Fuzzy Extractor Research Articles

Robust and Reusable Fuzzy Extractors from Non-Uniform Learning with燛rrors Problem

A fuzzy extractor can extract an almost uniform random string from a noisy source with enough entropy such as biometric data. To reproduce an identical key from repeated readings of biometric data, the fuzzy extractor generates a helper data and a random string from biometric data and uses the helper data to reproduce the random string from the second reading. In 2013, Fuller et al. proposed a computational fuzzy extractor based on the learning with errors problem. Their construction, however, can tolerate a sub-linear fraction of errors and has an inefficient decoding algorithm, which causes the reproducing time to increase significantly. In 2016, Canetti et al. proposed a fuzzy extractor with inputs from low-entropy distributions based on a strong primitive, which is called digital locker. However, their construction necessitates an excessive amount of storage space for the helper data, which is stored in authentication server. Based on these observations, we propose a new efficient computational fuzzy extractor with small size of helper data. Our scheme supports reusability and robustness, which are security notions that must be satisfied in order to use a fuzzy extractor as a secure authentication method in real life. Also, it conceals no information about the biometric data and thanks to the new decoding algorithm can tolerate linear errors. Based on the non-uniform learning with errors problem, we present a formal security proof for the proposed fuzzy extractor. Furthermore, we analyze the performance of our fuzzy extractor scheme and provide parameter sets that meet the security requirements. As a result of our implementation and analysis, we show that our scheme outperforms previous fuzzy extractor schemes in terms of the efficiency of the generation and reproduction algorithms, as well as the size of helper data.

Face Attribute Convolutional Neural Network System for Data Security with Improved Crypto Biometrics

Due to the enormous usage of the internet for transmission of data over a network, security and authenticity become major risks. Major challenges encountered in biometric system are the misuse of enrolled biometric templates stored in database server. To describe these issues various algorithms are implemented to deliver better protection to biometric traits such as physical (Face, fingerprint, Ear etc.) and behavioural (Gesture, Voice, tying etc.) by means of matching and verification process. In this work, biometric security system with fuzzy extractor and convolutional neural networks using face attribute is proposed which provides different choices for supporting cryptographic processes to the confidential data. The proposed system not only offers security but also enhances the system execution by discrepancy conservation of binary templates. Here Face Attribute Convolutional Neural Network (FACNN) is used to generate binary codes from nodal points which act as a key to encrypt and decrypt the entire data for further processing. Implementing Artificial Intelligence (AI) into the proposed system, automatically upgrades and replaces the previously stored biometric template after certain time period to reduce the risk of ageing difference while processing. Binary codes generated from face templates are used not only for cryptographic approach is also used for biometric process of enrolment and verification. Three main face data sets are taken into the evaluation to attain system performance by improving the efficiency of matching performance to verify authenticity. This system enhances the system performance by 8% matching and verification and minimizes the False Acceptance Rate (FAR), False Rejection Rate (FRR) and Equal Error Rate (EER) by 6 times and increases the data privacy through the biometric cryptosystem by 98.2% while compared to other work.

PEASE: A PUF-Based Efficient Authentication and Session Establishment Protocol for Machine-to-Machine Communication in Industrial IoT

Machine-to-machine (M2M) communication is one of the critical technologies of the industrial Internet of Things (IoT), which consists of sensors, actuators at the edge, and servers. In order to solve the security and availability problems regarding communication between edge devices with constrained resources and servers in M2M communication, in this study we proposed an authentication and session establishment protocol based on physical unclonable functions (PUFs). The scheme does not require clock synchronization among the devices, and it circumvents the situation where the authentication phase has to use a high computational overhead fuzzy extractor due to PUF noise. The protocol contains two message interactions, which provide strong security and availability while being lightweight. The security modelling is based on CPN Tools, which verifies security attributes and attack resistance in the authentication phase. After considering the design of the fuzzy extractor and scalability, the proposed scheme significantly reduces the computational overhead by more than 93.83% in the authentication phase compared with other schemes using PUFs. Meanwhile, under the guarantee of availability, the communication overhead is maintained at a balanced and reasonable level, at least 19.67% lower than the solution using XOR, hashing, or an elliptic curve.

