BAN Logic Research Articles

Secure and Lightweight User Authentication Scheme for Cloud-Assisted Internet of Things

Cloud-assisted Internet of Things (IoT) overcomes the resource-constrained nature of the traditional IoT and is developing rapidly in such fields as smart grids and intelligent transportation. In a cloud-assisted IoT system, users can remotely control the IoT devices and send specific instructions to them. If the users’ identities are not verified, adversaries can pretend as legitimate users to send fake and malicious instructions to IoT devices, thereby compromising the security of the entire system. Thus, a sound authentication mechanism is indispensable to ensure security. At the same time, it should be noted that a gateway may connect to massive IoT devices with the exponential growth of interconnected devices in a cloud-assisted IoT system. The efficiency of authentication schemes is easily impacted by the computation capability of the gateway. Recently, several schemes have been designed for cloud-assisted IoT systems, but they have problems of one kind or another, making them not very suitable for cloud-assisted IoT systems. In this paper, we take a typical scheme (proposed at IEEE TDSC 2020) as an example to identify the common weaknesses and challenges of designing a user authentication scheme for cloud-assisted IoT systems. In addition, we propose a new secure user authentication scheme with lightweight computation on gateways. The proposed scheme provides secure access between remote users and IoT devices with many ideal attributions, such as forward secrecy and multi-factor security. Meanwhile, the security of this scheme is proved under the random-oracle model, heuristic analysis, the ProVerif tool and BAN logic. Compared with ten state-of-the-art schemes in security and performance, the proposed scheme achieves all the listed twelve security requirements with minimum computation and storage costs on gateways.

Efficient Mobile RFID Authentication Protocol for Smart Logistics Targets Tracking

Target tracking is one of the problems existing in the supply chain management. The use of radio frequency identification (RFID) in target tracking helps improve the monitoring accuracy and status visibility of the tracked target. For mobile RFID system, its three entities have to authenticate each other’s identity in order to guarantee the data transmission security. The mobile RFID authentication protocol cannot achieve both high security and low complexity at the same time. For this problem, a new efficiency mobile RFID authentication protocol is proposed in this paper, which implements secure authentication among different communication entities by different operation modes. For example, the protocol adopts Hash Function between reader and cloud server, and exchange-cross bitwise operation between tag and cloud server, to achieve low computing cost at tag-end while improving the security of mobile communication data. At the cloud server end, the protocol proposed in this paper adopts index data table as the storage mode, which further improves the could server efficiency in retrieving the authentication of tags and readers, and reduces the risks of sensitive data disclosure. According to the security analysis, this protocol can resist impersonation attack, replay attack, trace attack and other attacks launched by attackers. Its security performance is further proved by BAN logic, proverif tool and random oracle model. On the other hand, the simple operation at the tag-end of the protocol lowers the tag cost to a larger extent.

PSAP-WSN: A Provably Secure Authentication Protocol for 5G-Based Wireless Sensor Networks

Nowadays, the widespread application of 5G has promoted rapid development in different areas, particularly in the Internet of Things (IoT), where 5G provides the advantages of higher data transfer rate, lower latency, and widespread connections. Wireless sensor networks (WSNs), which comprise various sensors, are crucial components of IoT. The main functions of WSN include providing users with real-time monitoring information, deploying regional information collection, and synchronizing with the Internet. Security in WSNs is becoming increasingly essential because of the across-the-board nature of wireless technology in many fields. Recently, Yu et al. proposed a user authentication protocol for WSN. However, their design is vulnerable to sensor capture and temporary information disclosure attacks. Thus, in this study, an improved protocol called PSAP-WSN is proposed. The security of PSAP-WSN is demonstrated by employing the ROR model, BAN logic, and ProVerif tool for the analysis. The experimental evaluation shows that our design is more efficient and suitable for WSN environments.

