IPsec Research Articles

Dynamic Key Extraction Technique Using Pulse Signal and Lightweight Cryptographic Authentication Scheme for WBAN

As a key component of ubiquitous computing, the wireless body area network (WBAN) can be used in a variety of disciplines, including health monitoring. Our everyday routines have been transformed by wearable technology, which has changed the medical industry and made our lives more convenient. However, the openness of the wireless network has raised concerns about the privacy and security of patient’s data because of the latent threat imposed by attackers. Patients’ sensitive data are safeguarded with authentication schemes against a variety of cyberattacks. Using pulse signals and a lightweight cryptographic approach, we propose a hybrid, anonymous, authentication scheme by extracting the binarized stream (bio-key) from pulse signal. We acquired 20 different sample signals to verify the unpredictability and randomness of keys, which were further utilized in an authentication algorithm. Formal proof of mutual authentication and key agreement was provided by the widely known BAN logic, and informal verification was provided by the Automated Validation of Internet Security Protocol and Applications (AVISPA) tool. The performance results depicted that storage cost on the sensor side was only 640 b, whereas communication cost was 512 b. Similarly, the computation time and energy consumption requirements were 0.005 ms and 0.55 µJ, respectively. Hence, it could be asserted that the proposed authentication scheme provided sustainable communication cost along with efficient computation, energy, and storage overheads as compared to peer work.

A Secure LEACH-PRO Protocol Based on Blockchain.

Wireless Sensor Networks (WSNs) are becoming more popular for many applications due to their convenient services. However, sensor nodes may suffer from significant security flaws, leading researchers to propose authentication schemes to protect WSNs. Although these authentication protocols significantly fulfill the required protection, security enhancement with less energy consumption is essential to preserve the availability of resources and secure better performance. In 2020, Youssef et al. suggested a scheme called Enhanced Probabilistic Cluster Head Selection (LEACH-PRO) to extend the sensors' lifetime in WSNs. This paper introduces a new variant of the LEACH-PRO protocol by adopting the blockchain security technique to protect WSNs. The proposed protocol (SLEACH-PRO) performs a decentralized authentication mechanism by applying a blockchain to multiple base stations to avoid system and performance degradation in the event of a station failure. The security analysis of the SLEACH-PRO is performed using Burrows-Abadi-Needham (BAN) logic and Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. Moreover, the SLEACH-PRO is evaluated and compared to related protocols in terms of computational cost and security level based on its resistance against several attacks. The comparison results showed that the SLEACH-PRO protocol is more secure and requires less computational cost compared to other related protocols.

A Secure Data Sharing Based on Key Aggregate Searchable Encryption in Fog-Enabled IoT Environment

Cloud server and fog computing have been utilized to manage enormous volumes of data with low service transmission time in Internet of Things (IoT) environment. However, untrustworthy relationships between network entities and cloud server cause a lot of security concerns. Many researches have been studied based on traditional cryptosystems for data sharing systems. But they lead to key management difficulty and do not ensure the data owner's authority by depending on Trusted Third Party (TTP). Therefore, we use key aggregate searchable encryption (KASE), which enables owners to exercise their rights in data management and sharing without the help of TTP and resolves the key management problem. In this paper, we propose a secure data sharing system based on KASE in fog-enabled IoT environment using blockchain. We prove the resistance of the proposed scheme against various attacks through informal analysis and Automated Validation of Internet Security Protocols and Applications (AVISPA) simulation tool. We prove the guarantee of secure mutual authentcation using Burrows-Abadi-Needham (BAN) logic. Furthermore, we compare security features and performance of the proposed scheme with existing schemes through Multiprecision Integer and Rational Arithmetic Cryptographic Library (MIRACL).

