Backward Secrecy Research Articles

BP-MGKM: An efficient multi-group key management scheme based on bivariate polynomial

As wireless sensor networks are becoming increasingly reliant on communication among heterogeneous wireless sensor nodes , the need for secure communication in multi-groups has grown tremendously. Secure group key management in the multi-group scenario is a major challenge. The existing group key management schemes focus on managing a single group. However, there is not much work done regarding secure communication in multiple groups simultaneously. Existing multi-group key management schemes usually fail to meet the performance demands and suffer from improper management of keys, violation of security requirements, or huge complexity. We have analyzed the existing schemes for secure multi-group key management and found that the major issue lies in the complexity overhead during the membership update process in the multi-group scenario. On that account, we have proposed a new and efficient scheme (BP-MGKM) for secure multi-group key management based on bivariate polynomial . BP-MGKM is more efficient than other existing schemes in the context of complexity incurred during re-keying procedures. BP-MGKM features forward and backward secrecy, resilience against node compromise attack, collusion attack, and replay attack. The proposed scheme is secure and efficient than the existing schemes.

Secure and Efficient Distributed Relay-Based Rekeying Algorithm for Group Communication in Mobile Multihop Relay Network

In mobile multihop relay (MMR) networks, Relay multicast rekeying algorithm (RMRA) is meant to ensure secure multicast communication and selective updating of keys in MMR networks. However, in RMRA, the rekeying is carried out after a specific interval of time, which cannot ensure the security for multicast communication on joining the member. Secondly, the rekeying scheme generates a huge communication overhead on the serving multihop relay base station (MR-BS) on frequent joining of members. Lastly, there is nothing about when a member left the group communication. Thus, the rekeying scheme of RMRA fails to provide forward and backward secrecy and also is not scalable. To solve this problem, an improved rekeying scheme based on broadcasting a new seed value on joining and leaving of a member for updating the ongoing key management is proposed. The proposed scheme solves the issue of forward and backward secrecy and the scalability in a very simplified way. The forward and backward secrecy of the proposed scheme has been extensively validated by formal method using rank theorem. Furthermore, mathematical derivation showed that the proposed scheme out-performed the RMRA in terms of communication cost and complexity.

Towards achieving efficient access control of medical data with both forward and backward secrecy

Healthcare service providers store the patients’ electronic medical records in the cloud in order to provide high quality healthcare services. Patients’ sensitive data is typically encrypted before storing in the cloud. However, it gives rise to a new challenge, namely access control over encrypted data. Attribute-Based Encryption (ABE) is a promising cryptographic technique to achieve the fine grained access control on outsourced encrypted data. Traditional ABE schemes assume a fixed access policy that is not suitable for the present dynamic environment. Although some ABE schemes with a dynamic access control policy have been proposed in the literature, these schemes have not addressed forward security, backward security, and user revocation after a policy update. In this paper, we propose an ABE scheme that supports access policy updates, and also provides forward security, backward security and user revocation at the same time. We have formally shown that the proposed scheme is Chosen Plaintext Attack (CPA)-secure under the Decisional Bilinear Diffie–Hellman (DBDH) assumption. Finally, the performance analysis exhibits that the proposed scheme is efficient in communication and computation, and is also suitable for resource constrained devices.

A seamless anonymous authentication protocol for mobile edge computing infrastructure

Mobile Edge Computing (MEC) accommodates processing and data storage and manipulation capabilities across the scope of wireless network. In MEC environment, MEC servers along with the computing and storage capabilities are distributed at the edge of the network. However, due to the broad range of wireless communication, the fulfillment of security requirements still remain a challenging task in the for MEC environment. With the expeditious traffic expansion and growing end user requirements, the classic security protocols cannot encounter the innovative requirements of lightweightness and real-time communication. To meet these requirements, we have proposed an authentication protocol for the MEC environment. Our proposed protocol stipulates secure and efficient communication for all of the intended entities. Meanwhile, during its execution user anonymity remains intact. Moreover, our protocol is proven to be secure under the assumptions of formal security model. Additionally in this article, we have described the security properties of our protocol that it offers resistance against impersonation, session key computation and forward and backward secrecy attacks. The comparative analysis of time consumption and computation overheads are presented at the end of the paper, which is an evidence that our proposed protocol outperforms prior to various existing MEC protocols.

