Certificate-based Authentication Schemes Research Articles

A lightweight certificate-based authentication scheme for 6LoWPAN-based internet of things

A lightweight certificate-based authentication scheme for 6LoWPAN-based internet of things

A Lightweight Authentication Scheme Based on Consortium Blockchain for Cross-Domain IoT

Internet of Things (IoT) has been ubiquitous in both industrial and living areas, but also known for its weak security. Being as the first defense line against various cyberattacks, authentication is even more critical to IoT applications. Moreover, there has been a growing demand for cross-domain collaboration, leading to an increasing need for cross-domain authentication. Recently, certificate-based authentication schemes have been extensively studied. However, many of these schemes are not efficient in computation, storage, and communication, which are highly required in IoT. In this paper, we propose a lightweight authentication scheme based on consortium blockchain and design a cryptocurrency-like digital token to build trust. Furthermore, trust lifecycle management is performed by manipulating the amount of tokens. The comprehensive analysis and evaluation demonstrate that the proposed scheme is resistant to various common attacks and more efficient than competitor schemes in terms of storage, communication, and authentication cost.

Lightweight and secure authentication scheme for IoT network based on publish–subscribe fog computing model

The Internet of Things (IoT) has converged with Cloud computing to provide comprehensive services to users in different places. However, with the exponential growth of smart devices connected to the Internet, Cloud computing has severe challenges, especially for applications that require low-latency and real-time processing. Therefore, the Fog computing paradigm emerged that is more compatible with the IoT, in which events are processed near where they occurred for practical and quick response time. Authentication is an essential issue for fog computing security since fog gateways and IoT devices are subject to many attacks. The main problem to provide authentication between IoT devices is that they have limited resources and computational processing. On the one hand, certificate-based authentication algorithms are secure, but they are heavy for IoT devices. On the other hand, Pre-shared authentication algorithms such as PSK are suitable for low-resource devices, but are not widely used due to their low security. Therefore, this paper proposes to use the Elliptic Curve Diffie–Hellman Ephemeral (ECDHE) key exchange algorithm along with the Pre-Shared Key (PSK) as a lightweight and secure authentication scheme between the fog gateway and IoT device based on the Message Queuing Telemetry Transport (MQTT) publish–subscribe protocol in a distributed fog computing architecture. The proposed ECDHE-PSK authentication scheme uses Ephemeral Pre-shared key instead of heavy certificates that is very lightweight and also provides Perfect Forward Secrecy (PFS) feature to enhance security in comparison with the static PSK algorithm. To evaluate the resource consumption and security resistance of the proposed scheme it was implemented on the real test environment and then was compared with two state-of-the-art certificate-based authentication schemes and a static PSK-based scheme. The comprehensive performance and security evaluations showed that in the distributed publish–subscribe fog computing architecture the proposed ECDHE-PSK is almost as light as the PSK algorithm while has all security features of certificate-based algorithms.

Blockchain-Enabled Certificate-Based Authentication for Vehicle Accident Detection and Notification in Intelligent Transportation Systems

As the communications among the vehicles, the Road-Side Units ( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">RSU</i> ) and the Edge Servers ( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ES</i> ) take place via wireless communication and the Internet, an adversary may take the opportunity to tamper with the data communicated among various entities in an Internet of Vehicles (IoV) environment. Therefore, it demands secure communication among the involved entities in an IoV-based Intelligent Transportation System (ITS) deployment. In this work, we design a new blockchain-enabled certificate-based authentication scheme for vehicle accident detection and notification in ITS, called BCAS-VADN. In BCAS-VADN, through the authentication process, each vehicle can securely notify accident related transactions to its nearby Cluster Head ( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CH</i> ), if an accident is detected on roads either by its own or neighbor vehicle(s). The <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CH</i> then securely sends the transactions received from the vehicles to its <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">RSU</i> and subsequently, these transactions are also received securely by the <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ES</i> s. The <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ES</i> is responsible for preparing partial block containing transactions and Merkle tree root, and a digital signature on those information, and then forwarding to its associated Cloud Server ( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CS</i> ) in the Blockchain Center ( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">BC</i> ) for complete block creation, verification and addition of the block using the designed consensus process. Due to blockchain technology usage, it is shown that BCAS-VADN is not only secure against various potential attacks, but also maintains transparency, immutability and decentralization of the information. Furthermore, a comprehensive comparative analysis reveals that BCAS-VADN achieves better security and more functionality attributes, and has low communication and computational overheads as compared to other competitive authentication schemes in IoV. In addition, the practical demonstration using the blockchain technology has been also provided.

A Frame Work to Estimate the Performance of Authentication Schemes in Mobile Ad Hoc Networks

increasing growth has been witnessed in the last few year with respect to development of wireless and mobile communication networks. In MANETs, nodes are able to communicate through the use of wireless mediums, constituting dynamic topologies. The certificate-based authentication has a positive edge in wired networks. It's a significantly arduous task to adapt a certificate based authentication protocols for mobile ad hoc networks due to absence of fixed infrastructure or centralized management. A traditional certificate-based authentication system depends on a fixed trusted Certificate Authority (CA). In this case Certificate Authority (CA) takes the responsibility for the establishment, distribution, renewing, and revocation of certificates. The consideration of the fixed centralized network is not practically possible in MANETs, because of issues such as regular link breakdown, node mobility, and inadequate wireless medium. The numbers of approaches have been introduced, which focus on the challenges to adapt certificate-based authentication in a distributed way in mobile ad hoc networks. In this paper, some issues related to performance analysis of exiting authentication schemes have been discussed. So, there is a need to construct a common frame work to evaluate the performance of certificate based authentication protocols for MANETs. This framework is based on two pillars. One is to survey some of the existing authentication mechanisms for MANETs and identify the needs of a secure authentication mechanism for MANETs in the context of distributed authentication. Second is the derivation of metrics to evaluate the performance of certificate based authentication schemes is done.

