2022 Fourth International Conference on Emerging Research in Electronics, Computer Science and Technology (ICERECT)

Development of Secured Authentication Contract

Communication Network Protocol for IoT
2022 Fourth International Conference on Emerging Research in Electronics, Computer Science and Technology (ICERECT) | 978-1-6654-5635-7/22/$31.00 ©2022 IEEE | DOI: 10.1109/ICERECT56837.2022.10060005

Environment
Mahdi Mohammad Abdullah Al Momani P S Puttaswamy
Research Scholar, PET Research Center PET Research Center
Mandya, Karnataka, India PESCE, Mandya
[email protected] Karnataka, India

Authentication, authorization, data confidentiality, and

ABSTRACT- Internet of Things (IoT) is a subject of great privacy are some of the significant security problems
interest and is the current technology. For the last few years,
associated with IoT. While smart phones are now
IoT application has increased many folds. In addition,
systems security has been a wonderful field for research commonplace, other smart devices are still in their infancy
activities. The mutual authentication between the IoT devices but use is growing all the time and there are now an
and Users of the IoT Environment is a significant part of estimated 6.4 billion “things” connected to the Internet. A
secure IoT systems. At present the widely used 30% increase from 2015. In 2020, this number is expected
authentication mechanisms are Single password based and to grow to a staggering 20.8 billion. Smart devices are
are likely vulnerable to side-channel and dictionary attacks. intended to make our lives easier and more convenient,
This paper introduces a multi-key-based mutual For example home automation systems allow homeowners
authentication mechanism to provide a contract for secure to turn up the thermostat on their way home from work in
authentication and communication between the IoT devices
the winter, or be alerted immediately of a suspected home
and Users of the IoT Environment. It also deals with publish-
subscribe-based Message Queuing Telemetry Transport intrusion while they’re out. Every piece of hardware and
(MQTT) protocol is used for secure communication, which is software that you use and is connected to the internet has
bandwidth-efficient and uses a small amount of battery the potential to be accessed by cybercriminals. With the
power. The blockchain technology is used in the present introduction of each new device, the number of potential
work to store data helps to bring trust and transparency to access points for hackers grows.
the developed model. The implementation of this entire
methodology, the authors has created a prototype using
Node MCU ESP8266 and Arduino IDE IoT platform for IoT
IT Environment, its advantages, and threats need to
Environment. To have secured communication via the cloud mitigate: IoT servers and devices can be hacked
has been designed for the client to control IoT devices, and remotely by malicious actors and unauthorized parties
the same will be stored using blockchain technology for who might attempt to find their way into the device
future data validation. The Node MCU ESP8266 IoT using a connection. If IoT devices could have been
platform used in the present work makes effective and fast configured more securely to allow for communication
IoT applications. to take place only with authorized servers, the outside
communication attempts could have been ignored. The
General Terms: IoT, Security, Blockchain number of attacks targeting IoT servers and devices has
continued to seen increase every year many folds.
Keywords: IoT Device, Users of IoT Environment, Message Thus, as these devices are being integrated into
Queuing Telemetry Transport (MQTT) protocol, Adler-32 corporate networks, special attention should be
redirected to the essence of security [2]. The powerful
I. INTRODUCTION and efficient cryptographic solution should be utilized
because it can assist with the standardization of secure
The IoT has become a rising subject in the recent past. It lines of communication between different devices and
can be defined as connecting the devices or things over the machines. It is also a tough decision to select the most
internet to convey a given function. This is primarily a appropriate authentication model to get the job done
device that either sends or collects information. In the before choosing the architecture model ideal for IoT
globe of the IoT, billions of devices are linked to the authentication. First, it is essential to consider a wide
internet, giving an attacker a chance to control the IoT range of factors that include which are not limited to
system on a huge scale. Due to the entryof super- cheap connectivity, security requirements, security expertise,
computer chips and the universality of wireless systems, it financial budgets, hardware capacity, and energy
is possible to turn anything where something little as a pill recourses. Therefore, the various models are able to
to something as large as an airplane, to form a part of the address the authentication problem related to IoT
IoT [1]. IoT is the fabric of the globe around us to be more servers and devices.
brilliant and more reactive, blending the digital and
physical universes. It is possible to transform any physical The use of security keys capable to make secure the
object into an IoT device and it can be connected to the IoT devices against cyber attacks which is considered in
internet, controlled, or want to communicate the data.