SECURED DATA RETRIEVAL IN MILITARY APPLICATIONS USING CP-ABE

Disruption-tolerant network (DTN) technologies are only solutions for military environment because of their mobile nodes irregular network connectivity and frequent partitions. But due to its nature of having external storage node during the transmission there is chance of getting exploited. Cipher text-policy attribute-based encryption(CP-ABE), is a good solution however, the problem of applying CP-ABE in decentralized DTNs introduces several security and privacy challenges with regard to the attribute revocation, key escrow, and coordination of attributes issued from different authorities.Some users (receivers) may change their associated attributes at some point (for example moving their region) here there is a need of attribute updation and also provides forward and backward secrecy for the attribute revocation problem. So we proposed a system that provides a multi authority CP-ABE scheme for secure data retrieval in decentralized DTNs a variation of the CP-ABE algorithm that overcomes the attribute revocation problem.

LPC: A lightweight pseudonym changing scheme with robust forward and backward secrecy for V2X

Vehicle-to-everything (V2X) has been regarded as an important enabling technology for future intelligent transportation systems (ITS). Safety-critical applications in V2X require authentication of nodes and messages, and also need to preserve the privacy of vehicles. Pseudonymity plays an important role in V2X communication by satisfying both security and privacy requirements. In this paper, we analyze the weaknesses of a recent relevant work named Issue First Activate Later (IFAL), which is the leading European candidate for V2X. We then propose a novel lightweight, secure and privacy-preserving pseudonym changing scheme. Through the security analysis, we show that the proposed scheme achieves the asynchronous key agreement, and realizes both robust forward secrecy and backward secrecy while keeping security functionalities of IFAL. Furthermore, the performance analysis is conducted on Arduino Mega 2560 to illustrate that the proposed scheme is feasible and practical. © 2014 xxxxxxxx. Hosting by Elsevier B.V. All rights reserved.

Cluster space key management scheme based on threshold secret sharing and bilinear pairing

SummarySpace key management schemes play a critical role in space information network security services. However, the existing space key management schemes are inefficient. To overcome these problems, this paper proposed a cluster group key management scheme, in which the space nodes are divided into different clusters. The ground control center (GCC) is used as a private key generation center. The threshold technique based on low‐density parity‐check code (LDPC) is used in the group key management of the cluster‐heads. The key escrow is transferred to GCC, which is a compromise of efficiency and security. The logical key hierarchy is used to manage the group key of the cluster. Furthermore, the bilinear paring‐based cryptosystem is employed to provide the identification. The formalized security proof of the protocol using the Extended Canetti–Krawczyk (ECK) model is introduced to prove the authentication and security. The consistency, forward secrecy, backward secrecy, ability to against the collusion attack and performance are analyzed and simulated. The result shows that the proposed scheme takes lower storage cost and computational cost.

Drone Secure Communication Protocol for Future Sensitive Applications in Military Zone.

Unmanned Aerial Vehicle (UAV) plays a paramount role in various fields, such as military, aerospace, reconnaissance, agriculture, and many more. The development and implementation of these devices have become vital in terms of usability and reachability. Unfortunately, as they become widespread and their demand grows, they are becoming more and more vulnerable to several security attacks, including, but not limited to, jamming, information leakage, and spoofing. In order to cope with such attacks and security threats, a proper design of robust security protocols is indispensable. Although several pieces of research have been carried out with this regard, there are still research gaps, particularly concerning UAV-to-UAV secure communication, support for perfect forward secrecy, and provision of non-repudiation. Especially in a military scenario, it is essential to solve these gaps. In this paper, we studied the security prerequisites of the UAV communication protocol, specifically in the military setting. More importantly, a security protocol (with two sub-protocols), that serves in securing the communication between UAVs, and between a UAV and a Ground Control Station, is proposed. This protocol, apart from the common security requirements, achieves perfect forward secrecy and non-repudiation, which are essential to a secure military communication. The proposed protocol is formally and thoroughly verified by using the BAN-logic (Burrow-Abadi-Needham logic) and Scyther tool, followed by performance evaluation and implementation of the protocol on a real UAV. From the security and performance evaluation, it is indicated that the proposed protocol is superior compared to other related protocols while meeting confidentiality, integrity, mutual authentication, non-repudiation, perfect forward secrecy, perfect backward secrecy, response to DoS (Denial of Service) attacks, man-in-the-middle protection, and D2D (Drone-to-Drone) security.

