Authentication Vectors Research Articles

Novel machine learning based authentication technique in VANET system for secure data transmission

<p>Adaptive transport technologies based on vehicular ad hoc networks (VANET) has proven considerable potential in light of the developing expansion of driver assistance and automobile telecommunication systems. However, confidentiality and safety are the vital challenges in vehicular ad hoc networks which could be seriously impaired by malicious attackers. While protecting vehicle privacy from threats, it is imperative to stop internal vehicles from putting out bogus messages. Considering these issues, a novel machine learning based message authentication combined with blockchain and inter planetary file system (IPFS) is proposed to achieve message dissemination in a secured way. Blockchain is the emerging technology which attempts to solve these problems by producing tamper proof events of records in a distributed environment and inter planetary file system used in the framework is a protocol designed to store the event with content addressability. Along with this combined technology, the source metadata information collected from the inter planetary file system is stored via a smart contract and uploaded to the distributed ledger technology (DLT). For performing event authentication, K-means clustering and support vector machine (SVM) classifier is employed in this framework. K-means clustering performs clustering of vehicles and it is marked malicious or not malicious. After clustering, support vector machine classifier detects the malicious event messages. By this way, the malicious messages are identified and it is dropped. Only the secure messages are forwarded in the network. Finally, our approach is capable of creating a safe and decentralized vehicular ad hoc network architecture with accountability and confidentiality through theoretical study and simulations.</p>

Preserving Privacy of User Identity Based on Pseudonym Variable in 5G

The fifth generation (5G) system is the forthcoming generation of the mobile communication system. It has numerous additional features and offers an extensively high data rate, more capacity, and low latency. However, these features and applications have many problems and issues in terms of security, which has become a great challenge in the telecommunication industry. This paper aimed to propose a solution to preserve the user identity privacy in the 5G system that can identify permanent identity by using Variable Mobile Subscriber Identity, which randomly changes and does not use the permanent identity between the user equipment and home network. Through this mechanism, the user identity privacy would be secured and hidden. Moreover, it improves the synchronization between mobile users and home networks. Additionally, its compliance with the Authentication and Key Agreement (AKA) structure was adopted in the previous generations. It can be deployed efficiently in the preceding generations because the current architecture imposes minimal modifications on the network parties without changes in the authentication vector's message size. Moreover, the addition of any hardware to the AKA carries minor adjustments on the network parties. In this paper, the ProVerif is used to verify the proposed scheme.

PSE-AKA: Performance and security enhanced authentication key agreement protocol for IoT enabled LTE/LTE-A networks

In the mobile telecommunication network, Long term Evolution (LTE) is the most successful technological development for the industrial services and applications. The Evolved Packet System based Authentication and Key Agreement (EPS-AKA) was the first protocol proposed to authenticate the communication entities in the LTE network. But, the EPS-AKA protocol suffers from the single key exposure problem and is susceptible to various security attacks. Also, the protocol incurs high bandwidth consumption and computation overhead over the communication network. Moreover, the protocol doesn’t support the Internet of Things (IoT) based applications and has several security issues such as the privacy violation of the user identity and key set identifier (KSI). To resolve the above problems, various AKA protocols were proposed by the researchers. Unfortunately, none of the protocols succeeded to overcome the privacy preservation and single key exposure problem from the communication network. In this paper, we propose the performance and security enhanced (PSE-AKA) protocol for IoT enabled LTE/LTE-A network. The proposed protocol follows the cocktail therapy to generate the authentication vectors that improves the performance in terms of computation and communication overhead. The protocol preserves the privacy of objects, protects the KSI and avoids the identified attacks from the communication network. The formal verification and security analysis of the proposed protocol is carried out using the BAN logic and AVISPA tool respectively. The security analysis shows that the protocol achieves the security goals and secure against various known attacks. Finally, the performance analysis shows that the proposed protocol generates the less overhead and reduces the bandwidth consumption from the network.

