Automated Validation Of Internet Security Protocols And Applications Research Articles

An Efficient and Secure Authentication for Ambient Assisted Living System

Although the birthrate is declining, the average life expectancy continues to increase. Therefore, it is more important for elderly people to maintain their independence while staying at home. Ambient Assisted Living (AAL) includes the use of devices and methods of ensuring that elderly people can stay safe and age at home rather than at a facility. Assisted living services help people live as independently and safely as possible when they can no longer perform everyday activities on their own. Because the information transmitted in AAL systems is personal, the security and privacy of such data are becoming important issues that must be addressed. Herein, we propose an efficient and secure authentication scheme for an AAL system. Our proposed authentication scheme not only satisfies several important security requirements of such a system but also withstands various types of attacks. Moreover, the proposed authentication scheme achieves lightweight performance by manipulating basic cryptographic operations including bitwise-eXclusive-OR (XOR) and hash functions. We simulated our proposed authentication scheme using Automated Validation of Internet Security Protocols and Applications (AVISPA), which is a prominent security verification tool. Security and performance analysis show that our proposed scheme is not only robust against several attacks and has a lower computational cost in terms of execution time than those of existing authentication schemes.

SETCAP: Service-Based Energy-Efficient Temporal Credential Authentication Protocol for Internet of Drones

Internet of Drones (IoD) is a framework to set up drones networks that may serve multiple purposes, e.g., data collection. New IoD applications (such as drone assisted internet of vehicles) envision the simultaneous collection of multiple data types. Although authentication may prevent unauthorized users to access the collected data, existing authentication solutions do not distinguish between the different types of data collected by drones. Therefore, authenticated users may receive sensitive data regarding another user incurring hence in a privacy leakage.In this paper, we propose SETCAP, a novel Service-Based Energy-Efficient Temporal Credential Authentication Protocol for IoD. SETCAP exploits the distinction between data types to prevent information leakage. We formally test SETCAP against the Real-Or-Random (ROR) model and implemented SETCAP in Automated Validation of Internet Security Protocols and Applications (AVISPA) simulation tool. Moreover, we validated SETCAP via non-mathematical security analysis to show its security against many attacks. We assessed the superiority of SETCAP in terms of functionality and security characteristics as well as computation, communication, and energy costs. The communication cost of creating a session in SETCAP is approximately 20% smaller than that of creating a session in the closest state-of-the-art protocol. Furthermore, the framework that we propose requires the creation of a number of sessions that are additive in terms of the number of drones and users, whereas the existing solutions are multiplicative. SETCAP is therefore a secure and scalable solution for resource-constrained devices such as drones.

Secure ECC-Based Three-Factor Mutual Authentication Protocol for Telecare Medical Information System

In the recent COVID-19 situation, Telecare Medical Information System (TMIS) is attracting attention. TMIS is one of the technologies used in Wireless Body Area Network (WBAN) and can provide patients with a variety of remote healthcare services. In TMIS environments, sensitive data of patients are communicated via an open channel. An adversary may attempt various security attacks including impersonation, replay, and forgery attacks. Therefore, numberous authentication schemes have been suggested to provide secure communication for TMIS. Sahoo <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> proposed a mutual authentication scheme based on biometrics and Elliptic Curve Cryptography (ECC) in 2020. However, we find out that Sahoo <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> ’s scheme cannot resist insider and privileged insider attacks and cannot guarantee patient anonymity. In this paper, we propose a secure ECC-based three-factor mutual authentication protocol that guarantees the privacy of patients for TMIS. We conduct informal security analysis to prove that our protocol is secure from various security attacks. In addition, we perform formal security analyses using the Automated Validation of Internet Security Protocols and Applications (AVISPA), Burrows-Abadi-Needham (BAN) logic, and the Real-Or-Random (ROR) model. Furthermore, we assess our protocol’s performance and compare it to other protocols. As a result, our protocol has lower communication costs, and better security features compared to related existing protocols. Therefore, our protocol is more appropriate for TMIS environments than other related protocols.

