Source-linked AI summary
Authentication Protocols for Internet of Things: A Comprehensive Survey
Mohamed Amine Ferrag, Leandros A. Maglaras, Helge Janicke, Jianmin Jiang
TL;DR
IoT devices must withstand attacks that threaten information exchange and consequently life. This paper surveys authentication protocols across four IoT environments, reviews countermeasures and formal verification techniques, and concludes that reliability depends on cryptography, computation complexity, and communication overhead.
Problem
IoT devices must be robust to attacks that could threaten the correct exchange of information and consequently life.
Method
The paper provides a structured comprehensive overview of authentication protocols for the IoT and presents countermeasures and formal security verification techniques.
Results
Authentication reliability depends not only on cryptography against attacks but also on computation complexity and communication overhead.
Takeaways & Limitations
Guaranteeing authentication between IoT machines requires considering cryptography, computation complexity, and communication overhead together.
Takeaways & Limitations
The surveyed protocols may be improved in authentication and privacy, efficient intrusion detection systems, and computation complexity.
Abstract
from arXiv · showhide
In this paper, we present a comprehensive survey of authentication protocols for Internet of Things (IoT). Specifically, we select and in-detail examine more than forty authentication protocols developed for or applied in the context of the IoT under four environments, including: (1) Machine to machine communications (M2M), (2) Internet of Vehicles (IoV), (3) Internet of Energy (IoE), and (4) Internet of Sensors (IoS). We start by reviewing all survey articles published in the recent years that focusing on different aspects of the IoT idea. Then, we review threat models, countermeasures, and formal security verification techniques used in authentication protocols for the IoT. In addition, we provide a taxonomy and comparison of authentication protocols for the IoT in form of tables in five terms, namely, network model, goals, main processes, computation complexity, and communication overhead. Based on the current survey, we identify open issues and suggest hints for future research.
1. Introduction
IoT connects diverse environments, but its massive and complex data exchanges create security and privacy concerns, especially for device authentication. This survey systematically reviews authentication research, compares protocols, and identifies open issues.
- Motivation: Billions of device interactions will generate massive, complex data vulnerable to security and privacy problems, particularly during authentication.The introduction links the scale of connected things and interactions with authentication concerns between devices.
- IoT scope: IoT spans machine-to-machine communications, vehicles, energy, and sensors, each using distinct connected-device settings and technologies.IoV uses vehicular resources and Road Side Units, IoE connects smart grids to the internet, and IoS connects sensors through ZigBee and IEEE 802.15.4-based protocols.
- Survey scope: The survey systematically examines more than forty authentication protocols across M2M, IoV, IoE, and IoS, using studies identified from SCOPUS and Web of Science between 2005 and 2016.It also reviews roughly seventy IoT survey articles and places the authentication-protocol literature in context.
- Security analysis: The paper reviews protocols evaluated against thirty-five attacks, emphasizing man-in-the-middle, impersonation, forging, and replay attacks.It additionally discusses countermeasures and formal security-verification techniques.
- Comparison and outlook: Its comparison tables organize protocols by network model, goals, main processes, computation complexity, and communication overhead, alongside open issues and future directions.The paper’s remaining sections cover prior surveys, threat models, countermeasures, formal verification, protocol comparisons, and future work.
2. Surveys articles for the IoT
Earlier IoT surveys addressed diverse research areas, but the literature lacked a survey thoroughly investigating authentication protocols for IoT. This paper organizes prior surveys and focuses authentication across four IoT environments.
- Survey landscape: Around seventy survey articles published in recent years address the Internet of Things.
- Survey landscape: These surveys span areas including networking, applications, standardization, social interactions, security, and privacy.
- Survey landscape: Prior surveys are categorized by research field and publication year, as shown in Tables 2 and 3.
- Survey scope: The paper addresses the identified gap by surveying authentication protocols in M2M, IoV, IoE, and IoS, then identifying open issues and future directions.
- Survey landscape: Existing reviews cover topics such as testbeds, heterogeneous wireless-sensor-network integration, middleware, data management, standardization, and IoT security and privacy.
3. Threat models
The survey organizes IoT threats by several classification schemes and examines authentication defenses across M2M, IoV, IoE, and IoS. It emphasizes five frequently evaluated attacks and the mechanisms used to address them.
