CONCLUSION

In this paper, we introduced a novel IoT authentication approach using an
Elliptic Curve Cryptography. We proposed a Level-Dependent Authentication for
Generic IoT (LDA-2IoT). The LDA-2IoT reduces the number of user registrations
and smooths the access control mechanism of the IoT system. We provided the
informal security analysis of the proposed scheme through the Dolev-Yao
channel. The formal security analysis of the proposed scheme is given using a
widely accepted AVISPA tool and random oracle based ROR Model. The comparative
analysis of the LDA-2IoT with the other existing systems shows a little
increase in computation and communication costs in the authentication phase.
Still, it drastically decreases the efforts in multiple user registration and
maintenance of the access control list. The implementation of a proposed
LDA-2IoT is done through the MQTT protocol as an application layer protocol
and raspberry-pi as a sensing device. Overall the proposed LDA-2IoT opens the
new door for the researchers to study access control free, only authentication
dependent security systems. The proposed scheme’s future work is to perform
the feasibility analysis for the proposed LDA approach in the different IoT
applications. Another future work of the proposed approach is to implement
proposed LDA with other cryptographic approaches like One Time Password (OTP),
Physical Unclonable Function (PUF), digital signature, third party
certificates, tokenizations and so on.

## References

  * Abbasinezhad-Mood Nikooghadam (2018) ABBASINEZHADMOOD201847Abbasinezhad-Mood, D. Nikooghadam, M.  2018\.  Design and hardware implementation of a security-enhanced elliptic curve cryptography based lightweight authentication scheme for smart grid communications Design and hardware implementation of a security-enhanced elliptic curve cryptography based lightweight authentication scheme for smart grid communications.  Future Generation Computer Systems8447 - 57.  https://doi.org/10.1016/j.future.2018.02.034
  * Abdalla . (2005) Abdalla2005Abdalla, M., Fouque, PA. Pointcheval, D.  2005\.  Password-Based Authenticated Key Exchange in the Three-Party Setting Password-based authenticated key exchange in the three-party setting.  S. Vaudenay (), Public Key Cryptography - PKC 2005 Public key cryptography - pkc 2005 ( 65–84).  Berlin, HeidelbergSpringer Berlin Heidelberg.
  * Challa . (2017) Challa2017Challa, S., Wazid, M., Das, AK., Kumar, N., Goutham Reddy, A., Yoon, E. Yoo, K.  2017\.  Secure Signature-Based Authenticated Key Establishment Scheme for Future IoT Applications Secure signature-based authenticated key establishment scheme for future iot applications.  IEEE Access53028-3043.  10.1109/ACCESS.2017.2676119
  * Chifor . (2018) chifor2018securitysmarthomeecccoapChifor, BC., Bica, I., Patriciu, VV. Pop, F.  2018\.  A security authorization scheme for smart home Internet of Things devices A security authorization scheme for smart home internet of things devices.  Future Generation Computer Systems86740–749.
  * Das . (2018) Das2018Das, AK., Wazid, M., Kumar, N., Vasilakos, AV. Rodrigues, JJPC.  2018Dec.  Biometrics-Based Privacy-Preserving User Authentication Scheme for Cloud-Based Industrial Internet of Things Deployment Biometrics-based privacy-preserving user authentication scheme for cloud-based industrial internet of things deployment.  IEEE Internet of Things Journal564900-4913.  10.1109/JIOT.2018.2877690
  * Das . (2019) Das2019Das, AK., Wazid, M., Yannam, AR., Rodrigues, JJPC. Park, Y.  2019\.  Provably Secure ECC-Based Device Access Control and Key Agreement Protocol for IoT Environment Provably secure ecc-based device access control and key agreement protocol for iot environment.  IEEE Access755382-55397.  10.1109/ACCESS.2019.2912998
  * Dolev Yao (1981) Dolev1981Dolev, D. Yao, AC.  1981\.  On the Security of Public Key Protocols On the security of public key protocols.  Proceedings of the 22Nd Annual Symposium on Foundations of Computer Science Proceedings of the 22nd annual symposium on foundations of computer science ( 350–357).  Washington, DC, USAIEEE Computer Society.  https://doi.org/10.1109/SFCS.1981.32 10.1109/SFCS.1981.32
  * Esfahani . (2019) Esfahani2019Esfahani, A., Mantas, G., Matischek, R., Saghezchi, FB., Rodriguez, J., Bicaku, A.Bastos, J.  2019Feb.  A Lightweight Authentication Mechanism for M2M Communications in Industrial IoT Environment A lightweight authentication mechanism for m2m communications in industrial iot environment.  IEEE Internet of Things Journal61288-296.  10.1109/JIOT.2017.2737630
  * Farash . (2016) farash2016efficientFarash, MS., Turkanović, M., Kumari, S. Hölbl, M.  2016\.  An efficient user authentication and key agreement scheme for heterogeneous wireless sensor network tailored for the Internet of Things environment An efficient user authentication and key agreement scheme for heterogeneous wireless sensor network tailored for the internet of things environment.  Ad Hoc Networks36152–176.