Robust Authentication and Session Key Agreement Protocol for Satellite Communications

Satellite networks are recognized as the most essential communication infrastructures in the world today, which complement land networks and provide valuable services for their users. Extensive coverage and service stability of these networks have increased their popularity. Since eavesdropping and active intrusion in satellite communications are much easier than in terrestrial networks, securing satellite communications is vital. So far, several protocols have been proposed for authentication and key exchange of satellite communications, but none of them fully meet the security requirements. In this paper, we examine one of these protocols and identify its security vulnerabilities. Moreover, we propose a robust and secure authentication and session key agreement protocol using the elliptic curve cryptography (ECC). We show that the proposed protocol meets common security requirements and is resistant to known security attacks. Moreover, we prove that the proposed scheme satisfies the security features using the Automated Validation of Internet Security Protocols and Applications (AVISPA) formal verification tool and On-the fly Model-Checker (OFMC) and ATtack SEarcher (ATSE) model checkers. We have also proved the security of the session key exchange of our protocol using the Real or Random (RoR) model. Finally, the comparison of our scheme with similar methods shows its superiority.

A Secure and Anonymous User Authentication Scheme for IoT-Enabled Smart Home Environments Using PUF

With the continuous development of Internet of Things (IoT) technology, research on smart home environments is being conducted by many researchers. In smart home environments, home users can remotely access and control a variety of home devices such as smart curtains, lights, and speakers placed throughout the house. Despite providing convenient services, including home monitoring, temperature management, and daily work assistance, smart homes can be vulnerable to malicious attacks because all messages are transmitted over insecure channels. Moreover, home devices can be a target for device capture attacks since they are placed in physically accessible locations. Therefore, a secure authentication and key agreement scheme is required to prevent such security problems. In 2021, Zou <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al</i> . proposed a two-factor-based authentication and key agreement scheme using elliptic curve cryptography (ECC) in smart home environments. They claimed that their scheme provides user anonymity and forward secrecy. However, we prove that their scheme suffers from forgery, ephemeral secret leakage, and session key disclosure attacks. To overcome the security vulnerabilities of Zou <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al</i> .’s scheme and provide home users with secure communication in smart home environments, we propose a secure user authentication scheme using physical unclonable functions (PUF). We utilize Real-or-Random (ROR) model and Burrows-Abadi-Needham (BAN) logic to verify the session key security and mutual authentication of the proposed scheme, respectively. Furthermore, we use the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool to simulate the resistance of our scheme to security attacks. After that, we analyze and compare the communication costs, computational consumption, and security functionalities along with related schemes.

Group Security Authentication and Key Agreement Protocol Built by Elliptic Curve Diffie Hellman Key Exchange for LTE Military Grade Communication

4G mobile communication is a global technology. Therefore, it is essential to enforce confidentiality between mobile users and their networks. This paper presents a Group Security Authentication and Key Agreement Protocol Built by Elliptic Curve Diffie Hellman Key Exchange (GSAKA-ECDHKE) to overcome and address the LTE networks Evolved Packet System Authentication and Key Agreement Protocol (EPS-AKA) protocol flaws and vulnerabilities. GSAKA-ECDHKE is presented for 4G mobile military group communications to provide security, confidentiality, and privacy while the users and networks authenticate. By embedding the Group Commander (GC) role in the EPS-AKA protocol to control the member authentication in the group. GSAKA-ECDHKE protocol is based on Elliptic Curve Diffie Hellman Key Exchange (ECDHKE) and hash function to generate and share secret Elliptic Curve (EC) key to encrypt and protect the routing authentication parameters. The Automated Validation of Internet Security Protocols and Applications (AVISPA) tool is used for security analysis and formal verification. AVISPA demonstrated that GSAKA-ECDHKE had overcome various known security attacks such as Man In The Middle (MITM), replay attacks, and Denial of Services (DoS) attacks, satisfying the evaluated security requirements. Additionally, the suggested protocol provides the lowest communication overheads compared to the existing group-based AKA protocols.

