Broadcast Authentication Protocol Research Articles

Comparative study of novel packet loss analysis and recovery capability between hybrid TLI-µTESLA and other variant TESLA protocols

Analyzing packet loss, whether resulting from communication challenges or malicious attacks, is vital for broadcast authentication protocols. It ensures legitimate and continuous authentication across networks. While previous studies have mainly focused on countering Denial of Service (DoS) attacks' impact on packet loss, our research introduces an innovative investigation into packet loss and develops data recovery within variant TESLA protocols. We highlight the efficacy of our proposed hybrid TLI-µTESLA protocol in maintaining continuous and robust connections among network members, while maximizing data recovery in adverse communication conditions. The study examines the unique packet structures associated with each TESLA protocol variant, emphasizing the implications of losing each type on the network performance. We also introduce modifications to variant TESLA protocols to improve data recovery and alleviate the effects of packet loss. Using Java programming language, we conducted simulation analyses that illustrate the adaptability of variant TESLA protocols in recovering lost packet keys and authenticating previously buffered packets, all while maintaining continuous and robust authentication between network members. Our findings also underscore the superiority of the hybrid TLI-µTESLA protocol in terms of packet loss performance and data recovery, alongside its robust cybersecurity features, including confidentiality, integrity, availability, and accessibility. Additionally, we demonstrated the efficiency of our proposed protocol in terms of low computational and communication requirements compared to earlier TESLA protocol variants, as outlined in previous publications.

EBiBa: A Post-Quantum Hash-Based Signature With Small Signature Size in the Continuous Communication of Large-Scale Data

Abstract We present eBiBa (enhanced BiBa), a hash-based signature scheme with the smallest possible signature size, while ensuring high feasibility and security in a specific application model. Our scheme is tailored to address the communication requirement of a large-scale public data stream continuously disseminated between two participants while ensuring data source and data integrity authentication. To achieve these goals, firstly, we optimized the classical hash tree mode into a hybrid mode to efficiently perform public key authentication and eliminate the need for an authenticated channel to transmit large amounts of data, unlike the initial BiBa-based broadcast authentication protocol. Secondly, we employed a specific tweakable hash chain function to digest a batch of messages, reducing the required conditions for post-quantum existential unforgeability under adaptive chosen message attack (EUCMA) of eBiBa to a second-pre-image-resistance-like property instead of collision resistance. This results in reduced pre-computation in both key and signature generations. Thirdly, we utilized a forward-secure pseudorandom function to achieve forward-secure of the proposed scheme. Finally, we minimize the signature size through a series of procedures. Firstly, we select BiBa few-time signature as the underlying signature scheme since it is currently the few-time hash-based signature with the smallest signature size that we are aware of; in addition, the hybrid approach we employed can also significantly reduce the signature size compared to using a hash tree solely; for the hash tree structure, we design a specific authentication path in combination with the related communication model to further minimize the signature size; finally, we optimize the authentication approach to achieve the minimum signature size in a single transmission. Our construction minimizes the signature size in the aforementioned model, achieving a compression rate of 0.017 to 0.828 based on distinct values of parameters, as compared to XMSS-256. We also demonstrated that eBiBa can achieve post-quantum forward-secure and EUCMA security.

Simulation Analysis and Comparison of New Hybrid TLI-µTESLA and Variant TESLA Protocols Using SHA-2 and SHA-3 Hash Functions

The evolution of 5G and 6G networks has enhanced the ability of massive IoT devices to provide real-time monitoring and interaction with the surrounding environment. Despite recent advances, the necessary security services, such as immediate and continuous authentication, high scalability, and cybersecurity handling of IoT cannot be achieved in a single broadcast authentication protocol. This paper presents a new hybrid protocol called Hybrid Two-level µ-timed-efficient stream loss-tolerant authentication (Hybrid TLI-µTESLA) protocol, which maximizes the benefits of the previous TESLA protocol variants, including scalability support and immediate authentication of Multilevel-µTESLA protocol and continuous authentication with minimal computation overhead of enhanced Inf-TESLA protocol. The inclusion of three different keychains and checking criteria of the packets in the Hybrid TLI-µTESLA protocol enabled resistance against Masquerading, Modification, Man-in-the-Middle, Brute-force, and DoS attacks. A solution for the authentication problem in the first and last packets of the high-level and low-level keychains of the Multilevel-µTESLA protocol was also proposed. The simulation analysis was performed using Java, where we compared the Hybrid TLI-µTESLA protocol with other variants for time complexity and computation overhead at the sender and receiver sides. We also conducted a comparative analysis between two hash functions, SHA-2 and SHA-3, and assessed the feasibility of the proposed protocol in the forthcoming 6G technology. The results demonstrated the superiority of the proposed protocol over other variants in terms of immediate and continuous authentication, scalability, cybersecurity, lifetime, network performance, and compatibility with 5G and 6G IoT generations.

