Chaudhry, Shehzad AshrafIrshad, AzeemYahya, KhalidKumar, NeerajAlazab, MamounBin Zikria, Yousaf2024-09-112024-09-1120211533-53991557-6051https://doi.org/10.1145/3425707https://hdl.handle.net/11363/7913The advancements in the internet of things (IoT) require specialized security protocols to provide unbreakable security along with computation and communication efficiencies. Moreover, user privacy and anonymity has emerged as an integral part, along with other security requirements. Unfortunately, many recent authentication schemes to secure IoT-based systems were either proved as vulnerable to different attacks or prey of inefficiencies. Some of these schemes suffer from a faulty design that happened mainly owing to undue emphasis on privacy and anonymity alongside performance efficiency. This article aims to show the design faults by analyzing a very recent hash functions-based authentication scheme for cloud-based IoT systems with misunderstood privacy cum efficiency tradeoff owing to an unadorned design flaw, which is also present in many other such schemes. Precisely, it is proved in this article that the scheme of Wazid et al. cannot provide mutual authentication and key agreement between a user and a sensor node when there exists more than one registered user. We then proposed an improved scheme and proved its security through formal and informal methods. The proposed scheme completes the authentication cycle with a minor increase in computation cost but provides all security goals along with privacy.eninfo:eu-repo/semantics/closedAccessSecuritykey-agreementcloud securityIoTincorrectnesstraceabilityanonymityArticle21310.1145/34257072-s2.0-85111987577WOS:000713626400026Q1