https://orcid.org/0000-0003-3895-2309
Correction
30 Dec 2024: Algarni F, Ullah Jan S (2024) Correction: A lightweight and secure protocol for teleworking environment. PLOS ONE 19(12): e0316745. https://doi.org/10.1371/journal.pone.0316745 View correction
Figures
Abstract
The Internet has advanced so quickly that we can now access any service at any time, from any location. As a result of this capability, People around the world can benefit from the popularity and convenience of teleworking systems. Teleworking systems, however, are vulnerable to a range of attacks; as an unauthorized user enters the open communication line and compromises the whole system, that, in turn, creates a big hurdle for the teleworkers. Professional groups have presented numerous mechanisms for the security of teleworking systems to stop any harm, but there are still a lot of security issues like insider, stolen verifier, masquerade, replay, traceability and impersonation threats. In this paper, we propose that one of the security issues with teleworking systems is the lack of a secure authentication mechanism. In order to provide a secure teleworking environment, we have proposed a lightweight and secure protocol to authenticate all the participants and make the requisite services available in an efficient manner. The security analysis of the presented protocol has been investigated formally using the random oracle model (ROM) and ProVerif simulation and informally through illustration/attack discussions. Meanwhile, the performance metrics have been measured by considering computation and communication overheads. Upon comparing the proposed protocol with prior works, it has been demonstrated that our protocol is superior to its competitors. It is suitable for implementation because it achieved a 73% improvement in computation and 34% in communication costs.
Citation: Algarni F, Ullah Jan S (2024) A lightweight and secure protocol for teleworking environment. PLoS ONE 19(3): e0298276. https://doi.org/10.1371/journal.pone.0298276
Editor: Pandi Vijayakumar, University College of Engineering Tindivanam, INDIA
Received: November 18, 2023; Accepted: January 18, 2024; Published: March 21, 2024
Copyright: © 2024 Algarni, Ullah Jan. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
Data Availability: All relevant data are within the manuscript and its Supporting Information files.
Funding: The authors are thankful to the Deanship of Scientific Research at University of Bisha for supporting this work through the Fast-Track Research Support Program.
Competing interests: The authors have declared that no competing interests exist.
1 Introduction
The facility provided to someone to accomplish their assigned responsibilities remotely through the Internet, e-mail, chat, video conferencing, or other platforms is called teleworking. The convenience of working in a remote work environment through online meetings, chat, video conferencing, instant messaging, multimedia document collaboration, and coordination among workers worldwide has drawn the attention of researchers into the field of telework [1]. And for the last three to four years, particularly during the COVID-19 pandemic, there has been a marked increase. The incredible and dispersed organizational controls associated with telework inevitably lead to an increase in information security threats. For instance, workers who opt to work from home are unable to guarantee that their living quarters meet the bare minimum security standards. Moreover, some companies need to create a telework security strategy that lays out the expectations, limitations, and duties of teleworkers in terms of preventing and handling security events. Organizations may be more vulnerable to network security threats in these circumstances [2]. Therefore, secure authentication and cross-verification of all participants are mandatory to ensure information security.
With the widespread developments in networking technology, unified communication, and the output produced by the Internet of Things (IoT), everyone may now do duties outside of the office with greater ease due to the Internet. To save time and money, competent and well-trained individuals may efficiently and flexibly provide services remotely from homes and other suitable locations. Their production will grow because of fewer workplace distractions, greater autonomy, and balanced work, saving businesses money and resources while requiring less real estate expenditure. However, this revolution in the business and technology sectors also creates constraints by forcing firms to develop and adapt, mimicking corporate trends and continuous improvement in their IT and communication systems. It aims to expand resources by developing the infrastructure to minimize human involvement [3], as show in the Fig 1.
Conversely, lessening the human element might enhance digital work administration; however, managing the technological safety of all modern traffic, whether inside or outside the company, is difficult as secure communication is one of the most important factors in ensuring data protection, accessibility, secrecy, and authenticity. Challenges with teleworking include monetary harm and data vulnerabilities that expose business data [4].
Conventional security methods that relied on a dynamic framework did not function well; teleworkers still need a safe and secure workplace even with powerful intrusion detection systems (IDS), firewalls, sophisticated encryption, anti-virus software, and other safety precautions [5]. The increasing number of skilled workers and teleworking outside the business infrastructures using capabilities offered by internet service providers (ISP) make the security of transferred information even more important. Companies that let staff work on assignments and operations from home to increase efficiency have put their corporation’s digital security at risk [6]. Businesses must be aware of the dangers of leaving themselves open to various attacks. To ensure the presence of risks for all parties concerned, they must fortify themselves with resources and proactive strategies [7].
1.1 Motivation
By creating and maintaining a telework security plan, protecting conversations and data saved on client devices, and assuring that remote servers/peripherals are appropriately accessed, a robust authentication of all participating entities is needed that can guarantee secure communication—also, keeping in view the fundamental security features like privacy protection, remotely working in a secure environment, time management, non-physical work environments at home, and intrinsic and extrinsic workload, etc. motives us to design a security system (remote authentication of all the participants in a secure manner) for such a vulnerable environment. And how various genders adapt to a work-life balance without annoying the traditional family culture. The proposed security system could help companies to reorganize their structures with greater flexibility.
1.2 Challenges and contributions
Employees who work remotely may be isolated from one another, which could inhibit their ability to react to security threats. Furthermore, there may be dangers associated with needing to have control over how sensitive data is used, stored, and deleted across different applications. Insufficient data security in teleworking environments can lead to data breaches, where hackers can take advantage of weak authentication schemes and compromise the confidentiality, integrity and authorization of data. Weak authentication can create severe repercussions from such breaches, including malware attacks and harm to one’s reputation (traceability and unprotected privacy). To combat these security challenges, some governments and corporations have restricted the physical involvement of their workers while keeping their output the same. These organizations have been responsible for providing a secure environment to their workers for working from home in the teleworking environment, which will rely heavily on the Internet. So far, this research offers a security mechanism for a teleworking environment that tackles the aforementioned major issues and challenges of security. In this regard, we have designed a strong authentication for the remote monitoring of teleworkers, which offers protection against unprotected connections. The main contributions of this research work are as follows:
- To propose a lightweight and secure authentication protocol that can protect critical resources of the teleworking environment and mitigate all known threats due to giving unsecured external access to critical data/resources.
- To design a protocol with lightweight operations causing no delay in responding to security vulnerability and offering low computation and communication costs and robust security.
- To verify the security of the proposed authentication protocol both formally and informally by showing a delicate balance of security with performance, as these are opposing features often missing in previous protocols.
- To comparatively analyze it with state-of-the-art works in terms of security functionalities, performance metrics, communication, and computation overheads.
By successfully conducting the proposed research work, the following questions that a layperson can raise will be answered. Recently, people haven’t felt secure due to the availability of strong adversaries–they didn’t work remotely in a safe environment.
- How can a teleworking environment be secure?
- How can the attention of skilled people be catered to?
- How can it take less time for greater output?
- How fast can the work be done?
- How can energy-saving techniques for an organization be materialized?
The remaining paper is organized as in section 2, which contains the literature survey, we have also presented reviewe analysis of baseline scheme and cryptanalyzed it. The result of cryptanalysis shows that the scheme suffers from insider, bias, inaccuracy, and heavyweight; section 3 confesses the system model, threat models, design goals and key highlights; section 4 demonstrates the proposed authentication scheme, and in 5, we analyzed the security of the proposed protocol both formally using the random oracle model (ROM) and ProVerif simulation and informally using attacks’ discussion; section 6 contains performance measurement of the proposed scheme, and in section 7, we have concluded the work.
