Unforged Identification and Authentication for IoT Devices: Integrating Elliptic Curve Cryptography and Gait Biometrics

This paper introduces a passwordless device authentication protocol for IoT devices that combines Elliptic Curve Cryptography (ECC) with gait analysis to improve security. By filling the security loopholes of conventional password-based systems and the resource limitations of IoT devices, the proposed system employs ECC to register the device securely and save an encrypted private key, salt, and initialization vector (IV) in the user database. A single gait signature was created during registration with the average joint angles and velocities obtained from a biomechanical dataset. A server nonce, XORed with the device’s MAC address and hashed, was used to secure the first authentication procedure. The Burrows-Abadi-Needham (BAN) logic was used to ensure the authenticity and freshness of the authentication request. The adopted system relies on a public gait biomechanics dataset to simulate the gait patterns during device registration. Authenticity is achieved if the conditions of the BAN logic are met. The outcomes of the applied system demonstrate the potential for secure, passwordless authenticity.