Hyper Elliptic Curve Based Certificateless Signcryption Scheme for Secure IIoT Communications

Industrial internet of things (IIoT) is the usage of internet of things (IoT) devices and applications for the purpose of sensing, processing and communicating real-time events in the industrial system to reduce the unnecessary operational cost and enhance manufacturing and other industrial-related processes to attain more profits. However, such IoT based smart industries need internet connectivity and interoperability which makes them susceptible to numerous cyber-attacks due to the scarcity of computational resources of IoT devices and communication over insecure wireless channels. Therefore, this necessitates the design of an efficient security mechanism for IIoT environment. In this paper, we propose a hyperelliptic curve cryptography (HECC) based IIoT Certificateless Signcryption (IIoT-CS) scheme, with the aim of improving security while lowering computational and communication overhead in IIoT environment. HECC with 80-bit smaller key and parameters sizes offers similar security as elliptic curve cryptography (ECC) with 160-bit long key and parameters sizes. We assessed the IIoT-CS scheme security by applying formal and informal security evaluation techniques. We used Real or Random (RoR) model and the widely used automated validation of internet security protocols and applications (AVISPA) simulation tool for formal security analysis and proved that the IIoT-CS scheme provides resistance to various attacks. Our proposed IIoT-CS scheme is relatively less expensive compared to the current state-of-the-art in terms of computational cost and communication overhead. Furthermore, the IIoT-CS scheme is 31.25% and 51.31% more efficient in computational cost and communication overhead, respectively, compared to the most recent protocol.

Certificate-Based Signcryption Scheme for Securing Wireless Communication in Industrial Internet of Things

The Industrial Internet of Things (IIoT) community is concerned about the security of wireless communications between interconnected industries and autonomous systems. Providing a cyber-security framework for the IIoT offers a thorough comprehension of the whole spectrum of securing interconnected industries, from the edge to the cloud. Several signcryption schemes based on either identity-based or certificateless configurations are available in the literature to address the IIoT’s security concerns. Due to the identity-based/certificateless nature of the available signcryption schemes, however, issues such as key escrow and partial private key distribution occur. To address these difficulties, we propose a Certificate-Based Signcryption (CBS) solution for IIoT in this article. Hyperelliptic Curve Cryptosystem (HECC), a light-weight version of Elliptic Curve Cryptosystem (ECC), was employed to construct the proposed scheme, which offers security and cost-efficiency. The HECC utilizes 80-bit keys with fewer parameters than the ECC and Bilinear Pairing (BP). The comparison of performance in terms of computation and communication costs reveals that the proposed scheme provides robust security with minimal communication and communication costs. Moreover, we used Automated Validation of Internet Security Protocols and Applications (AVISPA) to assess the security toughness, and the results show that the proposed scheme is secure.

A Transaction Security Accountability Protocol for Electronic Health Systems

In the last two decades, the term “electronic health (e-health) systems” were extensively mentioned in the healthcare industry with the aim of replacing paper usage and increasing productivity. Unfortunately, these systems are not still widely used by healthcare professionals and patients due to the concerns on security and accountability issues. In this article, we propose an accountability transaction protocol to overcome all security issues for implementing electronic health systems. To validate our proposed protocol, we used both Automated Validation of Internet Security Protocols and Applications (AVISPA) and Scyther as the tools to prove its soundness.

Secure Authentication Scheme for 5G-based V2X Communications

Information and communication technologies applied to means of transport allow the design and development of new applications and bring new solutions for the mobility of people. All these applications are grouped within the field of Intelligent Transport Systems (ITS) and improve user mobility in terms of safety, reliability, capacity, and quality. Vehicle to Everything is a novel technology of ITS which aims to enhance the security and efficiency of road traffic by using wireless communications. Cellular communications networks such as LTE-V2X and 5G NR, integrated into the Vehicle to Everything (V2X) architecture designed to support vehicular communications and deployed on a large scale, appear in particular to be a relevant solution. They could indeed guarantee reliable geographic distribution and acceptable performance (latency, bandwidth, packet loss). In this context, we propose a secure authentication scheme for 5G-based V2X communication. Our solution aims to guarantee a high level of security in different types of vehicular communication (V2V, V2I, V2N) to achieve the security requirements using lightweight cryptographic methods and to support vehicles to receive securely all keys and messages from RSU, other vehicles, or network. To validate our proposal, we utilize the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool to achieve the security goals, also we evaluate the performance according to the operational cost which demonstrates that our model has a less computational cost.

