Security and Privacy for Edge-Assisted Internet of Things Security Proof for the SKKE Protocol

Wang, Xiangyang; Gu, Chunxiang; Wei, Fushan; Lu, Siqi

doi:https://doi.org/10.1155/2021/9029664

Security and Communication Networks

On this page

Abstract Introduction Preliminaries Conclusions Data Availability Conflicts of Interest References Copyright Related Articles

Special Issue

Security and Privacy for Edge-Assisted Internet of Things

View this Special Issue

Research Article | Open Access

Volume 2021 | Article ID 9029664 | https://doi.org/10.1155/2021/9029664

Security and Privacy for Edge-Assisted Internet of Things Security Proof for the SKKE Protocol

Xiangyang Wang,¹Chunxiang Gu,^1,2Fushan Wei,¹and Siqi Lu¹

Academic Editor: Ding Wang

Received05 Jul 2021

Accepted09 Nov 2021

Published03 Dec 2021

Abstract

As an Internet of things (IoT) technology, the ZigBee has a wide range of applications in home automation, smart energy, commercial building automation, personal, home and hospital care, telecom, and wireless sensor. The ZigBee standard has the advantage of high reliability, which is based on the security of authentication key agreement protocol, namely, the SKKE protocol. In the ZigBee standard, this protocol based on shared symmetric-key is applied on the security protocol level. It is a full symmetric-key key agreement with key confirmation scheme, while the key confirmation mechanism is provided by a message authentication coding mechanism. In this paper, we consider the security of the SKKE protocol. In the random Oracle model, we reduce the security of the SKKE protocol to the collision of the hash function and the HMAC function and the indistinguishability between the output of the random Oracle and a random number. We also give a theoretical proof with the game-based method. To our knowledge, there is no research on the provable security of the ZigBee protocol at this stage, so it is helpful to promote further research of the ZigBee protocol security.

1. Introduction

The emerging IoT technology usage in different aspects of life results in a very large number of devices connected to each other and to the Internet in a small space. As we have known, IoT devices rely on one or more communication technologies [1–3] (such as ZigBee, Z-Wave, BLE, and WiFi), some of which are well-suited for resource-constrained devices to operate in low-power and lossy networks (LLNs) such as ZigBee and Z-Wave. Among them, the ZigBee protocol, with its low-cost, low-power consumption, high-robustness, and flexibility, has been increasingly applied in the field of short distance communication, daily monitoring, and short distance data transmission. Nowadays, ZigBee-based IoT devices are predominant in the IoT landscape, and the security of the ZigBee plays a more and more important role in the ZigBee communication. In recent years, the researches of the ZigBee security can be divided into implementation level security and specification level security.

At the implementation level, some researchers have studied ZigBee enabled devices in order to find vulnerabilities at the implementation level [4, 5]. These attacks found in the research include replay attack, eavesdropping attack, acquiring key attack, denial of service attack, same-nonce attack, ghost attack, and men-in-the-middle attack. However, these findings do not necessarily reflect the insecurity in the specification. In addition, their methods are usually special and aim to discover low-level vulnerabilities and cannot be effectively transported to the formal analysis of the protocol stack, while, at the specification level, formal verification of ZigBee has been considered in several papers [6–11]. Especially, in [12], the authors focused on the application of formal verification to protocols in the IoT domain and summarized the existing approaches to the formal analysis of the ZigBee protocol. In addition, Li et al. in [13] established the ZigBee symbol model according to the ZigBee standard (ZigBee 1.0 and ZigBee 3.0). This model mainly captures the important elements, such as key sharing, device joining, and key updating. Next, according to the ZigBee specification, the authors divided the ZigBee protocol into some subprotocols, then the authors used the security protocol verification tool (tamarin) to analyze and verify the security attributes of those subprotocols. Security analysis finds some known security vulnerabilities in ZigBee 1.0 and proves that there are no such vulnerabilities in ZigBee 3.0.