New Lattice-Based Broadcast Authentication Protocol for Wireless Sensor Networks

At present, wireless sensor networks have become one of the indispensable infrastructures in people’s lives. Considering the frequent mobility of wireless sensor network nodes, an efficient lattice-based random broadcast authentication protocol is proposed. The security of the proposed protocol is based on the SIS problem which helps to resist against quantum attacks. In this paper, we propose two forms of broadcast authentication, that is, one-to-many broadcast authentication and one-to-one broadcast authentication. The proposed protocol satisfies the broadcast authentication property. Moreover, the resistance against man in the middle attack, antireplay attack, unforgeability, and scalability properties are achieved. Moreover, its efficiency has certain advantages with other lattice-based studies.

Enhanced Inf-TESLA Protocol: A Continuous Connectivity and Low Overhead Authentication Protocol via IoT Devices

Continuous and low-cost broadcast authentication is a fundamental security service for distributed sensor networks. This paper presents a novel development of a continuous and low-overhead broadcast authentication protocol named enhanced Infinite timed-efficient stream-loss tolerant authentication (enhanced Inf-TESLA) protocol, based on the Inf-TESLA protocol, whose continuous authentication is limited to the duration of its keychains. The enhanced Inf-TESLA protocol satisfies important security properties, including lower communication and computational overhead; a continuous generation of keychains without the need to establish synchronization packets; scalability to a large network; and resistance to masquerading, modification, man-in-the-middle, and replay attacks. We also highlighted an unaddressed authentication issue in the last packets of the original TESLA protocol and proposed a corresponding solution. We performed a simulation analysis using JAVA and proved that, compared to the Inf-TESLA protocol, the enhanced Inf-TESLA protocol can continuously authenticate packets for the entire lifetime of the receiver. We also compared the enhanced Inf-TESLA protocol with the original TESLA protocol in terms of time complexity and critical authentication processes. The results revealed the superiority of the enhanced Inf-TESLA protocol over the original TESLA protocol in terms of the message authentication code (MAC) value generation time and packet authentication time, which we believe can significantly improve the lifetime and lower the energy expenditure of Internet of Things devices with limited power sources.

CBACS: A Privacy-Preserving and Efficient Cache-Based Access Control Scheme for Software Defined Vehicular Networks

In vehicular networks, caching content in fog nodes is a widely accepted and favorable way to quickly respond to massive vehicle requests, reduce content retrieval delay and improve service quality. However, to implement such caching mode, it is critical to ensure efficient security and privacy protection when vehicles access the cached content in fog nodes. In this paper, aiming at the security issue, a novel lightweight cryptography-based access control scheme for software defined vehicular networks (SDVN) is proposed, by using TESLA broadcast authentication protocol and Pederson commitment. The scheme realizes direct and efficient authentication between vehicles and fog nodes while limiting only legitimate vehicles can get request responses, and avoids limitations or deficiencies in existing access control schemes. Moreover, considering the limited cache space of the fog node, by utilizing the flexibility of the SDN paradigm, a cooperative cache update mechanism is provided. The security verification with ProVerif and detailed security analyses prove that the scheme can meet the security requirements in SDVN. And compared with the related works, our scheme achieves better performance in terms of computation and communication costs.

Flight Trial Demonstration of Secure GBAS via the L-band Digital Aeronautical Communications System (LDACS)

The ground-based augmentation system (GBAS) is the cornerstone for enabling automated landings without the instrument landing system (ILS). Currently, GBAS is evolving to GBAS approach service type-D (GAST-D) for category III landings. This development toward GBAS GAST-D extends GBAS via the use of multiple frequencies (L1/L2 and L5) and the use of multiple global navigation satellite system constellations. GBAS requires correction data to be broadcast to aircraft, which is currently handled via the VHF data broadcast (VDB) datalink. However, VDB has several known shortcomings: 1) low throughput, 2) small area of operation, and 3) no cyber-security measures. In this article, we propose the use of the L-band digital aeronautical communications system (LDACS) for broadcasting GBAS correction data to address these shortcomings. In flight experiments conducted in 2019, we set up an experimental GBAS installation using LDACS. Broadcast data are secured using the timed efficient stream loss-tolerant authentication (TESLA) broadcast authentication protocol. Our results indicate that cryptographically secured GBAS data via LDACS can provide GAST-C and GAST-D services with high availability if cryptographic parameters are chosen appropriately.

