Authenticated Key Agreement Protocol Research Articles

Provably Secure ECC-Based Anonymous Authentication and Key Agreement for IoT

With the rise of the Internet of Things (IoT), maintaining data confidentiality and protecting user privacy have become increasingly challenging. End devices in the IoT are often deployed in unattended environments and connected to open networks, making them vulnerable to physical tampering and other security attacks. Different authentication key agreement (AKA) schemes have been used in practice; several of them do not cover the necessary security features or are incompatible with resource-constrained end devices. Their security proofs have been performed under the Random-Oracle model. We present an AKA protocol for end devices and servers. The proposal leverages the ECC-based key exchange mechanism and one-way hash function-based message authentication method to achieve mutual authentication, user anonymity, and forward security. A formal security proof of the proposed scheme is performed under the standard model and the eCK model with the elliptic curve encryption computational assumptions, and formal verification is performed with ProVerif. According to the performance comparison, it is revealed that the proposed scheme offers user anonymity, perfect forward security, and mutual authentication, and resists typical attacks such as ephemeral secret leakage attacks, impersonation attacks, man-in-the-middle attacks, and key compromise impersonation attacks. Moreover, the proposed scheme has the lowest computational and communication overhead compared to existing schemes.

Towards post-quantum authenticated key agreement scheme for mobile devices

Mobile device communication enables mobile devices to connect with each other, exchange data, and access services, where security is a crucial aspect to protect sensitive data and privacy. The authenticated key agreement (AKA) protocols ensure authorized and secure communication in such environments. As the security of current AKA protocols relies on the hardness of discrete logarithmic or factorization, it will lead to a greater threat in the post-quantum world. Consequently, Ding et al. created a lattice-based AKA scheme for the quantum world. Although the protocol is simple for mobile devices, it is susceptible to insider attacks. Moreover, the scope of efficiency enhancement of this protocol needs to be explored. Therefore, to provide a secure and efficient solution, a new lattice-based AKA scheme has been proposed in this paper. It is designed with the idea of zero knowledge-based authentication. Further, our protocol resists key mismatch, and signal leakage attacks and supports the reuse of the private key of the server, perfect forward secrecy, and anonymity features. Additionally, we have talked about how our protocol stacks up in terms of computing complexity when compared to competing with other zero knowledge-based authenticated key agreement systems.

A Trusted Internet of Things Access Scheme for Cloud Edge Collaboration

With the rapid popularization of current Internet of Things (IoT) technology and 5G networks, as well as the continuous updating of new service lifestyles and businesses, the era of big data processing for the IoT has arrived. However, centralizing all data for processing in the cloud can lead to issues such as communication latency and privacy breaches. To solve these problems, edge computing, as a new network architecture close to terminal data sources and supporting low latency services, has gradually emerged. In this context, cloud edge collaborative computing has become an important network architecture. With the changing security requirements and communication methods of cloud edge collaborative network architecture, traditional authentication key agreement protocols are no longer applicable. Therefore, a new IoT authentication and key agreement protocol needs to be designed to solve this problem. This study proposes an IoT accessible solution for cloud edge collaboration. This scheme adopts a chaotic mapping algorithm to achieve efficient authentication. It ensures the anonymity and untraceability of users. Following this, we conducted strict security verification using BAN logic and Scyther tools. Through experimental comparative analysis, the research results show that the protocol performs better than other schemes while ensuring security. This indicates that the protocol can achieve efficient authentication and key negotiation in cloud edge collaborative network architecture, providing a secure and reliable solution for the accessibility of the IoT.

Cryptanalysis and Improvement of Several Identity-Based Authenticated and Pairing-Free Key Agreement Protocols for IoT Applications.

Internet of Things (IoT) applications have been increasingly developed. Authenticated key agreement (AKA) plays an essential role in secure communication in IoT applications. Without the PKI certificate and high time-complexity bilinear pairing operations, identity-based AKA (ID-AKA) protocols without pairings are more suitable for protecting the keys in IoT applications. In recent years, many pairing-free ID-AKA protocols have been proposed. Moreover, these protocols have some security flaws or relatively extensive computation and communication efficiency. Focusing on these problems, the security analyses of some recently proposed protocols have been provided first. We then proposed a family of eCK secure ID-AKA protocols without pairings to solve these security problems, which can be applied in IoT applications to guarantee communication security. Meanwhile, the security proofs of these proposed ID-AKA protocols are provided, which show they can hold provable eCK security. Some more efficient instantiations have been provided, which show the efficient performance of these proposed ID-AKA protocols. Moreover, comparisons with similar schemes have shown that these protocols have the least computation and communication efficiency at the same time.

