# Revisiting a Multifactor Authentication Scheme in Industrial IoT

Authors: Ding Wang; Shuhong Hong; Qingxuan Wang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Nowadays, as one of the key applications of Internet of Things, Industry IoT (IIoT) has recently received significant attention and has facilitated our life. In IIoT environments, an amount of data generally requires to be transmitted between the user and sensing devices in an open channel. In order to ensure safe transmission of these data, it is necessary for the user and sensing devices to authenticate each other and establish a secure channel between them. Recently, a multifactor authenticated key agreement scheme for IIoT was proposed, which aims to tackle this problem and provide solutions for user multiple sensing devices’ access. This work claims that the proposed scheme is secure against vario us attacks and has less communication and computational costs than other existing related schemes. Unfortunately, we find that this scheme cannot resist smart card attack and sensing device capture attack. Furthermore, we show that this scheme fails to provide forward secrecy, which is essential for a secure multifactor authentication scheme.


---

## Body

## 1. Introduction

Internet of Things (IoT) has developed rapidly in recent years, which generally penetrates into people’s life, and there are many IoT devices applied to various domains [1, 2]. Due to the superiority in automatic monitoring, efficient control, and intelligent manufacturing, Industry IoT (IIoT) is widely concerned among these domains. In the IIoT environment, sensing devices can be accessed and controlled by users remotely. During the process of production, sensing devices collect the real-time data, and the data can be obtained by users. The network model for IIoT is described in Figure 1. As a security critical system, IIoT has higher requirements in the secure transmission and communication of data [3, 4]. However, it is vulnerable to an attacker to perform attacks because the collected data is often transmitted through a public channel, and this brings security problems in the IIoT environment. It is possible for an adversary to launch attacks and impersonate an authorized user to obtain the data by accessing sensing devices. The unsatisfactory situation mentioned above will lead to destruction of the industrial production.Figure 1
Network model for IIoT.Therefore, in order to ensure the safe data transmission between users and sensing devices, many authenticated key agreement schemes [5–7] in IIoT are proposed. In these schemes, users are only allowed to access one sensing device at a time. When the user accesses multiple devices, his identity must be validated repeatedly. While supporting the critical security features, such as shared session key establishment and user authentication, an authentication scheme for IIoT environments should also be able to reduce the communication and computational costs due to the resource-constrained nature of IoT devices.Recently, Vinoth et al. [8] proposed a multifactor authenticated key agreement scheme for the IIoT environment, aiming to support the authorized user remotely accessing multiple sensing devices. They claimed that their scheme is suitable for the resource-constrained IIoT and has less cost during communication and computation processes. Besides, they demonstrated the security of the proposed scheme through a formal security analysis, which indicates that their scheme is resistant to various known attacks. Unfortunately, some subtleties are overlooked. In this paper, we find that their scheme cannot resist the smart card attack and the sensing device capture attack. Furthermore, we point out that their scheme cannot support forward secrecy. Although the scheme is a multifactor authentication mechanism designed by Vinoth et al., we do not think it can provide truly multifactor security.


## 2. Revisiting Vinoth et al.’s Scheme

In this section, we first revisit Vinoth et al.’s scheme [8] briefly and list some intuitive notations and abbreviates in Table 1 for the convenience of description. Their scheme includes six phases, while we only review the first three phases, which are related to our proposed attacks.Table 1
Notations and abbreviations.
SymbolDescriptionGWNGateway nodeIDGWNGWN’s identityUiandSDjith user and jth sensing deviceIDiandIDSDjUi’s and SDj’s identity, respectivelyrGWNA random noncePWiandBiUi’s password and biometricsBKiandτiUi’s biometrics key and public reproduction parameterGen⋅and Rep⋅Generation and reproduction algorithm of fuzzy extractor, respectivelyTSiCurrent timestampΔTSMaximum transmission delayKEYGWN−UiSymmetric key betweenUi and GWNSKSession key between the user and sensing devicesSSecret value utilized for secret sharingsj,fj,andkjSDj’s secret parametersh⋅Hash function⊕and‖Concatenation and bit-wise XOR operation


### 2.1. Offline Sensing Devices’ Registration Phase

Each sensing deviceSDj is registered by GWN in offline and is distributed a unique identity IDSDj. In order to calculate the secret, GWN chooses a secret value S and two vectors Vector1 and Vector2. Assume that S=Vector1⋅x0 and S2=Vector2⋅x0. GWN then computes sj=Vector1⋅xjandfj=Vector2⋅xj and picks pair-wise relative positive numbers k1,…,kn for each sensing device SDj. GWN computes Mul=∏j=1nkj and Mulj=Mul/kj. Then, GWN generates a random nonce Noncej, which satisfies Mulj×Noncej≡1modkj. GWN calculates γ as γ=∑j=1nVarj=∑j=1nMulj×Noncej and stores it. GWN sends IDSDj,sj,fj,kj to each sensing device.