Efficient, Flexible and Secure Group Key Management Protocol for Dynamic IoT Settings

For many Internet of Things (IoT) scenarios, group communication in the form of multicasting and broadcasting has proven to be effective. Classical Group Key Management (GKM) schemes perform inefficiently in dynamic IoT environments, wherein nodes frequently leave or join a network or migrate from one group to another. In this paper, we present a highly efficient and secure GKM protocol for dynamic IoT settings, which maintains forward and backward secrecy at all times and is completely resistant to collusion attacks. Also, our protocol is highly flexible and can handle several new scenarios in which device or user dynamics may take place, e.g., allowing a device group to join or leave the network or creation or dissolution of a user group, which are not handled by schemes proposed in prior work. We evaluate the performance of the proposed protocol via extensive mathematical analysis and numerical computations.

A novel methodology for secure group communication in Internet of Things

Nowadays, Wireless Sensor Networks (WSNs) are considered as a most important applications due to its rapid propagation. In an Internet of Things (IoT) network, the messages are exchanged and routed in an open multiple devices, therefore security is one of the major issue. Hence, the most important requirements in IoT networks is integrity of information, optimized energy consumption and data security. All the group members uses the shared symmetric key called Group Key (GK) for maintaining data confidentiality within a group. A forward and backward secrecy are maintained by redistributing the GK while joining and leaving of a group member. But, when consuming the scarce network resources, the key management includes generation and distribution process causes overhead. In this research study, Advanced Encryption Standard (AES) is used to design the lightweight and secure Group Communication (GC) and finally, preserved the data integrity by Public Key Infrastructure (PKI). By using AES-PKI algorithm, the method achieved secure GCs in network against attacks, lower bandwidth utilization and network overhead in key re-distribution and management operations. In addition, the proposed AES-PKI method ensured the data confidentiality by backward and forward secrecy in key distribution method and also effective against the network mobility in scalable IoT networks. The performance of AES-PKI is validated by simulation dynamic results of energy consumption and packet receiving ratio.

A Privacy-Preserving Key Management Scheme with Support for Sybil Attack Detection in VANETs.

Vehicular ad hoc networks (VANETs) face two important and conflicting challenges with regards to security: preserve the privacy of vehicles in order to prevent malicious entities from tracking users and detect and remove bad actors that attempt to game the system for their own advantage. In particular, detecting Sybil attacks, in which one node attempts to appear as many, seemingly conflicts with the goal of privacy preservation, and existing schemes fail on either one or both accounts. To fill this gap, we present a hierarchical key management system which uses short group signatures to preserve member privacy at lower levels while allowing mid-level nodes to detect Sybil attacks and highly trusted nodes at the top of the hierarchy to completely reveal the real identities of malicious nodes in order to prevent them from rejoining the system and for use by legal authorities. In addition, we present an argument for relaxing the requirement of backward secrecy in VANET groups in the case when no malicious activity has been detected.

A blockchain-based intelligent anti-switch package in tracing logistics system

In recent years, with the rapid development of e-commerce and network technologies, many people do online shopping through the Internet. If a physical product is bought by a client, the store will entrust their logistics to deliver the goods to the client. However, there have been many cases of switched goods which were purchased by clients recently. Some scholars proposed a security mechanism with a subliminal channel for E-cash and digital content previously. Only the designated sender and the designated receiver know the subliminal message which was hidden in the signature. Thus, it can be applied to solve the switched package issue. According to the WTO (World Trade Organization) forum, blockchain-related logistics applications have gradually emerged in recent days. Blockchain technology is essentially a decentralized database maintained by the collective. It has the characteristics of high reliability and high confidentiality and has a good prospect in effectively solving the trust problem between the two parties. In short, blockchain information will be publicly verifiable and cannot be tampered with, which provides solutions for traditional logistics. It realizes trust and cooperation between multiple entities, and create a modernized logistics environment. In this paper, we attach a sensor to monitor the situation of the delivery object and tag on the package to be an IoT object. The proposed scheme is a blockchain-based intelligent anti-switch package in tracing the logistics system. The client can check the GPS (Global Positioning System) location, the temperature, and humidity sensing data of the package any time during the delivery process, and the IoT-related intelligent logistics can be achieved. The proposed scheme also achieves data integrity, resisting replay attack, forward and backward secrecy, non-repudiation, and mutual authentication.

