Attribute-based Authentication Research Articles

Modified Attribute-Based Authentication for Multi-Agent Systems

Attribute-Based Encryption (ABE) is a type of authentication mechanism that validates both the users and their attributes. It is practical for the systems that need authorization according to credentials. In a multi-agent system, specifying an access policy within the user groups is crucial to enable authentic and confidential communication. This paper proposes an attribute-based authentication framework based on elliptic curves to provide privacy in multi-agent systems. In this system, we aim to alleviate the required burden of verification by ensuring that each unit verifies only a small amount of messages. Inspired by Zhang et al. [1], we use ABE for the multi-agent system to authenticate more than one user at a time; our scheme uses elliptic curve groups, unlike Zhang et al. We have thoroughly evaluated the various security attributes and discussed computational overheads for our proposed scheme.

A privacy-preserving attribute-based framework for IoT identity lifecycle management

The Internet of Things (IoT) has brought a new era of interconnected devices and seamless data exchange. As the IoT ecosystem continues to expand, there is an increasing need for effective identity management mechanisms, specifically for authorization processes and access control. The pervasiveness of such devices demands that desirable solutions tackle not only security properties but also privacy aspects like granular control over which identity data is shared in authentication/authorization processes, covering aspects like bootstrapping, enrolment, and service provision. In this context, it is natural to turn to privacy-enhancing technologies, like (privacy-preserving) Attribute-Based Credentials (p-ABC), for achieving both high security and privacy guarantees. Nonetheless, these technical tools need to be accompanied by a comprehensive approach that deals with the particularities of IoT scenarios and covers the full lifetime of the device. In this work, we propose the use of a p-ABC scheme with support for distributed issuance (dp-ABC) as a keystone for privacy-preserving attribute-based authentication and authorization in IoT scenarios. We integrate said cryptographic scheme with W3C’s Verifiable Credentials standard, evaluating its impact to gauge its feasibility. The integration facilitates adoption and, particularly, allows the solution to transparently coexist with simpler techniques in heterogeneous scenarios that demand them. Moreover, we define and analyse a generic and comprehensive framework for identity management that identifies challenges throughout the device’s lifetime to achieve IoT privacy-preserving identity management following self-sovereign principles. We show how the various aspects identified in the framework are tackled in a concrete instantiation as part of the H2020 project ERATOSTHENES.

Efficient and Flexible Multiauthority Attribute-Based Authentication for IoT Devices

The correctness and reliability of data sources are the keys to the practicality of data collected by IoT devices. Attribute-based signature(ABS) is a cryptographic primitive for users to sign with their own attributes, which can be applied to the authentication process in IoT scenarios. The attribute authority is responsible for issuing the attribute key to the user in ABS. Multiple authorities can complete attribute management tasks to avoid the threat of a single authority. However, attribute authorities need to execute multiple interactions to collaborate to generate attribute keys for users, which brings a large transmission burden. In addition, a lot of resource-constrained terminals in the IoT mostly play the role of signer or verifier in authentication protocols. The signature generation and verification algorithms often have heavy pairing and exponentiation operations. Currently, no ABS scheme takes into account the efficiency of all participating entities simultaneously. In this paper, we present an aggregated anonymous key issue (AAKI) protocol to reduce the transmission burden between multiple authorities. Meanwhile, the non-interactive zero-knowledge proof aggregate exponentiation (NI-ZKPoKAE) protocol is designed to aggregate the transmitted secret values in AAKI. To reduce the computational burden of signers and verifiers, Blakley secret sharing, where the Hadamard matrix is used more efficiently to handle the (n,n)-threshold, is used to construct an efficient and fine-grained multi-authority ABS (EFMA-ABS) scheme. This brings high efficiency to all three types of parties involved in IoT authentication. Our above-mentioned protocols have been proven to be feasible and effective.