A Study on Machine Learning Based Light Weight Authentication Vector

Artificial Intelligence area has been rapidly advanced around the global companies such as Google, Amazon, IBM and so on. In addition, it is anticipated to facilitate the innovation in a variety of industries in the future. AI provides us with convenience in our lives, on the other hand, the valuable information on the subjects that utilize this has the potential to be exposed at anytime and anywhere. In the next advancement of AI area, the technical developments of the new security are required other than the existing methods. Generation and validation methods of light-weight authentication vector are suggested in this study to be used in many areas as an expanded security function. Upon the results of the capacity analysis, it was verified that efficient and safe security function could be performed using the existing machine learning algorithm. Authentication vector is designed to insert the encrypted data as variable according to the change of time. The security function was performed by comparing coordinate distance values within the authentication vector, and the internal structure was verified to optimize the performance cost required for data reverse search.

An effective approach to solving large communication overhead issue and strengthening the securities of AKA protocols

SummaryAuthentication and key agreement (AKA) is a challenge‐response‐like security protocol that uses symmetric‐key cryptography to establish authenticated keys between 2 parties. Its application in the third‐generation mobile system universal mobile telecommunications system (UMTS) is called UMTS‐AKA, and the version applied in the fourth‐generation mobile communication system long‐term evolution (LTE) is called LTE‐AKA. Both UMTS‐AKA and LTE‐AKA share the same weakness: the network operators need to maintain a large space of authentication vectors for visiting stations, and the transmission of the vectors causes lots of overhead. This weakness will be amplified when there are billions of devices accessing the network in the Internet‐of‐things scenarios. In addition, these schemes provide only key distribution (not key agreement) and cannot provide session key forward secrecy. In this paper, we propose a range‐bound key assignment technique to tackle the challenges. The proposed scheme drastically reduces the communication overhead and greatly strengthens the security robustness. The securities are analyzed and are verified using the AVISPA toolset.

Performance and security enhanced authentication and key agreement protocol for SAE/LTE network

In recent years, Long Term Evolution has been one of the promising technologies of current wireless communication systems. Quality of service and data rate contribute for the robustness of the field. These two factors are the sum up of transmission rate, security delay, delay variation and some other communication factors. Despite its high data rate and quality of service, Long Term Evolution has some drawbacks as far as the security of this technology is concerned. Particularly, there are some security holes in authenticating users for access in the domain of Access Network. For instance, when User Equipment requests for attachment, the International Mobile Subscriber Identity (IMSI) is sent over network without security protection, hence privacy does not hold. In addition, many parameters are generated by invoking a function with only one input key by which compromising this key results in the whole failure of the system security. So as to mitigate these and some other huge security problems, the researchers, propose an improved approach without adding extra cost so that it can be implemented within the same environment as the existing security system (Evolved Packet System Authentication and Key agreement). As one of the performance enhancements, fetching authentication vectors from foreign network is enabled instead of fetching from home network, which significantly reduces the authentication delay and message overhead. Generally, the purpose is to boost the security level and performance of the protocol keeping the architecture of the system as similar as the conventional security system. These has been exhaustively analyzed and verified under network as well as security verification and simulation tools.

Analyzing secure key authentication and key agreement protocol for promising features of IP multimedia subsystem using IP multimedia server-client systems

