PASKE-IoD: Privacy-protecting authenticated key establishment for Internet of Drones

PASKE-IoD: Privacy-Protecting Authenticated Key Establishment for Internet of Drones

MUHAMMAD TANVEER ¹, ABD ULLAH KHAN ², (Member, IEEE), HABIB SHAH ³, SHEHZAD ASHRAF CHAUDHRY ⁴, AND ALAMGIR NAUSHAD ²

1Faculty of Computer Science and Engineering, Ghulam Ishaq Khan Institute of Engineering Sciences and Technology, Topi 23640, Pakistan 2Department of Computer Science, National University of Science and Technology, Balochistan Campus, Quetta 87300, Pakistan 3Department of Computer Science, College of Computer Science, King Khalid University, Abha 62529, Saudi Arabia

4Department of Computer Engineering, Faculty of Engineering and Architecture, Istanbul Gelisim University, 34310 Istanbul, Turkey

Corresponding author: Abd Ullah Khan (akhan.dphd17seecs@seecs.edu.pk)

This work was supported by the Deanship of Scientific Research at King Khalid University and titled Advanced Computational Methods for Solving Complex Computer Science and Mathematical Engineering under Grant RGP.1/365/42.

ABSTRACT Unmanned aerial vehicles/drones are considered an essential ingredient of traffic motoring systems in smart cities. Interconnected drones, also called the Internet of Drones (IoD), gather critical data from the environmental area of interest and transmit the data to a server located at the control room for further processing. This transmission occurs via wireless communication channels, which are exposed to various security risks. Besides this, an External User (EU) occasionally demands access to real-time information stored at a specific drone rather than retrieving data from the server, which requires an efficient Authenticated Session Key Establishment (ASKE) approach to ensure a reliable communication in IoD environment.

In this article, we present a Privacy-Protecting ASKE scheme for IoD (PASKE-IoD). PASKE-IoD utilizes Authenticated Encryption (AE) primitive ‘‘ASCON,’’ and hash function ‘‘ASCON-hash,’’ to accomplish the ASKE phase. PASKE-IoD checks the EU’s authenticity before allowing him to access the IoD environment resources. Moreover, PASKE-IoD enables EUs and drones to communicate securely after establishing a session key. Meticulous informal security analysis and security verification are carried out using Scyther to demonstrate that PASKE-IoD is immune to numerous covert security attacks. In addition, Burrows- Abadi-Needham logic is utilized to corroborate the logical exactitude of PASKE-IoD. A comparative analysis is presented to illustrate that PASKE-IoD is efficient and renders more security features than the eminent ASKE scheme.

INDEX TERMS AEAD, Internet of Drones, privacy, unmanned aerial vehicles, key exchange.

I. INTRODUCTION

Internet of Things (IoT) is an emerging networking paradigm that facilitates daily life routines [1]–[3]. IoT connects dif- ferent real-world wearable devices, vehicles, home, and office appliances, etc. [4], [5]. Connectivity among the IoT nodes is established through a private network or the public Internet [6], [7]. Recent technological advancements have given rise to an enhanced IoT network, namely, the Inter- net of Drones (IoD). In IoD, drones or Unmanned Aerial Vehicles (UAV) are utilized to enhance the versatility of the existing IoT networks [8]. UAVs are easy to deploy and troubleshoot, provide a swift response, and are capable of the Omni-direction movement, making them one of the most suit- able solutions to assess their surrounding environment and

The associate editor coordinating the review of this manuscript and approving it for publication was Emre Koyuncu .

gather useful information. IoD has various applications, such as public safety, smart-city traffic monitoring, 3D-mapping, search & rescue, node tracking, agricultural, cinematography, and product delivery systems, disaster recovery [8]–[10].

IoD is considered a resource-constricted environment because the drones are limited in energy resources, compu- tational capabilities, and storage capacity [11], [12]. In IoD, drones are deployed in an unattended environment, and the drones share information with other network entities using Public Communication Channels (PCCs). A PCC is vulnerable to various security threats. Security attacks on the IoD network can degrade the performance and interrupt the streamlined operations of the IoD network. So, It is imperative to thwart unauthorized information disclosure and prevent illegitimate External Users (EU) from accessing the network resources. Therefore, Authenticated Session Key Establishment (ASKE) is an essential requirement of IoD to

revoke unauthorized EU access to the network resources and establish a secret Session Key (SK) to achieve information confidentiality.

