Lu Wei, Jie Cui, Hong Zhong, Irina Bolodurina · 6 authors
Since the communication channels in vehicular ad-hoc networks (VANETs) are wireless and open, malicious adversaries can monitor or fabricate messages transmitted across them. To secure vehicular communications, an authenticated key agreement (AKA) scheme needs to be designed for VNAETs. Traditional VANETs AKA schemes require the trusted authority (TA) to authenticate the legality of message and corresponding sender. However, the TA in these schemes is vulnerable to suffer from single-point-of-failure issues. Some blockchain-based VANETs AKA schemes have been proposed recently to address the deficiency. However, these schemes rely on the consortium or private blockchain in which TAs are still required for key generation, resulting that the practicality is limited. To solve the issue, we design a smart contract-based VANETs AKA scheme, where the AKA algorithm of our proposed scheme is implemented on smart contract deployed on a public blockchain system and the TA that is responsible for key generation will not be required. The security proof and analysis show that our proposed scheme satisfies the session-key semantic security and essential security and privacy requirements, respectively. The performance analysis demonstrates that our proposed scheme outperforms existing blockchain-based VANETs AKA schemes.
Abstract With the increase of IoT devices generating large amounts of user-sensitive data, improper firmware harms users’ security and privacy. Latest home appliances are integrated with features to assure compatibility with smart home IoT. However, applying complex security mechanisms to IoT is limited by device hardware capabilities, making them vulnerable to attacks. Such attacks have recently become frequent. To address this issue, we developed a secure verification mechanism for firmware released by the device’s manufacturer. We proposed an IoT gateway for secure firmware verification and updating for smart home IoT devices utilizing the IOTA MAM (Masked Authenticated Messaging) protocol and a distributed file system with IPFS (Inter-Planetary File System) protocol. These two communication protocols ensure decentralized communication and firmware file distribution between the IoT device vendor and the IoT end device. The proposed scheme securely shares latest firmware content over IOTA and IPFS networks, performs a secure firmware update on IoT end devices and ensures authenticity and integrity of the firmware. Two types of validation methods were proposed for firmware updating and validation. We implemented the proposed scheme using three entities, Vendor, IoT gateway, and IoT end device. Our system yielded promising results in performing secure automated firmware updates on IoT end devices with very low computational power. The system’s functionality was implemented using IOTA’s MAM run on Raspberry Pi as an IoT gateway along with an ESP8266 Wi-Fi microcontroller, demonstrating the effectiveness of our approach. Our proposed methodology can be used for secure firmware distribution on home IoT applications.
A commitment scheme is a cryptographic tool that allows one to commit to a hidden value, with the option to open it later at requested places without revealing the secret itself. Commitment schemes have important applications in zero-knowledge proofs and secure multi-party computation, just to name a few. This survey introduces a few multivariate polynomial commitment schemes that are built from a variety of mathematical structures. We study how Orion is constructed using hash functions; Dory, Bulletproofs, and Vampire using the inner-product argument; Signatures of Correct Computation using polynomial factoring; DARK and Dew using groups of unknown order; and Orion+ using a CP-SNARK. For each protocol, we prove its completeness and state its security assumptions.
Lattice-based cryptography is one of the most promising candidates for designing post-quantum cryptographic algorithms that resist emerging quantum computing attacks. The recent NIST PQC standardization process is nearing its completion, with practical lattice-based algorithms for basic cryptographic functionalities (namely digital signature and public-key encryption) selected for standardization in the near future. However, practical lattice-based solutions for more advanced privacy-preserving protocols, in particular, Zero-Knowledge Proofs (ZKPs), have only emerged recently and are an active area of research. We discuss some recent developments in design and analysis of practical lattice-based post-quantum ZKPs and their applications. In particular, we review some challenges that arise in designing ZKPs in the lattice setting and some recent progress on efficient lattice-based Schnorr-like proofs for important relations, such as binary/range proofs, one-out-of-many proofs and rounding proofs [1, 2, 4]. We discuss applications and optimization of such proof systems as building blocks for practical advanced cryptographic protocols such as ring signatures and balance proofs for privacy-preserving cryptocurrency payment protocols [2, 3]. We also discuss our recent work on succinct designated-verifier ZKPs (DV-ZKSNARKS) for verifying correctness of general delegated computations [5].