- Threat coverage: Thirty-five attacks across M2M, IoV, IoE, and IoS are summarized alongside their defense protocols.
- Threat coverage: The five commonly evaluated attacks are man-in-the-middle, impersonation, forging, and replay attacks.
- Attack taxonomy: Attack classifications distinguish passive or active, internal or external, key-, data-, impersonation-, physical-, identity-, location-, eavesdropping-, manipulation-, and service-based attacks.
- Man-in-the-middle attack: MITM attacks let adversaries spoof two honest nodes, control their communication channel, and intercept, modify, change, or replace traffic.
- Man-in-the-middle attack: Four protocols use mutual authentication, while others employ authentication acknowledgements, public-key encryption, symmetric polynomials, or password and biometric updates.
- Replay attack: Twenty-four IoT authentication protocols detect or avoid replay attacks using timestamps, hash functions, or random numbers.
4. Countermeasures and formal security verification techniques
The survey organizes IoT authentication countermeasures by cryptosystem and examines formal techniques used to verify protocol security. It covers symmetric, asymmetric, and hybrid designs across M2M, IoV, IoE, and IoS.
- 4.1. Countermeasures: The tables summarize cryptosystems and countermeasures for M2M, IoV, IoE, and IoS, including smart-card-based protocols.
- 4.1. Countermeasures: Authentication protocols are classified as symmetric-cryptosystem-based, asymmetric-cryptosystem-based, or hybrid protocols.
- 4.1. Countermeasures: Most surveyed protocols use secure cryptographic hash functions, while others employ aggregate signatures, ECDH, ID-based signatures, AES, or LCE.
- 4.1. Countermeasures: Certificateless aggregate signatures combine n signatures on distinct messages into one short signature and are described as secure against existential forgery in the chosen aggregate model.
- 4.1. Countermeasures: Countermeasures span network mobility, symmetric polynomials, search algorithms, group signatures, Merkle Hash Trees, TESLA, ECDSA, secret sharing, HMAC, and attribute-based mechanisms.
- 4.1. Countermeasures: Symmetric polynomials let two users derive the same secret key without transmitting additional messages, exemplified by f(1,2) = 16.
- 4.1. Countermeasures: HSLV and LSHV provide two HORS-based verification modes using key generation, signing, and verification procedures.
5. Taxonomy and comparison of authentication protocols for the IoT
The survey examines IoT authentication protocols through network models, authentication goals, attacks, countermeasures, protocol phases, and performance measures. Its comparisons cover computation complexity, communication overhead, security properties, and reported limitations.
- The taxonomy defines network, authentication, and attack models, selects countermeasures, and identifies protocol phases such as setup and registration.
- Formal security analyses include tools such as ProVerif, BAN-logic, and AVISPA, while performance evaluations consider storage, computation, communication, and error rates.
- The comparison tables organize protocols by network model, goals, main processes, computation complexity, and communication overhead.
- Reported protocol advantages include resistance to DoS, redirection, man-in-the-middle, replay, and active attacks, alongside privacy, integrity, anonymity, and traceability properties.
- Several protocols report lower computation, communication, storage, energy, delay, or error costs than named comparison schemes.
- The survey records unresolved issues including unexamined location or privacy preservation, omitted storage costs, unstudied attack resistance, and missing threat models.
- Other reported limitations include greater computational overhead, lack of non-repudiation, and incomplete attack-performance analysis in particular schemes.
- PAWN is reported efficient in average energy consumption and handshake duration, while other schemes are efficient in end-to-end delay, throughput, and computation cost.
6.1. M2M Open Issues
M2M applications such as e-health, smart grids, industrial automation, and environmental monitoring face security, trust, scalability, and heterogeneity challenges. The survey highlights the need for robust authentication and broader attack-resistance research.
- M2M communications support e-health, smart grids, industrial automation, and environmental monitoring but face security threats and trust issues.
- In e-health, authentication must resist attacks that could threaten information exchange and consequently a patient’s life.
- Healthcare systems require authentication of users, organizations, and people to safely share and manage information access.
- Research is needed to assess the attack resistance and robustness of Australian NASH and similar certificate-based authentication systems.
- Scalability and heterogeneity arise when M2M devices come from different vendors and use different operating systems.
