A Client-based User Authentication Scheme for the Cloud of Things Environment

The limited capabilities of IoT devices have resulted in some of the tasks of IoT applications being distributed to a cloud server, which witnessed the arisen of the cloud of things (COT).  It enables IoT applications' development and deployment as a service, providing additional data storage, enhanced processing performance, and fast communication between devices. As COT involves communication between IoT devices, a remote server, and users, remote user authentication is crucial to meeting security demands. Therefore, this study designs a client-based user authentication scheme utilizing smartphone fingerprint recognition technology to fill the gap.  The scheme comprises six phases, namely (i) configuration phase, (ii) enrolment phase, (iii) authentication phase, (iv) password update phase, (v) fingerprint revocation phase, and (vi) smartphone revocation phase. The security analysis and automated verification using ProVerif suggested that the scheme is resistant to user impersonating attacks, replay attacks, and man-in-the-middle attacks.