Recently, Session Initiation Protocol (SIP) has become a prime signaling protocol for the multimedia communication systems, though none of the researchers have analyzed its promising features, namely access independence, authentication scheme verification, AKA (Authentication and Key Agreement) security properties, 3GPP security properties, signal congestion, bandwidth consumption and computation overhead using the physical multimedia server-client platform. To examine the issues realistically, the existing authentication schemes, such as UMTS AKA, EPS AKA, Cocktail AKA, S AKA, HL AKA and ZZ AKA were designed and developed in the multimedia server-client systems deployed on Linux platform. The cross-examination revealed that the existing schemes failed to satisfy the IMS (IP Multimedia Subsystem) promising features, like mutual authentication, session-key sharing, (perfect) forward secrecy and implicit-key authentication. Thus, this paper proposes a Secure-Key Authentication and Key Agreement protocol (SK AKA) to meet out the standard demands of IMS. To curtail its authentication steps, the secure authentication vector SAV computes and dispenses the generated vectors between the multimedia server-client systems in advance, through the serving call session control function SCSCF. As a result, the execution steps of UMTS AKA are annulled for the sake of accomplishment of the IMS features. In addition, the protocol of SK AKA integrates the strategies of Context Identity CID and Elliptic Curve --- Diffie Hellman (EC-DH) to resist most of the potential attacks like SIP flooding, forgery, man-in-the-middle, password guessing and key impersonation. To analyze the parameters, such as (SIP) Flooding Attack Detection Rate, End-To-End Delay of Multiple Voice Call Session, Call Success Rate, SIP Utilization, RTP Utilization, Call Response Time, Bandwidth Consumption and Signalling Congestion realistically, the proposed and existing authentication schemes have been coded and integrated in the real-time IMS client-server system. Above all, the thoroughgoing research has revealed that the proposed protocol of SK AKA accomplishes all the IMS challenges: 1. Adhere the promising features of IMS; 2. Attack resiliency; and 3. Fulfill the promising parameters of IMS, in comparison with the other existing schemes.

Enhanced Mobile Authentication Techniques

Milenage algorithm applies the block cipher Rijnadael (AES) with 128 bit key and 128 bit block size. This algorithm is used in the 3GPP authentication and key generation functions (f1, f1*, f2, f3, f4, f5 and f5*) for mobile communication systems (GSM/UMTS/LTE). In this paper a modification of Milenage algorithm is proposed through a dynamic change of S-box in AES depending on secret key. To get a new secret key for every authentication process we add the random number (RAND) transmitted from the authentication center (AUC) to the contents of the fixed stored secret key (Ki) and thus the initialization of the AES will be different each new authentication process . For every change in secret key a new S-box is derived from the standard one by permuting its rows and columns with the help of a new designed PN sequence generator. A complete simulation of modified Milenage and PN sequence generator is done using Microcontroller (PIC18F452). Security analysis is applied using Avalanche test to compare between the original and modified Milenage. Tests proved that the modified algorithm is more secure than the original one due to the dynamic behavior of S-box with every change of the secret key and immunity against linear and differential cryptanalysis using Avalanche tests. This makes the modified Milenage more suitable for the applications of authentication techniques specially for mobile communication systems. Keywords—Authentication vector (AV), Modified MILENAGE Algorithm for AKA Functions (F1, F1*, F2, F3, F4, F5, F5*), AES, Dynamic S-BOX and PN Sequence Generator (LFSR).

Fast Handover Pre-Authentication Protocol in 3GPP-WLAN Heterogeneous Mobile Networks

The demand of ubiquitous communications drives the development of advanced mobile technologies. Meanwhile, recent increases in mobile data usage and the emergence of new IP service applications constitute the motivation to integrate 3GPP cellular mobile systems with broadband WLANs. Since 3GPP and WLAN systems complement each other in terms of infrastructure and network coverage and bandwidth, 3GPP-WLAN Heterogeneous Mobile Networks based on the 3GPP-based Home Network (3GHN) are proposed for meeting the growing demands in high-speed data access on any mobile devices. However, heterogeneous radio access technologies and architectures lead to many interworking issues, such as network transparency, security mechanism, seamless handover, and quality of service. Among of them, security and handover are the major motives to ensure the confidentiality, reliability and continuity of services in 3GPP-WLAN Heterogeneous Mobile Networks. This paper proposes fast handover pre-authentication protocol to reduce the handover authentication latency and authentication signaling overhead during the whole handover session. The proposed protocol supports Intra-Domain Handover Pre-Authentication (Intra-HO Pre-Auth) and Inter-Domain Handover Pre-Authentication (Inter-HO Pre-Auth) for preauthenticating the Mobile User (MS) prior to performing an Inter-domain Handover (Inter-domain HO)/Intra-domain Handover (Intra-domain HO) process. Meanwhile, the reduction in retrieving new Authentication Vector sand key sets from the Home Location Register/Home Subscriber Service/Authentication Center in 3GHN achieves for minimized redundant authentication signaling transactions between 3GPP domains and WLAN domains. In addition, this paper provides simulation results which show that the proposed Intra-HO Pre-Auth achieves 49% handover authentication performance improvement compared to EAP-AKA, and the proposed Inter-HO Pre-Auth achieves 26% handover authentication performance improvement as well.