Smart healthcare technology is transforming from the traditional healthcare system in every manner conceivably. Smart healthcare provides several advantages over the existing approaches. However, it suffers from healthcare data security and privacy issues. As the Internet attackers may get access to sensitive healthcare data through the use of various types of cyber attacks. In this paper, an architecture of a blockchain-enabled secure smart health monitoring system has been presented (in short, it is called as BSSHM). BSSHM consists of various health data monitoring sensors, i.e., temperature, heartbeat, etc., which monitor the real time health data of the different patients. The healthcare data of the patients can be transmitted to the connected health servers in a secure way, where this data can be stored securely for its various uses. The formal security verification of the proposed BSSHM is also done through the widely-accepted Scyther tool. It has been proved that BSSHM is able to defend various potential attacks.
With the rapid development of information and communication technology, vehicular AD hoc networks (VANETs) has attracted more and more attention. In order to provide traffic safety services, vehicles frequently share information related to road traffic, such as vehicle motion data and traffic flow data. Reliable key generation is the basis of VANET security system construction. Presently, most key generation schemes rely on a trusted third party, so there are security risks. Traditional key agreement protocols have high overhead, and is not suitable for the latency-sensitive requirements of VANET. The physical layer security technology extracts the fingerprint of the wireless channel and the identity of the device, and generates the key quickly and in real time without the third party distribution. A physical layer key generation scheme based on received signal strength (RSS) is proposed to realize Vehicle-to-Vehicle (V2V) secure communications. First, a network model based on long short-term memory (LSTM) network and the Kalman filtering is proposed to effectively enhance the reciprocity of physical layer information in dynamic environment. Second, a lossless quantization scheme is proposed, which achieves a lower bit disagreement rate and a higher bit generation rate. Third, the inconsistent bits are corrected by fuzzy extractor, the confidentiality of the key exchange process is enhanced by zero knowledge proof, and the security of the key is improved by using hash function for privacy amplification. Finally, the experimental results show that the proposed scheme has great improvements in data correlation, bit disagreement rate, bit generation rate and bit distribution randomness.
Awaneesh Kumar Yadav, An Braeken, Mika Ylianttila, Madhusanka Liyanage
The metaverse, which consists of several universes called verses, is predicted to be the Internet of the future. Recently, this idea has received a lot of discussions, but not enough attention has been paid to the security concerns of these virtual worlds. Primarily when the user and platform server communicate with each other and share sensitive information using the public channel, any attacker can capture the message and can perform various types of attacks such as privacy attack, violation of perfect forward secrecy, impersonation attack, ephemeral secret leakage attack and traceability attack. Therefore, there is impelling need to design an authentication protocol for the metaverse environment that can secure the communication between the user and the platform server. Taking this into account, we designed a zero-knowledge proof authentication protocol based on blockchain for the metaverse environment. The security of the designed protocol is verified through the Burrows-Abadi-Needham (BAN) logic, Scyther tool, and Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. The outcome of the security verification demonstrates that the designed metaverse authentication protocol mitigates all the attacks mentioned above. Moreover, we evaluated the performance of the designed metaverse authentication protocol in terms of computational, communication, storage costs, and energy consumption and compared it with existing metaverse authentication protocols, showing good results taking into account the additional security strength.
Xin Liu, Weitong Chen, Naixue Xiong, Dan Luo · 6 authors
Private set intersection (PSI) is a valuable technique with various practical applications, including secure matching of communication packets in the Internet of Things. However, most of the currently available two-party PSI protocols are based on the oblivious transfer (OT) protocol, which is computationally expensive and results in significant communication overhead. In this paper, we propose a new coding method to design a two-party PSI protocol under the semi-honest model. We analyze possible malicious attacks and then develop a PSI protocol under the malicious model using the Paillier cryptosystem, cut-and-choose, zero-knowledge proof, and other cryptographic tools. By adopting the real/ideal model paradigm, we prove the protocol’s security under the malicious model, which is more efficient compared to the existing related schemes.