Since the 1980s, two methods for analyzing security protocols have been developed [14]. One method relies on the symbolic model of protocol execution, that is, symbolic (or Dolev Yao or formal) method, in which cryptographic primitives are regarded as black boxes. Symbolic method adopts a highly abstract execution view, in which the messages exchanged by all parties are symbolic terms. This model supports automatic analysis, but the high degree of abstraction makes the security guarantee provided by this method unclear and may miss the possible attacks in the computing model. The other method relies on the computational model which considers the complexity and probability problems, namely, computational (or cryptographic) method. This method captures a powerful security concept and can resist all probabilistic polynomial-time attacks.

All above researches of the ZigBee security at the specification level are in symbolic methods, so it is very necessary and meaningful to take research on the ZigBee security at the specification level under the computational model. In the ZigBee specification, the SKKE protocol is used for two end devices (not including trust center) to establish the application link key for their communication end-to-end (only used in APS layer). Although the process of establishing the end-to-end application link key has been researched in [13], the authors only considered the case that the trust center randomly generates the link key and then distributes it to the initiator and the responder, respectively. As for another case, the initiator and the responder share the master key (randomly generated by the trust center and transmitted to the initiator and the responder, respectively), and then they negotiate the application link key based on the shared master key through the SKKE protocol [15, 16]. The SKKE protocol is a full symmetric-key key agreement with key confirmation mechanism, while message authentication coding mechanism is used to provide key confirmation. Yuksel et al. [15, 16] described the SKKE protocol in detail, but the analysis of the SKKE protocol security is scarce at present. It is necessary to analyze and prove the security of the SKKE protocol. In this paper, the security model of the SKKE protocol is established under the random Oracle model, and its confidentiality is reduced to the collision of hash function and HMAC function and the indistinguishability between random Oracle output and random number. Meanwhile, its authentication is reduced to the collision between hash function and HMAC function, and the proof of the SKKE protocol confidentiality and authentication is given with the game-based method.

The rest of this paper is organized as follows. Section 2 gives the basic knowledge needed in the security proof of the SKKE protocol; Section 3 is the description of the SKKE protocol and its execution details; in Section 4, we model the SKKE protocol and give the definition of indistinguishable experiment, authentication experiment, and some security notions; in Section 5, we prove the security of the SKKE protocol with the game-based method; Section 6 is the summary of our work.

2. Preliminaries

Denote by the operation of assigning to . Denote by the operation sampling uniformly at random from a set . is short for probabilistic polynomial time.

Lemma 1 (see [17]). Let be a distinguisher, then we havewhere is a function cluster; ; is a random Oracle; denotes sampling uniformly at random from ; and is a negligible function.

HMAC [18] is a key-related hash operation message authentication code. HMAC operation uses a hash algorithm to generate a message digest as output with a key and a message as input. A key hash function and a key are used in the definition of HMAC. “text” is used as the plaintext to calculate HMAC; the operation of HMAC function is as follows:where is a hash function; and are two different fixed strings. The detailed operation steps of HMAC function can be referred to [18].

3. The Description of the SKKE Protocol

In this section, we describe the interaction and the execution details of the SKKE protocol.

3.1. The SKKE Protocol

Figure 1 shows the message transmission of the key agreement mechanism, namely, the SKKE protocol [16]. As shown in the figure, represents the initiator of the protocol and represents the responder of the protocol. The essential difference between the role of the initiator and the role of the responder is that the initiator sends the first pass of the exchange. As shown in Figure 1, the is the master key shared between the initiator and the responder . means the transmission of message that contains payload(s) . represents the challenge generated by a device and represents the hash value. Based on the master key , and negotiate the session key by executing the SKKE protocol.

3.2. Execution Details of the SKKE Protocol

In [15, 16], the authors showed a detailed description of the SKKE protocol. For convenience, let us briefly describe it here.

In the SKKE protocol, an initiator establishes a with a responder using a shared secret . We present the computational details of the SKKE protocol in Figure 2. In the first two messages, the initiator and the responder exchange their challenges. In the last two messages, they exchange the data they have computed using the challenges and their identities. After verifying that they have received the correct value, they use another value as the that both of them can compute.