MDS Code Based Ultralightweight Authentication Protocol for RFID System

Privacy and security are central issues in the deployment of an RFID system. It is vulnerable to several attacks, such as replay attacks, location tracking, man-in-middle attack, de-synchronization attack, etc., due to the inherent weaknesses of underlying wireless communications. In order to tackle these privacy and security concerns, this paper presents an ultralightweight authentication protocol based on group homomorphism and maximum distance separable (MDS) code. We use group homomorphism properties to make a server lookup table that reduces searching complexity and overcomes scalability issues. We develop an ultralightweight protocol using MDS code properties that employs only bit-wise operators. Formal and informal security analysis of the proposed protocol shows that our proposed protocol resists various attacks. In addition, we use automated security protocol verification tools, AVISPA and Scyther, to validate the security features of the proposed protocol. We demonstrate the correctness proof of the proposed protocol using BAN logic. To measure the level of privacy of the proposed protocol, we use two benchmark metrics to simulate the proposed protocol. The performance analysis indicates that the proposed protocol is efficient for a low-cost environment.

A Lightweight Three‐Party Mutual Authentication Protocol for Internet of Health Things Systems

In Internet of Health Things (IoHT) systems, there is a two‐hop network structure between the authentication server TA, Internet of Things Connector (IotC), and wearable sensor (WS). Attackers can use the sensor layer network (the first hop) between the IotC and WS to steal patient’s health‐related information and undermine the security of the system and the privacy of sensitive information. To address this threat, this study proposes a lightweight identity authentication and key agreement protocol for third‐party authentication servers TA, IotC, and WS. The results of the formal security proof, BAN logic analysis, and AVISPA tool simulation show that the scheme proposed in this study has an ideal security performance and can meet the security requirements of IoHT. In terms of performance, the proposed scheme could dynamically construct a sensor layer network (the first hop) and offline networking according to the diagnostic needs of doctors. Compared with other related protocols, the proposed scheme can significantly reduce the computing resource requirements of IotC and server TA and the resource requirements of database I/O operation of server TA in the application scenario of concurrent access of multiple WS nodes.

Achieving Light-Weighted Secure Scheme for Communication in a Smart Grid

There are many security risks in the communication between the various nodes of the smart grid. Among these security risks, data leakage is a common one, which occurs in communicating between any two smart meters. In the existing studies, the data leakage is tackled by proposing various security strategies. In this paper, we propose a novel security communication scheme to ensure the security of transmission data between two smart meters against external malicious attacks. Specifically, an authentication scheme based on chaos theory is proposed for verifying the identity trustworthiness of smart meters. In the authentication phase, we use a chaos algorithm and a hash function to compute a shared session key that is used for authentication of both communicating parties, as well as for encryption of private information. Our proposed scheme implements a one-time session approach, i.e., each round of communication keys are unrelated to each other. In relevant validation experiments, we verify that the chaotic algorithm is sufficiently time efficient and compare the computational efficiency with other literature in terms of communication expenses, and the results prove that the proposed scheme is of lightweight nature. Finally we use the Proverif formal verification tool the BAN logic to verify the security as well as the feasibility of the proposed scheme.

Formal security analysis of an IoT mutual authentication protocol

Wireless sensor networks (WSNs) are widely used in day to day activities in order to provide users with multiple services such as smart grids, smart homes, industrial internet of things (IoT), agriculture and health-care. These services are provided by collecting and transmitting the sensing data to the gateway node over an unsafe channel, having constraints of security, energy consumption and connectivity. In 2022, Fariss et al. proposed an ECC-based mutual authentication and key agreement protocol for WSNs. They provided its informal security and showed that it’s secure against many security threats. They also formally analyzed the scheme’s security using AVISPA Tool. In this article, we analyze the security of Fariss et. Al protocol using GNY logic, an advanced version of BAN logic.

