Internet of Vehicles (IoV) is a typical application of mobile Internet of Things (IoT), which aims to improve road conditions and enhance the driving experience. However, the issue of identity leakage has drawn a major privacy concern during the vehicleâs authentication. It is impractical to apply traditional anonymous authentication methods directly to the IoV system due to their complex computation. To enhance the userâs privacy and the serviceâs efficiency, we propose a novel efficient anonymous authentication approach for the IoV based on the zero-knowledge proof (ZKP) and elliptic curve cryptography (ECC). We achieve the userâs strong anonymity and authenticity based on the FujisakiâOkamoto Commitment algorithm. In addition, the third trusted authority can effectively trace users by tracking usersâ verification keys. It holds the userâs traceability when a violation occurs. Meanwhile, we design a fast reconnection procedure based on the security context from the last access, which can reduce the computation overhead effectively. Through the security analysis, it proves that our scheme provides the anonymity, mutual authenticity, unlinkability, traceability, forward security, and replay-attack resistance. The experimental results indicate that our scheme has a better performance compared with the classic protocols in the IoV.
The futuristic fifth-generation cellular network (5G) not only supports high-speed internet, but must also connect a multitude of devices simultaneously without compromising network security. To ensure the security of the network, the Third Generation Partnership Project (3GPP) has standardized the 5G Authentication and Key Agreement (AKA) protocol for mutually authenticating user equipment (UE), base stations, and the core network. However, it has been found that 5G-AKA is vulnerable to many attacks, including linkability attacks, denial-of-service (DoS) attacks, and distributed denial-of-service (DDoS) attacks. To address these security issues and improve the robustness of the 5G network, in this paper, we introduce the Secure Blockchain-based Authentication and Key Agreement for 5G Networks (5GSBA). Using blockchain as a distributed database, our 5GSBA decentralizes authentication functions from a centralized server to all base stations. It can prevent single-point-of-failure and increase the difficulty of DDoS attacks. Moreover, to ensure the data in the blockchain cannot be used for device impersonation, our scheme employs the one-time secret hash function as the device secret key. Furthermore, our 5GSBA can protect device anonymity by mandating the encryption of device identities with Subscription Concealed Identifiers (SUCI). Linkability attacks are also prevented by deprecating the sequence number with Elliptic Curve Diffie-Hellman (ECDH). We use Burrows-Abadi-Needham (BAN) logic and the Scyther tool to formally verify our protocol. The security analysis shows that 5GSBA is superior to 5G-AKA in terms of perfect forward secrecy, device anonymity, and mutual Authentication and Key Agreement (AKA). Additionally, it effectively deters linkability attacks, replay attacks, and most importantly, DoS and DDoS attacks. Finally, the performance evaluation shows that 5GSBA is efficient for both UEs and base stations with reasonably low computational costs and energy consumption.
A vehicular ad hoc network (VANET) is essential in building an intelligent transportation system that optimizes traffic conditions and makes traffic information conveniently accessible. However, malicious vehicles may disrupt the traffic order via propagating forged traffic/road information. Therefore, using digital certificates based on cryptography, some existing authentication schemes were proposed to manage vehiclesâ identities. At first glance, these schemes can effectively identify malicious vehicles. However, these schemes require more computation and storage resources to maintain certificates. This is because the data storage of the database increases in a near-linear trend as the number of certificates grows. In this paper, we propose an efficient blockchain-based authentication scheme for secure communication in VANET (EBAS) to address the aforementioned issues. In EBAS, the regional trusted authority (RTA) receives traffic messages uploaded by the vehicle, together with transactions constructed via the unspent transaction output (UTXO) model. The verifier checks the legitimacy of the single input contained in the uploaded transaction to verify the legitimacy of the message senderâs identity. In terms of privacy preservation, a asymmetric key encryption technique, elliptic curve cryptography (ECC), is applied for constructing the transaction pseudonym, and users participate in the authentication process anonymously. In addition, our scheme guarantees the scalability of EBAS by proposing a transaction update mechanism, which can keep data storage at a stable level rather than near-linear growth. Under the simulation, the retrieving overhead remains at approximately 0.32 ms while the storage cost is stable at around 32.7 M for the blockchain state database. In terms of authentication efficiency, the average overhead of the proposed scheme is around 0.942 ms, which outperforms the existing schemes.
