7
Biometric‐Based Robust Access Control Model for Industrial Internet of Things Applications

Pardeep Kumar and Gurjot Singh Gaba

Abstract

Information and operational technologies are being used together and making the industrial Internet of Things (IIoT) happen in the Industry 4.0 paradigm. In this paradigm, smart devices (i.e. sensors) will be offered services and shared data to the user and so the cloud. As these devices will communicate with the users through the open network (i.e. Internet), user authentication is one of the most important security features to protect IIoT data access from unauthorized users. However, there exist traditional security techniques but these require heavy computational complexities. Therefore, such traditional schemes cannot be deployed directly to the smart devices in IIoT applications. This chapter proposes a biometric‐based robust access control model (i.e. user authentication) that would perform a robust authentication and establish a session key between the user and smart devices. The effectiveness of the proposed scheme is demonstrated in terms of computation cost in the IIoT environment.

Keywords: industrial internet of things; security; access control; biometric

7.1 Introduction

The connection between industry and the advancement in computing, analytics, low‐cost sensing and seamless connectivity of internet is full of promise [1]. The degree of transformation is emerging and there is reference to a “breakthrough” in terms of production and operational speed and efficiency. The new innovative constructs are all around the “data,” which can now be gathered from plants, equipment, electrical and mechanical machines, thanks to low‐cost smart sensors and other smart devices. These smart devices are equipped with processing and communication capabilities. Therefore, new and innovative technologies, concepts and platforms are significantly on the increase in the setting up of the industrial automation: industrial Internet, Industry 4.0, and IIoT [2]. In [3], the authors reported that the IIoT revolution will impact economic sectors that currently account for nearly two‐thirds of global gross domestic product, changing the basis of competition and redrawing industry' boundaries.

In the smart factories or industries (i.e. manufacturing, assembly, etc.), IIoT makes best use of production and assembly processes producing more fine‐grained data by integrating seamless connectivity and computing to various machines, assembly lines and tools. More precisely, during the working process, smart factories generate an enormous amount of data through “smart devices,” i.e. devices with microprocessors onboard [2]. This data is transmitted to the users, control centers and other machines via a wireless communication network to maintain smooth and accurate operations in the factories. As smart devices are resource‐constrained devices, the potential deployment of smart devices (i.e. sensors) for the real‐world IIoT applications must deal with many challenges, including system architecture, availability, quality‐of‐services, etc.

Among these challenges, security is also one of the big concerns as the smart devices exchange data with other devices via insecure networks (e.g. Internet) [4]. Exploiting insecure networks, an attacker can trace and collect the data via eavesdropping and can redraw the profile of the process (i.e. production status) or other useful information of personal interest in a factory use‐case. Moreover, in various applications, smart devices provide services to users directly or a user can directly access the smart devices via their own hand‐held device. However, it is necessary to control who is accessing the smart device data as shown in Figure 7.1. Therefore, security services, i.e. access control (and/or authentication) is one of the core requirements for IIoT to protect the data access from unauthorized parties [4].

Illustration depicting an example of application of industrial IoT. Devices sending signals to users with handheld devices.

Figure 7.1 Industrial internet of things applications.

7.2 Related Work

Recently, several authentication schemes have been proposed which focus on IIoT applications. For instance, in [5], Ma et al. proposed a new certificateless searchable public key encryption method with multiple keywords (SCF‐MCLPEKS) for the IIoT environment. The authors demonstrated that their proposed scheme is secure against two types of adversaries, e.g. Type 1 and Type 2. However, SCFMCLPEKS exploits the concept of a network‐wide master, therefore, a leak of master key may lead to several attacks. In addition, the SCFMCLPEKS utilized the traditional public key primitives, such as scalar multiplication and bilinear pairing, therefore, it needs more energy for the smart devices attached with IIoT.

