Munir Hussain, Amjad Mehmood, Muhammad Altaf Khan, Jaime Lloret · 5 authors
The recent developments in telecommunication technologies and monitoring devices have brought many changes in modern electronic healthcare systems (EHSs) by improving quality and decreasing healthcare expenses. Despite the benefits, they have privacy and security issues because the communication between patients and service providers takes place generally over public channels. Several user authentication protocols using distributed ledger technology (DLT) have recently been proposed to address these issues in EHSs. However, many are still vulnerable to a single point of failure (SPoF), privacy, and security attacks. Besides, they suffered from high communication and computational costs. Therefore, in this paper, we proposed a user authentication protocol using DLT to avoid these issues. A Burrows-Abadi-Needham (BAN) logic proof method has been used to check the security of the proposed protocol and ensure it achieves the desired security goals. In addition, an informal security analysis has been conducted to verify its important security requirements. A formal security analysis has been performed via the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool and Real-or-Random (ROR) model for further security strength. The results demonstrate that the proposed user authentication protocol is SAFE against all types of Man-in-the-Middle (MitM) attacks, impersonation, replay, and forgery attacks . Finally, performance analysis has been performed and results show that it achieves better performance by consuming 29.63 % and 13.21 % less communication and computational overheads as compared to existing related user authentication protocols. The security and performance analysis make it a more appropriate choice for the EHSs.
Electronic voting (e-voting) has emerged as a transformative technology in the modern digital era. Many countries across the world are using e-voting systems in different types of elections, from political to non-political. One of the primary goals of e-voting is ensuring both verifiability and privacy simultaneously, which we refer to as security. Verifiability is a security feature that guarantees voters can confirm their vote is reflected in the final election result, while privacy guarantees that no one is able to link a vote to the voter who cast it. Verifiability needs to hold only for the duration of the election, whereas privacy needs to extend beyond the election period, even decades after the election. This property, known as everlasting privacy in the literature, ensures that even computationally unbounded adversaries cannot compromise voter privacy, securing elections against future advances in computing, including quantum computing. Researchers have proposed a wide variety of protocols to achieve this ambitious goal in secure e-voting, however, these protocols differ significantly, making the analysis and state-of-the-art complicated. In this thesis, we first address this fragmentation by systematically analyzing all existing e-voting protocols designed to ensure everlasting privacy. We map out the relationships and dependencies among these protocols, evaluate their security and efficiency under realistic assumptions, and identify unresolved challenges in the field. Our work provides a foundational reference for researchers aiming to design secure e-voting systems with everlasting privacy, paving the way for privacypreserving elections in the post-quantum era. Building on these insights, we propose a novel e-voting system that integrates the best practices from prior research while addressing their limitations. Leveraging the Hyperion scheme as a foundation, we develop an enhanced protocol that not only guarantees everlasting privacy but also introduces everlasting receipt-freeness and coercion mitigation. Unlike existing systems like Selene and Hyperion, which rely on computational assumptions for privacy, our protocol offers privacy even against adversaries with unlimited computational power. In secure electronic voting systems with everlasting privacy, the focus is on futureproofing privacy, while sometimes election verifiability relies on the computational soundness of zero-knowledge proofs (ZKP), which are vulnerable to quantum adversaries. Therefore, a key technical challenge is designing e-voting systems with efficient post-quantum cryptographic primitives to secure both privacy and verifiability against quantum attacks. In this thesis, we advance the state of post-quantum ZKPs by focusing on the ZKPs proposed by Jain et al., which are based on the conservative Learning Parity with Noise (LPN) assumption. We optimize the efficiency of these ZKPs, achieve formal security verification using EasyCrypt, and uncover flaws in existing implementations, demonstrating their vulnerability to malicious provers. Additionally, we construct the first code-based ZKP of shuffle, enabling a verifiable and privacy-preserving e-voting protocol with mixing-based tallying. Our e-voting system ensures both verifiability and vote privacy through the computational difficulty of decoding random linear codes, marking it as the first verifiable code-based e-voting system.