Certificateless and Lightweight Authentication Scheme for Vehicular Communication Networks

Reducing the number of road accidents is a key agenda item for governments across the world. This has led to an increase in the amount of attention given to Vehicular Communication Systems (VCS), which are seen as an important technology that can offer significant improvements in road safety. Using VCS, vehicles can form a dynamic self-configuring network that enables a vehicle to communicate with other vehicles (V2V) and roadside infrastructure (V2I). However, such wireless communication channels are vulnerable to attacks, and therefore an authentication scheme for communications should be designed before the deployment. Prior work has focused on utilising digital signature approaches to achieve the security requirements, but due to the special characteristics of VCS, such approaches are not well suited for safety related applications of VCS, since they incur high communication and computation overheads. To combat this issue, we propose a certificateless and lightweight authentication scheme to provide means of secure communications for VCS. In this work we introduce authentication tokens, which replace digital certificates to reduce the burden of certificate management on a Trusted Authority (TA). In addition, the utilisation of tokens ensures that mutual authentication is achieved for V2I communication. Moreover, we employ TESLA as the underlying broadcast authentication protocol to achieve the required security goals for safety message broadcasting. According to the security analysis and extensive simulation of our scheme, the results show that it can withstands various types of attacks. Also it has better performance in term of verification delay, scalability and communication overhead compared to lightweight authentication schemes that are based on similar techniques. Therefore, the scheme is well suited for VCS

An Improved Broadcast Authentication Protocol for Wireless Sensor Networks Based on the Self-Reinitializable Hash Chains

Broadcast authentication is a fundamental security primitive in wireless sensor networks (WSNs), which is a critical sensing component of IoT. Although symmetric-key-based μTESLA protocol has been proposed, some concerns about the difficulty of predicting the network lifecycle in advance and the security problems caused by an overlong long hash chain still remain. This paper presents a scalable broadcast authentication scheme named DH-μTESLA, which is an extension and improvement of μTESLA and Multilevel μTESLA, to achieve several vital properties, such as infinite lifecycle of hash chains, security authentication, scalability, and strong tolerance of message loss. The proposal consists of the t,n-threshold-based self-reinitializable hash chain scheme (SRHC-TD) and the d-left-counting-Bloom-filter-based authentication scheme (AdlCBF). In comparison to other broadcast authentication protocols, our proposal achieves more security properties such as fresh node’s participation and DoS resistance. Furthermore, the reinitializable hash chain constructed in SRHC-TD is proved to be secure and has less computation and communication overhead compared with typical solutions, and efficient storage is realized based on AdlCBF, which can also defend against DoS attacks.

Lightweight Broadcast Authentication Protocol for Edge-Based Applications

In this article, we propose a lightweight authentication protocol that provides forward secrecy for edge-based applications. Motivated by the general consensus that centralized authentication solutions are not suitable for an expanding Internet of Things (IoT), our edge-based authentication reduces latency for critical applications, lowers cloud dependency, and employs cryptographic primitives, which are efficiently implemented on resource-constrained low-end devices. Moreover, the edge entity broadcast messages using session keys that are derived securely from a hash function. The protocol utilizes hash chains and authenticated encryption which makes it resilient to quantum attacks. Moreover, entities are not required to hold a permanent master key, and all session keys are derived securely from a hash function. As a use case, we present a smart emergency system where an edge application broadcasts alert messages for individual responder groups when specific events occur. We formally define and prove the main security properties of our protocol, and compare it to other lightweight protocols in terms of security and performance. The computational complexity of our protocol comprises of three decryption operations, two HMAC, and five hash computations. The required storage for each node is 96 B and the communication overhead is only 56 B per session.

An Ultra-Lightweight and Provably Secure Broadcast Authentication Protocol for Smart Grid Communications

The information and communication technology (ICT) can bring attractive features to the traditional power grid such as energy conserving, reliability, efficiency, transparency, and cost reducing. All of these features can be accomplished with a concept called smart grid. However, the use of ICT introduces new challenges in security issue. There are many researches in recent years which have studied security as the most important challenge of the smart grid. Based on these researches, two important issues for the smart grid security protocols must be considered. In the first issue, the important security requirement such as confidentiality, authentication, integrity, etc. needs to be fulfilled. However, the cryptographic algorithms impose significant level of storage, communication, and computational costs to the system while, the smart meters are resource-constrained devices. Therefore, lightweight design of the security schemes is considered as another important issue. To that end, this paper proposes a novel provably secure broadcast authentication scheme based on one-way hash function, which not only can resist to the possible existing attacks but also dramatically reduces the storage and computational costs.