While the amount of data produced and accumulated continues to advance at unprecedented rates, protection and concealment of data increase its prominence as a field of scientific study that requires more action. It is essential to protect privacy-sensitive data at every phase; at rest, at run, and while computations are executed on data. The zero-knowledge proof (ZKP) schemes are a cryptographic tool toward this aim. ZKP allows a party to securely ensure the data's authenticity and precision without revealing confidential or privacy-sensitive information during communication or computation. The power of zero-knowledge protocols is based on intractable problems. There is a requirement to design more secure and efficient zero-knowledge proofs. This demand raises the necessity of determining appropriate intractable problems to develop novel ZKP schemes. In this paper, we present a brief outline of ZKP schemes, the connection of these structures to group-theoretic intractable problems, and annotate a list of intractable problems in group theory that can be employed to devise new ZKP schemes.
Secure authentication between user equipment and 5G core network is a critical issue for 5G system. However, the traditional authentication protocol 5G-AKA and the centralized key database are at risk of several security problems, e.g. key leakage, impersonation attack, MitM attack and single point of failure. In this paper, a blockchain based asymmetric authentication and key agreement protocol (BC-AKA) is proposed for distributed 5G core network. In particular, the key used in the authentication process is replaced from a symmetric key to an asymmetric key, and the database used to store keys in conventional 5G core network is replaced with a blockchain network. A proof of concept system for distributed 5G core network is built based on Ethereum and ECC-Secp256k1, and the efficiency and effectiveness of the proposed scheme are verified by the experiment results.
Mishri Saleh Al-Marshoud, Ali H. AlâBayatti, Mehmet Sabır Kiraz
Security and privacy in vehicular ad hoc networks (VANETs) are challenging in terms of Intelligent Transportation Systems (ITS) features. The distribution and decentralisation of vehicles could threaten location privacy and confidentiality in the absence of trusted third parties (TTP)s or if they are otherwise compromised. If the same digital signatures (or the same certificates) are used for different communications, then adversaries could easily apply linking attacks. Unfortunately, most of the existing schemes for VANETs in the literature do not satisfy the required levels of security, location privacy, and efficiency simultaneously. This paper presents a new and efficient end-to-end anonymous key exchange protocol based on Yang et al. 's self-blindable signatures. In our protocol, vehicles first privately blind their own private certificates for each communication outside the mix-zone and then compute an anonymous shared key based on zero-knowledge proof of knowledge (PoK). The efficiency comes from the fact that once the signatures are verified, the ephemeral values in PoK are also used to compute a shared key through an authenticated Diffie-Hellman key exchange protocol. Therefore, the protocol does not require any further external information to generate a shared key. Our protocol also does not require an interference with the Roadside Units or Certificate Authorities, and hence can be securely run outside the mixed-zones. We demonstrate the security of our protocol in an ideal/real simulation paradigm. Hence, our protocol achieves secure authentication, forward unlinkability, and accountability. Furthermore, the performance analysis shows that our protocol is more efficient in terms of computational and communication overheads compared to existing schemes.
The secure Internet of Things (loT) increasingly relies on digital cryptographic signatures which require a private signature and public verification key. By their intrinsic nature, public keys are meant to be accessible to any interested party willing to verify a given signature. Thus, the storing of such keys is of great concern, since an adversary shall not be able to tamper with the public keys, e.g., on a local filesystem. Commonly used public-key infrastructures (PKIs), which handle the key distribution and storage, are not feasible in most use-cases, due to their resource intensity and high complexity. Thus, the general storing of the public verification keys is of notable interest for low-resource loT networks. By using the Distributed Ledger Technology (DLT), this paper proposes a decentralized concept for storing public signature verification keys in a tamper-resistant, secure, and resilient manner. By combining lightweight public-key exchange protocols with the proposed approach, the storing of verification keys becomes scalable and especially suitable for low-resource loT devices. This paper provides a Proof-of-Concept implementation of the DLT public-key store by extending our previously proposed NFC-Key Exchange (NFC-KE) protocol with a decentralized Hyperledger Fabric public-key store. The provided performance analysis shows that by using the decentralized keystore, the NFC- KE protocol gains an increased tamper resistance and overall system resilience while also showing expected performance degradations with a low real-world impact.
