Despite decades of intensive research, it is still challenging to design a practical multi-factor user authentication scheme for wireless sensor networks (WSNs). This is because protocol designers are confronted with a long-standing "security vs. efficiency" dilemma: sensor nodes are lightweight devices with limited storage and computation capabilities, while the security requirements are demanding as WSNs are generally deployed for sensitive applications. Hundreds of proposals have been proposed, yet most of them have been found to be problematic, and the same mistakes are repeated again and again. Two of the most common security failures are regarding smart card loss attacks and node capture attacks. The former has been extensively investigated in the literature, while little attention has been given to understanding the node capture attacks. To alleviate this undesirable situation, this paper takes a substantial step towards systematically exploring node capture attacks against multi-factor user authentication schemes for WSNs. We first investigate the various causes and consequences of node capture attacks, and classify them into ten different types in terms of the attack targets, adversary's capabilities and vulnerabilities exploited. Then, we elaborate on each type of attack through examining 11 typical vulnerable protocols, and suggest corresponding countermeasures. Finally, we conduct a large-scale comparative measurement of 61 representative user authentication schemes for WSNs under our extended evaluation criteria. We believe that such a systematic understanding of node capture attacks would help design secure user authentication schemes for WSNs.

Cloud-assisted Internet of Things (IoT) overcomes the resource-constrained nature of the traditional IoT and is developing rapidly in such fields as smart grids and intelligent transportation. In a cloud-assisted IoT system, users can remotely control the IoT devices and send specific instructions to them. If the users’ identities are not verified, adversaries can pretend as legitimate users to send fake and malicious instructions to IoT devices, thereby compromising the security of the entire system. Thus, a sound authentication mechanism is indispensable to ensure security. At the same time, it should be noted that a gateway may connect to massive IoT devices with the exponential growth of interconnected devices in a cloud-assisted IoT system. The efficiency of authentication schemes is easily impacted by the computation capability of the gateway. Recently, several schemes have been designed for cloud-assisted IoT systems, but they have problems of one kind or another, making them not very suitable for cloud-assisted IoT systems. In this paper, we take a typical scheme (proposed at IEEE TDSC 2020) as an example to identify the common weaknesses and challenges of designing a user authentication scheme for cloud-assisted IoT systems. In addition, we propose a new secure user authentication scheme with lightweight computation on gateways. The proposed scheme provides secure access between remote users and IoT devices with many ideal attributions, such as forward secrecy and multi-factor security. Meanwhile, the security of this scheme is proved under the random-oracle model, heuristic analysis, the ProVerif tool and BAN logic. Compared with ten state-of-the-art schemes in security and performance, the proposed scheme achieves all the listed twelve security requirements with minimum computation and storage costs on gateways.

As an essential part of Internet of Things (IoT), wireless sensor networks (WSNs) have touched every aspect of our lives, such as health monitoring, environmental monitoring and traffic monitoring. However, due to its openness, wireless sensor networks are vulnerable to various security threats. User authentication, as the first fundamental step to protect systems from various attacks, has attracted much attention. Numerous user authentication protocols armed with formal proof are springing up. Recently, two biometric-based schemes were proposed with confidence to be resistant to the known attacks including offline dictionary attack, impersonation attack and so on. However, after a scrutinization of these two schemes, we found them not secure enough as claimed, and then demonstrated that these schemes suffer from various attacks, such as offline dictionary attack, impersonation attack, no user anonymity, no forward secrecy, etc. Furthermore, we proposed an enhanced scheme to overcome the identified weaknesses, and proved its security via Burrows–Abadi–Needham (BAN) logic and the heuristic analysis. Finally, we compared our scheme with other related schemes, and the results showed the superiority of our scheme.

Vehicular ad-hoc network system provides network communication technology and plays an important role in road safety and traffic control. Conditional privacy-preserving can safeguard privacy as well as trace malicious vehicles, which is critical in the system. However, in the restricted computing and communication resource situation, how to ensure the conditional privacy security remains a challenge. To address this issue, this research work proposes an efficient conditional privacy-preserving scheme. In this scheme, firstly, a certificateless aggregation signature has been performed on board to avoid channel conflicts, and to our best knowledge, this scheme is the first one to propose aggregation on board. Also an elliptic curve point multiplicative operation has been utilized to decrease the cost consumed in computation. Secondly, this paper gives the security proof of the proposed scheme against the existence of unforgeability under adaptively chosen message attack for Type-I and Type-II adversaries in the random oracle model. Lastly, comprehensive performance comparisons covering the computation, communication and storage costs have been done to state that the proposed scheme is more efficient than the existing solutions. Significantly, this scheme saves at least 86% in communication overhead than compared schemes.

Smart grid (SG) achieves more convenient and efficient power transmission through the rapid development of the information and communication technology. In addition to the transmission of electrical energy, the SG system also involves privacy and control information of service providers, which is closely related to people's livelihood. However, at present, the data in the SG system are transmitted in the form of plaintext, which does not have complete protection measures for entity privacy and communication data security. Focusing on preserving entity privacy and data security, this article proposes an anonymous secure authentication protocol (ASAP-SG) for the SG environment. Based on elliptic curve cryptography and physical unclonable function, ASAP-SG can realize authentication and key agreement between smart meters and service providers. The security of ASAP-SG has been verified with proverif tool and proven strictly under the real-or-random model. Furthermore, heuristic analysis manifests that ASAP-SG can successfully resist known security attacks. Finally, a fully comparison with the other five most advanced schemes reveals that ASAP-SG consumes the optimal computation cost on both smart meters and service providers and reduces the communication overhead by 33.3%–45.8%, on the basis of satisfying ten security objectives. These features make ASAP-SG more suitable for resource-constrained SG environment.