Lightweight and Privacy-Preserving Two-Factor Authentication Scheme for IoT Devices

TLDR

Device authentication is essential for IoT, yet many devices are deployed publicly and have limited resources, making them vulnerable to physical and cloning attacks and requiring computationally efficient, robust protocols. The authors aim to develop a lightweight, privacy‑preserving two‑factor authentication scheme for IoT devices that remains secure even if a device is captured. The scheme employs physically uncloneable functions as one authentication factor to achieve robustness and computational efficiency. Security and performance analysis demonstrate that the scheme is robust against multiple attacks and highly efficient computationally.

Abstract

Device authentication is an essential security feature for Internet of Things (IoT). Many IoT devices are deployed in the open and public places, which makes them vulnerable to physical and cloning attacks. Therefore, any authentication protocol designed for IoT devices should be robust even in cases when an IoT device is captured by an adversary. Moreover, many of the IoT devices have limited storage and computational capabilities. Hence, it is desirable that the security solutions for IoT devices should be computationally efficient. To address all these requirements, in this paper, we present a lightweight and privacy-preserving two-factor authentication scheme for IoT devices, where physically uncloneable functions have been considered as one of the authentication factors. Security and performance analysis show that our proposed scheme is not only robust against several attacks, but also very efficient in terms of computational efficiently.