Formal Security Analysis Research Articles

Multiauthority CP-ABE-based Access Control Model for IoT-enabled Healthcare Infrastructure

The exponential growth of the Internet of Things (IoT) technologies requires high data security. Here, data security is very critical as all IoT devices transfer data over the Internet. The fine-grained access control provided by the ciphertext policy attribute-based encryption (CP-ABE) technique can be considered as a potential solution to this issue. However, most of the CP-ABE schemes use bilinear pairing operations for its internal working, which is expensive for any resource constraint device. An elliptic curve cryptography (ECC) based CP-ABE scheme can be well suited for resource constraint IoT framework because ECC takes less computational time. This article proposes a novel CP-ABE technique based on ECC to achieve fine-grained access control over data or resources. The proposed technique includes multiple attribute authorities to manage attributes and key generation, which can reduce the work overhead of having a single authority in traditional CP-ABE systems. In addition, the proposed scheme outsources the decryption process to a user assistant entity to reduce the decryption overhead of the end-users. To prove the efficiency of the proposed scheme, both formal security analysis and performance comparisons are presented in this article. The result and findings prove the effectiveness of the proposed scheme over some well-known schemes.

An Effective Privacy-Preserving Blockchain-Assisted Security Protocol for Cloud-Based Digital Twin Environment

Recently, the Digital Twin (DT) technology has procured a lot of attention because of its applicability in the manufacturing and space industries. The DT environment involves the formation of a clone of the tangible object to perform simulations in the virtual space. The combination of conceptual development, predictive maintenance, real-time monitoring, and simulation characteristics of DT has increased the utilization of DT in different scenarios, such as medical environments, healthcare, manufacturing industries, aerospace, etc. However, these utilizations have also brought serious security pitfalls in DT deployment. Towards this, several authentication protocols with different security and privacy features for DT environments have been proposed. In this article, we first review a recently proposed two-factor authentication protocol for DT environments that utilizes the blockchain technology. However, the analyzed scheme is unable to offer the desirable security and cannot withstand various security attacks like offline password-guessing attack, smart card stolen attack, anonymity property, and known session-specific temporary information attack. We also demonstrate that an attacker can impersonate the analyzed protocol’s legal user, owner, and cloud server. To mitigate these security loopholes, we devise an effective three-factor privacy-preserving authentication scheme for DT environments. The proposed work is demonstrated to be secure by performing the informal security analysis, the formal security analysis using the widely recognized Burrows-Abadi-Needham (BAN) logic, and the Real-or-Random (ROR) model. A detailed comparative study with the existing competing schemes including the analyzed scheme demonstrates that the devised framework furnishes better security features while also having lower computation costs and comparable communication costs than the existing schemes.

A Lightweight and Efficient Remote Data Authentication Protocol Over Cloud Storage Environment

Cloud storage services need cost-effective, independent, and scalable functionality to manage data. Cloud repositories provide an opportunity to manage and access essential data conveniently. This article proposes a secure authentication protocol to resolve these issues. To add a convenient sharing of data controlled by a data delegator, we use symmetric encryption and decryption algorithms in which cloud servers encrypt and decrypt the data to control the accessibility of the user. Furthermore, informal security analysis demonstrates that our devised protocol is robust enough to resist various attacks. We present the formal analysis of security using the Random Oracle Model (ROM) to evaluate and prove the security strength of the devised protocol. The proposed and related protocols have been implemented on an online cloud server named PythonAnywhere with PyCrypto and Time libraries using Python with the help of a system that has predefined specifications to compare the performance. The results show that our scheme has feasible computation, storage, communication, and energy efficiency compared to various related protocols.

