Securing the Internet of Things (IoT) Edge: A Lightweight Authentication Protocol for Resource-constrained Devices

Abstract

The rapid scalability of IoT has brought computing power to the edge of the network where low powered devices have a great deal of difficulty protecting themselves from cyber-attack due to their limited resources (memory, processing, power).Current authentication protocols (i.e., TLS/DTLS, IPSec) are certainly statistically secure but computationally too expensive for low powered devices and as such expose them to a variety of cyber-attacks (replay, impersonation, man-in-the-middle, etc.).This paper introduces a new mutual authentication protocol called LEAP (Lightweight Edge Authentication Protocol) specifically developed for low powered edge devices in the IoT space.LEAP utilizes two message exchanges between devices using only lightweight cryptographic primitives (i.e., SHA-256 hash and simple XOR operations) to arrive at a mutual authentication and fresh session key.The protocol was developed using Python on Raspberry Pi Gateways and ESP32 Microcontrollers, with an extensive experimental performance evaluation as well as validating network resilience using the CIC IoT Dataset 2023.LEAP has a mean authentication time of 12.4 ms, an energy consumption of 28.4 mJ, and a memory footprint of only 11.2 KB flash and 4.8 KB RAM; therefore, LEAP provides a 28-fold speed improvement over the optimized ECC protocol of Sciancalepore et al. (2016) and a 33-fold improvement over the ECC protocol of Wang et al. (2018), with corresponding energy reductions of 26-fold and 31-fold respectively.Additionally, ProVerif checked that LEAP is secure against replay attacks, man-in-the-middle attacks and impersonation attacks under the Dolev-Yao adversary model.By providing verified resistance to replay, man-in-the-middle, and impersonation attacks under the Dolev-Yao adversary model, together with excellent efficiency, this makes LEAP a practical and viable method of authenticating resource constrained devices at the edge of the IoT, which is a critical gap in today's security landscape.