Abstract

This report presents a secure and anonymous user authentication scheme tailored for IoT-enabled smart home environments, where the increasing interconnectivity of devices has raised serious concerns about security and privacy. Traditional authentication techniques often fail to accommodate the limitations of smart devices, such as limited processing power, energy constraints, and susceptibility to physical attacks. To overcome these challenges, the proposed scheme leverages Physical Unclonable Functions (PUFs) — hardware-based security primitives that generate unique and tamper-resistant device identities. These PUFs enable strong authentication without revealing personal user information, thereby preserving anonymity and preventing tracking. The scheme employs lightweight cryptographic operations including hash functions (SHA-3, HMAC) and XOR operations, making it highly efficient and suitable for resource-constrained environments. It encompasses multiple phases such as device registration, user registration, secure login, mutual authentication, and password updates. The system is designed to withstand common attacks like replay, impersonation, and man-in-the-middle by incorporating mutual authentication and forward secrecy. Security analysis and performance evaluations confirm the scheme’s effectiveness, scalability, and practicality. By integrating PUF-based authentication, this report offers a robust, scalable, and privacy-preserving solution for enhancing trust and security in smart home ecosystems.