Hash Message Authentication Code Research Articles

Enhancing security mechanisms for robot-fog computing networks

<p>The evolution from conventional Internet usage to the internet of things (IoT) is reshaping communication norms significantly. Cloud computing, while prevalent, faces challenges like limited capacity, high latency, and network failures, especially when handling connected objects, leading to the emergence of fog computing as a more suitable approach for IoT. However, establishing secure connections among heterogeneous IoT entities is complex due to resource disparities and the unsuitability of existing security protocols for resource-constrained devices. This article explores fog computing's architecture, drawing comparisons with cloud computing while emphasizing its significance within the realm of IoT. Moreover, it delves into the practical application of fog computing within the context of the robot teacher project. Subsequently, our exploration introduces an advanced mutual authentication protocol, centered around hashed message authentication code (HMAC), aimed at enhancing the security infrastructure between the robot and the fog computing server.</p>

Enhancing the security of quality of service-oriented distributed routing protocol for hybrid wireless network

Merging the wireless infrastructure network with the wireless mobile ad-hoc networks constitutes hybrid wireless networks (HWNs). Quality of service (QoS) demands are available with the help of HWNs. However, these networks are subjected to many types of attacks because of their open wireless medium. To enhance the security of HWNs, it is necessary to provide secure routing protocols. Several routing protocols have been proposed for HWNs, one of them is the quality of service-oriented distributed (QOD) routing protocol. In this paper, two security mechanisms have been proposed for the QOD protocol. The first mechanism is used to protect transmitted data in the network using asymmetric and symmetric cryptography. The second mechanism has been proposed to enhance the security of the QOD routing protocol using keyed hash message authentication code (HMAC). The second security mechanism assumed that there is a secret key shared between each pair of neighbor nodes. Also, asymmetric cryptography is used to exchange the secret key. The secret key is used to include the message authentication code (MAC) for each message exchanged between the neighbor nodes. A network simulator NS2 is used to simulate our proposed schemes.

Secured Technique to Detect and Avoid Malicious Nodes in Internet of Things

Objectives: To detect rank attacks during topology establishment and updated the RPL Destination Oriented Directed Acyclic Graph (DODAG) formation algorithm. The algorithm’s distributed module runs across all participating nodes, while the centralized module runs in the sink. Methods: The integrity and authenticity of control messages transmitted among two nodes and the sink are verified using a lightweight Hashed Message Authentication Code - Light-weight One-way Cryptographic Hash Algorithm (HMAC-LOCHA). The Secured Technique to Detect and Avoid Malicious Nodes (STDAMN) technique is proposed to overcome the rank attack of the nodes. Findings: The proposed scheme STDAMN outperforms the LEADER and SBIDS schemes when considering 50% malicious nodes, the accuracy rate of STDAMN is 3% higher than LEADER and 17% higher than SBIDS in Security mode whereas it is 4% and 14% higher in non-security mode respectively in the decreased rank attack. Again considering 50% malicious nodes, the accuracy rate of STDAMN is 2% higher than LEADER and 13% higher than SBIDS in with- Security mode whereas it is 2.2% and 16.1% higher in without-security mode respectively in the increased rank attack. Also indeed, the false positive rate for STDAMN is lower by 72.5% and 72%, 15.3% and 21.2% whereas the false negative rate for STDAMN is lower by 77.2% and 62.1%, 32.5%, and 39.5% on average for with-security and without-security respectively than LEADER and SBIDS in the decreased rank attack. Novelty: This paper presents a rank attack detection approach for non-storing mode RPL used in IoT to cope with both increased and decreased rank attacks to address this issue. The performance of the suggested technique is assessed both conceptually and through simulation using the Contiki-based Cooja simulator. The proposed technique surpasses state-of-the-art rank attack detection techniques in terms of detection accuracy and false positive/negative rate while maintaining acceptable network performance, according to simulation results. Keywords: Security; RPL; Rank attack; HMAC; Malicious Node; DODAG

An Efficient Key Management and Multi-Layered Security Framework for SCADA Systems

