# Security Analysis of a Lightweight Identity-Based Two-Party Authenticated Key Agreement Protocol for IIoT Environments

Authors: Yuting Li; Qingfeng Cheng; Wenbo Shi
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Internet of Things brings convenience to the social life, at the same time, putting forward higher requirements for the security of data transmission and storage. Security incidents based on industrial Internet of Things have occurred frequently recently, which should be given full consideration. The identity-based authenticated key agreement protocol can solve these security threats to a certain extent. Recently, a lightweight identity-based authenticated key agreement protocol for Industrial Internet of Things, called ID-2PAKA protocol, was claimed to achieve secure authentication and meet security properties. In this paper, we show that the ID-2PAKA protocol is insecure in identity authentication and cannot resisting ephemeral key compromise impersonation attack.


---

## Body

## 1. Introduction

The application field of the Internet of Things is very extensive, especially in the industry [1]. As increasingly more devices such as sensors are connected together [2], related industries are getting closer and integrated with the Industrial Internet of Things (IIoT). IIoT can be regarded as a high degree of integration of industrial automation systems and IoT systems. With the explosive growth of industrial information, the large amount of data generated in the industrial production is a challenge for IIoT. How to effectively process, analyze, and record these data, and extract the results of guiding suggestions for industrial production, is the core difficulty of IIoT [3].The system architecture of IIoT is shown in Figure1. The perception layer is composed of widely deployed physical devices (such as sensors, actuators, manufacturing equipment, facility utilities, and other industrial manufacturing and automation related objects) and is responsible for real-time collection of industrial environment and production resource data. The network layer makes short-distance access and long-distance transmission of perception data a reality, while the data processing layer is for fully mining and utilizing the aggregated perception data. The application layer is composed of various industrial applications, including smart factories and smart supply chains. These intelligent industrial applications utilize numerous sensors and actuators to achieve real-time monitoring, precise control, and effective management.Figure 1
IIoT system architecture.With attendant, incidents based on IIoT security have occurred frequently recently. For intruders, attacks on IIoT systems can attract more attention or get more than attacks on IoT systems in other industries. Attackers have adopted a variety of intrusion methods, such as the leakage of industrial key data, and the illegal hijacking and manipulation of interconnected terminals [4]. The IIoT relies on modern and mature industrial automation systems and integrates a large number of technologies and applications from the fields of communications and computers. The wide application of the IoT puts forward more strict security requirements for data transmission and storage. Therefore, some traditional network attack methods are also suitable for IIoT systems. A large number of attacks have occurred in the past few years. Exposing the various hidden dangers of IIoT in terms of information security is a major obstacle to the rising trend of IoT.Specifically, the security threats faced by IIoT can be divided into two categories, namely, the hidden dangers of the internal structure of IIoT and the hidden dangers of external network attacks. Among them, attacks against external networks have the characteristics of wide coverage, multiple levels, and diverse attack methods. The solutions to these security problems usually use a mixture of computing, encryption, image processing, and identity authentication.Applying cryptography to network communication can solve these security threats to a certain extent. Cryptography realizes the encryption, decryption, user identity authentication, key agreement, and privacy protection of important information through strict mathematical theories. It is one of the important means to protect communication security. The key agreement protocol is an important branch of cryptography, which refers to the rule that two or more parties in communication negotiate a symmetric encryption key on a common channel before formal communication. The key agreement protocol determines the security of the symmetric encryption key and thus determines the information security of the communication participants. Therefore, the study of session key agreement protocol can strengthen the security of the network to a certain extent, and it is of great significance to the protection of personal privacy and commercial interests.Traditional key agreement protocols use certificates to authenticate the participants of the protocol, which are easy to be forged and tampered with. Therefore, the traditional session key agreement protocol still has certain deficiencies in security. The identity-based authenticated key agreement (ID-AKA) protocol integrates identity authentication into the key agreement process, avoiding the use of digital certificates and improving the security of the key agreement protocol [5, 6]. According to whether bilinear pairing is used in the ID-AKA protocol, it can be divided into the ID-AKA protocol based on bilinear pairing and the ID-AKA protocol without bilinear pairing. Although the ID-AKA protocol without bilinear pairing has an advantage over the ID-AKA protocol based on bilinear pairing in terms of computational efficiency, the ID-AKA protocol without bilinear pairing is not satisfactory in terms of security [7]. Bilinear pairing operation is a computationally intensive operation, so ID-AKA protocol based on bilinear pairing has obvious shortcomings in computational efficiency. This affects the comprehensive performance of the ID-AKA protocol based on bilinear pairs and also seriously affects its practical application range [8].In this paper, we analyze the ID-2PAKA protocol for IIoT environments from [9] in terms of a security perspective and discover some insecure threats. When the protocol is analyzed, it is insecure in terms of identity authentication. Moreover, there were some threats in resistance to ephemeral key compromise impersonation attack.The organization of this paper is arranged as follows. Related works are firstly introduced inSection 2. Then, we briefly review the ID-2PAKA protocol in Section 3. Furthermore, Section 4 points out the weaknesses of the ID-2PAKA protocol. Conclusion will be given in Section 5.


