Passwords remain fundamental to user authentication, including handheld devices, wearables, personal computers, and network devices. Privacy concerns have led to the development of new password guidelines and alternatives, yet these have not seen widespread adoption among users. Increasing skepticism towards the service providers has made users reluctant to share sensitive information, including passwords. While current security protocols ensure data protection in transit, assurances regarding the security and privacy of data at rest are often assumed without verification. Traditional best practices for password storage involve hashing, which still requires the original password to be shared as plaintext or as a hash. Each of these methods has its vulnerabilities. For instance, an adversary can sniff network packets to capture the original password or the hash value, potentially compromising the authentication system. To address these issues, we propose a framework for password-based authentication using graph isomorphism as a zero-knowledge proof technique. This framework aims to replace conventional authentication methods and enhance password privacy. The results demonstrate the proposed framework's effectiveness in ensuring secure and private password authentication.
Current mobile payment schemes gather detailed information about purchases customers make. This data can then be used to infer a customer’s spending behaviour, potentially violating their privacy. To tackle this problem, we propose an untraceable mobile payment scheme that strikes a better balance, preserving user privacy while allowing the Third-Party Service Provider (TPSP) to collect necessary information such as card details and transaction amount for regulatory compliance. Our scheme offers untraceability for legitimate users from malicious adversaries and curious TPSPs using cryptographic primitives such as partially blind signatures, zero-knowledge proofs, and identity-based signatures. It also guarantees that only authorised TPSPs can issue valid payment tokens, and even with limited data, the TPSP can still prevent dishonest customers/merchants from double-spending a payment token. We also propose a comprehensive evaluation framework to assess the untraceable payment schemes against seven key criteria such as untraceability, exculpability—merchant double-spending, exculpability—customer double-spending, unforgeability, confidentiality, message authenticity, efficiency, and regulatory compliance. We rigorously benchmark the security and privacy of our proposed payment scheme against this framework and other established schemes. Furthermore, we formally verify these properties using complexity-based analysis and Proverif modelling.
Jing Jiang, Xiaofeng Wang, Qianqian Xing, Jin Tang
Currently, personal information leakage and identity theft have become risks that cannot be ignored. As a robust authentication mechanism, multi-factor authentication (MFA) has gained prominence. However, many existing MFA schemes based on certificate-less public key cryptography amalgamate multiple authentication factors into a single factor for local verification, which fails to achieve independent authentication of each factor and is difficult to resist internal privilege attacks. To address these issues, this paper proposes a certificate-less multi-factor privacy authentication scheme based on elliptic curve cryptography. The proposed scheme divides the full private key into multiple authentication factors and employs the Schnorr zero-knowledge proof technique to independently generate challenge values for each factor, facilitating separate authentication of multiple factors. Notably, this approach eliminates the need to reconstruct the full private key during the authentication process, thereby effectively mitigating the risk of private key leakage.
Open access
Digital Rights Management and Security
Advanced Authentication Protocols Security
Physical Unclonable Functions (PUFs) and Hardware Security
Rosa Pericàs-Gornals, M. Magdalena Payeras–Capellà, Macià Mut–Puigserver, Jaume Ramis Bibiloni
Contract signing is a fundamental security service for both business and personal transactions. One of the essential properties of contract signing protocols is fairness. Numerous electronic contract signing protocols have been proposed, typically involving a Trusted Third Party (TTP) to ensure fairness and resolve any conflicts between the involved parties. Efficiency is another critical feature of these protocols, often measured by the number of steps required to complete the contract signature. According to the literature, the minimum number of steps required for signing a contract among n parties is 3(n−1). This document introduces an innovative contract signing protocol for two signers that reduces the number of steps needed for a fair contract signature to just two: the proposal of the signature and its acceptance. This two-step protocol guarantees fairness and confidentiality, along with several other notable features. The two-party contract signing protocol is made possible by the use of a special type of token, a rejectable non-transferable non-fungible token, named RejSBT. Furthermore, with the integration of blockchain technology, our protocol eliminates the need for a TTP, which is typically required in other electronic contract signing protocols.