Privacy-Enabling Framework for Cloud-Assisted Digital Healthcare Industry

As the technology era progresses, many opportunities are brought to the healthcare industry. With the support of technology and Internet of Things platforms, e-healthcare is now more common than ever. However, the sensitive nature of healthcare records makes them vulnerable to many attacks. Therefore, a privacy-enabled framework for cloud-based e-healthcare systems is proposed to achieve privacy-preserved and secured communication in e-healthcare. The analysis of the proposed protocol is presented in this article to demonstrate that it is secure against all well-known security attacks and provides patient anonymity, doctor anonymity, and patient and doctor unlinkability while ensuring data confidentiality. Additionally, the security simulations are performed using the Automated Validation of Internet Security Protocols and Applications tool. We also performed the proposed framework's performance analysis and compared it with existing frameworks. The analysis result indicates that the proposed framework achieves encouraging performance over other frameworks while ensuring security.

Lightweight, secure, efficient, and dynamic scheme for mutual authentication of devices in Internet‐of‐Things‐Fog environment

AbstractSecurity is a major challenge in the design and implementation of Internet‐of‐Things (IoT)‐Fog networks and it can be resolved by an efficient authentication mechanism. As the devices have limited resources like battery, processor and memory, any mechanism designed for IoT‐Fog has to be resource aware. In this paper, we proposed a lightweight, secure, dynamic, and efficient scheme for mutual authentication of devices in IoT‐Fog networks. In the proposed scheme, the devices obtain a primary security value from the cloud server and this acquired primary security value is used to authenticate them mutually. We used XOR operation, concatenation operation, one‐way hash function and symmetric key cryptography to accommodate resource constraint nature of devices. The proposed scheme has been analyzed for security formally using BAN logic and automated using Automated Validation of Internet Security Protocols and Applications & ProVerif tools and it is proved that the proposed scheme is secure from the known attacks. The comparative analysis of the proposed scheme with the existing schemes proved that it is better than existing schemes and its experimental analysis showed that it consumes 20%–30% less energy compared to existing schemes. Our proposed scheme is better with reference to security and efficient in respect of computation, communication, and storage overheads.

Authentication methods for internet of vehicles based on trusted connection architecture

This paper proposes an authentication protocol based on a trusted connection architecture to manage the security and reliability of the cloud service environment during the communication process, improve the trust of the cloud service platform toward vehicles, and ensure that vehicle terminals have reliable access to cloud services. Compared with prior Internet of Vehicle (IoV) authentication schemes, our scheme is the first to include platform identification in the authentication process. Based on the characteristics of the trusted connection architecture, the components that constitute the platform can be assessed for security by verifying the vehicle platform identity and platform integrity metrics, thereby eliminating internal threats. In addition, the protocol proposes an authentication scheme for the IoV environment, in which the trusted authority only needs to generate the user's partial key based on the identity, thereby avoiding the key escrow problem common to identity-based cryptosystems. Finally, the scheme is proven to be highly secure using various approaches, such as Syverson-Van Oorschot (SVO) logical analysis, simulated authentication via automated validation of internet security protocols and applications (AVISPA), and informal security analysis. In the identity authentication step, our method has low computation and communication overhead when compared with other schemes according to the performance analysis results.

Design of Inter-BAN Authentication Protocols for WBAN in a Cloud-Assisted Environment

The Telecare Medical Information System (TMIS) is a technology used in Wireless Body Area Networks (WBAN) that is used efficiently for remote healthcare services. TMIS services can be provided as cloud computing services for storage and processing purposes. TMIS uses wearable sensors to collect patient data and transmit it to the controller node over a public channel. The data is then obtained from the controller node by the medical server and stored in the database for analysis. However, an attacker can attempt to launch attacks on data transferred across an unsecured channel. Several schemes have therefore been proposed to provide mutual authentication however, there are security and performance problems. Therefore, the research aims to design two secure and efficient inter-BAN authentication protocols for WBAN: protocol-I (P-I) for emergency authentication and protocol-II (P-II) for periodic authentication. To analyze the proposed protocols, we conduct an informal security analysis, implement Burrows-Abadi-Needham (BAN) logic analysis, validate the proposed protocols using the Automated Validation of Internet Security Protocols and Applications (AVISPA) simulation tool, and conduct a performance analysis. Consequently, we show that the proposed protocols meet all the security requirements in this research, achieve mutual authentication, prevent passive and active attacks, and have suitable performance for WBAN.

