Anonymous mutual IoT interdevice authentication and key agreement scheme based on the ZigBee technique

Abstract Establishing end-to-end device authentication in Internet of Things (IoT) networks is challenging because of the heterogeneous nature of IoT devices. By covering different security properties, various authentication protocols have been introduced to ensure a certain level of security and privacy protection. In this paper, we propose an anonymous device-to-device mutual authentication and key exchange scheme based on the ZigBee technique, designed for a smart home network, an important domain in the IoT. The proposed protocol relies on symmetric encryption and enables IoT devices to authenticate in the network and agree on a shared secret session key when communicating with each other via a trusted intermediary (home controller). To achieve perfect forward secrecy, the session keys are changed frequently after every communication session. The proposed scheme achieves secure anonymous authentication with the unlinkability and untraceability of IoT devices’ transactions. The overhead and efficiency of the proposed scheme are analyzed and compared with other related schemes. In addition, the security of the scheme is evaluated using three different methods: informal analysis, formal analysis using the Burrows–Abadi–Needham logic (BAN), and a model check using the automated validation of internet security protocols and applications (AVISPA) toolkit.