In the field of cloud computing, ensuring secure and efficient key agreement among multiple parties has emerged as a paramount challenge. Traditional key agreement protocols often rely on central authorities or trusted third parties, posing significant security and privacy concerns. To address these challenges, this paper introduces a novel key agreement protocol designed specifically for cloud computing platforms, emphasizing security, efficiency, and resilience without depending on a trusted third party. The proposed protocol innovatively combines Distributed Key Generation (DKG) with a Dynamic Consensus Mechanism, Zero-Knowledge Proof (ZKP) based authentication, and a Multi-Cloud Redundancy approach, offering a comprehensive solution to secure multi-party communication in distributed cloud environments. The DKG protocol facilitates the collaborative generation of a shared secret among participants, significantly enhancing security by eliminating single points of failure. The proposed Dynamic Consensus Mechanism ensures the integrity and finality of key agreement transactions on a blockchain-based ledger, adapting to network conditions and participant trust levels to optimize performance without compromising security. ZKP-based authentication allows participants to verify their identities without revealing sensitive information, preserving privacy and thwarting impersonation attacks. Lastly, the Multi-Cloud Redundancy strategy enhances the protocol's resilience to cloud-specific vulnerabilities and service outages, ensuring high availability and robustness.
As the inevitable mode of the future intelligent transportation system, VANET still exists vehicle access authentication computational overhead, handover authentication inefficiency in the context of continuous development, simply using the traditional VANET architecture has been unable to adapt to the new complexity. Therefore, a hybrid blockchain-based privacy-preserving authentication scheme is proposed. Instead of using a single chain, the scheme combines the consortium and private chains, retaining the decentralization and high security of the consortium chain while leveraging the advantages of faster transactions, lower costs, and higher privacy in the private chain. Importantly, short signature technology and homomorphic encryption technology are proposed to further improve the efficiency of entity communication and protect the delivery of private data, respectively, while pre-authentication mechanism is used to further accelerate the cross-domain authentication of vehicles. The security analysis demonstrates the good privacy protection and attack resistance of this scheme. In addition, performance simulations and evaluations show that the proposed scheme requires the least computational and communication overhead compared to other schemes. It also performs better in terms of authentication delay and packet loss rate. Finally, the availability of the proposed scheme is explained through throughput and transaction cost analysis.
M. Albrecht, Matilda Backendal, Daniele Coppola, Kenneth G. Paterson
Nextcloud is a leading cloud storage platform with more than 20 million users. Nextcloud offers an end-to-end encryption (E2EE) feature that is claimed to be able “to keep extremely sensitive data fully secure even in case of a full server breach”. They also claim that the Nextcloud server “has Zero Knowledge, that is, never has access to any of the data or keys in unencrypted form”. This is achieved by having encryption and decryption operations that are done using file keys that are only available to Nextcloud clients, with those file keys being protected by a key hierarchy that ultimately relies on long passphrases known exclusively to the users. We provide the first detailed documentation and security analysis of Nextcloud's E2EE feature. Nextcloud's strong security claims motivate conducting the analysis in the setting where the server itself is considered malicious. We present three distinct attacks against the E2EE security guarantees in this setting. Each one enables the confidentiality and integrity of all user files to be compromised. All three attacks are fully practical and we have built proof-of-concept implementations for each. The vulnerabilities make it trivial for a malicious Nextcloud server to access and manipulate users' data. We have responsibly disclosed the three vulnerabilities to N extcloud. The second and third vulnerabilities have been remediated. The first was addressed by temporarily disabling file sharing from the E2EE feature until a redesign of the feature can be made. We reflect on broader lessons that can be learned for designers of E2EE systems.
Quantum cryptography represents a revolutionary paradigm shift in Smart contracts enable decentralized automation of agreements on blockchain platforms, enhancing transparency and trust. However, their immutable and public nature exposes them to various security vulnerabilities, including data leakage, unauthorized access, and execution flaws. This article explores advanced cryptographic solutions to secure blockchain smart contracts, focusing on zero-knowledge proofs, homomorphic encryption, multi-signature schemes, and secure multi-party computation. Through an in-depth analysis, the paper evaluates these cryptographic methods for their effectiveness in safeguarding confidentiality, integrity, and privacy of smart contract operations. Two comparative graphs illustrate the trade-offs between security strength, computational overhead, and privacy enhancement. The study concludes by highlighting future directions for optimizing cryptographic implementations to balance security and scalability.