PMTER-ABE: a practical multi-authority CP-ABE with traceability, revocation and outsourcing decryption for secure access control in cloud systems

Attribute-based encryption (ABE) has evolved as an efficient and secure method for storage of data with fine-grained access control in cloud platforms. In recent years, increasing diversification in the design of ABE schemes has led to significant research in the assimilation of properties like traceability, revocation, and outsourcing decryption. However, most of the recent ABE schemes incorporate few of these properties and hence lack in robustness to adapt with varying demands of cloud systems. In modern ABE designs, the notions of forward and backward secrecy have been introduced to accommodate the delegation of a large number of heterogeneous users in the system. In general, these features are realized under the concept of user revocation. On the other hand, to control malicious users in the system, it is necessary to implement traceability in integration with user revocation. Finally, for resource-constrained users, outsourcing decryption to proxy servers is a viable option. Thus, we propose PMTER-ABE, a practical decentralized multi-authority traceable and efficiently revocable attribute-based cryptosystem with outsourcing decryption advantage. The key features of our cryptosystem are (i) incorporating large attribute universe with highly expressive policies, (ii) integrating forward and backward secrecy under user revocation, (iii) implementing white-box traceability to detect malicious users, and (iv) outsourcing decryption to reduce the computational overhead of decryption on users. We present the formal proofs for correctness, security, and traceability of PMTER-ABE along with performance analysis. The efficiency and usability of PMTER-ABE is shown with practical implementation and experimental results.

Efficient Short Group Signatures for Conditional Privacy in Vehicular Ad Hoc Networks via ID Caching and Timed Revocation

Vehicular Ad hoc Networks (VANETs) are a subset of the Internet of Things (IoT) that are used in smart traffic applications. Due to their high speed, mobility, and exposure to the environment, the security requirements for VANETs result in the conflicting design goals of protecting member privacy while also ensuring non-repudiation. Group signature schemes can fulfill these requirements, but often at the cost of expensive bilinear pairing operations. Furthermore, the cost of updating the group key information can be costly. Accordingly, this paper has two goals. First, it presents a group signature scheme that has been modified to remove pairing operations by caching computed values, while still preserving the critical requirement of conditional privacy. Second, this paper presents an argument for the abandonment of perfect forward and backward secrecy in VANET schemes in order to prevent the generation of keys that are never used, or used only once, and reduce the twin burdens of excessive key recalculation and key redistribution on the system.

Multi-level on-demand access control for flexible data sharing in cloud

The exponential growth of data storage and sharing in cloud demands an efficient access control mechanism for flexible data sharing. Attribute-Based Encryption (ABE) is a promising cryptographic solution to share data among users in the cloud. But it suffers from user revocation, attribute revocation, forward secrecy and backward secrecy issues. Communication and computation overhead is more due to the linear variation in the size of ciphertext and the secret key with respect to the number of attributes. In this paper, we investigate an on-demand access control for flexible sharing of secure data among randomly selected users. It is a tunable access control mechanism for the flexible sharing of ciphertext classes in the cloud. It delegates the decryption rights of any set of ciphertext classes among the users only if their attributes are satisfied with the access policy associated with ciphertext and if they should possess a compact key corresponding to the intended set of ciphertext classes. It produces a constant size ciphertext and a compact secret key to efficiently utilize the storage space and reduce the communication cost. The compact key aggregates the power of secret keys used to encrypt the outsourced data. This method flexibly shares the ciphertext classes among the randomly selected users with a specific set of attributes. All other ciphertext classes outside the set remain confidential. It allows dynamic data updates by verifying the data manipulation privilege of users with the help of claim policy. The proposed scheme provides access control of varying granularity, at user-level, at file-level, and attribute-level. Granularity levels can be chosen based on applications and user demands. Hence, it is a multi-level, tunable access control over the shared data. It is very useful for secure data storage. This scheme tackles user revocation and attribute revocation problems so that, it allows the data owner to revoke a specific user or a group of users. It prevents forward and backward secrecy issues.

A proposed authentication and group-key distribution model for data warehouse signature, DWS framework

In the virtual world, the authentication process is used to prove the identity for both of the server and the clients. Therefore, the authentication is an urgent issue for sharing data between users in the data warehouse systems. This paper presents the enhancement of Data Warehouse Signature (DWS) framework through proposing a novel authentication and group-key distribution model, based on the modular symmetric polynomials, to distribute a secure group-key between the manager and the chosen executors. To the best of our knowledge, we are the first to propose a group-key based on the symmetric polynomial and the modular arithmetic. This leads to increase the security level of the proposed model from t, where t is the symmetric polynomial degree, to ∑i=1cci×t, where c is the number of executors in the DWS system. In this paper, enhancing the DWS achieves the high performance using a parallel computing in our middleware. The proposed model has the lowest cost of computation, communication and complexity overheads among the existing security models. Additionally, security analysis shows that the proposed model achieves the key security, prevents insider and outsider attacks, and provides forward and backward secrecy.

