Dynamic Multiparty Authentication using

Cryptographic Hardware for the Internet of Things

Hussain Al-Aqrabi, Anju P. Johnson, Richard Hill
Centre for Industrial Analytics
University of Huddersfield
Huddersfield, HD1 3DH, UK
Email: {h.al-aqrabi,a.johnson,r.hill}@hud.ac.uk

Abstract—The rapid development of various emerging tech- due to the security requirement of more common activities including
nologies such as cloud computing and the Internet of Things (IoT) communication, encryption disks, and electronic money systems.
presents significant security and privacy challenges. In particular, Currently, hardware security, where programmable logic solutions can
complex and challenging applications involving various business provide additional security in the form of cryptographic hardware
parties have the requirement to delegate access control mecha- solutions (CHS) are widely in research [9], [10]. Currently, most
nisms securely to one or more parties, who in turn can govern industrial sectors use hardware security modules (HSMs) to provide
methods that enable multiple other parties to be authenticated dedicated cryptographic services to ensure ultimate device protection
in relation to the services that they wish to consume. Moreover, with a dual focus on high performance and security [11]. Hardened
modern integrated design and manufacturing follows a business authentications are highly resistant to remote attacks and are capa-
model where different third-party vendors provide hardware, ble to meet any level of endpoint security and are high potential
software, and manufacturing services, making it hard to ensure candidates for the future business. CHS in the form of Physically
the trustworthiness of the entire process. The emergence of IoT Unclonable Function (PUF) technology is world leaders in security
has led to our use of Field Programmable Gate Array (FPGA) IP cores [12]. Currently, IoT employs reconfigurable and lightweight
devices with Dynamic Partial Reconfiguration (DPR) abilities, devices with embedded security for a variety of applications [13],
which allows for modifications to the hardware implemented to [14].
undergo changes and incorporate dynamic addition/deletion of In a distributed system architecture such as cloud [15], the user
access using security protocols. We use, Physically Unclonable becomes dynamic or system may need to upgrade their product
Functions (PUF), cryptographic hardware primitive which are to stay updated. As FPGAs are designed to provide the necessary
based on a physical system having easy to evaluate, hard to flexibility due to the infield reconfigurable device features within
predict and manufacturer resistant properties in developing a limited time, they provide benefits to enterprises [16]–[18]. FP-
security protocol. In this paper, we combine the concepts of GAs are also increasingly used in embedded security applications
hardware security through PUFs and hardware evolution through as they provide flexibility including algorithm agility, architecture
DPR in providing dynamic secure multiparty authentication efficiency, resource efficiency, algorithm modification, throughput and
system. cost efficiency [19]. All protection mechanisms in hardware-enforced
using cryptographic techniques and dynamism using reconfiguration
Keywords— cryptographic protocol, dynamic partial reconfigura- provide a compact solution for flexibility and security. It is also
tion, physically unclonable functions, cloud computing, analytics, known that the use of programmable hardware in system imple-
security, multiparty interactions, Internet of Things mentation can improve performance. Although the relatively higher
power dissipation of FPGAs in previous generations was a challenge
I. I NTRODUCTION to limit their deployment in power sensitive applications, Ultra low
The Internet of Things (IoT) refers to uniquely identifiable de- power FPGAs are now widely available for IoT usage. For distributed
vices/objects connected to the internet that can sense data and react systems and IoT applications, DPR-enabled FPGAs are the platform
with their environment [1], [2]. Computing is focused on the vast of choice [6]. Furthermore, It may be subject to malicious circuit
amount of data collected and made accessible by connecting all alterations, usually referred to as Hardware Trojan insertion [20],
smart objects within an IoT system [3]. IoT ‘things’ are dynamic [21]. Such attacks use the same DPR capabilities that are otherwise
in nature requiring flexible software and hardware [4]. Software so valuable. Therefore, proper defense strategies must be put in place
applications are well known for their flexibility, but plasticity in to counter such threats while taking into account the inherent physical
hardware is an emerging field. The concept of flexible hardware was restraints of IoT. With the growing popularity of services delivered by
introduced with the advent of new technologies such as Dynamic cloud computing, it is important that both cloud providers and cloud
Partial Reconfiguration (DPR) in re-programmable hardware such as users have confidence that there are appropriate safeguards in place to
Field Programmable Gate Array (FPGA) devices [5]. DPR enables ensure an acceptable level of security and privacy mechanisms [22]–
the use of fewer or smaller devices, reducing power consumption [24]. A number of researchers have contributed to strengthen security
and enhancing system upgrades. These features led to the growing and privacy protection in cloud applications, and there are various
demand for deployment of FPGAs in areas including IoT [6]. As cryptographic algorithms to address potential security and privacy
software provides a very high amount of flexibility, which is lacking problems in cloud [25]–[28]. It follows that research topics related
in hardware, FPGAs are thought to bridge this gap. However, the de- to cloud security have attracted tremendous research interest [29]–
sign of these systems can be challenging, and this is particularly true [32].
of the configuration controller. Currently, new tools have been widely The remaining part of the paper is organised as following. In
developed to support and promote DPR capabilities in FPGAs [7]. section II, we discuss the multiparty delivery system emphasis-
Another highly demanding requirement for IoT is security [6], ing security. Section III, describes the challenges associated with
[8]. Nowadays cryptography has become part of our everyday lives the design of multiparty system. Various multiparty authentication
methods are provided in Section IV. In section V we describe the into contractual agreements, multi-round cooperation and human
hardware security primitive used in this work. The proposed protocol intervention.
for multiparty authentication is described in Section VI. Finally, The primary reason for this lack of progress is due to serious
we conclude the work with directions for future development in concerns about the security, privacy, and reliability of these systems.