Fast and Efficient Security Scheme for Blockchain-Based IoT Networks

Internet of Things (IoT) has become widely used nowadays and tremendous increase in the number of users raises its security requirements as well. The constraints on resources such as low computational capabilities and power requirements demand lightweight cryptosystems. Conventional algorithms are not applicable in IoT network communications because of the constraints mentioned above. In this work, a novel and efficient scheme for providing security in IoT applications is introduced. The scheme proposes how security can be enhanced in a distributed IoT application by providing multilevel protection and dynamic key generation in the data uploading and transfer phases. Existing works rely on a single key for communication between sensing device and the attached gateway node. In proposed scheme, this session key is updated after each session and this is done by applying principles of cellular automata. The proposed system provides multilevel security by using incomparable benefits of blockchain, dynamic key and random number generation based on cellular automata. The same was implemented and tested with the widely known security protocol verification tool called Automated Validation of Internet Security Protocols and Applications (AVISPA). Results show that the scheme is secure against various attacks. The proposed scheme has been compared with related schemes and the result analysis shows that the new scheme is fast and efficient also.

Design of Secure Handover Authentication Scheme for Urban Air Mobility Environments

Urban air mobility (UAM) is a future air transportation system to solve the air pollution and movement efficiency problems of the traditional mobility system. In UAM environments, unmanned aerial vehicles (UAV) are used to transport passengers and goods providing various convenient services such as package delivery, air bus, and air taxi. However, UAVs communicate with ground infrastructures through open channels that can be exposed to various security attacks. Therefore, a secure mutual authentication scheme is necessary for UAM environments. Moreover, a handover authentication is also necessary to ensure seamless communication when the service location is changed. In this paper, we design a secure and efficient handover authentication scheme for UAM environments considering various security vulnerabilities and efficiency using elliptic curve cryptography (ECC). We utilize informal security analysis, Real-or-Random (RoR), Burrows–Abadi–Needham (BAN) logic, and Automated Validation of Internet Security Protocols and Applications (AVISPA) to prove the security of the proposed scheme. Furthermore, we compare the computation and communication cost comparisons of the proposed scheme with the other related schemes. The results show that the proposed scheme is secure and efficient for UAM environments.

Design of Secure Mutual Authentication Scheme for Metaverse Environments Using Blockchain

During the COVID-19 pandemic, engagement in various remote activities such as online education and meetings has increased. However, since the conventional online environments typically provide simple streaming services using cameras and microphones, there have limitations in terms of physical expression and experiencing real-world activities such as cultural and economic activities. Recently, metaverse environments, three-dimensional virtual reality that use avatars, have attracted increasing attention as a means to solve these problems. Thus, many metaverse platforms such as Roblox, Minecraft, and Fortnite have been emerging to provide various services to users. However, such metaverse environments are potentially vulnerable to various security threats because the users and platform servers communicate through public channels. In addition, sensitive user data such as identity, password, and biometric information are managed by each platform server. In this paper, we design a system model that can guarantee secure communication and transparently manage user identification data in metaverse environments using blockchain technology. We also propose a mutual authentication scheme using biometric information and Elliptic Curve Cryptography (ECC) to provide secure communication between users and platform servers and secure avatar interactions between avatars and avatars. To demonstrate the security of the proposed mutual authentication scheme, we perform informal security analysis, Burrows–Abadi–Needham (BAN) logic, Real-or-Random (ROR) model, and Automated Validation of Internet Security Protocols and Applications (AVISPA). In addition, we compare the computation costs, communication costs, and security features of the proposed scheme with existing schemes in similar environments. The results demonstrate that the proposed scheme has lower computation and communication costs and can provide a wider range of security features than existing schemes. Thus, our proposed scheme can be used to provide secure metaverse environments.