The Internet of Autonomous Vehicles (IoAV) faces growing challenges in user privacy and communication security, stemming from dynamic network topologies induced by highspeed vehicle mobility, resource-constrained onboard devices, and the inherent tension between identity anonymity and traceability in latency-critical applications. Given the distributed architecture of fog computing and the limited storage and computational capabilities of vehicles, conventional anonymous authentication and centralized key negotiation mechanisms prove insufficient in addressing these issues. In response, We propose a distributed authentication and key negotiation protocol that combines multifactor biometrics, zero-knowledge proof (ZKP), and physical unclonable function (PUF) without relying on a trusted third party. Specifically, we design an efficient ZKP algorithm based on Chebyshev polynomials with low overhead and strong anonymity. Our key innovation is the implementation of independent key negotiation of three untrusted entities in a single protocol cycle, enabling 23 security features and functions. The performance analysis shows that the scheme takes only 17 ms to complete the protocol flow, and it reduces vehicle memory usage by 33% to 83%, service latency by 61% to 83%, and communication overhead by 12% to 50% compared to existing schemes.
The surge in smartphone users has fueled the development of mobile Cloud Computing (MCC), a technology integrating cloud computing's power with mobile device mobility. MCC offers on-demand access to cloud resources like storage, processing power, and software, enhancing mobile device functionality and efficiency. This paper delves into user privacy concerns in 5G MCC environments. The convergence of mobile computing, wireless networks, and cloud computing has fostered the rapidly evolving field of MCC. Advancements in 5G mobile networks are expected to propel MCC services even further, making them a focal point in the mobile service landscape. However, 5G MCC also presents significant user privacy challenges, including network latency and data security. This paper investigates various cryptographic techniques employed to safeguard user privacy in 5G MCC systems. We compare and analyze encryption techniques, zero-knowledge proofs, MFA, and blockchain, and the inherent challenges associated with each approach.
Vehicular Ad Hoc Networks (VANETs) are essential to intelligent transportation systems (ITS), enabling secure, real-time communication among vehicles and infrastructure. However, their decentralized and dynamic nature makes them vulnerable to threats such as Sybil attacks, message forgery, replay attacks, and Denial-of-Service (DoS). This paper presents VANETGuard, a lightweight scalable trust management system that enhances security and scalability in 5G-enabled smart vehicular networks. The proposed system integrates entropy-based anomaly detection, Bayesian inference for adaptive trust scoring, and a lightweight distributed ledger for decentralized, tamper-resistant trust storage. Large-scale simulations under realistic traffic and attack conditions demonstrate that VANETGuard achieves 99.97% detection accuracy, significantly reduces false positives, and maintains low latency and computational overhead while supporting over 300 vehicles. These results highlight VANETGuard’s potential to enable secure, efficient, and scalable trust mechanisms in next-generation ITS and urban mobility systems.
Cross-chain interaction plays a crucial role in enhancing asset circulation and data sharing across diverse blockchain systems. Cross-chain identity authentication is the primary pre-requisite of cross-chain security interaction. However, existing cross-chain identity authentication protocol generally has issues such as insufficient decentralization, poor universality, and low authentication efficiency. These issues compromise the reliability of cross-chain interactions. Based on group signature and zero-knowledge proof, this paper proposes a cross-chain identity authentication protocol to address these concerns. The protocol employs Decentralized Identifiers(DIDs) as the global identity identifier of users, utilizes zero-knowledge proof to provide privacy for the verification of users' identities when joining the group, and then constructs the users' transaction signatures through group signatures to hide the users' identities. This approach not only reduces the risk of users' privacy leakage but also facilitates mutual recognition of identities among cross-chain systems. Finally, the security analysis and experimental analysis shows the correctness and efficiency of the proposed scheme.
