Cross-domain Authentication Research Articles

Reliable PUF-based mutual authentication protocol for UAVs towards multi-domain environment

With the widespread application of unmanned aerial vehicles (UAVs), the discussion about the various security and privacy issues of UAVs have never stopped. Physical Unclonable Function (PUF) is inherently unclonable and tamper-proof, many authentication and key agreement protocols based on PUF for UAVs have been proposed in the past. But they can only be suitable for mutual authentication between a single ground station and multiple UAVs. Not only does this centralized authentication method have a single point of failure, but also cannot adapt to the increasing demand for UAV authentication in multi-domain settings. In this paper, we propose a novel lightweight mutual authentication scheme based on PUF which is resistant to well-known attacks such as node tampering attacks, and cloning attacks, etc. Furthermore, we realized cross-domain authentication for UAVs, ensuring secure and efficient communication for UAVs in different domains. We have demonstrated the correctness of our scheme in detail, and carried out experimental analysis. The results show that our scheme is sufficiently secure and effective, and is suitable for UAVs in a multi-domain environment.

A Cross-Domain Authentication Scheme Based on Cooperative Blockchains Functioning With Revocation for Medical Consortiums

Regional medical consortium systems facilitates medical information sharing. However, many security issues exposed by the dominant centralized architectures, such as single points of failure, unauthorized operations and illegal access, are increasingly apparent constraints on the security and efficiency of data sharing across domains. Even more, any malicious operation detected, effective measures should be executed promptly for identity tracing. In this paper, we propose a secure and efficient cross-domain authentication scheme based on two cooperative blockchains (BCs) for medical consortium systems. Specifically, an intra-domain BC records any legal users’ registration and authentication information while an inter-domain BC is responsible for writing users’ cross-domain authentication information. In each domain, the general hospital acts as a trusted third service provider to achieve cross-chain interactions. For the entire cross-domain authentication procedure, anonymity mechanism is utilized to enhance security, and to trace malicious users, the improved chameleon hash is used in the intra-domain BC to redact the state of the user, and blacklist merkle tree is extended in the inter-domain BC to protect different domains’ services from illegal accessing. In addition, security analysis and performance evaluation are completely given to prove the superior security features and performance compared with other schemes.

XAuth: Efficient Privacy-Preserving Cross-Domain Authentication

It is well known that each Public Key Infrastructure (PKI) system forms a closed security domain and only recognizes certificates in its own domain (such as medical systems, financial systems, and 5G networks). When users need to access services in other domains, their identities often cannot be recognized or PKI systems require extremely complex operations to authenticate the users’ identities. This is the cross-domain authentication problem. The distributed consensus feature of blockchain provides a technical approach to solve this problem. However, there are some unresolved problems in existing blockchain-based schemes. On one hand, due to the low throughput of blockchain systems, the response speed may be insufferable when the number of cross-domain authentication requirements becomes enormous. On the other hand, these schemes insufficiently consider the privacy risk in the cross-domain scenario. In this article, we propose an efficient privacy-preserving cross-domain authentication scheme called XAuth that is integrated naturally with the existing PKI and Certificate Transparency (CT) systems. Specifically, we design a lightweight correctness verification protocol based on Multiple Merkle Hash Tree for rapid response. To protect users’ privacy, we present an anonymous authentication protocol for cross-domain authentication. The security analysis and experimental results demonstrate that XAuth is secure and efficient.

A Blockchain-Based Multi-CA Cross-Domain Authentication Scheme in Decentralized Autonomous Network

The continuous development of network technology has driven the emergence of smart devices, and the demand for smart devices interconnection has increased sharply, which requires the identity of devices to be authenticated to carry out secure communication. The traditional certificate-based identity authentication scheme can no longer meet the authentication requirements of massive devices. As an authority that issues and manages certificates, Certificate Authority (CA) creates data islands of intra-domain certificates, increasing the complexity of cross-domain authentication. In order to improve the efficiency of cross-domain authentication, this paper introduces blockchain technology, which can establish trust in an untrusted environment. We propose a multi-CA-based authentication architecture to establish distributed trust and share cross-domain certificate information among multiple domains. On this basis, we design a simplified identity authentication scheme to quickly complete cross-domain identity authentication and reduce authentication overhead. To further improve the efficiency of cross-domain authentication, a cross-domain certificate revocation mechanism is designed. The scheme has passed the formal security analysis, and the simulation results show that the cross-domain authentication scheme is efficient.