Gope et al. proposed a lightweight and physically secure anonymous mutual authentication protocol for real‐time data access in an industrial wireless sensor network (WSN) [6]. The authors discussed three different application scenarios, environmental sensing, condition monitoring in body‐area network, and process monitoring. The scheme makes use of the physically unclonable function and bitwise XOR operation. However, Katzenbeisser et al. [7] claimed that the main drawback of Physical Unclonable Function (PUF) is limited reproducibility and openness. In addition, raw PUF data is rarely available for subsequent research, which greatly hinders a fair comparison.

In [8], Das et al. proposed a new biometrics‐based privacy‐preserving user authentication scheme (BP2UA) for cloud‐based IIoT deployment. BP2UA uses the user's smart card and biometric as two factors for authentication purpose. The scheme proposed in [8] uses bitwise Exclusive‐OR and cryptographic hash operations at the smart devices's side, whereas the fuzzy extractor method is applied for biometric verification at the user side. The authors claimed that their proposed scheme is secure against many attacks, e.g. impersonation, man‐in‐the‐middle, replay, insider, denial‐of‐service attacks, etc. The scheme does indeed cover many security properties; however, the scheme may be vulnerable to masquerade attack. In addition, the overall communication cost is still expensive as the packet length is high compared to other schemes mentioned by the authors. In [9], Bilal‐Kang designed an authentication protocol in the future sensor network setting in which IoT can be embedded with WSN. In this scheme, a sensor node (a legitimate user) can establish multiple concurrent secure data sessions. They may be vulnerable to a parallel‐session attack that can lead to other issues.

As shown above, several secure services and attacks have been addressed in the literature [5,9]. However, several papers revealed that the most likely threat to information security is not the typical hacker, virus, or worm, but rather the malicious insider user [10]. In existing literature, the security‐related all parameters (e.g. passwords, biometrics, plain identities, etc.) are stored onto corresponding smartcards. Therefore, security related parameters (especially row information) from the smartcards, are easy to retrieve via the power analysis tools [8] and that may lead to high risks of security breaches.

To address the above issues, this chapter proposes a biometric‐based robust access control model for IIoT applications. The proposed scheme utilizes the biometric to perform robust authentication – because biometric identifiers are known to unique to individual's and more reliable in verifying identity than those of the sole password‐based methods. The proposed model provides a robust mutual authentication and establishes a session key between the user and smart devices. To attain a low‐computational overhead, we utilize elliptic curve cryptography (ECC), symmetric cryptosystem, and hash operation. Security analysis shows that the proposed model can defend popular attacks and also achieve efficiency.

The rest of the chapter is structured as follows: Section 7.2 discusses the network model, threat model, security requirements for the proposed model. Section 7.3 proposes our model in detail. Section 7.4 discusses the security analysis, efficiency evaluation and comparison with existing schemes for WSNs. Section 7.5's conclusions are drawn for the proposed access control model.

7.3 Network Model, Threat Model and Security Requirements

7.3.1 Network Model

Assume an IIoT network, consists of several low‐cost smart sensor devices, which are deployed in the industrial environment. These sensors sense the environmental information and transmit them to the users for analysis. In a real‐world IIoT, the sensory data is not only accessed through a gateway, but a user can also access it directly using a hand‐held device (e.g. personal digital assistant (PDA)/smart‐phone) over wireless communication. The basic network architecture is shown in Figure 7.1, where a user directly sends a data request to the smart sensor node. Upon receiving the data request, a sensor node first verifies user authenticity through the gateway node and then the user can access sensory data from the IIoT applications.

7.3.2 Threat Model

We consider the Dolev‐Yao attack model [10], where an attacker can eavesdrop on the traffic, inject new messages, replay and change messages, or spoof other identities. In addition, the attacker may come from inside or outside the network. However, the unauthorized user's goals might be to obtain illegitimate data access, to control the smart devices, and to perform service degradation or denial of service (DoF) to disrupt the IIoT application.

7.3.3 Security Goals

In the IIoT network, a secure scheme should consider transparent security goals, as follows.