## 2. Related Work

In recent years, cyberattacks against industrial IoT systems have emerged one after another, showing a continuous upward trend. The security issues of industrial IoT systems have attracted great attention in the information security industry.In view of the security issues of the IoT, a large number of security mechanisms have been proposed [10, 11], especially the wireless sensor network as an important supporting technology of IoT. In [12], in response to the vulnerability of wireless sensor network nodes and limited resources, Zhou and Xiong propose a lightweight smart card-based wireless sensor network user authentication scheme, which is based on random values as temporary keys. Through the request-response handshake mechanism to ensure the two-way authentication between the user and the gateway node, this solution avoids the problem of asynchrony between the smart card and the gateway node. The literature [13] presents a two-factor authentication protocol that provides a powerful authentication and session key establishment process. The protocol resists the threat of multiple users logging in with the same identity. The authentication process does not require public key operations, and it uses a cryptographic hash function to achieve higher efficiency.The literature [14] proposes a new method adapted to resource-constrained wireless sensor networks. Only legitimate users can access node resources, and illegal users are denied access. The solution is based on ID technology and elliptic curve cryptosystem (ECC), which provides mutual authentication and key agreement processes between users and nodes. In [15], Liu et al. analyze the wireless sensor network in the perception layer of the IoT and propose an identity authentication scheme for the wireless sensor network. The scheme uses ECC, protecting the data confidentiality and integrity of the perception layer of the IoT. However, this scheme only protects the data security of the perception layer of the IoT system and does not protect the IoT terminal devices at the perception layer.At present, many key agreement protocols for the IoT environment pay more attention to lightweight requirements [16, 17]. In 2016, Farash et al. [18] improved the key agreement protocol based on heterogeneous sensor network proposed by Turkanovic. The improved version can strengthen the security level. Srinivas et al. [19] proposed a chaotic mapping-based key agreement protocol for IIoT environment. However, the author uses a weaker model to prove the protocol; thus, there is still room for further improvement in the security of the protocol.In addition to the traditional key agreement protocol, some other methods have also been introduced into the field of IIoT security protection. Recently, Xiong et al. [20] combined data encryption with game theory, designing a personalized privacy protection framework. The advantage is to find a reasonable balance between retaining quality of crowdsensing services and privacy. Besides, in order to solve the key management problem of dynamic wireless sensor networks in IIoT, Tian et al. [21] presented a key management scheme based on blockchain. This scheme used stake blockchain to replace the base station to implement key management, avoiding the security threats of untrusted base stations. The summary of literature studies is given in Table 1.Table 1
The summary of literature studies.
Literature studiesDescriptionApplication[10, 11]Security mechanismsFor wireless sensor networks[12]A lightweight smart card-based authentication schemeFor wireless sensor networks[13]A two-factor authentication protocolFor wireless sensor networks[14]Uses ID technology and elliptic curve cryptosystemFor resource-constrained wireless sensor networks[15]Protects the data securityFor the perception layer[16, 17]Key agreement protocolsFor lightweight IoT environment[18]An improved key agreement protocolFor heterogeneous sensor network[19]Uses chaotic mappingFor IIoT environment[20]Combines data encryption with game theoryFor privacy protection in IIoT[21]Uses stake blockchainFor dynamic wireless sensor networks


