Journal of Software Engineering

Year: 2014 | Volume: 8 | Issue: 3 | Page No.: 184-193
DOI: 10.3923/jse.2014.184.193

Secure and Efficient Mutual User Authentication Protocol for Wireless Sensor Networks

Qinghua Yang, Liejun Wang, Qi Liu and Mingwei Wang

Abstract: Authentication is a very significant demand in wireless sensor networks, especially in some critical applications. However, most previous user authentication schemes are always vulnerable and high-power consumption for the resource-constrained WSNs nodes. This study will focus on user authentication by investigating the Park and others’ schemes to identify their demerits. After that, a novel and lightweight mutual user authentication protocol named MUAP is proposed. The analysis and results show that the proposed scheme not only can resist the specific attacks likes Man-In-The-Middle Attack, Impersonation Attack and Message-Alteration Attack but also is better than Kumar and others’ protocols in terms of devices’ computation overhead and communication consumption.

Keywords: session key, mutual user authentication, Wireless sensor networks and confidentiality

INTRODUCTION

Recent years, Wireless Sensor Network (WSN) grows rapidly in accommodating plenty of application areas. The applications include military, national security, environmental monitoring, traffic management, health care, manufacturing and so on (Kumar et al., 2013). The WSN consists of resource-constrained sensors Crossbow Technology (2012) and Moteiv Corporation (2012) that have low computational ability, low power, low bandwidth and a small amount of memory. The broadcast nature of the sensor node makes it possible for a user to access sensor data within the networks, that is, on demand users may misuse the sensitive data for personal reasons (Das, 2009, 2011; Sun et al., 2013). Since, the sensor data are private for users within the WSN, it is mandatory to authenticate the users before permitting access to the sensitive data. Therefore, user authentication is a primary concern in application areas of WSNs.

At present, some mutual user authentication protocols have been proposed for resource-constraint WSNs (Ko, 2008; Lee, 2008; Chen and Shih, 2010; He et al., 2010; Khan and Alghathbar, 2010; Yoo et al., 2012) and each of these protocols has its advantages and disadvantages. Gao proposed a two-factor user authentication protocol which is based on a smartcard and password in 2010 (He et al., 2010). However, Chen showed that Gao’s protocol fails in mutual authentication and is vulnerable to parallel-session attacks. After that, they proposed a robust mutual authentication protocol for WSNs in (Chen and Shih, 2010). Khan proposed an improvement advice to Gao’s scheme to resist these attacks.

In 2012, Park claimed that the protocols which are proposed in (Chen and Shih, 2010; He et al., 2010; Khan and Alghathbar, 2010) are sensitive to parallel-session attacks and gateway-bypass attacks and are none of mutual authentication schemes. Therefore, they proposed a scheme (Yoo et al., 2012) to overcome the problem that presented in (Chen and Shih, 2010; He et al., 2010; Khan and Alghathbar, 2010).

Nevertheless, according to our study, Park and others’ protocols are not only sensitive to impersonation attacks, message-alteration attacks and man-in-the-middle attacks but they are not efficient (in terms of communication and computation cost) for real-time WSNs. Therefore, we propose a strong and lightweight user authentication protocol that protects the privacy of the user, wherein each user has to demonstrate his legitimacy by show his secret information. The proposed scheme has many merits, including mutual authentication for entities (that is, sensor, gateway and user), protecting user’s privacy and maintaining confidential wireless messages. Further, we show that the protocol we proposed is strong against popular attacks, in contrast to those in (Chen and Shih, 2010; He et al., 2010; Khan and Alghathbar, 2010) and obtains high efficiency at computation overhead and communication consumption.

ANALYSIS OF PARK AND OTHERS’ SCHEME

Review of Park and others’ protocol: The schemes of Park and other’s are consist of three parts: Registration, authentication and password-change. The details of this protocol are shown in Fig. 1.

Registration part: To access the sensor data, each user has to register himself by passing his ID_U and PPW_u = h(PW_u)⊕b to Gateway nodes in a secure channel, where, b is a secret number generated by user. After that, the Gateway node uses the receiving data ID_u and PPW_u to calculate the following equations M_u = h(ID_u||PPW_u), N_u = h(ID_u||PPW_u)⊕h(K||J), L_u = h||(J_u||ID_u), where, J is a random number generated by the Gateway node and K is a key generated by the Gateway node. Finally, the parameters {M_u, N_u, L_u, h(.)}} are passed to the user. The user adds b to the smartcard as his secret.