Provably Secure Lightweight Mutual Authentication and Key Agreement Scheme for Cloud-Based IoT Environments.

A paradigm that combines cloud computing and the Internet of Things (IoT) allows for more impressive services to be provided to users while addressing storage and computational resource issues in the IoT environments. This cloud-based IoT environment has been used in various industries, including public services, for quite some time, and has been researched in academia. However, various security issues can arise during the communication between IoT devices and cloud servers, because communication between devices occurs in open channels. Moreover, issues such as theft of a user's IoT device or extraction of key parameters from the user's device in a remote location can arise. Researchers interested in these issues have proposed lightweight mutual authentication key agreement protocols that are safe and suitable for IoT environments. Recently, a lightweight authentication scheme between IoT devices and cloud servers has been presented. However, we found out their scheme had various security vulnerabilities, vulnerable to insider, impersonation, verification table leakage, and privileged insider attacks, and did not provide users with untraceability. To address these flaws, we propose a provably secure lightweight authentication scheme. The proposed scheme uses the user's biometric information and the cloud server's secret key to prevent the exposure of key parameters. Additionally, it ensures low computational costs for providing users with real-time and fast services using only exclusive OR operations and hash functions in the IoT environments. To analyze the safety of the proposed scheme, we use informal security analysis, Burrows-Abadi-Needham (BAN) logic and a Real-or-Random (RoR) model. The analysis results confirm that our scheme is secure against insider attacks, impersonation attacks, stolen verifier attacks, and so on; furthermore, it provides additional security elements. Simultaneously, it has been verified to possess enhanced communication costs, and total bit size has been shortened to 3776 bits, which is improved by almost 6% compared to Wu et al.'s scheme. Therefore, we demonstrate that the proposed scheme is suitable for cloud-based IoT environments.

Quantum Mutual Implicit Authentication Key Agreement Protocol without Entanglement with Key Recycling

Quantum Mutual Implicit Authentication Key Agreement Protocol without Entanglement with Key Recycling

Anonymous Lightweight Authenticated Key Agreement Protocol for Fog-Assisted Healthcare IoT System

The impact of fog-assisted Healthcare IoT (H-IoT) system is immense. The smart H-IoT equipments can upload healthcare information to fog nodes with low latency and high mobility. To facilitate secure interactions among three parties, including smart H-IoT equipments, fog nodes and a cloud server, over the public and insecure channels, a few authenticated key agreement (AKA) protocols are proposed. However, existing works are constructed based on expensive cryptographic primitives (e.g., bilinear pairing), which lead to high computation costs. Besides, the anonymity of H-IoT users is failed to be provided. To tackle these issues, an anonymous and lightweight three-party AKA protocol ALAKAP is proposed, which leverages an efficient cryptographic primitive (i.e., Chebyshev chaotic map operation) to generate a shared session key among three parties and achieve security (anonymity and other six properties) and efficiency simultaneously. It then formally proves the security of ALAKAP under the broadly accepted Burrows-Abadi-Needham (BAN) logic model and demonstrates how the proposed protocol satisfies the desired requirements in the fog-assisted H-IoT system. Finally, the performance of ALAKAP is validated by conducting the experiments on Amazon EC2 and Raspberry Pi. The results show that our work can achieve at least 44% higher improvement than the state-of-the-art works.