Supervisory Control and Data Acquisition (SCADA) networks play a vital role in industrial control systems. Industrial organizations perform operations remotely through SCADA systems to accelerate their processes. However, this enhancement in network capabilities comes at the cost of exposing the systems to cyber-attacks. Consequently, effective solutions are required to secure industrial infrastructure as cyber-attacks on SCADA systems can have severe financial and/or safety implications. Moreover, SCADA field devices are equipped with microcontrollers for processing information and have limited computational power and resources. This makes the deployment of sophisticated security features challenging. As a result, effective lightweight cryptography solutions are needed to strengthen the security of industrial plants against cyber threats. In this paper, we have proposed a multi-layered framework by combining both symmetric and asymmetric key cryptographic techniques to ensure high availability, integrity, confidentiality, authentication and scalability. Further, an efficient session key management mechanism is proposed by merging random number generation with a hashed message authentication code. Moreover, for each session, we have introduced three symmetric key cryptography techniques based on the concept of Vernam cipher and a pre-shared session key, namely, random prime number generator, prime counter, and hash chaining. The proposed scheme satisfies the SCADA requirements of real-time request response mechanism by supporting broadcast, multicast, and point to point communication.

Centralized Threshold Key Generation Protocol Based on Shamir Secret Sharing and HMAC Authentication.

Many group key management protocols have been proposed to manage key generation and distribution of vehicular communication. However, most of them suffer from high communication and computation costs due to the complex elliptic curve and bilinear pairing cryptography. Many shared secret protocols have been proposed using polynomial evaluation and interpolation to solve the previous complexity issues. This paper proposes an efficient centralized threshold shared secret protocol based on the Shamir secret sharing technique and supporting key authentication using Hashed Message Authentication Code Protocol (HMAC). The proposed protocol allows the group manager to generate a master secret key for a group of vehicles and split this key into secret shares; each share is distributed securely to every group member. -of- vehicles must recombine their secret shares and recover the original secret key. The acceptance of the recovered key is based on the correctness of the received HMAC signature to verify the group manager’s identity and ensure the key confidentiality. The proposed protocol is unconditionally secure and unbreakable using infinite computing power as , or more than secret shares are required to reconstruct the key. In contrast, attackers with secret shares cannot leak any information about the original secret key. Moreover, the proposed protocol reduces the computation cost due to using polynomial evaluation to generate the secret key and interpolation to recover the secret key, which is very simple and lightweight compared with the discrete logarithm computation cost in previous protocols. In addition, utilizing a trusted group manager that broadcasts some public information is important for the registered vehicles to reconstruct the key and eliminate secure channels between vehicles. The proposed protocol reduces the communication cost in terms of transmitted messages between vehicles from messages in previous shared secret protocols to zero messages. Moreover, it reduces the received messages at vehicles from to two messages. At the same time, it allows vehicles to store only a single secret share compared with other shared secret protocols that require storage of secret shares. The proposed protocol security level outperforms the other shared secret protocols security, as it supports key authentication and confidentiality using HMAC that prevents attackers from compromising or faking the key.

New Efficient Authentication Model for Vehicular Ad Hoc Networks

In this article, we present a security model architecture for communications, it offers a lightweight authentication in real-time, decentralized, efficient, that can be applicated in real mode, the proposed model respects the security requirements authenticity, anonymity, integrity, and non-repudiation. In our scheme, we firstly initialize the authentication between vehicle and RSU, the vehicle has an Access Token and key to join the group, then we use a hash message authentication code (HMAC) to avoid time consuming CRL checking. Finally, the vehicle can be using the generated Access Token for communication. The performances show that our model is more efficient in terms of authentication speed and consuming resources, it results a real time authentication.

Digital signatures over HMAC entangled chains

In this work we present a new digital signature method based on hash chains and the hash message authentication code (HMAC). Unlike Blockchain technology, our approach establishes that the database of transactions is distributed among users, so each one maintains a personal record called Singlechain. The Lizama HMAC protocol defines a double authentication mechanism that verifies the origin and destination of the signature. Our analysis shows that the system generates a block size of around 6 kilobytes to perform double authentication using SHA-256, making it a promising alternative for digital signature using public key infrastructure. Since the method is based on the mathematical properties of hash functions and hash chains, the security of the method can be properly evaluated and thereby achieve a robust method of digital signatures in the quantum era.