A Secure Personal Health Record Sharing System with Key Aggregate Dynamic Searchable Encryption

Recently, as interest in individualized health has increased, the Personal Health Record (PHR) has attracted a lot of attention for prognosis predictions and accurate diagnoses. Cloud servers have been used to manage the PHR system, but privacy concerns are evident since cloud servers process the entire PHR, which contains the sensitive information of patients. In addition, cloud servers centrally manage the PHR system so patients lose direct control over their own PHR and cloud servers can be an attractive target for malicious users. Therefore, ensuring the integrity and privacy of the PHR and allocating authorization to users are important issues. In this paper, we propose a secure PHR sharing system using a blockchain, InterPlanetary File System (IPFS), and smart contract to ensure PHR integrity and secure verification. To guarantee the patient’s authority over the management of his/her own PHR, as well as provide convenient access, we suggest a key aggregate dynamic searchable encryption. We prove the security of the proposed scheme through informal and formal analyses including an Automated Verification of Internet Security Protocols and Applications (AVISPA) simulation, Burrows–Abadi–Needham (BAN) logic, and security-model-based games. Furthermore, we estimate the computational costs of the proposed scheme using a Multiprecision Integer and Rational Arithmetic Cryptographic Library (MIRACL) and compare the results with those of previous works.

An efficient lightweight key exchange algorithm for internet of things applications

<p><span>Internet of things (IoT) gained wide popularity in recent years, and this is proved by tremendous increase in use of IoT applications worldwide. Distributed IoT applications can be implemented securely with the support of blockchain. By default, blockchain will ensure authentication of involved entities as well as integrity of data. Due to storage restrictions, use of hybrid system is preferred, and this involves cloud server for storage and blockchain for other functionalities. Data kept in cloud has to be encrypted by a strong encryption algorithm. Even though core security objectives are achieved, it is necessary to provide a secure method to exchange the key. Since, the key is the backbone of a security algorithm, protection of the key has to be ensured. In this work, an algorithm is proposed to provide a no-share key exchange between two communicating parties in a resource constrained environment. The same was implemented and compared with conventional key sharing algorithms. Security analysis was formally conducted by using widely accepted automated validation of internet security protocols and applications (AVISPA) tool and the proposed method proved to be secure.</span></p>

Efficient and Secure Key Management and Authentication Scheme for WBSNs Using CP-ABE and Consortium Blockchain

Wireless body sensor networks (WBSNs) pose significant security and privacy risks. The Medical Server (MS) will only allow legitimate stakeholders access to confidential patient medical records when successful mutual authentication between all registered users and the MS has been confirmed using preset secret attributes. This paper proposes a novel approach to overcome the security and privacy problems in WBSNs by using CP-ABE and a consortium blockchain for key management and authentication. In this paper, a fixed-size session key is computed by utilizing several attribute base rules and AND/OR logic gate combinations. IEEE 802.15.6 is also used to transmit the encoded patient data from the register and legitimately deployed biosensor nodes on a patient’s body to the Base Station nearby (BS). This was done in part by leveraging consortium blockchains to construct partial blocks and then, transmit the encrypted partial blocks to MS via peer-to-peer networks, as well as aggregating critical physiological information. MS is now validating partial blocks with a hash function to ensure their integrity before converting them all into full blocks, which are subsequently mined and put on the blockchain effectively and ideally using a consensus mechanism. When sessions between MS and stakeholders are established, all legitimate consumers can view the secure medical records of a registered patient in a hospital using their predefined access structure.. The resource-constrained environment of WBSNs can benefit from enhanced data security and privacy by using CP-ABE in conjunction with the organization’s consensus to encrypt the patient’s critical features or attributes. Automated Validation of Internet Security Protocol and Applications (AVISPA) tool is used to verify the validity and correctness of the proposed authentication mechanism. The proposed scheme reduces transmission, processing and storage costs and energy usage by a significant margin when compared to current state-of-the-art alternatives. It is also worth noting that a multicriteria decision making (MCDM) approach known as Evaluation Based on Distance from Average Solution (EDAS) is employed to provide the ranking and determine which strategy is optimal across all of the domains involved.

