Key Distribution Mechanism Research Articles

One-to-many image encryption with privacy-preserving homomorphic outsourced decryption based on compressed sensing

As a classical framework for signal compression and reconstruction, compressed sensing (CS) has dramatically improved the state-of-the-art in many fields such as image processing, wireless communication, medical imaging and optics. Since CS integrates data compression and encryption, CS-based cryptographic primitives have attracted great attention in recent years. Note that almost all the existing CS-based encryption schemes are one-to-one symmetric cryptosystems. Unlike traditional permutation-diffusion based symmetric cryptosystems (e.g., DES and AES), CS-based encryption schemes do not have the characteristic of high efficiency because decryption procedures require to perform complex and time-consuming reconstruction algorithms. In this paper, we break the traditional one-to-one encryption framework of CS-based cryptosystems, and present an efficient one-to-many encryption model for flexible application scenarios. Specifically, the information sender first encrypts several plaintext images simultaneously for different users according to our proposed attribute-based key distribution mechanism, and then sends the ciphertext to the cloud storage server. Any user who has one of attributes can efficiently obtain the corresponding plaintext by using an outsourced decryption server (ODS). To prevent the ODS from stealing the plaintexts for illegal activities, we employ a homomorphic transformation algorithm which can transform the original reconstruction problem into a variant one. The experimental results and the comparison with similar works demonstrate the feasibility and the superiority of the proposed scheme.

Towards Quantum-Secured Permissioned Blockchain: Signature, Consensus, and Logic

While Blockchain technology is universally considered as a significant technology for the near future, some of its pillars are under a threat of another thriving technology, Quantum Computing. In this paper, we propose important safeguard measures against this threat by developing a framework of a quantum-secured, permissioned blockchain called Logicontract (LC). LC adopts a digital signature scheme based on Quantum Key Distribution (QKD) mechanisms and a vote-based consensus algorithm to achieve consensus on the blockchain. The main contribution of this paper is in the development of: (1) unconditionally secure signature scheme for LC which makes it immune to the attack of quantum computers; (2) scalable consensus protocol used by LC; (3) logic-based scripting language for the creation of smart contracts on LC; (4) quantum-resistant lottery protocol which illustrates the power and usage of LC.

Trust Factor Based Key Distribution Protocol in Hybrid Cloud Environment

In the Hybrid cloud deployment model, security is essential to restrict access while using resources such as virtual machine, platform, and application. Many protocols were developed to provide security via the cryptography technique, but these protocols rarely considered the trust factor which is an essential factor for cloud security. The existing Elliptic Curve Cryptography and Diffie Hellman key distribution mechanism failed to stress the trust factor, and further, they have provided not only higher complexity but also lower security and reliability. The proposed method comprised two stages: first stage, Group Creation using the trust factor and develop key distribution security protocol. It performs the communication process among the virtual machine communication nodes. Creating several groups based on the cluster and trust factors methods. The second stage, the ECC (Elliptic Curve Cryptography) based distribution security protocol is developed. The proposed Trust Factor Based Key Distribution Protocol reduced error rate, improve the key computation time and maximize resource utilization.

Correction to: A Physical-Layer Key Distribution Mechanism for IoT Networks

The original version of this article unfortunately contained mistakes in the author group and affiliation sections.

A Physical-Layer Key Distribution Mechanism for IoT Networks

Physical layer security has gained an increasing attention due to its efficiency and simplicity as compared to other conventional security protocols. Thus, it has been recently nominated for Internet of Things (IoT) applications. In this paper, a novel key distribution mechanism is proposed for IoT networks. The proposed mechanism exploits the channel diversity to distribute encryption keys among nodes within the network. A main novelty aspect of the proposed mechanism is that it guarantees distributing different keys with different lengths to all nodes at the same time. In addition, an intelligent eavesdropper model has been considered. Simulation results prove the high performance of the proposed scheme and its robustness against channel estimation errors, and immunity against eavesdroppers.