A Strong ECC Based on Secure Authentication with Privacy for IoT Concepts

The internet of things offers a rich set of options and applications in different fields, such as smart home, agriculture, security, transportation, and health issues. The IoT aims at organizing the interactions between items that are both sensors and actuators, known as objects. These objects acquire new applications in our lives that facilitate the remote control of smart devices via the open channel. However, this makes the sensitive transmitted data easily reachable and vulnerable to many attacks. With this in mind, security and privacy become an essential requirement that precedes the deployment of any IoT network. In this paper, the authors provide an IoT authentication and key agreement scheme using ECC and a fuzzy extractor and then they use BAN logic model and AVISPA tool to demonstrate the security of the scheme. They show that the proposed scheme is resistant to various attacks. Furthermore, the security analysis of the proposed scheme and its comparison with some other related works have shown that the proposed scheme is both more efficient and more secure than the other ones.

An improved biometric based user authentication and key agreement scheme for intelligent sensor based wireless communication

The new communication technologies have changed the traditional networks processes and provides more feasible, and convenient services for healthcare, agriculture, and transportation. Ad hoc networks devices have limited resources for energy, storage and processing. The conventional and traditional security solutions are not suitable for small and tiny sensor nodes. The symmetric cryptography method consumes more energy than public key cryptography method, whereas the public key cryptography method is a resource-intensive and not suitable for wireless networks. The symmetric cryptosystems have key management issues. Different authentication mechanisms have been designed but almost all of them are either complex or insecure. Improving network security with less resources consumption, there is a need to design and develop more advance and lightweight solution. This paper proposed a Biometric based User Authentication and Key Agreement Protocol (BUAKA) that uses a fuzzy extractor and one-way hash functions for sensor nodes authentication. The proposed scheme has four phases: initialization, registration, authentication, and password renewal phase. The proposed scheme resolves the complexities issues by providing a secure authentication mechanism and provide great resilience against a number of attacks. Finally, the proposed scheme is evaluated using several parameters such as security attacks, computational cost, and communication overhead to measure the effectiveness of proposed scheme.

FLoRa: Sequential fuzzy extractor based physical layer key generation for LPWAN

The security of Low-Power Wide-Area Network (LPWAN) mainly relies on encryption for ensuring packet integrity and confidentiality. Unfortunately, the latest LPWAN specifications refrain from specifying how to distribute keys for encryption. In this paper, we tackle this problem via physical layer security, which exploits the channel characteristics to generate secret keys at the physical layer. In order to generate consistent keys from noisy feature sources and to achieve high reconciliation success rate, we propose FLoRa, a physical layer key generation system for LPWAN based on sequential fuzzy extractor. An adaptive multi-bit quantization algorithm is first proposed to generate the initial key, which accelerates the bit generation rate at the start-up procedure. We then design a novel fuzzy extractor by sequentially slicing the initial key, which improves the reconciliation success rate, as well as reduces the key reconciliation time. We implement FLoRa in a LoRaWAN based network prototype and evaluate it by conducting extensive indoor and outdoor experiments. Experimental results reveal that FLoRa is capable of generating consistent secret keys with high key generation performance in both static and dynamic network environments.

An Improved Lightweight PUF–PKI Digital Certificate Authentication Scheme for the Internet of Things

Prosanta and Biplab presented a lightweight two-factor authentication scheme for the Internet of Things (IoT) devices based on the physical unclonable function (PUF). Their presented scheme was based on the fuzzy extractor and analyzed various security reasonings, such as mutual authentication, session key agreement, privacy and protection against impersonation, message tampering, and replay attacks. In this article, we present sufficient security analysis to demonstrate that the scheme has various security and privacy issues in its setup and authentication phases. We propose a highly secure and robust authentication protocol based on a public key infrastructure (PKI) digital certificate based on two certificate authorities (CAs) for cloud IoT systems. The proposed authentication method is verified and validated using the Tamarin prover and supported with a detailed security and performance analysis discussion. The scheme security and privacy attributes are compared with other IoT authentication schemes. The analysis has proved that the proposed authentication scheme is more secure and highly reliable as compared to the Prosanta and Biplab authentication scheme.