Toward Trusted and Secure Communication Among Multiple Internal Modules in CAV

By equipping various sensors and analyzing sensed data, vehicles can perform automatic driving; these vehicles are known as connected and autonomous vehicles (CAVs). In CAVs, tampered data will result in incorrect driving decisions. Hence, secure data transmission should be ensured to enable correct life-critical decisions. Untrusted resource-constrained modules allow attackers to obtain private data from CAVs, such as the key. Benefitting from trusted computing, the proposed scheme can verify the trusted status of internal modules and achieve secure data transmission by adopting the remote attestation and hash message authentication code. The scheme is proven to be secure in the random oracle model under the computational Diffie–Hellman problem. Furthermore, we perform experiments and evaluate the performance using Intel Software Guard eXtensions, which provide part of the trusted computing function. The experimental results show that the scheme could be efficient and suitable for CAVs.

Efficient Implementation of a Crypto Library Using Web Assembly

We implement a cryptographic library using Web Assembly. Web Assembly is expected to show better performance than Javascript. The proposed library provides comprehensive algorithm sets including revised CHAM, Hash Message Authentication Code (HMAC), and ECDH using the NIST P-256 curve to provide confidentiality, data authentication, and key agreement functions. To optimize the performance of revised CHAM in the proposed library, we apply an existing method that is a four-round combining method and additionally propose the precomputation method to CHAM-64/128. The proposed revised CHAM showed an approximate 2.06 times (CHAM-64/128), approximate 2.13 times (CHAM-128/128), and approximate 2.63 times (CHAM-128/256) performance improvement in Web Assembly compared to JavaScript. In addition, CHAM-64/128 applying the precomputation method showed an improved performance by approximately 1.2 times more than the existing CHAM-64/128. For the ECDH using P-256 curve, the naive implementation of ECDH is vulnerable to side-channel attacks (SCA), e.g., simple power analysis (SPA), and timing analysis (TA). Thus, we apply an SPA and TA resistant scalar multiplication method, which is a core operation in ECDH. We present atomic block-based scalar multiplication by revising the previous work. Existing atomic blocks show a performance overhead of 55%, 23%, and 37%, but atomic blocks proposed to use only P=(X,Y,Z) show 18%, 6%, and 11% performance overhead. The proposed Web Assembly-based crypto library provides enhanced performance and resistance against SCA thus, it can be used in various web-based applications.

Ensuring Safety and Security in CAN-Based Automotive Embedded Systems: A Combination of Design Optimization and Secure Communication

As automotive embedded systems comprised of electronic control units (ECUs) connected via a controller area network (CAN) have continued to develop, the volume of information these systems are required to handle has also rapidly increased. Cyber attacks targeting vulnerable points of automotive embedded systems in particular are on the rise to hinder normal operation of a vehicle. However, adding security mechanisms to defend against attacks cannot neglect timing requirements in terms of vehicle safety. This is because it may lead to a violation of automobile safety. In short, both sides of this issue must be addressed from the outset of the system design stage to provide optimal security and safety. As a response to this pressing issue, we propose a novel and efficient scheme. The design optimization during the system design phase not only ensures all the real-time applications are executed within their deadline but also reduces the number of transmitted messages over the CAN bus. After optimization, we apply a hash message authentication code (HMAC) to specific messages, providing secure communication between ECUs and protecting against cyber attacks. Security analysis and experimental results prove that the proposed scheme can counter attacks on the CAN bus while meeting timing requirements. Therefore, our proposed scheme is effective in satisfying improvement of both safety and security.