Shelter Brazen Out Apprehension and Their Exposure in VANET

Vehicular Ad hoc Networks (VANET) is an application of MANET, due to its high mobility node which became exceedingly challenging research area. Vehicles which are connected to the NET through OBU (On board unit) are treated as nodes normally with high mobility in VANET. These nodes are certainly have authentication to transceives the status and refuge signals through one control groove having a modest bandwidth. This may origin an increasing impinging to the channel especially in impenetrable traffic circumstance. In Vehicular Accident Prevention System, the refuge messages are transceives through OBU sporadically on the highway to all of their neighbors within hearing range. These refuge messages are time sensitive and have stringent delay requirements. For these kinds of serious issue, Broadcast Authentication Protocol and Safe Routing are proposed against DDoS Attacks. The DDoS attacks broadcast towards authentication protocol leads to foreclose enervated authenticator. VANET networks is strongly dependent on their security and time alone features through routing, which will be conferred in this paper. The proposed protocol aims to make periodic the refuge messages to the proper authenticated nodes, so as to reduce the load on control groove as well as to avoid the collision within the short area of the sender vehicle.

A two way authentication using bilinear mapping function for wireless sensor networks

The deployment of sensor networks for security and safety related environments requires securing communication primitives such as broadcast, multicast, and point to point communication. Security services are vital for ensuring the integrity, authenticity, and confidentiality of the critical information. Therefore, the authentication mechanisms are required to support these security services and to be resilient to distinct attacks. Recent research shows that two-way authentication provides better security and high energy saving for wireless sensor networks (WSN). In this work, we investigate a shared authentication protocol for WSNs using bilinear mapping function. Many one-way broadcast authentication protocol proposed such as Timed Efficient Stream Loss-Tolerant Authentication (TESLA), Bin and Balls Authentication (BiBA), etc., which cannot provide energy efficient authentication. Here, we propose a two-way authentication based on bilinear map function and used in secure group formation algorithm. The performance metrics such as message cost, computation and communication overhead are calculated.

PUF‐based solutions for secure communications in Advanced Metering Infrastructure (AMI)

AbstractAdvanced metering infrastructure (AMI) provides 2‐way communications between the utility and the smart meters. Developing authenticated key exchange (AKE) and broadcast authentication (BA) protocols is essential to provide secure communications in AMI. The security of all existing cryptographic protocols is based on the assumption that secret information is stored in the nonvolatile memories. In the AMI, the attackers can obtain some or all of the stored secret information from memories by a great variety of inexpensive and fast side‐channel attacks. Thus, all existing AKE and BA protocols are no longer secure. In this paper, we investigate how to develop secure AKE and BA protocols in the presence of memory attacks. As a solution, we propose to embed a physical unclonable function (PUF) in each party, which generates the secret values as required without the need to store them. By combining PUFs and 2 well‐known and secure protocols, we propose PUF‐based AKE and BA protocols. We show that our proposed protocols are memory leakage resilient. In addition, we prove their security in the standard model. Performance analysis of both protocols shows their efficiency for AMI applications. The proposed protocols can be easily implemented.

A novel broadcast authentication protocol for internet of vehicles

Internet of Vehicles (IoVs) is coming and will grow in next few years, VANETs (Vehicular Ad Hoc Networks) is evolving into the era of IoVs. Inevitably, VANETs need to communicate with WSNs (Wireless Sensor Networks). Real-time data transmission between vehicles and road-side sensor nodes has many application scenarios. However, due to different characteristics of VANETs and WSNs, real-time traffic data transmission is too complicated and slow when emergencies occurred in many RSUs-sparse (Road Side Units) areas. In this paper, we propose a broadcast authentication protocol, namely Paralleling Broadcast Authentication Protocol (PBAP), aiming at enhancing energy efficiency and providing network security in the direct communication between vehicles and WSNs. The simulation results demonstrate that the protocol can effectively extend lifetime of WSNs by improving the utilization rate of the keys and show nice properties in different channel loss ratio and different degrees of DoS attacks. The protocol can work well even in the area without RSUs.

Comparative Study on Various Authentication Protocols in Wireless Sensor Networks.

