Authenticated Key Agreement Scheme Research Articles

EPAKA: An efficient and privacy-preserving authenticated key agreement scheme based on physical security for VANET

Vehicular ad hoc network (VANET) has been a promising technology in smart transportation system, which can enable information exchange between vehicles and roadside units (RSUs). However, the privacy of vehicles and RSUs is a critical challenge in VANET, as they may expose sensitive information to malicious attackers or unauthorized parties. Many existing authenticated key agreement (AKA) schemes aim to protect the privacy of vehicles and RSUs, but they often neglect the physical security of the devices involved in the communication. Therefore, we propose an efficient and privacy-preserving AKA scheme in VANET, which embeds physical unclonable function (PUF) and fuzzy extraction (FE) technology. PUF is a physical device that generates random strings based on their intrinsic characteristics and external inputs, which can protect the secrets in the devices from being stolen by attackers. FE can compensate for the drawbacks of PUF affected by environmental factors. Our scheme preserves the identity privacy of legitimate RSUs and vehicles, as well as intercepts and traces the identity of malicious attackers. In addition, we eliminate the involvement of the third party (TP) in the AKA phase to better meet the high-speed driving of vehicles. Finally, we conduct formal and informal security analyses in random oracle model (ROM), which prove that our scheme can resist various attacks. We also show in the performance analysis that our scheme has the lowest computational cost, communication overhead, and total energy consumption.

Quantum-attack-resilience OTP-based multi-factor mutual authentication and session key agreement scheme for mobile users

Due to rapid advancements in hardware and mobile communication technologies, the usage of various mobile-based online applications is increasing tremendously. However, security and privacy are two of the most essential features of wireless communication. Using a Mutual Authentication and Session Key Agreement (MASK) scheme, an authorized mobile user can login to a remote server over the Internet. In quantum contexts, many of the MASK schemes are not secure. This paper proposes a One-Time Password (OTP) and biometric-based Multi-Factor MASK (OTP-MF-MASK) scheme for mobile users. We used Peikert’s authentication and reconciliation mechanism, defined for the post-quantum environments. The OTP-MF-MASK scheme used a password, mobile device, biometric, and OTP as login credentials. To avoid the biometric acquisition problem, we used the fuzzy extractor in the OTP-MF-MASK scheme. We proved that the OTP-MF-MASK scheme is semantically secure in the Random Oracle Model (ROM) based on the hardness assumption of the Ring Learning With Errors (RLWE) problem. The OTP-MF-MASK scheme is compared with state-of-the-art schemes to justify the attack-resilience and computation efficiencies in quantum environments.

2F-MASK-VSS: Two-factor mutual authentication and session key agreement scheme for video surveillance system

The trend for deploying Video Surveillance Systems (VSSs) in public places has become common practice to maintain effective law and order in modern civilization. Further, data access control and the proper management of surveillance data with valid users are desirable for the safety and security of the communities. This paper aims to develop practical solutions to protect VSSs against evolving threats and challenges. This paper proposes a Two-Factor Mutual Authentication and Session Key Agreement usable in VSS (2F-MASK-VSS) environments for real-time data storage and access. In 2F-MASK-VSS, lightweight cryptographic tools, viz. hash function and symmetric key encryption, are used to maintain the desirable security features. In 2F-MASK-VSS, a surveillance camera captures real-time data and sends them securely to a central server for storage through the established session key agreement among valid concerns. Moreover, 2F-MASK-VSS can protect access control among valid users. The security strength of 2F-MASK-VSS has been proven by formal and informal analysis. The BAN logic model, AVISPA and Scyther tools validate the attack-resilience of 2F-MASK-VSS. Furthermore, the security analysis in the random oracle model shows that 2F-MASK-VSS is provably secure. In addition, 2F-MASK-VSS has been implemented using the Raspberry PI testbed to demonstrate its practical implementation.