Identity Based Key Distribution Framework for Link Layer Security of AMI Networks

Advanced metering infrastructures (AMIs) enable two-way communications between the utility and customers opening up opportunities for an efficient and reliable smart grid. This, however, opens up the grid to a vast amount of attack vectors and intruders. Therefore, cyber security is an indispensable part of the smart grid communications’ infrastructure and must be considered in the early phases of planning. The achievement of a secure grid infrastructure requires cryptographic primitives whose strength is dependent on the utilized keys, raising the need for secure key generation/distribution mechanisms. Furthermore, the underlying security mechanisms should be scalable due to the large AMI network sizes. In this paper, we propose the usage of identity-based-cryptography as the basic block of the key distribution mechanism to generate secret keys between neighboring smart meters in a non-interactive manner. Physical unclonable functions are proposed on the hardware platform to eliminate key compromise at the hardware level. We also propose a secure mechanism for updating private keys that are utilized as a seed within the identity-based cryptosystem. A lightweight key delivery mechanism exploiting multicast network features is presented along with a new authentication algorithm for the updated keys. Hardware tests are performed on a Cortex M3-based microcontroller to mimic smart meters’ processors and assess the feasibility of the proposed key authentication. Experiments conducted on a network simulator validate the feasibility of the proposed methodology indicating key delivery latency reduction up to 80% and network traffic reduction up to 27%.

OmniShare: Encrypted Cloud Storage for the Multi-Device Era

Two attractive features of cloud storage services are (1) the automatic synchronization of files between multiple devices and (2) the possibility of sharing files with other users. However, many users are concerned about the security and privacy of data stored in the cloud. Client-side encryption is an effective safeguard, but it requires all client devices to have the decryption key. Current solutions derive these keys from user-chosen passwords, which are easily guessed. We present OmniShare, the first scheme to combine strong client-side encryption with intuitive key distribution mechanisms to enable access from multiple client devices and sharing between users. OmniShare uses a novel combination of out-of-band channels (including QR codes and ultrasonic communication), as well as the cloud storage service itself, to authenticate new devices. We describe the design and implementation of OmniShare and explain how we evaluated its security (using formal methods), its performance (benchmarks), and its usability (cognitive walkthrough).

Secure Self-healing Group Key Distribution Scheme with Constant Storage for SCADA Systems in Smart Grid

Smart grid has a great advantage over the traditional power grid and it is a critical condition in people’s daily life. The security of data communication in smart grid is important and needs to be efficiently guaranteed. The supervisory control and data acquisition (SCADA) systems is in charge of supervising the sensitive process. In SCADA systems, the secure communication between control center and remote terminal units can be achieved by the key distribution mechanism. However, the remote terminal units are resource-constrained and sometimes are not available so that they cannot receive the session key updating broadcast. Self-healing is an efficient mechanism to calculate missing session keys by using later broadcast messages. In this paper, we propose an efficient self-healing group key distribution scheme for SCADA systems. The security analysis illustrates that our scheme satisfy the basic security properties defined in security model. According to the performance evaluation from storage and communication cost viewpoints, the proposed scheme is efficient.

OmniShare: Encrypted Cloud Storage for the Multi-Device Era

Two attractive features of cloud storage services are (1) the automatic synchronization of files between multiple devices and (2) the possibility of sharing files with other users. However, many users are concerned about the security and privacy of data stored in the cloud. Client-side encryption is an effective safeguard, but it requires all client devices to have the decryption key. Current solutions derive these keys from user-chosen passwords, which are easily guessed. We present OmniShare, the first scheme to combine strong client-side encryption with intuitive key distribution mechanisms to enable access from multiple client devices and sharing between users. OmniShare uses a novel combination of out-of-band channels (including QR codes and ultrasonic communication), as well as the cloud storage service itself, to authenticate new devices. We describe the design and implementation of OmniShare and explain how we evaluated its security (using formal methods), its performance (benchmarks), and its usability (cognitive walkthrough).

