Department of Information Technology Engineering, Faculty of Computer Engineering, University of Isfahan, Hezar Jerib St., Isfahan 81746-73441, Iran.
Department of Computer Science, University Carlos III of Madrid, Avda. de la Universidad 30, 28911 Leganés, Spain.
Sensors (Basel). 2018 Oct 29;18(11):3663. doi: 10.3390/s18113663.
Heterogeneous wireless sensor networks (HWSNs) are employed in many real-time applications, such as Internet of sensors (IoS), Internet of vehicles (IoV), healthcare monitoring, and so on. As wireless sensor nodes have constrained computing, storage and communication capabilities, designing energy-efficient authentication protocols is a very important issue in wireless sensor network security. Recently, Amin et al. presented an untraceable and anonymous three-factor authentication (3FA) scheme for HWSNs and argued that their protocol is efficient and can withstand the common security threats in this sort of networks. In this article, we show how their protocol is not immune to user impersonation, de-synchronization and traceability attacks. In addition, an adversary can disclose session key under the typical assumption that sensors are not tamper-resistant. To overcome these drawbacks, we improve the Amin et al.'s protocol. First, we informally show that our improved scheme is secure against the most common attacks in HWSNs in which the attacks against Amin et al.'s protocol are part of them. Moreover, we verify formally our proposed protocol using the BAN logic. Compared with the Amin et al.'s scheme, the proposed protocol is both more efficient and more secure to be employed which renders the proposal suitable for HWSN networks.
异构无线传感器网络 (HWSN) 在许多实时应用中得到了广泛应用，例如传感器互联网 (IoS)、车联网 (IoV)、医疗保健监测等。由于无线传感器节点具有有限的计算、存储和通信能力，因此设计节能的认证协议是无线传感器网络安全中的一个非常重要的问题。最近，Amin 等人提出了一种用于 HWSN 的不可追踪和匿名的三因素认证 (3FA) 方案，并声称他们的协议是高效的，并能抵御此类网络中的常见安全威胁。在本文中，我们展示了他们的协议如何不能抵御用户模拟、去同步和可追踪性攻击。此外，在传感器不防篡改的典型假设下，攻击者可以在协议下泄露会话密钥。为了克服这些缺点，我们改进了 Amin 等人的协议。首先，我们非正式地表明，我们改进的方案在 HWSN 中针对最常见攻击是安全的，其中针对 Amin 等人的协议的攻击是其中的一部分。此外，我们使用 BAN 逻辑对我们提出的协议进行了正式验证。与 Amin 等人的方案相比，所提出的协议在效率和安全性方面都有所提高，因此更适合用于 HWSN 网络。