2 Literature survey
Gupta et al. [8] identified drawbacks in an identity-based protocol used for remote working. They identified impersonation and insider attacks as the major loopholes. After that, [8] presented an improved ECC-based authentication scheme for mobile devices. However, [8] shows that the plan is lightweight and robust. Salami et al. [9] demonstrated that remote authentication could ensure any transaction’s availability, non-repudiation, and integrity. And the online task is accomplished by many businesses through cloud-based computing. In this scenario, thousands of devices accessed cloud servers remotely through low-capacity mobile devices. Such devices are susceptible to potential threats and need rigorous attention. So far, they [9] have proposed a multi-level remote authentication protocol to prevent misusing exchanged information. Ahn et al. [10] argued that telework is a practical working platform that offers stakeholders a more efficient way of working.
It should be noted that the protection of exchanged information is much needed in this regard [11] have proposed near-field communication (NFC) based authentication protocol for teleworking. They claimed that the privacy of a remote user is a dire need of the day, and most of the work done by researchers has never tackled this major issue; the schemes available in the literature also failed to provide secure services to teleworkers. They [11] claimed that their security framework offers resistance to insider and impersonation threats and provides anonymity, untraceability, and forward secrecy.
With the rapid advancement in technology, which is becoming more mature, people’s schedules are also getting more complicated. Right from dawn, their pursuit starts quite unaware of their immediate surroundings, including the household. They lock the door, hoping to control it from the workplace. This, however, is not immune to attacks from hackers who may easily rob the valuables. To overcome these impending threats, we have attempted to connect all valuables in the household so they can be safely monitored/ controlled via mobile. Jan et al. [12,13] proposed a remote user’s security mechanism for alleviating desynchronization attacks. They claimed that in most protocols, the random numbers generated at one end couldn’t update their corresponding peers, creating a desynchronization flaw. To tackle such an issue, they efficiently mitigated it by saying that if one participant sent a random number to other participants, and the central server failed to verify its randomness, it means that someone had tempered the message and considered it a potential threat, promptly discarded and terminate the process. And if, for example, one participant sent a random number to some other participants, and the captured it from the open line, the communicating parties, in this regard, don’t believe in single running because all the participants must first agree upon a single key, then start communication. Their scheme fantastically highlighted the desynchronization issue; however, their scheme’s computation cost is much higher due to modular exponentiation.
A three-factor symmetric key-based scheme has been presented by Zeeshan et al. [14] for telecare medicine information systems. The protocol suggested by [14] has reliably provided mutual authentication and perfect forward secrecy. However, it is weak against man-in-the-middle and session key disclosure attacks. Amin et al. [15] proposed a security framework for IoT in distributed cloud computing. Their scheme offered mutual authentication and could withstand impersonation attacks; however, they suffered from traceability attacks. Chaudhry et al. [16] demonstrated a protocol for distributed cloud computing. Their protocol has many merits, including its resisted Ephemeral Secret Leakage (ESL) and impersonation attacks. Also, their scheme competently provides perfect forward secrecy and mutual authentication. However, they forgot to mention the revocation/reissue phase, which is vital to security. Wu et al. [17] and Jia et al. [18] proposed a scheme for edge computing working for remote users. Their presented scheme’s security and privacy-related security protocol securely provides mutual authentication and withstands password guessing and brute force attacks. However, it failed to resist man-in-the-middle attacks and didn’t provide perfect forward secrecy.
Gope et al. [19] proposed a security protocol for the remote monitoring of an entity using a wireless sensor network. They argued that remote user authentication in a resource-limited environment is a critical task, and such paramount security concerns can only be handled by first efficiently authenticating the user and then starting data transmission. However, due to using symmetric cryptography and encryption/decryption functions, their lightweight claim needs to be made more explicit. Encryption/decryption is unsuitable for such a resource- and bandwidth-limited environment. At the movement, Shafiq et al. [20] designed an ECC-based lightweight authentication framework for authenticating a user remotely. But when an attacker steals the smart card, which is the primary entity in their scheme, they can quickly launch stolen-verifier and ESL attacks on their security mechanism. Taher et al. [21] proposed a three-factor authentication scheme for a remote user for IoT using WSN. They used AVISPA for simulation, BAN logic for hash code security checking, and fingerprint for additional security. However, the offline password-guessing attack has been noted in their scheme because when an chooses an identity, they can quickly become successful for limited guesses.
Challa et al. [22] presented a framework for a heterogeneous-based cyber-physical system using IoT. They argued that cyber attacks were challenging when the number of IoT increases for the physical phenomenon, and such challenges couldn’t be detected easily. Employing an efficient security system makes anonymity, privacy, and secure information broadcasting more straightforward to tackle. However, a signature-based scheme is not feasible for resource- and power-limited IoT. Similarly, if an attacker has stolen the smart card of a system, they can quickly figure out the internal credentials from it. Therefore, the proposed scheme still needs to deliver secure services for the system. Wazid et al. [23] proposed an ECC-based authentication scheme for a smart home environment. Their scheme seriously tackled the issue of replay and clock synchronization attacks, which they have noticed in many security frameworks. However, in the second public channel transmission, the gateway node key (SKGS) is transmitted openly, which the attacker can easily capture and identify many other credentials for DoS attack. Shuai et al. [24] proposed a robust remote monitoring authentication system using a symmetric key cryptographic method. The 1024-bit key is unsuitable for such a resource-limited and low-power IoT.
Oh et al. [25] presented a scheme for IoT-based smart homes. They used a lightweight asymmetric cryptographic method for designing their scheme. Their scheme has fantastically achieved its goals for the remote monitoring of intelligent gear installed in smart homes online through the internet. However, their scheme is unsafe against privileged insider and stolen verifier attacks because when an adversary steals the mobile device, the internally stored credentials can easily be identified and later used for malicious deeds. Ding et al. [26] designed a scheme using the fuzzy extractor method for securing user biometrics. However, their scheme is not safe against online/offline password-guessing attacks.
Kamble et al. [27] proposed a provable secure protocol for a tale-medicine information system using the chaotic map method. They have analyzed the security of their protocol through BAN logic and AVISPA simulation toolkit and claimed that their scheme has successfully preserved the privacy of users. However, using a chaotic encryption method, which is based on floating calculation, that in turn makes the hardware implementation difficult compared to AES and DES, which need integer operations. Meshram et al. [28] designed a scheme human-centred IoT system using the Quantum Chebyshev Chaotic (QCC) Maps method. They demonstrated that modelling analysis for IoT is much needed because of different human behaviour. Using encryption IoT can tackle the issue of human behaviour over IoT, but bilinear maps create hurdles while implementing these encryption-based security models. To mitigate this flaw, they have proposed the Quantum Chebyshev Chaotic (QCC) Maps method for the HC-assisted IoT system. However, due to using the Computational Diffie-Hellman [29] method for key exchange, their scheme is suitable for single-party authentication; when the number of participants increases, their scheme doesn’t show efficiency. Another scheme [30] based on Fractional Chebyshev Chaotic Map‑Based was also presented for the HC-IoT system. Upon going to check the protocol round-trips in the login authentication phase, it has been observed that in the first round trip, the identity is transmitted openly, which an attacker can catch and launch DoS and replay attacks later on. In [31], they used a digital signature technique for an HC-assisted IoT system. However, they didn’t tell the reader about what type of verification their algorithm will perform, either one-to-one or bach.