Shi Qiu, Jinqing Li, Xiaoqiang Di, Xusheng Li · 6 authors
To address the issues of poor user privacy protection and insecure communication in the Internet of Medical Things (IoMT) environment, we propose a blockchain-based lightweight mutual authentication scheme for the IoMT. First, our scheme is a two-factor authentication scheme that uses certificates and feature information for identity authentication. Second, we use elliptic curve cryptography and the Chinese remainder theorem to design a lightweight identity registration and authentication algorithm. This algorithm can aggregate multiple identity information of users for verification, while achieving efficient user identity authentication and ensuring the security of user identity information. Finally, we combined nonfungible tokens (NFTs) with user device information, and through a composable NFT solution, we ensured the uniqueness and immutability of user identity information on the blockchain, while facilitating user identity management. The formal security analysis based on AVISPA has proven the security of our scheme. Performance analysis shows that the proposed scheme has low communication and storage overhead. We simulated the proposed scheme on the Ethereum platform using the Solidity language and conducted latency and throughput analysis of our smart contracts using the stress testing tool, Hyperledger Caliper. The results illustrate the practicality of our scheme.
Zain Ul Islam Adil, Majid Iqbal Khan, Kahkishan Sanam, Saif Ur Rehman Malik · 6 authors
ABSTRACT Counterfeit medical devices pose a threat to patient safety, necessitating a secure device authentication system for medical applications. Resource‐constrained sensory nodes are vulnerable to hacking, prompting the need for robust security measures. Token‐based authentication schemes, such as one‐time passwords (OTPs), smart cards, key fobs, and mobile authentication apps, along with certificate‐based authentication methods, such as client and code‐signing, employ cryptographic frameworks like elliptical curve cryptography (ECC) and physical unclonable functions (PUF). However, these methods face challenges, including block sequence issues and susceptibility to side‐channel attacks. To address these issues, we propose a framework for mutual authentication using private Ethereum. This framework integrates private Ethereum and cryptographic techniques for encrypting and decrypting data using mathematical algorithms to overcome block sequence issues and side‐channel attacks. Similarly, fog nodes are utilised to enhance local computing, storage, and networking capabilities for sensors. The framework is evaluated using metrics such as communication costs, execution costs, and computation costs based on Ethereum gas consumption. The performance of the LightAuth framework is compared with that of the Smart Contracts Against Counterfeit IoMT (SCACIoMT) framework, designed for Internet of Medical Things (IoMT) devices. The effectiveness of LightAuth is verified through formal security analysis using BAN logic.
With the advancement of cutting-edge technologies, the Internet of Medical Things (IoMT) has assisted the healthcare sector by facilitating interaction between healthcare service providers and patients in remote areas. In IoMT, wearable or implantable sensors collect the patient’s record and share the information through a public network. Health-related information about the patient must be protected from a variety of attacks by the adversary since it is sensitive and extremely vulnerable to attacks. The sensor equipment that is implanted in the patient is also resource-constrained and has a low power capacity. The entities involved in the communication must be authenticated with one another in order to protect patients’ health information, anonymity, and reliability. While several authenticated key agreement protocols have been proposed, many suffer from high computational costs and storage cost, making them unsuitable for lightweight applications. This paper proposes a secure three-factor robust Elliptic Curve Cryptography (ECC) based mutually authenticated and key agreement protocol known as RELAKA for the IoMT environment, utilizing the benefits of one-way hash function. In proposed scheme, all entities, including the healthcare service providers and wearable sensors, are authenticated by the medical server. Subsequently, a secret key is established for each communication session and shared between all the entities. Additionally, mechanism for appropriate user revocation and re-registration is integrated to provide additional security in cases where a user’s QR code is tampered with by the attacker. The privacy of the proposed protocol is investigated by the potential use of zero knowledge proof. Furthermore, the efficacy of the authentication is examined by challenge and response mechanism. The informal security analysis demonstrates its resistance to threats such as DoS, impersonation, message modification, password guessing, and so on. The performance evaluation of RELAKA protocol indicates that the execution, communication, and storage costs is reduced by 87.59%, 43% and 60.71% respectively. Moreover, the outcomes of the AVISPA simulation illustrate that the RELAKA successfully evades both active and passive attacks. In addition, real-world testbed environment is developed with Raspberry pi 4 model B and the experimental results verifies the robustness of the proposed protocol. According to theoretical analysis and experimental evaluation, the RELAKA scheme is more secure and efficient than the existing protocols.