### 2.2. User Registration Phase

(1)
Step URP1:Ui chooses a high-entropy password PWi and an identity IDi. Ui imprints the biometrics Bi and uses the generation algorithm to calculate BKi,τi=GenBi. It notes that the algorithm is built into the fuzzy extractor. Ui generates a 128-bit random nonce a and computes TPWi as TPWi=hIDi‖PWi‖BKi⊕a. Finally, Ui sends a message IDi,TPWi to GWN.(2)
Step URP2: after receiving the messageIDi,TPWi, GWN generates a 1024-bit random secret key KEYGWN and further calculates KEYGWN−Ui=hIDi‖KEYGWN. Then, GWN calculates Ai as Ai=KEYGWN−Ui⊕TPWi and Ci as Ci=IDGWN⊕TPWi. In addition, for each user Ui, GWN generates a 128-bit identity TIDi. Finally, GWN generates the smart card SCi and sends SCi to Ui.(3)
Step URP3: after receivingSCi, in order to protect Ai, Ui calculates RPWi=hIDi‖PWi‖BKiandAi′=Ai⊕TPWi⊕RPWi. Ui then computes Di=a⊕hIDi‖BKi and Ci′=Ci⊕TPWi⊕hIDi‖BKi. Ui further calculates Vi=hRPWi‖Ai‖a‖hIDi‖BKimodω. Finally, Ui needs to store TIDi,Ai′,Ci′,Di,Vi,Gen⋅,τi,ω,Rep⋅,h⋅ into the memory.


### 2.3. Authenticated Key Agreement Phase

This phase includes the following steps. This phase along with the login phase is summarized in Table2.(1)
Step AKAP1: after receiving the messageTIDi,M1,M2,TS1, GWN firstly verifies whether TS1−TS1′≤ΔTS to check the freshness of login request. If it is true, GWN obtains IDi and KEYGWN−Ui corresponding to TIDi by retrieving the database. GWN calculates ri∗=M1⊕KEYGWN−Ui, M3=hTIDi‖M1‖IDGWN‖ri∗‖TS1. In order to authenticate the authenticity of Ui, GWN checks whether M3 is equal to M2. If it holds, GWN generates the current timestamp TS2 and a random nonce rGWNrGWN≤minkj. GWN calculates M4 as M4=rGWN×γ to securely send rGWN to each sensing device. Then, GWN calculates M5=EncrGWNIDi,IDGWN,ri∗,rGWN⊕KEYGWN−Ui to encrypt the parameters. After that, GWN computes M6=hIDi‖IDGWN‖ri∗‖M4‖TS2Vert‖KEYGWN−Ui to help sensing device SDj authenticate GWN. Finally, GWN broadcasts the message M4,M5,M6,TS2 via a public channel.(2)
Step AKAP2: after receiving the broadcast message fromGWN, each sensing device SDj verifies TS2−TS2′≤ΔTS to check the freshness of the message firstly. If the inequality holds, SDj uses CRT to obtain rGWN∗=M4modkj by its stored value kj. SDj then uses the group key rGWN∗ to decrypt M5 to attain the sensitive parameter IDi,IDGWN,ri∗,andrGWN⊕KEYGWN−Ui. SDj further calculates M7=hIDi‖IDGWN‖ri∗‖M4‖KEYGWN−Ui⊕rGWN⊕rGWN∗‖TS2 with the condition M7=M6 to verify GWN. If it is true, each SDj computes M8=EncrGWN∗IDSDj,sjfj to encrypt the legal share sjandfj and generates the current timestamp TS3. Then, each sensing device SDj sends the reply message M8,TS3 to GWN securely.(3)
Step AKAP3: when receiving the message,GWN firstly verifies TS3−TS3′≤ΔTS to check the freshness of the message. If it holds, GWN obtains share sjandfj by calculating DecrGWN∗M8=IDSDj,sj,fj. GWN further computes θ1=∑t=1lλtst and θ2=∑t=1lλtft and checks whether θ12=θ2. If it holds, GWN can reconstruct the secret successfully. Then, GWN computes M9=hS‖rGWN, M10=M9×γ,M11=hM9‖M10, and M12=EncKEYGWN−UirGWN,ri∗,M9. GWN then generates the current timestamps TS4 and a new temporal identity TIDinew and calculates M13=hIDi‖KEYGWN−Ui‖TS4⊕TIDinewandM14=hM12‖M9‖ri∗. Finally, GWN broadcasts the message M10,M11 to all the participants and sends the message M12,M13,M14,TS4 to Ui.(4)
Step AKAP4: when receiving the messageM10,M11 from GWN, each sensing device SDj calculates M9∗=M10modkj and M15=hM9∗‖M10. If M15=M11, each device SDj calculates SK as SK=hIDi‖IDGWN‖rGWN∗‖ri∗‖M9∗‖KEYGWN−Ui. GWN validates the shared session key by computing M16=hSK‖IDGWN‖IDi and sends it to Ui.(5)
Step AKAP5: after receiving the message,Ui firstly verifies TS4−TS4′≤ΔTS to check the freshness of the message. If it holds, Ui computes DecKEYGWN−UiM12=rGWN∗,ri∗,M9∗∗. Then, Ui checks whether ri∗=ri to validate the session consistency. If it holds, Ui computes M17=hM12‖M9∗∗‖ri. If M17=M14, Ui further calculates SK∗ as SK∗=hIDi‖IDGWN‖rGWN∗‖ri‖M9∗∗‖KEYGWN−Ui with sensing devices. Ui calculates M18=hSK∗‖IDGWN‖IDi after receiving the message from the sensing device and checks whether M18=M16. If it holds, Ui needs to change TIDinew=hIDi‖KEYGWN−Ui‖TS4⊕M13.Table 2
Login and authenticated key agreement phase.
UserUiGatewayGWNSensingdeviceSDjL1InsertSCi to card reader. Input IDi,PWi, and Bi∗. Compute BKi∗=RepBi∗,τi, RPWi∗=hIDi‖PWi‖BKi∗, a∗=Di⊕hIDi‖BKi∗, Ai∗=Ai′⊕a∗, and Vi∗=hRPWi∗‖Ai∗‖a∗‖hIDi‖BKi∗modωV1Check whetherTS1−TS1′≤ΔTS. If so, extract IDiandKEYGWN−Ui. Compute ri∗=M1⊕KEYGWN−Ui and M3=hTIDi‖M1‖IDGWN‖ri∗‖TS1. Check whether M3=M2; if so, generate a random nonce rGWN and timestamps TS2. Compute M4=rGWN×γ, M5=EncrGWNIDi,IDGWNri∗,rGWN⊕KEYGWN−Ui, and M6=hIDi‖IDGWN‖ri∗‖M4‖KEYGWN−Ui‖TS2, →openchannelM4,M5,M6,TS2V2Check whetherTS2−TS2′≤ΔTS. If so, compute rGWN∗=M4modkj, IDi,IDGWN,ri∗,rGWN⊕KEYGWN−Ui=DecrGWN∗M5, and M7=hIDi‖IDGWN‖ri∗‖M4‖KEYGWN−Ui⊕rGWN⊕rGWN∗‖TS2 Check whether M7=M6; if so, generate a timestamp TS3. Compute M8=EncrGWN∗IDSDj,sjfj, ←openchannelM8,TS3L2Check whetherVi=Vi∗, if so, generate a random nonce ri and timestamps TS1. Calculate, IDGWN∗=Ci′⊕hIDi‖BKi∗, M1=Ai′⊕RPWi∗⊕ri, M2=hTIDi‖M1‖IDGWN∗‖ri‖TS1→openchannelM4,M5,M6,TS2V3Check whetherTS3−TS3′≤ΔTS; if so, compute IDSDj,sj,fj=DecrGWN∗M8, θ1=∑t=1lλtst, and θ2=∑t=1lλtft. Check whether θ12=θ2; if so, return θ1 as S. Compute M9=hS‖rGWN, M10=M9×γ, and M11=hM9‖M10. Generate a temporal identity TIDinew and timestamp TS4. Compute M12=EncKEYGWN−UirGWN,ri∗,M9, M13=hIDi‖KEYGWN−Ui‖TS4⊕TIDinew, and M14=hM12‖M9‖ri∗. →openchannelM10,M11←openchannelM12,M13,M14,TS4V4ComputeM9∗=M10 and M15=hM9∗‖M10. Check if M15=M11; if so, compute SK=hIDi‖IDGWN‖rGWN∗‖ri∗‖M9∗‖KEYGWN−Ui and M16=hSK‖IDGWN‖IDi←openchannelM16V5Check whetherTS4−TS4′≤ΔTS if so, compute rGWN∗,ri∗,M9∗∗=DecKEYGWN−UiM12; check whether ri∗=ri; if so, compute M17=hM12‖M9∗∗‖ri. Check whether M17=M14; if so, compute SK∗=hIDi‖IDGWN‖rGWN∗‖ri‖M9∗∗‖KEYGWN−Ui and M18=hSK∗‖IDGWN‖IDi. Check whether M16=M18; if so, the session key is established successfully. Compute TIDinew=hIDi‖KEYGWN−Ui‖TS4⊕M13. Update TIDi with TIDinew


