{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,10]],"date-time":"2026-04-10T16:10:41Z","timestamp":1775837441244,"version":"3.50.1"},"reference-count":46,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2021,2,21]],"date-time":"2021-02-21T00:00:00Z","timestamp":1613865600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>With the information and communication technologies (ICT) and Internet of Things (IoT) gradually advancing, smart homes have been able to provide home services to users. The user can enjoy a high level of comfort and improve his quality of life by using home services provided by smart devices. However, the smart home has security and privacy problems, since the user and smart devices communicate through an insecure channel. Therefore, a secure authentication protocol should be established between the user and smart devices. In 2020, Xiang and Zheng presented a situation-aware protocol for device authentication in smart grid-enabled smart home environments. However, we demonstrate that their protocol can suffer from stolen smart device, impersonation, and session key disclosure attacks and fails to provide secure mutual authentication. Therefore, we propose a secure and lightweight authentication protocol for IoT-based smart homes to resolve the security flaws of Xiang and Zheng\u2019s protocol. We proved the security of the proposed protocol by performing informal and formal security analyses, using the real or random (ROR) model, Burrows\u2013Abadi\u2013Needham (BAN) logic, and the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. Moreover, we provide a comparison of performance and security properties between the proposed protocol and related existing protocols. We demonstrate that the proposed protocol ensures better security and lower computational costs than related protocols, and is suitable for practical IoT-based smart home environments.<\/jats:p>","DOI":"10.3390\/s21041488","type":"journal-article","created":{"date-parts":[[2021,2,21]],"date-time":"2021-02-21T22:04:15Z","timestamp":1613945055000},"page":"1488","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":85,"title":["A Secure and Lightweight Authentication Protocol for IoT-Based Smart Homes"],"prefix":"10.3390","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8690-2125","authenticated-orcid":false,"given":"JiHyeon","family":"Oh","sequence":"first","affiliation":[{"name":"School of Electronic and Electrical Engineering, Kyungpook National University, Daegu 41566, Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3245-781X","authenticated-orcid":false,"given":"SungJin","family":"Yu","sequence":"additional","affiliation":[{"name":"School of Electronic and Electrical Engineering, Kyungpook National University, Daegu 41566, Korea"},{"name":"Electronics and Telecommunications Research Institute, Daejeon 34129, Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8172-6182","authenticated-orcid":false,"given":"JoonYoung","family":"Lee","sequence":"additional","affiliation":[{"name":"School of Electronic and Electrical Engineering, Kyungpook National University, Daegu 41566, Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3198-8467","authenticated-orcid":false,"given":"SeungHwan","family":"Son","sequence":"additional","affiliation":[{"name":"School of Electronic and Electrical Engineering, Kyungpook National University, Daegu 41566, Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4891-818X","authenticated-orcid":false,"given":"MyeongHyun","family":"Kim","sequence":"additional","affiliation":[{"name":"School of Electronic and Electrical Engineering, Kyungpook National University, Daegu 41566, Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0406-6547","authenticated-orcid":false,"given":"YoungHo","family":"Park","sequence":"additional","affiliation":[{"name":"School of Electronic and Electrical Engineering, Kyungpook National University, Daegu 41566, Korea"},{"name":"School of Electronics Engineering, Kyungpook National University, Daegu 41566, Korea"}]}],"member":"1968","published-online":{"date-parts":[[2021,2,21]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Shin, S., and Kwon, T. (2019). A lightweight three-factor authentication and key agreement scheme in wireless sensor networks for smart homes. Sensors, 19.","DOI":"10.3390\/s19092012"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"1020","DOI":"10.1007\/s10922-019-09496-x","article-title":"Lightweight and secure password based smart home authentication protocol: LSP-SHAP","volume":"27","author":"Naoui","year":"2019","journal-title":"J. Netw. Syst. Manag."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1016\/j.cose.2018.03.004","article-title":"A two-factor authentication scheme against FDM attack in IFTTT based smart home system","volume":"77","author":"Baruah","year":"2018","journal-title":"Comput. Secur."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"254","DOI":"10.1109\/JSEN.2015.2475298","article-title":"Lightweight and secure session-key establishment scheme in smart home environments","volume":"16","author":"Kumar","year":"2015","journal-title":"IEEE Sens. J."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"968","DOI":"10.1109\/TIFS.2016.2647225","article-title":"Anonymous secure framework in connected smart home environments","volume":"12","author":"Kumar","year":"2017","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Xiang, A., and Zheng, J. (2020). A situation-aware scheme for efficient device authentication in smart grid-enabled home area networks. Electronics, 9.","DOI":"10.3390\/electronics9060989"},{"key":"ref_7","unstructured":"AVISPA (2020, November 10). Automated Validation of Internet Security Protocols and Applications. Available online: http:\/\/www.avispa-project.org\/."