A unique secure multimodal biometrics-based user anonymous authenticated key management protocol (SMUAAKAP) based on block chain mechanism for generic HIoTNs

The concept of blockchain has sparked hopes in the field of communication security between IoT devices. In blockchain, all network nodes need to verify its legitimacy before accepting and recording it. Users of HIoTNs (Hierarchical IoT Networks) want to get real-time data from specific sensors in a specific implementation. Users need authentications at GNs for obtaining their required services. On successful authentications, parties on either sides of communication can create secret session keys for safe communications. Critical issues like this in HIoTNs are addressed in this work by its novel proposed multimodal-biometrics based lightweight user authentications. The scheme based on block chain technologies is called SMUAAKMPs (Secure Multimodal Biometrics-based User Anonymous Authenticated Key Management Protocols). ECDSAs (Elliptic Curve Digital Signature Algorithms) are utilised for devices and GNs, to generate public and private keys. In addition, multimodal biometric verifications are executed using fuzzy commitment approaches. The fuzzy commitment technique is then used to validate the biometric authentication using the segmented face. This work's detailed security analyses use ROR (Real-Or-Random) models where formal security verifications are done by software verification tool AVISPAs (Automated Validation of Internet Security Protocols and Applications). Informal security analyses show that the proposed SMUAAKMPs withstand multiple known attacks. The system also provides improved safety and functionalities at reduced costs in computations and communications when compared to UABKMPs, UAKMPs, and SMBUAKEPs.

Ensure the dynamic identity and PUF based authenticated key settlement approach for the IoT infrastructure

With technological advancements, the dependency on the Internet of things (IoT) has increased. The spectrum of IoT application domain becomes larger day by day. It converts the existing services into smart services. The evolution brings lot of security challenges hand in hand with IoT paradigms. This is due to the limitation of IoT devices like, low computational capabilities, small storage medium, less power back up and low processing speed, etc. To overcome these limitations, a proper authentication technique must be required to do the trust management in a heterogeneous IoT environment and secure all kinds of traffic. In this research document, a dynamic identity-based authentication approach is introduced for IoT environment, which utilizes very lightweight physical unclonable function, one-way hashing function and exclusive-OR(XOR) function to make the scheme lighter. Broadly accepted the Real or Random (RoR) model and the Burrows Abadi Needham logic (BAN logic) are used here, to check the security and the correctness of the devised protocol. In addition to that, the software simulation tool, Automated validation of Internet security protocols and applications (AVISPA) has proved that, the recommended protocol is safe and secure from various attacks. Furthermore, the comparative performance analysis exhibits the supremacy of the recommended scheme over the analogous schemes w.r.t computational power, memory usage, and communication overhead.

ESIKE: An Efficient and Secure Internet Key Exchange Protocol

The use of Internet key exchange protocols in IP Security architecture and IoT environments has vulnerable to various malicious attacks and affects communication efficiency. To address these weaknesses, we propose a novel efficient and secure Internet key exchange protocol (ESIKE), which achieves a high level of security along with low computational cost and energy consumption. ESIKE achieves perfect forward secrecy, anonymity, known-key security, and untraceability properties. ESIKE can resist several attacks, such as, replay, DoS, eavesdropping, man-in-the-middle and modification. In addition, the formal security validation using AVISPA tools confirms the superiority of ESIKE in terms of security.