Verifiable and Dynamic Multi-Keyword Search Over Encrypted Cloud Data Using Bitmap

Searchable Symmetric Encryption (SSE), which enables users to search over encrypted data without decryption, has gained increasing attention from both academic and industrial fields. However, existing SSE schemes either have low search efficiency or cannot support multi-keyword search, dynamic updates, and result verification simultaneously. To solve these problems, we propose a Verifiable and Dynamic Multi-keyword Search (VDMS) scheme over encrypted data by using the bitmap and RSA accumulator, which provides multi-keyword search over encrypted data in an efficient, verifiable and updated way. The bitmap is used as a data structure to build the indexes, which improves the search efficiency and reduces the storage space of the indexes. The RSA accumulator and bitmap are combined to verify the correctness of results. Formal security analysis proves that our VDMS is adaptively secure against Chosen-Keyword Attacks (CKA), and empirical experiments using a real-world dataset demonstrate that our VDMS is efficient and feasible in practical applications.

Efficient Privacy-Preserving Spatial Range Query Over Outsourced Encrypted Data

With the rapid development of Location-Based Services (LBS), a large number of LBS providers outsource spatial data to cloud servers to reduce their high computational and storage burdens, but meanwhile incur some security issues such as location privacy leakage. Thus, extensive privacy-preserving LBS schemes have been proposed. However, the existing solutions using Bloom filter do not take into account the redundant bits that do not map information in Bloom filter, resulting in high computational overheads, and reveal the inclusion relationship in Bloom filter. To solve these issues, we propose an efficient Privacy-preserving Spatial Range Query (PSRQ) scheme by skillfully combining Geohash algorithm with Circular Shift and Coalesce Bloom Filter (CSC-BF) framework and Symmetric-key Hidden Vector Encryption (SHVE), which not only greatly reduces the computational cost of generating token but also speeds up the query efficiency on large-scale datasets. In addition, we design a Confused Bloom Filter (CBF) to confuse the inclusion relationship by confusing the values of 0 and 1 in the Bloom filter. Base on this, we further propose a more secure and practical enhanced scheme PSRQ <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">+</sup> by using CBF and Geohash algorithm, which can support more query ranges and achieve adaptive security. Finally, formal security analysis proves that our schemes are secure against Indistinguishability under Chosen-Plaintext Attacks (IND-CPA) and PSRQ <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">+</sup> achieves adaptive IND-CPA, and extensive experimental tests demonstrate that our schemes using million-level dataset improve the query efficiency by 100x compared with previous state-of-the-art solutions.

A Blockchain-Based Deep-Learning-Driven Architecture for Quality Routing in Wireless Sensor Networks

Over the past few years, great importance has been given to wireless sensor networks (WSNs) as they play a significant role in facilitating the world with daily life services like healthcare, military, social products, etc. However, heterogeneous nature of WSNs makes them prone to various attacks, which results in low throughput, and high network delay and high energy consumption. In the WSNs, routing is performed using different routing protocols like low-energy adaptive clustering hierarchy (LEACH), heterogeneous gateway-based energy-aware multi-hop routing (HMGEAR), etc. In such protocols, some nodes in the network may perform malicious activities. Therefore, four deep learning (DL) techniques and a real-time message content validation (RMCV) scheme based on blockchain are used in the proposed network for the detection of malicious nodes (MNs). Moreover, to analyse the routing data in the WSN, DL models are trained on a state-of-the-art dataset generated from LEACH, known as WSN-DS 2016. The WSN contains three types of nodes: sensor nodes, cluster heads (CHs) and the base station (BS). The CHs after aggregating the data received from the sensor nodes, send it towards the BS. Furthermore, to overcome the single point of failure issue, a decentralized blockchain is deployed on CHs and BS. Additionally, MNs are removed from the network using RMCV and DL techniques. Moreover, legitimate nodes (LNs) are registered in the blockchain network using proof-of-authority consensus protocol. The protocol outperforms proof-of-work in terms of computational cost. Later, routing is performed between the LNs using different routing protocols and the results are compared with original LEACH and HMGEAR protocols. The results show that the accuracy of GRU is 97%, LSTM is 96%, CNN is 92% and ANN is 90%. Throughput, delay and the death of the first node are computed for LEACH, LEACH with DL, LEACH with RMCV, HMGEAR, HMGEAR with DL and HMGEAR with RMCV. Moreover, Oyente is used to perform the formal security analysis of the designed smart contract. The analysis shows that blockchain network is resilient against vulnerabilities.

