HMAC Research Articles

Model for Storing Tokens in Local Storage (Cookies) Using JSON Web Token (JWT) with HMAC (Hash-based Message Authentication Code) in E-Learning Systems

E-learning is a technology that may be used in the learning process to improve not only the distribution of learning materials but also the ability of learners to modify their abilities of various competencies contained in a database. A Web Service is used to integrate the data. Web Service is a set of standards and programming methods for sharing data between different software applications, distributing services over the internet that supports system interoperability. In this digital era, the system that will survive is one that can function on multiple platforms, and one of the options is to use web servicess. Data is exchanged in JSON format, and JSON Web Tokens are used for authentication security (JWT). The use of JWT for token-based authentication on web services can help overcome interoperability issues. JWT is stateless and allows for the inclusion of data in the token authorisation. JWT includes a number of algorithm possibilities, including HMAC. Overall, the adoption of HMAC outperforms the criteria of token generation time, token size, and token transfer speed. Storing JSON Web Token into local storage in the client browser using the HMAC algorithm has been presented in this paper. The proposed work has shown that JWTs do not need to be stored on the server but can be stored on the client browser side using local storage.

Hardware Implementation of Effective Framework for the Trade-off between Security and QoS in Wireless Sensor Networks

The trade-off between security and quality of service (QoS) in wireless networks has attracted great attention in recent years. This paper presents a hardware implementation of a novel framework for realizing the trade-off between security and QoS in wireless sensor networks (WSNs) regarding the hostility of the operating environment and the available resources of our objects. For evaluating the hostility of the operating environment, we developed an effective intrusion detection unit that sends an alarm signal to a control unit that also collects the data-carrying information about the available resources. As our work is concerned with WSNs, we focus on the power consumption of sensor nodes as the considered object resources. According to the collected data from the intrusion detection unit and resources status unit, the control unit can evaluate the situation of the object in the operating environment and sends control signals to a security unit to select the appropriate level of security among three levels (low, medium, and high) available in our developed framework. The three security levels consider different combinations of the cryptographic algorithms Hash-based Message Authentication Code (HMAC) and Advanced Encryption Standard (AES), with different key lengths, regarding the required security services (confidentiality, authentication and integrity) and available resources. To reinforce the QoS, we considered the advantages of hardware implementation in addition to maintaining the object resources. Our framework has been implemented using Field Programmable Gate Array (FPGA), Virtex-7 (xc7v585tffg1761–3), which helps in achieving reasonable performance with a maximum operating frequency of 206.838 MHz and throughput of 2.3 Gbps.

Building a Trust Model for Secure Data Sharing (TM-SDS) in Edge Computing Using HMAC Techniques

With the rapid growth of Internet of Things (IoT) based models, and the lack amount of data makes cloud computing resources insufficient. Hence, edge computing-based techniques are becoming more popular in present research domains that makes data storage, and processing effective at the network edges. There are several advanced features like parallel processing and data perception are available in edge computing. Still, there are some challenges in providing privacy and data security over networks. To solve the security issues in Edge Computing, Hash-based Message Authentication Code (HMAC) algorithm is used to provide solutions for preserving data from various attacks that happens with the distributed network nature. This paper proposed a Trust Model for Secure Data Sharing (TM-SDS) with HMAC algorithm. Here, data security is ensured with local and global trust levels with the centralized processing of cloud and by conserving resources effectively. Further, the proposed model achieved 84.25% of packet delivery ratio which is better compared to existing models in the resulting phase. The data packets are securely transmitted between entities in the proposed model and results showed that proposed TM-SDS model outperforms the existing models in an efficient manner.