TARD: Temporary Access Rights Delegation for guest network devices

Many cryptographic protocols were developed to support efficient group membership operations. Although those schemes can be extensively used for controlling temporary access with guest devices which do occur in many real world situations, those schemes incur a significant management overhead. For guest devices, we propose a scheme without heavy key management overheads—Temporary Access Rights Delegation (TARD). The proposed scheme uses a cryptographic token that can be securely constructed by a one-way function chain, used for granting a temporary membership to a guest device. Our analysis shows that the proposed scheme is theoretically secure and outperforms the certificate-based authentication schemes.

An enhanced authentication protocol for WRANs in TV white space

Cognitive radio technique has been recognized as an effective solution to the dilemma introduced by the rapid growth of wireless communications and the scarcity of spectrum resources. One example of the cognitive radio systems is the wireless regional area network operating in television white space TVWS spectrum, which has been specified by IEEE 802.22 standard. The wireless regional area networks in TVWS face not only the traditional security threats but also cognitive security challenges. Especially, the authentication between the base station and the customer premises equipment is vital for secure communication. We discovered that the authentication protocol specified in IEEE 802.22 is vulnerable to the interleaving attacks and cannot achieve mutual key confirmation. In this paper, an Enhanced Certificate-based Authentication scheme ECA has been proposed to overcome the vulnerability of the authentication scheme in IEEE 802.22 standard with much less requirements on the computation and communication resources. The drawbacks of the authentication protocol in IEEE 802.22 standard has been explored followed by the presentation of the proposed enhanced authentication protocol, ECA. The ECA protocol has been evaluated in terms of security functionality and the performance. The correctness of the Enhanced Certificate-based Authentication scheme is analyzed by the Burrows, Abadi, and Needham logic. Copyright © 2015 John Wiley & Sons, Ltd.

Performance of Node-Eviction Schemes in Vehicular Networks

Vehicular ad hoc networks (VANETs) are expected to provide basic security attributes using certificate-based authentication schemes. Credential management guarantees that the principals in VANETs are able to filter out messages from misbehaving vehicles. The various phases in the process of eviction of a misbehaving vehicle-misbehavior detection, misbehavior reporting, certificate revocation, and revocation information dissemination-delay the eviction process by amounts that depend on the technology and schemes used to implement the individual phases. These delays directly translate into the existence of a window of vulnerability for other legitimate vehicles, thus implying degradation in the eviction performance. We propose a framework for analyzing the performance of the node-eviction schemes proposed for vehicle-to-vehicle (V2V) systems by abstracting out the various mechanisms for the different phases of misbehaving-vehicle eviction. This unifying framework could be useful, for example, in deciding the required communication technology and the rate of communication with the security infrastructure to achieve a target eviction performance. We advocate a holistic design approach, where the various phases of node eviction are jointly designed and optimized to improve the eviction performance of the network. Furthermore, it is emphasized that the window of vulnerability is lower bounded by the misbehavior-detection delays and, hence, cannot completely be eliminated; this also provides a natural bound on the performance of the node-eviction schemes. We derive bounds on the performance of misbehavior-detection and eviction schemes required to limit the extent of success of an attack where malicious vehicles submit incorrect accusations of misbehavior against legitimate vehicles.

Fast certificate-based authentication scheme in multi-operator maintained wireless mesh networks

In this paper, we consider QoS aware mesh networks that are maintained by multiple operators and they cooperate in the provision of networking services to the mesh clients. In order to support mobile users and seamless handover between the access points, the authentication delay has to be reduced. Many proposed fast authentication schemes rely on trust models that are not appropriate in a multi-operator environment. In this paper, we propose two certificate-based authentication schemes such that the authentication is performed locally between the access point and the mesh client. We assume that the access point is always a constrained device, and we propose different mechanisms for mesh clients with different computational performance. For constrained devices, we propose a mechanism where weak keys are used for digital signatures to decrease the latency of the authentication. The authenticity of the weak keys are provided by short-term certificates issued by the owner of the key. The short-term certificate has the digital signature generated by the owner’s long-term key. We prove formally that the use of our weak key mechanism on the mesh client side is as secure as the use of some stronger keys. We perform a detailed performance evaluation on our proof-of-concept implementation, and we also compare our solution to the current standard methods.

A Fast Authentication Mechanism Using Identity Based Signature in Mobile IPv6 Network

Access authentication is important to the deployment and application of mobile IPv6 network, and Authentication in handover procedure will reduce handover performance in mobile IPv6 network. However, many studies for the access authentication in mobile IPv6 network ignore the effect of authentication in handover procedure. Furthermore, many certificate-based authentication schemes are not fit for the wireless mobile environment. To solve these drawbacks, a fast mutual authentication mechanism using Identity-based signature in mobile IPv6 network is proposed. The identity-based signature scheme uses NAI (network access identifier) as public key and simplifies the key management in wireless mobile environment, so it can resolve the deficiency in PKI-based authentication mechanism. An effective combination of the fast handover and authentication can minimize the additional load resulting from authentication in mobile procedure. Performance analysis results show that the proposed mechanism is more efficient than other schemes.