Section VIII. IoT is capable of monitoring all aspect of day-to-to life, including
the above-mentioned concerns [39], [40]. Citizens, therefore, have
II. M ULTIPARTY SERVICE DELIVERY AND SECURITY legitimate concerns about privacy. In addition, businesses are con-
cerned with damage to their reputations due to data being handled by
As enterprises are being more conscious of data collection, anal-
wrong hands, and the governments fear the consequences of security
ysis, modelling, and prediction, the need for systems with a faithful
risks [41]. Multiparty authentication is a complex challenge in a
representation of business processes is becoming widespread. This
multi-cloud environment. These challenges increase in complexity
means that the underlying digital services must demonstrate both
when we consider the potential proliferation of devices in IoT
robustness and flexibility to tolerate new and unanticipated business
systems. In general, such systems may be a one-to-one mapping
scenarios. As such, process flows may be difficult to predict in
between system access devices and the clouds themselves.
some instances, especially if a business offers bespoke services or
However, there are also several additional complications of numer-
products to customers, where a transaction may execute only once
ous devices with varying degrees of functionality and capability. An
[33]. As a consequence of this, the eventual application that is
example of such a device is a Wireless Sensor Network (WSN), which
delivered is underpinned by a collection of disparate services that are
are often adaptive entities that may be applicable to the addition or
orchestrated at run-time, that may have origins in organisations that
removal of sensor nodes during operation.
are heterogeneous. Each of the host organisations will have adopted
Various reports predict a remarkable increase in the number of
security measures that are unique to the enterprise, with the effect
connected intelligent ‘things’ exceeding 20 billion by 2020 [42].
that an application composed of multiple services will thus present
As we see the exponential growth of the connected devices, the
a number of different security realms. Each realm typically consists
predictions seem to be believable. If these predictions come true, then
of data that represents a collection of resource principals, that are
the demand for authentication of devices will be a major challenge to
registered with a trusted principal such as a certificate authority. The
address, especially as there will be insufficient capacity to manually
principals are governed by a set of security policies that control access
authenticate even a fraction of the devices and consequently, some
to other services and resources within the scope of the application
automation will be mandatory.
[34]. The certificate authority is deemed to be trustworthy across
A fundamental challenge in a complex environment like the IoT or
the application domain and is present to validate users and functions
multi-clouds is the necessity to manage and ensure communications
[35]. It is essential that each security realm is authenticated against
that enable the required authentication approvals [43].
to ensure that a principal has the appropriate security privileges to
The use of Single Sign On (SSO) also allows the use of a key ex-
consume services marshalled by a security realm. The identity of a
change technique to actually manage the provision of authentication
principal needs to be confirmed by the correct authentication process
credentials certified by a named authority. In addition, it eliminates
of the relevant realm so as to correctly identify and establish who the
the need for users to enter different security credentials multiple times
principal is. During the authentication process, security credentials
[44], [45].
that were given to the principal by the relevant security realm are
However, despite the relative simplicity of the technique, it simply
used to authenticate it.
provides a secure method of key exchange is insufficient for the
In the case of more complex application architectures, such situation when we need multiple parties to be capable to establish
as cloud-based services provision, each cloud may hide multiple certain trust each other in a dynamic, heterogeneous environment,
instances of other clouds and/or services [36]. It follows that not and therefore SSO technique is lacking in this regard.
only will there be numerous authentication mechanisms to keep
maintained, but they will have to be invoked dynamically at run- IV. AUTHENTICATING MULTIPLE PARTIES
time on demand. If separate authentication processes are established
With the explosive growth of Internet of Things applications the
across disparate security realms, there is a potential for a significant
transition of traditional communication services to the Internet is
increase in authentication workload and the consequential side-effects
becoming increasingly important for group communication. Several
on network bandwidth and computational cycles [37]. The scenario
new online services and applications are emerging, such as Cloud
where a multiparty session is composed of many two-party sessions
computing which enables users to elastically scale their applications,
is explored by in [38], which demonstrates that there is a need for
software platforms and hardware infrastructures. These cloud imple-
a protocol for multiparty session authentication. There is an inherent
mentations increase the sharing of resources by separating solutions
challenge here that it is not always possible for a session participant
into different tiers [46].
to establish whether another session participant is actually a member
In contrast, where cloud computing systems share a domain,
of the multiparty session in progress.
services for the delivery of data analytics are more prone to external
threats such as: distributed attacks, malware attacks, and other known
III. K EY CHALLENGES FOR MULTIPARTY ENVIRONMENTS security and privacy issues for cloud computing [47], which are
The wider distribution of of IoT nodes and the extent and nature applicable to distributed systems also. Consequently, the growing
of the data collected and transformed by IoT devices are a major proliferation of services offered by IoT technologies poses many risks
challenge for security. The wider distribution of of IoT nodes and the related with security and privacy as well.
extent and nature of the data collected and transformed by IoT devices
are a major challenge for security. In the IoT domain, authentication A. Dynamic authentication
permits the integration of various IoT devices deployed in various In a multi-tenancy environment, Cloud-based business systems are
contexts. In view of the fact that services and organisations can adopt dynamic and involve similarly dynamic authentication interactions.
a collaborative process in an extremely vibrant and flexible manner, Hence, the authentication frameworks cannot be static. Burrows [48]
direct cross-realm authentication relationship is not simply a means proposed a tenant privacy framework using a global authentication
of joining the two collaborating realms. The lack of authentication register as an attempt to facilitate dynamic authentication.
path connecting two security realms will necessitate two security Dynamic authentication creates a per-session authenticator using
realms, when working together, to follow a more traditional and cryptography. With each authentication session between the requester
long route that will involve creating a mutual trust entailing entering and the verifier, a dynamic authenticator changes.