Efficient, Traceable and Privacy-Aware Data Access Control in Distributed Cloud-Based IoD Systems

The emerging combination of Internet of Things (IoT) and aerospace integration aided by satellite and 6G communication techniques has stimulated the Internet of Unmanned Aerial Vehicles (UAVs), i.e., Internet of Drones (IoD). To accommodate and share the enormous real-time UAV data, cloud-based IoD is an inevitable choice to lower the heavy burden of mobile UAVs. Nevertheless, how to protect highly sensitive UAV data in such a honest-but-curious, open and distributed environment with resource-limited UAVs is a significant challenge. Although our previous work (PATLDAC) in SPNCE’21 devises a cloud-based UAV data access control scheme with policy privacy protection, limited access time and user traceability, it incurs inflexible and centralized cloud data storage and access as well as untrustworthy metadata in untrusted cloud environment for data access and user tracing. To this end, we further propose a blockchain-based privacy-aware data access control (BPADAC) scheme for distributed and secure UAV data sharing in cloud-based IoD. Based on fine-grained, traceable and privacy-preserving UAV data access characteristic of our previous work, we extend it by leveraging blockchain and Distributed Hash Table (DHT) for distributed and trustful UAV data access and storage, together with reliable and limited access mechanism to guarantee cloud UAV data sharing service provision. We also design public and undeniable user tracing mechanism to prevent user key abuse with traitor denial. Finally, we present formal security analysis and prototype the system leveraging the smart contracts of Ethereum blockchain for performance evaluation to show the feasibility of BPADAC.

Formal security analysis of an IoT mutual authentication protocol

Wireless sensor networks (WSNs) are widely used in day to day activities in order to provide users with multiple services such as smart grids, smart homes, industrial internet of things (IoT), agriculture and health-care. These services are provided by collecting and transmitting the sensing data to the gateway node over an unsafe channel, having constraints of security, energy consumption and connectivity. In 2022, Fariss et al. proposed an ECC-based mutual authentication and key agreement protocol for WSNs. They provided its informal security and showed that it’s secure against many security threats. They also formally analyzed the scheme’s security using AVISPA Tool. In this article, we analyze the security of Fariss et. Al protocol using GNY logic, an advanced version of BAN logic.

Secure Model-Contrastive Federated Learning With Improved Compressive Sensing

Federated Learning (FL) has been widely used in various fields such as financial risk control, e-government and smart healthcare. To protect data privacy, many privacy-preserving FL approaches have been designed and implemented in various scenarios. However, existing works incur high communication burdens on clients, and affect the training model accuracy due to non-Independently and Identically Distributed (non-IID) data samples separately owned by clients. To solve these issues, in this paper we propose a secure Model-Contrastive Federated Learning with improved Compressive Sensing (MCFL-CS) scheme, motivated by contrastive learning. We combine model-contrastive loss and cross-entropy loss to design the local network architecture of our scheme, which can alleviate the impact of data heterogeneity on model accuracy. Then we utilize improved compressive sensing and local differential privacy to reduce communication costs and prevent clients’ privacy leakage. The formal security analysis shows that our scheme satisfies (ε,δ)-differential privacy. And extensive experiments using five benchmark datasets demonstrate that our scheme improves the model accuracy by 3.45% on average of all datasets under the non-IID setting and reduces the communication costs by more than 95%, when compared with FedAvg.

Decentralized Identity Authentication with Auditability and Privacy

Decentralized identity (DID) systems aim to give users full control over their identities by using completely decentralized technologies, such as blockchain or distributed ledgers, as identity providers. However, when user credentials are compromised, it is impossible in existing DID systems for the users to detect credential misuse. In this paper, we propose new DID authentication protocols with two properties: auditability and privacy. The former enables the detection of malicious authentication events, while the latter prevents an adversary from linking an authentication event to the corresponding user and service provider. We present two protocols that achieve auditability with varying privacy and performance guarantees. The first protocol has high performance, but it reveals information about the user. The second protocol achieves full privacy, but it incurs a higher performance overhead. We present a formal security analysis of our privacy-preserving protocols by using the Tamarin prover. We implemented them and evaluated their performance with a permissioned blockchain deployed over the Amazon AWS and a local cloud infrastructure. The results demonstrate that the first protocol is able to support realistic authentication workloads, while the second is nearly practical.

