Introduction

Nowadays most IoT (Internet of Things) devices in smart homes rely on radio frequency channels for communication, making them exposed to various attacks such as spoofing and eavesdropping attacks. Existing methods using encryption keys may be inapplicable on these resource-constrained devices that cannot afford the computationally expensive encryption operations. Thus, in this paper we design a key-free communication method for such devices in a smart home. In particular, we introduce the Home-limited Channel (HLC) that can be accessed only within a house yet inaccessible for an outside-house attacker. Utilizing HLCs, we propose a challenge-response mechanism to authenticate the communications between smart devices without key—HlcAuth. The advantages of HlcAuth are low cost, lightweight as well as key-free, and requiring no human intervention. According to the security analysis, HlcAuth can defeat replay attacks, message-forgery attacks, and man-in-the-middle (MiTM) attacks, among others. We further evaluate the HlcAuth in four different physical scenarios, and results show that HlcAuth achieves 100% true positive rate (TPR) within 4.2m for in-house devices while 0% false positive rate (FPR) for outside attackers, i.e., guaranteeing a high-level usability and security for in-house communications. Finally, we implement HlcAuth in both single room and multi-room scenarios.

Protocol

We propose HlcAuth which exploits a challenge-response mechanism and authenticates smart device communication without encryption. The overview of HlcAuth is shown in Fig. 2.

Challenge-Response. We utilize challenge-response mechanism to realize the mutual authentication between the gateway and smart devices. Smart devices require the gateway to prove its trustworthiness by answering a correct response. In similar, the gateway verifies the identity of smart devices by checking the validity of the challenge. Both challenge and response messages are transmitted over HLCs, which largely improves the security of the communication.

Key-free. The main difference between HlcAuth and traditional secure protocol is key-free, which means the authentication between smart devices and the gateway does not rely on encryption keys. The security of communication relies on the boundary-attenuated property of HLCs. Without the overhead of encryption keys, resource-constrained smart devices can also achieve high-level security.

Implementation

Contact us

Chaohao Li : lchao@zju.edu.cn