 In order to obtain the registration application certificate, the the provision of information that is personal and can uniquely identify
register holds a private key and personal data for each tenant, and and distinguish a particular tenant.
subsequently provides the requisite private key, providing that the It is the organisation that owns the private data (employee data in
personal data received by the system registrar is correct. Chen [49] this example), that administers and hosts the private key component
posits that a multi-tenant database hosted on a cloud platform can of the overall access key. The remaining component is the key to the
serve the purpose of registering global authentication requests and sub-domain that is generated and managed by the cloud provider. This
transactions, to include the specific details of which stakeholder has establishes a hierarchical organisation of the various key components,
initiated which transaction. as illustrated in Figure 2, where a commonplace use case of a staff
Each tenant is represented within the cloud service provider by member needing to access operations data from a remote cloud.
way of a record of specific data, that is appended to existing tenant
metadata. C. Federation across clouds
It is the augmentation of this tenant data that enables the verifi- As the number of parties requiring authorised access increases, so
cation of private data that has been supplied previously, a scheme does the complexity of the interactions that need to be managed via
that was introduced by Pippa [50] and is described as identity-based the home cloud. Agent-based federation of services across multiple
cryptography. This approach ensures that tenants within a multi- clouds [52] is one solution to the challenge, which simplifies the
tenant environment can only be granted access to the workspace that complexity by defining roles to manage service discovery, brokering
they have been allocated. and authentication.
The root key (common for the entire cloud) is the public key that Service discovery agents constantly scan the cloud ‘horizon’ to
unlocks a cloud or grid-based workspace assigned to all valid cloud detect the presence of new services that can be utilised by tenants.
tenants. Within the set of available services, there is then a matching service
Interaction between the client and server enables data regarding the that attempts to identify service availability and correlate this with
client’s identity to be exchanged for the purposes of verification. As service need. Finally, an agent that manages an authentication service
part of this exchange, the public (root) key is included and added to can then start the process of establishing trust between parties, as
the private key that was generated as a by-product of the interaction. illustrated in Figure 2.
The authentication registry server uses the signature to add private
key fields to the root key, for them to be sent to the client who
has made the rquest. Furthermore, other server arrays, which are
most likely to be clouds, can be allocated to undertake privacy-as-
a-service duties. These duties include the ability to provide identity-
based cryptography and identity-based signature generation for cloud
computing [50]. Such clouds arrange the key structures as hierarchies
as per Figure 1.

Fig. 2. Hierarchical multi-party structure in multi-cloud computing [34].

Trust is established between the home and foreign clouds by the

use of several keys, whose creation is invoked as a trigger for the
Fig. 1. Hierarchical key structures in cloud computing [34].
relationship to be generated. Once this is in place, the home cloud
can then marshall services, via the authentication cloud, to whichever
Each key is composed of two sub-components. The first is a public collection of multiple parties that exists.
key that is common across all authorised tenants of a cloud. The For a user to obtain trusted access to a resource, there now exists a
second component is a private key that is used by the tenants of a process where they divulge private information for authentication, in
cloud sub-domain. This private key is generated as a by-product of order to create private keys as necessary. This identification, together
a tenant’s individual digital signature via a distinct cloud array. with the group key, is then added to the key for the home cloud.
It is essential that secure information is exchanged in order
B. Cloud sub-domains to establish trust, but also to ensure that any redundancy and/or
Sub-domains within clouds are collections of virtual workspaces resilience is built into the scheme [52]. It might be that the home
that are private to a set of tenants or a business organisation. Users cloud could use attributes of tenants as a means of communicating
who are not authorised are prevented from entering the workspaces an intention to create trust with foreign clouds, on the basis that
by the use of public keys [51]. the recipients themselves would manage and issue public keys, for
The granting of a public key is marshalled by a requirement to later augmentation with personalised private keys as per the scheme
refer to personal records, such as employee data for instance. This is described above.
augmented by additional security from a private key that is issued to In the IoT domain, the security controls that we are exploring
tenants, again using an suthorisation mechanism that depends upon will be impractical to manage manually. Automation is an essential
enabler of a practical approach to trust between multiple parties [53], VII. AUTHENTICATION P ROTOCOLS
and the ability to rely on the operation of such services is of
paramount importance to all parties. This algorithm provides a secure protocol to authorise a user in
The inherent complexity of combining services from multiple par- an IoT network without adopting explicit storage of keys at the IoT
ties in an open world setting will inevitably lead to the identification nodes (SAC-FPGA or a key vault). This is achieved using a PUF
of system errors, either before or after an effect is detected [53], [54]. based protocol.
These potential design flaws are compounded by the introduction The method authorises an existing user (Protocol-1), as well as
of human behaviour and operation of the business systems, as such a new user using the properties of dynamic partial reconfiguration.
behaviours can be challenging to forecast accurately. A user is declared as genuine if he/she is introduced by an existing
user. A dynamically reconfigurable XOR-arbiter PUF is the security
D. A multiparty authentication model module behind this algorithm.
The first part of the algorithm defines multiparty authorisation in
Prior work [34] describes a framework that addresses the chal- a static environment. We define a static environment as a scenario in
lenges of providing the necessary agility for authorisation in a which all the requesting IoT nodes (users) are known to the network.
dynamic, multi-party setting. Figure 3 illustrates the framework in the The network contains ‘N’ users (existing) and ‘K’ IoT clouds.
context of a Session Authority Cloud that in this case is implemented The system contains a file handler, which processes and responds
as a Field Programmable Gate Array (FPGA), though it could also to requests between the user and a SAC FPGA. SAC-FPGA contains
be a remote cloud. The role of the SAC is to marshall the individual XOR-APUF configured in its fabric representing every authorised
sessions that are requested by any of the multiple parties (clouds). user in the network. The system consists of an evolvable framework,
The SAC does not distinguish between clouds, nor does it rely to begin with, we consider ‘N’ XOR-APUFs to be configured in the
on them being classified as ‘home’ or ‘foreign’, and it maintains static part of the FPGA-fabric.
overall authority over any party that has a desire to join the system. The static part corresponds to the FPGA fabric which is not
Authentication data for all tenants is retained by the SAC, including expected to bring changes in future after deployment. The number of
root keys for example. APUFs in the XOR-APUF is chosen to be strictly higher than 10 to
avoid any modelling attacks based on machine learning techniques
V. P HYSICALLY U NCLONABLE F UNCTIONS as described previously.
The FPGA-fabric also contains a dynamic partition, which could
In recent years, PUF circuits have produced significant interest incorporate more PUFs (users) / or modify the existing PUF design
as promising hardware security primitives for low overhead security for enhanced security. Addition of a new user using PUF-based
applications. A PUF is a hardware entity that is easy to use but hard authentication protocol will be discussed in the second phase of the
to anticipate the behavior. algorithm.