978-1-6654-5635-7/22/$31.00 ©2022 IEEE

Authorized licensed use limited to: VIT University. Downloaded on February 18,2025 at 14:27:34 UTC from IEEE Xplore. Restrictions apply.
this present work against those attacks, and the attacks Environment: (i) Authentication; (ii) Contract; (iii)
includes Network attacks, web attacks, malware attacks Communication.
Need of Mitigation: It is found that IoT networks are
also vulnerable to attacks; hence they need to mitigate as The following section shows the steps followed in each
far as possible. This includes the following implementation one of these phase implementation, and these phases are
methodology with the requirement as mentioned below. pictorially represented.
Security: The proposed security key should protect
users against man-in-the-middle attacks, phishing, etc.

Privacy: The Blockchain adoption helps the implemented

storage of data to prevent any tracking.

Easy Authentication and Registration process for User.

The detailed design captures cryptographic primitives, a
test of user presence, client data, device attestation,
authentication, and registration is essential. The most
important aspects will be registration and authentication, as Fig. 1. Proposed Secured Authentication Mechanism
shown in this article.
Hardware performance is found to be better, and this is Authentication Phase involves the following:
performed through the MQTT protocol.
(i) To configure User device and user profile
Hardware cost: The security developed must be cost- management
effective [3].
(ii) Data security key generation
I. LITERATURE SURVEY
(iii) Distribution and mapping of the user profile
Many approaches have been proposed by the with keys
researchers using a secure authentication protocol to
authenticate the IoT device and the server [4]. The existing (iv) Accept user request
authentication mechanisms are primarily based on single (v) Get secret key (Sk) from Secure Vault for the
passwords and are exposed to dictionary and side-channel User (U), represented as USk
attacks. A multi-key authentication mechanism has been
designed, and token values will change over time, avoiding Secure Vault: The secure vault contains n keys, each
dictionary attacks. Kalra S and Sood S. K [5] introduced being m bits long. The value of m is the key size. We
the IoT authentication and key agreement scheme. Even denote all the keys as K[0], K[1], K[2],…..K[n-1]. During
though the authors' method uses the elliptic curve the time of deployment of the IoT device, the secure vault
cryptography to improve security, it has two security is shared between the IoT device and the server. On the
issues and they are the mistiness of the session key and the IoT device, the secure vault should be stored in an
failure of mutual authentication. encrypted format. On the server, secure vaults are stored in
a secure database. Using the secure vault generates the
The framework to design a security protocol for the secret key for the User (U)=Usk
IoT was proposed [6]. The present research work provides
the information about the security protocol's structure, (vi) Encrypt using a key to generate Secure key
philosophy, and communication involved in the approach. Eusk
This mechanism has been implemented on the Sensible
(vii) Share Secure key to User Eusk
Things platform and expected to provide the secure
communication for the devices connected to the IoT. (viii) User should Decrypt EUsk to identify
the key and return back Dusk
Randa Almadhoun et al. [7] presented the user
authentication scheme using blockchain-enabled fog Validate EUsk= DUsk, and identify the User as a valid
nodes. In this technique, users are authenticated to access user to create a contract.
IoT devices by fog nodes interface to Ethereum contracts.
The fog nodes are used to deliver scalability to the system Contract Phase deals with the following:
by relieving the IoT devices from carrying out heavy (i) Contract phase is a session key (SKn)
computation involving tasks related to authentication and generation for valid user post-authentication
communicating with the Blockchain. Additionally, the phase.
blockchain technology adopted is a technology capable of
giving secure authentication, management, and admittance (ii) The Server should distribute SKn for User and
to IoT devices and their information. IoT environment for any further transaction.
Each session key (SKn) has been assigned with timeout for
II. SCHEMATIC-SECURED
the contract and expired automatically based on timeout.
AUTHENTICATION SYSTEM
The proposed secured authentication communication
network proposed for IoT environment is shown above in
Fig. 1. The implementation involves the following
methodology to develop a secure platform for IoT