Smart contracts self-executing code deployed on blockchain platforms have revolutionized the way digital agreements are formed and executed. Despite their decentralized nature and deterministic logic, vulnerabilities in code and execution environments can compromise their security. Cryptography is pivotal in safeguarding the integrity, authenticity, and confidentiality of smart contract operations. This paper explores cryptographic techniques that enhance smart contract trustworthiness, including digital signatures, zero-knowledge proofs, and verifiable computation. We assess how these methods reinforce security, compare frameworks across criteria like scalability and auditability, and present best practices for secure smart contract development
Threshold signatures are a fundamental cryptographic primitive used in many practical applications. As proposed by Boneh and Komlo (CRYPTO'22), TAPS is a threshold signature that is a hybrid of privacy and accountability. It enables a combiner to combine t signature shares while revealing nothing about the threshold t or signing quorum to the public and asks a tracer to track a signature to the quorum that generates it. However, TAPS has three disadvantages: it 1) structures upon a centralized model, 2) assumes that both combiner and tracer are honest, and 3) leaves the tracing unnotarized and static. In this work, we introduce Decentralized, Threshold, dynamically Accountable and Private Signature (DeTAPS) that provides decentralized combining and tracing, enhanced privacy against untrusted combiners (tracers), and notarized and dynamic tracing. Specifically, we adopt Dynamic Threshold Public-Key Encryption (DTPKE) to dynamically notarize the tracing process, design non-interactive zero knowledge proofs to achieve public verifiability of notaries, and utilize the Key-Aggregate Searchable Encryption to bridge TAPS and DTPKE so as to awaken the notaries securely and efficiently. In addition, we formalize the definitions and security requirements for DeTAPS. Then we present a generic construction and formally prove its security and privacy. To evaluate the performance, we build a prototype based on SGX2 and Ethereum.
The vehicular ad hoc networks (VANETs) offer additional opportunities for the development of intelligent transportation. Network-connected vehicles can help drivers adjust their driving environment and improve overall road safety by accessing information such as maps, signal status and road conditions. Due to the open nature of the communication channel, it is necessary for the receiving vehicle to verify the source and integrity of the message. Most of the existing researches are based on PKI certificate authentication model. However, there are some problems in this model: the distribution, storage and revocation of identity certificates need to consume a lot of vehicle resources, and the centralized structural framework cannot form an effective supervision of node operation. In order to solve the above problems, this paper proposes an identity authentication mechanism based on blockchain and zero-knowledge proof. In the blockchain structure composed of fog nodes, vehicles only need to store the generation seeds of communication pseudonyms to complete the communication within the coverage of fog nodes, which can effectively reduce the resource overhead caused by pseudonym distribution and revocation. Security analysis shows that our scheme can meet the security requirements of VANETs, and performance analysis shows that our scheme is better than existing schemes.
The correctness and reliability of data sources are the keys to the practicality of data collected by Internet of Things (IoT) devices. Attribute-based signature (ABS) is a cryptographic primitive for users to sign with their own attributes, which can be applied to the authentication process in IoT scenarios. The attribute authority is responsible for issuing the attribute key to the user in ABS. Multiple authorities can complete attribute management tasks to avoid the threat of a single authority. However, attribute authorities need to execute multiple interactions to collaborate to generate attribute keys for users, which brings a large transmission burden. In addition, a lot of resource-constrained terminals in the IoT mostly play the role of signer or verifier in authentication protocols. The signature generation and verification algorithms often have heavy pairing and exponentiation operations. Currently, no ABS scheme takes into account the efficiency of all participating entities simultaneously. In this article, we present an aggregated anonymous key issue (AAKI) protocol to reduce the transmission burden between multiple authorities. Meanwhile, the noninteractive zero-knowledge proof aggregate exponentiation (NI-ZKPoKAE) protocol is designed to aggregate the transmitted secret values in AAKI. To reduce the computational burden of signers and verifiers, Blakley secret sharing, where the Hadamard matrix is used more efficiently to handle the$(n, n)$-threshold, is used to construct an efficient and fine-grained multiauthority ABS (EFMA-ABS) scheme. This brings high efficiency to all three types of parties involved in IoT authentication. Our above-mentioned protocols have been proven to be feasible and effective.