Plenty of ASKE schemes have been proposed for IoT and IoD environments by employing symmetric and asymmetric cryptographic primitives. However, a large share of these schemes are not protected decently and are prone to various security attacks that include but are not limited to Stolen Smart Card (STSC), Privileged Insider (PRIN), Password Guessing (PAGU), User Impersonation (UIMP), and replay attacks, as presented in [13]–[15]. Apart from this, the ASKE schemes that utilize asymmetric cryptographic mech- anisms are computationally infeasible, from computational standpoint, for the resource-limited small scale IoT devices and drones. Therefore, a lightweight and efficient ASKE scheme has become a decisive concern in the resource-limited IoD environment. This paper presents an ASKE scheme by applying Lightweight Cryptography (LWC) primitive known as ASCON [16], which is an Authenticated Encryption with Associative Data (AEAD) scheme. An LWC based AE scheme renders the functionality of data encryption and authentication simultaneously. Therefore, by employing AEAD mechanism, we propose a secure and efficient ASKE scheme for the IoD environment.

A. RESEARCH CONTRIBUTIONS

To resolve the aforementioned issues, a novel efficient ASKE scheme, namely, Privacy-Protecting ASKE-IoD (PASKE-IoD), is presented with the following contributions.

1) The proposed scheme utilizes LWC-based AEAD primitive named as ASCON encryption along with ASCON-Hash and Exclusive-OR functions.

PASKE-IoD ensures the authenticity of an EU before allowing access to the IoD network resources. More- over, PASKE-IoD enables an EU and drone to set up an SK to accomplish indecipherable communication.

2) Informal security analysis is performed, and Scyther- based formal security verification is implemented, to demonstrate that PASKE-IoD is protected against malicious attacks. In particular, PASKE-IoD is effec- tive against replay and Man-in-the-Middle (MAMI) attacks. The logical completeness of PASKE-IoD is confirmed using BAN logic.

3) A comparative study shows that PASKE-IoD yields enhanced security features at minimized communica- tion overhead and computational costs compared to the eminent ASKE schemes.

B. THE PAPER’S ORGANIZATION

The paper is distributed into various sections as follows.

A brief overview of the existing leading ASKE schemes is presented in SectionII. The assumed system model for the proposed scheme is presented in SectionIII. The essential preliminaries are elaborated in Section IV. The proposed scheme with all its attributes is elaborated in SectionV. The

informal and formal security analyses associated with the proposed scheme are provided in SectionVI. An in-depth performance analysis of the proposed scheme is given in SectionVII. Finally, Section VIII presents the conclusion.

A list of notations employed in PASKE-IoD is reported in Table2.

II. THE EXISTING WORK

In this section, the eminent and related ASKE schemes designed for IoT/IoD environments are surveyed. To this end, Lin et al. [17] presented a detailed review of IoD applications and different security challenges associated with IoD networks. Additionally, they also described a security model for the IoD environment. Wazidet al.[18] presented an analysis of various ASKE schemes designed for IoD networks and security imperatives in the IoD environment.

Similarly, the authors in [19] devised a resource-efficient ASKE scheme for IoD. The scheme utilizes a hash func- tion and Exclusive-OR operation during the ASKE phase.

Likewise, a lightweight ASKE protocol is proposed in [20]

for IoD application. The scheme employs a symmetric encryption algorithm, hash function, and Exclusive-OR oper- ations. Islam and Biswas [21] highlighted the limitations of the scheme presented by Wu et al. [22] in terms of non-protection against STSC, PRIN, and PAGU attacks and non-provisioning of anonymity and revocation mechanism.

Similarly, a user ASKE scheme is presented in [23], which enables the user device to communicate securely after estab- lishing the SK. Moreover, the security strength of the devised scheme is endorsed through AVISPA.

In addition to this, Xue et al. [24] proposed an ASKE scheme considering multi-server scenario. However, the devised scheme is prone to UIMP attack, PRIN attack, and PAGU attack, as demonstrated in [25], and additionally does not render User Anonymity (UA) and SK security. Similarly, an ASKE mechanism is presented in [26] for the smart-grid system. However, it is demonstrated by the authors in [27]

that the scheme presented in [26] is not only prone to UIMP and MAMI attacks, but also cannot ensure the integrity of the communicated message. Furthermore, a novel ASKE scheme is devised by Mohammadali et al. in [28], which cannot stand against the replay, UIMP, and MAMI attacks, and can- not safeguard against Identity Guessing (IDGU) attack [29].

