School of Electronic and Electrical Engineering, Kyungpook National University, Daegu 41566, Korea.
Electronics and Telecommunications Research Institute, Daejeon 34129, Korea.
Sensors (Basel). 2021 Feb 21;21(4):1488. doi: 10.3390/s21041488.
With the information and communication technologies (ICT) and Internet of Things (IoT) gradually advancing, smart homes have been able to provide home services to users. The user can enjoy a high level of comfort and improve his quality of life by using home services provided by smart devices. However, the smart home has security and privacy problems, since the user and smart devices communicate through an insecure channel. Therefore, a secure authentication protocol should be established between the user and smart devices. In 2020, Xiang and Zheng presented a situation-aware protocol for device authentication in smart grid-enabled smart home environments. However, we demonstrate that their protocol can suffer from stolen smart device, impersonation, and session key disclosure attacks and fails to provide secure mutual authentication. Therefore, we propose a secure and lightweight authentication protocol for IoT-based smart homes to resolve the security flaws of Xiang and Zheng's protocol. We proved the security of the proposed protocol by performing informal and formal security analyses, using the real or random (ROR) model, Burrows-Abadi-Needham (BAN) logic, and the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. Moreover, we provide a comparison of performance and security properties between the proposed protocol and related existing protocols. We demonstrate that the proposed protocol ensures better security and lower computational costs than related protocols, and is suitable for practical IoT-based smart home environments.
随着信息与通信技术（ICT）和物联网（IoT）的逐步发展，智能家居已经能够为用户提供家庭服务。用户可以通过使用智能家居设备提供的家庭服务来享受高水平的舒适度并提高生活质量。然而，智能家居存在安全和隐私问题，因为用户和智能设备通过不安全的通道进行通信。因此，应该在用户和智能设备之间建立安全的认证协议。2020 年，Xiang 和 Zheng 提出了一种用于智能电网环境中智能家居设备认证的情境感知协议。然而，我们证明他们的协议容易受到被盗智能设备、伪装和会话密钥泄露攻击的影响，并且无法提供安全的相互认证。因此，我们提出了一种用于基于物联网的智能家居的安全和轻量级认证协议，以解决 Xiang 和 Zheng 协议的安全缺陷。我们通过使用真实或随机 (ROR) 模型、Burrows-Abadi-Needham (BAN) 逻辑和自动验证互联网安全协议和应用程序 (AVISPA) 工具对所提出的协议进行了非正式和形式化的安全分析，证明了所提出的协议的安全性。此外，我们还对所提出的协议与相关现有协议的性能和安全属性进行了比较。我们证明，所提出的协议比相关协议具有更好的安全性和更低的计算成本，并且适用于实际的基于物联网的智能家居环境。