A strengthened eCK secure identity based authenticated key agreement protocol based on the standard CDH assumption

An Authenticated Key Agreement (AKA) protocol enables two communicating parties to compute a session key with equal partnership, such that each entity is assured of the authenticity of its peer. Identity-based AKA (ID-AKA) protocols facilitate implicit authentication of the participating entities, without certificate verification. However, most of the existing ID-AKA schemes are proven secure based on the strong Gap Diffie-Hellman (GDH) assumption. Currently, there are no known implementation methods to realize the GDH assumption without using bilinear pairings. Further, none of the existing ID-AKA protocols have provable security against practical attacks due to intermediate result leakages. To this end, we propose a purely pairing-free ID-AKA protocol based on the Computational Diffie-Hellman assumption. The protocol offers provable security under the strengthened eCK (seCK) model that captures attacks resulting from intermediate result leakages. Comparative analysis with other ID-AKA protocols suggests that the proposed protocol satisfies stronger security requirements, without the gap assumption.

Research on Lightweight Authentication and Key Agreement Protocol in Power Grid Based on the SM9 Cryptographic Algorithm

With the wide application of power grids, the massive heterogeneous terminals become important data collection nodes and data relay nodes. However, the openness of the power system exposes the power grid to various security threats. Authentication key agreement protocol can provide authentication and session key sharing services and is the most important technical means to protect the communication security of power grids. However, the design of authentication key agreement protocols for power grids faces many challenges. Firstly, the members of the power grid change frequently, and each new member needs to be authenticated with the edge side equipment every time it joins, so the existing authentication scheme has a large computational overhead. Furthermore, the network communication bandwidth is limited, and the existing schemes have a high time overhead due to the number of communication interactions when performing terminal authentication with the edge side equipment. Finally, the existing schemes all use non-national secret algorithms, which cannot achieve autonomous control. This paper designs a lightweight power grid authentication key agreement protocol based on the state-secure SM9 algorithm to address the above technical challenges. Also, corresponding security proofs based on the threat model of power grids and the existing attack patterns are offered, and code implementation is carried out. It is experimentally verified that the computation time overhead and communication overhead of this scheme are smaller than those of the existing authentication key agreement protocols based on identification cryptosystems.

Lightweight Cloud Computing-Based RFID Authentication Protocols Using PUF for e-Healthcare Systems

In the present of convenience, cloud computing services have increasingly become used to resolve low-latency and high-efficiency issues. In particular, they can help medical staff remotely obtain patients’ data. The RFID system is popularly used to collect the physiological signals of patients in e-Healthcare, which include their heartbeat, blood pressure, pulse, brain activity, and others. Although cloud computing services and RFID systems are used in many environments, they have some problems that are associated with security and efficiency. For example, the RFID system cannot be used to perform time-consuming and burdensome computations. Therefore, the public key cryptosystem is difficult to be used. Additionally, due to the overload of cloud servers when a large number of devices join, the use of traditional cryptosystems is not feasible. Recently, many protocols have been proposed to resolve the above issues. However, most of them consider only the authentication of communicating entities rather than authenticated key agreement for secure data transmission. Some protocols are not secure against possible attacks. Thus, this study proposes authentication key agreement protocols for e-Healthcare systems to solve problems of efficiency using lightweight operations and to enhance security by adopting the Physical Unclonable Function (PUF). Since PUFs use the uniqueness and randomness of their circuits to perform computation, they have message fingerprints that act as authentication keys. A PUF is lightweight and suitable for use in e-Healthcare systems with limited resources. The proposed protocols satisfy more security requirements than related authentication protocols, require fewer computational resources and are more efficient.

ECC-Based Authenticated Key Agreement Protocol for Industrial Control System

Nowadays, Industrial Internet of Things (IIoT) technology has made a great progress and the industrial control systems (ICSs) have been used extensively, which has brought more and more serious information security threats to the ICS at the same time. The authenticated key agreement (AKA) protocol is a common method to ensure the communication security. This work proposes a lightweight AKA protocol based on the elliptic curve cryptography (ECC) algorithm to adapt to the resource-constrained environment. We only employ hash operation, XOR operation, and ECC algorithm to encrypt the data in the authentication and key agreement phase, and avoid involving the register center while proceeding the key agreement, to give consideration to both performance and security. The security analyses indicate that our protocol can meet nine critical security requirements, more than all of the existing protocols, and the performance analysis carried out indicates that our protocol has less computational and communication overheads in contrast to other corelative protocols.

