Zero-Knowledge and Identity-Based Authentication and Key Exchange for Internet of Things

The Internet of Things (IoT) is a dynamic and large-scale infrastructure of uniquely identifiable, potentially resource-constrained, and heterogenous things sensing and influencing their environment to provide services with or without direct human intervention. Moreover, the de facto method applied so far to provide communication confidentiality and integrity is cryptography. This requires an authentic key exchange between two communicating entities, which in turn needs a mutual authentication of the entities. In this paper, we introduce a novel approach supplying zero-knowledge and identity-based authentication with integrated key exchange while meeting the IoT challenges. Our approach is resistant to active man in the middle attacks and does not include any costly cryptographic operations. Also, it does not require any predistribution or pre-sharing with regard to authenticating entities. Additionally, our identity-based scheme allows that a thing can operate autonomously in a secure manner. Furthermore, this scheme provides application-independence without requiring additional components and procedures. After discussing our approach, this paper also presents our prototype implementation and its evaluation.