With the rise in need of Electronic Health Records (EHR), keeping confidentiality, integrity, and privacy intact of Patient Health Information (PHI) becomes of utmost importance, particularly while sharing via email which is inherently non-secure. The current work proposes a hybrid encryption approach on the basis of Advanced Encryption Standard (AES-256) with symmetric key cryptography and Elliptic Curve Cryptography (ECC) as asymmetric encryption. AES-256 is selected because it performs well to encrypt large datasets, and ECC provides secure key exchange and digital signature support with less computation overhead compared to RSA. The system addresses issues of key encryption, such as secure transmission of information, identification authentication, and digital signatures for message integrity.Besides AES and ECC, the system incorporates a Zero-Knowledge Proof (ZKP) protocol, enabling privacy-preserving identity authentication without exposing sensitive data. This is important in ensuring PHI protection because ZKP permits identity and message authenticity verification with private data left secure. The hybrid system is balanced between speed of encryption and security, such that it remains scalable and usable for real-time healthcare use cases. By integrating AES for quick data encryption, ECC for secure key management, and ZKP for added privacy, this solution provides an end-to-end solution for securely sending PHI through email. It successfully solves encryption issues while maintaining confidentiality, integrity, and privacy in healthcare communication without compromising efficiency. This encryption framework ensures compliance with major data privacy regulations including HIPAA and GDPR, making it applicable for real-world healthcare environments across both the U.S. and the EU.
The rapid growth of digital technologies has intensified concerns about data privacy and security. Blockchain technology, combined with advanced cryptographic methods, presents a promising solution to enhance digital privacy by enabling decentralized, transparent, and tamper-resistant systems. This article explores the foundational principles of blockchain and cryptography, evaluates their interplay in preserving digital privacy, and examines current challenges and future directions. Through comprehensive analysis, the study highlights how cryptographic protocols such as zero-knowledge proofs and homomorphic encryption can significantly augment privacy on blockchain platforms, while addressing inherent scalability and usability challenges.
With the rapid advancement of blockchain technology, smart contracts have enabled the implementation of increasingly complex functionalities. However, ensuring the security of smart contracts remains a persistent challenge across the stages of development, compilation, and execution. Vulnerabilities within smart contracts not only undermine the security of individual applications but also pose significant risks to the broader blockchain ecosystem, as demonstrated by the growing frequency of attacks since 2016, resulting in substantial financial losses. This paper provides a comprehensive analysis of key security risks in Ethereum smart contracts, specifically those written in Solidity and executed on the Ethereum Virtual Machine (EVM). We focus on two prevalent and critical vulnerability types (reentrancy and integer overflow) by examining their underlying mechanisms, replicating attack scenarios, and assessing effective countermeasures.
Verifiable credentials (VCs) serve as the digital counterparts to physical credentials, with their security assured through cryptographic methods. The interest on VCs has been renewed by the publication of the European Regulation eIDAS 2.0 that instructs the member states to provide their citizens with a digital wallet (EUDI Wallet) that stores such credentials and that the citizens can use all across the European Union. A great effort has been placed in the definition of common standards that are described in the EUDI Architecture and Reference Framework (ARF), that will be used for the design of the EUDI Wallet. One of the crucial aspects is the identification of the formats and types of VCs supported to be stored in it. The goal of this thesis is twofold: first, to provide a systematic description and analysis of the two VC formats that have been the primary candidates for support by the EUDI Wallet, and second, to propose cryptographic protocols and primitives that facilitate the addition of new features to these credential formats or improve the existing ones. The two VC formats that have been the primary candidates in the development of the EUDI ARF covers (1) the VCs based on hiding commitments that are signed by the issuer using a general purpose digital signature algorithm, and (2) the anonymous credentials generated using the framework of Camenisch and Lysyanskaya, that make use of special digital signature schemes supporting NIZKP that allow one to prove knowledge of a signature created by the issuer. We describe and characterize these formats with a special focus on the cryptographic aspects underlying their design. Then, we introduce a novel cryptographic primitive that can be used to increase the security of the storage of anonymous credentials. We call this primitive multi-holder anonymous credential, and it allows a holder to split an anonymous credential in shares and store them on multiple devices. To present the credential, the holder will need the contribution of a given threshold of the devices. This ensures that as long as an adversary does not compromise enough devices, reaching the threshold, it cannot steal the credential and use it to impersonate the holder. We instantiate a multi-holder anonymous credential that is compatible with the BBS anonymous credential scheme, and we prove its security. Finally, we present a cryptographic commitment scheme whose security is proven in the standard model under assumptions on cryptographic group actions, which are quantum resistant. This commitment scheme, unlike the more efficient commitment based on hashing and salting, supports algorithms and non-interactive zero knowledge proofs to prove predicates about the committed messages, which is an important feature for privacy-preserving applications. To be more specific, when our scheme is used to create VCs, it enables holders to create predicate proofs about the attributes included in their VC, increasing their ability to minimize the disclosure of data.