2.1 Review analysis of baseline scheme
Recently, [17] proposed a novel authentication scheme based on the bilinear mapping technique. They have taken two groups, namely |G|, |GT|, and Zp*, of key sizes 1024, 1024, and 160 bits, respectively. They have designed their scheme using SHA-256, symmetric encryption/decryption, and biometric Gen(.)/Rep(.) functions. Their scheme consisted of two phases, i.e., registration and login and authentication. The registration phase is accomplished at the following points:
- The user selects identity MIDi, and transmits it to the registration center.
- The RC chooses ri, xi, computes TMIDi = h(MIDi||ri), Bi = TMIDi⊕h(KRC||xi), stores {Bi, xi} and transmits {TMIDi, Bi, h(.)} back towards the user smart card.
- The user enters his/her PWi, generates biometrics BIOi, chooses ni, computes Gen(BIOi) = (σi, τi), Ci = ni⊕h(MIDi||PWi||σi), Authi = h(MIDi||PWi||σi||n), TMIDi* = TMIDi⊕h(n||PWi||σi), replace TMIDi with TMIDi* and injects {Ci, Authi, Gen(.), Rep(.), τi) in the memory of mobile smart card.
- Now, the server first chooses identity and transmits it to the registration center.
- The RC also chooses two orbitaray numbers rj, and xj, computes PSIDj = h(SIDj||rj), secret key of server KS = h(h(SIDj||KRC), Qj = h(SIDj||xj), Fj = rj⊕Qj, stores {Fj, PSIDj, xj} and transmits {KS, rj} back towards the server for also storing in its memory.
The login and authentication phase of the scheme [17] takes the following round-trips to complete. These are as follows:
- The user insert their smart card, provides MIDi, PWi, generates BIOi/ and computes Rep(BIOi/, τi) = σi/, nj/ = Ci⊕h(MIDi||PWi||σi/), checks Authi = h(MIDi||PWi|| σi/||ni/), if confirmed, user choses a number r1, time T1, computes TMIDi = TMIDi*⊕h(ni||PWi||σi/), r1/ = r1⊕h(SIDj||TMIDi), D1 = SIDj⊕h(TMIDi||T1), D2 = h(SIDj||TMIDi||r1||T1) and transmits {r1/, Bi, D1, D2, T1} towards RC over a public network channel.
- The RC checks the time space T1-Tc≤ΔT, computes TMIDi = B⊕h(KRC||xi), SIDj = D1⊕h(TMIDi||T1), r1 = r1/⊕h(SIDj||TMIDi), D2/ = h(SIDj||TMIDi||r1||T1), checks D/2? = D2, if becomes successful, RC selects a random number r2 and time T2, computes D3 = h(PSIDj||r2)⊕h(h(SIDj||KRC)), Qj = h(SIDj||xj), rj = Fj⊕Qj, TMIDi/ = h(PSIDj||rj)⊕TMIDi, D4 = h(h(PSIDj||r2||SIDj||T2) and transmits {r1/, T2, TMIDi/, D3, D4} towards server over a public network channel. 4
- The server checks the time validity T2-Tc≤ΔT, computes h(PSIDj||r2) = D3⊕h(KS), D4/ = h(h(PSIDj||r2||SIDj||T2), verify D4/ = D4, if passes, selects a random number r3 and time T3 and computes PSIDj = h(SIDj||rj), TMIDi = TMIDi/⊕h(PSIDj||rj), r1 = r1/⊕h(SIDj||TMIDi), SK = h(h(PSIDj||r2)||r1||r3||TMIDi), r3/ = r3⊕h(r1||SIDj), D5 = h(r1||r3||T3), D6 = h(SK||h(PSIDj||r2||r1) and transmits {r3/, T3, D5, D6} back towards RC over an open channel.
- The RC verify the time threshold, selects T4, computes r3 = r3/⊕h(r1|\SIDj), D5/ = h(r1||r3||T3), verify D5/ = D5, if validated, computes D7 = h(PSIDj||r2)⊕h(r1||TMID1), D8 = h(h(PSIDj||r2||r3||T4) and transmits {r3/, T4, D6, D7, D8} to user over open channel.
- The user check time space T4-Tc≤ΔT, computes r3 = r3/⊕h(r1||SIDj), h(PSIDj||r2 = D7⊕h(r1||TMIDi), D8/ = h(h(PSIDj||r2||r3||T4), checks D8/ = D8, if validated, computes SK = h(h(PSIDj||r2)||r1||r3||TMIDi), D6/ = h(SK||h(PSIDj||r2)||r1), confirms D6/ = D6, if matched, keep SK is secret session key for upcoming communication.
2.2 Cryptanalysis of baseline scheme
Upon thoroughly analyzing [17], the following vulnerabilities have been noticed:
1) Prone to Privileged Insider Threat: Many random numbers are extracted in each round trip of the protocol, which has a big chance for privileged insider threats. Similarly, in the scheme [17], the parameters stored in the smart card are {Ci, Authi, Gen(.), Rep(.),τi} in which a privileged user can select a random number rA, computes CA = rA⊕MIDi, Authi = MIDi⊕CA and TMIDA = MIDA||PWA⊕CA. After finding an identity, he/she can then easily launch a privileged insider attack. If we consider the same attack for the server, the credentials stored are {rj, Ks}, whereas rj is a random number while Ks = h(SIDj||s), which a privileged user can find easily. Therefore, [17] is prone to privileged insider threats.
2) Bias: The protocol presented in [17] minimizes biometric demographic bias for such a resource-limited environment. The biometrics used in [17] demonstrate notable variations in their functionality while engaging with distinct user demographics; they are deemed to be biased. As a result, some user groups enjoy privileges while others suffer disadvantages. They didn’t explain anything about bias and effectiveness in the user biometrics while authenticating or generating cryptographic keys.
3) Inaccuracy: The fuzzy extractor relies too much on expert knowledge and needs more capacity to gain insight from data. Therefore, the Gen(.) and Rep(.) functions can still have the chance of false rejection/accepting a legitimate user for entering the system credentials. The scheme presented is fuzzy extractor-based, in which a user authentication of biometrics is performed many times (fuzzy extractor is a challenge-response verification method), which causes heavy computation and communication costs. Also, a legitimate user can easily trace through biometrics/facial recognition/thumb extraction.
4) Stolen-Verifier Attack: Suppose an attacker steals the smart card and uses power analysis or reverse engineering techniques, chooses two random numbers LA, LB computes MA = h(MIDi||LA), BA = MA⊕h(LA||LB), obtain {BA, LA} which means
can reaches the identity and password, and then
uses it malicious deeds like launching replay, DoS, masquerade, impersonation, ESL, MITM, side-channel and other attacks. Therefore, a stolen verifier attack is possible on the scheme [17].
Considering all the drawbacks mentioned above, it has been concluded that [17] is a weaker scheme.
5) Tracebality, DoS and Replay Attacks: In the login and authentication phase of the protocol, the first message transmitted from the mobile user towards the registration centre is M1 = {r1/, B1, D1, D2, T1}. This message contains server identity SIDj, which an attacker can easily capture/identify in D1 = SIDj⊕h(TMIDi||T1) and violate the system’s privacy. Similarly, attacker can also use this server identity (SIDj) to launch replays and DoS attacks on the system. Therefore, the Wu et al. [17] scheme suffers from privacy issues and is vulnerable to traceability, DoS and Reply attacks.
