Improved IoT Device Authentication Scheme Using Device Capability and Digital Signatures

Internet of Things (IoT) device authentication is weighed as a very important step from security perspective. Privacy and security of the IoT devices and applications is the major issue. From security perspective, important issue that needs to be addressed is the authentication mechanism, it has to be secure from different types of attacks and is easy to implement. The paper gives general idea about how different authentication mechanisms work, and then secure and efficient multi-factor device authentication scheme idea is proposed. The proposed scheme idea uses digital signatures and device capability to authenticate a device. In the proposed scheme device will only be allowed into the network if it is successfully authenticated through multi-factor authentication otherwise the authentication process fails and whole authentication process will restart. By analyzing the proposed scheme idea, it can be seen that the scheme is efficient and has less over head. The scheme not only authenticates the device very efficiently through multi-factor authentication but also authenticates the authentication server with the help of digital signatures. The proposed scheme also mitigates the common attacks like replay and man in the middle because of nonce and timestamp.

I. Introduction

The need to secure and protect the IT products and their solutions are increasing rapidly [1]. Security mechanisms are needed to be applied in order to maintain the security characteristics like confidentiality, integrity and availability are intact and data is secured from manipulation and reverse engineering [2]. The first thing that comes to mind when talking about implementing any security mechanism is authentication. By authentication, it means a claimant will need to prove its identity. There are different ways through which a person can be verified, e.g. a password (something known) an identity card, passport, chip (has something) or fingerprint, retina scan, behavior etc. (something a person is).