Security is a challenging issue for M2M/IoT applications due to the deployment, decentralization and heterogeneity of M2M and IoT devices. Typical security solutions may not be suitable for M2M/IoT systems regarding the difficulties encountered for their implementation on resource-constrained devices. In this paper, we discuss the architectures deployed for M2M communications and the security challenges, as well as the vulnerabilities and solutions to counter possible attacks. We present a lightweight design based on a private blockchain to secure wireless M2M communications at the device domain level. Blockchain integration provides secure storage of data while preserving integrity traceability and availability. Besides, the evaluation and experimentations under NS3 simulator of the proposed scheme show that the authentication mechanism is lightweight, and presents better performances comparatively to other protocols in terms of key parameters as communication and computational overheads, average delay and energy consumption.
The deployed vehicles in an Internet of Vehicles (IoV) can take intelligent decisions by means of exchanging the real-time traffic-related information between the vehicles and IoV infrastructures. This further reduces the probability of the traffic jams and accidents. However, the insecure (public) communication among the various entities in IoV makes various security threats and attacks that can be launched by passive/active adversaries present in the network. In view of this context, there is a need of an efficient cryptographic primitive which can produce single compact signature. A multi-signature scheme (MSS) empowers a collection of signers to conjointly sign a given message using a single compact signature that can be verified by any verifier. Herein, we put forward a new identity-based multivariate MSS, namelyMV-MSS, which is built on top of the intractability of multivariate-quadratic (MQ) problem. The fact is that multivariate public key cryptosystem provides fast, post-quantum safe and efficient primitives, which makes it the front runner candidate among the post-quantum cryptographic candidates.MV-MSSis proven to be secure in the existential unforgeability under chosen-message and chosen identity attack model if solving the MQ problem is NP-hard. We then incorporate the designedMV-MSSin IoV application where the leader (cluster head) selected from a group of vehicles in a dynamic cluster forms the multi-signatures on the messages securely received from its member vehicles. Later, the messages along with their multi-signatures are forwarded to the nearby road-side unit (RSU) of the cluster head, which are then forwarded to a cloud server in the blockchain center maintained by a Peer-to-Peer (P2P) cloud servers network. In this way, the messages and their signatures considered as transactions are put in blocks and added into a public blockchain with the help of consensus algorithm. A comparative study among the proposedMV-MSSand other existing schemes shows thatMV-MSSis efficient and secure as compared to other schemes. Finally, a blockchain implementation through simulation study has been performed to show its practical use in IoV application.
When given a cryptographic public verification key, a receiver needs to be sure about the authenticity of the sender. Whenever an adversary is able to replace a well-intended public verification key of one of two participants within a communication relationship, she is able to send maliciously signed messages, using her own secret key, thereby compromising the whole authorization system. To overcome these issues for small to medium-sized distributed sensor networks, we previously proposed the NFC-Key Exchange protocol. Using the NFC-KE challenge-response authorization scheme, an attacker will not be able to intercept any communication unless she is authorized by a centrally trusted authority. Though, the NFC-KE protocol considers only local file storages for the storing operations of the authorized public-keys. This approach is inherently vulnerable to any zero-day exploits that enable an attacker to infiltrate the filesystem. Additionally, once the central authority component is restarted or becomes corrupted, every previously exchanged key needs to be reauthenticated. By using the Distributed Ledger Technology (DLT) framework Hyperledger Fabric, this paper proposes a new extension concept for the NFC-KE protocol in order to enhance the security of the public-key store. By using this extension, the NFC-KE protocol gains increased tamper-resistance and outage resilience, due to the decentralized nature of the DLT.
The use of Electric Vehicles (EVs) has been gaining traction in recent years due to various reasons. While charging their EVs, users expose their identity and personal details, and an adversary being able to identify and track where users charge their EVs is a potential privacy threat. In this article, we propose a user-empowered privacy-preserving authentication protocol for EV charging based on Decentralized Identifier (DID) and Verifiable Credential (VC) to provide Zero-Knowledge Proof (ZKP)-security. The proposed method gives users full control over their identities and allows them to remain anonymous while charging from any station. Giving control over their identities empowers users. At the same time, by making use of the concept of VC, other parties can verify that a user is legitimate and authenticate the user before providing charging services. Hence, the proposed protocol makes the charging service available in a secure way, while empowering users and preserving their privacy.