ShieldNVM

Data encryption and authentication are essential for secure non-volatile memory (NVM). However, the introduced security metadata needs to be atomically written back to NVM along with data, so as to provide crash consistency, which unfortunately incurs high overhead. To support fine-grained data protection and fast recovery for a secure NVM system without compromising the performance, we propose ShieldNVM. It first proposes an epoch-based mechanism to aggressively cache the security metadata in the metadata cache while retaining the consistency of them in NVM. Deferred spreading is also introduced to reduce the calculating overhead for data authentication. Leveraging the ability of data hash message authentication codes, we can always recover the consistent but old security metadata to its newest version. By recording a limited number of dirty addresses of the security metadata, ShieldNVM achieves fast recovering the secure NVM system after crashes. Compared to Osiris, a state-of-the-art secure NVM, ShieldNVM reduces system runtime by 39.1% and hash message authentication code computation overhead by 80.5% on average over NVM workloads. When system crashes happen, ShieldNVM’s recovery time is orders of magnitude faster than Osiris. In addition, ShieldNVM also recovers faster than AGIT, which is the Osiris-based state-of-the-art mechanism addressing the recovery time of the secure NVM system. Once the recovery process fails, instead of dropping all data due to malicious attacks, ShieldNVM is able to detect and locate the area of the tampered data with the help of the tracked addresses.

Trust Management Scheme Based on Hybrid Cryptography for Secure Communications in VANETs

Vehicular Ad hoc Networks (VANETs) are used to improve traffic management and reduce the number of road accidents by providing safety applications. However, VANETs are susceptible to a number of security attacks from malicious entities. To secure the network against these attacks, most of the researchers have proposed various security schemes based on cryptography and trust management. While both cryptography and trust management are effective to some extent, each scheme has some flaw to fully secure the network. In this paper, we propose a trust management scheme based on hybrid cryptography (TMHC) to secure VANET to a larger extent. As authentication is an integral part of trust establishment and secure communications between vehicles, the proposed TMHC integrates hybrid cryptography based authentication for efficient and robust trust management scheme. The hybrid cryptography includes, asymmetric identity-based (ID-based) digital signature and symmetric hash message authentication code (HMAC). The trusted road-side unit (RSU) evaluates trust-value, whereas, agent trusted authority (ATA) computes trust-value of vehicle based on its reward-points. The results are gained with extensive simulations to validate the proposed scheme. The results show that the proposed scheme meets security requirements and performs effectively. The communication overhead, computation overhead, storage overhead, and end-to-end delay of the proposed scheme were improved by 6% to 15%, 9% to 23%, 7% to 19%, and 4% to 15.85%, respectively, as compared to existing schemes.

Fast-track message authentication protocol for DSRC using HMAC and group keys

The exchange of information between vehicle to vehicle and vehicle to infrastructure in vehicular ad hoc networks (VANET) should be secured to provide an intelligent transport system. VANET uses certificate revocation lists (CRL) and public key infrastructures (PKI) for its security. In any PKI algorithms validity of the messages received from the sender is executed by checking the senders certificate in current CRL and verify the authenticity of the signature and certificate of the sender. Checking the CRL and verifying the authenticity is time-consuming and affects system performance drastically. This paper offers an accelerated and secure authentication method that utilizes a hash message authentication code (HMAC) in combination with secret keys for the revocation checking process. By using HMAC and enhancing the CRL checking procedure, the algorithm provides improved performance of the system parameters like authentication delay, end-to-end delay, and packet delivery ratio. Also, this algorithm reduces the delay involved in vehicle authentication. This novel algorithm uses the random distribution of keys that enables the authenticated on-board unit to securely share and update a secret key. An authentication delay of 77.29 μs, end-to-end delay of 13.56 ms and packet delivery ratio of 81.2% is achieved.

RETRACTED ARTICLE: Advanced resilient data consigning mechanism for mobile adhoc networks

Routing in network is a classic issue to be solved. To route the data among the nodes without any interruptions and without getting yield in any kind of malicious attack is a tedious task. Though there exist many routing techniques which were near success in the past some part of the problems are always left unsolved. Trust-based routing techniques and the bio-inspired path is connecting techniques area embedded together to solve this. The security of the proposed technique is given a big significance, which takes care of the rest of the key points. Initially, when a node tries to enter into the network which was already secured and confined by trustable nodes, we provide a two-way security check both from the new node and from the host node. This is made possible by applying digital signature algorithm, hash message authentication code, and message-digest algorithms for signature generations, hash value generation, and its corresponding encrypt and decrypt procedure. Elliptic curve Diffie–Hellman algorithm is used for certificate verification, after which the node is provided with the broadcast key. In the case of routing, ant colony optimization is applied to detect the best path for routing from root to destiny, and this path is again verified by trust frameworks and certain calculations. This highly secured verification and authentication process make the proposed advanced resilient data consigning mechanism (ARDC) stand out from the existing routing mechanisms. The proposed ARDC mechanism is analyzed against various network frameworks as throughput, packet loss, overhead, delivery ratio, delivery latency, and hop count and path reliability to prove its effectiveness. Further, the routing capability is also analyzed by comparing it against traditional DSR, destination-sequenced distance-vector and open shortest path first protocols.