## 2.1. Offline Sensing Devices’ Registration Phase

Each sensing deviceSDj is registered by GWN in offline and is distributed a unique identity IDSDj. In order to calculate the secret, GWN chooses a secret value S and two vectors Vector1 and Vector2. Assume that S=Vector1⋅x0 and S2=Vector2⋅x0. GWN then computes sj=Vector1⋅xjandfj=Vector2⋅xj and picks pair-wise relative positive numbers k1,…,kn for each sensing device SDj. GWN computes Mul=∏j=1nkj and Mulj=Mul/kj. Then, GWN generates a random nonce Noncej, which satisfies Mulj×Noncej≡1modkj. GWN calculates γ as γ=∑j=1nVarj=∑j=1nMulj×Noncej and stores it. GWN sends IDSDj,sj,fj,kj to each sensing device.


## 2.2. User Registration Phase

(1)
Step URP1:Ui chooses a high-entropy password PWi and an identity IDi. Ui imprints the biometrics Bi and uses the generation algorithm to calculate BKi,τi=GenBi. It notes that the algorithm is built into the fuzzy extractor. Ui generates a 128-bit random nonce a and computes TPWi as TPWi=hIDi‖PWi‖BKi⊕a. Finally, Ui sends a message IDi,TPWi to GWN.(2)
Step URP2: after receiving the messageIDi,TPWi, GWN generates a 1024-bit random secret key KEYGWN and further calculates KEYGWN−Ui=hIDi‖KEYGWN. Then, GWN calculates Ai as Ai=KEYGWN−Ui⊕TPWi and Ci as Ci=IDGWN⊕TPWi. In addition, for each user Ui, GWN generates a 128-bit identity TIDi. Finally, GWN generates the smart card SCi and sends SCi to Ui.(3)
Step URP3: after receivingSCi, in order to protect Ai, Ui calculates RPWi=hIDi‖PWi‖BKiandAi′=Ai⊕TPWi⊕RPWi. Ui then computes Di=a⊕hIDi‖BKi and Ci′=Ci⊕TPWi⊕hIDi‖BKi. Ui further calculates Vi=hRPWi‖Ai‖a‖hIDi‖BKimodω. Finally, Ui needs to store TIDi,Ai′,Ci′,Di,Vi,Gen⋅,τi,ω,Rep⋅,h⋅ into the memory.