A Novel Trust Evaluation Mechanism for Edge Device Access of the Internet of Things

The purpose of this paper is to build a novel trust evaluation mechanism model for edge devices of the Internet of Things (IoT). First, we use the SM9 authentication mechanism to authenticate the identity of the terminal device. Authentication includes both single-domain and cross-domain authentication of devices, reducing the time overhead of the authentication process. Then, we use the satisfaction function and the time degradation factor to improve the direct trust in the behavioural trust of Bayesian equations. Next, the weight of indirect trust of each device is calculated to improve the gray association method, and the accuracy of indirect trust is improved. Finally, the trust value of the edge device is obtained by combining the authentication result and the behaviour trust. Simulation results verify that the trust evaluation model proposed in this paper has certain advantages for the reliability, accuracy, and efficiency of trust evaluation.

Authentication in the Internet of Medical Things: Taxonomy, Review, and Open Issues

The Internet of Medical Things (IoMT) has revolutionized the world of healthcare by remotely connecting patients to healthcare providers through medical devices connected over the Internet. IoMT devices collect patients’ medical data and share them with healthcare providers, who analyze it for early control of diseases. The security of patients’ data is of prime importance in IoMT. Authentication of users and devices is the first layer of security in IoMT. However, because of diverse and resource-constrained devices, authentication in IoMT is a challenging task. Several authentication schemes for IoMT have been proposed in the literature. However, each of them has its own pros and cons. To identify, evaluate and summarize the current literature on authentication in IoMT, we conducted a systematic review of 118 articles published between 2016 and 2021. We also established a taxonomy of authentication schemes in IoMT from seven different perspectives. We observed that most of the authentication schemes use a distributed architecture and public key infrastructure. It was also observed that hybrid cryptography approaches have become popular to overcome the shortcomings of single cryptographic approaches. Authentication schemes in IoMT need to support end-to-end, cross-layer, and cross-domain authentication. Finally, we discuss some open issues and future directions.

A blockchain-based lightweight authentication and key agreement scheme for internet of vehicles

The Internet of Vehicles is deployed in an open environment, and protecting its security and data privacy is the challenge. Carrying out the Internet of Vehicles secure authentication before interaction of information is an important part of ensuring the security foundation. Therefore, this article designs a safe and reliable Internet of Vehicles authentication and key agreement schemeassisted by blockchain. This article uses a multi-TA network model to improve the efficiency of authentication. Because of the rapid movement of vehicles, it will continue to appear cross-RSU and TA certification. Considering the disadvantages of most centralised authentication protocols using a single TA, this paper uses the multi-TA model to improve the efficiency of authentication. By usingblockchain technology to store the authentication information of vehicles, the cross-domain authentication of vehicles and the protection of user privacy information can be well realised. At the same time, in order to reduce the time of vehicle authentication, this scheme uses a lightweight calculation operation to complete the whole process of authentication. Through security analysis and results of Proverif simulation, the security of the solution is well proved, our scheme can resist various common attacks. Compared with some existing Internet of Vehicles security authentication protocols, the proposed scheme has a lower cost of computation, communication, and storage.

Blockchain-Empowered Decentralized Horizontal Federated Learning for 5G-Enabled UAVs

Motivated by Industry 4.0, 5G-enabled unmanned aerial vehicles (UAVs; also known as drones) are widely applied in various industries. However, the open nature of 5G networks threatens the safe sharing of data. In particular, privacy leakage can lead to serious losses for users. As a new machine learning paradigm, federated learning (FL) avoids privacy leakage by allowing data models to be shared instead of raw data. Unfortunately, the traditional FL framework is strongly dependent on a centralized aggregation server, which will cause the system to crash if the server is compromised. Unauthorized participants may launch poisoning attacks, thereby reducing the usability of models. In addition, communication barriers hinder collaboration among a large number of cross-domain devices for learning. To address the abovementioned issues, a blockchain-empowered decentralized horizontal FL framework is proposed. The authentication of cross-domain UAVs is accomplished through multisignature smart contracts. Global model updates are computed by using these smart contracts instead of a centralized server. Extensive experimental results show that the proposed scheme achieves high efficiency of cross-domain authentication and good accuracy.