A secure and efficient authentication key agreement scheme for industrial internet of things based on edge computing

Industrial Internet of Things (IIoT) is a pivotal driving force behind the intelligent transformation of the global industrial system, bringing about a gradual shift in production methods. However, due to users completing remote access and data transmission through open channels, ensuring user legitimacy and data security has become an important factor in IIoT. In addition, resource limited users or devices need to collect and publish corresponding messages while also timely processing instant messages obtained from the network. Leveraging edge computing technology effectively mitigates the transmission time of messages, addressing the challenges of high computing pressure and prolonged response time associated with cloud server computing. Therefore, investigating authentication key agreement based on edge computing in the IIoT environment holds substantial theoretical significance and practical importance. This article introduces an IIoT authentication that ensures both security and efficiency by integrating elliptic curve cryptography and three-factor authentication. Within this scheme, the user and the edge server accomplish security authentication. Through security analysis, the proposed scheme is proven to meet the essential security requirements. Performance analysis shows that it achieves higher security, supports more functions, and achieves lower computational and communication costs compared to related schemes.

A lightweight group-based SDN-driven encryption protocol for smart home IoT devices

With the increasing adoption rate of Internet of Things (IoT) devices in smart home applications, it is vital to safeguard the privacy and security of information, communications among IoT devices and the underlying infrastructure. In open communication scenarios, an adversary can easily tamper with data transmitted by IoT communication devices. This paper proposes a softwarized lightweight authentication key agreement scheme for smart home applications in Software-Defined IoT (SDIoT) environment. The proposed scheme comprises registration, authentication, and key selection phases. Devices are registered in the registration phase after the successful completion of validation checks, while sessions’ keys are granted to the registered devices in the authentication phase. In the final phase, controllers classify IoT devices based on pre-defined parameters and impose class-specific access control based on classification. The security of the proposed scheme is validated using the widely accepted AVISPAs verification tool against a strong adversary. Simulation results demonstrate that our proposed scheme outperforms existing schemes in terms of running time, computation complexity, and energy consumption. It is found that the proposed scheme has significant cost-effectiveness.

A Decentralized Authenticated Key Agreement Scheme Based on Smart Contract for Securing Vehicular Ad-Hoc Networks

Since the communication channels in vehicular ad-hoc networks (VANETs) are wireless and open, malicious adversaries can monitor or fabricate messages transmitted across them. To secure vehicular communications, an authenticated key agreement (AKA) scheme needs to be designed for VNAETs. Traditional VANETs AKA schemes require the trusted authority (TA) to authenticate the legality of message and corresponding sender. However, the TA in these schemes is vulnerable to suffer from single-point-of-failure issues. Some blockchain-based VANETs AKA schemes have been proposed recently to address the deficiency. However, these schemes rely on the consortium or private blockchain in which TAs are still required for key generation, resulting that the practicality is limited. To solve the issue, we design a smart contract-based VANETs AKA scheme, where the AKA algorithm of our proposed scheme is implemented on smart contract deployed on a public blockchain system and the TA that is responsible for key generation will not be required. The security proof and analysis show that our proposed scheme satisfies the session-key semantic security and essential security and privacy requirements, respectively. The performance analysis demonstrates that our proposed scheme outperforms existing blockchain-based VANETs AKA schemes.

An Anonymous Authenticated Group Key Agreement Scheme for Transfer Learning Edge Services Systems

The visual information processing technology based on deep learning (DL) can play many important yet assistant roles for unmanned aerial vehicles (UAV) navigation in complex environments. Traditional centralized architectures usually rely on a cloud server to perform model inference tasks, which can lead to long communication latency. Using transfer learning (TL) to unload deep neural networks (DNN) to the edge-fog collaborative networks has become a new paradigm for dealing with the conflicts between computing resources and communication latency. However, ensuring the security of edge-fog collaborative networks entity is still challenging. For such, we propose an anonymous authentication and group key agreement scheme for the UAV-enabled edge-fog collaborative networks, consisting of UAV authentication protocol and collaborative networks authentication protocol. Utilizing the AVISPA assessment tool and security analysis, the security requirements and functional features of the proposed scheme are demonstrated. From the performance results of the proposed scheme, we show that it is superior to existing authentication schemes and promising.