## 2.3. Authenticated Key Agreement Phase

This phase includes the following steps. This phase along with the login phase is summarized in Table2.(1)
Step AKAP1: after receiving the messageTIDi,M1,M2,TS1, GWN firstly verifies whether TS1−TS1′≤ΔTS to check the freshness of login request. If it is true, GWN obtains IDi and KEYGWN−Ui corresponding to TIDi by retrieving the database. GWN calculates ri∗=M1⊕KEYGWN−Ui, M3=hTIDi‖M1‖IDGWN‖ri∗‖TS1. In order to authenticate the authenticity of Ui, GWN checks whether M3 is equal to M2. If it holds, GWN generates the current timestamp TS2 and a random nonce rGWNrGWN≤minkj. GWN calculates M4 as M4=rGWN×γ to securely send rGWN to each sensing device. Then, GWN calculates M5=EncrGWNIDi,IDGWN,ri∗,rGWN⊕KEYGWN−Ui to encrypt the parameters. After that, GWN computes M6=hIDi‖IDGWN‖ri∗‖M4‖TS2Vert‖KEYGWN−Ui to help sensing device SDj authenticate GWN. Finally, GWN broadcasts the message M4,M5,M6,TS2 via a public channel.(2)
Step AKAP2: after receiving the broadcast message fromGWN, each sensing device SDj verifies TS2−TS2′≤ΔTS to check the freshness of the message firstly. If the inequality holds, SDj uses CRT to obtain rGWN∗=M4modkj by its stored value kj. SDj then uses the group key rGWN∗ to decrypt M5 to attain the sensitive parameter IDi,IDGWN,ri∗,andrGWN⊕KEYGWN−Ui. SDj further calculates M7=hIDi‖IDGWN‖ri∗‖M4‖KEYGWN−Ui⊕rGWN⊕rGWN∗‖TS2 with the condition M7=M6 to verify GWN. If it is true, each SDj computes M8=EncrGWN∗IDSDj,sjfj to encrypt the legal share sjandfj and generates the current timestamp TS3. Then, each sensing device SDj sends the reply message M8,TS3 to GWN securely.(3)
Step AKAP3: when receiving the message,GWN firstly verifies TS3−TS3′≤ΔTS to check the freshness of the message. If it holds, GWN obtains share sjandfj by calculating DecrGWN∗M8=IDSDj,sj,fj. GWN further computes θ1=∑t=1lλtst and θ2=∑t=1lλtft and checks whether θ12=θ2. If it holds, GWN can reconstruct the secret successfully. Then, GWN computes M9=hS‖rGWN, M10=M9×γ,M11=hM9‖M10, and M12=EncKEYGWN−UirGWN,ri∗,M9. GWN then generates the current timestamps TS4 and a new temporal identity TIDinew and calculates M13=hIDi‖KEYGWN−Ui‖TS4⊕TIDinewandM14=hM12‖M9‖ri∗. Finally, GWN broadcasts the message M10,M11 to all the participants and sends the message M12,M13,M14,TS4 to Ui.(4)
Step AKAP4: when receiving the messageM10,M11 from GWN, each sensing device SDj calculates M9∗=M10modkj and M15=hM9∗‖M10. If M15=M11, each device SDj calculates SK as SK=hIDi‖IDGWN‖rGWN∗‖ri∗‖M9∗‖KEYGWN−Ui. GWN validates the shared session key by computing M16=hSK‖IDGWN‖IDi and sends it to Ui.(5)
Step AKAP5: after receiving the message,Ui firstly verifies TS4−TS4′≤ΔTS to check the freshness of the message. If it holds, Ui computes DecKEYGWN−UiM12=rGWN∗,ri∗,M9∗∗. Then, Ui checks whether ri∗=ri to validate the session consistency. If it holds, Ui computes M17=hM12‖M9∗∗‖ri. If M17=M14, Ui further calculates SK∗ as SK∗=hIDi‖IDGWN‖rGWN∗‖ri‖M9∗∗‖KEYGWN−Ui with sensing devices. Ui calculates M18=hSK∗‖IDGWN‖IDi after receiving the message from the sensing device and checks whether M18=M16. If it holds, Ui needs to change TIDinew=hIDi‖KEYGWN−Ui‖TS4⊕M13.Table 2
Login and authenticated key agreement phase.
UserUiGatewayGWNSensingdeviceSDjL1InsertSCi to card reader. Input IDi,PWi, and Bi∗. Compute BKi∗=RepBi∗,τi, RPWi∗=hIDi‖PWi‖BKi∗, a∗=Di⊕hIDi‖BKi∗, Ai∗=Ai′⊕a∗, and Vi∗=hRPWi∗‖Ai∗‖a∗‖hIDi‖BKi∗modωV1Check whetherTS1−TS1′≤ΔTS. If so, extract IDiandKEYGWN−Ui. Compute ri∗=M1⊕KEYGWN−Ui and M3=hTIDi‖M1‖IDGWN‖ri∗‖TS1. Check whether M3=M2; if so, generate a random nonce rGWN and timestamps TS2. Compute M4=rGWN×γ, M5=EncrGWNIDi,IDGWNri∗,rGWN⊕KEYGWN−Ui, and M6=hIDi‖IDGWN‖ri∗‖M4‖KEYGWN−Ui‖TS2, →openchannelM4,M5,M6,TS2V2Check whetherTS2−TS2′≤ΔTS. If so, compute rGWN∗=M4modkj, IDi,IDGWN,ri∗,rGWN⊕KEYGWN−Ui=DecrGWN∗M5, and M7=hIDi‖IDGWN‖ri∗‖M4‖KEYGWN−Ui⊕rGWN⊕rGWN∗‖TS2 Check whether M7=M6; if so, generate a timestamp TS3. Compute M8=EncrGWN∗IDSDj,sjfj, ←openchannelM8,TS3L2Check whetherVi=Vi∗, if so, generate a random nonce ri and timestamps TS1. Calculate, IDGWN∗=Ci′⊕hIDi‖BKi∗, M1=Ai′⊕RPWi∗⊕ri, M2=hTIDi‖M1‖IDGWN∗‖ri‖TS1→openchannelM4,M5,M6,TS2V3Check whetherTS3−TS3′≤ΔTS; if so, compute IDSDj,sj,fj=DecrGWN∗M8, θ1=∑t=1lλtst, and θ2=∑t=1lλtft. Check whether θ12=θ2; if so, return θ1 as S. Compute M9=hS‖rGWN, M10=M9×γ, and M11=hM9‖M10. Generate a temporal identity TIDinew and timestamp TS4. Compute M12=EncKEYGWN−UirGWN,ri∗,M9, M13=hIDi‖KEYGWN−Ui‖TS4⊕TIDinew, and M14=hM12‖M9‖ri∗. →openchannelM10,M11←openchannelM12,M13,M14,TS4V4ComputeM9∗=M10 and M15=hM9∗‖M10. Check if M15=M11; if so, compute SK=hIDi‖IDGWN‖rGWN∗‖ri∗‖M9∗‖KEYGWN−Ui and M16=hSK‖IDGWN‖IDi←openchannelM16V5Check whetherTS4−TS4′≤ΔTS if so, compute rGWN∗,ri∗,M9∗∗=DecKEYGWN−UiM12; check whether ri∗=ri; if so, compute M17=hM12‖M9∗∗‖ri. Check whether M17=M14; if so, compute SK∗=hIDi‖IDGWN‖rGWN∗‖ri‖M9∗∗‖KEYGWN−Ui and M18=hSK∗‖IDGWN‖IDi. Check whether M16=M18; if so, the session key is established successfully. Compute TIDinew=hIDi‖KEYGWN−Ui‖TS4⊕M13. Update TIDi with TIDinew


