Impersonation Attack Research Articles

AN IMPROVED AND EFFICIENT RSA-BASED AUTHENTICATION SCHEME FOR HEALTHCARE SYSTEM

Owing to the fast advancements of wireless communication, the telehealthcare platform makes it possible for patients to access healthcare services online. However, creating a secure and efficient authentication scheme for healthcare systems still presents a challenge. Several solutions have been introduced, but the majority are shortly found to be unable to meet some essential security standards. In this paper, we first revisit Dharminder et al.'s scheme, and prove its failure to provide mutual authentication, and pacient’s untraceability, and its vulnerability to impersonation attacks. Furthermore, we suggest an improved RSA-based authentication scheme to mitigate the deficiencies observed in Dharminder et al.'s schema. The proposed scheme can provide mutual authentication, patients’ anonymity and untraceability, and resist various types of attacks. Extensive evaluation on AVISPA proves the safeness of the proposed scheme against both passive and active attacks. Additionally, the proposed scheme is computationally and communicationally more efficient in comparison to existing schemes.

A new authentication scheme for dynamic charging system of electric vehicles in fog environment

AbstractThe dynamic charging system of electric vehicles has great potential for development. Electric vehicles initiate charging requests, and charging stations charge authorized electric vehicles. Fog computing improves the efficiency of request processing. However, open channels can be vulnerable to various attacks by a malicious adversary. Mutual authentication schemes allow users and charging stations to confirm each other. Therefore, numerous authentication and key agreement schemes have been proposed. In 2021, Babu et al. proposed an authentication scheme based on fog servers. Unfortunately, we found that their scheme can not resist FS impersonation attack and replay attack. Hence, we propose an authentication scheme between electric vehicles and fog servers to resolve the security weakness. Our scheme uses lightweight hash functions and XOR operations, which is more suitable for resource‐constrained electric vehicles. We proved our scheme can achieve mutual authentication by using BAN logic, and analyzed that our scheme can resist impersonation, replay, and known session key attacks, ensuring anonymity and untraceability. We finally compare computation cost and communication cost of our scheme with the existing schemes. The result shows that our scheme performs better than others overall. Therefore, our scheme is secure and suitable for dynamic charging systems.

A Pairing-free Provable Secure and Efficient Identity-based Identification Scheme with Anonymity

In this paper, we propose a Blind Identity-Based Identification (Blind IBI) scheme based on the Guillou-Quisquater (GQ) scheme. Our proposed scheme combines the benefits of traditional Identity-Based Identification (IBI) schemes that can authenticate a user's identity without relying on a trusted third party with the Blind Signature (BS) scheme that provides anonymity. As a result, the proposed scheme assures absolute user privacy during the authentication process. It does not rely on a third party, yet the verifier can still be assured of the user's identity without the user actually revealing it. In our work, we show that the proposed scheme is provably secure under the random oracle model, with the assumption that the one-more-RSA-inversion problem is difficult. Furthermore, we demonstrate that the proposed scheme is secure against passive, active, and concurrent impersonation attacks. In conclusion, the proposed scheme is able to achieve the desired blindness property without compromising the security of the GQ-IBI scheme it is based upon.

Provably Secure Lightweight Mutual Authentication and Key Agreement Scheme for Cloud-Based IoT Environments.