An anonymity-preserving mobile user authentication protocol for global roaming services

In this article, we put forward an anonymity-preserving mobile user authentication protocol for global roaming services. It deals with Mutual Authentication and Key Agreement (MAKA) between Mobile User (MU) and Foreign Agent (FA). It replaces the traditional Elliptic Curve Computational Diffie–Hellman Problem (ECCDHP) by Elliptic Curve Factorization Problem (ECFP) to reduce the computational overhead of the authentication system while keeping the system security unaltered. It can preserve user anonymity and conditional privacy using session-wise unique anonymous identities of MU, where each anonymous identity hides the real identity in such a way so that only Home Agent (HA) can recompute it. Besides, our protocol also concentrates on the anonymity and conditional privacy of FA. It also provides a simplified revocation strategy which minimizes the revocation and re-registration costs of the authentication system. We validate the security features through informal and formal security analysis. Finally, we present a performance comparison, and discuss the efficiency of the proposed protocol.

Improved and Provably Secure ECC-Based Two-Factor Remote Authentication Scheme with Session Key Agreement

The remote authentication scheme is a cryptographic protocol incorporated by user–server applications to prevent unauthorized access and security attacks. Recently, a two-factor authentication scheme using hard problems in elliptic curve cryptography (ECC)—the elliptic curve discrete logarithm problem (ECDLP), elliptic curve computational Diffie–Hellman problem (ECCDHP), and elliptic curve factorization problem (ECFP)—was developed, but was unable to address several infeasibility issues while incurring high communication costs. Moreover, previous schemes were shown to be vulnerable to privileged insider attacks. Therefore, this research proposes an improved ECC-based authentication scheme with a session key agreement to rectify the infeasible computations and provide a mechanism for the password change/update phase. The formal security analysis proves that the scheme is provably secure under the random oracle model (ROM) and achieves mutual authentication using BAN logic. Based on the performance analysis, the proposed scheme resists the privileged insider attack and attains all of the security goals while keeping the computational costs lower than other schemes based on the three hard problems. Therefore, the findings suggest the potential applicability of the three hard problems in designing identification and authentication schemes in distributed computer networks.

Provably secure certificateless protocol for wireless body area network

Wireless body area networks are gaining popularity due to their innovative applications such as timely analysis, remote monitoring of patients’ health, and high patient care quality. However, these healthcare systems that carry patient’s physiological data need special attention for the security and privacy of information. Due to the openness of transmitted data, the healthcare system gets prone to several adverse attacks. In this paper, a provably secure remote healthcare system is proposed based on the elliptic curve cryptosystem. The goal is to enable confidentiality and privacy of sensitive information by designing a certificateless authenticated key agreement protocol with low computational cost and higher security. The proposed scheme achieves anonymity, resistance to key escrow problems, mutual authentication between the sensor nodes attached to patients and the application provider. Furthermore, the protocol undergoes formal security analysis using the random oracle model, and the soundness of the proposed scheme is validated using ProVerif. Finally, the performance analysis depicts that the proposed scheme is efficient compared to existing methods.

Privacy conserving authenticated key settlement approach for remote users in IoT based Telecare Medicine information system

The Fourth Healthcare Industrial Revolution is transforming the traditional healthcare service to Internet of Things (IoT) based smart healthcare system. Telecare medicine information system (TMIS) is one of them which demands 100% electronic transaction. In this situation, User authentication, fortifies the legitimate patients, doctors, medical helper staffs, etc. Not only that, but it also allows them to access the remote medical servers to serve medical services. Robust and Efficient user authentication plays a vital role here. Many researchers proposed different techniques, but all of them have different limitations like computational expenses, huge memory usage, excessive communication overhead, etc. In this article, a very lightweight authentication approach of remote user is demonstrated in IoT based smart healthcare environment. This approach optimizes the use of one-way hash function, exclusive-or operation and extended One-Time-Password which make the authentication approach lighter and effective. The security strength of the recommended protocol is elaborated with the help of informal and formal security analysis. Well known BAN logic and Real-Or-Random (ROR) model are used in to check the correctness of the protocol and ensure the security of the established session key. In addition to that, AVISPA (automated validation of Internet security protocols and applications) and ProVerif software simulation tools are utilized which parade, the proposed protocol is safe and secure against many attacks like Man-In-The-Middle attack and Replay attack, Ephemeral secret leakage attack, Known-session-specific-temporary-information attack, Impersonation attack, etc. and maintain the secrecy of the session key. Furthermore, the recommended protocol is compared with the existing/recently published protocols to exhibit better performance.