The design is practically not feasible to clone, even with the Every authenticated user holds a mathematical model of the
knowledge of the exact design and manufacturing process involved PUF. A mathematical model of the XOR-APUF with 10 or higher
in its production. Due to this feature, PUFs have been a secure cryp- arbiter stages is configurable only with the knowledge of individual
tographic substitute for traditional methods of random key generation constituent arbiters. We assume that these modeling parameters are
and secure key storage. exchanged through a secure communication channel.
In this work we use the XOR Arbiter PUF (XOR-APUF) which are
popularly used for authentication and are efficiently implementable
on FPGAs, making them an ideal choice for FPGA based security A. Protocol-1
applications [55], [56]. APUF is formed by connecting an arbiter to
a pair of parallel paths formed by the switches according to the state User Ui in the static network requesting an authorisation for a
of challenge bits (see figure). This PUF consist of ‘n’ bit challenges session on the IoT cloud Cj should follow the following steps. The
and a single bit response. A standalone APUF is prone to modeling User Ui makes a request to the file handler asking an IoT session on
attacks based on machine learning [57]. Cloud Cj .
As a security measure, we use an XOR- Arbiter PUF (see figure), The find handler responds with a set of ‘q’ challenges, each
with a composition of 10 or more APUFs instances XOR-ed to of size ‘r’. The file handler, for every user, maintains a database
generate the response. This composition is proved to be resilient from of challenges that have been previously used for PUF based DPR
machine learning attacks [58]. enabling/disabling, and disregards every old challenge used.
However, for challenge set size of ‘q’ in each authentication
attempt, with each challenge being ‘r’-bit, the probability of repeated
VI. M ULTI - PARTY AUTHENTICATION USING PUF challenges occurring termed as the “Failure Probability” is almost
An FPGA (F) is configured with ‘N’ XOR-PUFs each constituting zero with a typical value of q=1000 and r=64 [6].
of 10 or greater number of Arbiter PUFs. The number ‘N corresponds On applying the received challenges to the model Mi , the user
to the number of users in the network. Using secure dynamic partial produces the responses Rimp. The ‘q’ responses along with the
reconfiguration (DPR), more PUFs can be configured in the FPGA, user ID is concatenated to form a string, which is encoded with a
to permit any additional (dynamic) user. previously agreed scheme (forms a certificate CAi ), and is send to
We use Xilinx design tools and follow the approach discussed the file handler.
in [59] for developing partial bitstreams for reconfigurable PUFs. The file handler sends the received certificate to the SAC-FPGA
Reconfiguration is done dynamically over the network. Hardware for verification. The SAC FPGA decodes the ID and the responses
updates over the network might bring potential threats in the form of generated by the mathematical model of PUF Pi , residing with the
malicious hardware alterations [60], [61]. user Ui . The SAC FPGA also receives the challenge bits from the
We insist the usage of a secure partial reconfiguration over the file handler.
network to prevent any malicious alterations of the device using On applying the received challenges to the PUF Pi , the SAC FPGA
hardware trojan insertion. Secure IoT hardware updates can also be produces the responses Rif p .
done using an authentication protocol enabled by a PUF configured The verification stage finds the match between the two responses.
in the static partition of the device [6].
Fig. 3. Proposed multiparty session authentication framework: The system consists of a session handler, who is responsible for handling the request of
different users. The SAC-FPGA follows a secure authentication protocol to enable access to the various clouds. The FPGA used permits dynamic alteration of
users in the network using dynamic partial reconfiguration. A PUF security primitive implemented on the FPGA is the key element of the secure multiparty
authentication protocol.

Fig. 4. Arbiter PUF: With n-bit challenge and a single bit response. An arbiter
PUF compares two paths with an identical delay in design, where a random
process variation determines which path is faster. Based on the fastest path,
the arbiter outputs a 1-bit digital response.

Fig. 5. XOR Arbiter PUF with k constituent PUFs: Arbiter PUFs are
duplicated k-times to form an XOR Arbiter PUF. All the constituent arbiter
PUFs are given the same challenge bits. The challenge bits select a unique
delay path in determining the outcome of the arbiter. The multiple responses Fig. 6. FPGA fabric configured with PUFs: The FPGA fabric is divided into
produced are then XOR-ed to generate a 1-bit digital response. two regions- the static partition and the dynamic partition. The static partition
consists of PUFs which are configured before deployment and with a fixed
and unalterable design. New PUFs can be added to the dynamic partition as
they evolve with time using dynamic partial reconfiguration feature of the
B. Protocol-2 FPGA. This evolution aids in incorporating dynamic users into the network
by following a trusted multiparty authentication protocol.
The second part of the algorithm describes an evolving IoT
network. This protocol is to enable a new user to access an IoT
node after successful introduction by an existing user. A user U B,
Algorithm 1 User is a member of the cloud to be accessed Algorithm 2 User is not a member of the cloud to be accessed
Objective: Objective:
(a) The session Authority Cloud is an FPGA which verifies (a) The Session Authority Cloud is an FPGA which verifies
the identity of user (U A ) who is requesting access. the identity of user (U B ) who is requesting access.