},{"key":"ref_8","unstructured":"(2020, November 10). SPAN: A Security Protocol Animator for AVISPA. Available online: http:\/\/www.avispa-project.org\/."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"3184","DOI":"10.1109\/JIOT.2020.2966242","article-title":"Certificateless-signcryption-based three-factor user access control scheme for IoT environment","volume":"7","author":"Mandal","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1145\/77648.77649","article-title":"A logic of authentication","volume":"8","author":"Burrows","year":"1990","journal-title":"ACM Trans. Comput. Syst."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Abdalla, M., Fouque, P.A., and Pointcheval, D. (2005). Password based authenticated key exchange in the three-party setting. Public Key Cryptgraphy, Springer.","DOI":"10.1007\/978-3-540-30580-4_6"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"198","DOI":"10.1109\/TIT.1983.1056650","article-title":"On the security of public key protocols","volume":"29","author":"Dolev","year":"1983","journal-title":"IEEE Trans. Inf. Theory"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"107046","DOI":"10.1109\/ACCESS.2020.3000790","article-title":"On the design of secure and efficient three-factor authentication protocol using honey list for wireless sensor networks","volume":"8","author":"Lee","year":"2020","journal-title":"IEEE Access"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Yu, S., Lee, J., Lee, K., Park, K., and Park, Y. (2018). Secure authentication protocol for wireless sensor networks in vehicular communications. Sensors, 18.","DOI":"10.3390\/s18103191"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Canetti, R., and Krawczyk, H. (2002). Universally composable notions of key exchange and secure channels. International Conference on the Theory and Applications of Cryptographic Thechniques (EUROCRYPT\u201902), Springer.","DOI":"10.1007\/3-540-46035-7_22"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"8804","DOI":"10.1109\/JIOT.2019.2923611","article-title":"AKM-IoV: Authenticated key management protocol in fog computing-based internet of vehicles deployment","volume":"6","author":"Wazid","year":"2019","journal-title":"IEEE Internet Things J."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Yu, S., Lee, J., Park, Y., Park, Y., Lee, S., and Chung, B. (2020). A secure and efficient three-factor authentication protocol in global mobility networks. Appl. Sci., 10.","DOI":"10.3390\/app10103565"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"25808","DOI":"10.1109\/ACCESS.2017.2764913","article-title":"On the design of provably secure lightweight remote user authentication scheme for mobile cloud computing services","volume":"5","author":"Roy","year":"2017","journal-title":"IEEE Access"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"30225","DOI":"10.1109\/ACCESS.2018.2844190","article-title":"2PAKEP: Provably secure and efficient two-party authenticated key exchange protocol for mobile environment","volume":"6","author":"Park","year":"2018","journal-title":"IEEE Access"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"101235","DOI":"10.1109\/ACCESS.2020.2996093","article-title":"Securing demand response management: A certificate-based access control in smart grid edge computing infrastructure","volume":"8","author":"Chaudhry","year":"2020","journal-title":"IEEE Access"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"119387","DOI":"10.1109\/ACCESS.2020.3005592","article-title":"LAKS-NVT: Provably secure and lightweight authentication and key agreement scheme without verification table in medical internet of things","volume":"8","author":"Park","year":"2020","journal-title":"IEEE Access"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"102660","DOI":"10.1016\/j.jnca.2020.102660","article-title":"Secure two-factor lightweight authentication protocol using self-certified public key cryptography for multi-server 5G networks","volume":"161","author":"Wang","year":"2020","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"483","DOI":"10.1016\/j.future.2016.05.032","article-title":"A robust and anonymous patient monitoring system using wireless medical sensor networks","volume":"80","author":"Amin","year":"2018","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"26","DOI":"10.1016\/j.comcom.2017.05.009","article-title":"A secure and robust anonymous three-factor remote user authentication scheme for multi-server environment using ECC","volume":"110","author":"Chandrakar","year":"2017","journal-title":"Comput. Commun."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Santoso, F.K., and Vun, N.C.H. (2015, January 24\u201326). Securing IoT for smart home system. Proceedings of the 2015 International Symposium on Consumer Electronics (ISCE), Madrid, Spain.","DOI":"10.1109\/ISCE.2015.7177843"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"100158","DOI":"10.1016\/j.iot.2020.100158","article-title":"Secure remote anonymous user authentication scheme for smart home environment","volume":"9","author":"Fakroon","year":"2020","journal-title":"Internet Things"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"85627","DOI":"10.1109\/ACCESS.2019.2926578","article-title":"Physically secure lightweight anonymous user authentication protocol for internet of things using physically unclonable functions","volume":"7","author":"Banerjee","year":"2019","journal-title":"IEEE Access"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"7500204","DOI":"10.1109\/LSENS.2019.2905020","article-title":"Session-key establishment and authentication in a smart home network using public key cryptography","volume":"3","author":"Dey","year":"2019","journal-title":"IEEE Sens. Lett."