Device authentication is an essential security feature for Internet of Things (IoT). Many IoT devices are deployed in the open and public places, which makes them vulnerable to physical and cloning attacks. Therefore, any authentication protocol designed for IoT devices should be robust even in cases when an IoT device is captured by an adversary. Moreover, many of the IoT devices have limited storage and computational capabilities. Hence, it is desirable that the security solutions for IoT devices should be computationally efficient. To address all these requirements, in this article, we present a lightweight and privacy-preserving two-factor authentication scheme for IoT devices, where physically uncloneable functions (PUFs) have been considered as one of the authentication factors. Security and performance analysis show that our proposed scheme is not only robust against several attacks, but also very efficient in terms of computational efficiently.

Industrial Wireless Sensor Network (IWSN) is an emerging class of a generalized Wireless Sensor Network (WSN) having constraints of energy consumption, coverage, connectivity, and security. However, security and privacy is one of the major challenges in IWSN as the nodes are connected to Internet and usually located in an unattended environment with minimum human interventions. In IWSN, there is a fundamental requirement for a user to access the real-time information directly from the designated sensor nodes. This task demands to have a user authentication protocol. To satisfy this requirement, this article proposes a lightweight and privacy-preserving mutual user authentication protocol in which only the user with a trusted device has the right to access the IWSN. Therefore, in the proposed scheme, we considered the physical layer security of the sensor nodes. We show that the proposed scheme ensures security even if a sensor node is captured by an adversary. The proposed protocol uses the lightweight cryptographic primitives, such as one way cryptographic hash function, Physically Unclonable Function (PUF) and bitwise exclusive (XOR) operations. Security and performance analysis shows that the proposed scheme is secure, and is efficient for the resource-constrained sensing devices in IWSN.

User authentication in wireless sensor networks (WSN) is a critical security issue due to their unattended and hostile deployment in the field. Since the sensor nodes are equipped with limited computing power, storage, and communication modules, authenticating remote users in such resource-constrained environment is a paramount security concern. Until now, impressive efforts have been made for designing authentication schemes with user anonymity by using only the lightweight cryptographic primitives, such as symmetric key encryption/decryption and hash functions. However, to the best of our knowledge, none has succeeded so far. In this paper, we take an initial step to shed light on the rationale underlying this prominent issue. In order to do that here at first, we demonstrate that the existing solutions for anonymous user authentication in WSN are impractical. Subsequently, we propose a realistic authentication protocol for WSN, which can ensure various imperative security properties like user anonymity, untraceability, forward/backward secrecy, perfect forward secrecy, etc.

Radio frequency identification (RFID) has been considered one of the imperative requirements for implementation of Internet-of-Things applications. It helps to solve the identification issues of the things in a cost-effective manner, but RFID systems often suffer from various security and privacy issues. To solve those issues for RFID systems, many schemes have been recently proposed by using the cryptographic primitive, called physically uncloneable functions (PUFs), which can ensure a tamper-evident feature. However, to the best of our knowledge, none of them has succeeded to address the problem of privacy preservation with the resistance of DoS attacks in a practical way. For instance, existing schemes need to rely on exhaustive search operations to identify a tag, and also suffer from several security and privacy related issues. Furthermore, a tag needs to store some security credentials (e.g., secret shared keys), which may cause several issues such as loss of forward and backward secrecy and large storage costs. Therefore, in this paper, we first propose a lightweight privacy-preserving authentication protocol for the RFID system by considering the ideal PUF environment. Subsequently, we introduce an enhanced protocol which can support the noisy PUF environment. It is argued that both of our protocols can overcome the limitations of existing schemes, and further ensure more security properties. By analyzing the performance, we have shown that the proposed solutions are secure, efficient, practical, and effective for the resource-constraint RFID tag.

Information and Communication Technologies (ICT) are one of the underpinning platforms of smart grids, facilitating efficient grid management and operation, optimization of resource utilization, as well as enable new products, features, and services. However, this interconnection of grid technology with ICT leads to various security challenges in the power grid. One such concern is the tampering of usage data from smart meters which may result not only in incorrect billing, but also in incorrect decisions related to demand and supply management. In addition to network based cyber attacks, smart meters are also susceptible to physical attacks since they are installed in customer premises without hardware protection mechanisms. In this paper, we propose a novel privacy-aware authenticated key agreement scheme which can not only ensure secure communication between the smart meters and the service provider, but also the physical security of smart meters. In this regard, we utilize the lightweight cryptographic primitives such as Physically Uncloneable Functions (PUFs) and one-way hash function, etc. Hence, the proposed scheme is suitable even for the resource constrained smart meters.

There has been a a significant increase in the popularity of using Unmanned Aerial Vehicles (UAVs), popularly known as drones, in several applications. In many application scenarios, UAVs are deployed in missions where sensitive data is collected, such as monitoring critical infrastructure, industrial facilities, crops, and public safety. Due to the sensitive and/or safety critical nature of the data collected in these applications, it is imperative to consider the security and privacy aspects of the UAVs used in these scenarios. In this article, we propose an efficient privacy aware authentication scheme for edge-assisted UAVs (Internet of Drones). Unlike the existing security solutions for UAV, our proposed scheme does not require to store any secret key in the devices but still can ensure the desired security level. To the best of our knowledge, this is the first article, where physical security of the UAV has taken into account. The proposed system allows third-party communication and mobile edge computing service provides to authenticate the UAVs without any loss of provacy and outperforms existing methods in terms of computational complexity.