Maximizing privacy and security of collaborative indoor positioning using zero-knowledge proofs

The increasing popularity of wearable-based Collaborative Indoor Positioning Systems (CIPSs) has led to the development of new methods for improving positioning accuracy. However, these systems often rely on protocols, such as iBeacon, that lack sufficient privacy protection. In addition, they depend on centralized entities for the authentication and verification processes. To address the limitations of existing protocols, this paper presents a groundbreaking contribution to the field of wearable-based CIPSs. We propose a decentralized Attribute-based Authentication (ABA) protocol that offers superior levels of privacy protection, untraceability, and unlinkability of user actions. Unlike existing protocols that rely on centralized entities, our approach leverages decentralized mechanisms for authentication and verification, ensuring the privacy of user location data exchange. Through extensive experimentation across multiple platforms, our results demonstrate the practicality and feasibility of the proposed protocol for real-world deployment. Overall, this work opens up new avenues for secure and privacy-preserving wearable-based CIPSs, with potential implications for the rapidly growing field of Internet of Things (IoT) applications.

Attribute-Based Pseudonymity for Privacy-Preserving Authentication in Cloud Services

Attribute-based authentication is considered a cornerstone component to achieve scalable fine-grained access control in the fast growing market of cloud-based services. Unfortunately, it also poses a privacy concern. Users attributes should not be linked to the users identity and spread across different organizations. To tackle this issue, several solutions have been proposed such as Privacy Attribute-Based Credentials (Privacy-ABCs), which support pseudonym-based authentication with embedded attributes. Privacy-ABCs allow users to establish anonymous accounts with service providers while hiding the identity of the user under a pseudonym. However, Privacy-ABCs require the selective disclosure of the attribute values towards service providers. Other schemes such as Attribute Base Signatures (ABS) and mesh signatures do not require the disclosure of attributes; unfortunately, these schemes do not cater for pseudonym generation in their construction, and hence cannot be used to establish anonymous accounts. In this paper, we propose a pseudonym-based signature scheme that enables unlinkable pseudonym self-generation with embedded attributes, similarly to Privacy-ABCs, and integrates a secret sharing scheme in a similar fashion to ABS and mesh signature schemes for attribute verification. Our proposed scheme also provides verifiable collusion, enabling users to share attributes according to the service providers policies.

Attribute-Based Authentication Scheme from Partial Encryption for Lattice with Short Key

Wireless network is the basis of the Internet of things and the intelligent vehicle Internet. Due to the complexity of the Internet of things and intelligent vehicle Internet environment, the nodes of the Internet of things and the intelligent vehicle Internet are more vulnerable to malicious destruction and attacks. Most of the proposed authentication and key agreement protocols for wireless networks are based on traditional cryptosystems such as large integer decomposition and elliptic curves. With the rapid development of quantum computing, these authentication protocols based on traditional cryptography will be more and more threatened, so it is necessary to design some authentication and key agreement protocols that can resist quantum attacks. In this paper, an anti-quantum authentication scheme for wireless networks based on lattice cryptosystem is constructed. In the attribute-based authentication scheme, the length of the authenticated public-private key pair depends on the maximum order and complexity of the formula in the algorithm. In the attribute-based authentication scheme, there is a certain correlation between the authenticated data and the attribute value of the user in the scheme. We show that the attribute-based authentication scheme gives an attribute-based with smaller public-private key pairs. The security of the attribute-based authentication scheme is based on the sub-exponential hard problem of the LWE (Learning With Errors). The Q-poly made by the adversary in the scheme, and our attribute-based authentication scheme guarantees that private data about user attributes and ciphertext cannot be obtained by malicious attackers.

Accountable attribute-based authentication with fine-grained access control and its application to crowdsourcing

Accountable attribute-based authentication with fine-grained access control and its application to crowdsourcing