Ardra Vinod, Malavika Vinodkumar, S Pranav, P Remyakrishnan
Vehicular Ad Hoc Network (VANET) is a particular subclass of the mobile ad-hoc network that raises several security challenges, notably how users authenticate the network. The work explores using zero-knowledge proofs for secure authentication while preserving user privacy and aims at encrypted information exchange between onboard units. Zero-knowledge proofs enhance security by protecting against impersonation attacks. We strive to reduce the dependence on roadside units for computational tasks by integrating the central authentication server and sub-authentication servers. We reduce modular exponentiation operations during authentication, enhancing efficiency without compromising security. We use the protocol verifier tool called Proverif to verify the security of our protocol. Simulation using the NS-2 simulator validates the protocol by varying the vehicle density. This paper advances VANET security by combining zero-knowledge authentication with encrypted information exchange, strengthening security, efficiency, and data confidentiality while reducing reliance on RSUs. Our protocol ensures secure communication in VANET with minimum computational and communication overhead.
Shalitha Wijethilaka, Awaneesh Kumar Yadav, An Braeken, Madhusanka Liyanage
The rapid evolution of heterogeneous applications signifies the requirement for network slicing to cater to diverse network requirements. Network Functions (NFs), which are the essential elements of network slices, are required to communicate with each other securely to facilitate network services. Certificates are the established method to authenticate each other. However, dynamic certificate management while allowing NFs to communicate in a multi-operator environment is arduous. Also, sharing NFs between network slices originates authorization-related security challenges such as unauthorized service utilization, deceptive Denial of Service attacks, and data leakages from network slices. In this paper, we develop a novel framework to address the security challenges related to authentication and authorization in 5G network slicing systems. A blockchain-based multi-party distributed certificate management framework with secure communication protocols is developed using elliptic curve cryptography to facilitate certificate services for multi-operator environments. Also, we propose a blockchain-based NF authorization framework to mitigate the security vulnerabilities in NF sharing between network slices. We implement the proposed framework using Hyperledger Fabric blockchain with Java chain codes and perform comprehensive experiments to show the significance of our framework.The Ability to mitigate the single point of failure with respect to state-of-the-art, including traditional certificate authorities and blockchain-based certificate authorities, time analysis for certificate generation, and the potential to eliminate the mentioned authorization attacks are some of the experiments conducted.Also, we have shown that our framework is secure using informal and formal (using Real-Or-Random (ROR) logic and Scyther Validation tool) security verification mechanisms.
Vehicle to vehicle (V2V) communications can facilitate traffic congestion control, reduce crashes, and enhance general safety. These goals can be reached only if vehicles communicate securely and anonymously. To this end, numerous key sharing protocols have been devised and proposed in recent years. Nevertheless, delving into the current vehicular protocols demonstrates that they have several drawbacks. First and the foremost, near all of them are improper for multi-domain internet of vehicle (IoV) environments and second, most of them failed to reach a proper tradeoff between security and effectiveness. Besides, the existing multi-domain protocols, which have been suggested for other applications, cannot still meet the desired requirements. To bridge this gap, this paper presents a resource-efficient privacy-preserving key sharing protocol for anonymous V2V communications in the IoV environments. In the proposed protocol, we utilize the blockchain and an inventive dual-signature approach. The former eases cross-domain authentication and the latter reduces the communication rounds. Security and efficiency analyses, respectively, indicate the protocol can withstand attacks and execute quite fast. Additionally, comparisons with top-related protocols show the suitable stage and precedence of the proposed multi-domain protocol.
