# A Secure IoT-Based Authentication System in Cloud Computing Environment
###### Abstract  
The Internet of Things (IoT) is currently the most popular field in communication and information techniques. However, designing a secure and reliable authentication scheme for IoT-based architectures is still a challenge. In 2019, [PERSON] et al. showed that schemes pro-posed by [PERSON] et al. and [PERSON] et al. are vulnerable to off-line guessing attacks, user tracking attacks, etc. On this basis, a lightweight authentication scheme based on IoT is proposed, and an authentication scheme based on IoT is proposed, which can resist various types of attacks and realize key security features such as user audit, mutual authentication, and session security. However, we found weaknesses in the scheme upon evaluation. Hence, we proposed an enhanced scheme based on their mechanism, thus achieving the security requirements and resisting well-known attacks. Internet of things (IoT); lightweight authentication; user anonymity; cloud computing +
Footnote †: journal: Computer Science  
0000-0001-5000-0000-0000-0000-0000-0000-0000-  
Asymmetric encryption uses pairs of keys, i.e., public key and private key. Although, asymmetric encryption is generally considered to have higher security, it requires a higher computational cost. On the other hand, common symmetric encryption, e.g., the advanced encryption standard (AES) and data encryption standard (DES), use a shared key between two or more parties. Symmetric encryption has the advantages of low computational cost and fast encryption speed. Some authentication schemes have been recently presented by using asymmetric encryptions [3; 4; 5; 6; 7; 8; 9; 10]. However, traditional asymmetric encryptions do not suit IoT devices due to limited resources of most IoT devices, which gives rise to lightweight authentication schemes [11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21]. To solve security disadvantages, many lightweight authentication schemes have been proposed. In 1981, [PERSON] [22] first suggested lightweight authentication using a password. The scheme also uses hash chains to go through unsafe communication channel for remote user authentication. However, the scheme relies on a password table, which makes it very easy to steal personal data. After that, many user authentications with a password and key negotiation techniques have been put forward [23; 24; 25; 26; 27; 28; 29; 30]. In 2007, [PERSON] et al. [31] proposed an authentication scheme based on a hash function for a multi-server environment. Further, [PERSON] et al. [32] pointed out that [PERSON] et al. 's scheme [31] is subject to multiple security threats, e.g., insider attack, masquerade attack, and user/server forgery attacks. [PERSON] et al. [32] then proposed a new authentication scheme and claimed their scheme has fewer computations and higher security. In 2011, [PERSON] et al. [33] proposed an authentication scheme using a dynamic identity for multi-server circumstances and criticized [PERSON] et al. 's scheme [32] for having a wrong password change phase and not resisting replay and impersonation attacks. In the same year, [PERSON] et al. [34] assessed [PERSON] et al. 's programme [33] and concluded that it was not safe. In 2014, [PERSON] et al. [35] pointed out that [PERSON] et al. 's scheme [34] failed under the circumstances of pseudonym attack and offline password guessing attack. Later, [PERSON] et al. [36] criticized the scheme in [35], saying that it lacked identity hiding features and could not resist offline password guessing attack. Recently, some authentication schemes are also used in vehicular ad-hoc networks (VANETs) [37; 38; 39; 40] or smart grid [41]. It shows the universality of authentication. In 2019, [PERSON] and other [42] proposed their scheme based on a hash function and exclusive or operation of the two-factor authentication scheme, claiming their authentication scheme has been proven safe and could resist various attacks. We reviewed the scheme of [PERSON] et al.