## 3. Review of ID-2PAKA Protocol

A brief introduction of ID-2PAKA protocol will be given in this section. It consists of three phases: setup phase, private-key generation phase, and session key agreement phase. The notations and the corresponding meanings used in ID-2PAKA protocol are shown in Table2.Table 2
The notations.
NotationsMeaningskSecurity parameterG1An additive cyclic groupG2A multiplicative groupqThe prime order ofG1 and G2pThe generator ofG1s0The master private keyP0The master public keyHii=1,2The secure hash functionsPii=1,2The usersThere are three entities participating in ID-2PAKA protocol: the initiatorP1, the responder P2, and the PKG. Among them, the PKG is only responsible for generating the identity-based private key of Pii=1,2. Other details can be depicted in the following subsections.


### 3.1. Setup Phase

In setup phase, the PKG generates the system parameters according the security parameterk:(1)
With a given security parameterk, the PKG chooses a prime number q greater than 2k, then generates an additive cyclic group G1, and a multiplicative group G2 of order q. The generator of G1 is P.(2)
The PKG chooses a bilinear mape:G1×G1⟶G2.(3)
The PKG chooses two one-way hash functionsHii=1,2:0,1∗⟶0,1q.(4)
The PKG randomly chooses a master private keys0∈Zq∗ and computes the master public key P0=s0P.(5)
The system parameters are set asq,G1,G2,P,e,H1,H2,P0, public to all entities.


### 3.2. Private-Key Generation Phase

In this phase, the identity-based private keys and the corresponding public keys ofPii=1,2 are generated by the PKG. The main details are shown in Figure 2:(1)
Pii=1,2 submits the identity IDii=1,2 to the PKG.(2)
The PKG first authenticates the legality ofIDii=1,2, then computes the public key qi=H1IDi and the identity-based private key Pri=s/s+qi.Figure 2
Private key generation phase.


### 3.3. Session Key Agreement Phase

This phase is executed between the initiatorP1 and the responder P2. The details are described in Figure 3:(1)
The initiatorP1 chooses a random number r1∈Zq∗, then computes ψ1=r1P and σ1=r1Pr1. Then, P1 sends the tuple ψ1,σ1 to the responder.(2)
After receivingψ1,σ1 from P1, the responder P2 chooses a random number r2∈Zq∗, then computes ψ2=r2P and σ2=r2Pr2. Finally, P2 sends the tuple ψ2,σ2 to P1.(3)
After receiving response ofP2, P1 first verifies whether the equation eσ2,P0+q2P=eψ2,P0 holds, where q2=H1ID2. If verified, P1 computes X=r1ψ2 and sets the session key as sk1=H2ID1‖ID2‖ψ1‖ψ2‖X.(4)
In the same way,P2 first verifies whether the equation eσ1,P0+q1P=eψ1,P0 holds, where q1=H1ID1. If verified, P2 computes X=r2ψ1 and sets the session key as sk1=H2ID1‖ID2‖ψ1‖ψ2‖X.Figure 3
Session key agreement phase.Remark.
The consistency of the computation is verified as(1)eσ1,P0+q1P=er1ss+q1P,s+q1P,=er1sP,P,=er1P,sP,=eψ1,P0,eσ2,P0+q2P=er2ss+q2P,s+q2P,=er2sP,P,=er1P,sP,=eψ1,P0.


