Abstract:Industrial Internet of Things (IIoT) brings together computers, devices, advanced analytics, and people in industries such as transportation, oil plant and power grid, that leads to major efficiency and productivity gains for almost any industrial procedures. Due to the interconnection of devices in IIoT, communication security has become a critical issue to address in many emerging industry standards which require the authentication and key exchange procedure to be done to guarantee the authorized machine access (e.g., from users) and secure the data transmission between machines. To overcome the shortcoming (i.e., low entropy) of the memorable password in user authentication, it is rightfully recommended by industry standards (such as IEC-62443 family) to use multi-factor authentication for higher security levels. Notably, latency is one of the main sources of inefficiency when a device is communicating with other machines on IIoT. To mitigate latency, smooth projective hash function (SPHF) built from wellstudied standard assumptions is used to achieve low-interactivity multi-factor authenticated key exchange protocol (MFAKE), because SPHF allows each party to prove to the others that he knows the right authentication factor(s). In this paper, we are therefore motivated to build a new MFAKE named "secure remote multifactor (SRMF)" to achieve the human involved "machine-to-machine" secure communication in IIoT. That is, SRMF leverages multiple user-centric authentication factors (such as password, biometric fingerprints, and PIN), and it can synergistically support multi-factor registration (MFR), multi-factor authentication (MFA) and multifactor key exchange (MFKE). Further, to prevent authentication factors stored at the server exposing to attackers, the password-harden service (i.e., Pythia-PRF, USENIX'15) inspires us to develop a multifactor hardening service (MFHS) -tilizing an oblivious pseudorandom function (OPRF). The balanced security of the proposed protocol is proved under the model of Bellare-Pointcheval-Rogaway (EUROCRYPTO' 00) along with theoretical and experimental evaluations.

A highly secure C2C-PAKE cross-domain protocol

Inter-domain authentication scheme for Pervasive Computing Environments

An Inter-Domain Authentication Scheme For Pervasive Computing Environment

Efficient and Strong Symmetric Password Authenticated Key Exchange with Identity Privacy for IoT

Simple three-party password-based key exchange protocol with provable security

Weaknesses of a Password-Authenticated Key Exchange Protocol between Clients with Different Passwords

Post-quantum Verifier-Based Three-Party Password Authenticated Key Exchange Protocol

A new framework for efficient password-based authenticated key exchange

Finding and Fixing Vulnerabilities in Several Three-Party Password Authenticated Key Exchange Protocols Without Server Public Keys.

Quantum-safe multi-server password-based authenticated key exchange protocol

Multi Server Password Authenticated Key Exchange Using Attribute-Based Encryption

Npake+: A Tree-Based Group Password-Authenticated Key Exchange Protocol Using Different Passwords

Password-based Authenticated Key Agreement Scheme with Mutual Anonymity for Trusted Computation

A practical and flexible PUF-based end-to-end anonymous authentication protocol for IoT

Provably Secure Password-Authenticated Key Exchange Using Diffie-Hellman

Building Low-Interactivity Multifactor Authenticated Key Exchange for Industrial Internet of Things

A new lattice-based password authenticated key exchange scheme with anonymity and reusable key

AEAKA: An Adaptive and Efficient Authentication and Key Agreement Scheme for IoT in Cloud-Edge-Device Collaborative Environments

Three-party Encrypted Key Exchange

Public-key cryptography and password protocols

Multilayer Consensus ECC-Based Password Authenticated Key-Exchange (MCEPAK) Protocol for Smart Grid System