Turkanovicet al.[30] proposed an ASKE for Wireless Sensor Network (WSN), which is lightweight and less expensive from the standpoint of computational overhead and energy consumption. However, the scheme is unsafe against MAMI, STSC, and replay attacks. Furthermore, the scheme fails to provide UA [31]. Similarly, the authors in [32] proposed an ECC-based ASKE mechanism for the IoT environment, which is exposed to different types of pernicious attacks.

Proceeding in the same fashion, the authors in [33]

also considered a multi-server environment and proposed a lightweight ASKE mechanism for protection. Moreover, the authors also demonstrated the limitations associated with the scheme presented in [34] in the form of non-resistance

against forgery-attack, replay attack, UIMP attack. More- over, it is shown in [33] that the scheme presented in [34]

fails to ensure mutual authentication. Similarly, the scheme presented for the IoT environment by Wu et al. [35] is, though, computationally efficient, yet, it does not render resistance against STSC attack, DoS attack, and UIMP attack.

Likewise, the ASKE mechanism presented by Taiet al.[36]

for IoT environment utilizes lightweight cryptography. Nev- ertheless, the scheme cannot protect perfectly against PAGU attack, PRIN attack, and STSC attack, and does not render UA and traceability security features, and does not pro- vide the SK security, as pointed out in [13]. In the same fashion, the ECC-based ASKE mechanism presented by Challaet al.[37] for IoT applications is computationally impracticable for the resource-limited devices and is insecure against UIMP attacks. Furthermore, the ASKE mechanism presented by Aminet al.[25] is deemed to be a lightweight and efficient ASKE scheme in particular for IoT-based cloud computing applications. The scheme, however, cannot pre- vent UIMP and PRIN attacks. Similarly, the scheme pre- sented by Wazid et al. [14] for IoD applications requires communication and computational overheads. However, the presented scheme cannot meet the requirement of proper revocation or re-issue operations.

Jung et al.[38] come up with an efficient ASKE mech- anism for WSN employing the hash function. However, the scheme cannot check tracing attacks, Ephemeral Secret Leakage (ESL) attack, UIMP attack, and does not ensure SK security [39]. In order to address the security limita- tions associated with the scheme presented in [38], Shin and Kwon [39] devised a user ASKE mechanism. The scheme of Shinet al.ably addresses most of the limitations of the scheme presented by Jung et al., however, the computa- tional cost incurred by the scheme of Shinet al. makes it computationally infeasible for IoT environment. Above this, the scheme of Shin et al. is also prone to ESL and de-synchronization attacks. The authentication scheme pre- sented in [40] cannot prevent the de-synchronization and PRIN attacks. Guptaet al.[41] suggested a user ASKE mechanism to deal with the security of the wearable devices. However, the devised scheme is unprotected against impersonation and de-synchronization attacks and does not provide SK security, as illustrated in [42]. Additionally, Jangiralaet al.presented a user ASKE mechanism for IoD environment [13], which is immune to various well-known attacks. However, the scheme cannot encompass all the secu- rity requirements of the IoD environment. Lv [43] used con- volution neural network and presented a security solution for IoD, which is again not suitable to cover the security concern of the IoD environment completely. The authors in [44] presented an ASKE mechanism in order to protect 6LoWPAN networks. The scheme leverages ASCON and hash function for protecting the devices with 6LoWPAN.

However, their scheme cannot achieve satisfactory perfor- mance against traceability attacks. In the same fashion, the scheme presented by Chen et al. [45] is fallible to replay,

FIGURE 1. IoD network model [13], [14].

DoS, STSC, PRIN, UIMP, PAGU, and also does not provide mutual authentication and anonymity features. Similarly, the ECC-based ASKE mechanism proposed by Wuet al.[15] is insecure against replay, DoS, PAGU, and UIMP attacks. The scheme of Ref. [46] is unsafe against UIMP, PRIN, and STSC and also does not render SK security. Table1 summarizes the security weaknesses of different ASKE for IoT and IoD environments.

III. SYSTEM MODEL

The subsequent models (Network & Threat model) are uti- lized in designing PASKE-IoD.

A. NETWORK MODEL

This paper considers IoD architecture, as shown in Fig.1for the ASKE process, which consists of Remote Drones (RDs) deployed in specific FZ, EU, CR, and CS. In an IoD environ- ment, RDs and GS are connected through wireless channels.