## 3.1. Setup Phase

In setup phase, the PKG generates the system parameters according the security parameterk:(1)
With a given security parameterk, the PKG chooses a prime number q greater than 2k, then generates an additive cyclic group G1, and a multiplicative group G2 of order q. The generator of G1 is P.(2)
The PKG chooses a bilinear mape:G1×G1⟶G2.(3)
The PKG chooses two one-way hash functionsHii=1,2:0,1∗⟶0,1q.(4)
The PKG randomly chooses a master private keys0∈Zq∗ and computes the master public key P0=s0P.(5)
The system parameters are set asq,G1,G2,P,e,H1,H2,P0, public to all entities.


## 3.2. Private-Key Generation Phase

In this phase, the identity-based private keys and the corresponding public keys ofPii=1,2 are generated by the PKG. The main details are shown in Figure 2:(1)
Pii=1,2 submits the identity IDii=1,2 to the PKG.(2)
The PKG first authenticates the legality ofIDii=1,2, then computes the public key qi=H1IDi and the identity-based private key Pri=s/s+qi.Figure 2
Private key generation phase.


## 3.3. Session Key Agreement Phase

This phase is executed between the initiatorP1 and the responder P2. The details are described in Figure 3:(1)
The initiatorP1 chooses a random number r1∈Zq∗, then computes ψ1=r1P and σ1=r1Pr1. Then, P1 sends the tuple ψ1,σ1 to the responder.(2)
After receivingψ1,σ1 from P1, the responder P2 chooses a random number r2∈Zq∗, then computes ψ2=r2P and σ2=r2Pr2. Finally, P2 sends the tuple ψ2,σ2 to P1.(3)
After receiving response ofP2, P1 first verifies whether the equation eσ2,P0+q2P=eψ2,P0 holds, where q2=H1ID2. If verified, P1 computes X=r1ψ2 and sets the session key as sk1=H2ID1‖ID2‖ψ1‖ψ2‖X.(4)
In the same way,P2 first verifies whether the equation eσ1,P0+q1P=eψ1,P0 holds, where q1=H1ID1. If verified, P2 computes X=r2ψ1 and sets the session key as sk1=H2ID1‖ID2‖ψ1‖ψ2‖X.Figure 3
Session key agreement phase.Remark.
The consistency of the computation is verified as(1)eσ1,P0+q1P=er1ss+q1P,s+q1P,=er1sP,P,=er1P,sP,=eψ1,P0,eσ2,P0+q2P=er2ss+q2P,s+q2P,=er2sP,P,=er1P,sP,=eψ1,P0.


## 4. Security Analysis of ID-2PAKA Protocol

There are some security vulnerabilities in the proposed ID-2PAKA protocol that cannot be ignored, which will be introduced in detail in this subsection. The security analysis of ID-2PAKA protocol in this paper is based on the theory of eCK model, which is mainly composed of Ephemeral Key Compromise Impersonation Attack and Secure Authentication.In the idea of eCK model, we can consider the security of the scheme from the perspective of leaking any two keys, except for leaking the long-term private key and temporary private key of a communicating party at the same time. The security analysis of ID-2PAKA protocol is given as follows.


### 4.1. Ephemeral Key Compromise Impersonation Attack

After analysis, when the ephemeral keysr1 and r2 of both communicating parties are leaked, the adversary A can recover the corresponding session key according to the leaked messages. Thus, ID-2PAKA protocol cannot resist ephemeral key compromise impersonation attack. The details are described in the following.In the case thatr1,r2 are known to A and q,G1,G2,P,e,H1,H2,P0 are public to all entities, so that A can compute ψ1=r1P, ψ2=r2P and X=r1r2P. The session key is computed as sk1=H2ID1‖ID2‖ψ1‖ψ2‖X. In this way, the adversary can easily compute the vital session key without having to do any modification or insertion operations.