In IoT(Internet of Things) Traditional authentication methods, such as passwords or public-key cryptography, often encounter challenges related to security, efficiency, and scalability. In response, Present work proposed a streamlined alternative utilizing Zero-knowledge proofs(ZKPs), allowing users to prove their identity with minimal exposure to sensitive information. Emphasizing the need for optimization in computational resources, this approach becomes particularly valuable in the context of Internet of Things application(IOTA). Current work introduces a novel method for authentication that combines the concept of isomorphic graphs from multi-graph ZKP with ZeroKnowledge Succinct Non-Interactive Argument of Knowledge (Zk-SNARKs), along with multi-threading in the IOTA ecosystem. This advancement represents a significant step forward in scalability and provides a solution to the increasing need for secure and effective authentication methods.
The trust management and the identity authentication in the Vehicular Edge Computing (VEC) is the critical part of data security. However, most of the existing authentication schemes fail to fully address the data trust issue among edge computing nodes in cross-regional communications, and lack anonymous security features. In this paper, a lightweight Multi-entity Authenticated Group Key Agreement (MAGKA) protocol is proposed for blockchain-based VEC networks. The proposed blockchain network built from the roadside units is to ensure the un-deniability of any data exchanged among the edge networks to provide data trust management. The MAGKA protocol substantiates the lightweight authentication between the vehicles, the roadside unit, and the trusted authority anonymously, allowing the vehicles to join or leave the edge network dynamically on the premise of ensured security. The security analysis shows that MAGKA protocol can resist common attacks effectively. In addition, the performance evaluation shows that the MAGKA reduces the computational cost for the low-power node and powerful node by 75% and 50%, respectively, over the existing authentication protocols.
Internet of Vehicles (IoVs) is increasingly used as a medium to propagate critical information via establishing connections between entities such as vehicles and infrastructures. During message transmission, privacy-preserving authentication is considered the first line of defence against attackers and malicious information. To achieve a more secure and stable communication environment, ever-increasing numbers of blockchain-based authentication schemes are proposed. At first glance, existing approaches provide robust architectures and achieve transparent authentication. However, in these schemes, verifiers need to conduct real-time operations in the blockchain (e.g., querying certificates). To remedy this limit, we propose a privacy-preserving blockchain-based authentication protocol with global-updated commitment (PBAG). In PBAG, based on the issued certificates, a public global commitment is computed, and a unique evaluation proof is generated for each authorized vehicle. Instead of querying the blockchain in real-time, verifiers can independently authenticate vehicles using the global commitment that is pre-updated with the assistance of the blockchain. Moreover, our scheme proposes a dynamic update mechanism to ensure the freshness of the global commitment and evaluation proofs. Benefiting from the update mechanism, there will be an authentication failure for vehicles holding invalid certificates when using the latest global commitment, thus avoiding the time-consuming of checking the Certificate Revocation List (CRL). In terms of privacy protection, our scheme provides privacy properties such as anonymity and unlinkability. It allows anonymous authentication based on evaluation proofs and achieves traceability of identity in the event of a dispute. The simulation demonstrates that the average computation cost of verifying per message is 0.36ms under the batch-enabled mechanism, reducing by more than 63.7% compared with existing schemes.
We discuss key management for cryptocurrencies from the perspective of security and risk management. While we found many earlier research studies about the implementation and security of wallets, few of them provide a comprehensive analysis of real-world integration as a complex system. We particularly focus on cryptocurrency custodians, who have to tightly control the risk to meet business needs as well as regulatory requirements. Unlike individual use cases, to manage substantial amounts of various assets, they typically need more complex wallet configurations and operations, such as multiple layers of hot and cold wallets in combination with different types of implementations. Therefore, we discuss the suitability of various wallet techniques, including software, hardware, HSMs, smart contracts, or cryptographic methods. We also address several open challenges for custodians mentioned in earlier work. Furthermore, as the ultimate example, we propose Extreme-Cold, a reference cold wallet in an air-gapped environment. It is resistant to side-channel attacks studied in earlier research. The risk assessment we conduct on Extreme-Cold demonstrates the effectiveness of our systematized knowledge.