TetraUnified v2.0 presents a fully revised, academically aligned research framework integrating three experimental components: Tetrahedral Key Exchange (TKE):Exploratory key exchange mechanism based on recursive geometric projections. Recursive Tesseract Hashing (RTH):Hyperdimensional hashing model using 16-axis Clifford projections and recursive entropy mixing. Quantum Isoca-Dodecahedral Lattice Encryption (QIDL):Conceptual encoding model for representing plaintext within dynamic polyhedral phase lattices. This version restructures the system into a coherent research-grade framework, emphasizing mathematical clarity, reproducibility, consistent notation, and proper cryptographic disclaimers.No security guarantees are claimed and no component should be used in production systems.All structures are intended strictly for experimental simulation, prototyping, and conceptual evaluation. Purpose of This Release Version 2.0 was developed to achieve three objectives: Remove speculative, metaphorical, or narrative content from earlier drafts and establish a formal academic tone. Strengthen mathematical structure and notation, including explicit operator definitions and theorem–proof formulations. Position the system as a technical R&D testbed, rather than a security product or operational cryptographic protocol. This release supersedes all previous versions.Earlier manuscripts are preserved only as historical development notes. Key Improvements in v2.0 1. Formal Mathematical Structures Includes new theorem–proof style sections addressing: TKE reconstruction consistency RTH entropy evolution under recursion QIDL transformation intractability (as a conceptual model) Defined core operators: Projection (𝒯) Modulation (f) Reconstruction () Polyhedral rotation (_{I,D}) Sealing (𝒮) Geometric embeddings now use clearly stated synthetic Clifford bases. 2. Cryptographic Positioning TKE, RTH, and QIDL are explicitly described as experimental, unverified, not secure, and not production-ready. No hardness assumptions are claimed. All constructs are positioned as alternative simulation models inspired by geometric/topological methods. 3. Distributed Systems & Navigation Concepts Introduces a conceptual framework for: phase-based synchronization inertial alignment without external timing sources distributed state coordination under high latency resilience to environmental drift or partial network partitions 4. Comparison with Existing Quantum Programming Includes a revised comparison table contrasting: NISQ-era quantum programming TetraUnified’s hyperdimensional simulation models Highlights key architectural differences without implying superiority. 5. Expanded Application Sections Updated application discussions for TKE, RTH, and QIDL covering: distributed identity experiments mesh communication models ledger integrity prototyping inertial navigation research off-world / high-latency environments multi-agent swarm coordination recursive lineage tracking for AI pods All applications are strictly conceptual research pathways, not operational deployments. Version Philosophy TetraUnified v2.0 establishes the framework as: an academic-style experimental cryptography model a research environment for hyperdimensional and geometric transformations an R&D prototype for studying non-linear distributed coordination a computational sandbox for exploring alternative post-quantum architectures No practical security, correctness, or adversarial resistance should be inferred.Formal verification and cryptanalysis remain open areas for future work. Included Artifacts This release includes: the revised LaTeX manuscript (PDF) updated mathematical definitions for TKE, RTH, QIDL reference diagrams and basis definitions example code structures (if present in repository) reproducibility metadata and version history Notes on Previous Versions Earlier versions contained exploratory and speculative material.Version 2.0 replaces these with a rigorous mathematical and systems-engineering structure. Per Zenodo policies, earlier versions remain visible but represent developmental prototypes only.The DOI series now resolves to v2.0 as the authoritative technical edition. Intended Use TetraUnified v2.0 is intended for: researchers exploring geometric or topological cryptography models distributed systems experimentation verifiable computation and XR/digital-twin state modeling conceptual post-quantum architecture studies academic and peer review simulation, prototyping, and reproducibility analysis This work is not intended for operational cryptography, production deployment, or security-critical environments. Citation MacDonald, M. (2025).TetraUnified v2.0 — Experimental Framework for Hyperdimensional Cryptography, Recursive Hashing, and Distributed State Models.Zenodo. https://doi.org/10.5281/zenodo.17759222