Wireless medical sensor networks (WMSNs)-based medical systems are an emerging paradigm of the Internet of Medical Things (IoMT) in which the patients and doctors can access various healthcare services via wireless communication technology without visiting the hospital in person. However, an adversary attempts a variety of security attacks because the sensitive information in various fields is exchanged via an insecure channel. Thus, robust and lightweight authentication protocols are essential for providing dependable healthcare services in WMSN-based medical systems. Recently, Wang et al. (IEEE Internet of Things Journal, doi: 10.1109/JIOT.2021.3117762) proposed blockchain and physically unclonable functions (PUFs)-based lightweight authentication protocol for WMSN. They claimed that their protocol is resistant to cyber and physical security threats and also does provide necessary security requirements. However, we prove that their protocol is vulnerable to various security attacks, such as man-in-the-middle and session key disclosure attacks and also lacks mutual authentication. As a result, we propose a robust authentication protocol for WMSN using blockchain and PUF to address the security problems raised by Wang et al.âs scheme. we assess the security of the proposed scheme by using informal and formal security analyses, such as AVISPA simulation and the ROR oracle model. Furthermore, we present the testbed experiments using Raspberry PI 4 based on MIRACL Crypto SDK. Then, we show the performance of the enhanced scheme compared with related schemes based on testbed experiments. Consequently, our scheme is better suited for practical WMSN-based medical systems because it provides greater security and efficiency than competing schemes.
Advanced Authentication Protocols Security
User Authentication and Security Systems
Physical Unclonable Functions (PUFs) and Hardware Security
Abstract Autonomous vehicles (AV) can not only improve traffic safety and congestion, but also have strategic significance for the development of the transportation industry. With the continuous updating of core technologies such as artificial intelligence, sensor detection, synchronous positioning, and highâprecision mapping, the development of AV has been promoted. When 5G network is combined with Internet of Vehicles, the problems of AV can be solved by taking advantage of 5G ultraâlarge bandwidth, low latency and high reliability. However, when the user controls the vehicle remotely, a realâtime and reliable authentication process is needed, while minimizing the overhead of security protocols. Therefore, this article proposes a practical and secure multifactor user authentication protocol for AV in 5G network. By introducing nonâinteractive zeroâknowledge proof technology and physical uncloning function, the protocol completes mutual authentication and key agreement without revealing any sensitive information. The article proves the security of the protocol through BAN logic and the simulation of Scyther. And it can resist malicious attacks and provide more security features. The informal security analysis shows that the protocol can meet the proposed security requirements. Finally, we evaluate the efficiency of the protocol, and the results show that the protocol can provide better performance.
Abstract With the continuous development of blockchain technology, blockchain gradually becomes to play an important role in the fields of finance, medicine, and new energy. In the certification of the membership of the blockchain, a thirdâparty certificate authority (CA) is used for certification. Considering the centralized structure of CA, and it is difficult for users to evaluate the credibility of CA. A decentralized blockchain membership authentication scheme and a key agreement protocol based on the elliptic curve are proposed by us. The protocol effectively addresses the credibility and single point of failure problems of centralized CAs in the traditional model. Through analysis, our scheme can effectively perform user registration and membership authentication instead of CAs. The security and correctness of the protocol was also analyzed using the formal protocol analysis tool ProVerif and the Ck model. The key authentication protocol we proposed can resist a variety of attacks, and the computational time consumption and Communication costs are relatively low.
Kisung Park, Joonyoung Lee, Ashok Kumar Das, Youngho Park
With the ongoing revolutionary growth of the industrial Internet of Things and smart grid networks, smart grid (SG) communication has been acknowledged as a next-generation network for intelligent and efficient electric power transmission. In SG networks, smart meters (SMs) generally send requests for electricity demand to service providers (SPs), which deal with the requests for efficient energy distribution. However, SGs experience many security issues with the deployed SMs and untrusted wireless communication. To tackle these security issues, we propose a privacy-preserving authentication scheme for demand response management in SGs, called BPPS. It can resist various attacks and achieve secure mutual authentication with key agreement; moreover, it provides integrity of demand-response data using blockchain. Moreover, we perform the informal and formal (mathematical) security analysis to confirm that BPPS is secure against various attacks and achieves session key security, respectively. Furthermore, we conduct the performance and simulation analysis for SGs using NS3 and Ethereum testnet. Consequently, BPPS provides high-level security and can be applied to actual SG networks.