### 4.2. Secure Authentication

In addition to the ephemeral key compromise impersonation attack, the ID-2PAKA protocol is also insecure in terms of identity authentication. The verification of either party to the other is based on the equationeσ1,P0+q1P=er1S/s+q1P,s+q1P. However, the equation is essentially established by relying on the ephemeral key r1. The processes of disguising P1 and P2 and completing the session key agreement phase are described below.IfA pretends to be P1, she first chooses r1′∈Zq∗, then computes ψ1′=r1′P0+r1′q1P and σ1′=r1′P0, finally sends the tuple ψ1′,σ1′ to the responder. The responder P2 verifies the equation eσ1′,P0+q1P=eψ1′,P0. The correctness is as follows:(2)eσ1′,P0+q1P=er1′P0,P0+q1P,=er1′sP,s+q1P,=er1′s+q1P,sP,=eψ1′,P0.In the same way,A can pretend to be P2. First, A chooses r2′∈Zq∗, then computes ψ2′=r2′P0+r2′q2P and σ2′=r2′P0, finally sends the tuple ψ2′,σ2′ to the initiator. The initiator P1 verifies the equation eσ2′,P0+q2P=eψ2′,P0. The correctness is as follows:(3)eσ2′,P0+q2P=er2′P0,P0+q2P,=er2′sP,s+q2P,=er2′s+q2P,sP,=eψ2′,P0.


## 4.1. Ephemeral Key Compromise Impersonation Attack

After analysis, when the ephemeral keysr1 and r2 of both communicating parties are leaked, the adversary A can recover the corresponding session key according to the leaked messages. Thus, ID-2PAKA protocol cannot resist ephemeral key compromise impersonation attack. The details are described in the following.In the case thatr1,r2 are known to A and q,G1,G2,P,e,H1,H2,P0 are public to all entities, so that A can compute ψ1=r1P, ψ2=r2P and X=r1r2P. The session key is computed as sk1=H2ID1‖ID2‖ψ1‖ψ2‖X. In this way, the adversary can easily compute the vital session key without having to do any modification or insertion operations.


## 4.2. Secure Authentication

In addition to the ephemeral key compromise impersonation attack, the ID-2PAKA protocol is also insecure in terms of identity authentication. The verification of either party to the other is based on the equationeσ1,P0+q1P=er1S/s+q1P,s+q1P. However, the equation is essentially established by relying on the ephemeral key r1. The processes of disguising P1 and P2 and completing the session key agreement phase are described below.IfA pretends to be P1, she first chooses r1′∈Zq∗, then computes ψ1′=r1′P0+r1′q1P and σ1′=r1′P0, finally sends the tuple ψ1′,σ1′ to the responder. The responder P2 verifies the equation eσ1′,P0+q1P=eψ1′,P0. The correctness is as follows:(2)eσ1′,P0+q1P=er1′P0,P0+q1P,=er1′sP,s+q1P,=er1′s+q1P,sP,=eψ1′,P0.In the same way,A can pretend to be P2. First, A chooses r2′∈Zq∗, then computes ψ2′=r2′P0+r2′q2P and σ2′=r2′P0, finally sends the tuple ψ2′,σ2′ to the initiator. The initiator P1 verifies the equation eσ2′,P0+q2P=eψ2′,P0. The correctness is as follows:(3)eσ2′,P0+q2P=er2′P0,P0+q2P,=er2′sP,s+q2P,=er2′s+q2P,sP,=eψ2′,P0.


## 5. Conclusions

Secure communication is a vital point in IIoT environment, which should be given full consideration. There are many ID-AKA protocols for IIoT environments suffer from a variety of attacks. ID-AKA protocols based on bilinear pairing have advantage in terms of security. In this paper, we analyze the ID-2PAKA protocol, which is a lightweight identity-based authenticated key agreement protocol for industrial Internet of Things proposed by Gupta et al. recently. The analysis results show that the ID-2PAKA protocol cannot obtain the secure identity authentication or resist ephemeral key compromise impersonation attack. The main reason for this situation is that there are some security flaws in the misusage of ephemeral key and long-term private key.



---

*Source: 5573886-2021-02-28.xml*