A paradigm that combines cloud computing and the Internet of Things (IoT) allows for more impressive services to be provided to users while addressing storage and computational resource issues in the IoT environments. This cloud-based IoT environment has been used in various industries, including public services, for quite some time, and has been researched in academia. However, various security issues can arise during the communication between IoT devices and cloud servers, because communication between devices occurs in open channels. Moreover, issues such as theft of a user's IoT device or extraction of key parameters from the user's device in a remote location can arise. Researchers interested in these issues have proposed lightweight mutual authentication key agreement protocols that are safe and suitable for IoT environments. Recently, a lightweight authentication scheme between IoT devices and cloud servers has been presented. However, we found out their scheme had various security vulnerabilities, vulnerable to insider, impersonation, verification table leakage, and privileged insider attacks, and did not provide users with untraceability. To address these flaws, we propose a provably secure lightweight authentication scheme. The proposed scheme uses the user's biometric information and the cloud server's secret key to prevent the exposure of key parameters. Additionally, it ensures low computational costs for providing users with real-time and fast services using only exclusive OR operations and hash functions in the IoT environments. To analyze the safety of the proposed scheme, we use informal security analysis, Burrows-Abadi-Needham (BAN) logic and a Real-or-Random (RoR) model. The analysis results confirm that our scheme is secure against insider attacks, impersonation attacks, stolen verifier attacks, and so on; furthermore, it provides additional security elements. Simultaneously, it has been verified to possess enhanced communication costs, and total bit size has been shortened to 3776 bits, which is improved by almost 6% compared to Wu et al.'s scheme. Therefore, we demonstrate that the proposed scheme is suitable for cloud-based IoT environments.

Designing access control security protocol for Industry 4.0 using Blockchain‐as‐a‐Service

AbstractIndustry 4.0 is a revolution of the operations in the industrial manufacturing for increased productivity, trade and commerce. It is heavily reliant on the automation of the processes and equipment along with complex interconnectivity and insightful analysis using machine learning. The interconnectivity of the manufacturing devices from various industrial sites brings with it several security issues related to communication. This article focuses on solving the security issue of access control between such devices and enable seamless secure communication for the proper functioning of the industry. An access control scheme has been proposed that achieves the necessary security features of anonymity, traceability, and forward secrecy. It is also shown that the proposed scheme takes less communication and computational costs, and is strongly resilient against various attacks such as impersonation attack, replay attack, and denial‐of‐service attack as compared to other relevant schemes.

Designing secure PUF-based authentication protocols for constrained environments

Physical Unclonable Functions (PUFs) are widely used in cryptographic authentication and key-agreement protocols due to their unique physical properties. This article presents a comprehensive cryptanalysis of two recently developed authentication protocols, namely PLAKE and EV-PUF, both relying on PUFs. Our analysis reveals significant vulnerabilities in these protocols, including susceptibility to impersonation and key leakage attacks, which pose serious threats to the security of the underlying systems. In the case of PLAKE, we propose an attack that can extract the shared secret key with negligible complexity by eavesdropping on consecutive protocol sessions. Similarly, we demonstrate an efficient attack against EV-PUF that enables the determination of the shared key between specific entities. Furthermore, we highlight the potential for a single compromised client in the EV-PUF protocol to compromise the security of the entire network, leaving it vulnerable to pandemic attacks. These findings underscore the critical importance of careful design and rigorous evaluation when developing PUF-based authentication protocols. To address the identified vulnerabilities, we present an improved PUF-based authentication protocol that ensures robust security against all the attacks described in the context of PLAKE and EV-PUF. Through this research, we contribute to the field by exposing vulnerabilities in existing PUF-based authentication protocols and offering an improved protocol that enhances security and safeguards against various attack vectors. This work serves as a valuable reference for researchers and practitioners involved in the design and implementation of secure authentication schemes for IoT systems and dynamic charging systems for electric vehicles.

Multiple attributes based physical layer authentication through propagation scenario identification in the internet of vehicles

The Internet of Vehicles (IoV) systems improve road safety through coordination among vehicles, but they are vulnerable to impersonation attack due to their broadcast communication nature. Existing cryptographic authentication approaches are complex for resource-limited IoV devices, which motivated the development of less complex Physical Layer Authentication (PLA) approaches. However, the existing PLA approaches use all channel attributes for all communication scenarios and do not update reference attributes used to authenticate newly observed attributes during authentication, which leads to poor performance when the attributes become insensitive to communication scenarios. To address these limitations, we propose a multiple attributes-based PLA scheme that flexibly selects effective attributes according to current communication scenarios for improved authentication. First, the historical channel attributes including the ricean K-Factor (KF), the Delay Spread (DS), and the Azimuth Spread of Arrival (ASA) together with the communication scenarios (i.e., Line-of-Sight (LoS) and Non-Line-of-Sight (NLoS)) information of transmitters are used to establish a relationship and train a Long Short-Term Memory (LSTM) neural network to identify current communication scenarios. The softmax function is then used to evaluate the scenario identification performance of each attribute and the attributes with maximum softmax values are dynamically selected for authentication. Second, to track and update the reference attributes, we use the historical attributes together with the past location and communication scenarios information of transmitters and train our model to predict future attributes for authentication. Finally, we use the Euclidean distance to measure the similarity between the selected and the predicted attributes to authenticate the transmitters. We validate the effectiveness of our approach and compare its performance with the existing methods through extensive simulations using realistic radio channel characteristics generated from the Quasi Deterministic Radio channel Generator (QuaDRiGa) platform. The results of the evaluation show that our system improves authentication performance and its false alarm and miss detection are respectively 19.19% and 52% lower than the existing approaches.