Blockchain-Based Cross-Domain Authentication for Intelligent 5G-Enabled Internet of Drones

While 5G can facilitate high-speed Internet access and make over-the-horizon control a reality for unmanned aerial vehicles (UAVs; also known as drones), there are also potential security and privacy considerations, for example, authentication among drones. Centralized authentication approaches not only suffer from a single point of failure but they are also incapable of cross-domain authentication. This complicates the cooperation of drones from different domains. To address these limitations, a blockchain-based cross-domain authentication scheme for intelligent 5G-enabled Internet of drones is proposed in this article. Our approach employs multiple signatures based on threshold sharing to build an identity federation for collaborative domains. This allows us to support domain joining and exiting. Reliable communication between cross-domain devices is achieved by utilizing smart contract for authentication. The session keys are negotiated to secure subsequent communication between two parties. Our security and performance evaluations show that the proposed scheme is resistant to common attacks targeting Internet of Things (IoT) devices (including drones), as well as demonstrating its effectiveness and efficiency.

A Trusted IoT Communication Architecture Based on Blockchain and Named Data Network

The trusted cross-domain sharing capability of the Internet of Things (IoT) terminals needs to be improved urgently. Aiming at the technical issues of routing overhead and authentication security of data sharing of IoT devices, this paper proposes a trusted transmission architecture for network-chain collaboration. Introduce the mobile edge computing (MEC) platform in named data network (NDN) to deploy blockchain light nodes and improve the PBFT consensus algorithm. Besides, a cross-domain authentication algorithm based on elliptic curve encryption is proposed. Simulation results show that the improved PBFT and cross-domain authentication algorithm can effectively improve IoT cross-domain sharing capabilities.

A Lightweight Authentication Scheme Based on Consortium Blockchain for Cross-Domain IoT

Internet of Things (IoT) has been ubiquitous in both industrial and living areas, but also known for its weak security. Being as the first defense line against various cyberattacks, authentication is even more critical to IoT applications. Moreover, there has been a growing demand for cross-domain collaboration, leading to an increasing need for cross-domain authentication. Recently, certificate-based authentication schemes have been extensively studied. However, many of these schemes are not efficient in computation, storage, and communication, which are highly required in IoT. In this paper, we propose a lightweight authentication scheme based on consortium blockchain and design a cryptocurrency-like digital token to build trust. Furthermore, trust lifecycle management is performed by manipulating the amount of tokens. The comprehensive analysis and evaluation demonstrate that the proposed scheme is resistant to various common attacks and more efficient than competitor schemes in terms of storage, communication, and authentication cost.

Cross-Domain Self-Authentication Based Consortium Blockchain for Autonomous Valet Parking System

This paper proposed a cross-domain authentication scheme to address the”information isolated island” problem of users’ identities storage in servers and the “redundant registration problem” of users’ identities for autonomous valet parking systems. This scheme adopts a decentralized anonymous authentication method to relieve the authentication center’s service load. Users are segregated into two categories to increase authentication efficiency: inexperienced and regular users. For the former, the paper explores a self-authentication mechanism based on verification parameters. Then its valid personal information, pseudonym, and public key, were stored in a blockchain consortium (PseIDChain) as the transaction records to securely shared among servers located in different domains. For the latter (regular users), the paper presents a mechanism for efficiently searching users’ personal information on PseIDChain by the smart contract to a certificate. Security proof and simulation results show that the designed scheme has superior security to the existing schemes. Its authentication efficiency is 80.29% and 50.45% higher than the traditional anonymous and batch authentication schemes.

CCAP: A Complete Cross-Domain Authentication Based on Blockchain for Internet of Things

The increasing diversity of Internet-of-Things (IoT) application scenarios and explosive growth of access devices have brought more frequent exchanges of resources between different administrative domains. Cross-domain authentication has become a key to safeguard communication and resource interaction among domains. Traditional centralized authentication schemes present heavy management overhead and trust challenges in cross-domain scenarios. Most of existing studies are incapable of establishing trust relationships between domains deployed with different authentication schemes, rendering such high-cost schemes difficult to be generalized. Further, the cross-domain scenario of IoT also raises additional requirements for device privacy and system overhead. In order to tackle these issues, this paper proposes a complete cross-domain authentication and privacy protection scheme, called CCAP, for the IoT based on consortium blockchain. CCAP achieves cross-domain authentication among the IoT domains which may have different configurations from each other. Further, CCAP can be cost-effectively deployed in resource-limited IoT domains and can offer privacy protection and efficient and secure communication for IoT devices. We demonstrate the effectiveness and efficiency of the scheme through experiments in virtual and physical experiment environments as well as comparing and analyzing CCAP with state-of-the-art work.

