Multi-factor Based User Authentication Scheme for Lightweight IoT Devices

Authentication of legitimate user plays a prominent role in security of the Internet of Things (IoT) applications like smart home, smart cities, wearable devices etc. The services offered by IoT devices must be attainable from anyplace and anytime, only by the legitimate users. The existing authentication schemes for IoT applications are not secure, vulnerable to many attacks and also any illegal user may access the data of smart devices. This paper presents an authentication scheme which uses only simple algebraic operations like hash and XOR, and this makes the proposed authentication scheme more suitable for the lightweight environment of IoT. It uses multiple factors like user identity, password, and biometrics for authenticating the legal users. Also, the proposed scheme establishes mutual authentication and key establishment between the users and smart devices involved in the communication. The protocol is modeled using the Security Protocol Description Language and the verification is done using one of the formal verification tools-Scyther. The result from the Scyther tool confirms the security of the protocol and clarifies that it is robust against various known attacks and are more affordable for practical applications.