Smart contracts are a secure and trustworthy application that plays a vital role in decentralized applications in various fields such as insurance,the internet, and gaming. However, in recent years, smart contract security breaches have occurred frequently, and due to their financial properties, they have caused huge economic losses, such as the most famous security incident "The DAO" which caused a loss of over $60 million in Ethereum. This has drawn a lot of attention from all sides. Writing a secure smart contract is now a critical issue. This paper focuses on Ether smart contracts and explains the main components of Ether, smart contract architecture and mechanism. The environment used in this paper is the Ethernet environment, using remix online compilation platform and Solidity language, according to the four security events of American Chain, The DAO, Parity and KotET, the principles of integer overflow attack, reentrant attack, access control attack and denial of service attack are studied and analyzed accordingly, and the scenarios of these vulnerabilities are reproduced, and the measures to prevent them are given. Finally, preventive measures are given. In addition, the principles of short address attack, early transaction attack and privileged function exposure attack are also introduced in detail, and security measures are proposed. As vulnerabilities continue to emerge, their classification will also evolve. The analysis and research of the current vulnerabilities are also to lay a solid foundation for avoiding more vulnerabilities.
Muhammad Jawad, Mahmood A. Al-Shareeda, Omar Yawez Mustafa Mustafa, Mohammed Amin Almaiah · 5 authors
Analysis of repeated attack signatures is important because of the rapid evolution of the Social Internet of Vehicles (SIoV). However, threats such as replay attacks, session hijacking, and key reuse make secure communication between vehicles, roadside units (RSUs), and the fog node difficult. Traditional models for authentication are limited by computational overhead and lack quick key revocation. In response to these challenges, we propose a hybrid cryptographic authentication scheme that combines a Zero-Knowledge Proof (ZKP) with AES-GCM encryption. Our protocol implements a dynamic key revocation mechanism to avoid rogue and session key migration, minimizing re-authentication delay. Security analysis in the Real-Oracle Random (ROR) model shows that it is not vulnerable to impersonation or replay attacks. Evaluations demonstrate decreases of 58% in authentication latency while achieving 45% and 72% improvements in communication and computation efficiency, respectively. Our approach is also scalable and secure, providing SIoV with higher reliability for automotive applications in the vehicular networks of the future.
The Internet of Vehicles facilitates seamless Vehicle-to-Everything (V2X) communication, offering a myriad of services ranging from traffic management to data exchange and route scheduling. However, the existence of malicious Autonomous Vehicles (AVs) poses significant security and privacy threats to data communications and vehicle users, respectively. Therefore, it is crucial to verify the identity and preserve the privacy of AVs before offering V2X services within each vehicular broadcast domain. To address the aforementioned issues, a novel privacy-preserving lightweight Fast Reed-Solomon Interactive Oracle Proof of Proximity using polynomial commitment-based authentication protocol is presented. The AVs are initially registered with a trusted authority in this protocol. After that, they are authenticated by roadside units in their respective broadcast domains using a zero-knowledge proof-based challenge-response mechanism. As per the performance analysis, the proposed protocol surpasses state-of-the-art authentication protocols and achieves notable improvements of 19.43% in registration computation time, 50.96% in registration latency, 89.75% in authentication computation time, 14.97% in authentication latency, 97.42% in handover computation time, and 95.84% in handover latency, compared to other protocols. A qualitative security analysis is also carried out to prove that the proposed protocol provides anonymity, privacy, user verifiability, and untraceability features.