Cryptanalysis of Secure ECC-Based Three Factor Mutual Authentication Protocol for Telecare Medical Information System

Telecare Medical Information System (TMIS) is gaining importance in the present COVID-19 crisis. TMIS as a technology, offers patients a range of remote medical services, incorporated into Wireless Body Area Network (WBAN). The patient’s medical report is confidentially transmitted over an open channel in TMIS environments. An attacker may attempt to compromise the security, such as forgery, replay, and impersonation attacks. To ensure secure communication, various authentication solutions have been introduced for TMIS. Biometrics and Elliptic Curve Cryptography-based mutual authentication protocol was recommended by Sahoo et al. in 2020 and is proved to have some loopholes in the protocol. We discovered, however, Sahoo et al. method is unable to prevent privileged insider attacks and insider attacks along with patient anonymity. Jongseok Ryu et al. recommended a ECC based three-factor mutual authentication protocol and ensures patient’s confidentiality for TMIS with proof of informal analysis. They have also performed formal security studies utilizing the Automated Validation of Internet Security Protocols and Applications (AVISPA), the Burrows-Abadi-Needham (BAN) logic and Real-Or-Random (ROR) model. However, we have reviewed the Jongseok Ryu et al.’s proposal. Based on his attacker model, we have examined that this scheme is unsafe against Message Substitution Attacks, Man-in-the-Middle attacks, Session Key Disclosure attacks, Privileged Insider attacks, and Stolen verifier attacks. we suggest a technique to be safe from the above security threats.

Analysis and Improvement of a Privacy-Preserving Authentication Scheme for Telecare Medical Information System Environment

Telecare Medical Information System (TMIS) can provide various telemedicine services to patients. However, information is communicated over an open channel. An attacker may intercept, replay, or modify this information. Therefore, many authentication schemes are proposed to provide secure communication for TMIS. Recently, Yu et al proposed a privacy-preserving authentication scheme in the Internet of Medical Things (IoMT)-enabled TMIS environments. They emphasize that their scheme is resistant to various attacks and ensures anonymity. Unfortunately, this paper demonstrates that Yu et al's scheme is vulnerable to impersonation attacks, replay attacks, and tracking attacks and cannot mutually authenticate. To overcome the shortcomings of Yu et al's scheme, we mainly improve the authentication and key agreement process and propose a corresponding improved scheme. We also compare the improved scheme with several existing authentication schemes in terms of security and computational efficiency.

On the security of a novel privacy‐preserving authentication scheme for V2G networks

AbstractVehicle‐to‐grid (V2G) network has a clear advantage in terms of economic advantages, it has attracted the interest of electric vehicle (EV) and power grid users. However, numerous security concerns limit its further progress. In existing V2G protocols a trusted third party independently generates the master key of the system, so if the adversary compromises the third party, then the system may become vulnerable to system master key leakage attack. Recently, Su et al. presented a privacy‐preserving mutual authentication protocol for V2G networks. Firstly, we crypt‐analysis Su et al.'s protocol and show that their protocol is vulnerable to several security attacks such as the reveal of the master secret key, impersonation attacks and the incorrect notion of EV's anonymity and traceability and does not meet the security features they claimed in their paper. Secondly, we verify that Su et al.'s protocol is unsafe against impersonation attacks, system key leakage, and electrical vehicle anonymity attack using the AVISPA tool.