An RD is equipped with various types of sensors, an actuator, a communication module, power resources (battery), and processing capabilities. An RD collects significant informa- tion from the different circumstances and sends the collected sensitive information to the Central Server (CS) stationed at GS. EU and GS communicate through the public Internet.

In IoD, the EU is an external entity and requires collect- ing real-time information from RD instead of procuring the information stored at CS. CS is the only trusted object/entity in the deployed IoD network, which is used to keep secret information about EU and RD. The internal user at the CR monitors RDs and controls their activities by sending various command and control (C&C) information to RDs.

Due to the wireless channel’s open nature, many security threats (attacks) can arise and deteriorate the performance of IoD networks. Therefore, it is of grave importance to secure the communication among RD, CS, and EU to avoid severe security circumstances, such as illegal information

TABLE 1. Summary of the various existing security schemes.

disclosure, unauthorized access to the network resources in the IoD environment.

B. THREAT MODEL

As a threat model, the well-known Dolev-Yao (DY) [47]–[49]

threat-model is considered for PASKE-IoD. It is worth noting that intruders can capture and record the communicating messages of network entities in the IoD network under the DY model. Communication among the entities in the IoD network is public, and an intruder or adversary can update, delete, modify, or forge the captured message. RDs are usu- ally stationed in an unattended environment, making their physical security challenging to guarantee. There is always a physical security threat in which an intruder or adversary can capture RDs and extract the secret information from their memory. The adversary can afterward utilize the confidential information extracted from seized RD to compromise the security of other protected RDs in the IoD environment.

Furthermore, an adversary is assumed to be able to obtain, from the lost or stolen mobile device of a user, the stored information in the device’s memory, by applying the Power Analysis (PA) attack. By deriving the secret parameters suc- cessfully, the adversary may launch various malicious attacks that include but are not limited to privileged-insider, replay, and impersonation attacks. Equally important, it is taken for granted thatCSis a trusted entity and cannot be compromised by an adversary in the IoD environment.

IV. PRELIMINARIES

Here, the preliminaries employed for our proposed scheme are elaborated.

A. ASCON

ASCON is an AEAD scheme, which has the attributes of being symmetric [16], [50]. Moreover, it is inverse free, requires a single pass, and provides an online block cipher. ASCON is therefore selected as the finalist candi- date in Caesar competition [1], [51]–[53]. ASCON gener- ates output tuple{CT,AuPa}. Mathematically, the encryption operation of ASCON can be represented as CT,AuPa = E_Sk{{AD},PT}, and decryption process by PT,AuPa⁰ = DS_k{{AD},CT}andAuPa, whereADis the Associative Data, andPT is Plaintext. ASCONSk can be computed as Sk = kkNkIV, where k is pre-shared key, N is nonce (random number used once with a key), and IV is the initialization vector.

B. FUZZY EXTRACTOR

This paper employs the Fuzzy Extractor (FE) [54] method for the bio-metric verification ofEU. FE consist of two functions gen(.) andrep(.).

1) gen(.): is a probabilistic function, which is used to gen- erate secret bio-metric key by computing (k_EU,r_p) = gen(Bio_EU) of lengthL bits. Bio_EU is the bio-metric information ofEU,k_EU is the generated secret key for EU, andr_pis the public-reproduction parameter.

2) rep(.): is a deterministic function. rep(.) takes EU bio-metric informationBio⁰_EU andr_pas the input and generates the original bio-metric keyk_EU, while ensur- ing the conditionHD(Bio_EU,Bio⁰_EU) ≤ t, whereHD is the Hamming Distance and t is the error tolerance threshold.

FIGURE 2. ASCON high level architecture.

TABLE 2. List of notations.

V. THE PROPOSED PASKE-IoD SCHEME

The proposed PASKE-IoD is divided into the following six phases. The proposed PASKE-IoD utilizes the ASCON-Hash function that takes an arbitrary input length and pro- duces 256 bits output. A detailed description of PASKE-IoD is given in the trailing sections.

A. DRONE DEPLOYMENT PHASE (DDP)

This phase deals with the drone deployment in a specific FZ in an IoD environment. Each FZ has a unique identityZID_k. It is supposed thatCShas its distinct identityIDCSand temporary identityTIDCS, which are known only toCS. The subsequent steps are necessitated to perform the registration of a RDj

withCS.

1) Step DDP-2:CS assigns a unique identityIDRD_j and a FZ identityZIDk to the drone.