Oct 23, 2024·Advances in knowledge acquisition, transfer, and management book series/Advances in knowledge acquisition, transfer and management book series
Mageshkumar Naarayanasamy Varadarajan, N. Rajkumar, C. Viji, A. Mohanraj · 6 authors
User Authentication and Privacy explores the application of blockchain technology in enhancing user authentication and protecting user privacy within library systems. The decentralized and immutable nature of blockchain provides a robust alternative to traditional centralized authentication methods, which are often vulnerable to breaches and unauthorized access. By utilizing blockchain, libraries can implement a secure and transparent system for verifying user identities, significantly reducing the risk of data tampering and unauthorized access. This study delves into the specifics of how blockchain can safeguard user data, ensuring confidentiality and integrity. Additionally, the use of blockchain for identity management in libraries is examined, demonstrating its potential to offer a streamlined, tamper-proof, and trustless environment for identity verification. Blockchain's ability to enhance data security and protect user privacy makes it an ideal solution for modernizing library management systems.
Medical research benefits from large quantities of high-quality data. Internet-based data-sharing platforms bring the advantage of rapidly sharing data medical data. However, ensuring security and accountability in networked medical systems remains a challenge. In this paper, we propose a secure and auditable data-sharing platform for hospitals and research groups based on a distributed ledger. A two-party protocol for recoverable key agreement lies at the basis of securing the data sharing. This protocol enables two parties to agree on an encryption key and put the encryption key under the escrow of a board of semi-trusted auditors. A quorum of these auditors is required in order to recover the encryption key. The recoverable key agreement ensures that past communication can be audited, even if one of the two parties is malicious. We provide a realization of the protocol and analyze its complexity and performance. Based on these analyses, we demonstrate that the protocol is suitable for real-world use cases and resource-constrained devices.
Vehicular platooning offers several advantages and plays an important role in the future of mobility. However, this technology is vulnerable to several attacks. Since vehicles can freely join and leave a platoon, it is important to ensure that only legitimate vehicles are admitted into a platoon. In this paper, we propose a mutual authentication protocol to securely admit vehicles into a platoon. The proposed protocol is built on the concepts of Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs). Each vehicle creates its DID which helps to achieve vehicle identity privacy. The vehicles must register with a Trusted Authority (TA) to join platoons. The TA issues a VC to the registered vehicle. The platoon leader and the vehicle joining the platoon verify each other’s VC before the vehicle joins the platoon. The security analysis demonstrates that the proposed protocol ensures secure platoon admission and preserves the privacy of vehicles. We also provide a proof of concept implementation of the blockchain network for the proposed scheme using Ethereum. We use the online Integrated Development Environment (IDE) Remix to compile and run the smart contract written in Solidity code for the proof of concept implementation. A performance analysis of the proposed protocol shows that its computation cost is less than that of other existing schemes for platoon admission.
The 6G communication network emerged with the developments in new generation Information and Communication Technologies such as Artificial Intelligence, Virtual Reality/Augmented Reality/Extended Reality, Internet of Things, blockchain technology, etc. The development of 6G has a profound impact on the intelligence process of communication development that consists of intelligent connectivity, deep connectivity, holographic connectivity, and ubiquitous connectivity. Security solutions in terms of distributed ledger technology (DLT), physical layer security, quantum communication, and distributed AI/ML are provided. The Distributed Ledger Technology threats include Majority attack/51% attack, other attacks, etc. The possible solutions include proper access control and authentication mechanisms, selecting the proper blockchain/DLT type according to the 6G application and services, etc. The Physical Layer Security requires line of sight transmission which can be overcome by multipath transmission in Terahertz Technology, broadcast nature of visible light communications which can be overcome by enhancing secrecy performance by using multiple input multiple output technology, Quantum cloning attacks and quantum collision attacks. The poisoning attacks, evasion attacks, and API-based attacks can affect distributed and scalable AI/ML that can be overcome by adversarial training injects, defensive distillation, etc. Finally, the road map for materializing 6G security visions into a reality is provided.
