A Lightweight DNA Inspired Logistic Leo Based Attribute Encryption Scheme for Mutual Authentication in Smart IoT Medical System

A cloud-based authentication method that makes use of the benefits of cloud computing was proposed by Fan et al. [22]. This method refreshes authentication data by timestamp and encrypts authentication data using permutations. The security characteristics of the timestamp-permutation protocol are demonstrated by a security study. In a cloud setting with a mixed level of trust, the protocol can safeguard the privacy of the tags. This framework's principal benefit is a decrease in storage and transmission costs, and it also manages the tag's growing processing overhead. However, this framework's disadvantage has been noted as taking more time to process [22].

The Timestamp-permutation protocol for IoT applications was examined by Adeli et al. [23], who demonstrated that their system is susceptible to a disclosure attack. They then advanced the Xperbp Lightweight Authentication Protocol for Internet of Things applications. Put more accurately, the protocol essentially makes the secrets of the tag visible. Executing any other attack is made simple by the tag's secrets. However, this framework's main flaw is increased communication overhead.

An IoT device application security system was introduced by Diwan et al. [24] and it makes use of encryption, integrity checking, and mutual authentication to provide secure communication over insecure communication channels. The multi-layer IoT security architecture that has been proposed demonstrates its resilience with exactness to identify malicious activity. This model also demonstrated that it was simple and required minimal communication resources.

A secure Fog-based Social Industrial IoT system was presented by Ben Amor et al. [25]. Using a trust key agreement, this framework ensures mutual authentication. Since this system simply employs hash functions, bitwise XOR operations, and symmetric cryptography, it is appropriate for the socially resource-constrained Internet of Things (IoT). Regarding security considerations, effectiveness, social awareness, and decreased computing overheads, this approach offers several benefits. But to sustain its performance, it needs more resources [25].

To make certain that individuals only become linked to the Internet of Things (IoT) after completing numerous authentication processes, Gagana et al. [26] are focusing on developing middleware programs that stand among users and the IoT environment. This means that regardless of the event that an attacker manages to obtain the covert key and is incapable to gain access to the verification keys, even though they're inactive, the method of authentication will remain secure. The real-time frameworks weren't covered by this framework, which virtually covered the authentication approaches.

With the help of a limited application protocol, Oliver et al. [27] suggested a reliable and compact authentication technique for client-server mutual authentication. Through this approach, by keeping message packet sizes small, sending few messages, and processing time on connected devices to a minimum, the authentication overhead between the devices is significantly decreased. Its time-consuming nature is its weakest feature.

Chen and Liu [28] examined the upcoming IoT remote protocol. It was discovered using the above structure that not every security attack can defeat the protocol. To solve the problems, this framework created a three-factor surveillance system based on biologic data. This structure showed that the protocol was reliable and secure using BAN logic and ROR testing. Better outcomes are provided by this paradigm in terms of both time and communication costs. However, this approach raised the overhead for authentication.

For IoT-based cloud systems, Zargar et al. [29] introduced a simple and safe authentication technique. By utilizing secret parameters and biometrics, the suggested approach may survive different assaults and offer safe mutual authentication and anonymity. To achieve the most energy efficiency, lightweight crypto modules are used. This paradigm provides more energy-efficient outcomes. However, there will be an extra delay if each edge/fog node authenticates the devices separately, which is unacceptable for real-time service.

A lightweight cryptographic algorithm-based solution is being developed by Kalpana et al. [30] to cater a safe reciprocal authentication technique linking the sensor node and the gateway. For the above framework, a light encryption technique was used to develop the protocol using symmetric-key cryptography, hash-based authentication of messages code and hash algorithm. Better results in terms of authentication time are provided by this architecture. However, the primary restriction found in this system is communication cost as data size grows.

A safe, portable, and anonymous authentication technique created by Son et al. [31] and colleagues is appropriate for IoT contexts. During the authentication process, only hash and exclusive-or operations are used. This framework prevented extra security features and thwarted several attempts. This framework can help improve energy efficiency and cut expenses by providing high security and cheap computing costs. However, this framework's primary drawback is its communication overhead.