Towards post-quantum authenticated key agreement scheme for mobile devices

Mobile device communication enables mobile devices to connect with each other, exchange data, and access services, where security is a crucial aspect to protect sensitive data and privacy. The authenticated key agreement (AKA) protocols ensure authorized and secure communication in such environments. As the security of current AKA protocols relies on the hardness of discrete logarithmic or factorization, it will lead to a greater threat in the post-quantum world. Consequently, Ding et al. created a lattice-based AKA scheme for the quantum world. Although the protocol is simple for mobile devices, it is susceptible to insider attacks. Moreover, the scope of efficiency enhancement of this protocol needs to be explored. Therefore, to provide a secure and efficient solution, a new lattice-based AKA scheme has been proposed in this paper. It is designed with the idea of zero knowledge-based authentication. Further, our protocol resists key mismatch, and signal leakage attacks and supports the reuse of the private key of the server, perfect forward secrecy, and anonymity features. Additionally, we have talked about how our protocol stacks up in terms of computing complexity when compared to competing with other zero knowledge-based authenticated key agreement systems.

Lattice-Based Three Party Authenticated Key Agreement Scheme in Medical IoT for Post-Quantum Environment

Lattice-Based Three Party Authenticated Key Agreement Scheme in Medical IoT for Post-Quantum Environment

Provably Secure and Lightweight Authentication Key Agreement Scheme for Smart Meters

Smart Grid is an indispensable part of the Internet of Things (IoT) and has the potential to revolutionise the electricity energy industry. Smart meters, as an important component of Smart Grid, are responsible for the exchange of information between end consumers and service providers. Smart meters and service providers need to use authentication key exchange protocols (AKE) to establish a secure session for secure information transmission. However, The current state-of-the-art lightweight solutions do not support identity anonymity and mostly have high communication costs. This paper proposes a lightweight and secure mutual authentication scheme, which is particularly designed for devices with limited computing capability to provide identity anonymity such as smart meters, based on the Shangyong Mima 2 (SM2) AKE protocol stipulated by the State Cryptography Administration of China. We conducted formal analysis of the security of the proposed scheme and proved its security. In addition, the computational overhead of the protocol was evaluated through performance analysis. Compared with related lightweight protocols, our scheme can reduce up to 30%-40% computational overhead. The results verified that the proposed scheme is indeed suitable for secure communication involving devices with constrained computing capability.

Improved SRP algorithm and bidirectional heterogeneous LTE‐R authentication key

AbstractDue to the problems that International Mobile Subscriber Identity is not encrypted during transmission, key disclosure, and high authentication overhead in Evolved Packet System‐Authentication and Key Agreement, the next generation of high‐speed railway Long‐Term Evolution for Railway train ground authentication protocol, this paper describes the improved Secure Remote Password algorithm and two‐way heterogeneous Long‐Term Evolution for Railway authentication key agreement scheme. First, the improved Secure Remote Password algorithm is used to encrypt the message transmission between User Equipment and Mobility Management Entity, solving the problem of International Mobile Subscriber Identity being not encrypted during transmission. Then, a two‐way heterogeneous digital signature method of Public Key Infrastructure and Identity‐Based Cryptosystem is proposed to authenticate and negotiate with the Mobility Management Entity and Home Subscriber Server, which improves the security of the root key and can effectively prevent man in the middle, replay and other attacks. Finally, in the research results, the random oracle model is used to verify, and the results show that our method is superior to the comparison method in security and authentication cost, and can meet the Long‐Term Evolution for Railway communication requirements.

A provably secure and PUF-based authentication key agreement scheme for cloud-edge IoT

With the exponential growth of intelligent Internet of Things (IoT) applications, Cloud-Edge (CE) paradigm is emerging as a solution that facilitates resource-efficient and timely services. However, it remains an underlying issue that frequent end-edge-cloud communication is over a public or adversary-controlled channel. Additionally, with the presence of resource-constrained devices, it's imperative to conduct the secure communication mechanism, while still guaranteeing efficiency. Physical unclonable functions (PUF) emerge as promising lightweight security primitives. Thus, we first construct a PUF-based security mechanism for vulnerable IoT devices. Further, a provably secure and PUF-based authentication key agreement scheme is proposed for establishing the secure channel in end-edge-cloud empowered IoT, without requiring pre-loaded master keys. The security of our scheme is rigorously proven through formal security analysis under the random oracle model, and security verification using AVISPA tool. The comprehensive security features are also elaborated. Moreover, the numerical results demonstrate that the proposed scheme outperforms existing related schemes in terms of computational and communication efficiency.