A novel approach for securing data against adversary attacks in UAV embedded HetNet using identity based authentication scheme

AbstractUnmanned Aerial Vehicle (UAV) integrated Heterogeneous Network (HetNet) is currently considered as one of the promising technologies. This technology helps in fulfilling high demands of bandwidth, volume, and range as per user needs. In this paper, the work is carried out by authors to assure high security for the users in such a network by incorporating an authentication‐based security known as Identity based Scheme (IBA). The IBA based implemented networks improve the confidentiality of data and the authenticity of the users. Privacy and reliability come through the entity's capacity to authenticate, sign and transact authenticated data without central directory interference. Therefore,the primary scope of this research project is to create an identity‐based authentication mechanism in HetNets that are assisted by UAVs and to secure communication against potential intruder threats. In this way, the security assurance is increased and dreadful intruder attacks are minimized. Moreover, in this research work, the implementing zones would be areas of defence for observation of a region to locate an enemy or as certain strategic features. The security rules are formulated in the coded language known as High Level Protocol Specification Language (HLPSL) and outcomes are verified through Automated Validation Internet Security Protocols and Applications (AVISPA).

Protocols for Secure Remote Access to Vehicle Onboard Diagnostic Systems in Smart Cities

The onboard diagnostic system (OBD) is almost standard on every modern vehicle. By exploiting the availability of wireless OBD dongles, vehicles can be assessed by the transportation authority and drivers to ensure compliance with emissions regulations. A vehicle’s OBD system can be remotely accessed by a fog node to retrieve a variety of the vehicle’s internal status and sensor readings. Such information can be shared with the transportation authority for registration renewal without the need for visiting emission stations. However, such automation comes at the risk of malicious intrusion into the OBD system by an attacker who aims to gain access to a vehicle’s internal network and control the vehicle. This article tackles this serious issue and proposes protocols for mutual authentication and securing the wireless connection between the OBD dongle, fog node, and authority. The robustness of the proposed protocols is verified using the Automated Validation of Internet Security Protocols and Applications (AVISPA) toolset.

Cloud‐based authentication and key management protocol for advanced metering infrastructure in smart grid

AbstractIn smart grid networks, the advanced metering infrastructure (AMI) enables sensors and communication networks to measure electricity consumed or generated by users. However, among the challenges to be overcome related to security in the AMI system is resistance to computer attacks, such as impersonation, denial of service, man in the middle, and redirection, which can compromise privacy, confidentiality, and availability of electrical systems. An efficient and effective authentication system is necessary to guarantee the privacy and confidentiality of data without compromising system performance, thus characterizing a challenge (need for a tradeoff between security and performance), which involves limited computing power and bandwidth and a high number of meters to be installed in a certain geographic area. This article introduces a group authentication and key agreement protocol that ensures both confidentiality and privacy of communications and avoids several computer attacks. It showed better communication and computational cost‐based performance compared to other protocols. Automated validation of internet security protocols and applications formally validated it, while security protocol animator tool simulated an intrusion, with good results.

MobEdge: Mobile blockchain‐based privacy‐edge scheme for healthcare Internet of Things‐based ecosystems

SummaryCentralized healthcare Internet of Things (HIoT)‐based ecosystems are challenged by high latency, single‐point failures, and privacy‐based attacks due to data exchange over open channels. To address the challenges, the shift has progressed toward decentralized HIoT setups that infuse computation closer to a patient node via edge services. As HIoT data are critical and sensitive, trust among stakeholders is a prime concern. To address the challenges, researchers integrated blockchain (BCH) into edge‐based HIoT models. However, the integration of lightweight BCH is required with an edge for proper interplay and leverage effective, scalable, and energy‐efficient computational processes for constrained HIoT applications. Owing to the existing gap, this article proposes a scheme MobEdge, that fuses lightweight BCH, and edge computing to secure HIoT. A local BCH client model is set up that forwards data to edge sensor gateways. The shared data are secured through an access tree control lock scheme that preserves the privacy of health records. For security and signing purposes, we have considered signcryption, and the validated records meta‐information are stored in an on‐chain structure. The scheme is compared on two grounds, security and simulation grounds. On the security front, we do cost evaluation and present a formal analysis model using the Automated Validation of Internet Security Protocols and Applications tool. An edge‐based BCH setup use‐case is presented, and parameters like mining cost, storage cost, edge servicing latency, energy consumption, BCH network usage, and transaction signing costs are considered. In the simulation, the mining cost is 0.6675 USD, and improvement of storage costs are improved by 18.34%, edge‐servicing latency is 384 ms, and signcryption improves the signing cost by 36.78% against similar schemes, that indicates the scheme viability in HIoT setups.