Using the Internet of Things, Sivaselvan et al. [32] proposed SUACC-IoT, a novel Secure Universal Authentication and Access Control System Capabilities, which are regarded as tokens representing the ability to grant privileges to those with authorization in the network, form the basis of this framework. This architecture operates superior when it comes to of memory use, processing load, and communication cost. The maximum message conveyed with the protocol has a tolerable transmission cost of 872 bits. However, its excessive energy utilization is the main issue here.

Figure 3 displays the system model taken into consideration for IoT topology. The suggested model consists embedded IoT devices linked to a single gateway. Only via the gateways, which use wireless communication protocols like WiFi, LORRA, and BLE, may any gadget interact with any other gadget. Bothe the 8-Bit and 32-bit based IoT devices are involved in the experimentation process. The shared secret key could be manually configured by an administrator into gateway and IoT equipment. IoT devices and gateways must function without the aid of a third party (TTP). In the non-volatile memory of embedded controllers, that are deemed as the brains of the Internet of Things, are all the private keys, device IDs, and gateway IDs. To carry out interactions between the gadget and gateway, a few megabytes (MB) of RAM are also essential. For updating the current session key, RAM is utilized to retain all the data that was sent during the prior networking session. Since attackers cannot physically access the gadgets, the entire architecture deliberates that the suggested protocol network structure is installed in a secured location. In that manner, they are unable to find the secret keys that are set up and kept on the gadgets.

3.jpg

Figure 3. IoT and gateway system model used in the research proposal

4.1 Security prerequisites

Every unprotected device linked to the Internet might act as a point of entry for cyberattacks as there is an explosive growth of IoT devices. This is because weaknesses are more likely to arise with this growth. A new IoT paradigm must be designed to overcome the security issues and offer unparalleled authentication data integrity and secrecy, since security is now deemed to be of the utmost importance in IoT gadgets. To address these security concerns, the suggested protocol has been created.

4.2 Key generation using proposed ABE scheme

The proposed ABE schemes used for key generation and data encryption is based on key-policy ABE schemes. In this encryption system, the user selects the attributes and encrypts the plain text to pair them. In short, the cipher text is linked with the set of attributes and access policy is linked with the private keys. The decryption process is evoked based on the private keys generated at other side(transmitter) and same can be used for authentication mechanism. The following steps are incorporated for generating the keys using proposed ABE schemes.

4.2.1 Initialization phase

In the initialization process, attributes from the sensors are connected to the IoT devices. The best fit attributes are selected based on the functions of CEPLO as mentioned in Eq. (6). Algorithm-1 presents the initialization stage

4.2.2 Encryption phase

The double-layered encryption process is adopted to obtain the strong encrypted data to mitigate the different attacks on the IoT networks. In the first layer, attributes selected from Eq. (6) are encrypted with the Chaotic maps (K) to form the intermediate encrypted data E_I. Then the formed intermediate data is again encrypted with chaotic maps (K) to form the final encrypted data E_m. In the both layers, permutations and diffusions are replaced with DNA encoding techniques. In the first layers, DNA subtraction is performed between the selected attributes and keys while DNA XOR operation is adopted in the second layer. Mathematically, the encryption process is expressed as follows

The first layer of encryption process is expressed as

$E_I=mod \left(\right. byte \left\{\left(U_{ {attributes }}\right) D N A(K)(\right. input \left.\left.), 16\right\}\right)$                   (7)

Final encryption process is expressed as

$E_m=mod \left(\right. byte \left\{\left(E_I\right) D N A(K)(\right. input\left.\left.), 16\right\}\right)$              (8)

In Eqs. (7) and (8), $U_{ {attributes }}$ denotes the user-selected attributes, and K represents the chaotic key generated from the map. The operator DNA(input) refers to the DNA-based encoding operation, including subtraction and XOR. The byte{} function converts the encoded data into byte format, and mod (16) ensures normalization within the 4-bit DNA space.