Research on Key Security Detection Method of Cross Domain Information Sharing Based on PKG Trust Gateway

Aiming at the problems of low precision, long detection time and poor detection effect in current cross domain information sharing key security detection methods, a cross domain information sharing key security detection method based on PKG trust gateway is proposed. By analyzing bilinear pairing based on elliptic curve and identity based encryption scheme, according to the independent system parameters of PKG management platform, cross domain authentication access mechanism is proposed. PKG of different trust domains is used as the trust gateway for cross domain authentication. The key escrow problem of PKG of different trust domains is solved through key sharing, and the communication key agreement mechanism is established to mutually authenticate the user nodes in the trust domains with different system parameters. The formal description of the rule detection of cryptographic functions, parameters and other information, supported by the dynamic binary analysis platform pin, dynamically records the encryption and decryption process information during the operation of the program, and realizes cross domain information sharing key security detection through the design of correlation vulnerability detection algorithm. The experimental results show that the cross-domain information shared key security detection effect of the proposed method is better, which can effectively improve the detection accuracy and shorten the detection time.

A lightweight and secure online/offline cross-domain authentication scheme for VANET systems in Industrial IoT.

In heterogeneous wireless networks, the industrial Internet of Things (IIoT) is an essential contributor to increasing productivity and effectiveness. However, in various domains, such as industrial wireless scenarios, small cell domains, and vehicular ad hoc networks, an efficient and stable authentication algorithm is required (VANET). Specifically, IoT vehicles deal with vast amounts of data transmitted between VANET entities in different domains in such a large-scale environment. Also, crossing from one territory to another may have the connectivity services down for a while, leading to service interruption because it is pervasive in remote areas and places with multipath obstructions. Hence, it is vulnerable to specific attacks (e.g., replay attacks, modification attacks, man-in-the-middle attacks, and insider attacks), making the system inefficient. Also, high processing data increases the computation and communication cost, leading to an increased workload in the system. Thus, to solve the above issues, we propose an online/offline lightweight authentication scheme for the VANET cross-domain system in IIoT to improve the security and efficiency of the VANET. The proposed scheme utilizes an efficient AES-RSA algorithm to achieve integrity and confidentiality of the message. The offline joining is added to avoid remote network intrusions and the risk of network service interruptions. The proposed work includes two different significant goals to achieve first, then secure message on which the data is transmitted and efficiency in a cryptographic manner. The Burrows Abdi Needham (BAN logic) logic is used to prove that this scheme is mutually authenticated. The system’s security has been tested using the well-known AVISPA tool to evaluate and verify its security formally. The results show that the proposed scheme outperforms the ID-CPPA, AAAS, and HCDA schemes by 53%, 55%, and 47% respectively in terms of computation cost, and 65%, 83%, and 40% respectively in terms of communication cost.

A New Hybrid Online and Offline Multi-Factor Cross-Domain Authentication Method for IoT Applications in the Automotive Industry

Connected vehicles have emerged as the latest revolution in the automotive industry, utilizing the advent of the Internet of Things (IoT). However, most IoT-connected cars mechanisms currently depend on available network services and need continuous network connections to allow users to connect to their vehicles. Nevertheless, the connectivity availability shortcoming in remote or rural areas with no network coverage makes vehicle sharing or any IoT-connected device problematic and undesirable. Furthermore, IoT-connected cars are vulnerable to various passive and active attacks (e.g., replay attacks, MiTM attacks, impersonation attacks, and offline guessing attacks). Adversaries could all use these attacks to disrupt networks posing a threat to the entire automotive industry. Therefore, to overcome this issue, we propose a hybrid online and offline multi-factor authentication cross-domain authentication method for a connected car-sharing environment based on the user’s smartphone. The proposed scheme lets users book a vehicle using the online booking phase based on the secured and trusted Kerberos workflow. Furthermore, an offline authentication phase uses the OTP algorithm to authenticate registered users even if the connectivity services are unavailable. The proposed scheme uses the AES-ECC algorithm to provide secure communication and efficient key management. The formal SOV logic verification was used to demonstrate the security of the proposed scheme. Furthermore, the AVISPA tool has been used to check that the proposed scheme is secured against passive and active attacks. Compared to the previous works, the scheme requires less computation due to the lightweight cryptographic algorithms utilized. Finally, the results showed that the proposed system provides seamless, secure, and efficient authentication operation for the automotive industry, specifically car-sharing systems, making the proposed system suitable for applications in limited and intermittent network connections.