6) Lack of Password Changing Phase: Despite using passwords by a user in the login and authentication phase of Wu et al.’s [17] scheme, they do not provide a facility for a legitimate user to change his/her password freely and securely.
All these vulnerabilities shall be mitigated by designing a robust, lightweight, and probable secure system for the teleworking environment.
3 System model
The proposed network model consists of a teleworking server (TS) that connects numerous Internet-of-Things (IoT) of the organization, a registration center (RC), and a remote-mobile user (MU). All the entities first register with the registration center (RC) over a reliable channel and then operationalize for the teleworkers in the teleworking environment. Suppose the RC is a fully trusted entity. In contrast, all other components, i.e., the Teleworking Server (TS) and mobile user (MU), may or may not be fully trusted, as shown in Fig 2. These participants can be described as follows:
- Registration Center (RC): It is responsible for registering all the entities within the organization (Teleworking server) or outside of the organization (remote/mobile user).
- Teleworking Server (TS): The teleworking server is placed between end-users and the IoT of the organization for data processing and broadcasting. Furthermore, TS provides reliable services with smaller latency to the remote user.
- Mobile-User (MU): It is either PCs, tablets, cell phones, or other network-enabled devices to get facilities prescribed by the teleworking server (TS)
As discussed, the popularity of teleworking is growing daily, allowing people to work from anywhere, utilizing various mobile devices and Internet services. Teleworking boosts business efficiency, productivity, and expenses, but securely accessing information, operating Internet-of-Things (IoT) remotely, and maintaining privacy are challenging concerns that have yet to be resolved. As a result, this study developed a security method that can effectively alleviate the security and privacy risks associated with teleworking. We will focus on the following main points:
- To design an architectural framework for a teleworker to utilize/access the resources remotely in the teleworking environment so that no one can weaken the remote access level.
- To propose a security mechanism that resisted all known threats on the client side during teleworking and can guarantee secure communication.
- To facilitate the teleworkers’ secure communication for working without breaks, saving businesses’ costs and managing time effectively.
- To facilitate the skilled individual to work without worrying about hacking, data leaking, and fishing so that they can feel more flexibility while working in the teleworking environment.
- The proposed scheme is without bilinear mapping, having no point multiplication exponentiation, and without symmetric encryption/decryption functions while offering excellent services to teleworkers.
- The secret session key secrecy, confidentiality, and authorization have been verified formally using ROR/ProVerif and informally using illustrations. The result shows that the mechanism is robust and lightweight for such a vulnerable environment.
- To comparatively analyze the designed scheme with present schemes regarding computation and communication overheads.
3.1 Design goals
The following goals can be achieved by designing a security mechanism [32,33] for teleworking environment protection:
- G1: Message authentication and integrity: mobile user/end-user (MU) mandatorily verifies the jurisdiction of the received message without being altered, modified, or forged by someone.
- G2: Confidentiality and Authorization: The request sent to the server or the response received by the end user must be confidential. No one can figure out its internal contents, and both peers must confirm the authenticity of each other and the message exchanged.
- G3: Conditional Privacy-Preserving: Except for the organization server, no other participants can trace the identity of the other participants.
- G4: Untraceability: Two sessions mandatorily will always start on a different key. Each session’s key must differ from other sessions; otherwise, a malicious user can easily trace the legitimate user.
- G5: Physical Protection: Protection of the system from active and passive attacks means the system is protected physically.
- G6: Resilience to Insider Threat: The server is accessible from any storage table; anyone accessing the internal credentials must not extract helpful information from memory. The internally stored credentials will be available to the attacker in a non-readable format to avoid any future hazard to the system.
- G7: Mutual Authentication: Each peer must mutually authenticate before starting data broadcasting. Each participant can verify the legality of messages and identities from other entities. If the verification fails, there may be a forgery attack.
- G8: Perfect Forward Secrecy: The 160-bit long keys cannot compute session keys without knowing hash values. It means that the secrecy of the previous session is not forward secrecy affected, even if the
can identify the long-term secret key, but still, A cannot succeed for hashed and encrypted values. Therefore, the proposed key agreement protocol satisfies the perfect feature.
- G9: Resists Man-in-the-Middle Attack: The security mechanism must be able to detect intruders. Each round trip must contain a random check to avoid a man-in-the-middle attack.
- G10: Resists Denial-of-Service (DoS) Attack: Message freshness, randomization, and pre-determined time threshold can deny any reply attack or DoS attack.
3.2 Threat model
This work adopted the threat model Dolev-Yao called DY-model [34]. According to this model, an attacker has the following capabilities:
- Attacker
can easily capture messages from the public network channel.
- Attacker
can modify the recorded message.
- Attacker
can delete the full or some part of a message captured from an open network channel.
- The attacker
can easily launch a reply attack.
- Attacker
can also divert the route of a message.
- Attacker
can guess different credentials from a publically transmitted message.
- An attacker
can steal the mobile device and obtain useful credentials using reverse engineering techniques.
- Attacker
might be a privileged insider sitting on the system.
4 Proposed protocol
The proposed protocol consists of registration, authentication, and password change phases. Each of these phases is described one by one as under, while the different notations used for designing the protocol are shown in Table 1.
4.1 Teleworking Server (TS) registration phase
This phase is accomplished in the following steps:
TS1: The teleworking server first generates IDTS, and sends them towards the registration center.
TS2: The registration center (RC) generates its secret key s, random numbers rTS, xTS, computes A = h(IDTS||rTS), B = h(IDTS||s), C = h(IDTS||xTS), D = rTS⊕C, store {A, D, and xTS}, and sends (rTS, B) back towards teleworking server over a private channel.
TS3: The teleworking, upon receiving (rTS, B), also stores it in its database, as shown in Fig 3.
4.2 Mobile User (MU) registration phase
This phase is completed in the following steps:
MU1: The mobile user generates its identity IDMU and sends it toward the registration center over a secure path.
MU2: The registration center (RC) first chooses its secret values s random numbers rMU, xMU, computes A/ = h(IDMU||rMU), B/ = A/⊕h(s||xMU), stores {A/, B/, h(.)} and transmits (A/, B/) back towards the mobile user (MU) over a private channel.
MU3: When receiving (A/, B/), the mobile user also stores it in its memory, as shown in Fig 4.
4.3 Login and authentication phase
The protocol’s most essential and logical phase is the login and authentication phase. This phase is completed in the following steps.
LA1: The mobile user (MU), first, provides their identity IDMU, password PW, computes D = (A/||B/)⊕h(IDMU||PW||r1), E = IDMU⊕h(D||PW||r1), r1/ = r1⊕h(IDTS||IDMU), record T1, compute: F = IDTS⊕h(IDMU||T1), G = h(IDTS||IDMU||r1||T1), and transmits (B/, r1/, F, G, T1) towards registration center (RC) over an open network channel.
LA2: The RC, first checks the time interval with the maximum available time threshold TC-T1≤ΔT; if it doesn’t validate, the potential reply attack is considered; otherwise, checkB/? = B/ = A/⊕h(s||xMU), it doesn’t match, the process will be denied, else compute: J = F⊕h(IDMU||T1), r1/ = r1⊕h(IDTS||IDMU), G/ = h(IDTS||IDMU||r1||T1), and confirms G? = G/, if becomes valid, the onward computation performed, otherwise, the process is terminated for potential DoS attack. The RC now retrieves A and selects T2 and r2. Computes Q1 = h(A||r2)⊕h(h(IDTS||s)), Q2 = h(IDTS||xTS), r2/ = D⊕Q2, A// = h(A||r2/)⊕A/, Q3 = h(h(A||r2||IDTS||T2), and transmits (r1/, A//, Q2, Q3, T2) towards teleworking server (TS) over the open path.