Secure Group based Routing and Flawless Trust Formulation in MANET using Unsupervised Machine Learning Approach for IoT Applications

INTRODUCTION: Mobile Adhoc Network (MANET) is integrated with Internet of Things (IoT) in many application cases due to its flexibility and scalability. The dynamic nature of MANET introduces some security threats in IoT environment. In those threats, Blackhole attack and Grayhole attack are severe routing attacks that disrupts routing algorithm to crack transmission in the entire network. OBJECTIVES: Many security mechanisms are introduced in MANET based on trust computation schemes. However, computation of inaccurate trust value degrades the performance of mitigation schemes. Thus the major objective of this work is to design a novel security mechanism to protect the MANET-IoT from different adversaries. METHODS: in this paper we propose a novel group based routing algorithm with recommendation filtering supported by security monitors (SMs). Unsupervised machine learning algorithm is adapted for the purpose of recommendation filtering in the network. Initially the entire network is grouped by Secure Certificate based Group Formation (SCGF) algorithm. In each group, Recommendation Filtering by K-means algorithm (RF-K means) algorithm is employed to perform trust computation. For secure and optimal route selection, hybrid optimization algorithm that combines Genetic Algorithm and Fire Fly Algorithm (GA-FFA) is proposed. Data transmission is protected by novel Hash Message Authentication Code with Advanced Encryption Standard (HMAC-AES) algorithm in which hash function is integrated with cryptography function. RESULTS: The proposed work is validated in network simulator-3 environment and the obtained results show better performance in terms of packet delivery ratio (96.3%), throughput (135kbps), delay (3.26ms), detection rate (99%), and energy consumption (8.5%). CONCLUSION: The MANET-IoT network is secured by group formation and trust filtering approaches. Further, involvement of cryptography function ensures data security whereas hash function ensures data integrity.

Man in the Middle Attack Prevention for Edge-Fog, Mutual Authentication Scheme

Fog computing is considered emerging technology nowadays. Due to proximity to the end user, fog computing provides a reliable transmission with low latency. In this paper, we have proposed an improved mutual authentication security scheme based on advanced encryption standard AES and hashed message authentication code HMAC in fog computing. Our scheme provides mutual authentication between edge devices and fog server in edge fog cloud computing environment. Further, the scheme has the resistance to man in the middle attack in the fog computing environment. Detailed security analyses are summarized.

S-GoSV: Framework for Generating Secure IEC 61850 GOOSE and Sample Value Messages

Standardized communication plays an important role in substation automation system (SAS). IEC 61850 is a de-facto standard in SAS. It facilitates smooth communication between different devices located in the substation by achieving interoperability. Generic Object-Oriented Substation Event (GOOSE) and Sample Value (SV) messages developed according to IEC 61850 enable efficient monitoring and operation control of SAS. IEC 61850 is very popular due to its flexible and robust modeling. As the number of critical infrastructures that employed IEC 61850 increases, it is important to study cybersecurity aspects as well. To this end, this paper develops a software framework, S-GoSV (Secure GOOSE and SV), that generates custom GOOSE and Sample Value messages. Furthermore, security features are added to protect them from different security attacks within a substation. IEC 62351-6 specifies digital signatures to achieve node authentication and messages integrity. Therefore, S-GoSV implements RSASSA-PKCS1-v1_5 digital signature algorithm based on RFC 2313. Performance studies show that digital signature algorithms based on RSA signing and verification take long times and do not conform to timing requirements stipulated by IEC 61850 for power system communication. To address this, Message Authentication Code (MAC) based digital signature algorithm, Keyed Hash-Message Authentication Code- Secure Hash Algorithm (HMAC-SHA256), is additionally implemented in S-GoSV framework for securing GOOSE messages.