2) Step DDP-3: CS picks Rj and determines the tem- porary identity of RDj by determining U = H(ID_CSkRjkZIDkkIDRD_j),TIDRD_j =Ua⊕Ub, where U₁andU₂are two same-sized parameters ofU. 3) Step DDP-3:CSstores the parameters {TID_RDj,ID_RDj,

ZID_k} in the memory ofRD_j.

FIGURE 3. Parameters stored during the pre-deployment phase.

B. USER REGISTRATION PHASE (URP)

Before obtaining the real-time information from a particular RD_jstationed in a FZ,EU_irequires registering withCS. For EU_iregistration, subsequent steps are needed.

1) STEP URP-1

EUi chooses its identity IDEU_i, password PWEU_i, and also generates a random number Rue. EUi imprints its bio-metric information Bio_EU

i at the interface available on M_Di and computes (k_EU^reg

i, r_p) = gen(Bio_EU

i), AS_reg =

H(PW_EU

ikk_EU^reg

ikIDEU_i), andSIDi = H(AS_regkRue). Further- more,M_Di constructs a messageM_reg¹ : {SID_i}and forwards M_reg¹ toCSvia a reliable channel.

2) STEP URP-2

After receivingM_reg¹ fromM_Di,CSpicks timestampT_regand a master-keyM_kuforEU_i. Additionally,CScomputesG^reg= H(ID_CSkSID_ikT_reg),TID_EUi = G^reg₁ ⊕G^reg₂ . Moreover, CS calculates Z^reg = H(ZID_kkM_kukID_CS) and authentication parameterAP=Z₁^reg⊕Z₂^reg. Finally,CSfabricates a message M_reg² :{TID_CS,TID_EUi,TID_RDj,AP}, whereTID_CS,TID_EUi, andTID_RDjare the temporary identities ofCS,EU_i, andRD_j, respectively and dispatches M_reg² to M_Di securely. Further- more,CSstores {TIDCS,TID_EU

i,TIDRD_j,AP}.

3) STEP URP-3

Upon receiving M_reg² from CS, M_Di calculates Q = H(PW_EUikID_EUik(0000)). Moreover, EU_i determinesP₁ = (TID_CS ⊕TID_EUi ⊕TID_RDj ⊕AP),P₂=(TID_CSkTID_EUi)

⊕AS_reg⊕Q, andP₃=Q⊕(TID_RDjkAP)⊕AS_reg. Further- more,EUicomputesAuPareg=H(PW_EU

ikk_EU^reg

ikIDEU_ikP1).

Finally,MDi stores the parameters {P₂,P3,AuPareg,gen(.), rep(.),rp, t} in its own memory and removesP1 from the memory.

The summary of the user registration process as shown in Fig.4. Fig.3illustrates the parameters stored inM_Di,CS, and RD_jduring deployment phase.

C. USER LOGIN AND AUTHENTICATION PHASE (ULAP) This phase validates the user’s authenticity by verifying the secret login credentials stored onCSandMDi. After receiving the login request,CSandRDjvalidate the authenticity ofEUi. It is assumed thatEUi has a list ofRDj from whereEUiis granted to obtain the real-time data accumulated byRDj. The subsequent steps outline the details of ULAP.

FIGURE 4. User registration process.

1) STEP ULAP-1

EUi inputs the login secret credential, such as IDEU_i, PW_EUi, and imprints Bio^b_EU

i at bio-metric sensor of M_Di. M_Di computes k_EU^b

i = rep(Bio^b_EU

i, r_p) provided the condition HD(Bio_EU

i,Bio^b_EU

i) ≤ t holds. More- over, M_Di calculatesAS_lo =H(PW_EUikk_EU^b

ikID_EUi),Q_lo=

H(PW_EUikID_EUik(0000)). In addition,M_Diderives the secret parameters, which are used in the ASKE process as P₂ ⊕ AS_lo ⊕ Q_lo = (TID_CSkTID_EUi) and P₃ ⊕ Q ⊕ AS_reg = (TID_RDjkAP). Finally, to validate the local authentication of EU_i,M_Di determinesP_lo =(TID_CS ⊕TID_EUi ⊕TID_RDj ⊕ AP) andAuPa_lo=H(PW_EU

ikk_EU^reg

i kID_EUikP_lo).M_Diverifies the conditionAuPa_lo =AuPa_reg. If the condition is true, the login attempt will be successful andMDicontinues the ASKE process. Otherwise,MDiterminates the login process. More- over,MDi retrieves the credentials {TID_CS,TID_EU

i,TIDRD_j, AP}. To generate a ASKE request message,MDipicks times- tampTam1, two random numbersR^iv_am1,Rse1, where the size of Tam1,R^iv_am1,Rse1is 32 bits, 64 bits, and 128 bits, respectively.