Lightweight and dynamic authenticated key agreement and management protocol for smart grid

With the development of IoT and 5G, the smart grid, as one of the key component for the smart city, can provide the uninterrupted and reliable electricity service by properly adjusting the electricity supply according to the consumption of users. The advanced metering infrastructure (AMI), as an important part of smart grid system, is a complete network and system for measuring, collecting, storing and analyzing the electricity consumption information of users. The security of AMI plays a vital role in the smooth operation of smart grid. In this paper, we study how to establish the secure communication between two entities in AMI, namely the smart meter and the electricity service provider. Although, there are many authentication and key management protocols for AMI, the high complexity and computation overhead of these protocols hinder their application in the smart grid environment. Based on identity cryptosystem and elliptic curve cryptography (ECC), we put forward a lightweight and dynamic authenticated key agreement and management protocol, which can significantly reduce the computation overhead of the resource-constrained smart meters. In addition, we utilize a one-way key tree technique to efficiently generate and update the group key in the multicast communication. We give a systematic proof to show that our designed protocol not only guarantees the confidentiality and integrity of transmitted messages, but also resists various attacks from an adversary. Finally, we carry out some simulated experiments to demonstrate the high efficiency of our designed protocol.

B-HAS: Blockchain-Assisted Efficient Handover Authentication and Secure Communication Protocol in VANETs

The traditional handover authentication protocols in Vehicular Ad-hoc Network (VANET) suffer from important issues like single source of trust, Single-Point-of-Failure (SPoF), and fails to provide robust authentication due to several potential threats. In state-of-the-art of handover authentication, it takes high computation and communication overhead. The main aim of this paper is to integrate blockchain technology into the VANET system and to design a robust handover authentication protocol to solve the above-mentioned challenges. In this article, we design blockchain-based mutual authentication and session key agreement protocols for intra-vehicular and inter-vehicular (handover case) scenarios by implementing the hash function and Elliptic Curve Cryptography (ECC). We also validate the proposed model by using the Scyther tool and Real-Or-Random (ROR) oracle, standard model. The proposed scheme confirms security against all applicable attacks during security analysis. Furthermore, a detailed comparative analysis reveals that the proposed method has low communication and computation overheads and achieves more functionality features and security attributes than the relevant schemes.

SAKAP: SGX-Based Authentication Key Agreement Protocol in IoT-Enabled Cloud Computing

With the rapid development of the Internet, Internet of Things (IoT) technology is widely used in people’s daily lives. As the number of IoT devices increases, the amount of data to be processed also increases. The emergence of cloud computing can process the data of IoT devices in a timely manner, and it provides robust storage and computing capabilities to facilitate data resource sharing. Since wireless communication networks are unstable and open, it is easy for attackers to eavesdrop, intercept, and tamper with the messages sent. In addition, authentication protocols designed for IoT-enabled cloud computing environments still face many security challenges. Therefore, to address these security issues, we propose an Intel software-guard-extensions (SGX)-based authentication key agreement protocol in an IoT-enabled cloud computing environment. The goal is to ensure data privacy and sustainable communication between the entities. Moreover, SGX can resist several well-known attacks. Finally, we show the security using the real-or-random model, ProVerif, and informal analysis. We also compare the security and performance of the proposed protocol with existing protocols. The comparison results show that our proposed protocol reduces the communication cost by 7.07% compared to the best one among the current protocols and ensures sufficient security.

Cryptanalysis and improved mutual authentication key agreement protocol using pseudo-identity.

The authentication key agreement is a scheme that generates a session key for encrypted communication between two participants. In the authentication key agreement, to provide the mutual authentication and the robust session key agreement is one of the important security requirements to enhance the security performance of key agreement. Recently Zhou et al. had proposed the key agreement protocol using pseudo-identifiers, but we found that there were weaknesses in their protocol. We have demonstrated that Zhou et al.'s protocol is vulnerable to replay attack, fails to provide mutual authentication, no key control, re-registration with the original identifier and efficiency in the verification of wrong password. We improved their scheme and proposed an improved authentication key agreement protocol that provides robust mutual authentication and the secure session key agreement. We analyzed its security performance using BAN logic and AVISPA tools and compared computational cost, communication overhead and security properties with other related schemes.