LA3: The TS first checks the time interval with the maximum available time threshold TC-T1≤ΔT; if it doesn’t validate, the potential reply attack is considered; otherwise, computes h(A||r2) = Q1⊕h(B), Q3/ = h(h(A||r2||IDTS||T2), checks Q3? = Q3/, if validated, the TS selects T3, r3 and computes A = h(IDTS||xTS), A/ = A//⊕h(IDTS||xTS), r1/ = r1⊕h(IDTS||A), SK = h(h(A||r2||r1||r3||A/), r3/ = r3⊕h(r1||IDTS), Q4 = h(r1||r3||T3), Q5 = h(SK||h(A||r2)||r1), and broadcast (r3/, Q4, Q5, T3) back towards RC, over an insecure channel.
LA4: The RC, first checks the time interval with the maximum available time threshold TC-T3≤ΔT; if it doesn’t validate, the potential reply attack is considered; otherwise, record timestamp T4, computes Q4 = h(r1||r3||T3), confirm Q4? = Q4/, if found valid, computes r3/ = r3⊕h(r1||IDTS), SK = h(h(A||r2||r1||r3||A/), Q/5 = h(SK||h(A||r2)||r1), check Q/5? = Q/5, compute: Q6 = h(A||r2)⊕h(r1||A/), Q7 = h(h(A||r2)||r3||T4) and sends (r3/, Q5, Q6, Q7, T4) to end-user via open channel.
LA5: The MU, first checks the time interval with the maximum available time threshold TC-T4≤ΔT; if it doesn’t validate, the potential reply attack is considered; otherwise, computes r3/ = r3⊕h(r1||IDTS), h(A||r2) = Q6⊕h(r1||A), Q7/ = h(h(A||r2)||r3||T4), confirms Q7? = Q7/, if fund valid, calculates SK = h(h(A||r2||r1||r3||A/), Q5 = h(SK||h(A||r2)||r1), checks Q5? = Q5/, if validates, keeps it the secret session key for future communication as shown in Fig 5.
Remark: The clock synchronization issue can be addressed by configuring each participant to the global clock so that it will establish the start and finish time slot as well as correct the offset and drift rate of the participants’ clock w.r.t global time.
4.4 Password change phase
If the mobile user (MU) desires to change their password, the proposed protocol offers the facility of changing it securely. In this regard, MU enters their identity IDMU, password PW and calculates: Am = h(IDMU||PW)⊕A, A/m = h(IDMU||PW)⊕Am, chooses a random number r5∈Z*n and calculates: A/m = h(A/m||r5)⊕Am. If A/m? = Am, asked the MU to enter a new password PWnew, upon provision of the new password PWnew, locally computes: A = h(IDMU||s), A/ = h(PWnew||r5), Anew = h(IDMU||PWnew)⊕A, A/new = h(IDMU||PWnew)⊕Anew and replaces {Am, A/m} with {Anew, A/new}, as shown in Fig 6.
5 Security analysis
In this section, the security of the proposed protocol can be analyzed using the random oracle model (ROM) [35] and ProVerif2.03 [36], which is also used by [18,21,26,28,30]. These are described one by one as follows:
5.1 ROM analysis
A standard formal security analysis method, namely the ROM, is used to analyse the proposed protocol’s shared session key between MU and RC and then RC and TS against an adversary . For achieving this goal, we first will go for the semantic approach and session key security. The different queries executed by an adversary
are discussed below; however, the collision-resistant one-way hash function will also be one of the participants for
, which can be demonstrated as H A S H, so by keeping these, the ROR model performed numerous elements, including RC, TS, MU in which MU and TS are engaged for mutual authentication apart from RC which primarily involved in the registration phase of the protocol. Let
and
identify the b1 and b2 instances of MU and TS correspondingly, also called random oracle instances.
1) Execute ():
eavesdrop on their own message among the shared message between MU and TS using this query.
2) Corrupt ():
forge parameters from the memory of a compromised MU using this query.
3) Reveal(∏b): can disclose the secret session key SK between MU and RC, RC, MU and other participants using this query.
4) Test(∏b): can test by calling ∏b to check the originality of SK, and ∏b received should be random for
, and
will definitely be flipped a coin, say d (Accepted Instance); in such a case, the following three cases will happen.
and
accepted state
and
session identification state
and
mutual participation state
5) Semantic Security: Let be fully authorized to run the Test(.) query and try to interfere Ƥ by polynomial tries. Individually, the three algorithms, i.e., Execute(.), Send(.), and Hash(.), are run in qE, qS, and qH. The Test(.) query once at most. Let lh be the length in a bit for a collision-resistant one-way hash function, and
be the average length of hash operation for another transcript in Ƥ. Then the advantage with
in breaking Ƥ by polynomial times attempt can be expressed as:
To pretend the different attacks on Ƥ, we justify through different games. The event
matching to these games means that
completes its goal in that specific game, which is defined one by one as under:
Game 0: In this environment, launch a genuine attack on Ƥ. To do so, the probability with
in cracking Ƥ is represented in Eq (1).
(1)
Game 1: In this environment,
launches Execute(.) and Test(.) queries for verifying the obtained results according to protocol’s Ƥ transcripts (B/, r1/, F, G, T1) which is related to session secret key SK. Conversely, due to random numbers for each round trip,
doesn’t diagnose the relationship of (B/, r1/, F, G, T1) with their obtained result through Test(.) query. However, the probability with
in identifying the relationship of Ƥ’s transcripts is represented in Eq (2).
(2)
Game 2: Here
calculates the session secret key SK from the messages transmitted over a public network channel, i.e. SK = h(h(A||r2||r1||r3||A/), but due to using SHA1 of key size 156-bits, difficult for
; however, the probability with
in computing SK from the openly transmitted messages of Ƥ is represented in Eq (3).
(3)
Game 3: In this environment,
runs Execute(.) and Send(.) queries to launch a hash image collision attack. According to the birthday paradox [32], the risk of hash collision is
. Meanwhile, the collision probability of other transcripts is
. Therefore, the probability with
for hash collision in Ƥ is represented in Eq (4).
(4)
Similarly, in the random bit r∈(0, 1), the probability with
of guessing the random number of Ƥ is represented in Eq (4).
(5)
Now, combine Eqs (1)–(5), we get
(6)
Eq (6) can also be expressed as:
5.2 Security model
This model consists of two peers–the Adversary and–the Responder Ɽ.
communicate either mobile user (MU) or TS or RC, but we denote all of them a Ëσ which means σth instance of any of them either MU, TS or RC.
launches the queries, and responses received from Responder Ɽ are shown in Table 2.
- ËSn means
impersonate MU, TS, RC by forcing r 1 or r2
- ËNs means
forges r3 or r4 from the participants
- ËSS means
overcomes the semantic security of the protocol.
5.3 ProVerif2.03 simulation
This is a formal security analysis method in which we will check the key’s robustness, key’s secrecy, confidentiality, and reachability; a programming verification toolkit ProVerif2.03 [36] is in S1 Appendix of this article. However, upon running the code, the result shows that the attacker couldn’t crack the secret session key at any computation stage. The status of SK is secure, and its confidentiality and reachability are preserved as shown under:
————————————————
Verification summary:
Query not attacker(SK[]) is true.