Additionally,MDideterminesP6=Rse,P7=TIDRD_j,Xn= H(TIDCSkR^iv_am1kTam1), andTIDⁿ_CS =X_n¹⊕X_n², whereX_n¹and X_n²are two same-sized parameters ofX_neach of size 128 bits.

Furthermore, M_Di computes X2 = TIDⁿ_CS ⊕TID_EUi,N3= X2, k3 = AP, Kam1 =(k3 k N3), and AD5 = X2, where the size of bothk3andN3is 128 bits and Associative Data of size 128 bits. Finally, MDi by using ASCON, calculates (CT₆,CT7),AuPa1=EK_am1{AD5,PT6,PT7}, whereAuPa1is the authentication parameter and fabricates a messageMam1: {Tam1,X2,CT6,CT7,AuPa1,R^iv_am1}, and sendsMam1toCS via an open channel.

2) STEP ULAP-2

Upon receivingM_am1fromEU_i,CSensures the freshness of M_am1by verifying the conditionT₃^d ≥ |T^r −T_am1|, where T₃^dmaximum allowed delay andT^r is the message received time. CS picksTam1andR^iv_am1from the received Mam1and computesX_n =H(TID_CSkR^iv_am1kT_am1),TIDⁿ_CS =X_n¹⊕X_n², andTID_EUi =TID_CS⊕X₂. Moreover,CS checks ifTID_EUi exits in its own database. If TID_EUi is found in its own database,CSretrievesAPrelated toTID_EUi. Additionally,CS

computesN4=TIDⁿ_CS⊕TIDEU_i,k4=AP,Kam1=(k₄kN4), andAD6 =X2, which is Associative Data of size 128 bits.

In addition, CS by using ASCON determines (PT₆, PT7), AuPa₂ = D_Kam1 {{AD₆},CT₆,CT₇}. Furthermore, to check the authenticity of the received message,CSchecks the con- ditionAuPa₁ = AuPa₂. If the condition is true,CS extracts R_se1 and TID_RDj from decryption process. Otherwise, CS terminates the ASKE process. Upon successful verification ofEU_i,CSretrieveID_RDj andZID_kfrom its databases corre- sponding toTID_RDj.

3) STEP ULAP-3

CS picks timestamp Tam2, two random numbers Rse2 and R^iv_am2 and computes X3 = TIDRD_j ⊕Rse2, PT8 = Rse1⊕ AP, where PT8 is the plaintext. CS also computes U = H(ID_RDjkZIDkkT4kR^iv_am2) and splitsUinto two similar-sized parametersN5andk5 each of size 128 bits. Moreover,CS calculates K_am2 = (k₅kN₅). Furthermore, CS by employ- ing ASCON, calculates AD₇ = X₃, (CT₈, AuPa₃) = E_Kam2{{AD₇},PT₈}. Finally,CS fabricates a messageM_am2: {T_am2,X₃,CT₈,AuPa₃,R^iv_am2}and dispatchesM_am2toRD_j via the public communication channel.

4) STEP ULAP-4

After receiving Mam2, RD_j verifies the freshness of Mam2

by verifying the conditionT₄^d ≥ |T^r −Tam1|. If the con- dition is true,RD_jcontinues the ASKE process. Otherwise, RDjrejectsMam2and aborts the ASKE process. In addition, RDj determinesRse2 = TIDRD_j ⊕X3,AD8 = X3,U1 = H(ID_RDjkZIDkkTam2), and dividesU1into two similar-sized parameters each of 128 bits, namely, nonceN6 and keyk6. Furthermore,RDj calculatesKam2 = (k₆kN6) and by using ASCON computes (PT₈, AuPa₃) = D_Kau4{{AD₈},CT₈}. Finally, to verify the authenticity of received M_am2, RD_j verifies the conditionAuPa₃=AuPa₄. If the condition is true, decryption process reveals the plaintext, i.e.,P₈ = (R_se1⊕ AP). If the condition is not true,RD_jaborts the ASKE process.