Mutual Authentication Security Scheme in Fog Computing

Fog paradigm is a new and emerging technology that extends the services of cloud computing near to edge network. This paradigm aims to provide rich resources near to edge devices and remove the deficiencies of cloud computing for example, latency. However, this paradigm is distributed in nature and does not guarantee the trustworthiness and good behavior of edge devices. Thus, authentication and key exchange are significant challenges in front of this new paradigm. The researchers have worked on different authentication and key exchange protocols. Recently Maged Hamada Ibrahim proposed an authentication scheme that permits fog user to authenticate mutually with fog server under the authority of a cloud service provider. Alongside, Amor et al proposed an anonymous mutual authentication scheme. In this scheme, the fog user and fog server authenticate each other without disclosing the user real identity, using public-key cryptosystem. But, we demonstrated that Maged Hamada Ibrahim does not preserve the user anonymity, hence, it was exposed to man in the middle attack. Amor et al. scheme is computationally complex as it is using public key cryptosystem that has low throughputs and requires large memory, which not suitable to employ for fog computing that connecting internet of things with small memory, and requires high throughputs. Therefore, to overcome the above-aforementioned security problems internet of things constraints, an improved mutual authentication security scheme based on advanced encryption standard and hashed message authentication code in fog computing has been proposed. Our scheme provides mutual authentication between internet of things devices and fog servers. We proved that the proposed improved scheme provides secure mutual authentication using the widely accepted Burrows Abdi Needham logic. In this study, the properties i.e. performance, security, and functionality are analyzed and compared with existing and related mutual authentication schemes. Our scheme provides better in security, functionalities, communication and computation cost as compared with the existing schemes.

Decentralized and Scalable Privacy-Preserving Authentication Scheme in VANETs

Existing authentication schemes are based on either symmetric or asymmetric cryptography such as public-key infrastructure (PKI). These PKI-based authentication schemes are highly recommended to address the security challenges in VANETs. However, they have certain shortcomings such as: 1) lack of privacy-preservation due to revealing of vehicle identity and broadcasting of safety-message and 2) lengthy certificates leading to communication and computation overheads. The symmetric cryptography based schemes on the other hand are faster because they use a single secret key and are very simple; however, it does not ensure nonrepudiation. In this paper, we present a decentralized and scalable privacy-preserving authentication (DSPA) scheme for secure vehicular ad hoc networks. The proposed scheme employs a hybrid cryptography. In DSPA, the asymmetric identity-based (ID-based) cryptography and the symmetric hash message authentication code (HMAC) based authentication are adopted during vehicle to infrastructure and vehicle to vehicle communications, respectively. Extensive simulations are conducted to validate the proposed DSPA scheme by comparing the existing works based on PKI, ID-based, group signature, batch verification, and HMAC. The performance analysis showed that DSPA is more efficient, decentralized, scalable, and also a privacy-preserving secured scheme than the existing authentication schemes.

A Lightweight Protocol for Secure Video Streaming.

The Internet of Things (IoT) introduces many new challenges which cannot be solved using traditional cloud and host computing models. A new architecture known as fog computing is emerging to address these technological and security gaps. Traditional security paradigms focused on providing perimeter-based protections and client/server point to point protocols (e.g., Transport Layer Security (TLS)) are no longer the best choices for addressing new security challenges in fog computing end devices, where energy and computational resources are limited. In this paper, we present a lightweight secure streaming protocol for the fog computing “Fog Node-End Device” layer. This protocol is lightweight, connectionless, supports broadcast and multicast operations, and is able to provide data source authentication, data integrity, and confidentiality. The protocol is based on simple and energy efficient cryptographic methods, such as Hash Message Authentication Codes (HMAC) and symmetrical ciphers, and uses modified User Datagram Protocol (UDP) packets to embed authentication data into streaming data. Data redundancy could be added to improve reliability in lossy networks. The experimental results summarized in this paper confirm that the proposed method efficiently uses energy and computational resources and at the same time provides security properties on par with the Datagram TLS (DTLS) standard.