A Secure Three-Factor Authentication Protocol for E-Governance System Based on Multiserver Environments

In electronic governance (e-governance) system, citizens can access government services such as transportation, licensing and immigration remotely over the Internet. With the development of information and communication technology, usage of the e-governance system has been increased. To efficiently provide citizens with various e-governance services, multi-server environments can be applied to the e-governance system. However, messages can be inserted, deleted, and modified by a malicious adversary since these are transmitted through a public channel. Therefore, many researchers have suggested mutual authentication protocols for secure communication in multi-server environments. In 2020, Sudhakar <i>et al</i>. proposed a smart card based lightweight authentication protocol for multi-server environments. We analyze Sudhakar <i>et al</i>.&#x2019;s protocol to propose a secure mutual authentication protocol in the e-governance system based on multi-server environments. However, we disclosure that their protocol is not resistant to smart card stolen, insider, man-in-the-middle, user impersonation, and session key disclosure attacks. Moreover, Sudhakar <i>et al</i>.&#x2019;s protocol does not provide mutual authentication. To improve these security problems, we suggest a secure three-factor mutual authentication protocol for the e-governance system based on multi-server environments. We prove our protocol&#x2019;s security using informal security analysis, Burrows-Abadi-Needham (BAN) logic, and Real-or-Random (ROR) model. We also simulate our protocol utilizing Automated Validation of Internet Security Protocols and Applications (AVISPA) tool.We estimate the proposed protocol&#x2019;s security functionalities, computation costs, and communication overheads compared with existing related protocols. Consequently, we demonstrate that our protocol is secure and suitable for the e-governance system.

Can Formal Security Verification Really Be Optional? Scrutinizing the Security of IMD Authentication Protocols.

The need for continuous monitoring of physiological information of critical organs of the human body, combined with the ever-growing field of electronics and sensor technologies and the vast opportunities brought by 5G connectivity, have made implantable medical devices (IMDs) the most necessitated devices in the health arena. IMDs are very sensitive since they are implanted in the human body, and the patients depend on them for the proper functioning of their vital organs. Simultaneously, they are intrinsically vulnerable to several attacks mainly due to their resource limitations and the wireless channel utilized for data transmission. Hence, failing to secure them would put the patient’s life in jeopardy and damage the reputations of the manufacturers. To date, various researchers have proposed different countermeasures to keep the confidentiality, integrity, and availability of IMD systems with privacy and safety specifications. Despite the appreciated efforts made by the research community, there are issues with these proposed solutions. Principally, there are at least three critical problems. (1) Inadequate essential capabilities (such as emergency authentication, key update mechanism, anonymity, and adaptability); (2) heavy computational and communication overheads; and (3) lack of rigorous formal security verification. Motivated by this, we have thoroughly analyzed the current IMD authentication protocols by utilizing two formal approaches: the Burrows–Abadi–Needham logic (BAN logic) and the Automated Validation of Internet Security Protocols and Applications (AVISPA). In addition, we compared these schemes against their security strengths, computational overheads, latency, and other vital features, such as emergency authentications, key update mechanisms, and adaptabilities.

ES-HAS: ECC-Based Secure Handover Authentication Scheme for Roaming Mobile User in Global Mobility Networks

The design and implementation of two-factor schemes designed for roaming mobile users for global mobility networks in smart cities requires attention to protect the scheme from various security attacks, such as the replay attack, impersonation attack, man-in-the-middle attack, password-guessing attack and stolen-smart-card attack. In addition to these attacks, the scheme should achieve user anonymity, unlinkability and perfect forward secrecy. In the roaming scenario, as mobile users are connected to the foreign network, mobile users must provide authentication details to the foreign network to which they are connected. The foreign network forwards the authentication messages received from the mobile users to their home network. The home network validates the authenticity of the mobile user. In the roaming scenario, all communication between the three entities is carried over an insecure channel. It is assumed that the adversary has the capabilities to intercept the messages transmitted over an insecure channel. Hence, the authentication scheme designed must be able to resist the above-mentioned security attacks and achieve the security goals. Our proposed scheme ES-HAS (elliptic curve-based secure handover authentication scheme) is a two-factor authentication scheme in which the mobile user possesses the password, and the smart card resists the above-mentioned security attacks. It also achieves the above-mentioned security goals. We also extended our two-factor authentication to a multi-factor authentication scheme using the fingerprint biometric technique. The formal security analysis using BAN logic and the formal security verification of the proposed scheme using the widely accepted AVISPA (automated validation of internet security protocols and applications) tool is presented in this article. In comparison with the related schemes, the proposed scheme is more efficient and robust. This makes the proposed scheme suitable for practical implementation.