  * Gope Sikdar (2019) Gope2019Gope, P. Sikdar, B.  2019Feb.  Lightweight and Privacy-Preserving Two-Factor Authentication Scheme for IoT Devices Lightweight and privacy-preserving two-factor authentication scheme for iot devices.  IEEE Internet of Things Journal61580-589.  10.1109/JIOT.2018.2846299
  * Jangirala . (2020) Jangirala2020Jangirala, S., Das, AK., Wazid, M. Vasilakos, AV.  2020\.  Designing Secure User Authentication Protocol for Big Data Collection in IoT-Based Intelligent Transportation System Designing secure user authentication protocol for big data collection in iot-based intelligent transportation system.  IEEE Internet of Things Journal1-1.  10.1109/JIOT.2020.3040938
  * Jia . (2018) Jia2018healthJia, X., He, D., Kumar, N. Choo, KKR.  2018May29.  Authenticated key agreement scheme for fog-driven IoT healthcare system Authenticated key agreement scheme for fog-driven iot healthcare system.  Wireless Networks.  https://doi.org/10.1007/s11276-018-1759-3 10.1007/s11276-018-1759-3
  * Jo . (2016) Jo2016smartgrideccJo, HJ., Kim, IS. Lee, DH.  2016May.  Efficient and Privacy-Preserving Metering Protocols for Smart Grid Systems Efficient and privacy-preserving metering protocols for smart grid systems.  IEEE Transactions on Smart Grid731732-1742.  10.1109/TSG.2015.2449278
  * Khan . (2019) khan2019secureKhan, S., Khan, R. Al-Bayatti, AH.  2019\.  Secure Communication Architecture for Dynamic Energy Management in Smart Grid Secure communication architecture for dynamic energy management in smart grid.  IEEE Power and Energy Technology Systems Journal6147–58.
  * Kirsal Ever (2019) ever2019healthKirsal Ever, Y.  2019March.  Secure-Anonymous User Authentication Scheme for e-Healthcare Application Using Wireless Medical Sensor Networks Secure-anonymous user authentication scheme for e-healthcare application using wireless medical sensor networks.  IEEE Systems Journal131456-467.  10.1109/JSYST.2018.2866067
  * Kocher . (1999) Kocher1999Kocher, PC., Jaffe, J. Jun, B.  1999\.  Differential Power Analysis Differential power analysis.  Proceedings of the 19th Annual International Cryptology Conference on Advances in Cryptology Proceedings of the 19th annual international cryptology conference on advances in cryptology ( 388–397).  Berlin, HeidelbergSpringer-Verlag.  http://dl.acm.org/citation.cfm?id=646764.703989
  * N. Kumar . (2019) Kumar2019SmartGridECCKumar, N., Aujla, GS., Das, AK. Conti, M.  2019\.  ECCAuth: Secure Authentication Protocol for Demand Reponse Management in Smart Grid Systems Eccauth: Secure authentication protocol for demand reponse management in smart grid systems.  IEEE Transactions on Industrial Informatics1-1.  10.1109/TII.2019.2922697
  * P. Kumar . (2016) Kumar2015homeKumar, P., Gurtov, A., Iinatti, J., Ylianttila, M. Sain, M.  2016\.  Lightweight and Secure Session-Key Establishment Scheme in Smart Home Environments Lightweight and secure session-key establishment scheme in smart home environments.  IEEE Sensors Journal161254-264.  10.1109/JSEN.2015.2475298
  * Light . (2017) light2017mosquittoLight, RA. .  2017\.  Mosquitto: server and client implementation of the MQTT protocol. Mosquitto: server and client implementation of the mqtt protocol.  J. Open Source Software213265.