Yangxu Song, Frank Jiang, Syed Wajid Ali Shah, Robin Doss
With the development of 5G networking technology on the Internet of Vehicle (IoV), there are new opportunities for numerous cyber-attacks, such as in-vehicle attacks like hijacking occurrences and data theft. While numerous attempts have been made to protect against the potential attacks, there are still many unsolved problems such as developing a fine-grained access control system. This is reflected by the granularity of security as well as the related data that are hosted on these platforms. Among the most notable trends is the increased usage of smart devices, IoV, cloud services, emerging technologies aim at accessing, storing and processing data. Most popular authentication protocols rely on knowledge-factor for authentication that is infamously known to be vulnerable to subversions. Recently, the zero-trust framework has drawn huge attention; there is an urgent need to develop further the existing Continuous Authentication (CA) technique to achieve the zero-trustiness framework. In this paper, firstly, we develop the static authentication process and propose a secured protocol to generate the smart key for user to unlock the vehicle. Then, we proposed a novel and secure continuous authentication system for IoVs. We present the proof-of-concept of our CA scheme by building a prototype that leverages the commodity fingerprint sensors, NFC, and smartphone. Our evaluations in real-world settings demonstrate the appropriateness of CA scheme and security analysis of our proposed protocol for digital key suggests its enhanced security against the known attack-vector.
Abylay Satybaldy, Anton Hasselgren, Mariusz Nowostawski
Background: The increasing use of various online services requires an efficient digital identity management (DIM) approach. Unfortunately, the original Internet protocols were not designed with built-in identity management, which creates challenges related to privacy, security, and usability. There is an increasing societal concern regarding the management of these sensitive data, access to it, and where it is stored. Blockchain technology can potentially offer a secure solution to address these issues in a decentralized manner without centralized authority. This is important for e-health services where the patient and the healthcare provider often are required to prove their identity. Blockchain technology can be utilized for creating digital identities and making its management easier, thus giving a higher degree of control to the user than what current solutions offer. It can be used to create a digital identity on the blockchain, making it easier for individuals and entities to manage, giving them greater control over who has their personal information and how they handle it. In addition, it might be utilized to create a higher degree of trust and security for e-health applications. Objective: The aim of this research work was to review the state-of-the-art regarding blockchain-based decentralized identity management for healthcare applications. Based on this summary, we provide a viewpoint on how blockchain-based decentralized identity frameworks might be utilized for virtualized healthcare applications. Methods: This research study applied a scoping, semi-systematic review approach to summarize the state-of-the-art. Included identity management systems were evaluated based on seven criteria: autonomy, authority, availability, approval, confidentiality, tenacity, and Interoperability. Results: Seven blockchain-based identity management systems were included and evaluated in this work: these include solutions built with Ethereum, Hyperledger Indy, Hyperledger Fabric, Hedera, and Sovrin blockchains. Conclusions: DIM is crucial for virtual health care. Decentralized identity management for healthcare purposes is currently being explored in both academia and the private sector. More work is needed with the aim of improving the efficiency of current DIM solutions and to fully understand what technical frameworks are best suited for e-health applications.
Smart contracts have recently been adopted by many security protocols. However, existing studies lack satisfactory theoretical support on how contracts benefit security protocols. This paper aims to give a systematic analysis of smart contract (SC)-based security protocols to fulfill the gap of unclear arguments and statements. We firstly investigate \textit{state of the art studies} and establish a formalized model of smart contract protocols with well-defined syntax and assumptions. Then, we apply our formal framework to two concrete instructions to explore corresponding advantages and desirable properties. Through our analysis, we abstract three generic properties (\textit{non-repudiation, non-equivocation, and non-frameability}) and accordingly identify two patterns. (1) a smart contract can be as an autonomous subscriber to assist the trusted third party (TTP); (2) a smart contract can replace traditional TTP. To the best of our knowledge, this is the first study to provide in-depth discussions of SC-based security protocols from a strictly theoretical perspective.