4. Security Model and Security Experiment

4.1. Security Model

We assume that the attacker can completely control the channel, that is, the attacker can eavesdrop, delay, and tamper with the messages transmitted by running the protocol. The following Oracle queries are defined to describe the adversary’s ability:(i): this query models passive attacks. The output of this query consists of messages that were exchanged during the honest execution of the protocol among and .(ii): this query models active attack by sending message to the participant . The output of this query is the message that would generate on receipt of message .(iii): this query models the misuse of session key, namely, link key established between and . The output of this query is the link key established during the -th communication between and . If the -th communication is used as the test session, this query cannot be executed.(iv): this query models the ability of the adversary to reveal the long-term secret key of the -th communication between and . The output of this query is the master key shared between and during the -th communication. If the -th communication is used as the test session, this query cannot be executed.

The adversary is represented as two procedures and that share state. In the RO model, the hash functions and are modeled as two random oracles, and , and each of them obtains a list to store queries. When the adversary queries to , if the query is in the list, the corresponding value is returned, else it returns a random value. It is the same as above that the adversary queries to .

4.2. Security Experiment

Before defining the security notion of the SKKE protocol, we define indistinguishability experiment and authentication experiment from the perspectives of confidentiality and authentication of the SKKE protocol.

4.2.1. Indistinguishability Experiment

In this section, we define an indistinguishability experiment (see Figure 3), which is used in the security proof of confidentiality.

The represents -th session established by the initiator and the responder , which is the test session and not revealed. and represent the master key and the link key, respectively, which is a bijection. represents the length of the master key and the link key.

Definition 1. For any adversary , the advantage of the adversary breaks the confidentiality of the SKKE protocol which is defined as follows:

4.2.2. Authentication Experiment

We denote the authentication experiment as . Next, we consider the authentication of the initiator to the responder , namely, (see Figure 4), as an example to consider the authentication of the SKKE protocol.

Remark 1. The SKKE protocol is a symmetrical two-way authentication protocol. In Figure 4, denotes the authentication of the initiator to the responder , as for the authentication of the responder to the initiator , similarly.

Definition 2. For any adversary , the advantage of the adversary breaks the authentication of the SKKE protocol which is defined as follows:

Definition 3. The SKKE protocol has security if for any adversary , the following advantage is negligible:

5. Security Proof

In this section, firstly, we prove the confidentiality (namely, indistinguishable security) and authentication of the SKKE protocol, namely, Theorem 1 and Theorem 2. In the random Oracle model, we reduce the confidentiality to the collision of hash function and HMAC function and the indistinguishability between the output of random Oracle and random number, while the authentication is reduced to the collision of the hash function and the HMAC function. Then, we show the SKKE protocol is secure by Theorem 3.

Theorem 1. For any adversary against the indistinguishability experiment, the advantage of the adversary wins the experiment which satisfies the following inequality:where is the length of master key, and are the output lengths of the hash function and the HMAC function, and are the times of the adversary queries to the hash functions and , and are two negligible functions.

Proof. For each game G_i, we denote as . The initial game G₀ is defined as Figure 3.
Game G₁: the transition from G₀ to G₁ is realized by in-lining the calculation process of and the HMAC function, as shown in Figure 5. So, the two games are equivalent. Then, we haveGame G₂: if the adversary obtains the shared by the initiator and the responder, the adversary can calculate the , and then the adversary can win the game. Thus, as shown in Figure 6, in game G₂, we raise a flag when the adversary obtains the by guessing. The difference in the probability of in this game and in game G₁ is bounded by the probability of in the latter game, while the probability of does not exceed . Then, we haveGame G₃: as shown in Figure 7, in this game, we raise a flag to represent that the adversary finds a collision of the outer hash function of the HMAC function , then the adversary obtains . In the RO model, the hash function is idealized as a random Oracle, and an Oracle is randomly selected from the function cluster to replace the hash function . Then, according to the lemma, that is, the output of the random Oracle which is indistinguishable from the random number, we randomly and evenly select and replace with . Therefore, the upper bound of probability difference of G₂ to G₃ transformation is characterized by the probability of event occurrence and the indistinguishability between the output of the random Oracle and a random number. Then, we can getGame G₄: as shown in Figure 8, in this game G₄, we raise a flag to represent that the adversary finds a collision of the hash function , then the adversary obtains . In the RO model, the hash function is idealized as a random Oracle, and an Oracle is randomly selected from the function cluster to replace the hash function . Then, according to the lemma, that is, the output of the random Oracle which is indistinguishable from the random number, we randomly select and replace with . Therefore, the upper bound of the probability difference of G₃ to G₄ transformation is characterized by the probability of event occurrence and the indistinguishability between the output of the random Oracle and a random number. Then, we havewhere is the output length of the hash function and is a negligible function. While in G₄, the protocol copies returned are random numbers that have nothing to do with coin tossing, then we haveIn summary, from (1) to (5), we can get the adversary’s advantage in winning as follows:

