A Privacy-Preserving Authentication Scheme Using PUF and Biometrics for IoT-Enabled Smart Cities

With the advancement of communication technology, smart cities can provide remote services to users using mobile devices and Internet of Things (IoT) sensors in real time. However, the collected data in smart cities include sensitive personal information and data transmitted over public wireless channels, leaving the network vulnerable to security attacks. Thus, robust and secure authentication is critical to verify legitimate users and prevent malicious attacks. This paper reviews a recent authentication scheme for smart cities and identifies its susceptibilities to attacks, including insider attacks, sensor node capture, user impersonation, and random number leakage. We propose a secure and privacy-preserving authentication scheme for smart cities to resolve these security weaknesses. The scheme enables mutual authentication by incorporating biometric features to verify identity and using the physical unclonable function to prevent physical attacks. We evaluate the security of the proposed scheme via informal and formal analyses, including Burrows–Abadi–Needham logic, the real-or-random model, and the Automated Validation of Internet Security Protocols and Applications simulation tool. Finally, we compare the performance, demonstrating that the proposed scheme has better efficiency and security than existing schemes. Consequently, the proposed scheme is suitable for resource-constrained IoT-enabled smart cities.