The advancement of Industrial Internet of Things (IIoT) has enabled cross-domain collaboration among enterprises, facilitating data exchange and coordinated operations for complex manufacturing tasks. As the primary security mechanism, cross-domain continuous authentication periodically verifies external devices to prevent unauthorized access and session hijacking, thereby mitigating system vulnerabilities. However, existing solutions face limitations: some rely on device-specific features incompatible with heterogeneous environments, while others neglect cross-domain scenarios, offering insufficient privacy protection and irreversible identity management. To address these gaps, we propose a cross-domain authentication framework leveraging zero-knowledge proofs and blockchain technology. Devices are assigned anonymous identities, with revocation managed via a distributed ledger. Initial authentication employs zero-knowledge proofs to generate valid tokens, while continuous authentication refreshes these tokens periodically. Security analysis confirms robustness against common threats, and performance evaluations demonstrate that periodic token renewal reduces computational and communication costs compared to repeated initial authentication processes.
With the rapid development of vehicular ad-hoc networks (VANETs) and the increasing diversification of user demands, interactions between different management domains have become more frequent. Identity authentication is an effective way to establish cross-domain trust and secure communication. However, the existing cross-domain authentication schemes of VANETs are limited to the same management or authentication technology for each domain and rely on centralized cross-domain identity management. Even distributed management solutions encounter latency sensitivity, security and privacy challenges. To address these challenges, we propose a blockchain-assisted revocable cross-domain authentication scheme for VANETs. The proposed scheme can establish trust between domain entities by deploying different authentication methods and using distributed management to avoid single-point failures. In addition, the scheme can revoke the identity of malicious vehicles by updating the group public key, thereby ensuring the security and privacy of cross-domain Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) communication. This design avoids the additional impacts of blockchain technology constraints on the high mobility and real-time requirements of VANETs. Security analysis and performance evaluation show that our scheme can resist more attacks and has better security than other related schemes while also achieving a better balance between communication and computational cost.
We propose Data Tumbling Layer (DTL), a cryptographic scheme for non-interactive data tumbling. The core concept is to enable users to commit to specific data and subsequently re-use to the encrypted version of these data across different applications while removing the link to the previous data commit action. We define the following security and privacy notions for DTL: (i) no one-more redemption: a malicious user cannot redeem and use the same data more than the number of times they have committed the data; (ii) theft prevention: a malicious user cannot use data that has not been committed by them; (iii) non-slanderabilty: a malicious user cannot prevent an honest user from using their previously committed data; and (iv) unlinkability: a malicious user cannot link tainted data from an honest user to the corresponding data after it has been tumbled. To showcase the practicality of DTL, we use DTL to realize applications for (a) unlinkable fixed-amount payments; (b) unlinkable and confidential payments for variable amounts; (c) unlinkable weighted voting protocol. Finally, we implemented and evaluated all the proposed applications. For the unlinkable and confidential payment application, a user can initiate such a transaction in less than $1.5$s on a personal laptop. In terms of on-chain verification, the gas cost is less than $1.8$ million.
Currently, PAKE (Password Authenticated Key Exchange) protocols on lattice using a single-server architecture are widely applied. However, such protocols are vulnerable to server leakage attacks, dictionary attacks, and other threats. To address these issues, researchers have proposed multi-server and two-server architecture-based PAKE protocols. However, PAKE protocols in a multi-server architecture require the use of complex cryptographic primitives such as signatures, and zero-knowledge proofs to ensure security, which reduces the execution efficiency of the protocol. To tackle these challenges, we propose two new multi-server password authentication key exchange protocols based on the MLWE (Module learning with errors) problem. Both protocols rely on MLWE instances, using Peikert's error coordination technique to enable two parties with similar values to compute the same result. Furthermore, we introduce the error pairing assumption and proves its security within random oracle model. The proposed protocol divides the password information into different shares and stores them on separate servers. In protocol 1, all servers and user collaboratively generate session keys, making it suitable for high-security application scenarios. In protocol 2, both user and servers generate session keys individually, which is ideal for high-efficiency application scenarios. Compared to similar protocols, both protocols lower computation and communication costs, better addressing practical application needs while providing protection against quantum computing attacks and server leakage threats.