An effective AKA protocol for UMTS

Universal Mobile Telecommunication System (UMTS) is the most popular third-generation mobile phone system at present and the UMTS AKA is authentication and key agreement protocol. There are some weaknesses in the existing UMTS AKA protocol, such as synchronisation question, storage overhead, insecurity with leakiness authentication vector and weakness in mutual authentications. In this paper, we use the concept of proxy key to design a more secure and more efficient UMTS AKA protocol. Our protocol can not only resist the above-mentioned drawback of the original UMTS AKA protocol on the security, but also improve the performance of UMTS AKA protocol, including the computational overhead, storage overhead and communication overhead.

Reducing False Synchronizations in 3G-WLAN Integrated Networks

Authentication in 3G encompasses a mechanism, which ensures that the authentication vectors (AVs) are used only once. To achieve this, the employed mechanism maintains counters at both sides (mobile station and network) and verifies that the provided AVs are among the last α generated. However, there are many cases in which the mobile station receives AVs that have not been previously used, but the employed mechanism rejects them as outdated. This phenomenon, called false synchronization, causes signaling overhead and delays, and increases the cost of the network use. False synchronizations are more frequent in 3G-WLAN integrated networks. The frequency of false synchronizations decreases with α, while at the same time the risk of a replay attack increases. This paper aims at analytically determining an appropriate value of α, which balances effectively in 3G-WLANs the tradeoff between the rate of false synchronizations and exposure to adversaries exploiting compromised AVs. This is done by determining a threshold value of α beyond which the further reduction in false synchronizations is marginal, while the potential for a replay attack is constantly increasing and substantial. To this end, an analytical model based on a four dimensional Markov chain is developed whose accuracy is verified through simulations.

3G 네트워크에서 프라이버시 보호를 강화한 효율적인 인증 메커니즘

이동통신 기술 및 다양한 서비스 개발로 모바일 사용자들은 해마다 증가하고 있다. 그러나 무선 네트워크 환경에서 동작하는 모바일 서비스들은 불법적인 변조, 도청, 신분위장 등 다양한 보안위협에 노출되어 있다. 이에 따라 3GPP에서는 안전한 이동통신 서비스를 제공하기 위하여 인증과 키 동의를 수행하는 3GPP-AKA 표준을 제정하였다. 그러나 3GPP-AKA 프로토콜은 관련 연구들을 통해 sequence number 동기화 문제, false base station을 이용한 공격, 프라이버시 문제 등이 발견되었다. 따라서 본 논문에서는 3G 네트워크에서 프라이버시를 강화한 효율적인 인증기법을 제안한다. 제안하는 인증 기법에서는 타임스탬프를 사용하여 기존의 3GPP 인증 방식에서 발견된 sequence number 동기화 문제를 해결하고, 비밀토큰을 이용하여 프라이버시 관련 문제를 해결하였다. 또한 하나의 인증벡터만을 사용하기 때문에 SN과 HLR 사이의 대역폭 소비 문제와 SN의 인증 데이터 오버헤드 문제를 개선할 수 있다. As communication technologies are developed and variety of services to mobile devices are provided, mobile users is rapidly increasing every year. However, mobile services running on wireless network environment are exposed to various security threats, such as illegal tampering, eavesdropping, and disguising identity. Accordingly, the secure mobile communications services to 3GPP were established that the standard for 3GPP-AKA specified authentication and key agreement. But in the standard, sequence number synchronization problem using false base station attack and privacy problem were discovered through related researches. In this paper, we propose an efficient authentication mechanism for enhanced privacy protection in the 3G network. We solve the sequence number synchronization existing 3GPP authentication scheme using timestamp and strengthen a privacy problem using secret token. In addition, the proposed scheme can improve the bandwidth consumption between serving network and home network and the problem of authentication data overhead for the serving network because it uses only one authentication vector.

