Key Establishment Mechanism Research Articles

IoT Device-to-Cloud Continuous Authentication using Lightweight Key Establishment Mechanism

Cloud computing is an important component for the success of the Internet of Things (IoT). IoT devices generate massive amounts of data, and cloud computing provides the necessary infrastructure to store, process, and analyze this data. The IoT environment is heterogeneous and connects billions of devices, making it a high-value target for attackers. Impersonation attacks and denial-of-service attacks (DoS) are two common threats that can compromise the availability and security of IoT devices. Continuous authentication is a technique that can help mitigate the risk of session hijacking and unauthorized access to IoT devices. While many existing continuous authentication schemes focus on cloud-to-device authentication, it is also important to authenticate devices themselves, as a compromised device can put the entire system at risk. This research proposes a solution for a secure cloud-to-device continuous authentication protocol that relies on devices' features (such as token, battery). Continuous authentication has been introduced as a solution to the problems related to static authentication. The protocol considers the software and hardware limitations of smart IoT devices by using hash function lightweight cryptography.

Design and Testbed Experiments of User Authentication and Key Establishment Mechanism for Smart Healthcare Cyber Physical Systems

Smart healthcare technologies transform the traditional healthcare system in all possible ways. Smart healthcare has enormous number of benefits over the traditional system. However, at the same time, it also suffers from some healthcare data security and privacy related issues as the potential Internet attackers may get access to the sensitive healthcare through the deployment of various kinds of attacks. To mitigate these issues, in this paper, a new lightweight remote user authentication and key establishment scheme (in short, UAKM-SH) has been proposed by making the use of lightweight cryptographic operations. The security analysis of UAKM-SH is conducted to prove its robustness against various possible attacks. A detailed comparative study among the proposed UAKM-SH and other existing schemes shows that UAKM-SH performs better in terms of computation cost, communication cost, and the offered security and functionality features. Finally, the testbed implementation of UAKM-SH is given to observe its behavior in the real time scenario.

A secure elliptic curve based anonymous authentication and key establishment mechanism for IoT and cloud

A secure elliptic curve based anonymous authentication and key establishment mechanism for IoT and cloud

ACM-SH: An Efficient Access Control and Key Establishment Mechanism for Sustainable Smart Healthcare

Sustainable smart healthcare applications are those in which health services can be provided to remotely located patients through the Internet without placing extra burden on environmental resources. They should be operated with minimum power consumption using biodegradable, recyclable, and environmentally friendly healthcare equipment and products. In an Internet of Medical Things (IoMT)-enabled sustainable smart healthcare environment, all the health services are capable of producing informative data whenever some raw information is provided as the input or are capable of performing work on their own with less intervention from humans. As a result, they provide great advantages over the traditional healthcare system. As sustainable smart healthcare devices are operated through the Internet, it is possible that they could be attacked by various hackers. To mitigate these issues, in this paper, we propose a new access control along with a key-establishment mechanism for a sustainable smart healthcare system. The results of the security analysis showed that the proposed scheme was highly robust against a variety of passive and active attacks. In comparison to existing competing schemes, the proposed scheme is lightweight, as well as delivers high security and additional functionality. Finally, a practical demonstration of the proposed scheme is provided to show its impact on the key network performance parameters.

Statistical inference attack against PHY-layer key extraction and countermeasures

The establishment of secure secret keys ahead of transmissions is one of the key issues in the field of information security. The security of traditional cryptographic secret key establishment mechanisms is seriously challenged by computing-intensive attacks, with the fast growth of high-performance computing. As an alternative, considerable efforts have been made to develop physical (PHY) layer security measures in recent years, such as link-signature-based (LSB) secret key extraction techniques. Those mechanisms have been believed secure, based on the fundamental assumption that wireless signals received at two locations are uncorrelated when separated by more than half a wavelength. However, this assumption does not hold in some circumstances under latest observations, rendering LSB key extraction mechanisms vulnerable to attacks. To address this problem, the formal theoretical analysis on channel correlations in both real indoor and outdoor environments is provided in this paper. Moreover, this paper proposes empirical statistical inference attacks (SIA) against LSB key extraction, whereby an adversary infers the signature of a target link. Consequently, the secret key extracted from that signature has been recovered by observing the surrounding links. In contrast to prior literature that assumes theoretical link-correlation models for the inference, our study does not make any assumption on link correlation. Instead, we employ machine learning (ML) methods for link inference based on empirically measured link signatures. We further propose a countermeasure against the SIAs, called forward-backward cooperative key extraction protocol with helpers (FBCH). In the FBCH, helpers (other trusted wireless nodes) are introduced to provide more randomness in the key extraction. Our experimental results have shown that the proposed inference methods are still quite effective even without making assumptions on link correlation. Furthermore, the effectiveness of the proposed FBCH protocol is validated by our experiment results.