- Android-focused approaches may not guarantee end-to-end system security.
6.2. IoV Open Issues
IoV authentication still faces unresolved challenges across autonomous platooning, heterogeneous communication channels, and socially mediated identity protection.
- Open issues: Existing vehicular authentication protocols provide authentication but leave open issues for the research community.Prior work has addressed strong anonymity for platoon members, but further challenges remain for autonomous and heterogeneous settings.
- Autonomous platooning: Automated vehicles need authentication methods for forming platoons without a central entity or trust authority.The paper suggests digital signatures with challenge verification or vehicle trust levels as possible techniques.
- Heterogeneous vehicular networking: Authentication protocols must protect IoV deployments across DSRC, LTE, IEEE 802.11p, WiMax, and other communication channels.Securing one channel while ignoring threats in the others leaves IoV vulnerable to authentication attacks.
- Social Internet of Vehicles: Social Internet of Vehicles authentication must address identity protection in communications among vehicles and drivers.The paper recommends combining authentication technologies established for social networks and vehicular networks.
6.3. IoE Open Issues
IoE authentication is difficult because the energy domain integrates multiple interconnected IoT subdomains and communication infrastructures.
- IoE definition: The IoE connects energy networks with the Internet through standard and interoperable communication protocols.Its infrastructure allows energy units to be dispatched when and where needed.
- Integrated IoE environment: IoE combines M2M, V2G, industrial IoT, smart home automation, cloud services, and IoS, making authentication a multi-domain problem.The paper frames IoE as an IoT application in the energy domain.
- Integrated IoE environment: IoE authentication cannot be assured without addressing security across each interconnected subdomain.The paper states that security, hardware authentication, and middleware-security solutions must be combined.
6.4. IoS Open Issues
IoS authentication research must jointly address sensor security and energy efficiency, including integration with intrusion detection systems.
- Core challenges: IoS networks primarily face energy-efficiency and sensor-security challenges.These requirements must be considered together when developing authentication protocols.
- Core challenges: Intrusion detection systems and energy-efficient mechanisms remain insufficiently investigated in surveyed IoS authentication protocols.The survey identifies both areas as unresolved limitations of existing work.
- Future directions: Extending SVELTE for energy-efficient, real-time intrusion detection is identified as a possible IoS research direction.SVELTE is described as an IoT scheme based on real-time intrusion detection.
- Future directions: Future frameworks should combine intrusion detection and authentication to detect and avoid attacks in IoS.The paper presents joint treatment of security, especially IDSs, and energy as an important contribution area.
6.5. Pattern recognition and biometrics for the IoT
Pattern recognition and biometrics are proposed as promising directions for strengthening IoT authentication, while introducing privacy and ethical considerations.
- Hybrid authentication: Hybrid authentication combines knowledge-based methods such as passwords with token-based methods such as badges.Passwords may be forgotten or guessed, whereas badges may be lost or stolen.
- Biometric authentication: Biometric characteristics are presented as a safer authentication basis because two people cannot possess exactly the same characteristic.The paper proposes combining pattern recognition authentication with biometrics for IoT.
- Biometric authentication: Recent IoT biometric efforts have contributed to the Internet of Biometric Things concept.The survey cites several biometric-IoT proposals and identifies IoBT as an emerging term.
- Privacy and ethics: Biometric authentication introduces privacy and ethical issues, especially in applications handling sensitive information.These issues should be considered when designing new IoT authentication protocols.
7. Conclusion
The survey provides a structured overview and comparison of IoT authentication protocols across four environments, while reviewing threats, countermeasures, and formal verification techniques. It concludes that reliable authentication depends on cryptography together with computation complexity and communication overhead, and identifies several directions for improvement.
- The paper surveys authentication protocols across M2M, IoV, IoE, and IoS environments.
- It reviews major threats, countermeasures, and formal security verification techniques used by IoT authentication protocols.
- The survey presents a side-by-side tabular comparison of authentication protocols proposed for M2M and IoV.
- Authentication reliability depends on cryptographic effectiveness against attacks, computation complexity, and communication overhead.
- Future protocols should address authentication and privacy together, improve IDSs, reduce computation complexity and communication overhead, and strengthen formal verification.