Improved and Provably Secure ECC-Based Two-Factor Remote Authentication Scheme with Session Key Agreement

The remote authentication scheme is a cryptographic protocol incorporated by user–server applications to prevent unauthorized access and security attacks. Recently, a two-factor authentication scheme using hard problems in elliptic curve cryptography (ECC)—the elliptic curve discrete logarithm problem (ECDLP), elliptic curve computational Diffie–Hellman problem (ECCDHP), and elliptic curve factorization problem (ECFP)—was developed, but was unable to address several infeasibility issues while incurring high communication costs. Moreover, previous schemes were shown to be vulnerable to privileged insider attacks. Therefore, this research proposes an improved ECC-based authentication scheme with a session key agreement to rectify the infeasible computations and provide a mechanism for the password change/update phase. The formal security analysis proves that the scheme is provably secure under the random oracle model (ROM) and achieves mutual authentication using BAN logic. Based on the performance analysis, the proposed scheme resists the privileged insider attack and attains all of the security goals while keeping the computational costs lower than other schemes based on the three hard problems. Therefore, the findings suggest the potential applicability of the three hard problems in designing identification and authentication schemes in distributed computer networks.

An Efficient Authenticated Key Agreement Scheme Supporting Privacy-Preservation for Internet of Drones Communications.

In recent years, due to the rapid development of Internet of things (IoTs), various physical things (objects) in IoTs are smart enough to make their own decisions without the involvement of humans. The smart devices embedded in a drone can sense, collect, and transmit real-time data back to the controller from a designated environment via wireless communication technologies. The mobility, flexibility, reliability and energy efficiency of drones makes them more widely used in IoT environments such as commercial, military, entertainment applications, traffic surveillance and aerial photography. In a generalized IoD architecture, we have communications among the drones in a flying zone, among the drones and the control server, and also among the drones and authorized user. IoD still has many critical issues that need to be addressed, such as data access being carried out through a public channel and battery operated drones. To address these concerns in IoD communications, in this paper, an efficient authentication and secure communication scheme with privacy preservation is proposed and it only uses secure one-way hash function and bitwise XOR operations when control server, drone and user mutually authenticate each other. After the successful authentication, both IoD-based participants can agree on a common session key to secure the subsequent communication messages. The widely accepted ProVerif and BAN logic analysis have been used to assure that the proposed scheme is provably secure against existing well-known security attacks and ensures privacy. Finally, a comparative analysis is presented to demonstrate the proposed scheme preserves efficiency when compared to existing competitive schemes.

Privacy conserving authenticated key settlement approach for remote users in IoT based Telecare Medicine information system

The Fourth Healthcare Industrial Revolution is transforming the traditional healthcare service to Internet of Things (IoT) based smart healthcare system. Telecare medicine information system (TMIS) is one of them which demands 100% electronic transaction. In this situation, User authentication, fortifies the legitimate patients, doctors, medical helper staffs, etc. Not only that, but it also allows them to access the remote medical servers to serve medical services. Robust and Efficient user authentication plays a vital role here. Many researchers proposed different techniques, but all of them have different limitations like computational expenses, huge memory usage, excessive communication overhead, etc. In this article, a very lightweight authentication approach of remote user is demonstrated in IoT based smart healthcare environment. This approach optimizes the use of one-way hash function, exclusive-or operation and extended One-Time-Password which make the authentication approach lighter and effective. The security strength of the recommended protocol is elaborated with the help of informal and formal security analysis. Well known BAN logic and Real-Or-Random (ROR) model are used in to check the correctness of the protocol and ensure the security of the established session key. In addition to that, AVISPA (automated validation of Internet security protocols and applications) and ProVerif software simulation tools are utilized which parade, the proposed protocol is safe and secure against many attacks like Man-In-The-Middle attack and Replay attack, Ephemeral secret leakage attack, Known-session-specific-temporary-information attack, Impersonation attack, etc. and maintain the secrecy of the session key. Furthermore, the recommended protocol is compared with the existing/recently published protocols to exhibit better performance.