Authorized licensed use limited to: VIT University. Downloaded on February 18,2025 at 14:27:34 UTC from IEEE Xplore. Restrictions apply.
 Communication Phase involves the following functions: subscribes technique. Publishing messages and
subscribing to topics or "pub/sub" is the principle on
(i) Incorporate the User request is always attached with Skn which the MQTT protocol is built. Many clients link to
for any transaction. a broker and subscribe to the topics which they are
(ii) Provide Secure communication via cloud for the client to concerned. Same topics can be used to subscribe for
control IoT devices and the same will be stored using many clients, and where the clients can access the data
blockchain technology for future data validation. as they received. The MQTT protocol and a broker act
as a simple and common interface for everything to link
The cloud created for the client is used to control IoT device to. The default port for MQTT is 1883, registered for
[8,9,10]. secure MQTT. In the proposed work, the
Blockchain: Blockchain is a form of distributed storage system implementation of the MQTT protocol between the user
that stores the chronological sequence of transactions in a tamper- and IoT device is for the message exchange.
evident manner. In Blockchain, each node has the same order of data HiveMQ is one of the MQTT brokers. It is a service
which is immutable. Since Blockchain is a form of distributed storage, provider which uses the MQTT protocol for efficient
it uses a consensus algorithm to maintain consistency of data data exchange between the user and IoT Environment.
amongthe nodes. Due to its decentralized, immutability nature, In the present implementation have integrated the
Blockchain becomes a promising technology for untrusted peer to HiveMQ and MQTT broker into the proposed
peer network. Currently, there are various Blockchain platforms in the system[14]. In this case, the communication phase
market of Bitcoin, Ethereum, Bigchaindb, Hyperledger are some should be active until Session Key expires.
examples. There are some of the Blockchains which are mostly used
for electronic currencies such as Bitcoin [11,12].The Ethereum and
Hyperledger go beyond crypto-currency to support different kind of
transaction storage models that are related to other forms of business
or e-commerce activities [13]. However, these platform are having
slack high throughput and the immediate concern for the research
community is to improve the throughput. The present work uses
Ethereum for the process of storing and data validation.
Adler-32 Algorithm: Hash is created for each entry in the
Blockchain ledger. To create a hash, the present work used the Adler-
32 algorithm. It is a popular checksum algorithm designed to detect
corruption in the data. Since it is faster than the other checksum
algorithms, Adler-32 is chosen for the current work. If the
uncompressed information does not match the Adler-32 checksum, Fig. 2. Main Menu
the application can notify through its protocol or detects the handler
that the information is corrupted. To get an Adler-32 checksum, we
must calculate the two 16-bit checksums, P and Q, and add their bits
to form a 32-bit integer. P is the aggregate of all bytes in the stream in
addition, and Q is the aggregate of the individual P values from each
phase. At the start of an Adler-32 run, P is set to 1, Q to 0. The sum
done is the modulo Pn (the highest prime number). The bytes are
stored in network in order, where Q occupies the two most significant
bytes.