Investigating the Avalanche Effect of Various Cryptographically Secure Hash Functions and Hash-Based Applications

In modern cryptography, hash functions are considered as one of the key components for secure communication. They play a vital role in a wide range of applications such as ensuring the authentication and integrity of the data, in forensic investigation, password storage, random number generations for unique session keys, and for creating a unified view in blockchain. The Avalanche effect (also known as diffusion) is an important characteristic of a hash function where a minor change in the hash function’s input will result in a significantly different output. The absence of this property implies that the hash function is vulnerable to various attacks such as collision attack, length extension attack, and preimage attack. Through this research, we have investigated the Avalanche effect of sixteen hash functions and two hash-based applications, namely Hash-based Message Authentication Code (HMAC) and Public Key Cryptography Standards (PKCS). To measure the performance of these hash functions and hash-based applications, we have implemented a generic circuit using CrypTool for automating the simulation process for multiple trials. Simulation results indicate that around half of the inputs of each hash function failed to exhibit the Strict Avalanche Criterion (SAC) and, Bit Independence Criterion (BIC). Moreover, we ranked the hash functions based on Multi Criteria Decision Metrics (MCDM) using intermediate states of simulation results. Furthermore, a total of fifteen statistical tests were carried out to evaluate the randomization property of the hash functions using NIST (National Institute of Standards and Technology) toolkit. This study is aimed to open up a future scope of research to the need for improvement of various hash functions by analyzing the randomization and non-correlation properties of existing functions in terms of the Avalanche effect.

Design and Implementation of an Encryption Unit to Enhance Satellite Communication Security

Satellite projects consume very high resources in all of their phases (research, design, manufacturing, testing and launching), they also extend for significant amount of time, and hence satellites must be protected against intrusion and data perception. Over the past years, satellite security has been overlooked except for military satellites because satellite intrusions were inconceivable as they far away from earth, but recently commercial satellite manufacturers realized the importance of satellite security because satellite intrusion became not an impossible task. In this paper, we present the design and implementation of encryption unit to secure satellite communication system by ciphering tele-commands using advanced encryption algorithm (AES) with random key generation, Diffie-Hellman key exchange algorithm and Hash-based message authentication code (HMAC) digital signature algorithm.

Privacy preservation and secure data sharing scheme in fog based vehicular ad-hoc network

Due to the increase in vehicle numbers and various services, such as exchanging messages between vehicles under different traffic conditions and in an emergency, the vehicular cloud computing (VCC) has drawn significant attention. The current centralized system has the computation and safety requirements such as secure storage, authentication, access control, availability over alternative network connections, and a real-time summary of the data flow. The traditional method includes the transfer of data for processing from the edge node to a centralized server that reduces the available bandwidth and increases the latency across the network. Transmission of the vast amount of data from the edge devices to a central system increases the chances of getting a security breach that leads to compromised information and data loss. In this paper, we propose a Privacy Preservation and Secure Data Sharing Scheme in Fog Based Vehicular Ad-hoc Network by analyzing critical information and employing data confidentiality with the help of Hierarchical Attribute-Based Encryption (HABE) with an efficient key exchange. The proposed scheme also uses symmetric encryption and a Hash-based Message Authentication Code (HMAC) computation with the shared secret key to secure the message transmission between vehicles. It also provides fine-grained access control before outsourcing data to the cloud server to ensure privacy depends on ownership to reduce the number of data forwarded to the cloud server with a short period and decreases bandwidth requirements due to fast analytics at the edge. Assessment of the proposed scheme is done by finding the key generation computation cost on attribute authority, message broadcasting computation cost for vehicles, and message decryption computation cost for vehicles.

A secure and efficient range query method for two‐layer wireless sensor networks

Traditional range query methods of work still have shortcomings in node energy consumption and privacy security, so a two-layer secure and efficient range query method for wireless sensor networks is proposed. In the data storage stage, the sensing node obtains the data ciphertext and timestamp by the Advanced Encryption Standard encryption algorithm, receives the new encryption constraint chain by the reverse 0–1 encoding method and Hash-based Message Authentication Code encryption algorithm, and sends the chain to the storage node. In the query response phase, the storage node responds to the request of the base station and sends the data that meet the query requirements. After receiving the data, the base station verifies the consistency with the new encryption constraint chain and timestamp. During the experiment, the energy consumption is analysed from three aspects: the number of data collected in the period, the data length of the sensing node and the partition factor of the encryption constraint chain. The results show that this method has low energy consumption and can maintain the consistency of data.

