ALPAK: (Anonymized Lightweight PUF-based group Authentication with Key distribution) for IoT Devices

Securing applications that gather and transfer confidential information has become a critical challenge in the rapidly evolving Internet of Things (IoT) landscape. Such data’s authenticity, integrity, and confidentiality must be guaranteed while reducing security functions’ computation and communication overhead to accommodate the numerous constrained devices involved. Group authentication and key management are essential aspects of IoT security, but existing protocols often need to be more computationally expensive for IoT applications and must take care of anonymization. Consequently, IoT devices may be open to potential cyber-attacks due to the use of simple security primitives. Physically Unclonable Function (PUF) can enable in lightweight approach to authentication and key distribution among group members. The factorial tree and Chinese Remainder Theorem (CRT) can minimize communication messages required to renew the keys. This paper presents a novel protocol, Anonymized Lightweight PUF-based group Authentication with Key distribution (ALPAK) for IoT Devices, which improves the PUF-Based Lightweight Group Authentication and Key Distribution Protocol (PLGAKD) to enhance the anonymity of IoT devices. The paper further presents the formal verification of the ALPAK scheme with the Scyther tool and detailed security analysis.