(b) The FPGA provides session key for the genuine set of (b) The FPGA provides session key for the genuine set of
users (U i ). new users (Ui ).

Prerequisites Prerequisites
1) An n-bit input, 1-bit output XOR PUF P 1 is reconfigured 1) SAC FPGA has built-in controllers to facilitate secure
in the static partition of the SAC − F P GA. There exists dynamic partial reconfiguration.
a PUF for every authenticated user. PUF P 1 represents 2) FPGA fabric is divided into two parts, a) static fabric
the identity of the user. and b) dynamic fabric. Static fabric consists of PUF
2) Each user also has an identity number, ID. configurations which existed before deployment. They
3) A mathematical model M i of P i resides with each User. might be assigned to some set of genuine users in
4) F and user U i have agreed on a fixed encoding scheme the beginning. The dynamic fabric is dedicated to con-
E(.) and a decoding scheme D(.), such that for any figure additional security primitives (mostly PUFs) for
binary string x, E(.) and D(.) are injective, X = E(x) any genuine dynamic user using secure dynamic partial
and D(X) = x. reconfiguration.

Output A value in variable F lag to show that the session is Output A value in variable F lag to show that a session is
granted (F lag = 1) or denied (F lag = 0). granted (F lag = 1) or denied (F lag = 0).

Steps Steps
1: U i to File handler F : request Access to IoT cloud Cj 1: U B requesting introduction to U A to access the cloud C j
2: F to U i : Request for the identity number ID of the 2: U A to File handler F : request introduction of U B to cloud
user and responds to a set of challenges CH p . F sends q Cj
challenge bits each of length n to U i . 3: F to UA : Request for keys for authentication by sending a
3: U i calculates the following: Rimp = M i(CH p ), p = 1q, set of challenges CHp . There are ‘q’ challenge bits each
Rim = (Rim1 , Rim2 , Rim3 , Rimq ), CAi =E(IDi , Rim) of length ‘n’.
4: U i to F : U i sends the certificate CAi to F 4: U A calculates the following:
5: F generates a session ID for the IoT cloud access. a RAmp = M A(CHp), p = 1q
6: F to SAC − F P GA: F sends the set of challenges CH p b RAm = (RAm1, RAm2, RAm3, RAmq)
and CAi to the SAC − F P GA c CAA = E(IDA, RAm)
7: SAC − F P GA calculates the following 5: U A to U B U A sends the certificate CAA to U B
a (ID, Rim) = D(CAi ) 6: U B to F: E(IDB,IDA,CAA)
b Rif p = Pi (CH
Pq p ), p = 1qL 7: F to SAC-FPGA: F new user request IR, set of challenges
(Rimp Rif p
c Ni = (1 − (p=1)
) If N i ≥ 0.99, SAC − CHp and CAA to the SAC-FPGA
q
F P GA declares U i as an authenticated user. 8: SAC-FPGA calculates the following

8: SAC to IoT cloud. Flag indicating U i is authenticated a RAm = D.(CAA)

or not. Sends the SessionID and U serID to to the IoT b RAf p = P P A(CHp),
q
p =L1q
(RAmp RAf p
Cloud C j if authenticated. c NA = (1− (p=1) q ), If NA ≥ 0.99, SAC-
9: Cloud C j approves the decision to grand session for FPGA declares UA as an authenticated introducer and
authenticated user U i . F lag = 1 and exit. UB as a genuine user.
9: SAC FPGA configures new PUFs PB using secure dy-
namic partial reconfiguration in the dynamic part of the
FPGA.
requests an existing user, U A for an introduction to access a cloud, 10: SAC-FPGA to UB : sends PUF modelling parameters ‘m’
Ci. The user U B is known to U A as a trusted entity. The user
U A requests that the file handler introduces the new user. The file through secure channel
handler responds with a set of challenge bits. The user U A applies 11: UB constructs the mathematical model MB of the PUF
the challenge bits to its model and forms a certificate CA, which is PB from ‘m’
given to the user U B. User U B sends the certificate received from 12: Now UB is same as any other user. F lag = 1 and exit
U A, with its ID number to the file handler. The file handler verifies and follow protocol-1.
if user A is genuine by comparing the responses of the PUF model
and the physical PUF. If U A is successfully authenticated, the FPGA
declares U B to be trustworthy. This initiates a dynamic partial reconfiguration (DPR) process,
which adds configures a new PUF in the dynamic part of the FPGA [5] W. Lie and W. Feng-Yan, “Dynamic Partial Reconfiguration in FPGAs,”
fabric. We assume that a secure DPR process is followed. in 2009 Third International Symposium on Intelligent Information Tech-
The FPGA sends the modeling parameters to U B, through a secure nology Application, vol. 2. IEEE, 2009, pp. 445–448.
channel, enabling the mathematical modelling of the PUF. Now user [6] A. P. Johnson, R. S. Chakraborty, and D. Mukhopadhyay, “A PUF-
U B is same as any other existing user, and has to follow protocol 1 enabled Secure Architecture for FPGA-based IoT Applications,” IEEE
Transactions on Multi-Scale Computing Systems, vol. 1, no. 2, pp. 110–
to gain access to the IoT cloud.
122, 2015.
[7] Vivado Design Suite Tutorial–Partial Reconfiguration
VIII. C ONCLUSIONS AND F UTURE W ORK UG947 (v2018.3), Xilinx Inc, [Online]. Available:
Security has always been a concern for companies targeting the www.xilinx.com/support/documentation/sw manuals/xilinx2018 3/ug947-
IoT and its many applications, as well as the developers who need the vivado-partial-reconfiguration-tutorial.pdf, 2019, accessed: 2019-05-21.
resources to help ensure they can deliver products that will meet their [8] A. Sajid, H. Abbas, and K. Saleem, “cloud-assisted iot-based scada
systems security: A review of the state of the art and future challenges,”
customers’ requirements. With the use of cryptography in embedded
IEEE Access.
devices increasing, semiconductor manufacturers are seeing improved
[9] E. Trichina, M. Bucci, D. De Seta, and R. Luzzi, “Supplemental
demand with innovative solutions aimed at ensuring that IoT meets Cryptographic Hardware for Smart Cards,” IEEE micro, vol. 21, no. 6,
and probably exceeds their expectations. pp. 26–35, 2001.