Lightweight and Certificateless Multi-Receiver Secure Data Transmission Protocol for Wireless Body Area Networks

The rapid development of low-power integrated circuits, wireless communication, intelligent sensors, and microelectronics has allowed the realization of wireless body area networks (WBANs), which can monitor patients’ vital body parameters remotely in real time to offer timely treatment. These vital body parameters are related to patients’ life and health; and these highly private data are subject to many security threats. To guarantee privacy, many secure communication protocols have been proposed. However, most of these protocols have a one-to-one structure in extra-body communication and cannot support multidisciplinary team (MDT). Hence, we propose a lightweight and certificateless multi-receiver secure data transmission protocol for WBANs to support MDT treatment in this article. In particular, a novel multi-receiver certificateless generalized signcryption (MR-CLGSC) scheme is proposed that can adaptively use only one algorithm to implement one of three cryptographic primitives: signature, encryption or signcryption. Then, a multi-receiver secure data transmission protocol based on the MR-CLGSC scheme with many security properties, such as data integrity and confidentiality, non-repudiation, anonymity, forward and backward secrecy, unlinkability and data freshness, is designed. Both security analysis and performance analysis show that the proposed protocol for WBANs is secure, efficient, and highly practical.

Security Tools for Internet of Things: A Review

In today’s communications, the main challenging facet is Security of LTE systems in terms of various areas such as mutual authentication, key management, forward and backward secrecy, use of efficient security tools, etc. For proper key management, the generation and distribution of random keys is of main concern which can be done with the help of dynamic security tools. In this paper, main features of security tools like, Docker, Java Cryptography Architecture (JCA), Token-based authentication have been reviewed. Docker provides containerized environment based on application virtualization and also lighter than virtual machines. To define cryptographic concepts and algorithms, JCA cites design patterns and an extensible framework for Java platform. Token-based authentication method or system is used to provide secure user access to server using a token, like smart cards.

A Blockchain-Based Authentication and Dynamic Group Key Agreement Protocol.

With the rapid development of mobile networks, there are more and more application scenarios that require group communication. For example, in mobile edge computing, group communication can be used to transmit messages to all group members with minimal resources. The group key directly affects the security of the group communication. Most existing group key agreement protocols are often flawed in performance, scalability, forward or backward secrecy, or single node failure. Therefore, this paper proposes a blockchain-based authentication and dynamic group key agreement protocol. With our protocol, each group member only needs to authenticate its left neighbor once to complete the authentication, which improved authentication efficiency. In addition, our protocol guarantees the forward secrecy of group members after joining the group and the backward secrecy of group members after leaving the group. Based on blockchain technology, we solve the problem of single node failure. Furthermore, we use mathematics to prove the correctness and security of our protocol, and the comparison to related protocols shows that our protocol reduces computation and communication costs.

Tree and elliptic curve based efficient and secure group key agreement protocol

Group Key Agreement Protocol (GKAP) is a cryptographic mechanism where members of a group agree on a common key by sharing their blinded keys over a public channel. Sharing a key over a public channel is a security threat and expensive in terms of communication cost. In this paper, we proposed the GKAP based on tree and elliptic curve. For reducing the communication cost, we have used the divide-and-conquer mechanism with that group is divided into small subgroups and forming a tree-like structure. The modified Elliptic-Curve-Diffie–Hellman used for sharing the blinded key over a public network channel securely. This paper discussing different group key management operations are initialization, join, mass join, leave, mass-leave, merge with their communication cost are the number of rounds, unicast cost, broadcast cost, messages. This paper discussing the establishment of common keys not only for the group but also for the subgroups. Based on communication cost, we have compared the performance of proposed method with the existing approaches like Communication-Computation Efficient Group Key Algorithm (CCEGK), Tree-based group key agreement (TGDH), Ternary-tree based group key agreement protocol for dynamic group (TTGKAP), Group key generation tree protocol (GKGT), Ternary tree-based group key agreement protocol over elliptic curve for dynamic group (TTEGKAP), Efficient Group key agreement using hierarchical key tree (EGKAKT). From performance analysis, it is cleared that proposed approach performed better in most of the cases than the existing approaches. The proposed approach is safe against passive attack, collaborative attack, forward secrecy, backward secrecy, and man-in-the-middle attack.