Biagio Boi, Franco Cirillo, Marco De Santis, Christian Esposito
Context: The digitalization of the healthcare sector faces significant challenges due to the diverse representation of data and their distribution across various hospitals. Moreover, security is a key concern as healthcare-related data are subject to the legal obligations of General Data Protection Regulation (GDPR) and similar data protection legislation. Standardization efforts like Health Level Seven (HL7) have been implemented to enhance data interoperability. However, authentication still remains a critical issue with significant challenges. Aim: This research aims to improve and strengthen the authentication process by introducing a novel architecture for decentralized authentication. Additionally, it proposes a new approach to decentralized data management, which is crucial for handling sensitive medical data efficiently. Methodology: The proposed architecture adopts a user-centric approach, utilizing Self-Sovereign Identity (SSI). It introduced a new non-fungible token (NFT) type called soulbound token (SBT) in the medical context, which will facilitate user authentication across different hospitals, effectively creating a federation of interconnected institutions. Results: The implementation of the proposed architecture demonstrated a significant reduction in authentication time across multiple hospitals. The use of SBT ensured secure and seamless user authentication, enhancing overall system interoperability and data security. The decentralized approach also mitigated the risks associated with centralized authentication servers. Conclusion: This study successfully presents a novel decentralized authentication architecture for the healthcare domain, leveraging SSI and SBTs. This approach accelerates the authentication process and enhances data security and interoperability among hospitals. Future research should explore the scalability of this architecture and its application in other sectors requiring stringent data security measures.
In the contemporary landscape of the battlefield, the enhanced cyber warfare capabilities of adversaries mandate that routing protocols are equipped with endogenous security features. These features must be capable of detecting threats promptly and addressing them effectively to ensure both security and control. They also provide secure configuration options for the intrinsic security architecture of communication nodes within communication systems. This paper introduces a novel, inherently secure identity verification system named ORCA, which utilizes the concept of noninteractive zero-knowledge proof. ORCA streamlines the process of node identity authentication by minimizing communication exchanges, thereby safeguarding network topology integrity and establishing trust upon network formation. Leveraging this framework, the ORCA-OLSR security protocol was developed. Comparative simulations on the OPNET platform between the ORCA-OLSR and the challenge-response mechanism-based CA-OLSR security protocol demonstrate that ORCA-OLSR outperforms its counterpart in metrics such as routing overhead, end-to-end delay, and routing load.
This paper explores the synergetic potential of blockchain technology and attribute-based encryption to enhance security and privacy in decentralized data sharing systems, particularly within healthcare. We introduce PAVA, a novel privacy-preserving attribute-based scheme, which leverages smart contracts for verifiable authentication and ensures secure data interactions in healthcare applications. The scheme incorporates dual access policies: a data provider policy and a data user policy, which respectively authorize data providers to write (encrypt) and data users to read (decrypt) health data records. Encrypted health data records are stored on a blockchain within a healthcare smart contract, which enforces these access policies while keeping them confidential from unauthorized users and the smart contract itself. This arrangement allows for verifiable authentication checks on both the data providers (user authentication) and the integrity of the data they submit (data authentication) without revealing specific policy attributes. PAVA employs ciphertext-policy attribute-based encryption with partially hidden access policies based on linear secret sharing schemes (LSSS) and integrates blind access policies to facilitate verifiable authentication. Furthermore, the security of PAVA can be proved using the dual system encryption technique under static assumptions in the standard model, demonstrating its robustness and applicability in real-world healthcare data sharing scenarios.
Vehicular ad hoc networks (VANETs) establish wireless connections among all vehicles, enabling seamless mobile communication. However, existing conditional privacy protection VANETs authentication schemes fail to address the issue of potential key-exposure and do not provide accelerated vehicle authentication. In this paper, we propose a reputation incentive committee-based secure conditional dual authentication scheme for VANETs called RIC-SDA. Our proposed scheme incorporates dual authentication of the consensus committee and vehicle-to-vehicle (V2V) communication. It enables the rapid provision of dynamic vehicle epoch-key from consensus committee authentication for V2V authentication through our designed reputation incentive mechanism. To mitigate the potential key-exposure problem, we introduce a novel concept of secure vehicle epoch communication, which means V2V authentication is valid for only one epoch blockchain unit time. The proposed scheme achieves lightweight computation and incurs minimal communication overheads, with the signature size being just 137 bytes. The RIC-SDA scheme supports fast batch verification. We prove that our proposed scheme is unforgeable security under random oracle and demonstrate its feasibility by implementing it in a test network based on Ethereum Sepolia. The results demonstrate that our RIC-SDA solution outperforms the existing state-of-the-art authentication VANET schemes regarding efficiency and communication costs.