Fig. 3. Main Menu of Client

Where Z is the string of bytes for which the checksum is

calculated, Pn is the highest prime number, and n is the length
of Z. The MQTT protocol is used for communication between
the IoT device and the Users of the IoT Environment.
Fig. 4. User Request Form
Message Queuing Telemetry Transport Protocol: The
MQTT is a messaging protocol based on the published

Authorized licensed use limited to: VIT University. Downloaded on February 18,2025 at 14:27:34 UTC from IEEE Xplore. Restrictions apply.
Fig. 5. Approval Process

Fig. 9. Request to Control

Fig. 6. Check Status

Fig. 10. IOT Control Screen

The various stages of implementation of the methodology

chosen is represented with various snapshots from Fig 2 to 10
as seen.
Fig.2 describes the Introduction Screen for the Main Menu
of the Internet of Things. The Internet of Things (IOT) is the
network of physical objects or "things" embedded with
Fig. 7. Certificate Download electronics, software, sensors, and network connectivity, which
enables these objects to collect and exchange data.
Fig. 3 describes Client Main Menu form which contains
options like registration, check status, send request and exit.
These options can be used to process the particular operations.
Initially Registration is the first process used in user screen.
Sequentially remaining operations will be processed.
Fig. 4 describes the User Registration Request Form
containing attributes (username, Mac ID, IP address, machine
name and date time) and Radio buttons (send request and
close). The user information is auto fetched from the system
Fig. 8. Certificate Manager and sends the request to the admin. The message will be
displayed as “Your request submitted successfully, please wait
until approved”, and can close the form.
Fig. 5 describes the Main Menu for Approval Process. The
attributes of the user process which are auto filled are displayed
in the screen. The approval process consists of two options
such as process request and delete request. The request can be
processed otherwise it can be deleted. The delete request is
used when the public common IP is used.

Authorized licensed use limited to: VIT University. Downloaded on February 18,2025 at 14:27:34 UTC from IEEE Xplore. Restrictions apply.
 Fig. 6 describes the User Check Status Form. The user has already The server selects a unique a random number Ri for
requested and to know the status of user request the above screen is every device and generates a cookie CK = H(Ri | X |
used. It has an option called as “Click following image to check EXP_TIME | IDi) where X is the private key of the server
status”. If the request is approved then the message will be displayed and stores the cookie on the embedded device 2 as ECC
as “Download Certificate” or if the request is not approved then the point CK‟= CK × G. The server also calculates the security
message will be as “Not Approved”. parameters Ti = RiH(X), Ai = H(Ri H(X)  Pi CK‟)
and stores Ai ‟ 272 = H(Ri H(X)
Fig. 7 describes Certificate Download Form with a download
option. The downloaded certificate will be in the form of cipher text Pi CK‟) × G, Ti corresponding to the identity IDi of
and the message will be displayed as “Private Key Downloaded the device Di in its database. The server itself stores the
Successfully”. expiration time of the cookie EXP_TIME corresponding to
a particular embedded device’s identity. When the cookie
Fig. 8 describes Service Manager Interface. The only two options expires, the expiration time is updated to EXP_TIME‟ and
are start and stop service. When the service starts it will be always cookie is updates as CK = H(Ri | X | EXP_TIME‟ | IDi).
running on back ground and waits for any request to come from