This article has considered problems associated with reliable, [10] M. Canim, M. Kantarcioglu, and B. Malin, “Secure Management of
timely and secure data transfer mechanisms necessary for shared Biomedical Data with Cryptographic Hardware,” IEEE Transactions on
business data processing networks. Information Technology in Biomedicine, vol. 16, no. 1, pp. 166–175,
This multiparty authentication system for dynamic authentication 2011.
interactions is effective when members of different security realms [11] T. W. Arnold, C. Buscaglia, F. Chan, V. Condorelli, J. Dayka,
want to access distributed business data micro services [62] through W. Santiago-Fernandez, N. Hadzic, M. D. Hocker, M. Jordan, T. Morris
a trusted principal. et al., “IBM 4765 Cryptographic Coprocessor,” IBM Journal of Research
Our proposed mechanism can help cloud session users authenticate and Development, vol. 56, no. 1.2, pp. 10–1, 2012.
their session membership so as to largely simplify the authentication [12] G. E. Suh and S. Devadas, “Physical Unclonable Functions for Device
Authentication and Secret Key Generation,” in 2007 44th ACM/IEEE
processes within multi-party sessions. Design Automation Conference. IEEE, 2007, pp. 9–14.
While this paper has presented the framework, additional research [13] C. Herder, M.-D. Yu, F. Koushanfar, and S. Devadas, “Physical Unclon-
and development will develop a set of protocols for multi-party able Functions and Applications: A Tutorial,” Proceedings of the IEEE,
session management and cross-realm authentication for dynamic au- vol. 102, no. 8, pp. 1126–1141, 2014.
thentication interactions, between users and data services in multiple [14] D. Mukhopadhyay, “PUFs as Promising Tools for Security in Internet
cloud systems located in different security realms. of Things,” IEEE Design & Test, vol. 33, no. 3, pp. 103–115, 2016.
The scenario of multiparty authentication across security realms is [15] H. Al-Aqrabi, L. Liu, R. Hill, L. Cui, and J. Li, “Faceted Search in
not limited to business processes that require access to data services. Business Intelligence on the Cloud,” in 2013 IEEE International Con-
Internet of Things (IoT) architectures are a contemporary example of ference on Green Computing and Communications and IEEE Internet of
a need to be able to model, comprehend and deploy authentication Things and IEEE Cyber, Physical and Social Computing. IEEE, 2013,
mechanisms that can securely tolerate myriad network nodes that pp. 842–849.
each provide more cohesive services [2]. [16] P. Sundararajan, “High Performance Computing using FPGAs,” Xilinx
white paper: FPGAs, pp. 1–15, 2010.
We are now progressing the work in two ways.
[17] C. De Schryver, FPGA Based Accelerators for Financial Applications.
First, we are formally evaluating the authentication protocols in Springer, 2015.
order to robustly deploy the framework to an environment that is [18] M. A. H. Dempster, J. Kanniainen, J. Keane, and E. Vynckier, High-
composed of a mixed set of discrete devices, enabling the framework Performance Computing in Finance: Problems, Methods, and Solutions.
to be tolerant of existing and emerging technologies for cloud CRC Press, 2018.
platforms and network infrastructures. [19] T. Wollinger and C. Paar, “How Secure are FPGAs in Cryptographic
Second, we are now including a variety of devices in addition Applications?” in International Conference on Field Programmable
to clouds within the simulation, to better understand the effects Logic and Applications. Springer, 2003, pp. 91–100.
upon network performance when greater numbers of low powered [20] R. S. Chakraborty, S. Narasimhan, and S. Bhunia, “Hardware Trojan:
computing and storage wireless nodes are introduced [63]. Threats and Emerging Solutions,” in 2009 IEEE International high level
This replicates the emerging IoT and Industrial IoT scenarios design validation and test workshop. IEEE, 2009, pp. 166–171.
where extensive integration of Wireless Sensor Networks and edge [21] A. P. Johnson, S. Saha, R. S. Chakraborty, D. Mukhopadhyay, and
computing nodes is commonplace. S. Gören, “Fault Attack on AES via Hardware Trojan Insertion by Dy-
namic Partial Reconfiguration of FPGA over Ethernet,” in Proceedings
of the 9th Workshop on Embedded Systems Security. ACM, 2014, p. 1.
ACKNOWLEDGMENT [22] H. Liu, H. Ning, Q. Xiong, and L. T. Yang, “Shared Authority based
This work has been supported by the Centre for Industrial Ana- Privacy-preserving Authentication Protocol in Cloud Computing,” IEEE
lytics (CIndA) at the University of Huddersfield, UK. Transactions on parallel and distributed systems, vol. 26, no. 1, pp.
241–251, 2014.
R EFERENCES [23] H. Al Aqrabi, L. Liu, R. Hill, and N. Antonopoulos, “A Multi-
layer Hierarchical Inter-Cloud Connectivity Model for Sequential Packet
[1] A. J. Jara, M. A. Zamora-Izquierdo, and A. F. Skarmeta, “Intercon- Inspection of Tenant Sessions Accessing BI as a Service,” in 2014 IEEE
nection Framework for mHealth and Remote Monitoring Based on the Intl Conf on High Performance Computing and Communications, 2014
Internet of Things,” IEEE Journal on Selected Areas in Communications, IEEE 6th Intl Symp on Cyberspace Safety and Security, 2014 IEEE 11th
vol. 31, no. 9, pp. 47–65, 2013. Intl Conf on Embedded Software and Syst (HPCC, CSS, ICESS). IEEE,
[2] A. Ikram, A. A., and N. L. L. S. S. Hill, R.and Antonopoulos, 2014, pp. 498–505.