Query inj-event(end_MU(IDmu[])) = = > inj-event(start_MU(IDmu[])) is true.
Query inj-event(end_RC(IDrc[])) = = > inj-event(start_RC(IDrc[])) is true.
Query inj-event(end_TS(IDts[])) = = > inj-event(start_TS(IDts[])) is true.
————————————————
5.4 GNY logic analysis
The GNY logic [37] is a formal method of security analysis which Gong-Needham-Yahalom first introduced for the formal proof of a security protocol. The different formulae and statements used in this logic are shown in Table 3.
Now, we are using GNY logic for the proposed protocol and make assumptions which are as follows:
(7)
(8)
(9)
(10)
(11)
(12)
(13)
(14)
(15)
(16)
(17)
(18)
(19)
(20)
We transformed the proposed scheme to P→Q: (X) from fill-in GNY logic and made some changes to notations.
Using GNY logic, the proposed scheme can be represented as:
(21)
(22)
(23)
(24)
(25)
(26)
(27)
(28)
(29)
(30)
(31)
(32)
(33)
(34)
(35)
(36)
The mobile user keeps IDMU, and PWMU in its memory and can extract r1 during computations, so by applying the GNY logic and Eq (7), we have
(37)
Eqs (12) and (37), we have
(38)
Eqs (17) and (38), we have
(39)
(40)
Eqs (37) and (39) become:
(41)
Eq (41) becomes:
(42)
(43)
Keeping Eqs (42) and (43), and the credentials checking by mobile-user in which each part/parameter of the message passed/verified to and from RC, as shown as under:
(44)
(45)
(46)
(47)
Keeping Eqs (46) and (47), and the credentials checking by teleworking-server in which each part/parameter of the message passed/verified to and from RC, as shown under:
(48)
(49)
(50)
(51)
From Eqs (44) and (45), we have:
(52)
(53) Goal 1 Achieved
From Eqs (48)-to-(51), the same for RC, as RC has full control over the message in, and out
, so we have
(54)
(55)
(56) Goal 2 Achieved
From Eqs (52)-to-(56), again for RC because the RC has complete control over the message in, and out
, so we have
(57)
(58)
(59)
(60)
(61)
(62)
Like RC (Eqs (57)-to-(62), we will use the GNY logic for a mobile user, as MU also sees
and
, messages, so, we have :
(63)
(64)
(65)
(66) Goal 3 Achieved
5.5 Informal security analysis
Assume an adversary has complete control over the open network and can intercept, manipulate, delete, or update the communication transmission between participants. Then, there’s how the presented authentication system will withstand identified weaknesses. In this section of the study, we shall address such assumptions one by one as follows:
5.5.1 Resists side channel attack.
The presented security mechanism is generally less dependent on key numbers, strongly validates the main attributes at various steps, and calculates a different secret session key for each session, which leads to the sequence of operations changing for another session. Similarly, the availability of timestamps at each round trip of the protocol and the exchange of random numbers differently for the different sessions means that the proposed security mechanism efficiently withstands a side-channel attack.
5.5.2 Resists insider attacks.
The registration center (RC) first picks a random number s of size 160-bits, rTS, xTS, then concatenates it with the identity of a mobile user or teleworking server to quickly calculate the secret session key. The hash code generated is a collision-free and non-readable format, so the cannot, at any stage, identify the identity or password from stored values. Similarly, the messages exchanged among participants are changed for upcoming sessions; if an
gets access to the internal credentials, their attempt fails due to choosing large random numbers by each peer, complex calculations, and arbitrary computation of the secret session key. Therefore, the teleworking environment security mechanism resists insider threats.
5.5.3 Resists stolen-verifier attack.
Suppose an attacker steals the mobile device, embezzles personal values from the teleworking server’s memory and attempts to figure out the identities or passwords. In that case, they will fail because the proposed security mechanism is based purely on large random numbers and SHA-1. Due to the large random numbers r1, r2, r3, r4, r5, s, xTS, rTS for every session key and the linkage of these numbers with the identity/password,
cannot succeed. Therefore, the proposed scheme withstands a stolen verifier attack.
5.5.4 Resists man-in-the-middle attack.
Suppose an attempts to modify, discard, update, copy, or divert the exchanged information between MU→RC (B/, r1/, F, G, T1), RC→TS (r1/, A//, Q2, Q3, T2), or TS→RC (r3/, Q4, Q5, T3), RC→MU (r3/, Q5, Q6, Q7, T4) and the peers believed that some malicious entity acted, then promptly stop the establishment of secure session key. But to do so, the
doesn’t know the 160-bit long random numbers r1, r2, r3, XMU, rMU, xTS, rTS, so any illegal attempt will promptly be detected due to randomness in the exchanged information. Also, the recorded time threshold for each round trip and message confirmation can ensure mitigation of man-in-the-middle attack. Any independent connection establishment by any third party, the secret values which are not known to anyone, identities and random numbers can mitigate/cater to malicious deeds (man-in-the-middle attack, etc.) in the proposed lightweight authentication and key establishment protocol. Therefore, our proposed scheme is safe against man-in-the-middle attacks.
5.5.5 Spoofing attack.
Suppose an desires to succeed in sending false messages to a teleworking server (TS). In that case, they will fail due to verifying a pre-defined time threshold in each round trip. Also, other checks for different messages like G = h(IDTS||IDMU||r1||T1) and G/ = h(IDTS||IDMU||r1||T1), Q3 = h(h(A||r2||IDTS||T2) and Q3/ = h(h(A||r2||IDTS||T2) in the proposed security mechanism can strongly mitigate a spoofing attack.
5.5.6 Withstands replay attack.
If an capture (B/, r1/, F, G, T1) message or (r1/, A//, Q2, Q3, T2) or (r3/, Q4, Q5, T3) or (r3/, Q5, Q6, Q7, T4) or all form the open network channel and reply some other time for a potential replay attack.
don’t make successful due to timestamp check in the first stage and several further checks, i.e., G = h(IDTS||IDMU||r1||T1) and G/ = h(IDTS||IDMU||r1||T1), Q3 = h(h(A||r2||IDTS||T2) and Q3/ = h(h(A||r2||IDTS||T2) in the second stage. Therefore, the proposed security mechanism is robust against reply attacks.
5.5.7 Key secrecy.
Each entity mutually authenticate each other like G = h(IDTS||IDMU||r1||T1) and G/ = h(IDTS||IDMU||r1||T1), Q3 = h(h(A||r2||IDTS||T2) and Q3/ = h(h(A||r2||IDTS||T2) which in turn confirming secret session key SK = h(h(A||r2||r1||r3||A/), Q/5 = h(SK||h(A||r2)||r1). This means that the secrecy of the secret session key is strong in the proposed security mechanism.
5.5.8 Password guessing attack.
Suppose an adversary desires to extract the internal secret parameters from the mobile devices due to D = (A/||B/)⊕h(IDMU||PW||r1), E = IDMU⊕h(D||PW||r1), r1/ = r1⊕h(IDTS||IDMU), F = IDTS⊕h(IDMU||T1), G = h(IDTS||IDMU||r1||T1) and 64-bits of random numbers rMU, xMU, r1, he/she cannot extract password from the stolen mobile device or illegal internal entry. Also, the proposed protocol has many checks at different round trips and can also deny any illegal attempt of an
for guessing online/offline password guessing attacks. Therefore, the proposed protocol resists password-guessing attacks.