Chien‐Ming Chen, Zhaoting Chen, Saru Kumari, Mohammad S. Obaidat · 6 authors
In the ever-evolving landscape of technology, healthcare continuously harnesses its benefits, propelling advancements in medical practices. Within intelligent healthcare, medical robots play a pivotal role, providing integral support to healthcare professionals, streamlining processes, and delivering efficient services. These robots securely transmit patient treatment plans, transferring them to cloud storage and subsequently storing them in blockchain systems. This innovative approach ensures the integrity and accessibility of patient data, introducing novel avenues for seamless interaction with medical information for hospitals and patients’ families. Despite these advantages, the looming privacy risks associated with sensitive patient data transmission pose a compelling challenge, demanding a comprehensive solution. In response to this challenge, we propose a mutual authentication and key agreement protocol designed to optimize healthcare services while prioritizing data security and patient privacy. To validate the robustness of our authentication protocol, we conduct thorough analyses based on both formal and informal models, establishing a foundational framework for evaluating the protocol’s security. Additionally, we perform a comprehensive comparative analysis, assessing the proposed protocol against existing counterparts across various dimensions. This comparative scrutiny reveals the superiority of our protocol in terms of security, as well as its efficiency in communication cost and computational overhead. These findings affirm the efficacy of our proposed solution in navigating the intricate interplay between medical robotics, blockchain, and data security.
Xiao Zhao, Suzhen Cao, Zheng Wang, D. Y. Xing · 5 authors
A traceable anonymous authentication ring signature scheme with privacy protection is proposed to solve the problem of tracking the identity of malicious signers in ring signatures and protecting the identity privacy of receiver. When the decrypted plaintext contains illegal words, the receiver can request to trusted third party (TTP) to trace the signer, the trusted third party (TTP) interaction with the ring member to find the signer. In avoid leaking the privacy information of receiver, and receiver’s privacy information or input data. Before identify tracing, scheme adopts zero-knowledge proof (ZKP) technology verify the legitimacy of receiver and protect the privacy of the receiver. At last, trusted third party (TTP) returns the public key of the traced signer to the receiver. Based on the computational Diffie-Hellman difficult problem, the scheme is proved to satisfy the security of signature unforgeability under the random oracle model. Compared with the existing schemes, the experimental results show that the scheme reduces the time of signature by 47.521%, the time of verification by 45.915%, and the time of traceability by 16.630%, which proves that the scheme is more effective.
Jo Vliegen, Md Masoom Rabbani, Wouter Hellemans, Nele Mentens
Over the past decade, an exponential rise in the deployment of Internet-of-Things (IoT) devices engulfed our surroundings. IoT devices have spread into domains like personal smart devices, industrial applications, military applications, and medical applications, to name a few. Brittle security features and large deployment in safety-critical systems make IoT devices an attractive target for cyberattacks. Large collections of data, ranging from personal, and oversensitive to financial data, make it crucial to safeguard IoT applications and data communication from cybercriminals. One key technique to deal with these cyberattacks is Remote Attestation (RA), in which a verifier remotely checks the sanity of an IoT device's firmware. However, implementing RA over large IoT networks can be challenging due to the dynamic nature of the network and the real-time aggregation of attestation results. We propose 'HAGAR: Hashgraph-based Aggregated Communication and Remote Attestation' to address the aforesaid challenges. HAGAR is a distributed ledger based on a hashgraph architecture that not only provides decentralized security guarantees like traditional blockchain technology, but also makes communication fast and thus offers continuous attestation aggregation in large IoT networks. We use the features of Hashgraphs for data aggregation in remote attestation mechanisms for large dynamic IoT networks.