Neural Fuzzy Extractors: A Secure Way to Use Artificial Neural Networks for Biometric User Authentication

Powered by new advances in sensor development and artificial intelligence, the decreasing cost of computation, and the pervasiveness of handheld computation devices, biometric user authentication (and identification) is rapidly becoming ubiquitous. Modern approaches to biometric authentication, based on sophisticated machine learning techniques, cannot avoid storing either trained-classifier details or explicit user biometric data, thus exposing users’ credentials to falsification. In this paper, we introduce a secure way to handle user-specific information involved with the use of artificial neural networks for biometric authentication. Our proposed architecture, called a Neural Fuzzy Extractor (NFE), allows the coupling of pre-existing classifiers with fuzzy extractors, through an artificial-neuralnetwork-based buffer called an expander, with minimal or no performance degradation. The NFE thus offers all the performance advantages of modern deep-learningbased classifiers and all the security of standard fuzzy extractors. We demonstrate the NFE retrofit of a few classic artificial neural networks, for simple biometric authentication scenarios.

ISG-SLAS: Secure and lightweight authentication and key agreement scheme for industrial smart grid using fuzzy extractor

Smart grid (SG) has been received significant attention due to various services such as renewable energy and demand response. However, SG is fragile to various security attacks because an adversary can eavesdrop, insert, delete, or intercept the exchanged messages over an open channel. Thus, secure and lightweight authentication and key agreement (AKA) scheme for SG to ensure the necessary security requirements. Recently, the existing schemes designed a secure and efficient AKA protocol for industrial SG using cryptographic primitives to ensure reliable energy services. However, we prove that existing schemes for industrial SG are vulnerable to potential security attacks and do not guarantee the necessary security requirements. To enhance the security flaws of the existing schemes, we design a secure and lightweight AKA scheme for SG using fuzzy extractor, called ISG-SLAS. ISG-SLAS resists various security attacks and provides security functionalities. We evaluate the security of the ISG-SLAS using ROR model and AVISPA simulation. Moreover, we present the testbed experiments using MIRACL based on Raspberry PI 4. We then present a comparative analysis between ISG-SLAS and related schemes. Consequently, ISG-SLAS better ensures security and efficiency compared with related schemes and is more suitable than related schemes for practical SG.

MACP: Multifactor Authentication using Physical Unclonable Function and Fuzzy Extractor based Chebyshev Polynomial for Industrial Internet of Things devices

AbstractThe Internet of Things adapted by the industries, known as Industrial Internet of Things (IIoT), increases the production rate by reducing the risk factor. The wireless devices deployed in the open places are always susceptible to various attacks including cloning and physical attacks. Thus security of IIoT devices becomes the primary concern of these days. The resource constraint IIoT devices demand light weight security schemes to authenticate communicating devices and protect the privacy of industrial data. In this article, an authentication scheme with low computation and communication cost has been proposed using multiple factors, namely smart card, password, physical unclonable function (PUF), and fuzzy extractor. PUF helps in preventing the cloning of smart card and generates unique challenge‐response pairs to authenticate the smart devices. The environmental noise, produced by the operation of PUF, is extracted by the use of fuzzy extractor. Real‐or‐Random (ROR) model and Burrows‐Abadi‐Needham (BAN) logic has been used for formal security analysis of the proposed scheme, which is resilience against replay attack, man‐in‐the‐middle attack, masquerading, forgery and impersonation attacks, camouflage attack and offline password guessing attack. The performance evaluation has been done using Raspberry Pi, lunchbox, and a laptop. The simulation results show that the proposed scheme outperforms the existing methodologies in terms of end‐to‐end delay, throughput, packet loss, computation cost, and communication cost.