Wireless sensor networks (WSNs) consist of lightweight devices with low cost, low power, and short-ranged wireless communication. The sensors can communicate with each other to form a network. In WSNs, broadcast transmission is widely used along with the maximum usage of wireless networks and their applications. Hence, it has become crucial to authenticate broadcast messages. Key management is also an active research topic in WSNs. Several key management schemes have been introduced, and their benefits are not recognized in a specific WSN application. Security services are vital for ensuring the integrity, authenticity, and confidentiality of the critical information. Therefore, the authentication mechanisms are required to support these security services and to be resilient to distinct attacks. Various authentication protocols such as key management protocols, lightweight authentication protocols, and broadcast authentication protocols are compared and analyzed for all secure transmission applications. The major goal of this survey is to compare and find out the appropriate protocol for further research. Moreover, the comparisons between various authentication techniques are also illustrated.

A Mutual Broadcast Authentication Protocol for Wireless Sensor Networks Based on Fourier Series

This thesis presents a mural broadcast authentication protocol (MBAP) for wireless sensor networks based on Fourier series according to the issues of the main broadcast authentication protocol µTESLA being limited in authentication delay, more initial parameters, limited time, large key chain, and network congestion. Firstly, achieving the forward authentication work for common sensor nodes to base station is based on the characteristic of continuous-integrability function [Formula: see text] in [Formula: see text] which could be expanded into Fourier series, including entity authentication and source attestation. Secondly, assume that [Formula: see text] is the quadratic form function, and achieve the reverse authentication work for base station to common sensor nodes by detecting the security of [Formula: see text]. The analysis results of safety performance in MBAP show that the captured nodes in WSN will not affect the security of broadcast authentication protocol and have low computation and communication cost, the base station can make broadcast randomly, and common sensor nodes can authenticate messages instantly, which solves the problem of network congestion well. The most important thing of MBAP is the mutual broadcast authentication method which ensures the security of the network greatly.

Multi-User Broadcast Authentication Protocol in Wireless Sensor Networks against DoS Attack

In order to achieve the multi-user broadcast authentication in WSNs (Wireless Sensor Networks) defending against DoS (Denial-of-Service) attack, a multi-user broadcast authentication protocol in WSNs was proposed based on the improved ECDSA (Elliptic Curve Digital Signature Algorithm) with partial message recovery. The authenticity of the user public key is verified by using bloom filter, which reduces the storage overhead of sensor nodes. The bogus messages are filtered using pre-authentication scheme based on one-way Hash key chain. Theoretical analyses show that, the pro- posed protocol can resist active attack, compromise attack, and DoS attack. Compared with DDA-MBAS, the proposed protocol reduces the energy consumption of sensor node by about 41.3% while improving the scalability.

Broadcast Security in Future Mobile Networks

A typical broadcast authentication communication within information distribution systems is characterised by plain text communication between nodes, which do not mutually authenticate. Although, the authentication of every incoming message seems to be a very effective way to mitigate a denial of service type attack, such process results into an increase of end-to-end delay. To mitigate this drawback, the broadcast authentication protocols have been proposed. This paper introduces a new improved delay and resource enhanced DREAM (IDARED) scheme, which is based on the DoS resistant efficient authentication mechanism (DREAM) and which provides lower latency results achieved by several parameters optimisation and a split verification queue concept for the end-to-end management data traffic in the next generation femtocell (NGF). DOI: http://dx.doi.org/10.5755/j01.eee.20.10.6392

Comprehensive Analysis of Broadcast Authentication protocols in Wireless Sensor Networks

Comprehensive Analysis of Broadcast Authentication protocols in Wireless Sensor Networks Masoum Farahmandian, Mohammad Masdari, Vahid Farahmandian Abstract Wireless sensor networks (WSNs) due to law costs and easy communication are used in different environments for surveillance activities. One the most important issues raised in these networks is the usage of a good broadcast authentication mechanism. This mechanism helps to provide the security of these networks efficiently. User authentication is a crucial service in wireless sensor networks that is becoming increasingly common in WSNs because wireless sensor nodes are typically deployed in an unattended environment, leaving them open to possible hostile network attack. Because wireless sensor nodes are limited in computing power, data storage and communication capabilities, any user authentication protocol must be designed to operate efficiently in a resource constrained environment.A broadcast authentication mechanism is important in wireless sensor networks. Researchers have provided various authentication mechanisms– which have their own advantages and disadvantages– in these networks. In this paper we analyze and review some popular authentication schemes which are recently proposed for WSNs. Full Text: PDF DOI: 10.15640/jcsit.v2n3-4a6