IFKMS: Inverse Function-based Key Management Scheme for IoT networks

Due to the rapid growth of the Internet of Things (IoT), secure communication is becoming a significant concern. Nodes that compose such a dynamic network need to exchange sensitive and valuable data. The data must be kept safe against attacks. This protection requires the development of efficient key management protocols. However, this task is challenging because of the high resource constraints of most IoT devices in terms of storage, communication, processing, and energy capabilities. Some existing key management techniques have certain weaknesses since sensitive parameters are not protected during transmission, and cryptographic keys are stored in plain text and usually renewed at a fixed period of time. This paper proposes a new key management protocol aiming to secure communications before and after key establishment. Our scheme uses hash and one–one functions to achieve security during the key establishment process. The symmetrical character of the invertible functions is thus exploited to conceal critical data and pairwise keys stored in nodes’ memories. Moreover, the key refresh period is variable, which can be adjusted according to the number of occurred attacks in the network. BAN (Burrows Abadi Needham) logic is employed to assess the correctness of the proposed scheme. The results show that our scheme operates correctly and does not have redundancies or security flaws. Furthermore, the security and performance analysis point out that the proposed scheme is resilient against well-known attacks, and efficient in terms of storage, communication, computation overhead, and energy consumption.

A Strong ECC Based on Secure Authentication with Privacy for IoT Concepts

The internet of things offers a rich set of options and applications in different fields, such as smart home, agriculture, security, transportation, and health issues. The IoT aims at organizing the interactions between items that are both sensors and actuators, known as objects. These objects acquire new applications in our lives that facilitate the remote control of smart devices via the open channel. However, this makes the sensitive transmitted data easily reachable and vulnerable to many attacks. With this in mind, security and privacy become an essential requirement that precedes the deployment of any IoT network. In this paper, the authors provide an IoT authentication and key agreement scheme using ECC and a fuzzy extractor and then they use BAN logic model and AVISPA tool to demonstrate the security of the scheme. They show that the proposed scheme is resistant to various attacks. Furthermore, the security analysis of the proposed scheme and its comparison with some other related works have shown that the proposed scheme is both more efficient and more secure than the other ones.

Dynamic Key Extraction Technique Using Pulse Signal and Lightweight Cryptographic Authentication Scheme for WBAN

As a key component of ubiquitous computing, the wireless body area network (WBAN) can be used in a variety of disciplines, including health monitoring. Our everyday routines have been transformed by wearable technology, which has changed the medical industry and made our lives more convenient. However, the openness of the wireless network has raised concerns about the privacy and security of patient’s data because of the latent threat imposed by attackers. Patients’ sensitive data are safeguarded with authentication schemes against a variety of cyberattacks. Using pulse signals and a lightweight cryptographic approach, we propose a hybrid, anonymous, authentication scheme by extracting the binarized stream (bio-key) from pulse signal. We acquired 20 different sample signals to verify the unpredictability and randomness of keys, which were further utilized in an authentication algorithm. Formal proof of mutual authentication and key agreement was provided by the widely known BAN logic, and informal verification was provided by the Automated Validation of Internet Security Protocol and Applications (AVISPA) tool. The performance results depicted that storage cost on the sensor side was only 640 b, whereas communication cost was 512 b. Similarly, the computation time and energy consumption requirements were 0.005 ms and 0.55 µJ, respectively. Hence, it could be asserted that the proposed authentication scheme provided sustainable communication cost along with efficient computation, energy, and storage overheads as compared to peer work.

Lightweight, secure, efficient, and dynamic scheme for mutual authentication of devices in Internet‐of‐Things‐Fog environment

AbstractSecurity is a major challenge in the design and implementation of Internet‐of‐Things (IoT)‐Fog networks and it can be resolved by an efficient authentication mechanism. As the devices have limited resources like battery, processor and memory, any mechanism designed for IoT‐Fog has to be resource aware. In this paper, we proposed a lightweight, secure, dynamic, and efficient scheme for mutual authentication of devices in IoT‐Fog networks. In the proposed scheme, the devices obtain a primary security value from the cloud server and this acquired primary security value is used to authenticate them mutually. We used XOR operation, concatenation operation, one‐way hash function and symmetric key cryptography to accommodate resource constraint nature of devices. The proposed scheme has been analyzed for security formally using BAN logic and automated using Automated Validation of Internet Security Protocols and Applications & ProVerif tools and it is proved that the proposed scheme is secure from the known attacks. The comparative analysis of the proposed scheme with the existing schemes proved that it is better than existing schemes and its experimental analysis showed that it consumes 20%–30% less energy compared to existing schemes. Our proposed scheme is better with reference to security and efficient in respect of computation, communication, and storage overheads.

