PUF-Based Lightweight Group Authentication for Massive IoT Access With Insecure Channel

The massive access in Internet of Things (IoT) introduces significant communication and computation overheads. Besides, the widespread IoT terminals placed in unattended area and with limited capabilities are vulnerable to various attacks, such as physical attack. To alleviate the huge communication and computation overheads and to resist physical attacks, we propose a physically unclonable function (PUF)-based group authentication protocol in this article, where a prestored PUF challenge scheme with PUF acting as the root key is proposed to limit the size of signalings in a group. Different from existing work with assumptions on secure communication channels and trusted group leader (GL), we consider untrusted GL and insecure communication channels among the device, the GL, and the home network (HN) and propose a simplified PUF-based device-to-device authentication scheme to perform mutual authentication and key sharing between the devices and the untrusted GL. Finally, the proposed protocol is evaluated with formal security analysis, where a novel threat model is presented for the physical attacker to overhear the secret in device’s memory. Results show that the proposed protocol can achieve desired authentication and confidentiality goals even the GL is under physical attacks and the communication channels are insecure. Further, simulations are demonstrated to show the outperformance of the proposed protocol in communication overhead, computation overhead, and security, compared with baseline solutions.