Authentication part: This authentication part can be divided into three parts: Login part, verification part and session key establishment.

Login part: The user tries to access the sensor data on demand. The user has to use his smartcard and input his ID_u and PW_u. The smartcard performs series of computations after getting the request from user as the Fig. 1 shown.

Verification part: In this part, user and Gateway verified for each other by transmitting the data {A_u, RN_gateway}, {B_u}, {DID_u, T₂, RN'_gateway} and {C_u, RN_sensor}.

Session key establishment: After verifying for each other, a session key between user and Gateway node can be built.

Password-change part: User needs to enter his previous ID_u and Pw_u, then the smart card computes the new PPW_u and M_u*, matches the M_u* with M_u. If not, the new password change request will be rejected. Otherwise, it would be accepted, then, the user input his new password.

Drawbacks of Park and others’ scheme: We find two weaknesses of Park and Others schemes after analyzing the process of their protocols.

We assume that Eve was an intruder who can control the communication between the user, the Gateway and the sensor node. Eve has abilities of eavesdropping, altering and intercepting the wireless messages at any time. Alice is a legal user.

Impersonating attack: Supposing that previous login messages (DID_u, T, ID_u, RN_u) of Alice has been intercepted by Eve. Eve does not know anything about Alice’s password or identity but Eve could simply impersonate Alice to access the WSNs. The details of the impersonating attack are shown as follows:

The impersonating attack was proved to be successful by performing the above steps. Eve’s login request was accepted and Eve can easily imitate any user to login into the Gateway at any time.

MITM attack: Assume that Eve is active between the Gateway and the sensors. And Eve can intercept the Gateway node message {DID_u, T₂, RN’_gateway} and simply alter the request to be (DID_u, T', ID_u, RN_u) by delete the original T' and RN'_gateway where, T' is a current timestamp and RN'_gateway is a random nonce of Eve. Eve transmits the altered request to the sensor node around him. The sensor node will receive the request from Eve, the details is shown as following:

It is seemingly that this protocol rejects Eve but the detection of the MITM attack is too late. Eve can easily make the sensor node out of energy by numerous of attempting verification.

Certainly, Park and others’ protocol has overcome the drawbacks of (Das, 2009; Chen and Shih, 2010; Yoon and Yoo, 2011) but failed to the impersonating attack and MITM attack. However, there are still impacts on real-time WSNs by our analysis. To solve the problem in (Ko, 2008; Lee, 2008; Chen and Shih, 2010; He et al., 2010; Khan and Alghathbar, 2010; Yoo et al., 2012) we propose a secure and efficient mutual user authentication protocol named MUAP which provides the necessary security and efficient services to WSNs at a reasonable computation and communication consumption in next section.

PROPOSED MUTUAL USER AUTHENTICATION PROTOCOL MUAP

A special type of cryptography named Shamir secret sharing algorithm was used in this protocol. First, let us review the Shamir secret sharing algorithm (Dolev et al., 2011; Ulutas et al., 2011; Aldosary and Howells, 2012; Coron et al., 2013). Generally, Shamir (k, n) secret sharing algorithm divides a secret s into n parts called child-secret, the secret S can be recovered if only the number of the child-secret is equal to k, or more.

A secret S∈GF(q) (that is, q is a large prime number, GF(q) is in Galois field) will be divided into n parts by this polynomial f(x) = a₀+a₁x+a₂x²+…+a_k-1x^k-1 mod q. Each of the parts has its unique identifier x₁, x₂…..x_n∈GF(q), a₁, a₂…a_k-1∈GF(q) and a₀ = S. Then, all parts of the secret will be gotten as f(x₁), f(x₂)…f(x_n). Finally, distribute the {xi, f(x_i)} (that is i = 1,2…n)) as a key to each participant. In MUAP, we distribute {x_i, f(x_i)} to each legal user as his identity number. The identity number will be used at process of authentication.

We consider a WSN which consists of two kinds of devices those are low-resource devices and high-resource devices. The high-resource devices, like Gateway nodes, can resist the tampering attacks but the low-resource devices cannot. User can access to the WSN and get the sensor data by using their terminal equipment like smart phone, or laptop. Certainly, before that, user must register to the Gateway node and get the permission.

To introduce MUAP protocol, we make the following assumptions. And the notations used in this study are shown in Table 1.

The MUAP protocol consists of three parts: Registration part, authentication part and password-change part.