A lightweight security framework for electronic healthcare system.

Electronic healthcare systems (EHS) are the most emerging field of today’s digital world which is used for remote health monitoring, evidence-based treatment, disease prediction, modeling, etc. Many internet of things (IoT) devices and body sensors are involved in such systems for data collection. Every time a cloud-based solution is adopted to collect and preserve collected personal health information. Secure data transmission is a big challenge in such an environment as the devices are memory and power-constrained. This research focuses on a lightweight ciphering mechanism that can be used to secure an electronic healthcare system. Traditional cryptographic solutions are not suitable due to the operational complexity. Some popular lightweight block ciphers which includes SIMON, HEIGHT, LEA, etc. are used in IoT device to increase the speed. Hence, in this paper, we have proposed a lightweight security framework with a flexible key structure to protect the data in the electronic healthcare system. The proposed scheme increases the speed by minimum 4% with compared to existing literature. Our experimental analysis shows that the proposed technique also have a low computational and communicational load. The brief security analysis using automated validation of internet security protocols and applications (AVISPA) tool shows that the proposed scheme can withstand all network attacks.

A secure lightweight anonymous elliptic curve cryptography‐based authentication and key agreement scheme for fog assisted‐Internet of Things enabled networks

SummaryThe fog assisted‐Internet of Things (IoT) enabled network has been a novel topic in recent years. With the rapid development of the IoT, it is imperative to accomplish security in the fog computing environment. The surface for cryptographic attacks is expanded since the fog node can analyze, store, and process data between cloud and IoT device. This article proposes elliptic curve cryptography (ECC) based mutual authentication and key agreement scheme to support secure communication between device and fog server. In this work, we have formally analyzed the proposed scheme using the most widely accepted automated validation of Internet security protocols and application (AVISPA) tool. The informal security analysis of the proposed scheme shows that the proposed method is robust against several attacks. The performance analysis has been evaluated in terms of computation and storage overhead. The security and performance analysis with theoretical proof indicates that proposed scheme attains better security than related schemes.

UpHaaR: Blockchain-based charity donation scheme to handle financial irregularities

Non-profit organization raise charity donation through different sources, and raised funds often require a clean traceability. Recently, fake charity fundraisers schemes have raised a social concern, and thus a trusted and auditable approach is necessary to manage charity organizations reputations. Blockchain-based charity (BBC) schemes are proposed with decentralization that ensure trust, transparency, and chronology among donators and beneficiaries. However, the schemes suffer from the high-end complexity of certificate generation. Motivated from this, in this paper, we propose a BBC scheme, UpHaaR, where donators, defined as charity persons (CP), and beneficiaries, defined as charity beneficiaries (CB), register in blockchain, managed for diverse fundraisers by charity organizations (CO). The scheme mitigates fake fundraisers, as the charity scheme data and fund allocations to CP are managed as ledger entries in the blockchain. To maintain the security and privacy of massive CP and CB users, the scheme proposes partial key generations through certificate-less cryptography (CLC), which mitigates expensive digital signing and eliminates certificate generation through key distribution centers. For signature aspects, the scheme proposes a lightweight certificate-less signcryption scheme (CSS) that eliminates collusion against insider attacks and reduces computational costs. The scheme is evaluated for security analysis using automated validation of internet security protocols and applications (AVISPA) tool, and informal attack analysis, and cost evaluations. The proposed results indicate the scheme’s viability against similar conventional approaches.