## 3. Cryptanalysis of Vinoth et al.’s Scheme

For a multifactor authentication scheme, it is essential to create a concise and concrete adversarial model. In this section, we propose two attacks, a smart loss attack and a sensing device capture attack to show the vulnerabilities of the scheme. First of all, we refer to the adversary model proposed by Wang et al. [9] which is strict but reasonable. The assumptions below are about the adversary’s capabilities:(1)
There exist two kinds of communication channels: a secure channel and a public channel. The former is mainly used for registration, while the other is mainly used in login and authentication phases. The adversaryA has full control of the public channel, i.e., A can eavesdrop, intercept, modify, and redirect messages transmitted between communication participants [10, 11].(2)
The adversaryA can offline exhaust all the items in the Descartes space of identities and passwords which are of low entropy within polynomial time.(3)
When it comes to multifactor authentication, the scheme should be secure even if one or more factors are compromised, which is called truly multifactor security [12]. Therefore, it is reasonable to make an assumption that A may i obtain a victim’s password by performing shoulder surfing or phishing attacks, ii extract the secret parameters in the lost smart card by performing side-channel attack, or iii attain a victim’s biometric information using malicious devices. However, the above assumptions cannot be achieved at the same time; otherwise, it will be a trivial case.(4)
The adversaryA could be the administrator of the server or a legitimate user in the system.(5)
The adversaryA can determine victim’s identity.It is worth noting that users can select his/her identityID and password PW in many protocols. However, the user selected identities and passwords are usually of low entropy (Did≤Dpw≤106) [13, 14]. Therefore, assumption (2) is realistic. Then, assumption (3) specifies truly three-factor security. And, assumption (4) can be used to capture the threats from the system when the server is corrupted or any legitimate users are malicious. Finally, assumption (5) describes the fact that most of the user identity are user’s e-mail addresses or phone numbers, which can be easily obtained. The following analysis will take the five assumptions mentioned above into account.


### 3.1. Smart Card Loss Attack

We employ the userUi as the victim to show the process of this attack. According to assumption (3), it is reasonable for the adversary A to get Ui’s smart card SC (stolen or picked up) and corresponding biometrics Bi∗. Besides, as a premeditated adversary, A has full control of the public channel, and she can collect a past transcript between Ui and gateway node GWN (i.e., TIDi,M1,M2,TS1). Then, A can guess Ui’s password and identity correctly as following steps:Step 1. A computes BKi=RepBi∗,τi, where τi can be extracted from victim’s smart cardStep 2. A chooses a pair IDi∗,PWi∗ from Did×Dpw, where Did denotes the identity space and Dpw denotes the password spaceStep 3.A computes IDGWN∗=Ci′⊕hIDi∗‖BKiStep 4.A computes RPWi∗=hIDi∗‖PWi∗‖BKiStep 5.A computes ri∗=M1⊕Ai′⊕RPWi∗, noted that A can extract Ai′ from victim’s smart card and collect M1 from the past transcriptStep 6.A computes M2∗=hTIDi‖Mi‖IDGWN∗‖ri∗‖TS1 and verifies the correctness of IDi∗,PWi∗ pair by checking if M2∗=M2Step 7.A executes the steps 2∼6 repeatedly until finding the correct valuesAs mentioned before, users can choose his/her ownID and PW in most password-based authentication schemes (e.g., References [15–17]) aiming to achieve user-friendliness. And, Vinoth et al.’s scheme is no exception. It makes assumption (2) reasonable that users often select low entropy identities and passwords. Therefore, it is possible for A to exhaust all the ID,PW pairs offline within polynomial time. We can calculate the running time of the attack procedure as O3TH×Did×Dpw, where Did represents the number of identities, Dpw represents the number of passwords, and TH represents the running time for Hash operation. Note that the operation time of bit-wise XOR operation in Step 3 can be ignored. Since Did and Dpw are very limited (e.g., Did≤Dpw≤106) [13, 14], the attack mentioned above is significant and shows a challenge to user authentication protocols.