Joint Crypto-Stego Scheme for Enhanced Image Protection With Nearest-Centroid Clustering

Owing to the exceptional growth of information exchange over open communication channels within the public Internet, confidential transmission of information has become a vital current concern for organizations and individuals. In the proposed content-protection scheme, the decryption key is embedded in the encrypted image by utilizing machine learning, nearest-centroid clustering classifier, followed by least significant bit matching (LSB-M) in the spatial domain. An image is first encrypted with the advanced encryption standard (AES) algorithm in output feedback mode, after which the AES key is embedded into the encrypted image. Preliminary nearest-centroid clustering followed by shuffling the sequence of pixels within the clusters before applying LSB-M makes any attack more complex, as the bits of the key are further dispersed within the encrypted image. In terms of contributions, one contribution is the direct implementation of the proposed security mechanism on color images rather than first converting them into gray tones. Another contribution of the Crypto-Stego method is that, it requires no separate key distribution mechanism to decrypt the information. In addition, a parallel-processing approach is implemented to improve the execution time and the efficiency of the scheme by exploiting system resources. Extensive experiments were performed on RGB images with different resolutions and sizes to confirm the effectiveness of the scheme. The high structural similarity index score confirmed that the overall carrier image and stego-image were unaltered by processing. While an average value over the test images of 0.0594 for mean squared error confirmed that malicious individuals cannot detect the presence of stego data in the cover image. Moreover, negligible pixel intensity histogram changes also validated the effectiveness of the proposed scheme. An average 77% efficiency and 1.5 times speed-up factor were achieved through parallel processing showed the effectiveness of the joint Crypto-Stego method for image confidentiality.

Bitstream-Oriented Protection for the H.264/Scalable Video Coding (SVC)

The newly standardized H.264/SVC enable multimedia suppliers to provide video bitstream with temporal, spatial and quality scalabilities to meet various needs of end users. Its bitstream scalability characteristic is also especially suitable for multimedia applications under merged heterogeneous networks with different network protocols, capacities and throughputs. Although the network environment, to some extent, provides security protection against the illegal users, it is not enough to protect against the authorized users from digesting contents beyond its authorization. Hence the issue of content protection for the H.264/SVC has aroused researchers’ interests in recent years. In this paper, we present an efficient bitstream-oriented protection scheme for the H.264/SVC in a compression friendly and format compliant manner. The encryption is implemented on the Network Abstraction Layer (NAL) unit level. To improve the computational efficiency as well as to provide sufficient security, selective cryptographic algorithms with different computation cost are employed for different content level of SVC according to its significance. The I slice NAL units from the base layer of SVC bitstream are encrypted with the symmetric AES algorithm in Cipher Block Chaining mode. And the other NAL units are protected by simplified XOR cipher. Furthermore, a robust key management (key generation and distribution) mechanism is also discussed in this paper. The security analysis and simulation results further verify that the proposed methods can effectively protect the H.264/SVC bitstream at low computational cost.

A key distribution scheme for secure communication in acoustic sensor networks

Cryptographic key distribution is always a major problem in large scale wireless communications such as Acoustic Sensor Networks (ASNs) based on wireless sensors in an Internet of Things (IoT) environment. Because of the resource constraints of the nodes in such networks, the traditional cryptographic primitives are not suitable solutions. Our endeavor in this paper is to develop a new deterministic key distribution mechanism for such networks. In particular, we bring in a novel construction methodology from two-dimensional geometry by exploiting the properties of regular Hexagon. One advantage of using the proposed approach, as opposed to randomized distribution techniques, is that, the configurations have a compact and efficient algebraic description. This yields nice algorithm for shared-key discovery, in which very little information (or no information at all) needs to be broadcasted. Furthermore, it is shown that the security strength of the proposed approach outperforms well-known deterministic techniques in terms of resilience. Furthermore, the distribution technique ensures 100% connectivity (i.e., the probability that two nodes share a key is 1) and average key-path length is 1.