Improving Unlinkability of Attribute-based Authentication through Game Theory

This article first formalizes the problem of unlinkable attribute-based authentication in the system where each user possesses multiple assertions and uses them interchangeably. Currently, there are no recommendations for optimal usage of assertions in such authentication systems. To mitigate this issue, we use conditional entropy to measure the uncertainty for a Relying Party who attempts to link observed assertions with user labels. Conditional entropy is the function of usage statistics for all assertions in the system. Personal decisions made by the users about the usage of assertions contribute to these statistics. This collective effect from all the users impacts the unlinkability of authentication and must be studied using game theory. We specify several instances of the game where context information that is provided to the users differs. Through game theory and based on conditional entropy, we demonstrate how each user optimizes usage for the personal set of assertions. In the experiment, we substantiate the advantage of the proposed rational decision-making approaches: Unlinkability that we obtain under Nash equilibrium is higher than in the system where users authenticate using their assertions at random. We finally propose an algorithm that calculates equilibrium and assists users with the selection of assertions. This manifests that described techniques can be executed in realistic settings. This does not require modification of existing authentication protocols and can be implemented in platform-independent identity agents. As a use case, we describe how our technique can be used in Digital Credential Wallets: We suggest that unlinkability of authentication can be improved for Verifiable Credentials.

Cloud Data Security through BB84 Protocol and Genetic Algorithm

In the current digitalized world, cloud computing becomes a feasible solution for the virtualization of cloud computing resources.  Though cloud computing has many advantages to outsourcing an organization’s information, but the strong security is the main aspect of cloud computing. Identity authentication theft becomes a vital part of the protection of cloud computing data. In this process, the intruders violate the security protocols and perform attacks on the organizations or user’s data. The situation of cloud data disclosure leads to the cloud user feeling insecure while using the cloud platform. The different traditional cryptographic techniques are not able to stop such kinds of attacks. BB84 protocol is the first quantum cryptography protocol developed by Bennett and Brassard in the year 1984. In the present work, three ways BB84GA security systems have been demonstrated using trusted cryptographic techniques like an attribute-based authentication system, BB84 protocol, and genetic algorithm. Firstly, attribute-based authentication is used for identity-based access control and thereafter BB84 protocol is used for quantum key distribution between both parties and later the concept of genetic algorithm is applied for encryption/decryption of sensitive information across the private/public clouds. The proposed concept of involvement of hybrid algorithms is highly secure and technologically feasible. It is a unique algorithm which may be used to minimize the security threats over the clouds. The computed results are presented in the form of tables and graphs.

A decentralized strongly secure attribute-based encryption and authentication scheme for distributed Internet of Mobile Things

Internet of Things (IoT) networks has been widely deployed as the distributed computing and communication component in the smart city. The security problems in the distributed IoT-assisted computing architecture are still noteworthy and has not been solved satisfactorily. So in this paper, to design and build an access control and admission detection model for the distributed IoT environment, we propose an IND-CCA-secure multi-authority ciphertext-policy ABE (MA-CP-ABE) scheme with outsourced decryption (OD) and progressive mode attribute-based authentication (ABAuthen). In our authenticaiton algorithm, by using the zero knowledge proof, the user’s secret will be protected from leaking out to the server. And due to the randomness of the authentication message, our authentication algorithm can resist the impersonation attacks by the malicious server. Finally, by the theoretical analysis and performance evaluation for our scheme with other state-of-art schemes, we can observe that our encryption and authentication schemes are both efficient and applicable for the distributed IoT-assisted cloud computing.

Publicly Traceable Attribute-Based Anonymous Authentication and Its Application to Voting

Numerous anonymous authentication schemes are designed to provide efficient authentication services while preserving privacy. Such schemes may easily neglect access control and accountability, which are two requirements that play an important role in some particular environments and applications. Prior designs of attribute-based anonymous authentication schemes did not concentrate on providing full anonymity while at the same time holding public traceability. To address this problem, we formally define and present a new primitive called traceable attribute-based anonymous authentication (TABAA) which achieves (i) full anonymity, i.e., both registration and authentication cannot reveal user’s privacy; (ii) reusable credential, i.e., a registered credential can be repeatedly used without being linked; (iii) access control, i.e., only when the user’s attribute satisfies the access policy can the user be involved in authentication; and (iv) public traceability, i.e., anyone, without help from the trusted third party, can trace a misbehaving user who has authenticated two messages corresponding to a common address. Then, we formally define the security requirements of TABAA, including unforgeability, anonymity, and accountability, and give a generic construction satisfying the security requirements. Furthermore, based on TABAA, we propose the first attribute-based, decentralized, fully anonymous, publicly traceable e-voting, which enables voters to engage in a number of different voting activities without repeated registration.