Design of Secure Authentication Handover Protocol for Innovative Mobile Multimedia Services in 5G MEC Environments

<p>5G advanced technology has introduced innovative multimedia services, thus propelling the rise of the mobile multimedia market. While the ubiquity of mobile multimedia services has boosted customer convenience, it has also unlocked the way to possible security concerns that potentially damage users’ privacy and service providers’ properties. Several standards and researches have been proposed to counter these threats, notably those concentrating on authentication between users and service applications. Unfortunately, these studies are limited to address a new challenge, secure handover among distributed application functions in 5G Multi-access Edge Cloud (MEC) environments. Motivated by this, we present a handover authentication protocol with push-key and pull-key optimization options in 5G mobile multimedia application services. The proposed protocol provides mutual authentication, secure key exchange, confidentiality, and integrity. Furthermore, it also supports perfect forward secrecy, optimal handover, and anonymity, which were not previously considered in prior studies. While formal verification through BAN Logic and Scyther proved that the protocol is secure against attacks that violate the supported security requirements, comparative analysis of the proposed protocol against existing studies demonstrates that the protocol is simultaneously efficient.</p> <p> </p>

A Digital Media Subscription Management System Combined with Blockchain and Proxy Re-Encryption Mechanisms

The subscription economy was born because the relationship between creators and customers is different than it used to be. The era of the creator economy seems to be filled with boundless promise, but at the end of the day, creators are just slaves to tech giants. Neither the control of the content created, nor the money made in their pockets is in complete control of the creator. The blockchain can completely solve these injustices monopolized by enterprises. In the blockchain era, all kinds of creations from music, and video-to-text can be turned into assets that can be purchased and traded through smart contracts. In the music industry, for example, creators do not need to share profits with streaming platforms and record labels and get all the benefits directly. In addition, when the content created is on the chain, every transaction will be recorded on the blockchain, and everyone can inquire about it, avoiding opacity or causing disputes in the future. However, with the structure of the standard blockchain, as long as the registration is successful, each role in the chain will have permanent data access rights, and the flexibility of access control is poor. Therefore, this study proposes a digital media subscription mechanism based on the Hyperledger blockchain architecture combined with proxy re-encryption. We use symmetric and asymmetric cryptography, smart contracts, and algorithms to design our protocol. When the licensee violates the agreement with the creator, the creator can revoke the access rights to the digital media of the licensee at any time, to realize more secure and convenient digital media transmission. The proposed scheme meets various security requirements of blockchain architecture, and we have also applied the BAN logic proof model to evaluate the correctness of the proposed scheme. This study also proposes an arbitration mechanism when the dispute occurs, and performed well in terms of communication and computational costs.

CCMbAS: A Provably Secure CCM-Based Authentication Scheme for Mobile Internet

To improve the security of authentication system and strengthen privacy protection in mobile Internet environment, this paper proposes a provably secure Chebyshev chaotic map (CCM)-based authentication scheme (CCMbAS). The proposed scheme transformed the traditional public key of Chebyshev chaotic map into a private key and combined two private keys to compute a one-time key used to encrypt authentication information. The scheme is verified using security review of BAN logic and ProVerif simulation tool. The verification results confirm that the scheme is well secured against all existing security threats. Compared with similar schemes, the proposed scheme is more efficient and secure. The security analysis shows that the proposed scheme can fulfil secure demands and ensure the security of user’s information in mobile Internet environment.

