Formal verification of security properties of the Lightweight Authentication and Key Exchange Protocol for Federated IoT devices

Abstract

The federated nature of many crucial Internet of Things (IoT) applications introduces several challenges from a security perspective. To address critical challenges related to the authentication and secure communication of IoT devices operating in federated environments, we propose a new authentication and key exchange protocol based on a distributed ledger. Our protocol uses the unique configuration fingerprint of an IoT device and does not require secure storage in participating IoT devices. To validate the correctness of our design, we have performed formal modeling and verification of the security properties, using two different verification tools: Verifpal and the Tamarin prover.