The limited capabilities of IoT devices have resulted in some of the tasks of IoT applications being distributed to a cloud server, which witnessed the arisen of the cloud of things (COT). It enables IoT applications’ development and deployment as a service, providing additional data storage, enhanced processing performance, and fast communication between devices. As COT involves communication between IoT devices, a remote server, and users, remote user authentication is crucial to meeting security demands. Therefore, this study designs a client-based user authentication scheme utilizing smartphone fingerprint recognition technology to fill the gap. The scheme comprises six phases, namely (i) configuration phase, (ii) enrolment phase, (iii) authentication phase, (iv) password update phase, (v) fingerprint revocation phase, and (vi) smartphone revocation phase. The security analysis and automated verification using ProVerif suggested that the scheme is resistant to user impersonating attacks, replay attacks, and man-in-the-middle attacks. The study’s outcome could help secure user credentials from attacks on applications that involve IoT and the cloud.
A Client-based User Authentication Scheme for the Cloud of Things Environment
Roberto Vergallo;
2022-01-01
Abstract
The limited capabilities of IoT devices have resulted in some of the tasks of IoT applications being distributed to a cloud server, which witnessed the arisen of the cloud of things (COT). It enables IoT applications’ development and deployment as a service, providing additional data storage, enhanced processing performance, and fast communication between devices. As COT involves communication between IoT devices, a remote server, and users, remote user authentication is crucial to meeting security demands. Therefore, this study designs a client-based user authentication scheme utilizing smartphone fingerprint recognition technology to fill the gap. The scheme comprises six phases, namely (i) configuration phase, (ii) enrolment phase, (iii) authentication phase, (iv) password update phase, (v) fingerprint revocation phase, and (vi) smartphone revocation phase. The security analysis and automated verification using ProVerif suggested that the scheme is resistant to user impersonating attacks, replay attacks, and man-in-the-middle attacks. The study’s outcome could help secure user credentials from attacks on applications that involve IoT and the cloud.I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.