A flexible and lightweight privacy-preserving handshake protocol based on DTLShps for IoT

Anonymous authentication is widely studied for preserving the privacy of IoT devices . Although attribute-based signature (ABS) schemes can show identity attributes flexibly, letting the private key be generated by someone else is not safe. The computational overhead of traditional anonymous credential schemes based on zero-knowledge proofs (ZKP) is heavy for resource-constrained IoT devices. DTLShps, a lightweight handshake protocol based on software-defined networking (SDN), brings a new thought to verify certificates for resource-constrained IoT devices without anonymous functions. In this article, a lightweight privacy-preserving handshake protocol is designed based on DTLShps to flexibly present attributes of anonymous certificates for resource-constrained IoT devices. An authorization code is designed to represent the authorization status of each identity attribute defined in the X.509 standard. The IoT device cooperating with the CA can flexibly show arbitrary identity attributes to its peer by the authorization code. Only one signing operation of the elliptic curve digital signature algorithm (ECDSA) is needed to grant the authorization on the IoT device with the cooperation of the controller. The security of the proposed scheme is validated by the BAN logic and the tool Scyther. The performance evaluation shows that the computational delay on the IoT device and overall handshake delay is effectively reduced compared with the existing anonymous certificate schemes.

A lightweight mutual and transitive authentication mechanism for IoT network

IoT devices are typically authenticated directly by gateways present in the network. However, in large and complex IoT systems like the smart city or smart industry which consist of thousands of connected devices, it may not be always feasible to be directly connected to the gateway while it may be possible to be connected to another device. Therefore, already authenticated devices should facilitate the new device to get authenticated by the gateway. To address this issue, the existing protocols use multiple authentication protocols based on different cryptography techniques, which are difficult to implement and manage in resource constrained IoT devices. In this paper, we propose a Transitive device authentication protocol based on the Chebyshev polynomial. The transitive authentication protocol utilizes the session key established in the mutual authentication between the intermediate device and gateway. Both the mutual authentication and transitive authentication protocols are relying on the same preregistration and authentication mechanism. To ensure the security of the proposed authentication protocol, detailed security analysis is carried out, and the secure session key establishment is verified using the BAN logic. Moreover, the proposed protocol is tested against crucial attacks in the Scyther tool. These formal analyses and Scyther attack simulation show that the proposed protocol is capable of withstanding critical attacks. Finally, to verify the efficiency, the protocol implementation is experimentally compared with similar approaches studied in the literature. The results show that the proposed protocol offers better performance, providing significantly lower response time, handshake duration, memory utilization, and energy consumption.

A security scheme for distributing analysis codes supporting CDM-based research in a multi-center environment

Background: Although the common data model (CDM) has achieved a standardization of medical data and a de-identification of personal patient information, hospitals still store CDM data in an on-premises environment, making it difficult for researchers to access medical data.Objective: In this study, for easy access to CDM data in a multi-institutional participatory CDM research environment and to encourage data-driven research, researchers outside hospital networks securely access and analyze CDM data in the target medical center, analyze it, and respond to the results through a public network. We propose an automated security framework that operates on a public network, such as the Internet.Method: The proposed scheme allows authenticated researchers to securely deliver CDM data analysis codes to a medical institution distributed on the network. The institutional servers automatically execute authenticated codes and return the results to the researcher safely. For this purpose, we designed a scheme based on cryptography. The scheme operates on a group of servers consisting of an authentication process, a signing process, a ticket-granting process, a relaying process, and a data analysis process located at the hospital providing medical CDM data. The scheme consists of four phases for a secure medical data analysis in a distributed environment: authentication, code signing, ticket issuing, and distribution and return.Results: Although the CDM has de-identified patient privacy, the issue still needs to be carefully addressed. Therefore, we established four security objectives to verify that the proposed scheme can be operated safely and formally proved them using BAN logic.Conclusion: As a result of the proof using BAN logic, the proposed scheme was verified to achieve the proposed security goal. Although this scheme was designed solely for CDM, it can be applied to systems with similar environments and functional goals.