  • Mutual authentication: Every entity (user, gateway, and sensor) must be mutually authenticated; hence they can ensure the communication is only taking place between authentic entities.
  • Session key establishment: A session key should be established between a user and sensor node, so that subsequent communication could take place securely.
  • Confidentiality: It is desirable that a user authentication protocol facilitate confidentiality of messages; as a result, these confidential messages can only be used by authorized users.
  • Robust against popular attacks: Clearly, the scheme should defend against different popular attacks, such as impersonation, replay, and man‐in‐the‐middle attacks. As a result, the scheme should be easily applicable to real‐world applications.

7.4 Proposed Access Control Model in IIoT

To provide strong security to IIoT applications, this section presents a biometric‐based robust access control model. In the proposed scheme, each user should perform a biometric‐based registration with the gateway in a secure manner so that the sensory data in IIoT applications can be accessed only by the registered users in a secure way, as shown in Figure 7.2. After user registration, the gateway node issues the security tokens for every registered user. Then, a user can submit his/her query in an authentic way and request the sensor data at any time within an administratively configurable period. The proposed scheme consists of two phases: system setup, and mutual authentication and key establishment.

Illustration of a network model. Users with smartphones/PDA or laptop request signals from sensors in IIoT network from gateway/base station, which responds via these sensors back to the users.

Figure 7.2 Network model.

Assumptions: Before starting the system, we assume that the gateway is a trustworthy entity. It is also assumed that the clocks of the user's mobile device, gateway, and smart sensor are synchronized in IIoT application [11]. Consider the elliptic curve discrete logarithm problem (ECDLP), to find an integer r, given an elliptic curve E defined over Fq, a point P ∈ E(Fq) of order n, and a point Q = r P where 0 ≤ r ≤ n − 1, as shown in [12]. The notations and descriptions are shown in Table 7.1.

Table 7.1 Symbols and descriptions.

Symbol Description
idU, idGW, and idSD Identities of a user (U), Gateway (GW), and smart device (SD)
PWu Password of user U.
HD A hand‐held device, e.g. mobile phone
Fq A finite field
E Elliptic curve defined on finite field Fq with prime order n
G Group of elliptic curve points on E
P A point on elliptic curve points on E
EK[M] M is encrypted (E) with symmetric Key K
DK[M] M is decrypted (E) with symmetric Key K
KGWSD A shared key between the GW and SD
h() One‐way hash function
MAC{M} Message authentication code on message M
||, Concatenation operation
⊕ Ex‐or operation

7.4.1 System Setup

To start the system setup, the user (Ui) and the GW need to perform the following steps to finish the system setup:

  1. (i) Each user (Ui) generates own identity (idU) and password (pwU) and inputs idU, pwU and personal biometric (BU) to the GW for the registration.
  2. (ii) GW chooses two private keys y, z ∈ Zp, and then computes two public keys, Pub1 = yP and Pub2 = zP. It generates a long‐term shared key (KGWSD) and shares a private key (z) and a public key (Pub1) with the SD. Now, the GW generates a random number m and computes the security for each user's hand‐held device (e.g. HD), as follows: a proxy key pair S = mP and α = y + m h(h(S)||idU). In addition, the GW generates a unique token (UTU ∈ Zp) and computes gU = h(UTU||idU||pwU||BU) for each user. The GW stores the proxy key pair (S, α) along with idU, pwU, BU of all SDs. Then each SD's key pair (S, α), public key (pub2), UTU, gU, idGW, h() are stored securely to each corresponding HD SIM card.