Identity-Based Key Agreement for Blockchain-Powered Intelligent Edge

In the new paradigm of blockchain-powered intelligent edge, the key agreement is a significant problem that has not been extensively studied so far. Existing key agreement protocols in the traditional public-key setting are usually too complicated and heavy for edge and end devices. Besides, most protocols in use do not have effective measures to resist side-channel attacks, which are increasingly threatening cloud servers, edge devices, and end devices. Identity (ID)-based protocols can be conveniently implemented in the blockchain-powered intelligent edge. Several leakage-resilient ID-based protocols, which can resist side-channel attacks, have been proposed. However, they all involve time-consuming pairing computations. Besides, none of them address side-channel attacks to the key generation center (KGC). This article designs and realizes two novel ID-based key agreement protocols for the blockchain-powered intelligent edge, including an extended Canetti-Krawczyk (eCK) secure ID-based authenticated key agreement (AKA) protocol and a continuous after-the-fact leakage-resilient eCK (CAFL-eCK) secure ID-based AKA protocol. Both protocols do not involve any heavy pairing computation. Besides, the second one can resist side-channel attacks to the KGC and the communicating parties. A hybrid implementation of the two protocols can achieve high efficiency and strong security at the same time in blockchain-powered intelligent edge environments. This is demonstrated via a use case of a blockchain-powered smart home.

Robust Authentication and Session Key Agreement Protocol for Satellite Communications

Satellite networks are recognized as the most essential communication infrastructures in the world today, which complement land networks and provide valuable services for their users. Extensive coverage and service stability of these networks have increased their popularity. Since eavesdropping and active intrusion in satellite communications are much easier than in terrestrial networks, securing satellite communications is vital. So far, several protocols have been proposed for authentication and key exchange of satellite communications, but none of them fully meet the security requirements. In this paper, we examine one of these protocols and identify its security vulnerabilities. Moreover, we propose a robust and secure authentication and session key agreement protocol using the elliptic curve cryptography (ECC). We show that the proposed protocol meets common security requirements and is resistant to known security attacks. Moreover, we prove that the proposed scheme satisfies the security features using the Automated Validation of Internet Security Protocols and Applications (AVISPA) formal verification tool and On-the fly Model-Checker (OFMC) and ATtack SEarcher (ATSE) model checkers. We have also proved the security of the session key exchange of our protocol using the Real or Random (RoR) model. Finally, the comparison of our scheme with similar methods shows its superiority.

An anonymous SIP authenticated key agreement protocol based on elliptic curve cryptography.

Designing a secure authentication scheme for session initial protocol (SIP) over internet protocol (VoIP) networks remains challenging. In this paper, we revisit the protocol of Zhang, Tang and Zhu (2015) and reveal that the protocol is vulnerable to key-compromise impersonation attacks. We then propose a SIP authenticated key agreement protocol (AKAP) using elliptic curve cryptography (ECC). We demonstrate the correctness of the protocol using Burrows-Abadi-Needham (BAN), and its security using the AVISPA simulation tool. We also evaluate its performance against those of Zhang, Tang and Zhu, and others.

Security and Privacy for Edge-Assisted Internet of Things Security Proof for the SKKE Protocol

As an Internet of things (IoT) technology, the ZigBee has a wide range of applications in home automation, smart energy, commercial building automation, personal, home and hospital care, telecom, and wireless sensor. The ZigBee standard has the advantage of high reliability, which is based on the security of authentication key agreement protocol, namely, the SKKE protocol. In the ZigBee standard, this protocol based on shared symmetric-key is applied on the security protocol level. It is a full symmetric-key key agreement with key confirmation scheme, while the key confirmation mechanism is provided by a message authentication coding mechanism. In this paper, we consider the security of the SKKE protocol. In the random Oracle model, we reduce the security of the SKKE protocol to the collision of the hash function and the HMAC function and the indistinguishability between the output of the random Oracle and a random number. We also give a theoretical proof with the game-based method. To our knowledge, there is no research on the provable security of the ZigBee protocol at this stage, so it is helpful to promote further research of the ZigBee protocol security.

A Password Authentication Key Agreement Protocol for IoT Devices

A Password Authentication Key Agreement Protocol for IoT Devices