Application of Blockchain Technology in Supply Alliance Chain Under Big Data Time Domain

The 21st century is the era of big data. Data is growing at a massive amount of time, and the value of data itself is increasing rapidly. In the era of big data, the demand for security continues to increase, and traditional methods are obviously unable to meet the increasing demand. As a trust-building machine, blockchain technology, especially the multi-center architecture and multi-institutional cooperation scenarios of the alliance chain, satisfies the needs of cross-domain authentication among regions, industries, and enterprises. The purpose of this article is to analyze and discuss the application of blockchain technology in the supply alliance chain under the time domain of big data. This article first introduces the core technology of blockchain through an overview of blockchain theory, and analyzes the status quo of supply alliance chains. Finally, it integrates big data and blockchain technology to explore the supply of blockchain technology in the time domain of big data. Experimental research shows that compared with the traditional supply alliance chain technology, the supply alliance chain that applies the blockchain technology in the big data time domain is more feasible.

A secure cross-domain authentication scheme with perfect forward security and complete anonymity in fog computing

Nowadays, fog computing has become an emerging hot-topic for possessing the same advantages as cloud computing and the lower latency. Nevertheless, there are still many issues in fog computing that worth studying, the most importantly of which are key agreement and user authentication. In order to achieve secure communication among different entities, designing a secure key agreement and user authentication scheme becomes an urgent issue. Although many schemes have been investigated the key agreement and user authentication for cloud computing, these schemes cannot be directly applied to the fog computing due to efficiency and cost. To tackle this problem, we propose a secure and efficient key agreement and user authentication scheme for fog computing. Our scheme can establish secure sessions among different entities, and users can achieve cross-domain access to other fog server. Most importantly, Our scheme satisfies the perfect forward security and the complete anonymity. We prove that our scheme is secure in the random oracle model, and achieve formal security verification through the AVISPA tool. Finally, the performance analysis demonstrates that our scheme tends to be more efficient in comparison with similar schemes.

SCTIM: A Trusted Identity Model Based On Smart Contract

The anonymity of blockchain identities brings security risks to transactions. To solve this problem, this paper proposes a trusted identity model based on smart contracts and introduces the CA certificate of the PKI system to endorse the authenticity of the user’s identity. The model structure is designed, the blockchain digital certificate format is given, the cross-domain authentication scheme based on smart contracts is described, and the security and efficiency of the model are analyzed. In terms of security, the model meets the needs of entity verification; in terms of efficiency, the use of a hash algorithm to construct a complete certificate chain, compared with existing solutions, significantly improves the efficiency of cross-domain authentication.

Decentralized Anonymous Authentication With Fair Billing for Space-Ground Integrated Networks

The space-ground integrated network (SGIN) has attracted growing attention due to its advantages of high-capacity, low-latency and global coverage. To guarantee the security requirements of SGIN, anonymous authentication is an essential approach to addressing severe threats such as unauthorized access and impersonation attack, while payment is another common method in service-oriented applications in order to encourage companies to participate and also prevent insider attackers from enjoying services without paying. Existing anonymous authentication protocols for SGIN either require users to involve in heavy computation especially in dynamic scenarios, or do not consider cross-domain authentication. In this paper, we first introduce the concept of cross-company satellite services, and then address the cross-domain authentication and billing issues in SGIN, i.e., we propose a decentralized anonymous authentication scheme supporting fast handover and also achieve fairness for the billing procedures. To reduce the authentication delays, the authentication process is delegated from ground to satellites, such that users can arbitrarily switch the satellite networks belonging to different companies. Specifically, users can be anonymously authenticated by showing the knowledge of a secret bound with a randomized verifiable credential and connect to different satellite networks through a fast handover authentication protocol building on a blockchain. Even all companies collude, they cannot forge a valid identity credential and access records for a user. In addition, we provide a fair billing mechanism that can prevent malicious users and greedy satellite companies from manipulating the network accessing fees based on a well-designed smart contract. Finally, we demonstrate that the proposed scheme is secure and efficient through security analysis and performance evaluation.