A secure authentication and key agreement scheme with dynamic management for vehicular networks

The development of 5G communication, big data technology and intelligent transportation system has driven the rapid development of vehicle network (VANET). However, with the rapid development of vehicle networks, it will be invaded by various security problems, such as privacy disclosure, session key security, forward security, etc. To eliminate the security threats faced by the vehicle network and ensure privacy and secure communication between vehicles and roadside units(RSU), it is necessary to introduce a secure, reliable, and efficient authentication key agreement scheme. Therefore, based on the principle of challenge authentication handshake protocol, we propose a novel security authentication and key agreement scheme for the vehicle networks. The scheme meets mutual authentication, and is the session key of communication protocol between vehicle and roadside unit to resist common attacks. In addition, compared with other schemes, our scheme has the advantage that we can flexibly set time keys to constrain vehicle behaviour and achieve dynamic vehicle management. We also give a formal security proof of the scheme under the random oracle model (ROM). Finally, the efficiency of the protocol is evaluated, and the computing and communication overhead of our scheme is about 35% lower than that of the existing scheme. So, our scheme is more practical.

A Lightweight and Conditional Privacy-Preserving Authenticated Key Agreement Scheme With Multi-TA Model for Fog-Based VANETs

Recently, the fog computing concept has been introduced into vehicular ad-hoc networks (VANETs) to formulate fog-based VANETs. Since the communication channels between vehicles and fog nodes are open and insecure, it is necessary to construct an authenticated key agreement (AKA) scheme for securing the channels. The existing AKA schemes have two main deficiencies. One is that the computational and communication overhead are not low enough to satisfy the requirements of delay-sensitive applications. The other is that the multi-trusted-authority (multi-TA) model has not been considered. To solve the deficiencies, we propose a lightweight and conditional privacy-preserving AKA scheme, where the main steps are designed with symmetric cryptography methods. The design can reduce the computational and communication overhead of the AKA process. Additionally, we consider the multi-TA model in the AKA process to solve the single-point-of-failure issue. By integrating Cuckoo filter into the multi-TA model, the secrecy of real identities of legal vehicles is guaranteed and the identity revocation function for illegal vehicles is supported in the AKA process. The security proof and analysis show that our proposed scheme satisfies the essential security and privacy requirements of VANETs. The performance analysis shows that our proposed scheme outperforms other related and represented schemes.

Certificateless Cross-Domain Group Authentication Key Agreement Scheme Based on ECC

Focusing on the problem that existing traditional cross-domain group authentication schemes have a high complexity, a certificateless cross-domain group authentication key agreement scheme based on ECC is proposed. The protocol provides scalability and can meet the requirements of cross-domain key negotiation by multiple participants in different domains. Security analysis shows that the proposed scheme is secure in the random oracle security model, it can resist some attacks under the extended Canetti-Krawczyk (eCK) security model. Performance analysis shows that the proposed scheme is of strong practical application value with high efficiency; it costs relatively low amount of calculation and communication.

A Time-Sensitive Token-Based Anonymous Authentication and Dynamic Group Key Agreement Scheme for Industry 5.0

In Industry 5.0, the massive number of Internet of Things devices have increasing demands for group communication with a high communication efficiency and low energy consumption. However, group communication meets continuously increasing security risk challenges. Existing authentication and group key agreement schemes have encountered many problems, such as lack of anonymity and untraceability. In this article, we propose an anonymous authentication and dynamic group key agreement scheme based on the Blockchain and token mechanism, where each group member can apply for a time-sensitive token during the first authentication and only needs to check the validity of the token in the subsequent authentication, reducing the computational and transmission costs considerably. The verification on the security of the proposed scheme is tackled through mathematical analysis and validated using ProVerif, and comparisons with existing schemes demonstrate that the proposed scheme reduces the security risks and each group member’s energy consumption.