### 3.2. Sensing Device Capture Attack

According to Vinoth et al.’s threat model, the adversaryA can compromise a sensing device SD and extract the parameters stored in it (i.e., IDSDj,si,fi,kja). We assume that SDj is captured by the adversary; then, A can successfully impersonate the user Ui as follows:Step 1. Computes rGWN∗=M4modkj, where M4 is received from GWNStep 2. Decrypts the received message M5 by using the key rGWN∗ and obtains the security parameters rGWN⊕KEYGWN−Ui,IDGWN,IDi,andri∗ of the user Ui who is sending the login requestStep 3. Computes KEYGWN−Ui as KEYGWN−Ui=rGWN∗⊕rGWN⊕KEYGWN−UiStep 4. Computes TIDinew=hIDi‖KEYGWN−Ui‖TS4⊕M13, where TS4 and M13 are obtained from the public channelStep 5. Randomly chooses a new nonce rinew and current timestamp TS1newStep 6. Computes M1∗ as M1∗=KEYGWN−Ui⊕rinew and M2∗ as M2∗=hTIDinew‖M1∗‖IDGWN‖rinew‖TS1newStep 7. Sends the login request TIDinew,M1∗,M2∗,TS1new to GWN and finishes the login phaseAfter receiving the message,GWN first checks the freshness of the received message and computes rinew=KEYGWN−Ui⊕M1∗, where KEYGWN−Ui is stored in the GWN’s database and retrieved according to corresponding TIDi. Then, GWN computes M3=hTIDinew‖M1∗‖IDGWN‖rinew‖TS1new and verifies whether the calculated M3 is equal to the received M2. If it holds, GWN will authenticate the authenticity of Ui. Since the parameters are calculated correctly, the adversary A can pass the verification of the GWN. So far, the adversary has successfully impersonated user Ui.


### 3.3. No Forward Secrecy

When a scheme ensures that, even the long-term private keys (or secret) of communication participants are leaked, previously agreed session keys can still be secure [18], then the scheme is called supporting forward secrecy. It is important for security critical systems to support forward secrecy, especially when there still exist many security and privacy problems in the IIoT environment.If an attackerA has captured a sensing device SDj, extracted the parameters IDSDj,si,fi,kj from SDj, and intercepted the messages M4,M5,M10, the following method can be used to calculate the session key:Step 1.A computes rGWN∗=M4modkj, where M4 is received from GWNStep 2.A decrypts the received message M5 by using the key rGWN∗ and obtains the security parameters rGWN⊕KEYGWN−Ui,IDi,ri∗,andIDGWN of the user UiStep 3.A computes M9∗=M10modkj, where M10 is received from GWNStep 4.A computes the session key SK∗=hIDi‖IDGWN‖rGWN∗‖ri∗‖M9∗‖KEYGWN−UiWith the session keySK∗ computed, the entire session will be no secret to the adversary A.