A lightweight traceable D2D authentication and key agreement scheme in 5G cellular networks

Device-to-device (D2D) communication is one of the promising features in 5G cellular networks. However, there are also new security challenges such as mutual authentication, device anonymity protection, end-to-end data secrecy, and free-riding attack prevention. Therefore, there is a need to develop an authentication scheme that addresses all these security concerns. The scheme must also be computationally lightweight, such that it supports all mobile devices having limited battery and computational resources. To overcome these challenges, in this paper, we propose a lightweight traceable D2D authentication and key agreement protocol (LT-AKA) based on the existing 3GPP 5G mobile networks. The LT-AKA scheme uses randomly generated hash-based message authentication code (HMAC) to guarantee message authorships, and Elliptic Curve Diffie-Hellman (ECDH) to facilitate secure key exchange. Security evaluation shows that our protocol is resilient to various network attacks including free-riding attacks. Performance evaluation shows that our protocol is 36.5%, 51.5%, and 7.7 times faster than the existing schemes.

IoT Data Privacy Protection Scheme based on Blockchain

This article introduces the blockchain technology and proposes a blockchain-based IoT sensor data privacy protection scheme from the anonymisation of user identity, the protection of private data and the procedure that allows third parties to use encrypted sensor data. The sensor and the gateway establish a connection after authentication and key negotiation, and the sensor periodically uploads the sampled data and hash-based message authentication code (HMAC) to the gateway. After the gateway verifies the HMAC code of the sensor data, it encrypts the sensor data, constructs a blockchain transaction and submits it to the blockchain node. Blockchain nodes cache transactions and periodically generate blocks to confirm that the transactions are on the chain. After the gateway constructs an authorised transaction and submits it to the blockchain node for confirmation, the designated decentralised application (DApp) obtains the permission and related keys to access the designated sensor managed by the gateway. Finally, the DApp queries the local blockchain node for the specified sensor data and decrypts the results. Experiments have proven through in-depth discussions on sensor synthesis data, sensor/gateway verification, transaction data encryption and transaction signatures that the scheme can be used in IoT systems.

Implementasi JWT pada Aplikasi Presensi dengan Validasi Fingerprint, Geotagging dan Device Checker

During the Covid-19 pandemic the government implement the imposition of Large-Scale Social Restrictions (PSBB). This PSBB also has an impact on companies in Jabodetabek including PT Akses Digital Indonesia. In order to comply with regulations given by the government, PT Akses Digital Indonesia has implemented a Work From Home (WFH) policy for its employees. During the implementation of the WFH policy, had difficulty monitoring the performance of its employees. Attendance is one measure of the level of performance, especially employee discipline. Based on the identification of the problem, an employee presence web service application is needed. Of course, this application should be as effective as conventional fingerprint machines in offices. This application is accompanied by a validation feature using geotagging, fingerprint and device checkers to minimize fraud when employees make attendance. This study implements the RESTful API security feature on web services using JSON Web Token (JWT) based on the HMAC SHA-256 algorithm. All implementation stages are tested using the Black Box method and show that JWT can secure the authentication process and secure data. The validation feature is able to provide attendance data with an accuracy of 90,9%.

