Behavioural biometric authentication and secure key agreement for smart networks using machine learning and lightweight elliptic curve cryptography

Abstract

The fast integration of Internet of Things (IoT) into smart environments, introduces significant security challenges, especially in user authentication and secure data exchanges. These security challenges increase unauthorized access, information leakage, and disruption of services. Traditional user authentication mechanisms depending on static credentials, such as passwords or fingerprints, are vulnerable to common cyberattacks such as replay attacks, impersonation attacks, and denial-of-service attacks. Moreover, many current authentication protocols require high computational resources, making them unsuitable for resource constrained IoT devices. To address these challenges, this paper proposes a lightweight user authentication and secure key agreement protocol that integrates behavioural biometrics, Machine Learning (ML) and Elliptic Curve Cryptography. During first login sessions, the system captures behavioural biometric data such as keystroke dynamics, mouse movements, and cursor patterns. During subsequent login attempts, the trained model verifies user identity based on the behavioural biometric before allowing access to IoT resources. After successful authentication, a secure session key is established between the user and the IoT node based on partial key with gateway assistance. Formal security verification using the ROR model and AVISPA tool confirms that the protocol is resistant to common security threats. Experimental results using a behavioural biometrics dataset show that the Random Forest classifier achieves the best performance with high authentication accuracy. Furthermore, the proposed protocol achieves a low execution time of 8.9937ms, demonstrating its suitability for resource-constrained smart network environments. The future work will emphasize on Blockchain-base distributed authentication and deploying the proposed framework in actual IoT environments.