### 3.4. Security Vulnerability Discussion

In this section, we highlight again that when considering multifactor security, even if one or more authentication factors are obtained (not all) by the adversary, the scheme should not be broken. Based on this assumption, we proposed the smart card loss attack and the sensing device capture attack. Although Vinoth et al. have employed the fuzzy-verify technique proposed by Wang and Wang [12], the adversary can still obtain victim’s password in the way of offline guessing. This disappointing situation is caused that they do not employ the public-key cryptosystem and no public key material is used to construct the login message. To solve this problem, we suggest to use Diffie–Hellman key exchange scheme. Specifically, GWN computes y=gxmodp and stores it into Ui’s smart card SC during the user registration phase, where g is a generator of the group G, p is a large prime number, and x is GWN’s secret key. After that, when Ui logs in, she should choose a random number u and compute Y1=gumodpandC1=yumodp first; then, she constructs the login message M2=hTIDi‖M1‖IDGWN∗‖ri‖C1‖Y1‖TS1. Since the adversary cannot calculate Y1, the aforementioned smart card loss attack can be prevented.Meanwhile, in the sensing device capture attack, an adversaryA can impersonate user Ui even without her password PWi. Essentially, when authenticating the identity of user Ui, the GWN only checks whether the user Ui who sends the login request holds the parameter KEYGWN−Ui. Unfortunately, KEYGWN−Ui is encrypted by the group key rGWN∗ in the message M5, but obtaining the group key rGWN∗ is easy for an adversary who has breached the SDj and extracted kj. After this, A could decrypt M5 to get KEYGWN−Ui,IDi,ri∗, and IDGWN. With these parameters, A can bypass the system’s user authentication. One possible countermeasure to this problem is that GWN constructs the message M5=EncrGWNIDi,IDGWN,KEYGWN−Ui⊕ri∗ and M6=hIDi‖IDGWN‖M4‖KEYGWN−Ui‖TS2. As a result, when receiving the message, M4,M5,M6,TS2, the adversary A who captures the sensing device can only obtain the parameter KEYGWN−Ui⊕ri∗ by decrypting M5. Therefore, A cannot impersonate Ui since she cannot obtain KEYGWN−Ui.Note that, one may argue that when the victim userUi interacts with the GWN, she uses her temporary identity TIDi, and it seems impressible for an adversary to find victim’s message from the transcript. However, according to assumption (5), the adversary A can determine victim’s identity. Thus, a premeditated adversary may first compromise a sensing device and wait for the victim chosen by her to send the login request message. Then, A decrypts M5 to get IDi and checks if this ID belongs to the victim. After that, A continues to monitor the channel until Ui’s session ends. Finally, A could calculate TIDinew as Step 4 of the sensing device capture attack.In order to fix the defects of forward secrecy, we also rely on public key cryptography. Specifically, before computingM8, SDj first chooses a random number rs and computes Y2=grsmodp. Then, SDj computes M8=EncrGWN∗IDSDj,Sj,fj,Y2 and sends it to GWN. After that, GWN chooses a random number x′ and computes C2=Y2Zx′modp, YGWN−Sj=gx′modp, M10=Encc2M9, and M11=hM10‖M9‖YGWN−Sj. In Section 3.4, we show that the adversary A can compute the session key SK, and this is caused by A to obtain M9. However, M9 is protected by the shared key C2 now. As a result, A cannot calculate the previous session key. In order to be consistent with the previous modification, the session key is calculated as SK=hIDi‖IDGWN‖rGWN∗‖M9∗‖KEYGWN−Ui⊕ri∗.


## 3.1. Smart Card Loss Attack

We employ the userUi as the victim to show the process of this attack. According to assumption (3), it is reasonable for the adversary A to get Ui’s smart card SC (stolen or picked up) and corresponding biometrics Bi∗. Besides, as a premeditated adversary, A has full control of the public channel, and she can collect a past transcript between Ui and gateway node GWN (i.e., TIDi,M1,M2,TS1). Then, A can guess Ui’s password and identity correctly as following steps:Step 1. A computes BKi=RepBi∗,τi, where τi can be extracted from victim’s smart cardStep 2. A chooses a pair IDi∗,PWi∗ from Did×Dpw, where Did denotes the identity space and Dpw denotes the password spaceStep 3.A computes IDGWN∗=Ci′⊕hIDi∗‖BKiStep 4.A computes RPWi∗=hIDi∗‖PWi∗‖BKiStep 5.A computes ri∗=M1⊕Ai′⊕RPWi∗, noted that A can extract Ai′ from victim’s smart card and collect M1 from the past transcriptStep 6.A computes M2∗=hTIDi‖Mi‖IDGWN∗‖ri∗‖TS1 and verifies the correctness of IDi∗,PWi∗ pair by checking if M2∗=M2Step 7.A executes the steps 2∼6 repeatedly until finding the correct valuesAs mentioned before, users can choose his/her ownID and PW in most password-based authentication schemes (e.g., References [15–17]) aiming to achieve user-friendliness. And, Vinoth et al.’s scheme is no exception. It makes assumption (2) reasonable that users often select low entropy identities and passwords. Therefore, it is possible for A to exhaust all the ID,PW pairs offline within polynomial time. We can calculate the running time of the attack procedure as O3TH×Did×Dpw, where Did represents the number of identities, Dpw represents the number of passwords, and TH represents the running time for Hash operation. Note that the operation time of bit-wise XOR operation in Step 3 can be ignored. Since Did and Dpw are very limited (e.g., Did≤Dpw≤106) [13, 14], the attack mentioned above is significant and shows a challenge to user authentication protocols.


## 3.2. Sensing Device Capture Attack

According to Vinoth et al.’s threat model, the adversaryA can compromise a sensing device SD and extract the parameters stored in it (i.e., IDSDj,si,fi,kja). We assume that SDj is captured by the adversary; then, A can successfully impersonate the user Ui as follows:Step 1. Computes rGWN∗=M4modkj, where M4 is received from GWNStep 2. Decrypts the received message M5 by using the key rGWN∗ and obtains the security parameters rGWN⊕KEYGWN−Ui,IDGWN,IDi,andri∗ of the user Ui who is sending the login requestStep 3. Computes KEYGWN−Ui as KEYGWN−Ui=rGWN∗⊕rGWN⊕KEYGWN−UiStep 4. Computes TIDinew=hIDi‖KEYGWN−Ui‖TS4⊕M13, where TS4 and M13 are obtained from the public channelStep 5. Randomly chooses a new nonce rinew and current timestamp TS1newStep 6. Computes M1∗ as M1∗=KEYGWN−Ui⊕rinew and M2∗ as M2∗=hTIDinew‖M1∗‖IDGWN‖rinew‖TS1newStep 7. Sends the login request TIDinew,M1∗,M2∗,TS1new to GWN and finishes the login phaseAfter receiving the message,GWN first checks the freshness of the received message and computes rinew=KEYGWN−Ui⊕M1∗, where KEYGWN−Ui is stored in the GWN’s database and retrieved according to corresponding TIDi. Then, GWN computes M3=hTIDinew‖M1∗‖IDGWN‖rinew‖TS1new and verifies whether the calculated M3 is equal to the received M2. If it holds, GWN will authenticate the authenticity of Ui. Since the parameters are calculated correctly, the adversary A can pass the verification of the GWN. So far, the adversary has successfully impersonated user Ui.