Key-management scheme for wireless sensor networks based on merging blocks of symmetric design

Wireless sensor networks as the key infrastructure of the new networking paradigm are vulnerable against different kinds of attacks. Therefore, ensuring a secure communication between the sensor nodes is important. One of the most critical issues in this regard is the key distribution mechanism. Due to the random deployment of the sensors in the target area, key pre-distribution is a promising approach, in which a list of keys, so-called key-ring, is pre-distributed to each sensor node before deployment. To establish a secure communication, two nodes must share a common key from their key-rings. In this paper, we consider a hybrid key pre-distribution approach based on the symmetric design. We propose a new scheme, which is a modification of the hybrid symmetric design in order to improve the connectivity and resilience. Considering the trade-off between resilience and connectivity, we introduce a new parameter based on the application requirement. The experimental results and analytical analysis approve the efficiency of our proposed approach and introduced parameter.

Design and FPGA implementation of an efficient security mechanism for mobile pay‐TV systems

SummaryA mobile pay‐TV service is one of the ongoing services of multimedia systems. Designing an efficient mechanism for authentication and key distribution is an important security requirement in mobile pay‐TV systems. Until now, many security protocols have been proposed for mobile pay‐TV systems. However, the existing protocols for mobile pay‐TV systems are vulnerable to various security attacks. Recently, Wang and Qin proposed an authentication scheme for mobile pay‐TV systems using bilinear pairing on elliptic curve cryptography. They claimed that their scheme could withstand various attacks. In this paper, we demonstrate that Wang and Qin's scheme is vulnerable to replay attacks and impersonation attacks. Furthermore, we propose a novel security protocol for mobile pay‐TV systems using the elliptic curve cryptosystem to overcome the weaknesses of Wang and Qin's scheme. In order to improve the efficiency, the proposed scheme is designed in such a way that needs fewer scalar multiplication operations and does not use bilinear pairing, which is an expensive cryptographic operation. Detailed analyses, including verification using the Automated Validation of Internet Security Protocols and Applications tool and implementation on FPGA, demonstrate that the proposed scheme not only withstands active and passive attacks and provides user anonymity but also has a better performance than Wang and Qin's scheme.

Blind key distribution mechanism to secure wireless metropolitan area network

IEEE 802.16, also known as WMAN is a promising broadband wireless technology that provides a great support for Next Generation Networks (NGN). Due to the continuous evolution of new technologies and increasing diverse set of mobile users, WMAN has huge security vulnerabilities. So, there is an intrinsic need to address WMAN security and reliability pitfalls. Therefore, we propose an enhanced version of Privacy Key Management Protocol Version 2 (e-PKMv2) based security scheme for secured data transmission between the Base Station (BS) and the Subscriber Station (SS) in WMAN. For this, we introduce a new technique called Blind Key Distribution (BKD) which increases the security of Authorization Key (AK) significantly in the key management protocol. We show how the proposed e-PKMv2 ensures secure key exchange in WMAN. Finally, the performance analysis of both the existing and proposed cryptosystem is provided.

Utilizing hash graphs for key distribution for mobile and replaceable interconnected sensors in the IoT context

In most general terms, Internet of Thing (IoT) applications and networks contain interconnected equipment, which are mostly resource constrained. Sensor nodes with sensing and communication capabilities are widely referred as a "thing" in IoT domain in the literature. On the other hand, mobility is an important concern to provide sustainable security and privacy for IoT applications. Solutions that provide high performance security and privacy with static nodes may perform badly when the nodes are mobile. To this end, a security and privacy infrastructure for mobile IoT deployments requires a flexible cryptographic key distribution mechanism with the support of continuous secure connectivity and resiliency even in the case of node replacements. The concept of continuity by deploying new nodes in the area has been studied under multiphase wireless sensor network topic in the literature. In this type of multiphase networks, key rings of the newly deployed nodes are selected from their deployment generation key pools to improve the resiliency and to ensure constant secure connectivity. Nevertheless, the existing research in this area assumes fixed and/or uniformly distributed network lifetime from key distribution point of view. In IoT terms, as the entire lifetime of an application and the underlying networks cannot be guessed a priori, this issue should also be addressed while designing a key distribution mechanism. In this paper, we propose Hash Graph (HaG) scheme for key predistribution among a large set of sensor nodes in a sustainable and secure way. In our HaG scheme, every generation has its own key pool which is generated using the key pool of the previous generation. Since this is an iterative process, there is no limit on the total number of generations, providing flexible network lifetime property to our HaG scheme. This allows nodes deployed at different generations to have the ability to establish secure channels. Likewise, a captured node can only be used to obtain keys for a limited amount of successive generations. We also consider sensor nodes as mobile and use different mobility models to show its effects on the performance. We compare the connectivity and resiliency performance of our scheme with a state-of-the-art multiphase key predistribution scheme and show that our scheme performs considerably better when the attack rate is low. When the attack rate increases, our scheme still has better resiliency performance considering that it requires less key ring size compared to a state-of-the-art multiphase scheme.