Some results of development of cryptographic transformations schemes using non-abelian groups

Implementation of a successful attack on classical public key cryptosystems becomes more and more real with the advent of practical results in the implementation of Shor's and Grover's algorithms on quantum computers. Modern results in tackling the problem of building a quantum computer of sufficiently power justify the need to revise the existing approaches and determine the most effective in terms of solving problems of post-quantum cryptography. One of these promising research priorities is the study of the cryptosystems based on non-abelian groups.
 The problems of conjugacy search, membership search, and others are difficult to solve in the theory of non-abelian groups and are the basis for building provably secure public key cryptosystems. This paper gives an overview of the most frequently discussed algorithms using non-abelian groups: matrix groups braid groups, semi direct products, and algebraic erasers (AE). The analysis of the construction of encryption and decryption schemes, key establishment mechanisms is given. Many non-abelian group-based key establishment protocols are associated with the Diffie – Hellman (DH) protocol. The paper analyzes the properties of non-abelian group public key encryption schemes. Various cryptographic primitives using non-commutative groups as a basis for post-quantum schemes are considered.

PUF-RAKE: A PUF-Based Robust and Lightweight Authentication and Key Establishment Protocol

Physically unclonable functions (PUFs) bind a device's identity to its physical hardware and thus, can be employed for device identification, authentication and cryptographic key generation. However, PUFs are susceptible to modeling attacks if a number of PUFs’ challenge-response pairs (CRPs) are exposed to the adversary. Furthermore, many of the embedded devices requiring authentication and inter-device communication in a real-time environment/system have stringent resource and low latency requirements, and thus require a lightweight authentication and key establishment mechanism to quickly realize an authenticated and secure connection. We propose PUF-RAKE, a PUF-based lightweight, highly reliable authentication and key establishment scheme. The proposed scheme enhances the reliability of PUF as well as alleviates the resource constraints by employing error correction in the server instead of the device as well as removing cryptographic hashing required by earlier PUF-based protocols. The proposed PUF-RAKE is robust against masquerade, brute force, replay, and modeling attacks. In PUF-RAKE, we introduce an inexpensive yet secure stream authentication scheme inside the device which authenticates the server before the underlying PUF can be invoked. This prevents an adversary from brute forcing the device's PUF to acquire CRPs essentially locking out the device from unauthorized model generation. Additionally, we also introduce a lightweight CRP obfuscation mechanism involving XOR and shuffle operations. The security of PUF-RAKE has been formally verified. A prototype of the protocol has been implemented on two Xilinx Zynq 7000 system-on-chips with one present on Xilinx zc706 evaluation board and the other present on the Avnet Zedboard. Observations, security analysis and results verify that the PUF-RAKE is secure against a probabilistic polynomial time adversary under both the unauthenticated link and authenticated link adversarial models while providing ∼99% reliable authentication. In addition, PUF-RAKE provides a reduction of 60 and 72 percent for look-up tables (LUTs) and register count, respectively, in the programmable logic (PL) part of the Zynq 7000 as compared to a recently proposed approach while providing additional advantages.

Secure Key Establishment Mechanism for Smart Sensing System Based Robots Network.

The smart robot is playing an increasingly important role in the social economy, and multi-robot systems will be an important development in robotics. With smart sensing systems, the communications between sensors, actuators, and edge computing systems and robots are prone to be attacked due to the highly dynamic and distributed environment. Since smart robots are often distributed in open environments, as well as due to their limited hardware resources and security protection capabilities, the security requirements of their keys cannot be met with traditional key distribution algorithms. In this paper, we propose a new mechanism of key establishment based on high-order polynomials to ensure the safe key generation and key distribution. Experiments show that the key establishment mechanism proposed in this paper guarantees the security of keys; its storage cost and communication cost are smaller than state-of-the-art mechanisms; and it allows robot components to join and leave the network dynamically, which is more suitable for multi-robot systems.