Anonymous and lightweight secure authentication protocol for mobile Agent system

Recently mobile agent technology used in intelligent systems, cloud computing and IOT. However using mobile agents in distributed environment makes them facing several security threats. In this paper, we propose a lightweight authentication protocol to overcome the security problem, and to provide a secure and anonymous mobile agent system. Our protocol is based on Elliptic Curve Cryptography (ECC) and fulfill all security requirements. For the validation of our security protocol, we used Automated Validation of Internet Security Protocols and Applications (AVISPA) tool using HLPSL language. Furthermore, we used Java Agent Development Framework (JADE) to implement and simulate the proposed scheme. Finally, the paper presents the security analysis and comparison with well-known and significant related protocols in secure communication.

Secure user authentication mechanism for IoT-enabled Wireless Sensor Networks based on multiple Bloom filters

In this article, we propose an efficient Bloom filter and fuzzy extractor based user authentication technique, which is significant for an Internet of Things (IoT)-enabled multi-hop Wireless Sensor Networks (IoT-WSNs). The novelty of the proposed authentication technique is that it prevents fraudulent querying data delivery at the starting phase (i.e., at the querying sensor node itself) to stop false or counterfeit data flooding (which can exhaust the resources of IoT-WSNs) from the resource-constrained IoT-enabled sensor nodes to the nearby gateway node. The proposed authentication technique has the ability to significantly reduce the Bloom filter based false positive for user authentication in IoT-WSNs, while also preserving the constraint resources of WSNs. To estimate the security robustness of the proposed protocol based on the security goals of IoT-WSNs, we perform the formal security analysis using the random oracle and Real-Or-Random (ROR) models, informal security analysis and also the formal security verification using a widely-recognized automated software validation tool, known as Automated Validation of Internet Security Protocols and Applications (AVISPA). Next, communication and computational overheads analysis reveal that the proposed protocol is appropriate for resource-constrained sensor nodes. Furthermore, a correlative security feature and complexity analysis outcomes validate that the proposed protocol is reliable, secure, and efficient in comparison with other existing state of art related user authentication protocols.

Formal security analysis of lightweight authenticated key agreement protocol for IoT in cloud computing

The internet of things (IoT) and cloud computing are evolving technologies in the information technology field. Merging the pervasive IoT technology with cloud computing is an innovative solution for better analytics and decision-making. Deployed IoT devices offload different types of data to the cloud, while cloud computing converges the infrastructure, links up the servers, analyzes information obtained from the IoT devices, reinforces processing power, and offers huge storage capacity. However, this merging is prone to various cyber threats that affect the IoT-Cloud environment. Mutual authentication is considered as the forefront mechanism for cyber-attacks as the IoT-Cloud participants have to ensure the authenticity of each other and generate a session key for securing the exchanged traffic. While designing these mechanisms, the constrained nature of the IoT devices must be taken into consideration. We proposed a novel lightweight protocol (Light-AHAKA) for authenticating IoT-Cloud elements and establishing a key agreement for encrypting the exchanged sensitive data was proposed. In this paper, the formal verification of (Light-AHAKA) was presented to prove and verify the correctness of our proposed protocol to ensure that the protocol is free from design flaws before the deployment phase. The verification is performed based on two different approaches, the strand space model and the automated validation of internet security protocols and applications (AVISPA) tool.

A lightweight anonymous cross-regional mutual authentication scheme using blockchain technology for internet of vehicles

The Internet of Vehicles (IoV) is regarded as the application of the Internet of Things (IoT) in transportation. Each vehicle will acts as a separate node on the Internet of Vehicles, which possesses specific ability to collect data and then send the collected data to the network. In this paper, we propose a scheme with the features of lightweight anonymous mutual authentication and key agreement using blockchain technology to obtain the session key. The security of this scheme is proved by formal proof of Burrows–Abadi–Needham (BAN) logic and informal analysis. Besides, the Automated Validation of Internet Security Protocols and Applications (AVISPA) is used to simulate the scheme. Finally, compared with other related schemes, this scheme has superior advantages and efficiency in lightweight characteristics.