Complete Security Analysis on Event-Based Dynamic Protocol for Constrained IoT Device

Authentication protocols have become essential for Internet of Things (IoT) devices. Developing a secure authentication protocol has become more challenging due to the constraints of IoT devices. However, event-based dynamic protocols promise lightweight and secure authentication. Nevertheless, it is necessary to thoroughly evaluate an authentication protocol, considering both protocol validation and physical aspects to closely simulate the real environment of IoT devices. We used the Tamarin Prover to evaluate the protocol validation, specifically executability, session secrecy, authentication secrecy, and historical authentication secrecy. Additionally, we assessed IoT devices implementing the event-based dynamic protocol for side channel attacks, node tempering, and cloning attacks. Our findings indicate that the event-based dynamic protocol is valid in terms of executability, session secrecy, authentication secrecy, and historical secrecy, thus confirming its claim of being secure. However, we discovered vulnerabilities in the authentication properties of the device firmware, making it susceptible to side channel and node tempering attacks. These vulnerabilities stem from the lack of necessary confidential properties. By exploiting these weaknesses, we were able to decrypt messages from the IoT device. Furthermore, we have successfully uploaded the original firmware to unofficial devices, and it runs properly on them. Therefore, while the event-based dynamic protocol itself is secure, it is prone to physical attacks. Moreover, we discuss potential solutions to completely secure the authentication process for the event-based dynamic protocol, addressing the identified vulnerabilities and ensuring robust protection against physical attacks.