Blockchain and PUF-Based Lightweight Authentication Protocol for Wireless Medical Sensor Networks

Due to the emergence of heterogeneous Internet of Medical Things (IoMT) (e.g., wearable health devices, smartwatch monitoring, and automated insulin delivery systems), large volumes of patient data are dispatched to central cloud servers for disease analysis and diagnosis. Although this direct mode brings a lot of convenience for both patients and medical professionals (MPs), the open communication channel between them also incurs several security and privacy issues, such as man-in-the-middle attacks, eavesdropping attacks, and tracking attacks. Based on the unsolved challenges in wireless medical sensor networks (WMSNs), several researchers have proposed various authentication and key agreement (AKA) protocols for this type of healthcare system recently. However, most of these protocols do not perceive physical-layer security and over-centralized server problem in WMSN. In this article, to address these two open problems, we propose a lightweight and reliable authentication protocol for WMSN, which is composed of cutting-edge blockchain technology and physically unclonable functions (PUFs). In addition, a fuzzy extractor scheme is introduced to deal with biometric information. Subsequently, two security evaluation methods are used to prove the high reliability of our proposed scheme. Finally, performance evaluation experiments illustrate that the proposed mutual authentication protocol requires the least computation and communication cost among the compared schemes.

A Comparative Study on Various Techniques Related to Fingerprint Based Biometric Cryptosystems

In this digital era, data transmission through network is essential for everyone. Users are not confident that their data is secure when it is transferred through a network. So there is a need of protecting data transferring through network in a swollen manner. Cryptography is our conventional method for protecting information and communications using some keys. But keys can be stolen or forgotten. Due to these reasons biometrics are introduced for key generation. Keys generated using biometrics are specific to that person and are generated dynamically with their biometrics. By combining cryptography with biometrics, we can develop a secure system which can be used in different applications like law enforcement, border control, consumer biometrics, financial services and also to provide access for smart devices. In this comparative study of various attacks on Biometric Cryptosystems are discussed and related techniques used in Biometric Cryptosystems for key generation like Fuzzy Extractor and key binding techniques such as Fuzzy Vault, Fuzzy Commitment are discussed and their performance is analysed.

Biometric authentication utilizing fuzzy extractor with PSO based security ensuring the data security mechanism as Trio in Cloud

Cloud computing is widely preferred by various organizations due to its numerous advantages such as lower costs, better security, and faster processing times. The most critical data stored in the remote servers are protected by firewalls and encryption, at the same time, the user’s essential data may be accessed from the remote cloud server without their control. This kind of data storage facility introduces various security complications. In order to prevent these issues, we have proposed a method that uses a Biometric authentication method with PSO to provide high-level security. The method combines a pseudo-integer authentication scheme with a secret OTP that can be used to authenticate an individual. A Tri-level security mechanism model is proposed to store three types of data classification namely, No Privacy, Privacy with Trusted Provider and Privacy with Non-PNR. The proposed method provides a uniform security scheme for all the classifications using Adaptive ElGamal with Menezes-Qu-Verstone, that prevents data loss and corruption caused by insiders in the cloud. Further Seed Block is utilized to recover and extract data without loss. It does so by effectively extracting the data from the formatted disks. It is then followed with the decryption process, as if the data are requested by the user. Our framework aims to provide a secure and authenticated environment for accessing data. It features an improved authentication process and reduced complexity.

Analysis Of Biometric-Based Identification Algorithms In Electronic Trust Services Systems

The article is devoted to the usage of identification algorithms based on biometric personal data (biometrics) in the electronic trust services. This theme is of considerable interest due to the fact that it is becoming one of the most used tools in everyday life. It can include such things as fingerprint and facial scanners in modern cell phones as well as more official aspects such as a personal passport or signature. The main problem of electronic identification is that the most effective algorithms: based on abstract-minutiae cylindrical codes, where minutiae are unique to each fingerprint and determine the points of change in the structure of the capillary lines (ending, splitting, breaking, etc.), the orientation of capillary lines and coordinates at these points. Also, algorithms based on fuzzy extractors, where by fuzzy extractor we mean the system (object, algorithm) which transforms biometric data into random sequences, providing the opportunity to apply encryption methods for biometric security. Although they perform their role, they do not always work correctly and present a possible danger to a user. A comprehensive analysis of the advantages and disadvantages of such algorithms requires further investigation and combination of these algorithms to solve existing problems and improve overall response. Not only could that provide a higher level of protection, but also greatly simplify the mathematical complexity of data processing, as well as lead to an increase in the number of correct triggers and overall increase the efficiency of using biometric technology in electronic trust services.