5.5.9 Untracebality.
The user in the proposed protocol is untraceable because the messages transmitted over a public network channel cannot be revealed to an attacker. For example, if an attacker desires to find the identity from these messages {B/, r1/, F, G, T1}, {r1/, A//, Q2, Q3, T2}, {r3/, Q4, Q5, T3}, {r3/, Q/5, Q6, Q7, T4} they have to pass from many complex calculations. Also, the timestamp, random nonce and 64 bits of long key are concatenated with the identity, and the attacker couldn’t figure out any useful information from any of the messages exchanged over public channels. Therefore, the proposed protocol provides the facility for the user to be untraced and secure, and their privacy could be preserved.
5.5.10 Physical protection.
If someone wants to avail of the facilities using the proposed protocol must pass the registration phase. Suppose some culprit captures any legitimate user or mobile device and tries to find valuable credentials from it. The culprit must compute A = h(IDTS||rTS), B = h(IDTS||s), C = h(IDTS||xTS) and D = rTS⊕C for the mobile device, and A/ = h(IDMU||rMU), and B/ = A/⊕h(s||xMU) for the teleworking server; which is absolutely not possible. Suppose someone finds useful credentials, like key, identity, or any other parameter, they cannot establish a connection with the system due to the dynamicity of each message, and such an attempt could promptly be highlighted to the organization, and no peer can negotiate with an illegitimate third party at any stage. Therefore, the physical protection feature is available in our scheme.
5.5.11 Withstands DoS attack.
If an capture (B/, r1/, F, G, T1) message or (r1/, A//, Q2, Q3, T2) or (r3/, Q4, Q5, T3) or (r3/, Q5, Q6, Q7, T4) or all form the open network channel and launches a DoS attack on the system.
don’t make successful due to timestamp check in the first stage and several further checks, i.e., G = h(IDTS||IDMU||r1||T1) and G/ = h(IDTS||IDMU||r1||T1), Q3 = h(h(A||r2||IDTS||T2) and Q3/ = h(h(A||r2||IDTS||T2) in the second stage. Therefore, the proposed security mechanism is robust against DoS attacks.
5.5.12 Perfect forward secrecy.
We have a user password change phase, in which a legal user can easily, securely and efficiently update their password without interacting with the TS or RC, which means the proposed secure framework offers high scalability and deposits the RC. It means any change in the stored credentials could be submitted to RC and alternately to all peers. So, upon computing the session key, all the credentials can be secretly changed from the user side to the server. This prominent feature is available in the proposed security framework.
6 Performance and comparative analyses
The performance of the proposed protocol can be measured by considering computation and communication costs. These are as follows:
6.1 Computation costs analysis
Suppose TE is the time consumed when a random number is extracted, Th is the time for a collision-free one-way hash function, and TXoR is the time of XOR operation, as shown in Table 4 and diagrammatically is shown in Fig 7. According to [38,39], the different times for different cryptographic operations are as follows:
- Computation time for extracting random numbers TE = 2.011ms
- Computation time for one-way hash function Th = 0.09ms
- Computation time for bit-wise XOR Operation TXoR≈0ms
It is worth mentioning that only the cost calculated in the login authentication phase can be considered as computation costs, which is 6TE+42Th+18TXOR = 6(2.011)+42(0.09)+0 = 12.066+3.78 = 15.786ms, while the computation costs of registration phase should be discarded.
6.2 Communication costs analysis
The messages transmitted during the login and authentication phase among different participating entities are {B/, r1/, F, G, T1}, {r1/, A//, Q2, Q3, T2}, {r3/, Q4, Q5, T3}, and {r3/, Q5, Q6, Q7, T4}. According to [38,39], identity takes 60 bits of space, timestamp 56, random number 64 bits, and one-way to function is 156 bits of memory space; then the communication costs of the proposed protocol in bits are shown in Table 5, while diagrammatically as shown in Fig 8.
6.3 Comparative analysis
By comparing the proposed protocol in terms of extra security features with Chall et al. [22], Wazid et al. [23], Shuai et al. [24], and Oh et al. [25], which is shown in Table 6. The result shows that our protocol is resisting all the design goals discussed in section II of the paper.
Similarly, to compare the proposed scheme with Xia et al. [7], Wazid et al. [23], Ding et al. [26], and Yang et al. [40] in terms of computation and communication costs, as shown in Table 7. The results show that the proposed security mechanism is lightweight, fast, secure, and suitable for practical implementation in the teleworking environment. The comparison in computation and communication overheads are diagrammatically depicted in Figs 9 and 10, respectively.
Furthermore, the proposed protocol has better performance than its competitors, i.e. Xia et al. [7], Wazid et al. [23], Ding et al. [26], and Yang et al. [40]. The percentage improvement of the proposed protocol with the mentioned schemes is shown in Table 8.
Table 8 argued that the proposed protocol is 8.94% better in communication costs than the Xia et al. [7] scheme, 20.66% from the Wazid et al. [23] scheme, 34.4% from the Ding et al. [26] and 33.22% from the Yang et al. [40] scheme. The maximum improvement in communication costs is 34.4%, and the minimum is 8.94%. Similarly, the percentage improvement of our scheme in terms of computation costs is 73.17% with Xia et al. [7], 66.09% with Wazid et al. [23], 3.89% with Ding et al. [26] and 66.49% with Yang et al. [40] scheme. The maximum improvement is 73.17%, and the minimum is 3.89%. It is keeping in view that our scheme is superior to its competitors.
7 Conclusion
Nowadays, people prefer remote work through the Internet (teleworking environment) instead of visiting physically. Such an environment is prone to numerous security issues like eavesdropping, unavailability, masquerading, replay, DoS, etc., and attacks. To make it prone-free, we have, in this article, proposed a lightweight and robust authentication protocol for those continuously using the Internet for remote monitoring of official work and securely authenticating before starting work. We have used SHA1 for the design of a protocol that is lightweight, robust in security, and offers efficient services to all the participants. We have tested the security of the proposed authentication protocol through a well-known formal technique, ROM analysis, programming verification toolkit ProVerif2.03, and informally via programmatic discussions. The performance analysis of the proposed security mechanism has been evaluated by considering computation and communication costs. Upon comparing the proposed mechanism with the existing security schemes in terms of security features and performance metrics, it has been demonstrated that the proposed protocol achieved a maximum of 34% improvement in computation and 73% improvement in communication costs and resisted all known vulnerabilities and can be implemented practically in the teleworking environment.
In the future, the proposed security scheme can be designed using blockchain technology, and the simulation part can be conducted through a network security simulator (NeSSi).
References
- 1. Khan MA, Din IU, Almogren A. Securing Access to Internet of Medical Things Using a Graphical-Password-Based User Authentication Scheme. Sustainability. 2023; 15(6): 5207.
- 2. James P, Griffiths D. A secure portable execution environment to support teleworking. Information Management & Computer Security. 2014; 22(3): 309–30.
- 3. Moon C, Stanworth C. Ethical issues of teleworking. Business ethics: A european review. 1997; 6(1): 30–4.
- 4. Soltani S, Hosseini Seno SA, Rejito J, Budiarto R. Robust Authentication and Session Key Agreement Protocol for Satellite Communications. Computers, Materials & Continua. 2022; 71(3): 15–35.
- 5. Solís MS. Telework: conditions that have a positive and negative impact on the work-family conflict. Academia Revista Latinoamericana de Administración. 2016; 29(4): 435–49.