“Approaching things (IoT): a Modelling, Analysis and Abstraction [24] K.-K. R. Choo, O. F. Rana, and M. Rajarajan, “Cloud Security Engi-
Framework,” Concurrency and Computation: Practice and Experience, neering: Theory, Practice and Future Research,” IEEE Transactions on
pp. 1966–1984, 2015. Cloud Computing, vol. 5, no. 3, pp. 372–374, 2017.
[3] M. Chui, M. Löffler, and R. Roberts, “The Internet of Things,” 2010. [25] G. Ateniese, M. Steiner, and G. Tsudik, “New Multiparty Authentication
[4] K. Hwang and M. Chen, Big-data Analytics for Cloud, IoT and Cognitive Services and Key Agreement Protocols,” IEEE journal on selected areas
Computing. John Wiley & Sons, 2017. in communications, vol. 18, no. 4, pp. 628–639, 2000.
[26] J. Katz and M. Yung, “Scalable Protocols for Authenticated Group national Conference on Signal Processing, Communication, Power and
Key Exchange,” in Advances in Cryptology - CRYPTO 2003. Berlin, Embedded System (SCOPES), Oct 2016, pp. 1192–1196.
Heidelberg: Springer Berlin Heidelberg, 2003, pp. 110–125. [46] J. Li, B. Li, T. Wo, C. Hu, J. Huai, L. Liu, and K. Lam, “CyberGuarder:
[27] Y. Rahulamathavan, R. C.-W. Phan, S. Veluru, K. Cumanan, and A Virtualization Security Assurance Architecture for Green Cloud
M. Rajarajan, “Privacy-preserving Multi-class Support Vector Machine Computing,” Future Generation Computer Systems, vol. 28, no. 2, pp.
for Outsourcing the Data Classification in Cloud,” IEEE Transactions on 379 – 390, 2012.
Dependable and Secure Computing, vol. 11, no. 5, pp. 467–479, 2013. [47] H. Al-Aqrabi, L. Liu, R. Hill, and N. Antonopoulos, “Cloud bi: Future
[28] E.-J. Yoon and K.-Y. Yoo, “New Authentication Scheme based on a One- of business intelligence in the cloud,” Journal of Computer and System
way Hash Function and Diffie-Hellman Key Exchange,” in International Sciences, vol. 81, no. 1, pp. 85 – 96, 2015.
Conference on Cryptology and Network Security. Springer, 2005, pp. [48] M. Burrows, M. Abadi, and R. Needham, “A Logic of Authentication,”
147–160. ACM Trans. Comput. Syst., vol. 8, no. 1, pp. 18–36, Feb. 1990.
[29] D. Thilakanathan, S. Chen, S. Nepal, and R. A. Calvo, “Secure Data [49] C.-Y. Chen and J.-F. Tu, “A Novel Cloud Computing Algorithm of
Sharing in the Cloud,” in Security, Privacy and Trust in Cloud Systems. Security and Privacy,” Mathematical Problems in Engineering, pp. 1–6,
Springer, 2014, pp. 45–72. 2013.
[30] W. Song, H. Zou, H. Liu, and J. Chen, “A Practical Group Key [50] S. Pippal, V. Sharma, S. Mishra, and D. S. Kushwaha, “An Efficient
Management Algorithm for Cloud Data Sharing with Dynamic Group,” Schema Shared Approach for Cloud Based Multitenant Database with
China Communications, vol. 13, no. 6, pp. 205–216, 2016. Authentication and Authorization Framework,” in 2011 International
[31] P. K. Arya, K. Selvamani, S. Kanimozhi, and A. Kannan, “Data Sharing Conference on P2P, Parallel, Grid, Cloud and Internet Computing, Oct
for Dynamic Group in the Cloud Environment by using Group Signature 2011, pp. 213–218.
Approach,” 2013.
[51] H. Li, Y. Dai, L. Tian, and H. Yang, “Identity-Based Authentication
[32] A. Celesti, F. Tusa, M. Villari, and A. Puliafito, “Security and Cloud
for Cloud Computing,” in IEEE International Conference on Cloud
Computing: Intercloud Identity Management Infrastructure,” in 2010
Computing. Springer, Berlin, Heidelberg, 2009, pp. 157–166.
19th IEEE International Workshops on Enabling Technologies: Infras-
tructures for Collaborative Enterprises. IEEE, 2010, pp. 263–265. [52] H. Li, Y. Dai, and B. Yang, Identity-Based Cryptography for
[33] D. Georgakopoulos, M. Hornick, and A. Sheth, “An Overview of Work- Cloud Security, University of Electronic Science and Technology
flow Management: From Process Modeling to Workflow Automation of China and University of Tennessee, USA, [Online]. Available:
Infrastructure,” Distributed and parallel Databases, vol. 3, no. 2, pp. https://eprint.iacr.org/2011/169.pdf, 2019, accessed: 2019-05-21.
119–153, 1995. [53] B. Qin, H. Wang, Q. Wu, J. Liu, and J. Domingo-Ferrer, “Simultaneous
[34] H. Al-Aqrabi and R. Hill, “Dynamic Multiparty Authentication of Authentication and Secrecy in Identity-based Data Upload to Cloud,”
Data Analytics Services Within Cloud Environments,” in 2018 IEEE Cluster Computing, vol. 16, no. 4, pp. 845–859, Dec. 2013.
20th International Conference on High Performance Computing and [54] S. Sotiriadis, N. Bessis, N. Antonopoulos, and R. Hill, “Meta-scheduling
Communications; IEEE 16th International Conference on Smart City; Algorithms for Managing Inter-cloud Interoperability,” Int. J. High
IEEE 4th International Conference on Data Science and Systems Perform. Comput. Netw., vol. 7, no. 3, pp. 156–172, Sep. 2013.