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"69722","DOI":"10.1109\/ACCESS.2020.2986480","article-title":"Robust and lightweight mutual authentication scheme in distributed smart environments","volume":"8","author":"Gaba","year":"2020","journal-title":"IEEE Access"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"154","DOI":"10.1016\/j.comcom.2020.11.017","article-title":"A privacy and session key based authentication scheme for medical IoT networks","volume":"166","author":"Kumar","year":"2021","journal-title":"Comput. Commun."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"132","DOI":"10.1016\/j.cose.2019.06.002","article-title":"Anonymous authentication scheme for smart home environment with provable security","volume":"86","author":"Shuai","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"326","DOI":"10.1016\/j.comcom.2010.03.013","article-title":"Robust one-time password authentication scheme using smart card for home network environment","volume":"34","author":"Vaidya","year":"2011","journal-title":"Comput. Commun."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Kim, H.J., and Kim, H.S. (2011). AUTH HOTP-HOTP based authentication scheme over home network environment. International Conference on Computational Science and Its Applications, Springer.","DOI":"10.1007\/978-3-642-21931-3_48"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"391","DOI":"10.1109\/TDSC.2017.2764083","article-title":"Secure remote user authenticated key establishment protocol for smart home environment","volume":"17","author":"Wazid","year":"2017","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"41835","DOI":"10.1109\/ACCESS.2019.2907602","article-title":"Remotely access \u201cmy\u201d smart home in private: An anti-tracking authentication and key agreement scheme","volume":"7","author":"Lyu","year":"2019","journal-title":"IEEE Access"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Poh, G.S., Gope, P., and Ning, J. (2019). Privhome: Privacy-preserving authenticated communication in smart home environment. IEEE Trans. Dependable Secur. Comput.","DOI":"10.1109\/TDSC.2019.2914911"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Irshad, A., Usman, M., Chaudry, S.A., Bashir, A.K., Jolfaei, A., and Srivastava, G. (2020). Fuzzy-in-the-loop-driven low-cost and secure biometric user access to server. IEEE Trans. Reliab.","DOI":"10.1109\/TR.2020.3021794"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Banerjee, S., Odelu, V., Das, A.K., Chattopadhyay, S., and Park, Y. (2020). An efficient, anonymous and robust authentication scheme for smart home environments. Sensors, 20.","DOI":"10.3390\/s20041215"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"AL-Turjman, F., and Deebak, D.B. (2020). Seamless authentication: For IoT-big data technologies in smart industrial application systems. IEEE Trans. Ind. Inf.","DOI":"10.1109\/TII.2020.2990741"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Lee, J., Yu, S., Park, K., Park, Y., and Park, Y. (2019). Secure three-factor authentication protocol for multi-gateway IoT environments. Sensors, 19.","DOI":"10.3390\/s19102358"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"2776","DOI":"10.1109\/TIFS.2017.2721359","article-title":"Zipf\u2019s law in passwords","volume":"12","author":"Wang","year":"2017","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"76812","DOI":"10.1109\/ACCESS.2019.2921399","article-title":"A dynamic privacy-preserving key management protocol for V2G in social internet of things","volume":"7","author":"Park","year":"2019","journal-title":"IEEE Access"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"167875","DOI":"10.1109\/ACCESS.2020.3022778","article-title":"IoV-SMAP: Secure and efficient message authentication protocol for IoV in smart city environment","volume":"8","author":"Yu","year":"2020","journal-title":"IEEE Access"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Boyko, V., MacKenzie, P., and Patel, S. (2000, January 14\u201318). Provably secure password-authenticated key exchange using Diffie-Hellman. Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques, Bruges, Belgium.","DOI":"10.1007\/3-540-45539-6_12"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1016\/j.entcs.2005.11.052","article-title":"Automated security protocol analysis with the AVISPA tool","volume":"155","author":"Vigano","year":"2006","journal-title":"Electron. Notes Theor. Comput. Sci."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"2136506","DOI":"10.1155\/2019\/2136506","article-title":"A lightweight secure user authentication and key agreement protocol for wireless sensor networks","volume":"2019","author":"Mo","year":"2019","journal-title":"Secur. Commun. Netw."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/4\/1488\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T05:27:16Z","timestamp":1760160436000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/4\/1488"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,2,21]]},"references-count":46,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2021,2]]}},"alternative-id":["s21041488"],"URL":"https:\/\/doi.org\/10.3390\/s21041488","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,2,21]]}}}