- 6. Scarfone K, Hoffman P, Souppaya M. Guide to enterprise telework and remote access security. NIST Special Publication. 2009; 800(2009): 46.
- 7. Xia M, Li S, Liu L. A Secure Three-Factor Authenticated Key Agreement Scheme for Multi-Server Environment. Computers, Materials & Continua. 2020; 64(3): 47–64.
- 8. Gupta S, Alharbi F, Alshahrani R, Kumar Arya P, Vyas S, Elkamchouchi DH, Soufiene BO. Secure and lightweight authentication protocol for privacy preserving communications in smart city applications. Sustainability. 2023; 15(6): 5346.
- 9. Zhen J, Dong K, Xie Z, Chen L. Factors influencing employees’ information security awareness in the telework environment. Electronics. 2022; 11(21): 3458.
- 10.
Salami OW, Demchenko Y, Adedokun EA, Mu’azu MB. SIMP-REAUTH: a simple multilevel real user remote authentication scheme for mobile cloud computing. InInformation and Communication Technology and Applications: Third International Conference, ICTA 2020, Minna, Nigeria, 2021 (375–388). Springer International Publishing.
- 11. Ahn J, Lee SW, Kim H. NFC based privacy preserving user authentication scheme in mobile office. International journal of computer and communication engineering. 2016 Jan 1;5(1):61.
- 12. Jan SU, Abbasi IA, Alqarni MA. LMAS-SHS: A Lightweight Mutual Authentication Scheme for Smart Home Surveillance. IEEE Access. 2022 May; 10: 791–803.
- 13. Jan SU, Qayum F. Mitigating the desynchronisation attack in multiserver environment. IET Communications. 2020; 14(13): 2210–21.
- 14. Ali Z, Hussain S, Rehman RH, Munshi A, Liaqat M, Kumar N, Chaudhry SA. ITSSAKA-MS: An improved three-factor symmetric-key based secure AKA scheme for multi-server environments. IEEE Access. 2020; 8: 7993–8003.
- 15. Amin R, Kumar N, Biswas GP, Iqbal R, Chang V. A light weight authentication protocol for IoT-enabled devices in distributed Cloud Computing environment. Future Generation Computer Systems. 2018; 78: 05–19.
- 16. Chaudhry SA, Kim IL, Rho S, Farash MS, Shon T. An improved anonymous authentication scheme for distributed mobile cloud computing services. Cluster Computing. 2019; 22: 595–609.
- 17. Wu TY, Meng Q, Yang L, Guo X, Kumari S. A provably secure lightweight authentication protocol in mobile edge computing environments. The Journal of Supercomputing. 2022; 78(12): 893–914.
- 18. Jia X, He D, Kumar N, Choo KK. A provably secure and efficient identity-based anonymous authentication scheme for mobile edge computing. IEEE Systems Journal. 2019; 14(1): 60–71.
- 19. Gope P, Hwang T. A realistic lightweight anonymous authentication protocol for securing real-time application data access in wireless sensor networks. IEEE Transactions on industrial electronics. 2016; 63(11): 24–32.
- 20. Shafiq A, Altaf I, Mahmood K, Kumari S, Chen CM. An ECC based remote user authentication protocol. Journal of Internet Technology. 2020; 21(1): 85–94.
- 21. Taher BH, Liu H, Abedi F, Lu H, Yassin AA, Mohammed AJ. A secure and lightweight three-factor remote user authentication protocol for future IoT applications. Journal of Sensors. 2021; 2021: 1–8.
- 22. Challa S, Wazid M, Das AK, Kumar N, Reddy AG, Yoon EJ, Yoo KY. Secure signature-based authenticated key establishment scheme for future IoT applications. Ieee Access. 2017;5: 28–43.
- 23. Wazid M, Das AK, Odelu V, Kumar N, Susilo W. Secure remote user authenticated key establishment protocol for smart home environment. IEEE Transactions on Dependable and Secure Computing. 2017; 17(2): 391–406.
- 24. Shuai M, Yu N, Wang H, Xiong L. Anonymous authentication scheme for smart home environment with provable security. Computers & Security. 2019; 86: 132–46.
- 25. Oh J, Yu S, Lee J, Son S, Kim M, Park Y. A secure and lightweight authentication protocol for IoT-based smart homes. Sensors. 2021; 21(4): 1488. pmid:33669920
- 26. Ding Z, Xie Q. Provably Secure Dynamic Anonymous Authentication Protocol for Wireless Sensor Networks in Internet of Things. Sustainability. 2023; 15(7): 5734.
- 27. Kamble A, Gaikwad V, Tembhurne J. A provably lightweight mutually authentication and key establishment protocol using extended chaotic map for telecare medicine information system. International Journal of Information Technology. 2023; 24: 1–7.
- 28. Meshram C, Ibrahim RW, Yupapin P, Bahkali I, Imoize AL, Meshram SG. An efficient certificateless group signcryption scheme using Quantum Chebyshev Chaotic Maps in HC-IoT environments. The Journal of Supercomputing. 2023; 4: 1–26.
- 29. Vijayakumar P, Azees M, Kannan A, Deborah LJ. Dual authentication and key management techniques for secure data transmission in vehicular ad hoc networks. IEEE Transactions on Intelligent Transportation Systems. 2015 Nov 11;17(4):1015–28.
- 30. Meshram C, Lee CC, Bahkali I, Imoize AL. An Efficient Fractional Chebyshev Chaotic Map-Based Three-Factor Session Initiation Protocol for the Human-Centered IoT Architecture. Mathematics. 2023; 11(9): 2085.
- 31. Meshram C, Obaidat MS, Tembhurne JV, Shende SW, Kalare KW, Meshram SG. A lightweight provably secure digital short-signature technique using extended chaotic maps for human-centered IoT systems. IEEE Systems Journal. 2020; 15(4): 5507–15.
- 32. Wright F. Design Goals for an Internet Printing Protocol. 1999 Apr.
- 33.
Tembhurne JV, Diwan T, Jain TK. IoT Security and Privacy. InModern Approaches in IoT and Machine Learning for Cyber Security: Latest Trends in AI 2023 (pp. 45–61). Cham: Springer International Publishing.
- 34. Cervesato I. The Dolev-Yao intruder is the most powerful attacker. In16th Annual Symposium on Logic in Computer Science—LICS. 2001; 1: 1–2.
- 35. Canetti R, Goldreich O, Halevi S. The random oracle methodology, revisited. Journal of the ACM (JACM). 2004; 51(4): 57–94.
- 36. Blanchet B, Smyth B, Cheval V, Sylvestre M. ProVerif 2.00: automatic cryptographic protocol verifier, user manual and tutorial. Version from. 2018; 16: 05–16.
- 37. Gong L, Needham RM, Yahalom R. Reasoning about Belief in Cryptographic Protocols. In IEEE Symposium on Security and Privacy 1990; 1990: 234–248.
- 38. Chaudhry SA, Yahya K, Karuppiah M, Kharel R, Bashir AK, Zikria YB. GCACS-IoD: A certificate based generic access control scheme for Internet of drones. Computer Networks. 2021; 191: 107999.
- 39. Kilinc HH, Yanik T. A survey of SIP authentication and key agreement schemes. IEEE communications surveys & tutorials. 2013; 16(2): 1005–23.
- 40. Yang Z, Lai J, Sun Y, Zhou J. A novel authenticated key agreement protocol with dynamic credential for WSNs. ACM Transactions on Sensor Networks (TOSN). 2019; 15(2): 1–27.