3GPP authentication and key agreement-protocol based on public key cryptosystem

The authentication and key agreement protocol adopted by 3rd Generation Partnership Project (3GPP) System Architecture Evolution (SAE) Release 8 standard was analyzed in contrast with 3G,and several security defects in SAE protocol were pointed out,then an improved 3GPP SAE authentication and key agreement protocol was put forward based on public key cryptosystem. In the new protocol,user's identity information and authentication vector in network domain were encrypted based on public key cryptosystem,public parent key adopted in local authentication was generated by random data. The security and efficiency of the proposed new scheme was analyzed at last. The analysis results show that the proposal can effectively solve the problems mentioned above and improve the security of protocol with less cost.

A novel congestion control model for interworking AAA in heterogeneous networks

In the 3rd generation partnership project (3GPP) and wireless local area network (WLAN) interworking networks, 3GPP authentication, authorization, accounting (AAA) server located in 3GPP core network will be responsible for the AAA request from WLAN access network (AN). However, centralized AAA deployment is bound to give rise to the single point failure, resulting in system congestion. In order to solve this problem, this paper presents a novel congestion control model for AAA. In addition, through analyzing the model, the conclusion can be drawn that the average congestion rate of extensible authentication protocol (EAP) user request is related with factors, such as the arrival rate of EAP request, the number of EAP re-authentication, and the system buffer queue length. Finally, the simulation results show that EAP request arrival rate is directly proportional to the congestion rate, and when the number of EAP re-authentication and system buffer queue length are fixed, the number of corresponding user authentication vectors should be directly proportional to the EAP request arrival rate, so as to ensure the average congestion rate of EAP request is less than 0.005.

A cocktail protocol with the Authentication and Key Agreement on the UMTS

At present, the Universal Mobile Telecommunications System (UMTS) is very popular in most parts of the world. It is a third-generation mobile communication technique known for its ability to conduct user authentication and for its security of communication with the use of Authentication and Key Agreement (AKA) protocol. A mobile station (MS), a service network (SN) and a home environment (HE) use the protocol to authenticate each other and make an agreement with a session key. With the UMTS-AKA protocol standard, all authentication vectors (AV) produced by the HE are transferred to the SN for mutual authentication with the MS. In this scenario, authentication is exposed to two kinds of defects. One defect is computational overhead concentrating on the HE and the other is the communication overhead for delivering the AVs. To overcome these congenital defects, this study proposes a unique UMTS-AKA protocol called the cocktail-AKA protocol. The goal of this protocol is to allow the SN to share some medicated authentication vectors (MAV) that are calculated in advance and combined with a prescription at the authentication stage. So, the HE only needs to produce a prescription authentication vector (PAV). Once the authentication stage is initiated, the SN distributes MAV and PAV and produces an effective AV for mutual authentication with the MS. The cocktail-AKA protocol can overcome both the aforesaid defects.

Reducing Communication Overhead for Wireless Roaming Authentication: Methods and Performance Evaluation

The protocol design for wireless roaming authentication is challenging because of the key management regarding users and home/visited networks. In this paper, we present two authentication methods that demonstrate better performance in terms of authentication latency and energy consumption of a mobile terminal, compared to the 3G cellular network approach of home network transporting authentication vector to visited network. The proposed Method I, referred to as Nonce-based Authentication, eliminates the sequence numbers used in the 3G roaming authentication and employs the key derivation and caching technique for mobile terminal and visited network. The proposed Method II, called Lightweight Localized Authentication, introduces the computation-efficient protocol based on a carefully designed public key certificate infrastructure. With the design goal of achieving security by lower cost, both methods significantly reduce the communication overhead between home and visited networks for roaming authentication, as indicated by analytical and experimental result.

