Practical Two-Factor Authentication Protocol for Real-Time Data Access in WSNs

With the rapid development of sensors and communication technologies, the Internet of Things (IoT) paradigm has increasingly expanded to cover various daily, industrial, and military applications. As a core component of the IoT responsible for environmental sensing and data collection, wireless sensor networks (WSNs) face significant security threats. The design of multi-factor authentication schemes to secure real-time data transmission in WSNs has garnered considerable research efforts. However, a common trend in existing multi-factor authentication protocols is emphasizing performance and security benefits, while possible limitations are rarely subjected to thorough analysis. To fill this gap, we first select two representative multi-factor authentication schemes (i.e., Chaudhry et al.'s scheme at ACM ToIT'21 and Jabbari-Mohasef's scheme at IEEE TII'22) as case studies, and point out that both schemes are vulnerable to offline password guessing and node capture attacks, and fail to achieve forward secrecy. We then investigate the fundamental causes of these weaknesses underlying the schemes and propose corresponding solutions. After rethinking previous schemes, we present a new robust two-factor authentication scheme for WSNs and formally prove its security under the Random Oracle Model. Furthermore, we compare our scheme with 18 state-of-the-art protocols using the widely accepted evaluation framework. The comparison results show that our protocol outperforms its foremost counterparts.