Secure multiparty computation is a major field of research in modern cryptography. It allows for the creation of a protocol that maintains the privacy of the inputs and ensures that violation of the protocol results in no undue benefit to the violator or detriment to an honest party. These protocols can be used in many fields. In this dissertation, we explore the application of the mechanisms of secure party computation in the context of peer-to-peer lending, fair exchange with cryptocurrencies, consensus, and electronic voting. In all these areas, honesty of execution and fairness in the outcome should be assured or verifiable, especially if the other parties are not trusted. In this dissertation, we designed protocols to solve the above-mentioned problems, analyzed their efficiency and scalability, and proved their security. First, we present a platform called ZeroLender for peer-to-peer lending in Bitcoin. Our protocol utilizes zero-knowledge proofs to achieve unlinkability between lenders and borrowers while securing payments in both directions against potential malicious behavior of the ZeroLender as well as the lenders and covert action by the borrowers. We prove by simulation that our protocol is privacy-preserving. Based on our experiments, we show that the runtime and transcript size of our protocol scale linearly with respect to the number of lenders and repayments. Second, we propose a generic framework for atomic swap, called PolySwap, that enables fair exchange of assets between two {heterogeneous sets of blockchains}. Our construction preserves the anonymity of the swap by preventing transactions from being linked to each other or be distinguishable from other transactions on the blockchain and does not require any scripting capability in the blockchain, all without requiring a third party. We provide construction details of secret sharing signatures for ECDSA, Schnorr, and CryptoNote-style Ring signatures. Additionally, we provide an alternative contingency protocol, allowing parties to exchange to and from blockchains that do not support any form of time-locked escape transactions. We prove that PolySwap is secure against malicious adversaries, and is privacy-preserving against passive observers. We conducted experiments to demonstrate the efficiency of the protocol. Third, we propose ACCORD, a consensus protocol consisting of three distinct components: an asynchronous quorum selection procedure to designate the creators of future blocks, a block creation protocol run by the quorum to prevent omissions in the presence of honest quorum members, and a decentralized arbitration protocol to ensure consensus by voting. We implemented the protocol and conducted experiments to demonstrate scalability, robustness, and fairness. Finally, we introduce ORBIT, a cryptographic voting protocol that uses hidden credentials and mutable identities through ciphertext manipulation to prevent coercion. This enables voters to submit dummy ballots that are indistinguishable from genuine ones, thus enabling them to evade potential coercers, as well as preventing a fully compromised government from determining their voting preferences. ORBIT is blockchain-based, allowing government verifiers to process incoming ballots as they are submitted. We implemented ORBIT and performed experiments that illustrate its linear scaling in relation to three key variables: election size, the number of ring members within the anonymity set, and the number of ballots.
With the vigorous development of the Internet of Things (IoT), mobile users need to access data from other domains in edge computing. To achieve secure data sharing, mobile users first need to be authenticated by servers from different domains and then negotiate session keys among them. However, traditional schemes cannot solve cross-domain identity authentication and key agreement problems well due to the limited computational resources of IoT devices. In this work, we propose a Blockchain-based Cross-domain Authentication scheme for Edge computing, namely BCAE. First, to achieve secure identity verification, we design a novel cross-domain mutual identity authentication algorithm based on digital certificates and digital signatures. Next, to improve efficiency, we utilize the blockchain to share information among different domains to reduce the computation overhead. To realize quick key agreement, we apply the elliptic curve cryptography technique to design a lightweight key agreement algorithm and obtain secure session keys. Extensive experiments conducted on an actual smart healthcare issue to validate the performance of BCAE and formal security analysis confirmed the potential of the proposed work.
Mishri Saleh Al-Marshoud, Mehmet Sabır Kiraz, Ali H. Al-Bayati
Vehicular Ad Hoc Networks (VANETs) are powerful platforms for vehicular data services and applications. The increasing number of vehicles has made the vehicular network diverse, dynamic, and large-scale, making it difficult to meet the 5G network’s demanding requirements. Decentralized systems are interesting and provide attractive services because they are publicly available (transparency), have an append-only ledger (robust integrity protection), remove single points of failure, and enable distributed key management and communication in a peer-to-peer network. Researchers dedicated substantial efforts to advancing vehicle communications, however conventional cryptographic mechanisms are insufficient which enabled us to look at decentralized technologies. Therefore, we revisit decentralized approaches with VANETs. Endpoint devices hold a wallet which may incorporate threshold key management methods like MPC wallets, HD Wallets, or multi-party threshold ECDSA/EdDSA/BLS. We also discuss trust management approaches and demonstrate how decentralization can improve integrity, security, privacy, and resilience to single points of failure. We also conduct a comprehensive review, comparing them with current requirements, and the latest authentication and secure communication architectures, which require the involvement of trusted but non-transparent authorities in certificate issuance/revocation. We highlight the limitations of these schemes from PKI deployment and recommend future research, particularly in the realm of quantum cryptography.