7.4.2 Authentication and Key Establishment

This phase invokes when the user wants to access the IIoT data locally. For this, user inputs idU, pwU and BU and then the HD performs following steps:

  1. (i) HD computes gU* = h(UTU||idU||pwU||BU) and verifies gU* = gU. It generates a random integer o, computes A = oP, Φ = h(o. pub2) ⊕ (S,idU,BU, t1), μ = α. h(h(A)|| Φ||idSD|| idGW) + o, and tag = MAC {UTU,(idU||BU|| α||idSD||t1)}. Here t1 is the time stamp of the user's HD. Now, HD sends {A, Φ, μ, idSD, tag, t1} to SD.
  2. (ii) SD checks if (t2‐t1) ≥ ΔT then SD aborts the operations. Here t2 is the current timestamp of the SD and ΔT is the expected transmission delay.
  3. (iii) SD uses own private key (z) and computes Φ ⊕ h (z A) to obtain S, idU, BU, and t1*. It checks t1* = t1, if not then aborts the request. It computes μP and h(A|| Φ|| idU ||idSD||idGW). (pub1 + S h(h(S)||idU)) + A and then checks whether the computed values are identical. If yes, then goes to the next step. Generates random integer v, and computes β1 = EKGWSD[v||S||idU||t1||t2], here t2 is the timestamp of SD. Now, it sends {β1, idGW,idSD, tag, t2} to the GW. In addition, SD keeps store, idU for the current session.
  4. (iv) The GW verifies if (t3 – t2) ≥ ΔT then GW aborts the further step. Here t3 is the current timestamp of the GW. Now the GW decrypts β1 using DKGWSD and obtains v*,S*,idU*, t1*,t2*. It verifies t2* = t2, if yes then it retrieves the corresponding authentication token (UTU) of IdU*, α of S* from its table. Now the GW, computes tag* = MAC {UTu*(idU||BU|| α||idSD*|| t1*)}, and checks (tag* = tag) and (idSD* = idSD), if it holds, then the user, HD and SD are authenticated entities. Now, the GW generates a random integer f, computes SKey = h(v||f||idU||idSD||α||t1||t2 ||t3), β2 = Eα[v||f||idSD||idGW||t2||t3], and β3 = EKGWSD[β2||v||SKey||idU||idGW || t3]. Here, t3 is current timestamp of the GW and SKey is the session key. Finally, it sends {β3, idGW, idSD, t3} to the SD.
  5. (v) The SD verifies if (t4‐t3) ≥ ΔT then aborts the system. Here t4 is the current timestamp of the SD. It decrypts β3 using KGWSD and obtains β2||v* ||SKey|| idU|| idGW*||t3*. It checks (t3* = t3), (v* = v), and (idGW * = idGW). If all the conditions are true, then it sends (β2, idSD, and t4) to user's HD.
  6. (vi) Upon receiving the message, HD verifies if (t5‐t4) ≥ ΔT then aborts the system. Here t5 is the timestamp of HD. Decrypts β 2 using α and gets v||f||idSD*||idGW* || t2 || t3. It checks (idSD * = idSD), and (idGW* = idGW), if yes then MD computes a session key SKey = h(v||f|| idU||idSD||α||t1||t2|| t3).

7.5 Security and Performance Evaluations

7.5.1 Informal Security Analysis

We analyze the security of the proposed scheme under the Dolev‐Yao attack model [10]. An adversary may intercept, modify, and insert any message over the public communication channels. The advantages of our scheme are explained as follows:

7.5.1.1 Save Against Masquerade Attack

  1. (i) An adversary cannot masquerade GW to cheat SD, since he/she does not have knowledge of the secret key (KGWSD). Hence, it is not easy for an adversary to compute the valid response, i.e. β3 = EKGWSD[β2||v||SKey||idU||idGW||t3] to SD.
  2. (ii) SD cannot masquerade GW to cheat HD. It can be noticed that the SD does not have any idea about a secret parameter α, and thus, SD cannot decrypt β2 = Eα[v||f ||idSD ||idGW ||t2||t3] as this message is encrypted by α. Here, α is shared between the GW and legitimate SD.
  3. (iii) An adversary cannot masquerade HD as the user uses biometric (BU) to prove own legitimacy. In addition, if an adversary uses a fake identity (idU') and false (α'), then the corresponding spurious tag = MAC {UTU,(idU'||BU||α'||idSD||t1)}) can be identified by HG, because HG cannot be verified (i.e. tag' = tag).