Authentication Vector Management for UMTS

In Universal Mobile Telecommunication System (UMTS), the security function provides mutual authenticity and key agreement between the core network and the Mobile Station (MS). Specifically, the Serving GPRS Support Node (SGSN) in the core network obtains an array of Authentication Vectors (AVs) from the Home Subscriber Server/Authentication Center (HSS/AuC), and consumes one AV for each mutual authentication. After the departure of the MS, the SGSN may keep the unused AVs for a time interval called the Reservation Timeout (RT) period. If the MS returns within the RT period, the SGSN uses the stored AVs for mutual authentication instead of obtaining new AVs from the HSS/AuC. Note that a long RT period results in fewer accesses to the HSS/AuC at the cost of extra AV storage in the SGSN. In this paper, we propose an analytic model to investigate the impact of the RT period on the system performance. Our study provides the guidelines for the mobile operators to select an appropriate RT period.

Analytical model for authentication transmission overhead between entities in mobile networks

This paper analyses the authentication and key agreement (AKA) protocol for UMTS mobile networks. In this research the current authentication protocol has been enhanced by reducing the network traffic, signalling message between entities. Consequently the bottleneck at authentication centre is avoided. This is achieved by reducing the number of messages between mobile and authentication centre, then reducing the authentication times, and setup time as well as improving authentication efficiency as shown in analytical analysis and simulation results. In this paper dynamic length ( L) for an array for authentication vector (AV) has been proposed. This requires designing a new technique to predict the numbers of records in AV in each authentication data request depending on the arrival rate of authentication events and residence time of the mobile station (MS) in VLR/SGSN. The analytical and simulation study have been carried out to explore the impact of dynamic length for authentication vector on the signalling traffic in mobile network. To validate the simulation results in this research work, the results have been compared with the analytical results and fill match has been achieved.

An improvement for authentication protocol in third-generation wireless networks

An improvement for the mutual authentication in the third-generation mobile networks is proposed to address the potentially long delay in waiting for authentication vector (AV) when SGSN and HLR/AuC are located far away from each other, or when the two entities are operated by different operators, or when the mobile terminal (MT) call/mobility activity is frequent. In the 3GPP Technical Specification TS33.102, the probability that an action triggering authentication and key agreement (AKA) has to wait for an AV is fixed as high as 20%. Our proposed scheme is able to achieve this probability smaller than 2% with negligible increased signaling overhead and low storage cost.

Security analysis and enhancements of 3GPP authentication and key agreement protocol

This paper analyzes the authentication and key agreement protocol adopted by Universal Mobile Telecommunication System (UMTS), an emerging standard for third-generation (3G) wireless communications. The protocol, known as 3GPP AKA, is based on the security framework in GSM and provides significant enhancement to address and correct real and perceived weaknesses in GSM and other wireless communication systems. In this paper, we first show that the 3GPP AKA protocol is vulnerable to a variant of the so-called false base station attack. The vulnerability allows an adversary to redirect user traffic from one network to another. It also allows an adversary to use authentication vectors corrupted from one network to impersonate all other networks. Moreover, we demonstrate that the use of synchronization between a mobile station and its home network incurs considerable difficulty for the normal operation of 3GPP AKA. To address such security problems in the current 3GPP AKA, we then present a new authentication and key agreement protocol which defeats redirection attack and drastically lowers the impact of network corruption. The protocol, called AP-AKA, also eliminates the need of synchronization between a mobile station and its home network. AP-AKA specifies a sequence of six flows. Dependent on the execution environment, entities in the protocol have the flexibility of adaptively selecting flows for execution, which helps to optimize the efficiency of AP-AKA both in the home network and in foreign networks.