Attribute-Based Identity Authentication Scheme Based on Linear Codes

In the multi-user application environment, the simple use of user private key to achieve identity authentication is too single and can not carry out fine-grained access control to users. And there is the problem of user key management, which is easy to produce system bottleneck. In order to solve the above problems, a traceable and revocable attribute-based authentication scheme is constructed based on linear codes, which divides user access rights in a fine-grained manner. The method of direct revocation is adopted in the scheme, and the cost of revocation is lower. When a key abuse occurs or the system suffers a denial of service attack, the true identity of the malicious user can be tracked based on the signature. Finally, the MBDH problem proves that the scheme meets unforgeability, and the performance comparison and numerical analysis show that the scheme has a shorter key length and less computational overhead.

An online/offline distributed attribute-based authentication scheme

Attribute-based authentication is an effective cryptography mechanism, which makes it possible for service providers to implement fine-grained access control on cloud resources. Although many attribute-based authentication schemes have been proposed, most of them only support single attribute authority and users have to perform a large amount of computation in the authentication phase. By extending the ciphertext policy attribute-based encryption scheme of Rouselakis et al, a distributed attribute-based authentication scheme was designed. The feature of the new scheme is to optimize the online computation efficiency of both service providers and users, i.e., by introducing the technique of online/offline attribute-based encryption, the online computational burden of semi trusted servers is greatly reduced. On the other hand, by introducing outsourcing decryption, users’ computation in the authentication stage is independent of the size of underlying access structures. Compared with previous schemes, the new scheme satisfies several ideal properties, that is, introducing distributed authorities, supporting outsourcing computation, satisfying anonymity and unlinkability, and so on.

An efficient attribute-based authentication scheme with multiple authorities in public cloud

Currently, attribute-based authentication provides a feasible solution for fine-grained access control in cloud environment. However, the existing schemes can not solve the following problems at the same time, that is, how to ensure that the computation cost of the client does not depend on the size of underlying access structure, and how to introduce distributed authorities to manage and maintain the attribute universe. To solve the above problems, an efficient multi-authority attribute-based authentication scheme is proposed. The new scheme uses the technique of distributed attribute-based encryption to realize the access control of anonymous users, and reduces users’ computation burden by optimizing the standard implementation zero-knowledge proof and outsourcing users’ computing tasks in the authentication stage. Under the new definition of security, it can be proved that the new scheme is secure and satisfies many attractive properties, such as introducing distributed authorities, supporting outsourcing computation, satisfying attribute anonymity.

Securing communication by attribute-based authentication in HetNet used for medical applications

One of the major applications of the Heterogeneous Network (HetNet) is in the healthcare system. Deploying HetNet in healthcare systems enables patients, physicians, and other stakeholders to communicate easily with each other. Due to the large growth in the network’s subscribers, the security of the stored health data became one of the major concerns because unauthorized access to this data may lead to very serious complications, and unreliable transmission of data may lead to fatal risks to the patient’s life. Therefore, taking data integrity into consideration, user authentication has become one of the main factors. However, significant research work has been performed at HetNet’s physical layer to secure communication, but the result of this leads to an increase in hardware components. The increasing hardware components not only costs money but also power consumption. Therefore, this paper presents an alternate way of securing communication in HetNet at the network layer. However, resolving security problems at the network layer increases computational complexity. Nevertheless, earlier, some encryption techniques like identity-based encryption (IBE), symmetric key encryption (SKE), and public-key encryption (PKE) have been utilized for securing data. Due to their own disadvantages, this paper utilizes an attribute-based encryption (ABE) authentication scheme for securing health data in medical applications. With the help of this method, access to the intruders is denied which results in reduced communication overhead. This authentication scheme helps protect the essential information against attacks by the intruders. It includes a third party server that helps to authenticate and store patient’s information. The whole security technique has been written in the form of HLPSL (high-level protocol specification language) codes, and the results are then validated with the help of AVISPA (automated validation of Internet security protocols and applications) tool.