Dynamic spectrum access‐based cryptosystem for cognitive radio networks

AbstractThe dynamic spectrum access (DSA) paradigm of the cognitive radio (CR) contributes intrinsic security capability to the CR network by hiding information in the unpredictable spectrum access patterns. This paper formalizes the frequency hopping DSA (FH‐DSA)‐based cryptography by introducing the model of dynamic bit (dybit), whose state indicates both the binary value and the DSA strategy. Taking advantage of uncertainty of the dybit state, FH‐based key distribution (FH‐KE) mechanisms are proposed to establish secrets among communication attendants. Based on the group FH‐KE (GKE), a confidentiality‐oriented DSA scheme, GKE‐DSA is developed to realize the FH‐DSA cryptography‐based secure data communication. The GKE‐DSA can conceal the DSA strategy of each communication link from others while limiting the data packet collisions through GKE‐based negotiation. Copyright © 2016 John Wiley & Sons, Ltd.

Efficient chosen ciphertext secure key encapsulation mechanism in standard model over ideal lattices

ABSTRACTKey encapsulation mechanism (KEM) is an important key distribution mechanism that not only allows both sender and receiver to safely share a random session key, but also can be mainly applied to construct a hybrid public key encryption scheme. In this paper, we give an positive answer to the question of if it is possible to build an efficient KEM over lattices. More precisely, we design an efficient KEM scheme in standard model based on ideal lattices. We prove that the proposed scheme captures indistinguishability against active chosen ciphertext attacks (IND-CCA) under the ring learning with errors problem, or more formally, IND-CCA security. Compared with the current CCA secure KEM schemes based on lattices in the standard model, our scheme has shorter public key, secret key and encapsulation ciphertext. In addition, our KEM scheme realizes IND-CCA security in the standard model.

SDAW: secure data aggregation watermarking-based scheme in homogeneous WSNs

Redundant data retransmission problem in wireless sensor networks (WSNs) can be eliminated using the data aggregation process which combines similar data to reduce the resource-consumption and consequently, saves energy during data transmission. In the recent days, many researchers have focused on securing this paradigm despite the constraints it imposes such as the limited resources. Most of the solutions proposed to secure the data aggregation process in WSNs are essentially based on the use of encryption keys to protect data during their transmission in the network. Indeed, the key generation and distribution mechanisms involve additional computation costs and consume more of energy. Considering this, in this paper, we propose a new security mechanism to secure data aggregation in WSNs called SDAW (secure data aggregation watermarking-based scheme in homogeneous WSNs). Our mechanism aims to secure the data aggregation process while saving energy. For this, the mechanism uses a lightweight fragile watermarking technique without encryption to insure the authentication and the integrity of the sensed data while saving the energy. The links between the sensor nodes and the aggregation nodes, and also the links between the aggregation nodes and the base station are secured by using the watermarking mechanism.

Survey on secure communication protocols for the Internet of Things

The Internet of Things or “IoT” defines a highly interconnected network of heterogeneous devices where all kinds of communications seem to be possible, even unauthorized ones. As a result, the security requirement for such network becomes critical whilst common standard Internet security protocols are recognized as unusable in this type of networks, particularly due to some classes of IoT devices with constrained resources. The document discusses the applicability and limitations of existing IP-based Internet security protocols and other security protocols used in wireless sensor networks, which are potentially suitable in the context of IoT. The analysis of these protocols is discussed based on a taxonomy focusing on the key distribution mechanism.