Cipher-based Message Authentication Code Research Articles

Prevention of Controller Area Network (CAN) Attacks on Electric Autonomous Vehicles

The importance of vehicle security has increased in recent years in the automotive field, drawing the attention of both the industry and academia. This is due to the rise in cybersecurity threats caused by (1) the increase in vehicle connectivity schemes, such as the Internet of Things, vehicle-to-x communication, and over-the-air updates, and (2) the increased impact of such threats because of the added functionalities that are controlled by vehicle software. These causes and threats are further amplified in autonomous vehicles, which are generally equipped with more electronic control units (ECUs) that are connected through controller area networks (CANs). Due to the holistic nature of CANs, attacks on the networks can affect the functionality of all vehicle ECUs and the whole system. This can lead to a breach of privacy, denial of services, alteration of vehicle performance, and exposure to safety threats. Although cryptographic encryption and authentication algorithms and intrusion detection systems (IDS) are currently being used to detect and prevent CAN bus attacks, they have certain limitations. Therefore, this study proposed a mitigation scheme that can detect and prevent such attacks at the ECU level, which could address the limitations of existing algorithms. This study proposed the usage of a secure boot scheme to detect and prevent the execution of malicious codes, as the presence of one or more ECUs with a malicious code is the root cause of most CAN bus attacks. Secure boot schemes apply cryptographic data integrity algorithms to ensure that only authentic and untampered software can run on the vehicle’s ECUs. The selection of an appropriate cryptographic algorithm is important because it affects the secure boot schemes’ security level and performance. Therefore, this study also tested and compared the performance of the proposed secure boot scheme with five different data security algorithms implemented using the hardware security module (HSM) of the TC399 32-bit AURIX™ TriCore™ microcontroller through an electric autonomous vehicle’s control unit. The tests showed that the two most favorable schemes with the selected hardware are the secure boot scheme with the cipher-based message authentication code (CMAC), because it possesses the highest performance with an execution rate of 26.07 (ms/MB), and the secure boot scheme with the elliptic curve digital signature algorithm (ECDSA), because it provides a higher security level with an acceptable compromise in speed. This study also introduced and tested a novel variation of the ECDSA algorithm based on the CMAC algorithm, which was found to have a 19% performance gain over the standard ECDSA-based secure boot scheme.

SEC-CMAC A New Message Authentication Code Based on the Symmetrical Evolutionist Ciphering Algorithm

This article describes how the simplicity of data transmission made eavesdropping by malicious people easier. This became one the flaws of computer security that needs to be handled. In order to establish a secure data communication, many data security techniques were developed to ensure privacy, integrity and authenticity. One of the techniques developed was to fulfill authentication with a message authentication code (MAC) that was defined by the National Institute of Standards and Technology. It is still a powerful data integrity and authentication tool that provides better protection than error detection codes or checksums. In this article, the authors propose a new cipher-based message authentication code (CMAC) algorithm. Their proposed algorithm, termed SEC-CMAC, is based on a previously developed symmetric evolutionist ciphering algorithm named symmetrical evolutionist ciphering (SEC). Compared to the well-known previously developed MAC, their suggested algorithm proved to be robust and fulfill some security requirement by resisting an exhaustive key search and mac forgery attacks.

GHAP: An Efficient Group-based Handover Authentication Mechanism for IEEE 802.16m Networks

IEEE 802.16m is now under consideration by the International Telecommunication Union (ITU) to become the International Mobile Telecommunications (IMT)-Advanced standard. However, handover authentication is a critical issue in this area. In this paper, we propose an efficient group-based handover authentication mechanism, named as GHAP, for correlated mobile stations (MSs) in IEEE 802.16m networks. In our scheme, the correlated MSs who have the similar Signal to Interference-plus-Noise Ratio and history handover information etc. are divided into the same handover group. When the first MS of the handover group members moves from the service base station (BS) to a target BS, the service BS transmits all the handover group members' security context to the target BS utilizing the security context transfer (SCT) method and then all these MSs in the same handover group can easily perform the handover authentication with the target BS. Different from the conventional SCT schemes, our scheme uses the MSs' security context as a symmetric key of Cipher-based message authentication code (CMAC) but not the key material of deriving new session key. Therefore, the proposed scheme can effectively resist the domino effect existing in the previous SCT schemes. Moreover, security analysis shows that the proposed scheme also meets the other security requirements in handover authentication semantics. Furthermore, performance analysis demonstrates that the proposed scheme is very efficient in reducing average handover latency.

Partial Key Recovery Attack Against RMAC

In this paper new “partial” key recovery attacks against the RMAC block cipher based Message Authentication Code scheme are described. That is we describe attacks that, in some cases, recover one of the two RMAC keys much more efficiently than previously described attacks. Although all attacks, but one, are of no major threat in practice, in some cases there is reason for concern. In particular, the recovery of the second RMAC key (of k bits) may only require around 2k/2 block cipher operations (encryptions or decryptions). The RMAC implementation using triple DES proposed by NIST is shown to be very weak.