5) STEP ULAP-5

RD_j picks timestamp Tam3, two random numbers Rse3, R^iv_am3, and computes PT9 = (Rse3 ⊕ ZID_k ⊕ Rse2), U2 = H(TID_RDjkRse1 ⊕ APkTam3) and divides U2 into two similar-sized parameters N6 and k6, where N6 is the nonce andk6 is the key. Moreover, RDj calculatesAD9 = R^iv_am3kR^iv_am3,Kam3 = (k₆kN6). Finally,RDj computes (CT₉, AuPa5)=EK_am3{{AD9},PT9}. Additionally,RDjconstructs a messageMam3:{Tam3,CT9,AuPa5,R^iv_am3}and sendsMam3

toM_Divia an open channel. In addition, to secure the future communications betweenRD_jandM_Di,RD_jcomputes SK as SK_d−u=H(TID_RDjkR_se1⊕APkPT₉kT_am3).

6) STEP ULAP-7

After receivingM_am3 from RD_j,M_Di verifies the freshness of M_am3 by verifying the condition T₃^d ≥ |T^r − T_am3|. If the condition holds, M_Di continues the ASKE process.

Otherwise, M_Direjects the received Mam3 and aborts the

FIGURE 5. PASKE-IoD user ASKE phase.

ASKE process. In addition,M_DicomputesR_se1⊕AP,AD₁₀= R^iv_am3,U₃ = H(TID_RDjkR_se1⊕APkT_am3),AS_f = (k₇kN₇), whereN₇is nonce andk₇is key, which are two same-sized parameters of U₃, and K_am3 = (k₇kN₇). Moreover, M_Di also computes (PT₉,AuPa₆)=D_Kam3{{AD₁₀},CT₉}by using ASCON. Furthermore, M_Di checks the legitimacy ofM_am3 by checking the condition AuPa₅ = AuPa₆. If the condi- tion is true,M_Di retrievesPT9from the decryption process.

To secure the communication between M_Di and RD_j, M_Di computes SK asSKu−d = H(TIDRD_jkRse1⊕APkPT9kT5).

The summary of the user login and ASKE phase as shown in Fig.5.

D. USER BIO-METRIC/PASSWORD UPDATE PHASE (UBPU) It is important to note that the bio-metric information of EU_i remains unchanged. However, to achieve the maxi- mum security, EU_i required to update his/her password periodically. In this phase, the new bio-metric informa- tion considered the same as the old bio-metric information.

EU_i required to execute the following steps to update both bio-metric and password.

1) STEP UBPU-1

EU_i inputs its secret parameters, such as ID_EUi, PW_EU^old

i

and imprints bio-metric information Bio^old_EU

i at smartMDi. Upon receiving the secret parameters,MDicomputesk_EU^old

i =

rep(Bio^old_EU

i,r_p), both old and fresh bio-metric informa- tion are same. Moreover, to accomplish the bio-metric and password change phase, M_Di computes AS_old = H(PW_EU^old

ikk_EU^old

ikID_EUi), Q_old = H(PW_EU^old

ikID_EUik(0000)), P₂ ⊕ AS_old ⊕ Q_old = (TID_CSkTID_EUi), P₃ ⊕ Q_old ⊕ AS_old=(TID_RDjkAP), andP_lo=(TID_CS⊕TID_EUi⊕TID_RDj

⊕AP). Finally,M_Di determinesAuPa_old =H(PW_EU

ikk_EU^reg

i

kID_EUikP_lo) and verifies the conditionAuPa_old = AuPa_reg. If the condition is true,MDi sends a notification message to EUi to select new secret parameters, such as password and bio-metric information.

2) STEP UBPU-2

After receiving the notification message from MDi, EUi

picks its new passwordPW_EU^new

i and Bio^new_EU

i. Upon procur- ing the new inputs form EU_i, M_Di by using FE calcu- lates new bio-metric key as (k_EU^new

i, r_p^new) = gen(Bio^new_EU

i).

FIGURE 6. User bio-metric/password update phase.

In addition,M_DicalculatesAS_new=H(PW_EU^new

ikk_EU^new

ikID_EUi) andQ_new=H(PW_EU^new

ikID_EUik(0000)). In addition,M_Dicom- putesP^new₂ =(TID_CSkTID_EUi)⊕AS_new⊕Q_new,P^new₃ =Q_new

⊕ (TID_RDjkAP)⊕ AS_new, and AuPa^new = H(PW_EU^new

ikk_EU^new kID_EUikP_lo), whereP_loisP_lo=(TID_CS⊕TID_EUi⊕TID_RDi_j

⊕ AP). Finally, M_Di stores the parameters {P^new₂ , P^new₃ , AuPa^new,gen(.),rep(.),r_p^new, t} in its own memory. Fig. 6 shows summary of the user bio-metric/password update phase.

