Once: A Unified Secure and Lightweight Key Agreement Scheme for Internet of Things

The Internet of things (IoT) has achieved rapid development and been widely used in various industrial communities in recent years. In a typical IoT environment, users can remotely access the smart devices and send instructions to them. If the users’ identities are not correctly verified, potential adversaries could then pretend as legitimate users to send fake or even malicious instructions to the devices, which threaten the security of the entire network. Due to IoT’s open nature and constrained resources on smart devices inside, secure and efficient mutual authentication and key agreement (MAKA) schemes are indispensable to ensure security. A range of MAKA schemes with diverse security goals have been proposed in recent years, yet most of them have flaws in security or performance. In this paper, we propose a novel secure and lightweight multi-factor MAKA scheme with <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> messages in only one cycle for both single-gateway and multi-gateway IoT networks, where <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> corresponds to the number of participants involved in the network environment. The proposed scheme is capable of providing secure authentication between remote users and smart devices in the face of the state-of-the-art threat model. The security of this scheme has been proved under the random-oracle model, the ProVerif tool, BAN logic, and informal security analysis, collectively demonstrating that our scheme succeeds in meeting all expected security requirements with high confidence. We conduct adequate comparisons respectively with 20 single-gateway and 6 multi-gateway schemes in terms of security and performance. To our best knowledge, our scheme not only meets all the security requirements but also has minimum communication overhead among all competitors and minimum computation overhead among all multi-gateway schemes. We believe that our work takes a substantial step toward a further breakthrough on trade-off between security and efficiency for MAKA schemes in IoT environments.