Transient Session Key Derivation Protocol for Key Escrow Prevention in Public Key Infrastructure

The Internet of Things (IoT) devices have been deployed to realize smart environments such as smart cities, smart homes, smart health and smart grids. In these domains, the IoT devices collect and forward high volumes of sensitive and private data. It is therefore important that security schemes be developed to protect the exchanged data. In this regard, a myriad of authentication protocols have been developed over the recent past. However, these schemes deploy cryptographic primitives that result in extremely high communication, storage and computation complexities. In addition, some of these protocols still have numerous security and privacy issues that render them unsuitable for deployment in an IoT environment. For instance, untraceability, anonymity, key escrow problems and attack vectors such as de-synchronization and forgery attacks are frequently ignored. In this paper, a transient session key derivation protocol is developed to address some of these security and efficiency challenges. The security analysis executed shows that this protocol offers untraceability, device anonymity and perfect forward key secrecy. In addition, it is robust against de-synchronization, known secret key leakage, eavesdropping and forgery attacks. In terms of operational efficiency, this protocol incurs the lowest computation and communication complexities.