Registration part: In order to access the sensor data, each user has to register himself with by passing their ID_u and PPW_u = h(PW_u)⊕b to the Gateway node in a secure channel. After receiving these two messages, the Gateway node will choose S and use the Shamir secret sharing algorithm to calculate the f(ID_u), then performs the following steps: The Gateway will call the ZUC algorithm to generate the key K₁ whose length is the same as ID_u||h(f(ID_u))⊕ID_gateway to encrypt it. Then, calculate A_u = EEA_3K1[ID_u||h(f(ID_u))⊕ID_gateway]. S the Gateway chooses is a periodical-change parameter, so each user must reregister to the Gateway node after S changes.

After that, user will get a smartcard with the following parameters: {A_u, B_u, h[f(ID_u)]}. Then, user needs to add the random number b to the smartcard. Now, the register part is done.

Authentication part: The procedures of the authentication part in MUAP are shown in Fig. 2. This part consists of three sub-phases: Login phase verification phase and session key establishment.

Login phase: The user needs to insert his smartcard into the terminal and input ID_u and PW_u when he wants to access the sensor data. The smartcard will check the user identity after receiving the login request. Then the smartcard will calculate B_u* = h[ID_u||h(f(ID_u))⊕h(b⊕PW_u)] and judges if(B_u= =B_u*), if yes, proceeds to next step: Calculate C_u = h(B_u⊕T'), then transmit the message (that is {C_u, A_u, T'}) to Gateway, T' is the current system timestamp of the user; otherwise, deny the login request.

Verification phase: When the Gateway receives the login request from the user, the following steps will be done.

Session key establishment: If the step 9 is yes, a session key between user and sensor will be built.

Password-change part: When user needs to change his password, he has to do the following steps:

ANALYSIS OF MUAP PROTOCOL

In this section, we analyze the security and performance of MUAP protocol and compare it with Park and others’ protocols.

Security analysis: Similarly, we assume that Eve was an intruder who could control the wireless channels between user, the Gateway and sensor. Eve has abilities of eavesdropping, altering and intercepting the wireless messages at any time. Alice is a legal user.

Replay attack and message-alternation attack: Eve has three methods to carry out this replay attack by eavesdropping the messages of authentication procedures: (1) Intercepts Alice’s login message {C_u, A_u, T'} and tries to login by replaying it to the Gateway, (2) Intercepts the message {Du, T_gateway} which is from the Gateway to sensor and tries to replay it to the sensor, (3) Intercepts the message {G_u, T'_sensor} which is from the sensor to user and tries to replay it to the user. In (i), Eve replays the message {C_u, A_u, T'} to the Gateway. The verification of this replayed message will be failed, because of the maximum tolerable interval (T''-T')<ΔT. Even if Eve modifies T' (T'*,T'*≠T') to make it suitable for (T''-T')<ΔT, unfortunately, Eve also cannot get through the verification due to the C_u*≠C_u (that is, C_u* = h(B_u⊕T'*)). In (ii), Eve replays the message {Du, T_gateway} to sensor. Similarly, the verification of the replayed message will be fail because of the maximum tolerable interval (T_sensor-T_gateway)<ΔT. Even if Eve modifies T_gateway (T_gateway*, T_gateway*≠T_gateway) to make it suitable for (T_sensor-T_gateway)<ΔT, unfortunately, Eve also cannot get through the verification due to the T_gateway*≠T_gateway. In (iii), Eve replays the message {G_u, T'_sensor} to user. Likewise, the verification of the replayed message will be fail because of the maximum tolerable interval (T_sensor-T_gateway)<ΔT. Even if Eve modifies T'_sensor (T_sensor*, T_sensor*≠T_sensor) to make it suitable for (T_u-T_sensor)<ΔT, unfortunately, Eve also cannot get through the verification due to the G_u*≠G_u (that is, G_u* = h(h(f(ID_u*))||ID_u*⊕T_sensor*)). Therefore, the MUAP protocol is secure against replay attack and message-alternation attack.

MITM attack: Eve also can carry out the MITM attack by modifying the message {D_u, T_gateway} from the Gateway to the sensor. (1) D_u is a piece of cipher-text. (2) The real timestamp of the Gateway T_gateway is in D_u. Eve has no idea about D_u because he knows nothing about K₂. If Eve modified the timestamp T_gateway to T’_gateway (T_gateway≠T'_gateway), Eve will not get through the step 6. So, the MUAP protocol can resist the MITM attack.