client. Server -> Embedded Device Di: Before every login, the
device selects a random number N1 and calculates an ECC
Fig.9 describes Control Request Form. When the control request point P1= N1 × G and stores it in its memory. Embedded
is clicked internally the request is submitted, the request will be Device Calculates ECC point P1 In order to login with the
handled by service manager. The request will be accepted by server cloud server, the device calculates the ECC point P2=
and generates all certificate matching and checks whether approved or H(N1×CK‟) sends the P1, P2 and its IDi to the server.
not. Once everything is done an OTP is generated and also it is Embedded Device  Server: IDi, P1, P2 The code developed
examined in background. When the user check the status of his/her for this purpose presented below is the user authentication
request a session key is generated with Request Id to control the IOT function for IoT devices[16].
device.
Fig. 10 describes Environment Control Panel. When the admin
grant the permission to access the IOT the control screen will be
displayed. Turn On the button and send command to the IOT
Environment then the message is displayed as “Command Submitted
Successfully” and the LED light will be On in the model.
The Node MCU IoT platform for IoT Environment is developed.
The Node MCU IoT platform is used for making effectual and fast
IoT applications. The goal is to provide a secure authentication,
contract and communication for IoT Environment. We have used the
Node MCU platform to create a IoT application.
Authentication process: Before the user registration process the
admin as to login to permit the user for further communication and the
steps are explained below.
Admin login: Admins are the entities responsible for managing
the user access control list and permissions for IoT devices. The main Fig. 11. User authentication function for IoT devices
task of the admin is to manage the registration and de- registration of The template developed for registration is shown in the
IoT devices and nodes in the system. Furthermore, admin give form of a snapshot. Here User Requests for Registration. The
permission to the end users to access IoT devices. Request form contains attributes such as Username, IP
address, Mac ID, Machine name, Date, and time. The user
Cloud: The cloud hosts compute and storage servers which information is auto-fetched from the system, and the
aggregate and store IoT data. The data can be then subjected to administrator sends a request for verification once it is
heavy processing and analytics by the cloud servers confirmed [17,18,19].
Registration Phase: The steps involved in this phase are The IoT Environment Control Panel is pictorially shown
explained below. in the above image. The control screen will be displayed when
In order to register with the cloud server S, the embedded the admin grants permission to access the IoT device. Turn
device Di sends a unique IDi to the server. On receiving this On the button and send the command to the IoT Environment,
request, the cloud server generates a unique password Pi for every then, the message is displayed as "Command Submitted
device Di as given below Successfully," and the LED light will be On in the model to
confirm the process validation.
Embedded Device Di Server S: IDi 268, Server S generates
Pi III. COMPARISON OF MQTT PROTOCOL WITH
HTTP PROTOCOL
Authentication Phase: In this phase, the embedded device and
cloud server mutually authenticate each other using ECC For better understanding and validation comparative
parameters [15]. studies are also presented below. The table 1 shown below the
tabulated values obtained by comparing the performance