Sandeep Kumar Arora, Gulshan Kumar, Mustapha Hedabou, El Mehdi Amhoud · 5 authors
Summary A decentralized application runs on the blockchain network without the intervention of a central authority. Transparency in transactions and security in vehicular networks are the issues for central systems. The proposed system uses blockchain‐based smart contracts, which eliminate the requirement for any third‐party verification. Additionally, with signature verification and reduced overhead, smart contracts also help in a fast and secure transaction. This study suggests a trust‐based system paradigm where certificate authority (CA) is employed for vehicle registration. We also propose a blockchain‐based system that provides efficient two‐way authentication and key agreement through encryption and digital signatures. The analysis of the proposed model reveals that it is an efficient way of establishing distributed trust management, which helps in preserving vehicle privacy. The proposed scheme is tested in Automated Validation of Internet Security‐sensitive Protocols (AVISPA), and security parameters verification in Network Simulator 2(NS2) also shows that the proposed scheme is more effective in comparison with existing schemes in terms of authentication cost, storage cost, and overhead.
Mahmoud A. Shawky, Muhammad Usman, David Flynn, Muhammad Ali Imran · 7 authors
Intelligent transportation systems are an emerging technology that facilitates real-time vehicle-to-everything communication. Hence, securing and authenticating data packets for intra- and inter-vehicle communication are fundamental security services in vehicular ad-hoc networks (VANETs). However, public-key cryptography (PKC) is commonly used in signature-based authentication, which consumes significant computation resources and communication bandwidth for signatures generation and verification, and key distribution. Therefore, physical layer-based secret key extraction has emerged as an effective candidate for key agreement, exploiting the randomness and reciprocity features of wireless channels. However, the imperfect channel reciprocity generates discrepancies in the extracted key, and existing reconciliation algorithms suffer from significant communication costs and security issues. In this paper, PKC-based authentication is used for initial legitimacy detection and exchanging authenticated probing packets. Accordingly, we propose a blockchain-based reconciliation technique that allows the trusted third party (TTP) to publish the correction sequence of the mismatched bits through a transaction using a smart contract. The smart contract functions enable the TTP to map the transaction address to vehicle-related information and allow vehicles to obtain the transaction contents securely. The obtained shared key is then used for symmetric key cryptography (SKC)-based authentication for subsequent transmissions, saving significant computation and communication costs. The correctness and security robustness of the scheme are proved using Burrows–Abadi–Needham (BAN)-logic and Automated Validation of Internet Security Protocols and Applications (AVISPA) simulator. We also discussed the scheme’s resistance to typical attacks. The scheme’s performance in terms of packet delay and loss ratio is evaluated using the network simulator (OMNeT++). Finally, the computation analysis shows that the scheme saves ∼99% of the time required to verify 1000 messages compared to existing PKC-based schemes.
Open access
Vehicular Ad Hoc Networks (VANETs)
Advanced Authentication Protocols Security
Advanced Steganography and Watermarking Techniques
Due to high effectiveness and robust security protocols, lattice-based cryptography becomes a very broadly applicable optimistic post-quantum technique that is recently used in public key cryptosystem. An aggregate signature scheme enables a party to bundle a set of signatures together into a single short cryptographic signature, which can be verified by any verifier using the public information. In this paper, we provide a lattice-based aggregate signature scheme where the security depends on the difficulty of the Ring Learning-with-Error (Ring-LWE) problem. Next, we use the basic scheme in Internet of Drones (IoD) applications using the blockchain technology for secure and transparent data storage. The detailed security analysis and comparative study show that the proposed scheme provides superior security including resistance to quantum attacks and is efficient as compared to the existing state of art approaches. The testbed experimental results and the blockchain simulation demonstrate that the proposed scheme can be applied in real-life drones applications.
Yan Zhuang, Chi‐Ren Shyu, Shenda Hong, Pengfei Li · 5 authors
BACKGROUND: Patient tokenization is a novel approach that allows anonymous patient-level linkage across healthcare facilities, minimizing the risk of breaching protected health information in health information exchange (HIE). Most patient tokenization is the centralized approach that is unable to address data security concerns fundamentally. Non-Fungible Tokens (NFT), which are non-transferable cryptographic assets on the blockchain, have the potential to provide secure, decentralized, and trustworthy patient tokenization. Self-Sovereign Identity (SSI) is a user-centric approach to verify the ownership of NFTs in a decentralized manner. METHODS: We have developed a blockchain architecture that contains four modules: (1) Creation module for NFTs creation, (2) Linkage module to link the local patients' accounts to their NFTs, (3) Authentication module that allows patients to permit healthcare providers to access their token, and (4) Exchange module, which involves the HIE process and the validation of the legitimacy of the token through SSI. RESULTS: A case study has been conducted on the proposed architecture. Over 3 million transactions have been completed successfully with a blockchain validation and written time of 1.17 s on average. A stability test has also been conducted with a higher throughput of 200 transactions per second running for an hour with an average transaction processing time of 1.42 s. CONCLUSIONS: This study proposed a blockchain architecture that achieves SSI-enabled NFT-based patient tokenization. Our architecture design, implementation, and case studies have demonstrated the feasibility and potential of NFT with SSI to establish a secure, transparent, and patient-centric identity management and HIE.