Theorem 2. For any adversary against the authentication experiment, the advantage of the adversary winning satisfies the following inequality:where is the length of master key; and are the output lengths of the HMAC function and the hash function; is the times of the adversary queries to the hash function ; and is the total times of the adversary queries to the hash function .

Proof. For each game G_i, we denote as . The initial game G₀ is defined as Figure 4.
Game G₁: as shown in Figure 9, the transition from G₀ to G₁ is realized by in-lining the calculation process of HMAC function. Thus, the two games are equivalent. Then, we can haveGame G₂: as shown in Figure 10, we raise a flag to represent that the adversary finds a collision of the hash function of , then the adversary obtains a , which satisfies the following conditions:Since the probability of the event happening is not more than , then we can havewhere is the number of times the adversary queries to in this game.
Game G₃: as shown in Figure 11, we raise a flag to represent that the adversary finds a collision of the hash function , then the adversary obtains a , which satisfies the following conditions: and . Since the probability of the event happening is not more than , then we can haveGame G₄: as shown in Figure 12, we raise a flag to represent that the adversary finds a collision of the hash function of , then the adversary obtains a , which satisfies and . Since the probability of the event happening is not more than , then we can havewhere is the number of times the adversary queries to in this game. Due to the inclusion relationship between events , , , and , can be obtained from the conditional probability formula. The probability of the adversary obtains the master key by guessing which is not more than ( is the length of the master key), so we can haveTo sum up, from (6) to (10), we can get the advantage of the adversary against the authentication experiment of to , and it satisfies the following inequality:In a word, the advantage of the adversary against the authentication of the SKKE protocol satisfies

Theorem 3. For any adversary against the security of the SKKE protocol, the advantage of the adversary winning satisfies the following inequality:

Remark 2. The proof of Theorem 3 is obvious. It should be noted that is the largest times of the adversary queries to the hash function in these two security experiments, and is the largest total times of the adversary queries to the hash function , similarly.

6. Conclusions

As an Internet of things communication technology, ZigBee has a wide range of applications in home automation, smart energy, commercial building automation, personal, home and hospital care, telecom, and wireless sensor. At the same time, its security has also received more and more attention. According to the standard of ZigBee 3.0, this paper considers the security of the SKKE protocol, which is used by the initiator and the responder to establish the application link key. In the random Oracle model, we reduce the confidentiality of the SKKE protocol to the collision of the hash function and the HMAC function and the indistinguishability between the output of random Oracle and random number. Then, we reduce the authentication to the collision between the hash function and the HMAC function. Finally, we give the theoretical proof of the confidentiality and authentication of the SKKE protocol with the game-based method. As we known, there is a lack of research on the provable security of the ZigBee protocol at this stage, so it is a meaningful work to study the provable security of the SKKE protocol, and it is helpful to promote further research of the ZigBee protocol security.

Data Availability

No data were used to support this study.

Conflicts of Interest

The authors declare that there are no conflicts of interest regarding the publication of this paper.