Extended Chaotic-Map-Based User Authentication and Key Agreement for HIPAA Privacy/Security Regulations

Background: The US government has enacted the Health Insurance Portability and Accountability Act (HIPAA), in which patient control over electronic protected health information is a major issue of concern. The two main goals of the Act are the privacy and security regulations in the HIPAA and the availability and confidentiality of electronic protected health information. The most recent authenticated key-agreement schemes for HIPAA privacy/security have been developed using time-consuming modular exponential computations or scalar multiplications on elliptic curves to provide higher security. However, these authenticated key-agreement schemes either have a heavy computational cost or suffer from authorization problems. Methods: Recent studies have demonstrated that cryptosystems using chaotic-map operations are more efficient than those that use modular exponential computations and scalar multiplications on elliptic curves. Additionally, enhanced Chebyshev polynomials exhibit the semigroup property and the commutative property. Hence, this paper develops a secure and efficient certificate-based authenticated key-agreement scheme for HIPAA privacy/security regulations by using extended chaotic maps. Results and Conclusions: This work develops a user-authentication and key-agreement scheme that solves security problems that afflict related schemes. This proposed key-agreement scheme depends on a certificate-management center to enable doctors, patients and authentication servers to realize mutual authentication through certificates and thereby reduce the number of rounds of communications that are required. The proposed scheme not only provides more security functions, but also has a lower computational cost than related schemes.

A Secure Key Agreement Scheme for Unmanned Aerial Vehicles-Based Crowd Monitoring System

Unmanned aerial vehicles (UAVs) have recently attracted widespread attention in civil and commercial applications. For example, UAVs (or drone) technology is increasingly used in crowd monitoring solutions due to its wider air footprint and the ability to capture data in real time. However, due to the open atmosphere, drones can easily be lost or captured by attackers when reporting information to the crowd management center. In addition, the attackers may initiate malicious detection to disrupt the crowd-sensing communication network. Therefore, security and privacy are one of the most significant challenges faced by drones or the Internet of Drones (IoD) that supports the Internet of Things (IoT). In the literature, we can find some authenticated key agreement (AKA) schemes to protect access control between entities involved in the IoD environment. However, the AKA scheme involves many vulnerabilities in terms of security and privacy. In this paper, we propose an enhanced AKA solution for crowd monitoring applications that require secure communication between drones and controlling entities. Our scheme supports key security features, including anti-forgery attacks, and confirms user privacy. The security characteristics of our scheme are analyzed by NS2 simulation and verified by a random oracle model. Our simulation results and proofs show that the proposed scheme sufficiently guarantees the security of crowd-aware communication.

An efficient authenticated key agreement scheme supporting privacy-preservation for smart grid communication

As a branch of the next generation grid, smart grid(SG) combines information and communication technology with traditional grid architecture, which can greatly improve the efficiency and reliability of traditional power systems. However, the tampering of power data in smart grid communications may lead to unclear decisions related to power demand management. So, a secure authentication method which achieves SG device validation in different regions is a basic requirement. In the paper, we put forth a secure authentication key agreement(AKA) scheme supporting privacy-preservation in SG communications. This scheme allows SG devices and service provider(SP) to establish secret session key through mutual authentication. With the session key, the sensitive information can be exchanged securely. Through rigorous security and performance analysis, our proposed solution has stronger security functions and higher computational efficiency than related solutions in the smart grid.

Security and Privacy Analysis of Vinoth et al.’s Authenticated Key Agreement Scheme for Industrial IoT

Vinoth et al. proposed an authenticated key agreement scheme for industrial IoT (Internet of Things) applications. Vinoth et al.’s scheme aimed to protect the remote sensing data of industrial IoT devices under hostile environments. The scheme is interesting because the authorized user is allowed simultaneously to access the multiple IoT sensing devices. Therefore, we carefully analyzed the security and privacy implications of Vinoth et al.’s scheme. Our findings are summarized as follows. One, Vinoth et al.’s scheme failed to defeat user impersonation attacks. Second, Vinoth et al.’s scheme did not prevent IoT sensing device impersonation attacks. Third, Vinoth et al.’s scheme suffered from replay attacks. Fourth, Vinoth et al.’s scheme was vulnerable to desynchronization attacks. Fifth, Vinoth et al.’s scheme could not maintain user privacy. As a case study, our analysis results enlighten researchers and engineers on the design of robust and efficient authenticated key agreement schemes for IoT applications.