  * Lohachab Karambir (2019) Lohachab2019Lohachab, A. Karambir.  2019\.  ECC based inter-device authentication and authorization scheme using MQTT for IoT networks Ecc based inter-device authentication and authorization scheme using mqtt for iot networks.  Journal of Information Security and Applications461 - 12.  https://doi.org/10.1016/j.jisa.2019.02.005
  * Lyu . (2019) Lyu2019SmartHomeECCLyu, Q., Zheng, N., Liu, H., Gao, C., Chen, S. Liu, J.  2019\.  Remotely Access “My” Smart Home in Private: An Anti-Tracking Authentication and Key Agreement Scheme Remotely access “my” smart home in private: An anti-tracking authentication and key agreement scheme.  IEEE Access741835-41851.  10.1109/ACCESS.2019.2907602
  * Mahmood . (2018) MAHMOOD2018557Mahmood, K., Chaudhry, SA., Naqvi, H., Kumari, S., Li, X. Sangaiah, AK.  2018\.  An elliptic curve cryptography based lightweight authentication scheme for smart grid communication An elliptic curve cryptography based lightweight authentication scheme for smart grid communication.  Future Generation Computer Systems81557 - 565.  https://doi.org/10.1016/j.future.2017.05.002
  * Messerges . (1999) Messerges1999Messerges, TS., Dabbish, EA. Sloan, RH.  1999\.  Power Analysis Attacks of Modular Exponentiation in Smartcards Power analysis attacks of modular exponentiation in smartcards.  ÇK. Koç C. Paar (), Cryptographic Hardware and Embedded Systems Cryptographic hardware and embedded systems ( 144–157).  Berlin, HeidelbergSpringer Berlin Heidelberg.
  * Miller (1985) miller1985useMiller, VS.  1985\.  Use of elliptic curves in cryptography Use of elliptic curves in cryptography.  Conference on the theory and application of cryptographic techniques Conference on the theory and application of cryptographic techniques ( 417–426).
  * Mosenia Jha (2017) Mosenia2017Mosenia, A. Jha, NK.  2017Oct.  A Comprehensive Study of Security of Internet-of-Things A comprehensive study of security of internet-of-things.  IEEE Transactions on Emerging Topics in Computing54586-602.  10.1109/TETC.2016.2606384
  * Naoui . (2019) Naoui2019smarthomeeccNaoui, S., Elhdhili, ME. Saidane, LA.  2019Mar09.  Lightweight and Secure Password Based Smart Home Authentication Protocol: LSP-SHAP Lightweight and secure password based smart home authentication protocol: Lsp-shap.  Journal of Network and Systems Management.  https://doi.org/10.1007/s10922-019-09496-x 10.1007/s10922-019-09496-x
  * Patel Doshi (2018) patel2018internetPatel, C. Doshi, N.  2018\.  Internet of Things Security: Challenges, Advances, and Analytics Internet of things security: Challenges, advances, and analytics (1st ).  Boston, MA, USAAuerbach Publications.
