Cryptanalysis of Biometric Based Secure User Authentication Protocol for IoT Applications

In the 21st century various Biometric based user authentication schemes for Internet of Things network applications are evolving. As a part, Vinoth et al. proposed an Biometric authenticated key agreement scheme for industrial IoT. As the IoT environments are rapidly connecting with various public networks for the communication and data transfer, there are high chance for security attacks. The schemes used in these kind of IoT networks needs to maintain the security with lightweight operations. Validation of existing schemes are highly important to protect the environment. We cryptanalysis the Vinoth et al.'s scheme and identified a security design flaw. Their scheme is failed to protect the biometric and not achieving the key freshness. As a result, their scheme is vulnerable to Biometric template attack, user impersonation attack and failed to meet the user anonymity security feature. This work proposes a technique to address the flaws identified. The proposed scheme has been implemented and verified using the AVISPA simulator.