4.2.3 Proposed mutual authentication protocol

Amongst IoT devices, gateways, and users, the recommended protocol offers a safe mutual authentication method. The Internet of Things network's security resilience is improved. An intermediary gateway is placed in connection with the sensors, gateways, and users, as stated in the System Architecture. These characteristics characterize the suggested protocol: (i) The gateways and Internet of Things devices may securely authenticate each other using this protocol. (ii) Both the primary secret keys that the protocol uses—the dynamic chaotic key (Lk) and the encryption data (Em) utilized throughout mutual authentication phases. The disorganized features introduced into the key construction alter the keys continuously beyond a specified transaction interval. All the potential credentials never switch to networks since they are kept in storage by the gadgets and gateway during deployment. (iii) The suggested procedure, which operates based on logistic chaotic oriented ABE strategies, is new and lightweight authentication mechanism. The initial conditions are formulated using ABE schemes and consequently the key which is formulated will exhibit the high randomness nature which prevents the attackers to get the information. Device ID hashes and Gateway ID hashes are saved in the respective devices to improve overall security on the network. Ensuring strong security throughout the common authentication process is facilitated by the inclusion of suggested chaotic keys and their storage in relevant devices. (iv) When it comes to energy usage and transmission of messages times throughout mutual authentication and data transfer, the suggested protocol is being created among IoT gadgets, gateways, and users. Table 4 provides an inventory of the acronyms utilized in the present research.

Table 4. List of all the acronyms utilized in the text

4.2.4 Mutual authentication phases

The 3 steps that make up this phase of the process are covered in the following discussion.

Step-1: IoT devices -$\rightarrow$ Gateway:

By providing the gateway with a generated at random task C1 and the hash of the gadget ID, the Internet of Things gadgets within the network can initiate the mutual authentication procedure. We use a key Lk to encrypt the first authentication message. All IoT devices use the initial update key to compute the total amount of time needed to send the message to ensure message validity and authenticity.

Step-2: Gateway -$\rightarrow$ IoT devices:

When the IoT device sends a message to the gateway asking for mutual authentication, it decrypts it first, then checks the decrypted IDs it receives with the identities it has stored. The following stage, the authentication procedure, is initiated if both IDs are equivalent. The authentication procedure is unsuccessful otherwise. For the subsequent communication, IoT gadgets choose a set of numbers that represent sequences Seq{i} to be utilized when updating the session key, the newly produced challenge C2, the already established session duration Session(T), N1, besides the hash value of its ID (Hash (Device ID)), all of which are encrypted with (Ek)which uses Ec to determine the RSSI (msg2) and transmits to IoT gadget.

Step-3: IoT-Devices -$\rightarrow$ Gateway:

After decrypting communication and matching it against the previously saved hash, the sensor examines the second message it got from the gateway. If both hashes match, the process for authentication is carried out by comparing the RSSI with the threshold RSSI (-100dBm). IoT devices authenticate gateways and verify that the gateway has selected the proper option for data transfer if the data meets the threshold RSSI. Authorization fails if RSSI doesn’t meet the criteria. An Internet of Things gadget computes the hash of C2, random number sequences Sen{j+1}, session time (S+1), and RSSI for the entire message, encrypts it with key (Ek), and sends it to gateway to validate that it was able to receive the message from the gateway.

4.2.5 Communication between the IoT devices and gateways

Upon receiving message 3 from a gateway, the sensor authenticates h(Gid) and MACKik (msg4) by decrypting the message. When message 3 gets delivered by the gateway effectively, the mutual authentication procedure is said to be completed if it is legitimate.

In this section, security and lightweight characteristics are analyzed using the Communication Cost, and encryption time. Additionally, AVISPA and tools are also used to authenticate the security strength of the suggested protocol. Embedded C programming is adopted for deploying the proposed protocol in the Arduino and ESP8266 based IoT applications where as python is used for raspberry and creating the various test environments. Tos implements the proposed ABE schemes; it is mandatory to install PBC (pairing based cryptography) library on Arduino and raspberry pi. Randomness of the keys and encrypted data uses NIST STS version 2.1.2 which was developed by Python 3.19. For AVISPA simulation, specific parameters were used to control the analysis behavior and execution. These are summarized in the following Table 6:

Table 6. Simulation settings

These simulation settings ensure consistent and controlled security verification across multiple sessions, helping to validate the protocol’s resistance to various attack models.

6.1 Communication cost

Assuming that there are five to ten sensors inputs per IoT device and that the integrated microcontroller serves as the device's brain, the suggested protocol’s communication cost is assessed. Based on the sensor inputs, communication cost is calculated on the authentication process. The suggested ABES is used throughout this endeavor to encrypt all credentials used for authentication beforehand sending them to the recipient. The number of bits communicated in the complete process of validation is used to calculate communication cost. Table 7 illustrates the hardware specification used for the experimentation.

