  Home automation Internet of Things (IoT) systems have recently become a
target for several types of attacks. In this paper, we present an
authentication and key agreement protocol for a home automation network based
on the ZigBee standard, which connects together a central controller and
several end devices. Our scheme performs mutual authentication between end
devices and the controller, which is followed by device-to-device
communication. The scheme achieves confidentiality, message integrity,
anonymity, unlinkability, forward and backward secrecy, and availability. Our
scheme uses only simple hash and XOR computations and symmetric key encryption,
and hence is resource-efficient. We show using a detailed security analysis and
numerical results that our proposed scheme provides better security and
anonymity, and is more efficient in terms of computation time, communication
cost, and storage cost than schemes proposed in prior works.
