Internet of Things (IoT) based services connect the user with sensing devices through intermediary devices like a gateway. The authentication with secure key exchange assures security trio of confidentiality, integrity, and availability for the complete IoT based system. It also ensures trusted privacy of communicated information. Recently, numerous authors proposed a Remote User Authentication scheme (RUA) on User-Gateway based secure key exchange for the tiny and lightweight sensor-based paradigms such as an IoT and a wireless sensor network (WSN) using lightweight mathematical approaches. In this paper, we propose a reliable and efficient lightweight key exchange scheme with the secure RUA for the user-gateway model. For designing a lightweight RUA scheme, we use elliptic curve cryptography (ECC).We use BAN-Logic for the validation of mutual authentication.We use widely accepted random oracle based ROR model for formal security analysis and Dolev-Yao channel for informal security analysis. For the implementation and result collection of the proposed scheme, we use a publish-subscribe based lightweight Message Queuing Telemetry Transport (MQTT) protocol. Overall, in this paper, we propose a highly secure and efficient RUA scheme for the sensor-based environment with formal security analysis and real-time implementation.

With the agile development of the Internet era, starting from the message transmission to money transactions, everything is online now. Remote user authentication (RUA) is a mechanism in which a remote server verifies the user’s correctness over the shared or public channel. In this paper, we analyze an RUA scheme proposed by Chen for the multi-server environment and prove that their scheme is not secured. We also find numerous vulnerabilities such as password guessing attack, replay attack, Registration Center (RC) spoofing attack, session key verification attack, and perfect forward secrecy attack for Chen’s scheme. After performing the cryptanalysis of Chen’s scheme, we propose a biometric-based RUA scheme for the same multi-server environment. We prove that the proposed authentication scheme achieves higher security than Chen’s scheme with the use of informal security analysis as well as formal security analysis. The formal security analysis of the proposed scheme is done using a widely adopted random oracle method.