Authorized licensed use limited to: VIT University. Downloaded on February 18,2025 at 14:27:34 UTC from IEEE Xplore. Restrictions apply.
parameters of the MQTT protocol with the HTTP protocol in terms technology for future data validation. The proposed system
of average time taken in seconds in order to validate the is implemented and tested to ensure Secure IoT
methodology considered in the present work. communication between the user and IoT device using
For this purpose the experiment was performed for 1000 authentication, Contract, communication, and data
messages, and the average time has been evaluated and the same is validation. The average response time with respect to the
presented in the table. The MQTT and HTTP protocols have taken number of users increases marginally where it highlights
5.9 and 115.6 seconds, respectively. It is found that the MQTT the advantage of the proposed implementation.
protocol is faster than HTTP because of the short message header
and 2 bytes of packet message size. REFERENCES
[1] I.J. Computer Network and Information Security, 2, 29-38 Published
Online April 2021 in MECS (http://www.mecs-press.org/) DOI:
10.5815/ijcnis.2021.02.03
TABLE I THE PROPOSED SYSTEM'S AVERAGE RESPONSE TIME VS. NO.
OF USERS IS ALSO PRESENTED FOR BETTER CLARITY OF THE
[2] Hien Thi Thu Truong, Miguel Almeida, Ghassan Karame and Claudio
IMPLEMENTATION
Soriente, "Towards Secure and Decentralized Sharing of IoT Data," In
Proceedings of IEEE International Conference, Atlanta, GA, USA, pp.
176-183, 2019.
1000 Messages Average Time in
Seconds [3] C.M. Chen, X. Deng, W. Gan, J. Chen, and S. H. Islam, “A secure
blockchain-based group key agreement protocol for IoT,” The Journal
MQTT (1 publish- subscribe 5.9 of Supercomputing, vol. 77, pp. 1–23, 2021.
per message) [4] Trusit Shah and S. Venkatesan, "Authentication of IoT Device and IoT
Server Using Secure Vaults," In Proceedings of 17th IEEE
HTTP (1 POST-GET per 115.6
International Conference, New York, USA, pp. 819-824, 2018.
message)
[5] Kalra S and Sood S. K, "Secure Authentication Scheme for IoT and
Cloud Servers," Journal of Pervasive and Mobile Computing,
Elsevier Publications, Vol. 24, pp. 210-233, 2015.
[6] Shapna Muralidharan and Heedong Ko, "An Inter Planetary File
System (IPFS) based IoT framework," In Proceedings of IEEE
International Conference, Las Vegas, NV, USA, USA, pp. 1-2, 2018.
[7] Sarada Prasad Gochhayat, Eranga Bandara, Sachin Shetty, and Peter
Foytik, "Blockchain-based Encrypted Cloud Storage for IoT Data,” In
Proceedings of IEEE International Conference, Atlanta, GA, USA, pp.
483- 489, 2019.
[8] Amazon.com, “Amazon Elastic Compute Cloud”.
URL http://aws.amazon.com/ec2/.
[9] Amazon.com. “Amazon Elastic Block Store”.
URL http://aws.amazon.com/ebs/.
[10] Microsoft Windows Azure Platform.
URL http://www.microsoft.com/azure/default.mspx.
[11] L. McRae, K. Ellis, and M. Kent, “Internet of things (IoT): education
and technology,” Relatsh. between Educ. Technol. students with
Disabil. Leanne, Res, pp. 1–37, 2018.
[12] S. A. Chaudhry, J. Nebhen, K. Yahya, and F. Al- Turjman, “A privacy
enhanced authentication scheme for securing smart grid infrastructure,”
IEEE Transactions on Industrial Informatics, 2021.
[13] B. A. Alzahrani and K. Mahmood, “Provable privacy preserving
authentication solution for internet of things environment,” IEEE
Fig. 12. Average Response Time Vs. No. Of Users Access, vol. 9, 2021. https://github.com/hivemq/hivemq-community-
edition.
The average response time with respect to the number of users [14] Panda, Prabhat & Chattopadhyay, Sudipta, A secure mutual
authentication protocol for IoT environment. Journal of Reliable
pictorially presents the average response time. Even when the Intelligent Environments. 6. 10.1007/s40860-020-00098-y.
number of users is increased, it is found the average response [15] A., Hariprasanna & Mahesha, P., Secure Authentication, Contract and
time required marginally increases, which reflects the advantage Communication for IoT Environment using MQTT Protocol.
of the present method. International Journal of Computer Applications. 175. 40-43.
10.5120/ijca2020920776.
[16] Jun Suzuki, Akira Tsuji, Yuki Hayashi, Masaki Kan, and Shinya
IV. CONCLUSION Miyakawa, "Device-Level IoT with Virtual I/O Device
Interconnection," In Proceedings of IEEE International Conference,
Luxembourg City, Luxembourg, pp. 67-74, 2016.
This paper aims to introduce the mechanism to provide secure [17] Alok Kumar Gupta and Rahul Johari, "IOT-based Electrical Device
authentication, Contract, and communication between the IoT Surveillance and Control System," In Proceedings of 4th IEEE
device and Users of the IoT Environment. The Secret keys International Conference, Ghaziabad, India, pp.1-5, 2019.
generated for the present work in Secure Vault keep changing [18] Hittu Garg and Mayank Dave, "Securing IoT Devices and Securely
after each successful communication session between the user Connecting the Dots Using REST API and Middleware," In
Proceedings of 4th IEEE International Conference, Ghaziabad,
and IoT device. The model uses the MQTT protocol for India, pp. 1-6, 2019.
communication between the IoT device and the Users of the IoT
Environment. The information is stored using Blockchain

Authorized licensed use limited to: VIT University. Downloaded on February 18,2025 at 14:27:34 UTC from IEEE Xplore. Restrictions apply.