E. REISSUE OR REVOCATION PHASE

If MDi of a legitimate EUi somehow lost or stolen, EUi

gets a newM_Diⁿ and accomplishes the Reissue or Revocation Phase (RRP) as follows.

1) STEP RRP-1

EU_i needs to maintain same identity ID_EUi. EU_i picks a new passwordPW_EUⁿ

i, random numberRⁿ_ue, andEU_iimprints fresh/new bio-metric information Bioⁿ_EU

i and computes (k_EUⁿ

i,r_pⁿ) = gen(Bioⁿ_EU

i),ASn = H(PW_EUⁿ

ikk_EUⁿ

ikIDEU_i), andSIDⁿ_i = H(AS_nkRⁿ_ue). Furthermore, theM_Di a message M_regⁿ : hSIDⁿ_ii and dispatchesM_regⁿ toCS through a secure channel.

2) STEP RRP-3

CSpicks timestampT_regⁿ and a new master-keyM_kuⁿ.CScom- putesG^reg_n =H(ID_CSkSIDⁿ_ikT_regⁿ ),TIDⁿ_EU

i =Gⁿ₁⊕Gⁿ₂,Zⁿ=

H(ZIDⁿ_RD

jkM_kuⁿkID_CS), andAPⁿ=Z₁ⁿ⊕Z₂ⁿ. Furthermore,CS dispatches a messageM_reg² :{TIDCS,TIDⁿ_EU

i,TIDⁿ_RD

j,APⁿ} toM_Diⁿ via public channel.

3) STEP RRP-3

Upon receiving M_reg² from CS, MDi calculates Qⁿ = H(PW_EUⁿ

ikIDⁿ_EU

ik(0000)). Moreover,EUi determinesPⁿ₁= (TIDⁿ_CS ⊕TIDⁿ_EU

i ⊕TIDⁿ_RD

j ⊕APⁿ),Pⁿ₂=(TIDⁿ_CSkTIDⁿ_EU

i)

⊕ AS_regⁿ ⊕ Qⁿ, and Pⁿ₃ = Qⁿ ⊕ (TID_RDjkAP)⊕ ASreg.

FIGURE 7. Reissue and revocation phase.

Furthermore, EU_i computes AuPaⁿ_reg = H(PW_EUⁿ

ikk_EUⁿ

i

kIDⁿ_EU

ikPⁿ₁). Finally, M_Diⁿ stores the parameters {Pⁿ₂, Pⁿ₃, AuPaⁿ_reg,gen(.),rep(.),r_pⁿ, t} in its own memory and removes Pⁿ₁from the memory. The summary of the reissue and revo- cation phase is presented in the Fig.7.

F. DYNAMIC DRONE ADDITION PHASE (DDAP)

To deploy, a new remote drone RDⁿ_i in a specific FZ, CS executes the following necessary steps.

1) STEP DDAP-1

CS assigns a new uniqueIDⁿ_RD

j and a particular FZ identity ZID_kto the droneRDⁿ_i before its deployment.CS selectsRⁿ_j and computesUⁿ = H(ID_CSkRⁿ_jkZIDⁿ_kkIDⁿ_RD

j),TID_RDⁿ

i =

U₁ⁿ⊕U₂ⁿ, whereU₁ⁿandU₂ⁿare two same-sized parameters ofUⁿ.

2) STEP DDAP-2

CS stores the parameters {IDⁿ_RD

j, TIDⁿ_RD

j, ZIDⁿ_k} in the memory ofRDⁿ_j.

VI. SECURITY ANALYSIS

In this section, we present both the formal and informal security analysis of PASKE-IoD.

A. INFORMAL SECURITY ANALYSIS

The trailing analysis demonstrates that PASKE-IoD is protected against different malicious attacks, such as replay, privilege insider, and impersonation, ensuring user’s anonymity and untraceability.

1) USER DEVICE CAPTURE ATTACK

Suppose an adversary A somehow gets/steals the Mobile Device MDi of the user EUi and extracts the parame- ters {P₂, P3, AuPareg, gen(.), rep(.), rp, t} stored on MDi

using PA attack [55]. To guess the valid PWEUi of EUi, A requires to computes k_EU^A

i = rep(Bio^A_EU

i,r_p), AS_A =

H(PW_EU^A

ikk_EU^A

ikID^A_EU

i), Q_A = H(PW_EU^A

ikID^A_EU

ik(0000)),