Table 7. Experimental setup for the calculation of communication cost

Table 8. No of bits transmitted during the authentication protocol (Assuming 8-bit IoT devices with 5 sensors)

Table 8 and Table 9 provide a detailed breakdown of the total number of bits exchanged during each stage of the authentication protocol for 8-bit and 32-bit IoT devices equipped with five sensors respectively. In Table 8, the 8-bit devices transmit a cumulative total of 1720 bits, distributed across four stages involving multiple message exchanges. Similarly, Table 9 shows that the 32-bit devices incur a higher communication overhead, totaling 1048 bits, due to wider data widths per transmission. These values reflect the cost of securely exchanging encrypted attributes and authentication hashes between the IoT devices and the gateway. This stage-wise breakdown highlights the communication efficiency of the proposed protocol across different hardware architectures. The suggested protocol requires a lower communication cost compared to references [29, 30], and references [31, 32], as outlined in Table 10. This efficiency is further illustrated in Figure 4, which compares the total communication bits of different approaches and clearly shows that the proposed protocol achieves the least overhead. Thus, from the standpoint of resource-constrained environments, the suggested protocol proves to be more suitable for Internet of Things devices.

Table 9. Total bits transmitted during the authentication protocol for 32-bit IoT devices

Table 10. Communication bits analyis

4.jpg

Figure 4. Comparison of total communication bits between different approaches

6.2 Authentication performance analysis

As the number of processes increases, the time required for key creation, encryption, and decryption is estimated. For every stage of authentication, execution time is calculated for the varying iterations. For these experimentations, attributes are increased randomly and time consumption for each iteration is calculated. Figures 5 and 6 shows the execution involved in encryption, decryption and authentication process for distinct embedded processors.

From the Figures 5 to 8, it is clearly identified that the time consumption is increasing linearly with the varying iterations and increasing attributes. The most time consumption process is key management and authentication process. As the iteration increases, average encryption time in raspberry pi is 8.7secs for 60 iterations whereas Arduino +esp8266 takes only 5.3secs for completing the entire process. For the same number of iterations, raspberry pi’s decryption time is 8.8secs and 8-bit system requires only 4.2secs. Furthermore, key generation and authentication phases consumes 37.34secs and 27.45secs in raspberry and other low end embedded systems. From this experimentation, the time consumption for each stage is quite low which can be suitable for porting in the resource constraint IoT devices.

5.jpg

Figure 5. Time consumption analysis for encryption process using the proposed protocol

6.jpg

Figure 6. Time consumption analysis for decryption process using the proposed protocol

7.jpg

Figure 7. Time consumption analysis for key generation process using the proposed protocol

8.jpg

Figure 8. Time consumption analysis for authentication process using the proposed protocol

6.3 Security analysis

The key utilized to encode and decode the communications is closely related to the security features of any cryptography system. Owing to the symmetric nature of the encryption system, the gadget is susceptible to various attacks once the attacker obtains the key. Thus, it is imperative that we guarantee the key generator's genuine randomness and prevent it from approaching.

An adversary cannot anticipate the next output bit in a sequence generated for cryptographic applications, even if they know the arbitrary numbers in the sequence. This means that pseudorandom numbers created for cryptographic applications must also be unaffected. To verify that a particular random or pseudo-random generator may be expended for cryptography. National Institute of Standards and Technology (NIST) describes a series of statistical assessments for the randomness of the sequences of numbers. Sensing any difference from randomness in each binary sequence is the goal of the approaches discussed here. A poor-quality generator primarily explains the variance. To demonstrate that the keys are highly random, the study project employs almost a variety of numerical tests as outlined by NIST. The experiments are conducted on a sample size of 100 iterations, with a sampling frequency of 1 kHz. Using MicroPython modules installed on embedded boards, the keys generated at each iteration are transformed into binary format and subjected to statistical tests.

6.3.1 Frequency monobit test

Throughout the test, the percentage of ones and zeros is what matters most. To ascertain that a sequence has about the same number of ones and zeros as predicted for random sequence, this test examines that question. The test evaluates how closely the ratio of ones to ½ is kept to a minimum—namely, how nearly equal the number of zeros and ones in a series occur. This test's success is a must for completing all others. The test gives a value of -1 to zeros and a value of +1 to ones. These values are then added up to generate cumulative numbers, the total computation of which is outlined below:

$S=\|S(n)\| / n^{0.5}$              (9)

In this case, n is the sum of samples, and S(n) is the sum of values obtained. P-value is determined by the mathematical equation, when the sum of the individual numbers is calculated.