  * Roy . (2018) Roy2018Roy, S., Chatterjee, S., Das, AK., Chattopadhyay, S., Kumari, S. Jo, M.  2018Aug.  Chaotic Map-Based Anonymous User Authentication Scheme With User Biometrics and Fuzzy Extractor for Crowdsourcing Internet of Things Chaotic map-based anonymous user authentication scheme with user biometrics and fuzzy extractor for crowdsourcing internet of things.  IEEE Internet of Things Journal542884-2895.  10.1109/JIOT.2017.2714179
  * Shin Kwon (2020) Shin2020Shin, S. Kwon, T.  2020\.  A Privacy-Preserving Authentication, Authorization, and Key Agreement Scheme for Wireless Sensor Networks in 5G-Integrated Internet of Things A privacy-preserving authentication, authorization, and key agreement scheme for wireless sensor networks in 5g-integrated internet of things.  IEEE Access867555-67571.  10.1109/ACCESS.2020.2985719
  * Shuai . (2019) SHUAI2019SmartHomeEccShuai, M., Yu, N., Wang, H. Xiong, L.  2019\.  Anonymous authentication scheme for smart home environment with provable security Anonymous authentication scheme for smart home environment with provable security.  Computers and Security86132 - 146.  https://doi.org/10.1016/j.cose.2019.06.002
  * Sureshkumar . (2019) suresh2019healthSureshkumar, V., Amin, R., Vijaykumar, V. Sekar, SR.  2019\.  Robust secure communication protocol for smart healthcare system with FPGA implementation Robust secure communication protocol for smart healthcare system with fpga implementation.  Future Generation Computer Systems100938 - 951.  https://doi.org/10.1016/j.future.2019.05.058
  * Vahedi . (2017) vahedi2017securesmartgrideccVahedi, E., Bayat, M., Pakravan, MR. Aref, MR.  2017\.  A secure ECC-based privacy preserving data aggregation scheme for smart grids A secure ecc-based privacy preserving data aggregation scheme for smart grids.  Computer Networks12928–36.
  * Wazid . (2019) Wazid2019droneWazid, M., Das, AK., Kumar, N., Vasilakos, AV. Rodrigues, JJPC.  2019April.  Design and Analysis of Secure Lightweight Remote User Authentication and Key Agreement Scheme in Internet of Drones Deployment Design and analysis of secure lightweight remote user authentication and key agreement scheme in internet of drones deployment.  IEEE Internet of Things Journal623572-3584.  10.1109/JIOT.2018.2888821
  * Wazid, Das, Odelu, Kumar, Conti Jo (2018) wazid2018Wazid, M., Das, AK., Odelu, V., Kumar, N., Conti, M. Jo, M.  2018Feb.  Design of Secure User Authenticated Key Management Protocol for Generic IoT Networks Design of secure user authenticated key management protocol for generic iot networks.  IEEE Internet of Things Journal51269-282.  10.1109/JIOT.2017.2780232
  * Wazid . (2017) wazid2017secure-smarthomeWazid, M., Das, AK., Odelu, V., Kumar, N. Susilo, W.  2017\.  Secure remote user authenticated key establishment protocol for smart home environment Secure remote user authenticated key establishment protocol for smart home environment.  IEEE Transactions on Dependable and Secure Computing.
  * Wazid, Das, Odelu, Kumar Susilo (2018) Wazid2018secureWazid, M., Das, AK., Odelu, V., Kumar, N. Susilo, W.  2018\.  Secure Remote User Authenticated Key Establishment Protocol for Smart Home Environment Secure remote user authenticated key establishment protocol for smart home environment.  IEEE Transactions on Dependable and Secure Computing1-1.  10.1109/TDSC.2017.2764083
  * Wu . (2018) wu2018healthWu, F., Li, X., Xu, L., Kumari, S. Sangaiah, AK.  2018\.  A novel mutual authentication scheme with formal proof for smart healthcare systems under global mobility networks notion A novel mutual authentication scheme with formal proof for smart healthcare systems under global mobility networks notion.  Computers and Electrical Engineering68107 - 118.  https://doi.org/10.1016/j.compeleceng.2018.03.030
  * Zhang . (2019) ZHANG2019smartgrideccZhang, L., Zhao, L., Yin, S., Chi, CH., Liu, R. Zhang, Y.  2019\.  A lightweight authentication scheme with privacy protection for smart grid communications A lightweight authentication scheme with privacy protection for smart grid communications.  Future Generation Computer Systems100770 - 778.  https://doi.org/10.1016/j.future.2019.05.069
  * Zhou . (2019) Zhou2019Zhou, Y., Liu, T., Tang, F., Wang, F. Tinashe, M.  2019\.  A Privacy-Preserving Authentication and Key Agreement Scheme with Deniability for IoT A privacy-preserving authentication and key agreement scheme with deniability for iot.  Electronics84.  https://www.mdpi.com/2079-9292/8/4/450 10.3390/electronics8040450