Provably secure and lightweight three-factor authentication scheme for industrial medical CPS

Cyber-Physical System (CPS) is a multidimensional complex system that integrates computing, network, and physical environment, which is widely used to promote the upgrading of industrial production and technology. Recently, the application of industrial CPS in the medical field has attracted the attention of scholars and medical experts. Medical CPS can establish a perfect medical network to help doctors monitor patients’ conditions in real-time and make treatments. However, how to design a provably secure and lightweight authentication protocol for industrial medical CPS is a challenge. Very recently, Qi et al. proposed an authentication protocol for industrial medical CPS based on the chaotic map, the Artificial Intelligence (AI) biometric technique is used in the protocol to resist password guessing attack and smart card lost attack. However, we find that their protocol is still vulnerable to identity guessing attack, user impersonation attack, trace attack, desynchronization attack, and has no perfect forward secrecy. Therefore, we propose a security-enhanced and lightweight authentication protocol for industrial medical CPS. In the protocol, a dynamic temporary identity strategy is designed to protect anonymity and privacy, which enables the updating of temporary identities while resisting desynchronization attacks. The protocol is proved secure through formal security proof in random oracle model. Meanwhile, compared with the related protocols, our protocol is superior in security and cost to meet the lightweight requirements in medical scenarios.

A Framework for Securing Email Entrances and Mitigating Phishing Impersonation Attacks

Emails are used every day for communication, and many countries and organisations mostly use email for official communications. It is highly valued and recognised for confidential conversations and transactions in day-to-day business. The Often use of this channel and the quality of information it carries attracted cyber attackers to it. There are many existing techniques to mitigate attacks on email, however, the systems are more focused on email content and behaviour and not securing entrances to email boxes, composition, and settings. This work intends to protect users' email composition and settings to prevent attackers from using an account when it gets hacked or hijacked and stop them from setting forwarding on the victim's email account to a different account which automatically stops the user from receiving emails. A secure code is applied to the composition send button to curtail insider impersonation attack. Also, to secure open applications on public and private devices.

Zone-based stable and secure clustering technique for VANETs

Vehicular Ad-hoc Network (VANET) is a pivotal element of the Intelligent Transportation System (ITS) and has gained significant attention in both academia as well as in the industry. The driving experience has been improved with the deployment of VANETs in the transportation system. In this scenario, accurate real-time traffic information is required to be forwarded to the correlated vehicles using Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) communication. The V2V system is prone to the issue of communication overhead and security, whereas the V2I-based model for data dissemination faces the issue of scalability. In addition to this, wireless communication among vehicles is affected by potential attackers, that not only threaten the vehicle's security but also the commuter's life. An impersonation attack is considered the most common and dangerous attack in VANETs. In this paper, we propose a hybrid system that utilizes both V2V and V2I communications for secure data dissemination in urban scenarios. We use a zone-based stable and secure clustering mechanism to identify Cluster Heads (CH) as a message forwarding node to and from the Road Side Unit (RSU), which reduces the communication overhead and latency of the network. We utilize the concept of Internet Control Message Protocol (ICMP) and the monitoring mode of RSU for the detection and mitigation of impersonation attacks in VANETs. Finally, we validate our results using a network simulator (NS2).

A Lightweight Cross-Domain Authentication Protocol for Trusted Access to Industrial Internet

This paper proposes a hierarchical framework for industrial Internet device authentication and trusted access as well as a mechanism for industrial security state perception, and designs a cross-domain authentication scheme for devices on this basis. The scheme obtains hardware device platform configuration register (PCR) values and platform integrity measure through periodic perception, completes device identity identification and integrity measure verification when device accessing and data transmission requesting, ensures secure and trustworthy access and interoperation of devices, and designs a cross-domain authentication model for trustworthy access of devices and related security protocols. Through the security analysis, this scheme has good anti-attack abilities, and it can effectively protect against common replay attacks, impersonation attacks, and man-in-the-middle attacks.