A lightweight attribute-based authentication system with DAA

In cloud computing environment, while preventing users from illegally accessing resources, various cloud service systems must provide protection for authorized users of their personal sensitive information. Attribute-based authentication (ABA) makes it possible to solve the above problems. An efficient ABA system was put forward by extending the direct anonymous attestation (DAA) scheme of Brickell et al. During the construction of the new system, the technique of lightweight ciphertext policy attribute-based encryption was adopted, and the online computing task of users was optimized. Compared with other similar systems, the new system is characterized by the use of trusted computing technology to improve the level of privacy protection of users, and the computational complexity of users in the authentication stage is independent of the size of access policy.

Killing the Password and Preserving Privacy With Device-Centric and Attribute-Based Authentication

Current authentication methods on the Web have serious weaknesses. First, services heavily rely on the traditional password paradigm, which diminishes the end-users' security and usability. Second, the lack of attribute-based authentication does not allow anonymity-preserving access to services. Third, users have multiple online accounts that often reflect distinct identity aspects. This makes proving combinations of identity attributes hard on the users. In this paper, we address these weaknesses by proposing a privacy-preserving architecture for device-centric and attribute-based authentication based on: 1) the seamless integration between usable/strong device-centric authentication methods and federated login solutions; 2) the separation of the concerns for Authorization, Authentication, Behavioral Authentication and Identification to facilitate incremental deployability, wide adoption and compliance with NIST assurance levels; and 3) a novel centralized component that allows end-users to perform identity profile and consent management, to prove combinations of fragmented identity aspects, and to perform account recovery in case of device loss. To the best of our knowledge, this is the first effort towards fusing the aforementioned techniques under an integrated architecture. This architecture effectively deems the password paradigm obsolete with minimal modification on the service provider's software stack.

Killing the Password and Preserving Privacy with Device-Centric and Attribute-based Authentication

Killing the Password and Preserving Privacy with Device-Centric and Attribute-based Authentication

Attribute-based multiuser authentication scheme between IoT devices for 5G environment

Background/Objectives: Due to the development of mobile communication technology, infrastructure construction from 4G to 5G service, which is currently being serviced, is actively under way. In particular, as the types and functions of mobile phones and IoT devices using 5G services are diversified, mutual authentication technology among multiple users is required.Methods/Statistical analysis: In this paper, we propose a multi - user authentication scheme which can efficiently mutually authenticate different types of mobile phones and IoT devices that are provided with 5G service. The proposed method minimizes the authentication delay time because it identifies the authentication security parameter δ of multiple users requesting authentication to the server as a polynomial coefficient. As a result of the performance evaluation, the proposed method showed an average improvement of 9.3% in authentication processing time and 5.5% lower overhead than the existing method. In addition, the multiuser authentication latency was improved by 6.1% on average compared with the existing scheme.Findings: The proposed scheme minimizes the user 's authentication delay time by constructing the users who simultaneously request the 5G service into a subnet and then applying the authentication security parameter δ constituting each subnet to n - bit and applying it to the polynomial coefficients. Especially, for multi - user authentication, the proposed scheme divides the authentication path into two paths (main path and secondary path) to guarantee user authentication and integrity. The proposed scheme is suitable for mobile phones and IoT devices that use low power because it generates keys without performing additional cryptographic algorithms like conventional techniques when performing multi - user authentication.Improvements/Applications: In future research, we plan to apply the proposed method to the actual environment based on the results of this study.  

Security Vulnerability Analysis and Solution Proposal to Smart Vehicle Network Environments

Interest and development in the field of smart automobiles is very high. We expect to be able to take a smart vehicle with no driver in the near future and move to any place. However, smart vehicle can be useful for multiple people, but risks that could not have been expected to occur. Therefore, we have been looking into the security vulnerabilities that may occur in smart vehicle networks and are being displayed. And among the security vulnerabilities of various smart vehicle networks that may occur from now on, smart vehicle using smart car authentication method using Digital signature-based information sharing method and smart using attribute-based authentication delegation method I would like to propose a car remote control method. We will study about our suggested mechanism on a simulator with future work.