Secure Authentication and Key Management Protocol for Deployment of Internet of Vehicles (IoV) Concerning Intelligent Transport Systems

Intelligent transport systems amalgamated with advanced technologies are an important element of the automotive industry, including critical infrastructure and transportation. Internet of Vehicles (IoV) is the modern technological framework designed for intelligent transportation. IoV creates a network of information relations among vehicles, thus contributing to reduced congestion, roadside infrastructure, driver/traveller safety, and traffic efficiency through wireless communication and sensing technology. However, a significant challenge in IoV applications is security, as criminals could potentially exploit these applications. It is clear that despite increasing industry awareness, the potential danger posed by security vulnerabilities and cyber threats is high. In this study, we have designed a new system called AKAP-IoV, which supports secure communication, mutual authentication, and key management among vehicles, roadside units, and fog and cloud servers. AKAP-IoV was tested and verified using Scyther and Tamarin to ensure its resistance to cyber threats. Furthermore, we conducted a formal security analysis using the Real-or-Random (RoR) oracle model to assess security properties logically. In addition, a detailed, comprehensive comparative study was considered to evaluate the performance, functionality, efficiency and security features supported by AKAP-IoV compared to those of recently developed schemes.

Securing Session Initiation Protocol

The session initiation protocol (SIP) is widely used for multimedia communication as a signaling protocol for managing, establishing, maintaining, and terminating multimedia sessions among participants. However, SIP is exposed to a variety of security threats. To overcome the security flaws of SIP, it needs to support a number of security services: authentication, confidentiality, and integrity. Few solutions have been introduced in the literature to secure SIP, which can support these security services. Most of them are based on internet security standards and have many drawbacks. This work introduces a new protocol for securing SIP called secure-SIP (S-SIP). S-SIP consists of two protocols: the SIP authentication (A-SIP) protocol and the key management and protection (KP-SIP) protocol. A-SIP is a novel mutual authentication protocol. KP-SIP is used to secure SIP signaling messages and exchange session keys among entities. It provides different security services for SIP: integrity, confidentiality, and key management. A-SIP is based on the secure remote password (SRP) protocol, which is one of standard password-based authentication protocols supported by the transport layer security (TLS) standard. However, A-SIP is more secure and efficient than SRP because it covers its security flaws and weaknesses, which are illustrated and proven in this work. Through comprehensive informal and formal security analyses, we demonstrate that S-SIP is secure and can address SIP vulnerabilities. In addition, the proposed protocols were compared with many related protocols in terms of security and performance. It was found that the proposed protocols are more secure and have better performance.

Provably Secure PUF-Based Lightweight Mutual Authentication Scheme for Wireless Body Area Networks

Wireless body area networks (WBANs) are used in modern medical service environments for the convenience of patients and medical professionals. Owing to the recent COVID-19 pandemic and an aging society, WBANs are attracting attention. In a WBAN environment, the patient has a sensor node attached to him/her that collects patient status information, such as blood pressure, blood glucose, and pulse; this information is simultaneously transmitted to his/her respective medical professional through a gateway. The medical professional receives and checks the patient’s status information and provides a diagnosis. However, sensitive information, including the patient’s personal and status data, are transmitted via a public channel, causing security concerns. If an adversary intercepts this information, it could threaten the patient’s well-being. Therefore, a secure authentication scheme is essential for WBAN environments. Recently, Chen et al. proposed a two-factor authentication scheme for WBANs. However, we found out Chen et al.’s scheme is vulnerable to a privileged insider, physical cloning, verification leakage, impersonation, and session key disclosure attacks. We also propose a secure physical-unclonable-function (PUF)-based lightweight mutual authentication scheme for WBANs. Through informal security analysis, we demonstrate that the proposed scheme using biometrics and the PUF is safe against various security attacks. In addition, we verify the security features of our scheme through formal security analyses using Burrows–Abadi–Needham (BAN) logic, the real-or-random (RoR) model, and the Automated Validation of Internet Security Protocols and Applications (AVISPA). Furthermore, we evaluate the security features, communication costs, and computational costs of our proposed scheme and compare them with those of other related schemes. Consequently, our scheme is more suitable for WBAN environments than the other related schemes.