Tag-Based PHY-Layer Authentication for RIS-Assisted Communication Systems

This paper proposes a tag-based approach for physical (PHY)-layer authentication in a reconfigurable intelligent surface (RIS) communication system. We first extract the intrinsic PHY-layer features of RIS communication systems in terms of channel gain and background noise, and then apply these PHY-layer features, a random signal as well as the private key of the transmitter to construct a robust cover tag signal against the impersonation attack. We adopt an asymmetric cryptography technique to encrypt tagged signals and to resist against unauthorized detection and tampering attacks during the transmission process. The receiver then applies the maximum a-posteriori (MAP) ratio test to conduct authentication based on the received tag signal, a reference tag signal transmitted in training phase and the knowledge of distributions of the channel gain, background noise and the random signal. We also provide security analysis to demonstrate how the proposed scheme can resist unauthorized detection, tampering attacks, etc. With the help of tools of the MAP ratio test, maximum likelihood estimation, we further analyze the distribution of the test statistics and derive analytical models for the false alarm and detection probabilities. Finally, extensive simulations are conducted to verify the theoretical results and to illustrate the performance of the proposed scheme.

An identity‐based secure VANET communication system

AbstractVehicular ad‐hoc networks (VANETs) are mobile networks intended to connect vehicles and provide secure communication. In this direction, many researchers worked on establishing secure communication in VANETs. However, VANETs still face potential security and privacy issues due to network openness. In this paper, we proposed a secure communication system for VANETs with privacy, consisting of an Enhanced privacy‐preserving mutual authentication procedure for safe communication in V2V and deriving a session key using vehicle identities and time stamps the secret values (nonce) shared during the session. Further, we compared the proposed technique with existing techniques, and satisfactory results were obtained in favor of the proposed less computation. Finally, a formal security model is established to secure against unknown key share attacks, replay attacks, and key‐compromised impersonation attacks.

Automated Patient Activity Identification in Cyber-physical Systems Using A Unique Deep Learning Approach and Multi-objective Optimization

Aims and Background: For video understanding and analysis, human activity recognition (HAR) has emerged as a challenging field to investigate and implement. Patients can be monitored in real-time by a group of healthy individuals, and abnormal behaviors can be used to identify them later. Patients who do not engage in customary physical activities are more likely to suffer from stress, cardiovascular disease, diabetes, and musculoskeletal disorders. Thus, it is critical to collect, evaluate, and analyze data to determine their activities. Objectives and Methodology: Deep learning-based convolutional neural networks (CNNs) can be used to solve the problem of patient activities in the healthcare system by identifying the most efficient healthcare providers. Healthcare relies heavily on the integration of medical devices into cyberphysical systems (CPS). Hospitals are progressively employing these technologies to maintain a high standard of patient care. The CNN-CPS technique can be used by a healthcare organization to examine a patient's medical history, symptoms, and tests to provide personalized care. A network of medical devices must be integrated into healthcare. Hospitals are increasingly using these technologies to ensure that patients get the best possible care at all times. Healthcare automation can dramatically improve quality and consistency by reducing human errors and fatigue. The multiobjective optimization is achieved considering various factors like the time required to find emergency case identification, new disease prediction, and accuracy of data protection. Results: Consequently, patients are assured of receiving a consistent, attentive service at every visit. Data and orders can be stored and entered more easily via automation, market research suggests. The outcome of this article is obtained based on a comparison of various approaches in health monitoring systems, such as collection of patient data is 82.3%, new disease prediction is 80.14%, emergency case identification is 78.25%, data protection is 81.35%, immune to impersonation attack reduction is 78.36% and overall accuracy of data protection and transmission performance is 86.24% is achieved. Conclusion: Compared with existing methods DM-CC and HE-WSN for health monitoring and patient’s treatment process, the proposed method CNN-CPS is better in maintaining the data and proper information passed to the medical care is 92.56%.