LAKE-IoD: Lightweight Authenticated Key Exchange Protocol for the Internet of Drone Environment

A drone is an unmanned aerial vehicle, which is deployed in a particular Fly Zone (FZ), and used to collect crucial information from its surrounding environment to be transmitted to the server for further processing. Generally, a Mobile User (MU) is required to access the real-time information collected by the drone stationed in a specific FZ securely. Therefore, to ensure secure and reliable communications an Authenticated Key Exchange (AKE) protocol is imperative to the Internet of Drone (IoD) environment. An AKE scheme ensures only authentic MU to access IoD network resources. Upon successful authentication, MU and drone can set up a secret session key for secure communication in the future. This paper presents a novel Lightweight AKE Protocol for IoD Environment (LAKE-IoD), which first ensures the authenticity of MU and also renders session key establishment mechanism between MU and drone with the help of a server. LAKE-IoD is an AKE protocol, which is based on an authenticated encryption scheme AEGIS, hash function, and bit-wise XOR operation. Meticulous formal security verification by employing a software tool known as Scyther and informal security analysis demonstrates that LAKE-IoD is protected against different well-known active and passive security attacks. Additionally, Burrows-Abadi-Needham logic is applied to verify the logical completeness of LAKE-IoD. Furthermore, a comparison of LAKE-IoD with the related schemes shows that LAKE-IoD incurs less communication, computational and storage overhead.

Key Establishment Algorithm for Secure Cyber Physical System to Prevent Cyber Attacks

Extensive research effort is going on to contribute to the Cyber Physical system (CPS). It will create a physical system capable of computation, communication and sharing information between physical devices. Physical devices become smart devices because of CPS. CPS are engineered systems that are built with sensors, microcontrollers which performs computation, communication, control, process and analysis of physical objects. CPS playing important role in smart cities, home automations and other applications. Due to resource constraints like low processing power and low storage space there is a lack of standard security mechanism which can provide adequate security in CPS. In the research paper, we proposed Key establishment mechanism which prevents CPS from cyber-attacks. The goal of this research paper are six -folds: i) to give a detailed overview of cyber physical system. ii) To study architecture of CPS. iii) To study different attacks on CPS with attack points. iv)Application areas of CPS v) security threats in CPS vi) Key establishment algorithm to prevent cyber-attacks in CPS.

A Novel Authentication Management RFID Protocol Based on Elliptic Curve Cryptography

The existing RFID (Radio Frequency Identification) security protocol lacks the key establishment mechanism, assuming only that both parties of the authentication protocol have shared their respective session keys. However, key establishment is an integral part of the RFID security system. This article first introduces the elliptic curve related mathematical theory foundation. Then we establish the key negotiation mechanism, and analyze the correctness and rationality of the negotiation mechanism. Finally, we design the authentication protocol based on elliptic curve in mobile RFID system, analyze the protocol authentication process, and compare the security and performance with other protocols, which shows that the authentication protocol has more efficient performance and the ability to resist all kinds of attacks.

Elgamal Elliptic Curve Based Secure Communication Architecture for Microgrids

Microgrids play an important role in today’s power systems as the distributed generation is becoming increasingly common. They can operate in two possible modes: (i) standalone and (ii) grid-connected. The transitional state from standalone to grid-connected mode is very critical and requires the microgrid to be synchronized with the main grid. Thus, secure, reliable and trustworthy control and communication is utmost necessary to prevent out-of-sync connection which could severely damage the microgrid and/or the main grid. Existing solutions consume more resources and take long time to establish a secure connection. The objective of the proposed work is to reduce the connection establishment time by using efficient computational algorithms and save the resources. This paper proposes a secure authentication and key establishment mechanism for ensuring safe operation and control of the microgrids. The proposed approach uses the concept of Elgamal with slight modification. Private key of the sender is used instead of a random number. The proposed modification ensures the non repudiation. This paper also presents a system threat model along with security network architecture and evaluates the performance of proposed algorithm in protecting microgrid communication against man in the middle attacks and replay attacks that could delay the packets to damage the system and need to be detected. Mathematical modeling and simulation results show that the proposed algorithm performs better than the existing protocols in terms of connection establishment, resource consumption and security level.

A lossy channel aware parameterisation of a novel security protocol for wireless IP-enabled sensors

IP-enabled sensors can be globally addressable by any Internet-connected entity, and therefore, their protection presents different challenges than that of traditional sensors, as they are subject to any potential attacker in the Internet. For this reason, specific security protocols must be developed to address the security requirements of IP-enabled sensors. An interesting approach to achieve this aim is the Ladon security protocol, which allows resource-deprived devices to efficiently implement end-to-end authentication, authorisation and key establishment mechanisms. However, in so limited environments such as sensor networks, not only efficient protocols must be defined, but they must also be optimally parameterised. This paper constitutes a step forward in this direction. First, a state transition model of the Ladon protocol is presented to analytically describe its behaviour. Then, this model is used to select the most effective parameterisation of the protocol in terms of message retransmissions and execution of cryptographic operations. The obtained results show that the selected parameterisation allows maximising the probability of a successful secure session establishment, while keeping the overhead introduced by the protocol low. Additionally, the performance comparison carried out shows that Ladon outperforms alternative approaches to achieve the same objective in terms of message transmission and reception operations.