P=erfc(S/2)^0.5               (10)

Table 11. Frequency monobit test performance

Table 12. Frequency block test performance

The parameters which are obtained during the frequency monobit tests are tabulated in Table 11.

The proposed model has produced keys that have demonstrated genuine randomness in all ten rounds, indicating their appropriateness for robust encryption and potential protection against network assaults.

6.3.2 Frequency block test

The purpose of this test is to determine if the frequency of those in a K -bit block is approximately k/2, regardless of the assumption of randomness. Frequency (Monobit) test, test 1, is the degenerate test for block size k=1. In this test, the randomness of each repetition of K-bit encryption is determined by the mathematical formula, which divides it into K/2.

$P={igamc}\left(\frac{N}{2}, \frac{¥^{0.5}(o b s)}{2}\right)$                (11)

where, igamc is the gamma function used for calculation of randomness,

¥=statistical randomess value which is given by the mathematical expression

For every single key created and analyzed under two conditions, the randomness value is more than 0.01 in the entire iterations tested. The mean score from the tests conducted in the key blocks is displayed in the Table 12.

6.3.3 Run test

A sequence test measures the number of continuous identical series of bits called runs. When you see a run of length k it means there are k identical bits separated by bits of the other value. The runs test checks if the number of runs of ones and zeros of different dimensions matches that of what we assume from a random sequence. (Table 13). The purpose of this test is to specifically assess how quickly or gradually the oscillation between these zeros and ones vacillates.

Table 13. Runtest performance

The frequency test is made necessitous for this exam by the instances that have been completed before. A randomness analysis of the key's continuation is conducted which is mentioned in reference [33].

When there are numerous changes in the bit streams, quicker oscillations—which are defined as a switch from one to zeros—occur in this test, as identified by V(n)(Obs). Therefore, for the bit generated by the suggested ABE maps, strong pseudo randomness is used.

6.3.4 Longest run test

The main objective of the criterion is the longest run of M-bit blocks. To determine whether the length of the longest run of ones in the sequence under test is consistent with the length of the longest run of ones that one would anticipate in a random sequence, this test is intended to do. It should be observed that an anomaly in the longest run of ones' predicted length suggests existence of an abnormality in the longest run of zeroes' expected length as well. Table 14 illustrates the intermediate results of this test. From the Table 14, proposed scheme has produced the high random keys that can grant the defensive properties against the multiple attacks.

6.3.5 DFT Test

Peaks in the sequence's Discrete Fourier Transform are the focus of this exam. This test’s objective is to identify recurrent characteristics in a chronological sequence under test indicating departure from the assumption of randomness. Table 15 demonstrates the DFT test performance of the proposed model. From the Table 15, the proposed model met the DFT test and produced the most random bits in its experimental iterations.

Table 14. Longest run test performance of the proposed schemes

Table 15. DFT test performance of the recommended scheme

The key displays considerable pseudo randomness in every iteration when the d value is small and P is greater than 0.01.

6.4 Protocol validation phase

The protocols are validated over AVISPA by modelling through CAS++ and HLPSL. The protocols are validated for the security attacks feasible on them. Figures 9 to 11 shows the simulation results under Messaging Servers that run at the backend.

Simulation results demonstrate that recommended protocol can defend against any attacks and solve the defense challenges of an IoT environment.

9.jpg

Figure 9. HLPSL file programmed for the proposed authentication protocol

10.jpg

Figure 10. CAS++ programs simulated in AVISPA-SPAN environment

11.jpg

Figure 11. Mutual authentication programs simulated in AVISPA-SPAN environment

6.5 Statistical analysis

To analyze the effectiveness of the proposed optimization techniques, a statistical comparison was performed using standard fitness metrics, including best, worst, mean, median, standard deviation (SD), and variance. Table 16 presents the outcomes of different optimizers such as Binary Whale Optimization (BWO), Particle Swarm Optimization (PSO), Ant Colony Optimization (ACO), Random Search Optimization (RSO), and the proposed Optimization. Among all, suggested framework emerged as the best-performing method, demonstrating the highest fitness score with minimal variation.

Table 16. Statistical results of fitness function between different techniques