PUF-Assisted Lightweight Group Authentication and Key Agreement Protocol in Smart Home

Various IoT-based applications such as smart home, intelligent medical, and VANETs have been put into practical utilization. The smart home is one of the most concerned environments, allowing users to access and control smart devices via the public network remotely. The smart home can provide many intelligent services for users through these smart devices. To securely access devices and obtain collected data over the public network, multifactor authentication protocols for smart home have gained wide attention. However, most of these protocols cannot withstand impersonation attack, smart device lost attack, privileged-insider attack, smart card lost attack, and so on. Besides, high communication and computational costs weaken the system performance, which leads to most authentication protocols are not suitable for resource-constrained smart devices. To mitigate the aforementioned drawbacks, we proposed a PUF-assisted lightweight group authentication and key agreement protocol to implement secure access to multiple devices in the smart home simultaneously using the Chinese Remainder Theorem and secret sharing technique. Our protocol also utilizes physical unclonable function (PUF) and fuzzy extractor technique to extract the digital fingerprint of the smart devices, which can uniquely validate smart devices and protect the secrets stored in their memory. Our protocol can support various security features and withstand the many well-known attacks in the smart home. The performance analysis indicates that the proposed protocol can efficiently reduce communication/computational costs when the user simultaneously accesses multiple devices.

A blockchain and smart contract-based data provenance collection and storing in cloud environment

Data uploading needs security and privacy in the cloud. But there are some problems like centralized provenance data (PD) collection, storage, lack of security, integrity, and more time consumption. There are methods like Rabin, Knapsack, McEliece, Elagamal, and Rivest–Shamir–Adleman for the generation of keys but it increases the encryption and decryption time and less security. Therefore, the blockchain and smart contract-based data provenance (BSCDP) Architecture is proposed for providing secure storage in the cloud environment. Initially, the fingerprint biometrics and physically uncloneable functions (PUF) have been used in verification process. The combination of PUF and fingerprint biometrics is used for secure data transmission. To protect privacy and strengthen the security, the fuzzy extractor is employed. Secondly, we use an elliptic-curve key based cyclic shift transposition cryptography algorithm for enhancing the security when sharing the key. Thirdly, we introduce the blockchain and the interplanetary file system (IPFS) for PD collection, hash computation, and storing with reduced computational overhead (CO). The integrity of data is maintained by using blockchain based secure hashing algorithm-3. By arranging fuzzy based smart contracts (FSC), the data user (DU) tracks their data. FSC is employed for tracking the history of data. The data collected is directly stored in IPFS and the DU gets a hash from IPFS to retrieve the data in the future. Finally, the data verification is done by the provenance auditor. When comparing our proposed BSCDP method with existing methods, the proposed BSCDP method achieves high security in the cloud environment for 2 K users in terms of evidence insertion time (30 ms), verification time (30 ms), response time (40 ms), total change rate (5%), CO (5.8 Kb), encryption (50 ms) and decryption time (52 ms).

A Lightweight and Practical Anonymous Authentication Protocol Based on Bit-Self-Test PUF

Physical unclonable function (PUF), a cryptographic primitive, has recently been used in protocol design because it can ensure a tamper-evident feature. In many PUF-based protocol schemes, helper data algorithms (HDA) or fuzzy extractors (FE) are used to generate strong keys from unreliable PUF responses. However, these methods inevitably introduce complex error correction techniques, which not only increase the overhead of embedded devices but also pose some security risks. We propose a novel HDA technology, which does not use any high-overhead error correction mechanism, greatly reducing the implementation complexity and execution overhead. The novel HDA exploits the strategy of bit-self-test (BST) and the PUF can extract the robust responses by using the real-time generated reliable flags, and then an entropy extractor is used to generate the reliable and random key with high entropy. Based on this novel HDA, we design a lightweight anonymous authentication protocol. The protocol uses pseudo-random function (PRF) and XOR operation instead of the traditional hash function and symmetric encryption algorithm, which ensures security while reducing the overhead. Moreover, the proposed protocol does not require the server to store a large number of challenge–response pairs (CRPs), which reduces the storage overhead on the server while avoiding the risk of leakage of CRPs. Moreover, the device identity ID is updated during each round of the authentication process, which prevents the device from being tracked and protects the privacy of the device. The implementation and performance analysis of the protocol prototype on a Zynq-7000 SoC XC7Z010 FPGA shows that the proposed scheme solves the problems encountered with existing schemes and has additional security properties.

