A Privacy-Preserving Three-Factor Authentication System for IoT-Enabled Wireless Sensor Networks

Recently, Sahoo et al. introduced a three-factor authentication scheme for Wireless Sensor Networks (WSNs) based on an elliptic curve cryptosystem. Nonetheless, upon closer examination, we have identified critical vulnerabilities in their scheme, including susceptibility to user impersonation, gateway impersonation, sensor node impersonation attacks, and a breach in the three-factor security aspect. Further, the scheme fails to withstand offline sensor node identity guessing attacks, man-in-the-middle attacks, and known session-specific temporary information attacks. Intending to elevate both security and efficiency, we propose a novel three-factor authentication scheme that capitalizes on the strengths of a fuzzy extractor and a cryptographic one-way hash function. The proposed scheme’s security has been rigorously assessed using the SCYTHER tool, confirming its validity under the real-or-random (ROR) model. Moreover, a heuristic analysis exemplifies that the scheme effectively withstands various known cryptographic attacks. Consequently, the performance comparisons establish the superiority of our scheme over related approaches in terms of security and efficiency. Additionally, its suitability for WSNs is evident due to the minimal overhead on the sensor nodes, making it a highly promising solution for real-world implementation.