User-impersonation attack: If Eve wants to carry out the user-impersonation attack to login in the Gateway, he needs to eavesdrop a legal user’s login message {C_u, A_u, T’} at the time of T'*. We assume that T'* is available for step 1. But the user-impersonation attack will not succeed when proceed to the step 2. Therefore, the MUAP protocol can resist the user-impersonation attack.

Key-guessing attack: In MUAP protocol, we use ZUC algorithm which is a stream encryption algorithm to encrypt the authentication data. One key is used for only once then a new key will be generated in next procedure to encrypt next procedure data. If someone guesses the current key, it will be useless in next procedure. For instance, someone got the key K₁ in the authentication procedure while the K₁ will be useless because of the new key K₂. So, we can see that key-guessing attack could do nothing about the MUAP protocol.

Gateway-bypass attack: We assume that Eve maybe requests to the sensor directly without getting the Gateway’s permission. Eve can fabricate a message of Gateway’s request to sensor. But it will be recognized because the communication data between the Gateway and sensor are encrypted. So, the Gateway-bypass attack is useless for MUAP.

Mutual authentication protocol: We know that the MUAP is a mutual authentication scheme from the procedure of MUAP. Firstly, the Gateway will check the user by executing the step 2; Secondly, the Gateway will transmit the authentication data to sensor, the sensor also checks the Gateway by executing the step 6; At last, sensor will transmit the authentication data to sensor, the user also checks the sensor by executing the step 9.

Both of the three members will authenticated each other, so, the MUAP is a mutual protocol between user, Gateway and sensor.

Performance analysis: In this part, we compare the performance of the MUAP to that of (Lee, 2008; Chen and Shih, 2010; He et al., 2010; Yoo et al., 2012; Kumar et al., 2013).

Computational consumption: The major computational consumption of the registration part is in the Gateway while the Gateway is a high-resource device. It can calculate complex operations. The consumption of the user in registration part in (Lee, 2008; Chen and Shih, 2010; He et al., 2010; Yoo et al., 2012; Kumar et al., 2013) is approaching. But it is not the same in authentication part. From Table 3, we know that the consumption of the authentication part in (Lee, 2008; Chen and Shih, 2010; He et al., 2010; Yoo et al., 2012) are lower than that in (Kumar et al., 2013) and MUAP. But, from Table 2, we can see Gao’s and Chen’s protocols cannot resist all the attacks; Park’s scheme can resist the replay attack and message-alternation attack but is not good at resisting MITM attack, user-impersonation attack, key-guessing attack. And Lee’s can only resist the replay attack. it is obvious that the security in (Lee, 2008; Chen and Shih, 2010; He et al., 2010; Yoo et al., 2012) cannot catch up with that in (Kumar et al., 2013) and MUAP. We know that those protocol is not suitable for the WSNs’ security.

The security in (Kumar et al., 2013) and MUAP is the same while the computational consumption is different. Kumar’s protocol uses the RC5/Skipjack encryption and decryption algorithm which is block cipher, The MUAP uses the lightweight stream cipher. Stream cipher is lower-consumption than the block cipher. So, the Stream cipher is more suitable for WSN. The total computational consumption of MUAP is only 8H, 4Z and 2S while that in (Kumar et al., 2013) is 11H and 8B. Here, the computational consumption of S is lower than B. It is clear that the computation overhead of MUAP is lower than that in (Kumar et al., 2013). So, the MUAP protocol is more efficient than the protocol in (Kumar et al., 2013) at the same security level.

Communication consumption: From Fig. 1 and 2, we know that those protocols have six times of message-exchanging to complete the whole authentication procedure but in MUAP, we need only three times of message-exchanging with the same length of authentication messages.

CONCLUSION

A secure and lightweight authentication scheme is significant for wireless sensor network. We propose a secure and lightweight mutual user authentication protocol to resist those attacks presented in Table 1 using Shamir secret sharing algorithm, timestamp and a lightweight stream encryption algorithm. The analysis and results show that the MUAP is a secure and lightweight authentication scheme. In addition, the MUAP protocol not only can resist those attacks but has lower consumption of computation and communication at the same security level.

ACKNOWLEDGMENT

This study is supported by the Graduation of Xinjiang Research and Innovation Projects under grant No. XJGRI2013038. The authors would like to thank the anonymous reviewers for their constructive comments that helped to improve the quality of this study.

REFERENCES