Implementasi JSON Web Token Berbasis Algoritma SHA-512 untuk Otentikasi Aplikasi BatikKita

Batikkita is an android based application and web framework laravel web service architecture that is used to bring together between craftsmen and consumers of batik Trusmi and batikkita application with the e-commerce model used is business to customer. The backend system interface used is a web framework while the frontend system interface used is android. The problem that arises from the Batikkita application is that the security of users, both as sellers and consumers, is very vulnerable to being hacked, so it is very detrimental to both sellers and buyers. This study aims to implement the JSON Web Token based on the HMAC SHA-512 algorithm in the Batikkita application in order to provide a sense of security for both the seller and the buyer before entering the sales transaction page. The application development method used is Rapid Application Development because the cycle used to develop our batik application is very short so it is very helpful in this research. While the implementation of JSON Web Token with the HMAC SHA-512 algorithm in the Batikkita application is used to improve user security when logging in to the Batikkita application in the form of a token and the password used by the user is wrapped in a token given by the Batikkita application. As a comparison, the HMAC SHA-256 algorithm and the HMAC SHA-384 algorithm are used. The results obtained from testing the implementation of JSON Web Token with the SHA-512 algorithm in our batik application, for an average increase of speed between 138.8 milliseconds for SOAP and 122.7 milliseconds for REST compared to the HMAC SHA-256 algorithm and the HMAC SHA-algorithm. 384. While the required token size is greater between 2.13 kb for SOAP and 2.11 kb for REST compared to the HMAC SHA-256 algorithm and the HMAC SHA-384 algorithm.

DAPA: Differential Analysis aided Power Attack on (Non-) Linear Feedback Shift Registers

Differential power analysis (DPA) is a form of side-channel analysis (SCA) that performs statistical analysis on the power traces of cryptographic computations. DPA is applicable to many cryptographic primitives, including block ciphers, stream ciphers and even hash-based message authentication code (HMAC). At COSADE 2017, Dobraunig et al. presented a DPA on the fresh re-keying scheme Keymill to extract the bit relations of neighbouring bits in its shift registers, reducing the internal state guessing space from 128 to 4 bits. In this work, we generalise their methodology and combine with differential analysis, we called it differential analysis aided power attack (DAPA), to uncover more bit relations and take into account the linear or non-linear functions that feedback to the shift registers (i.e. LFSRs or NLFSRs). Next, we apply our DAPA on LR-Keymill, the improved version of Keymill designed to resist the aforementioned DPA, and breaks its 67.9-bit security claim with a 4-bit internal state guessing. We experimentally verified our analysis. In addition, we improve the previous DPA on Keymill by halving the amount of data resources needed for the attack. We also applied our DAPA to Trivium, a hardware-oriented stream cipher from the eSTREAM portfolio and reduces the key guessing space from 80 to 14 bits.

A New Derivation of the Leftover Hash Lemma.

This paper reviews the characteristics of the main digest algorithms, and presents a new derivation of the leftover hash lemma, using the collision probability to derive an upper bound on the statistical distance between the key and seed joint probability, and the hash bit sequence distribution. The paper discussed the use of the hash function in cryptography and presented a new derivation of the upper bound on the statistical distance between the joint distribution of the key and the seed, and the distribution of the hash bit distribution, based on the collision probability. A cryptographic hash function is used to verify whether a data file maps onto a certain hash value. On the other hand, it is difficult to reconstruct the information based on the hash value. Therefore, it is used to assure data in- integrity, and is the building block of a Hash-based Message Authentication Code (HMAC), which provide message authentication.

Analysis of the Security of Internet of Multimedia Things

To study the security performance of the Internet of multimedia things on the privacy protection of user identity, behavior trajectory, and preference under the new information technology industry wave, in this study, aiming at the problems of the sharing of Internet of things perception data and the exposure of users’ privacy information, the Anonymous Batch Authentication Scheme (ABAH) for privacy protection is designed. Hash-based Message Authentication Code is used to cancel the list-checking process and analyze its security performance. Compared with the methods of elliptic curve digital signature algorithm, Bayes least-square method, identity-based bulk verification, anonymous batch authentication and key protocol, conditional privacy authentication scheme, and expert message authentication protocol, the transmission delay, packet loss rate, and computation cost are studied without considering the undo list and during the undo check. The results show that with the increase of information size, the transmission delay and packet loss rate also increase, and the transmission delay of ABAH increases by about 15%, while the correlation between speed and transmission delay is small. In the case of the same amount of validation information, ABAH has the highest validation efficiency, and it still has an efficient validation effect in the case of invalid information. The message packet loss rate for ABAH is always 0 when the undo check validation overhead is considered. It can be found that ABAH can avoid the communication overhead and privacy leakage caused by the revocation list, ensure the integrity of batch verification information, meet the security performance of the vehicular ad hoc network under the Internet of Things, and protect the privacy of users from being disclosed.