7.5.1.2 Safe Against Man‐in‐the‐Middle (MITM) Attack

In this attempt, an attacker can eavesdrop on all the packet exchanges between the involved entities. Then he/she can resend these eavesdropped packets to make the other entities trust that they are rightfully exchanging information with each other. By doing so, an attacker can take over the whole communication and degrade the performance of IIoT. In the proposed scheme, it not easy for an ill‐intentioned attacker to mount such a type of attack, successfully, since the adversary requires knowledge of the user's biometric (BU) and needs the secret value α. Without knowing all the secure parameters, the attacker would not be able to decrypt messages β2 (= Eα[v||f||idSD ||idGW ||t2||t3]) and β3 (=EKGWSD[β2||v||SKey||idU||idGW||t3]) to compute the session key. Therefore, the proposed scheme is resistant to the man‐in‐the‐middle (MITM) attack.

7.5.1.3 Safe Against Denial‐of‐Service Attack

In the proposed protocol, the proxy key pair of the SIM card of HD and the database of GW do not require synchronous updates. Therefore, even if the attacker interferes with the transmitted authentic messages among HD, SD, and GW, they still cannot mount the DoS attack successfully.

7.5.1.4 Safe Against Replay Attack

An attacker can collect messages {A, Φ, μ, idSD, tag, t1}, {β1, idGW,idSD, tag, t2}, {β3, idGW, idSD, t3}, and (β2, idSD, and t4), which are sent among HD, GW, and SD. The attacker might replay these captured messages later to respective recipient. However, as can be seen, each message recipient checks the validity of the timestamp at first place as follows (t2–t1) ≥ ΔT (at SD); (t3–t2) ≥ ΔT (at GW); (t4–t3) ≥ ΔT (at SD) and (t5‐t4) ≥ ΔT) (at HD). Therefore, the proposed scheme is safe against message replay attacks.

Table 7.2 lists the selected security features and makes a comparison between the proposed scheme and others, e.g. Ma et al. [4] and Das et al. [7].

Table 7.2 Comparison of security features.

Ma et al. [4] Das et al. [7] Proposed Scheme
Resist to masquerade attack Partially — Yes
Resist to replay attack — Yes Yes
Safe to MITM — Yes Yes
Resist to DoS attack Yes — Yes

7.5.2 Performance Analysis

We evaluate the performance of our proposed scheme and the scheme of Ma et al. [5], in terms of computation and communication costs.

The computational cost of the proposed model is analyzed. Let Th by the time of performing a one‐way hash h (.), TE and TD by the time for performing a symmetric encryption and decryption, respectively, TPM by the time for performing an ECC point multiplication operation, TMAC by the time for performing a Message authentication code (MAC) operation, TSM by the time for a scalar multiplication, TBP by the time for performing a bilinear pairing operation, TH by the time for a Hash‐to‐point operation, and TPA by the time for performing a point addition operation. At HD device requires 6Th + 3TPM + 1TD + 1TMAC; the SD requires 4Th + 2TPM + 1TE+1TD; and the GW incurs 1Th + 2TE+ 1TD + 1TMAC. Whereas Ma et al. scheme requires 2TH + 4TSM for KeyGen, 3TH + Th + 4TSM + 3TBP + TPA for certificateless public key encryption scheme, TH + TSM + TPA for a Trapdoor, and 2TH + Th + TSM + 2TPA + TBP for the test verification. Table 7.3 summarizes the overall computation cost between the proposed scheme and Ma et al.'s [4] scheme. Note that we did not compare the computation cost of the proposed scheme with the Das et al.'s Scheme [8], as their scheme is based on the sole hashing and XoRing operations. Overall, the scheme from Das et al. requires an excessive hashing operation, e.g. 30 Th (approx.).

Table 7.3 Comparison of computation costs.