The application of Internet of Vehicles (IoV) technology has greatly improved users’ driving experience, but it also faces some challenges: 1) the central server is not powerful enough to support the rapid growth of IoV identity authentication requests and 2) there is a privacy leakage issue during vehicle authentication. To address these issues, we propose an anonymous authentication scheme based on trustworthy roadside unit group (TRUG)-PBFT main secondary chains and zero-knowledge proof (ZKP). First, to enhance authentication efficiency, we propose the TRUG-PBFT consensus algorithm. It improves the traditional PBFT by optimizing the PBFT consensus process, reducing the number of consensus nodes using fractional grouping, and selecting main node using verifiable random functions (VRFs). Second, we use a lattice-based ZKP scheme to achieve anonymous authentication of vehicles, and important data in the vehicle authentication process is stored by the main chain maintained by the base station group and the secondary chain maintained by the roadside unit group. Finally, experimental results demonstrate that compared to PBFT consensus, TRUG-PBFT in terms of consensus efficiency is improved by approximately 33%, and the authentication scheme’s computational cost is only 7.08 ms, superior to existing authentication schemes.
The Internet of Medical Things (IoMT) has emerged substantial growth within the healthcare sector, spurred by advancements in smart devices that generate and process critical healthcare data. Sharing this data among trusted healthcare entities is vital for efficient patient care but raises substantial security and privacy concerns. Existing solutions have focused on authentication techniques employing Self-Sovereign Identity (SSI) and Zero-Knowledge Proofs (ZKPs), aiming to ensure secure, auditable, and anonymous authentication. These solutions often prioritize either lightweight authentication or robust security, yet a flexible approach that integrates both characteristics is essential for adaptive cross-domain authentication in the IoMT landscape. Furthermore, the importance of lightweight authentication combined with adaptive verification, pivotal for scaling access control in cross-domain environments, has been underexplored in existing frameworks. Addressing this gap, we proposed a scheme called LSAC which is a lightweight, scalable, and anonymous authentication for SSI-based cross-domain authentication for IoMT setting. Our proposed LSAC scheme not only facilitates rapid and robust identity verification across multiple IoMT domains within a consortium blockchain network but also incorporates the advanced ZK-STARK and Plonk ZKP protocols to enable efficient and secure verification processes. By leveraging Hyperledger for generating smart contracts and managing user interactions across domains, our system represents a significant step forward in cross-domain authentication. Our comprehensive functionality and performance analysis confirms the effectiveness of our solution in providing scalable and secure access to IoMT resources, supporting the ongoing evolution of healthcare services.
In this thesis, the aim is to understand the possibilities and limitations of Zero Knowledge Proofs (ZKP) in blockchain technology. The first chapters focus on the presentation of distributed ledger systems and the tools that will be used, with particular reference to Remix, the IDE of choice for programming smart contracts in Solidity, and Sepolia, the Ethereum Testnet where the smart contracts were deployed. Subsequently, zero knowledge proofs are defined, their characteristics are explained, and the difference between interactive and non-interactive proofs is discussed; the latter will be emphasized as they are the most interesting in this context. The thesis then moves on to possible theoretical application contexts, with a particular focus on verifiable computation. Zokrates, a framework used to implement the non-interactive ZKP protocol, will be presented, explaining its language, features, functioning, and differences compared to other programming languages. A focal point for explaining how to implement verifiable computation will be introducing the various representations of an arithmetic circuit, fundamentally of textual and matrix types. Through various tests, the limitations of Zokrates and, to some extent, the entire arithmetic circuits sector for ZKP were highlighted. The thesis concludes with a possible implementation on the subject and an attack that this technology may be able to avoid.