Consensus Mechanism of IoT Based on Blockchain Technology

Applying blockchain technology to the Internet of Things (IoT) remains a huge challenge. To meet the actual needs of IoT, a lightweight and high-throughput consensus mechanism, combined with blockchain technology, is proposed in this study. Blockchain nodes use the Diffie–Hellman algorithm for key negotiation. Sensors and blockchain nodes can use the shared key to generate HMAC (Hash-based Message Authentication Code) signatures for sensor-aware transactions and use the Verifiable Random Function to implement block nodes. Offline fast election, which is the node that wins the election, becomes the block node. Machine learning methods are also introduced to identify or remove outliers in the sensor data before such data are uploaded to the chain. Experimental results show that the system throughput synchronously increases as the test load increases. Moreover, when the test load is 800 tps, the system throughput reaches the maximum, close to 600 tps. When the test load exceeds 800 tps, the actual system throughput starts to drop, and approximately 90% of transactions have a delay time within 5000 ms. This method can be used in a lightweight IoT system.

WATERMARCH: IP Protection Through Authenticated Obfuscation in FPGA Bitstreams

Field programmable gate array (FPGA) bitstreams contain information on the functionality of all hardware intellectual property (IP) cores used in a given design, so if an attacker gains access to the bitstream, they can mount attacks on the IP. Various mechanisms have been proposed to protect IP from reverse engineering and theft. However, there are no examples of IP obfuscation in FPGA bitstreams that also intrinsically enable tamper detection and authentication at no additional hardware cost. In this letter, we propose a mutable architecture-based watermarking scheme called WATERMARCH, a novel technique of authenticated obfuscation utilizing a hash-based message authentication code (HMAC) to cryptographically mesh the obfuscation and watermark with the original design, with no additional overhead beyond the underlying obfuscation method. While collaboration between the IP owner and FPGA vendor is necessary to facilitate parsing of the bitstream, once the bitstream is parsable, the watermark can be extracted to prove authorship of the IP or confirm the presence of malicious IP modification, providing tremendous benefits to both IP owners and end users.

Separable Robust Reversible Watermarking in Encrypted 2D Vector Graphics

To accomplish robust watermark extraction in reversible watermarking both in plaintext domain and encrypted domain, a separable robust reversible watermarking in encrypted 2D vector graphics is proposed in this paper. Firstly, a content owner uses a key to scramble the polar angles of the vertices to encrypt the graphics in the polar coordinate system. Consequently, a watermark embedder maps the encoded watermark segments to different vertices under the control of an embedding key and an HMAC (hash-based message authentication code) function. After that, the polar angle of the vertex is slightly adjusted to embed a watermark. Since the decryption operation does not affect the embedded watermark, the watermark can be extracted both in the plaintext and encrypted domain. Experimental results and analysis show that the proposed scheme can achieve good invisibility and reversibility. It can effectively resist normal operations such as rotation, scaling, translation (RST) and entity reordering, and it has good robustness against malicious attacks such as vertices/entities addition, deletion and modification.