Keunok Kim, Jihyeon Ryu, Hakjun Lee, Youngsook Lee · 5 authors
Federated authentication, such as Google ID, enables users to conveniently access multiple websites using a single login credential. Despite this convenience, securing federated authentication services requires addressing a single point of failure, which can result from using a centralized authentication server. In addition, because the same login credentials are used, anonymity and protection against user impersonation attacks must be ensured. Recently, researchers introduced distributed authentication schemes based on blockchains and smart contracts (SCs) for systems that require high availability and reliability. Data on a blockchain are immutable, and deployed SCs cannot be changed or tampered with. Nonetheless, updates may be necessary to fix programming bugs or modify business logic. Recently, methods for updating SCs to address these issues have been investigated. Therefore, this study proposes a distributed and federated authentication scheme that uses SCs to overcome a single point of failure. Additionally, an updatable SC is designed to fix programming bugs, add to the function of an SC, or modify business logic. ProVerif, which is a widely known cryptographic protocol verification tool, confirms that the proposed scheme can provide protection against various security threats, such as single point of failure, user impersonation attacks, and user anonymity, which is vital in federated authentication services. In addition, the proposed scheme exhibits a performance improvement of 71% compared with other related schemes.
The Internet of Things (IoT) is ubiquitous in our lives. However, the inherent vulnerability of IoT smart devices can lead to the destruction of networks in untrustworthy environments. Therefore, authentication is a necessary tool to ensure the legitimacy of nodes and protect data security. Naturally, the authentication factors always include various sensitive users’ information, such as passwords, ID cards, even biological information, etc. How to prevent privacy leakage has always been a problem faced by the IoT. Zero-knowledge authentication is a crucial cryptographic technology that uses authenticates nodes on the networks without revealing identity or any other data entered by users. However, zero-knowledge proof (ZKP) requires more complex data exchange protocols and more data transmission compared to traditional cryptography technologies. To understand how zero-knowledge authentication works in IoT, we produce a survey on zero-knowledge authentication in privacy-preserving IoT in the paper. First, we overview the IoT architecture and privacy, including security challenges and open question in different IoT layers. Next, we overview zero-knowledge authentication and provide a comprehensive analysis of designing zero-knowledge authentication protocols in various IoT networks. We summarize the advantages of ZKP-based authentication in IoT. Finally, it summarizes the potential problems and future directions of ZKP in IoT.
Zero-knowledge proof is one of the techniques implemented in a variety of data security applications. ZKP is a security procedure between two parties, one as the prover and the other as the verifier. The prover and the verifier exchange information without allowing any kind of sensitive information to leak. In this paper, we mention the challenges and limitations that face the zero-knowledge technique when utilized in authentication and privacy protection processes in different environments. We help to produce improvements to the most common zero-knowledge protocol to show many factors that would have greatly contributed to the success of the authentication process.
Perubahan teknologi semakin lama semakin pesat diberbagai bidang, termasuk teknologi digital yang merupakan revolusi dari teknologi analog dan elektronik. Dekade ini semua serba bermetamorfosis menjadi digital, termasuk akhirnya muncul uang digital, yaitu cryptocurrency. Cryptocurrency sebagai bentuk digital cash beroperasi dengan bantuan teknik yang disebut kriptografi. Kriptografi sendiri adalah proses yang menerjemahkan semua informasi yang dapat dibaca menjasi kode yang tidak dapat dipecah sama sekali. Cryptocurrency menggunakan blockchain sebagai buku utama, yang semua sistemnya dikelola oleh yang disebut penambang. Mata uang crypto memiliki sistem yang sedikit rumit yang tidak dengan mudah dapat dipahami, jadi pengetahuan tentang cryptocurrency mau tidak mau harus dipelajari, dipahami agar dalam implementasi tidak mengalami dampak yang merugikan. Jenis jenis cryptocurrency, serta kekurangan dan kelebihannya akan dikupas sekilas dalam artikel ini.