Lightweight and Anonymous Mutual Authentication Protocol for Edge IoT Nodes with Physical Unclonable Function

Internet of Things (IoT) has been widely used in many fields, bringing great convenience to people’s traditional work and life. IoT generates tremendous amounts of data at the edge of network. However, the security of data transmission is facing severe challenges. In particular, edge IoT nodes cannot run complex encryption operations due to their limited computing and storage resources. Therefore, edge IoT nodes are more susceptible to various security attacks. To this end, a lightweight mutual authentication and key agreement protocol is proposed to achieve the security of IoT nodes’ communication. The protocol uses the reverse fuzzy extractor to acclimatize to the noisy environment and introduces the supplementary subprotocol to enhance resistance to the desynchronization attack. It uses only lightweight cryptographic operations, such as hash function, XORs, and PUF. It only stores one pseudo-identity. The protocol is proven to be secure by rigid security analysis based on improved BAN logic. Performance analysis shows the proposed protocol has more comprehensive functions and incurs lower computation and communication cost when compared with similar protocols.

Lightweight Key Management Scheme Using Fuzzy Extractor for Wireless Mobile Sensor Network

The mature design of wireless mobile sensor network makes it to be used in vast verities of applications including from home used to the security surveillance. All such types of applications based on wireless mobile sensor network are generally using real time data, most of them are interested in real time communication directly from cluster head of cluster instead of a base station in cluster network. This would be possible if an external user allows to directly access real time data from the cluster head in cluster wireless mobile sensor network instead of accessing data from base station. But this leads to a serious security breach and degrades the performance of any security protocol available in this domain. Most existing schemes for authentication and cluster key management for external users, exchange a number of messages between cluster head and base station to allow external to access real time data from the base station instead of cluster head. This increase communication cost and delay in such real time access information. To handle this critical issue in cluster wireless mobile sensor network, we propose a lightweight authentication and key management scheme using a fuzzy extractor. In this scheme, any external user can access data directly from the cluster head of any cluster without the involvement of the base station. The proposed scheme only uses the one-way hash functions and bitwise XOR operations, apart from the fuzzy extractor method for the user biometric verification at the login phase. The presented scheme supports scalability for an increasing number of nodes using polynomials. The proposed scheme increases the life-time of the network by decreasing the key pool size.

Privacy, Secrecy, and Storage With Nested Randomized Polar Subcode Constructions

We consider a set of security and privacy problems under reliability and storage constraints that can be tackled by using codes and particularly focus on the secret-key agreement problem. Polar subcodes (PSCs) are polar codes (PCs) with dynamically-frozen symbols and have a larger code minimum distance than PCs with only statically-frozen symbols. A randomized nested PSC construction, where the low-rate code is a PSC and the high-rate code is a PC, is proposed for successive cancellation list (SCL) and sequential decoders. This code construction aims to perform lossy compression with side information, i.e., Wyner-Ziv (WZ) coding. Nested PSCs are used in the key agreement problem with physical identifiers and two terminals since WZ-coding constructions significantly improve on Slepian-Wolf coding constructions such as fuzzy extractors. Significant gains in terms of the secret-key vs. storage rate ratio as compared to nested PCs with the same list sizes are illustrated to show that nested PSCs significantly improve on all existing code constructions. The performance of the nested PSCs is shown to improve with larger list sizes, unlike the nested PCs considered. A design procedure to efficiently construct nested PSCs and possible improvements to the nested PSC designs are also provided.