EBAKE-SE: A novel ECC-based authenticated key exchange between industrial IoT devices using secure element

Industrial IoT (IIoT) aims to enhance services provided by various industries, such as manufacturing and product processing. IIoT suffers from various challenges, and security is one of the key challenge among those challenges. Authentication and access control are two notable challenges for any IIoT based industrial deployment. Any IoT based Industry 4.0 enterprise designs networks between hundreds of tiny devices such as sensors, actuators, fog devices and gateways. Thus, articulating a secure authentication protocol between sensing devices or a sensing device and user devices is an essential step in IoT security. In this paper, first, we present cryptanalysis for the certificate-based scheme proposed for a similar environment by Das et al. and prove that their scheme is vulnerable to various traditional attacks such as device anonymity, MITM, and DoS. We then put forward an inter-device authentication scheme using an ECC (Elliptic Curve Cryptography) that is highly secure and lightweight compared to other existing schemes for a similar environment. Furthermore, we set forth a formal security analysis using the random oracle-based ROR model and informal security analysis over the Doleve-Yao channel. In this paper, we present comparison of the proposed scheme with existing schemes based on communication cost, computation cost and security index to prove that the proposed EBAKE-SE is highly efficient, reliable, and trustworthy compared to other existing schemes for an inter-device authentication. At long last, we present an implementation for the proposed EBAKE-SE using MQTT protocol.

Pocket Diagnosis: Secure Federated Learning Against Poisoning Attack in the Cloud

Federated learning has become prevalent in medical diagnosis due to its effectiveness in training a federated model among multiple health institutions (i.e., Data Islands (DIs)). However, increasingly massive DI-level poisoning attacks have shed light on a vulnerability in federated learning, which inject poisoned data into certain DIs to corrupt the availability of the federated model. Previous works on federated learning have been inadequate in ensuring the privacy of DIs and the availability of the final federated model. In this article, we design a secure federated learning mechanism with multiple keys to prevent DI-level poisoning attacks for medical diagnosis, called <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SFAP</small> . Concretely, <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SFAP</small> provides privacy-preserving random forest-based federated learning by using the multi-key secure computation, which guarantees the confidentiality of DI-related information. Meanwhile, a secure defense strategy over encrypted locally-submitted models is proposed to resist DI-level poisoning attacks. Finally, our formal security analysis and empirical tests on a public cloud platform demonstrate the security and efficiency of <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SFAP</small> as well as its capability of resisting DI-level poisoning attacks.

Verifiable Semantic-Aware Ranked Keyword Search in Cloud-Assisted Edge Computing

Ranked keyword search has gained Ranked keyword search has gained traction due to its attractive properties such as flexibility and accessibility. However, most existing ranked keyword search schemes ignore the semantic associations between the documents and queries. To solve this challenging issue in cloud-assisted edge computing, we first design the <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">S</b> emantic-aware <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">R</b> anked <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">M</b> ulti-keyword <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">S</b> earch (SRMS) scheme by adopting the Latent Dirichlet Allocation (LDA) topic model and the Chinese Remainder Theorem (CRT)-based secret sharing mechanism. Considering that the cloud server may be malicious, we implement a basic verification mechanism in SRMS to verify the correctness and completeness of search results and extend this verification mechanism in cloud-assisted edge computing scenarios. Formal security analysis proves that SRMS and extended result verification mechanisms are secure in both the known ciphertext model and the known background model. Extensive experiments using the real-world dataset demonstrate that SRMS is efficient and practical.