(HPCC/SmartCity/DSS), June 2018, pp. 742–749. [55] M. Majzoobi, M. Rostami, F. Koushanfar, D. S. Wallach, and S. Devadas,
[35] J. D. Clercq, “Single Sign-On Architectures,” in Proceedings of the “Slender PUF Protocol: A Lightweight, Robust, and Secure Authentica-
International Conference on Infrastructure Security, ser. InfraSec ’02. tion by Substring Matching,” in 2012 IEEE Symposium on Security and
London, UK, UK: Springer-Verlag, 2002, pp. 40–58. Privacy Workshops, May 2012, pp. 33–44.
[36] C. Baker, A. Anjum, R. Hill, N. Bessis, and S. L. Kiani, “Improving [56] M. Barbareschi, P. Bagnasco, and A. Mazzeo, “Authenticating IoT
Cloud Datacentre Scalability, Agility and Performance Using Open- Devices with Physically Unclonable Functions Models,” in 2015 10th
Flow,” in 2012 Fourth International Conference on Intelligent Network- International Conference on P2P, Parallel, Grid, Cloud and Internet
ing and Collaborative Systems, Sep. 2012, pp. 20–27. Computing (3PGCIC), Nov 2015, pp. 563–567.
[37] M. U. Yaseen, A. Anjum, O. Rana, and R. Hill, “Cloud-based Scalable [57] U. Rhrmair, J. Slter, F. Sehnke, X. Xu, A. Mahmoud, V. Stoyanova,
Object Detection and Classification in Video Streams,” Future Gener. G. Dror, J. Schmidhuber, W. Burleson, and S. Devadas, “PUF Mod-
Comput. Syst., vol. 80, no. C, pp. 286–298, Mar. 2018. eling Attacks on Simulated and Silicon Data,” IEEE Transactions on
[38] S. Hada and H. Maruyama, “Session Authentication Protocol for Web Information Forensics and Security, vol. 8, no. 11, pp. 1876–1891, Nov
Services,” in Proceedings 2002 Symposium on Applications and the 2013.
Internet (SAINT) Workshops, Jan 2002, pp. 158–165. [58] J. Tobisch and G. T. Becker, “On the scaling of machine learning attacks
[39] R. Roman, P. Najera, and J. Lopez, “Securing Things,” Computer, on pufs with application to noise bifurcation,” in Revised Selected Papers
vol. 44, no. 9, pp. 51–58, Sep. 2011. of the 11th International Workshop on Radio Frequency Identification
[40] H. Al-Aqrabi, L. Liu, R. Hill, Z. Ding, and N. Antonopoulos, “Business - Volume 9440, ser. RFIDsec 2015. Springer-Verlag New York, Inc.,
intelligence security on the clouds: Challenges, solutions and future 2015, pp. 17–31.
directions,” in 2013 IEEE Seventh International Symposium on Service- [59] S. Gren, O. Ozkurt, Y. Turk, A. Yildiz, and H. F. Ugurdag, “enabling
Oriented System Engineering, March 2013, pp. 137–144. difference-based dynamic partial self reconfiguration for large differ-
[41] A. Kanuparthi, R. Karri, and S. Addepalli, “Hardware and embedded ences,” in 2013 8th IEEE Design and Test Symposium.
security in the context of internet of things,” in Proceedings of the 2013
[60] A. P. Johnson, R. S. Chakraborty, and D. Mukhopadhyay, “A PUF-
ACM Workshop on Security, Privacy & Dependability for Cyber
Enabled Secure Architecture for FPGA-Based IoT Applications,” IEEE
Vehicles, ser. CyCAR ’13. ACM, 2013, pp. 61–64.
Transactions on Multi-Scale Computing Systems, vol. 1, no. 2, pp. 110–
[42] “Gartner Says 8.4 Billion Connected ”Things” Will Be in Use in
122, April 2015.
2017, Up 31 Percent From 2016,” [Online]. Available:https: //www.
gartner.com/en/newsroom/press-releases/2017-02-07-gartner-says-8- [61] A. P. Johnson, S. Patranabis, R. S. Chakraborty, and D. Mukhopadhyay,
billion-connected-things-will-be-in-use-in-2017-up-31-percent-from- “Remote Dynamic Partial Reconfiguration: A Threat to Internet-of-
2016, Feb 2017, accessed: 2019-05-23. Things and Embedded Security Applications,” Microprocessors and
[43] A. Celesti, F. Tusa, M. Villari, and A. Puliafito, “Security and Cloud Microsystems, vol. 52, pp. 131 – 144, 2017.
Computing: InterCloud Identity Management Infrastructure,” in 2010 [62] D. Shadija, M. Rezai, and R. Hill, “Towards an Understanding of
19th IEEE International Workshops on Enabling Technologies: Infras- Microservices,” in 2017 23rd International Conference on Automation
tructures for Collaborative Enterprises, June 2010, pp. 263–265. and Computing (ICAC), Sep. 2017, pp. 1–6.
[44] R. Sharma and B. Joshi, “H-IBE: Hybrid-identity based Encryption [63] J. M. Garca-Campos, D. G. Reina, S. L. Toral, N. Bessis, F. Barrero,
Approach for Cloud Security with Outsourced Revocation,” in Inter- E. Asimakopoulou, and R. Hill, “Performance Evaluation of Reactive
[45] C. Schridde, T. Drnemann, E. Juhnke, B. Freisleben, and M. Smith, Routing Protocols for VANETs in Urban Scenarios Following Good
“An identity-based security infrastructure for cloud environments,” in Simulation Practices,” in 2015 9th International Conference on Innova-
2010 IEEE International Conference on Wireless Communications, tive Mobile and Internet Services in Ubiquitous Computing, July 2015,
Networking and Information Security. pp. 1–8.