## 3.3. No Forward Secrecy

When a scheme ensures that, even the long-term private keys (or secret) of communication participants are leaked, previously agreed session keys can still be secure [18], then the scheme is called supporting forward secrecy. It is important for security critical systems to support forward secrecy, especially when there still exist many security and privacy problems in the IIoT environment.If an attackerA has captured a sensing device SDj, extracted the parameters IDSDj,si,fi,kj from SDj, and intercepted the messages M4,M5,M10, the following method can be used to calculate the session key:Step 1.A computes rGWN∗=M4modkj, where M4 is received from GWNStep 2.A decrypts the received message M5 by using the key rGWN∗ and obtains the security parameters rGWN⊕KEYGWN−Ui,IDi,ri∗,andIDGWN of the user UiStep 3.A computes M9∗=M10modkj, where M10 is received from GWNStep 4.A computes the session key SK∗=hIDi‖IDGWN‖rGWN∗‖ri∗‖M9∗‖KEYGWN−UiWith the session keySK∗ computed, the entire session will be no secret to the adversary A.


## 3.4. Security Vulnerability Discussion

In this section, we highlight again that when considering multifactor security, even if one or more authentication factors are obtained (not all) by the adversary, the scheme should not be broken. Based on this assumption, we proposed the smart card loss attack and the sensing device capture attack. Although Vinoth et al. have employed the fuzzy-verify technique proposed by Wang and Wang [12], the adversary can still obtain victim’s password in the way of offline guessing. This disappointing situation is caused that they do not employ the public-key cryptosystem and no public key material is used to construct the login message. To solve this problem, we suggest to use Diffie–Hellman key exchange scheme. Specifically, GWN computes y=gxmodp and stores it into Ui’s smart card SC during the user registration phase, where g is a generator of the group G, p is a large prime number, and x is GWN’s secret key. After that, when Ui logs in, she should choose a random number u and compute Y1=gumodpandC1=yumodp first; then, she constructs the login message M2=hTIDi‖M1‖IDGWN∗‖ri‖C1‖Y1‖TS1. Since the adversary cannot calculate Y1, the aforementioned smart card loss attack can be prevented.Meanwhile, in the sensing device capture attack, an adversaryA can impersonate user Ui even without her password PWi. Essentially, when authenticating the identity of user Ui, the GWN only checks whether the user Ui who sends the login request holds the parameter KEYGWN−Ui. Unfortunately, KEYGWN−Ui is encrypted by the group key rGWN∗ in the message M5, but obtaining the group key rGWN∗ is easy for an adversary who has breached the SDj and extracted kj. After this, A could decrypt M5 to get KEYGWN−Ui,IDi,ri∗, and IDGWN. With these parameters, A can bypass the system’s user authentication. One possible countermeasure to this problem is that GWN constructs the message M5=EncrGWNIDi,IDGWN,KEYGWN−Ui⊕ri∗ and M6=hIDi‖IDGWN‖M4‖KEYGWN−Ui‖TS2. As a result, when receiving the message, M4,M5,M6,TS2, the adversary A who captures the sensing device can only obtain the parameter KEYGWN−Ui⊕ri∗ by decrypting M5. Therefore, A cannot impersonate Ui since she cannot obtain KEYGWN−Ui.Note that, one may argue that when the victim userUi interacts with the GWN, she uses her temporary identity TIDi, and it seems impressible for an adversary to find victim’s message from the transcript. However, according to assumption (5), the adversary A can determine victim’s identity. Thus, a premeditated adversary may first compromise a sensing device and wait for the victim chosen by her to send the login request message. Then, A decrypts M5 to get IDi and checks if this ID belongs to the victim. After that, A continues to monitor the channel until Ui’s session ends. Finally, A could calculate TIDinew as Step 4 of the sensing device capture attack.In order to fix the defects of forward secrecy, we also rely on public key cryptography. Specifically, before computingM8, SDj first chooses a random number rs and computes Y2=grsmodp. Then, SDj computes M8=EncrGWN∗IDSDj,Sj,fj,Y2 and sends it to GWN. After that, GWN chooses a random number x′ and computes C2=Y2Zx′modp, YGWN−Sj=gx′modp, M10=Encc2M9, and M11=hM10‖M9‖YGWN−Sj. In Section 3.4, we show that the adversary A can compute the session key SK, and this is caused by A to obtain M9. However, M9 is protected by the shared key C2 now. As a result, A cannot calculate the previous session key. In order to be consistent with the previous modification, the session key is calculated as SK=hIDi‖IDGWN‖rGWN∗‖M9∗‖KEYGWN−Ui⊕ri∗.


## 4. Conclusion

In this paper, we have revisited and analysed Vinoth et al.’s authentication scheme for IIoT environments. We demonstrate that their scheme suffers from the smart card loss attack and the sensing device capture attack although they claimed that their scheme has the ability to defend various known attacks. We have also briefly discussed the potential causes of these defects. It is hoped that the proposed attacks can help inspire new designs of secure and efficient multifactor authentication protocols for IIoT.



---

*Source: 9995832-2021-06-04.xml*