References

C. Ge, Z. Liu, J. Xia, and L. Fang, “Revocable identity-based broadcast proxy Re-encryption for data sharing in clouds,” IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 3, pp. 1214–1226, 2021.
View at: Publisher Site | Google Scholar
C. Ge, W. Susilo, Z. Liu, J. Xia, P. Szalachowski, and F. Liming, “Secure keyword search and data sharing mechanism for cloud computing,” IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 6, p. 1, 2020.
View at: Publisher Site | Google Scholar
J. Durech and M. Franekova, “Security attacks to ZigBee technology and their practical realization,” in Proceedings of the 2014 IEEE 12th International Symposium on Applied Machine Intelligence and Informatics (SAMI), pp. 345–349, IEEE, Herl'any, Slovakia, January 2014.
View at: Publisher Site | Google Scholar
L. N. Whitehurst, T. R. Andel, and J. T. McDonald, “Exploring security in ZigBee networks,” in Proceedings of the 9th Annual Cyber and Information Security Research Conference, pp. 25–28, ACMDL, Ingolstadt , Germany, April 2014.
View at: Publisher Site | Google Scholar
X. Cao, D. M. Shila, Z. Yang, Y. Zhou, and J. Chen, “Ghost-in-Zigbee: Energy depletion attack on zigbee-based wireless networks,” IEEE Internet of Things Journal, vol. 3, no. 5, pp. 816–829, 2016.
View at: Publisher Site | Google Scholar
A. Gawanmeh, “Embedding and verification of ZigBee protocol stack in event-B,” Procedia Computer Science, vol. 5, pp. 736–741, 2011.
View at: Publisher Site | Google Scholar
C. Ge, W. Susilo, J. Baek, Z. Liu, J. Xia, and L. Fang, “A verifiable and fair attribute-based proxy Re-encryption scheme for data sharing in clouds,” IEEE Transactions on Dependable and Secure Computing, p. 1, 2021.
View at: Publisher Site | Google Scholar
R. M. Nadeem and A. A. Gill, “A formal model for verification of ZigBee protocol for secure network authentication,” Indian Journal of Science and Technology, vol. 10, no. 20, pp. 1–7, 2017.
View at: Publisher Site | Google Scholar
A. P. Melaragno, D. Bandara, D. Wijesekera, and J. B. Michael, “Securing the ZigBee protocol in the Smart grid,” Computer, vol. 45, no. 4, pp. 92–94, 2012.
View at: Publisher Site | Google Scholar
C. Ge, W. Susilo, J. Baek, Z. Liu, J. Xia, and L. Fang, “Revocable attribute-based encryption with data integrity in clouds,” IEEE Transactions on Dependable and Secure Computing, p. 1, 2021.
View at: Publisher Site | Google Scholar
M. Alshahrani, I. Traore, and I. Woungang, “Anonymous mutual IoT interdevice authentication and key agreement scheme based on the ZigBee technique,” Internet of Things, vol. 7, Article ID 100061, p. 100061, 2019.
View at: Publisher Site | Google Scholar
K. Hofer-Schmitz and B. Stojanović, “Towards formal verification of IoT protocols: a Review,” Computer Networks, vol. 174, p. 107233, 2020.
View at: Publisher Site | Google Scholar
L. Li, P. Podder, and E. Hoque, “A formal security analysis of ZigBee (1.0 and 3.0),” in Proceedings of the 7th Symposium on Hot Topics in the Science of Security, pp. 1–11, ACMDL, Ingolstadt , Germany, September 2020.
View at: Publisher Site | Google Scholar
B. Blanchet, “Mechanizing game-based proofs of security protocols,” Software Safety and Security, vol. 33, pp. 1–25, 2012.
View at: Publisher Site | Google Scholar
E. Yuksel, H. R. Nielson, and F. Nielson, “ZigBee-2007 security essentials,” in Proceedings of the 13th Nordic Workshop on Secure IT Systems, pp. 65–82, Technical University of Denmark, Kongens Lyngby, Denmark, October 2008.
View at: Google Scholar
ZigBee Specifications, 2015, , 2015, https://zigbeealliance.org/wp-content/uploads/2019/11/docs-05-3474-21-0csg-zigbee-specification.pdf.
M. Bellare and P. Rogaway, “Random oracles are practical,” in Proceedings of the 1st ACM conference on Computer and communications security - CCS '93, pp. 62–73, Computer and Communications Security, Ingolstadt , Germany, December 1993.
View at: Publisher Site | Google Scholar
H. Krawczyk, M. Bellare, and R. Canetti, “HMAC: keyed-hashing for message authentication,” RFC, vol. 2104, pp. 1–11, 1997.
View at: Publisher Site | Google Scholar

Copyright

Copyright © 2021 Xiangyang Wang et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

PDF Download Citation

Download other formats

Order printed copies

Views

291

Downloads

501

Citations