Ma et al. [4] Proposed scheme
Overall computation cost 6TH + 2Th + 10TSM + 4TBP + 5TPA 11Th + 5TPM + 3TE+3TD + 2TMAC

We evaluate and compare communication costs in terms of the number of message exchanges for the proposed scheme, and Ma et al. [5] and Das et al.'s [8] schemes. To execute the whole scheme, Ma et al.'s scheme requires four rounds of message exchanges, Das et al.'s scheme takes three rounds of message exchanges and the proposed scheme requires four rounds of message exchanges, as shown in Figure 7.3. However, considering the security features (refer to Table 7.2), the proposed requires one more round of message exchanges than Das et al.'s scheme but provides more security features. Therefore, the proposed scheme can be a practical solution for such real‐world IIoT applications.

Bar graph of communication costs in terms of number of message exchanges according to Ma et al., Das et al., and the proposed scheme. Bars for Ma et al. and the proposed scheme have similar height, higher than Das et al.

Figure 7.3 Comparison of communication costs.

7.6 Conclusions

IIoT is an emerging paradigm in the Industry 4.0 where smart devices (i.e. sensors) will play an important role and offer services and share data to the user. However, providing security to such time‐critical applications is challenging. This chapter proposed a biometric‐based robust access control model (i.e. user authentication) that would perform a robust authentication and establish a session key between the user and smart devices. The effectiveness of the proposed scheme has been demonstrated in terms of computation and communication costs in the IIoT environment.

References

  1. 1 Da Xu, L., He, W., and Li, S. (2014). Internet of things in industries: a survey. IEEE Transactions on Industrial Informatics 10 (4): 2233–2243.
  2. 2 Ferrari, P., Flammini, A., Sisinni, E. et al. (2018). Delay estimation of industrial IoT applications based on messaging protocols. IEEE Transactions on Instrumentation and Measurement 67 (9): 2188–2199.
  3. 3 Luvisotto, M., Tramarin, F., Vangelista, L., and Vitturi, S. (2018). On the use of LoRaWAN for indoor industrial IoT applications. Wireless Communications and Mobile Computing 2018: 1–11.
  4. 4 Gurtov, A., Liyanage, M., and Korzun, D. (2016). Secure communication and data processing challenges in the industrial internet. Baltic Journal of Modern Computing (BJMC) 4 (4): 1058–1073.
  5. 5 Ma, M., He, D., Kumar, N. et al. (2018). Certificateless searchable public key encryption scheme for industrial internet of things. IEEE Transactions on Industrial Informatics 14 (2): 759–767.
  6. 6 Gope, P., Das, A.K., Kumar, N., and Cheng, Y. (2016). Lightweight and physically secure anonymous mutual authentication protocol for real‐time data access in industrial wireless sensor networks. IEEE Transactions on Industrial Informatics 63 (11): 1.
  7. 7 Katzenbeisser, S., Kocabas, U., Rozic, V. et al. (2013). PUFs: Muth, fact or busted? A security evolution of physically unclonable functions (PUFs) cast in silicon. In: IEEE International Symposium on Hardware‐Oriented Security and Trust (HOST), Texas, USA (2–3 June 2013). Texas, USA: IEEE.
  8. 8 Das, A.K., Wazid, M., Kumar, N. et al. (2018). Biometrics‐based privacy‐preserving user authentication scheme for cloud‐based industrial internet of things deployment. IEEE Internet of Things Journal 5 (6): 4900–4491.
  9. 9 Bilal, M. and Kang, S.‐G. (2017). An authentication protocol for future sensor networks. Sensors 17 (5): 1–29.
  10. 10 Dolev, D. and Yao, A. (1983). On the security of public key protocols. IEEE Transactions on Information Theory 29 (2): 198–208.
  11. 11 Neuman, B.C. and Stubblebine, S.G. (1993). A note on the use of timestamps as nonce. ACM SIGOPS Operating System Review 27 (2): 10–14.
  12. 12 Lee, H., Shin, K., and Lee, D.H. (2012). PACPs: practical access control protocols for wireless sensor networks. IEEE Transactions on Consumer Electronics 58 (2): 491–499.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.219.215.178