A Robust Privacy-Preserving ECC-Based Three-Factor Authentication Scheme for Metaverse Environment

Metaverse is revolutionizing the future iteration of technology with the potential to ameliorate efficiency and innovation drastically. It fashions engaging spaces for user interaction that simulate the real world by integrating augmented and virtual reality. Metaverse furnishes immersive interactive experiences, unrestricted time and space, visualizations, minimal learning costs, and endorses communication. A metaverse offers various services, such as virtual environments and avatars for telecommuting, education, and gaming. Yet, to access services, users must register with the server, where the registration requires user’s identity, password, and personal information. Additionally, the user interaction in metaverse is mediated through avatars over public channels, fabricating opportunities for security attacks such as replay and impersonation attacks. Consequently, we propose a secure mutual authentication scheme for safer user-server and avatar–avatar interactions utilizing Elliptic Curve Cryptography (ECC) and fuzzy extractor. The security of protocol is examined with Burrows–Abadi–Needham (BAN) logic, Real-or-Random (ROR) model, and Automated Validation of Internet Security Protocols Applications (AVISPA). We also conduct a comparative analysis of the computational and communication costs and the security features of proposed scheme with pre-existing works. Hence, the suggested protocol offers magnificent security and efficiency, making it suitable for the metaverse environment.

A puf-based three-party authentication key establishment scheme for fog-enabled smart home

With the rise of Internet of Things (IoT), the smart home is another emerging concept and application of IoT, where security and private data of devices are important. In this paper, fog computing is applied to the smart home environment, where fog can provide many smart features and services to the smart home. Fog computing has many advantages, such as low latency and real-time interaction. However, when fog computing is combined with smart home, it also faces some security threats: first, some fog nodes and smart home devices are deployed in public places, vulnerable to damage or theft by attackers, not considered fully trusted, and vulnerable to device loss/theft attacks, impersonation attacks, and message tampering attacks, etc. These threats can lead to adversaries controlling devices in the smart home or modifying messages to make smart home devices execute wrong commands, causing irreparable damage; Second, the smart home system should have good real-time interaction, and the authentication process using the low latency feature of fog computing should not be involved by the cloud. Considering these, it is necessary to design a secure and effective fog-enabled smart home authentication system that is secure against various known attacks, especially when the fog node is not fully trusted or the smart home device is captured as well. Finally, the authentication scheme should also be lightweight due to the limited resources of many smart home devices. To address these issues, this paper proposes a lightweight authentication scheme for the fog-enabled smart home system. It also employs a physical unclonable function to achieve mutual authentication among three parties: smart home devices, fog nodes and users. Formal security analysis under the Real-Or-Random model shows that this scheme is provably secure. And informal security analysis shows that our scheme is robust against various known attacks. At the same time, the proposed scheme requires less computation cost (8.239 ms) and is approximately 40% to 390% faster than existing related schemes. Although the communication cost is slightly higher (4512 bits), it is reasonable because the proposed scheme implements fog/gateway node compromised attack that has not been achieved by any other existing related schemes.

A Stronger Secure Ciphertext Fingerprint-Based Commitment Scheme for Robuster Verifiable OD-CP-ABE in IMCC

Outsourced Decryption Attribute-based Encryption (OD-ABE) is emerging as a promising cryptographic tool to provide efficient fine-grained access control for data accessing and sharing in cloud-assisted Intelligent Internet of Mobile Things (IIoMT). Decryption verification is an essential property of OD-ABE to enable the mobile user to verify the precision of the decryption data. Unfortunately, the most representative verification (commitment) algorithms have various security flaws. In this paper, we first indicate that the two state-of-art key-based commitment schemes are vulnerable to “Commitment Extract(Decrypt)-then-Reuse Attack” and “Commitment Impersonation Attack” which demolish the unforgeability of the commitment. Then to cover all the existing attacks to commitment algorithms, we re-define a robuster verifiable security model for verifiable OD-ABE. Subsequently, we invent a ciphertext fingerprint (CTfp) based commitment scheme and give rigorous proof to the proposed commitment scheme including binding, hiding, unforgeability, and non-repudiation (traceability) in the random oracle. Next, we apply our CTfp-based commitment to the widely used OD-ABE schemes to provide them robuster verifiability. Finally, the theoretical comparison and simulation experiments are presented to show our new type of commitment algorithm is more secure and practical.