Open Sensor Manager for IIoT

Data collection in an industrial environment enables several benefits: processes and machinery can be monitored; the performance can be optimized; and the machinery can be proactively maintained. To collect data from machines or production lines, numerous sensors are required, which necessitates a management system. The management of constrained IoT devices such as sensor nodes is extensively studied. However, the previous studies focused only on the remote software updating or configuration of sensor nodes. This paper presents a holistic Open Sensor Manager (OSEMA), which addresses also generating software for different sensor models based on the configuration. In addition, it offers a user-friendly web interface, as well as a REST API (Representational State Transfer Application Programming Interface) for the management. The manager is built with the Django web framework, and sensor nodes rely on ESP32-based microcontrollers. OSEMA enables secure remote software updates of sensor nodes via encryption and hash-based message authentication code. The collected data can be transmitted using the Hypertext Transfer Protocol (HTTP) and Message Queuing Telemetry Transport (MQTT). The use of OSEMA is demonstrated in an industrial domain with applications estimating the usage roughness of an overhead crane and tracking its location. OSEMA enables retrofitting different sensors to existing machinery and processes, allowing additional data collection.

Ed-PUF: Event-Driven Physical Unclonable Function for Camera Authentication in Reactive Monitoring System

As surveillance footage plays an increasingly significant role in law enforcement, it is imperative to ensure the integrity of recorded video data and the authenticity of its originator, and instill situation awareness into these monitoring systems with a fidelity record of the incidents. Unfortunately, existing frame-based networked surveillance systems could only partially fulfill these requirements. The emerging Dynamic Vision Sensor (DVS) sheds new light on solving this problem with its completely different sensor design, i.e., DVS responds only to temporal intensity change and records only sparse asynchronous address-events with precise timing information. Motivated by the reduced data size of activities and the prevention of privacy intrusion of subjects under surveillance as well as other appealing attributes, this work introduces the first event-driven physical unclonable function (Ed-PUF) system to fill the forensic gap of simultaneously authenticating the event data integrity and source camera identity for reactive monitoring by DVS camera. New DVS sensor architecture is proposed with negligible modifications made to the original DVS pixel. The Ed-PUF response bit can only be triggered by and uniquely dependent on the asynchronous addressed event without being interfered by the simultaneous firing of other address events. Address event streams are securely transmitted with an event package tag created by a keyed hash-based message authentication code with the key being the Ed-PUF response. A secure protocol to authenticate the identity of DVS camera and the integrity of address events transmitted through cellular network is also proposed. A camera lock is embedded to protect against severing and splicing the inter-chip connectivity within the camera for raw PUF responses. The proposed system is evaluated using raw PUF data obtained by post-layout Monte Carlo simulation in UMC 180nm technology and real event stream captured by a DVS camera. The proposed Ed-PUF has been demonstrated to have excellent uniqueness, randomness and reliability. Collision test is also conducted to show that the quality of DVS imaging is not compromised. Besides keeping the hardware/power/timing overheads low, the proposed scheme is also analyzed to be resilient against multiple attack scenarios.

High-Throughput of SHA-256 Hash Function with Unfolding Transformation

Hash Function in cryptography algorithms is used to encrypt the message by giving the appropriate output based on the structure of the hash function itself. This algorithm is important for security applications such as Keyed-Hash Message Authentication Code (HMAC), digital signature, and others. There are different types of hash functions such as MD5, SHA-1, RIPEMD-160, SHA-256, SHA-224, SHA-384, SHA-512, and others. In this paper, the unfolding transformation method was proposed to improve the throughput of the SHA-256 hash function. Three types of SHA-256 hash function were designed namely SHA-256 design, SHA-256 design inner pipelining with unfolding factor 2, and SHA-256 design inner pipelining with unfolding factor 4. The designs were written in Verilog code and the output simulations were verified using ModelSim. The simulation results showed that the proposed SHA-256 inner pipelining unfolding with factor 4 provided the highest throughput which is 4196.30 Mbps, and factor 2 was superior in terms of maximum frequency and was better than the conventional SHA-256 design. Type of Paper: other. Keywords: Cryptography algorithm; FPGA; SHA-256 Hash Function; Unfolding transformation, Verilog