# A Survey of Internet of Things (IoT) Authentication Schemes +
## 5 Analysis of IoT Authentication Schemes
### Generic IoT Applications  
The authors of [134] provided a protocol for performing authentication between a user and a server, and not between end devices. It is a two-step verification to IoT devices. A password or a shared secret key is considered as the first authentication factor and the use of PUF as the second authentication factor. Due to the large number of devices wishing to access the network which leads to an overload for the authenticating server and in order to achieve mutual authentication and secure key management for resource-constrained devices, the authors in [135] provided a group-based lightweight authentication and key agreement scheme called GLARM. GLARM is composed of two fundamental stages: an identification stage and, a group authentication and key-agreement stage based on a combination of message authentication code of a group of devices to be authenticated. In [136], the authors proposed a lightweight device authentication protocol for IoT systems named speaker-to-microphone (S2M). This scheme achieves distance authentication between wireless IoT devices. Is is implemented in both mobile phones and PC to check its experimental results. The author of [137] provided a new hardware-based approach, using a hardware fingerprint to authenticate IoT device with its Physical Unclonable Functions (PUF). The author presented the machine learning based attacks on PUF leading to the creation of a software model of the PUF. The author of [138] presented an implementation of PUF-based algorithms for IoT device. They used PUF-based elliptic curve for device enrollment, authentication, decryption, and digital signature. The author fingered the environment variations under which the IoT devices will be operating and also the effects of aging in the usage of PUF by using error correction codes. They handled the machine-learning attacks by combining the PUF with the use of ECC to encrypt the generated key. In [139], the authors proposed an authentication mechanism which applies a modeling for the PUF to avoid storing the whole Challenge-Response Pairs (CRPs) or the retrieval of some CRPs during authentication or verification phases, and the model will be hidden by applying a symmetric encryption algorithm (AES) to avoid modeling-based attacks. The authors of [140] realized that a single-tier authentication is not adequate for services such as cloud computing. Thus, they proposed a multi-tier authentication scheme without the use of any extra software or hardware. In the first stage, user enters a simple username and password that is validated by the server on the cloud. In the second stage, user pursues a predetermined sequence on the virtual screen during the registration phase. In [141], the authors provided an authentication scheme to be used in cloud computing use cases. They divided the devices into two categories: registered and unregistered devices, and handled the authentication using two different approaches. The registered devices are authenticated using an authentication server. Firstly, the device is registered in the server, then a session key is generated by the server and sent encrypted using Advanced Encryption Standard (AES), to the device to be used for further communications. On the other hand, a cloud-based Software-as-a-Service (SaaS) using modified Diffie-Hellman (DH) algorithm is used to authenticate unregistered devices for accessing cloud services. Using password or smart cards as the only way of authentication for remote users is vulnerable to security attacks. Thus, the authors of [142] proposed a novel scheme by using a three-factor authentication. The fingerprint or iris-scan, the smart card, and a password to authenticate a user to remotely-based applications. Although traditional Public Key Infrastructure is considered heavy with respect to the computation and communication cost, the authors of [143; 144] presented a lightweight PKI to be implemented in IoT use cases. The authors of [145] presented an efficient transmission to ensure privacy of data sent.