Evaluation of Secure Multi-Hop Node Authentication and Key Establishment Mechanisms for Wireless Sensor Networks

Designing secure authentication mechanisms in wireless sensor networks in order to associate a node to a secure network is not an easy task due to the limitations of this type of networks. In this paper, we propose different multi-hop node authentication protocols for wireless sensor networks. For each protocol, we provide a formal proof to verify the security of our proposals using Scyther, which is an automatic cryptographic protocols verification tool. We also provide implementation results in terms of execution time consumption obtained by real measurements on TelosB motes. These protocols offer different security mechanisms depending on the design of the protocol itself. Moreover, we evaluate the overhead of protection of each solution by studying the effect on execution time overhead of each protocol. Finally, we propose a mechanism to detect possible attack based on our evaluation results.

A dynamic key management scheme for dynamic wireless sensor networks

AbstractDynamic wireless sensor network (DWSN) is a group of mobile sensor nodes deployed in an intended area. Secure communication in DWSNs depends on the existence of an efficient key management scheme. Because of the movements of sensor nodes and unknown mobility pattern, dynamic key management is an important issue in such networks. In this paper, we propose a new key management scheme, which uses key pre‐distribution and post‐deployment key establishment mechanisms for DWSNs. The proposed approach ensures that the two communicating nodes share at least one common key. It also provides efficient ways for key generation and revocation as well as addition or deletion of mobile sensor nodes. Compared with the other key management schemes, which are designed for DWSNs, our simulation and analytical results demonstrate the efficiency of the proposed approach in terms of confidentiality, resilience, memory usage, energy consumption and overhead. Copyright © 2014 John Wiley & Sons, Ltd.

Enhancing secure access to sensor data with user privacy support

With the development of solutions like 6LoWPAN, the implementation of IP technology in sensor devices is already a reality. Therefore, sensors can be natively integrated in the Internet, becoming globally addressable by any other Internet-connected party. Despite the huge potential of this approach, it also gives place to new threats, being one of the most critical ones the effective protection of the information gathered by sensors from unauthorised remote access attempts. A suitable solution to address this issue is the Ladon security protocol, which provides resource-deprived devices with end-to-end authentication, authorisation and key establishment mechanisms. Once the critical security issue has been solved, additional concerns arise. Specially remarkable is the protection of user privacy in order to prevent potential eavesdroppers from tracking users’ access trends and obtaining behavioural patterns. In this regard, authentication and authorisation processes deserve an special consideration, since they imply conveying user identity-related information to the targeted services. In this paper, we present a privacy-enhanced Ladon protocol by integrating the original protocol with the PrivaKERB user privacy framework for Kerberos. Due to the severe resource limitations that characterise the targeted environments, a performance evaluation of the proposed solution is carried out in order to prove that it meets the performance requirements of the considered environments in terms of energy cost and additional delay for each secure session establishment. The obtained results show that privacy-enhanced Ladon is a secure and efficient solution to implement privacy-supporting authentication and authorisation processes in resource-deprived environments.

Key management approach for secure mobile open IPTV service

In mobile open Internet Protocol TV (IPTV) which is one of the major attracting technologies recently, the security is a key issue for reliable service, because the mobility and the openness in IPTV could cause much more vulnerabilities to various attacks compared with traditional IPTV services. In this paper, we propose an energy-efficient and secure channel group key establishment and rekeying management scheme for mobile open IPTV services. Our scheme provides the data authentication between an Evolved Node B (eNB) or a Base Station and the mobile devices for the security enhancement and efficiently rekeys the group key when the membership changes. Additionally, it proposes a pairwise key establishment mechanism for open IPTV services through eNBs. Our proposal can cope with the security vulnerability in mobile open IPTV services and guarantee the secure group key rekeying in addition to decreasing the storage and communication overhead.

A random key establishment scheme for multi-phase deployment in large-scale distributed sensor networks

Several symmetric-key distribution mechanisms are proposed in the literature, but most of them are not scalable or they are vulnerable to a small number of captured nodes. In this paper, we propose a new dynamic random key establishment mechanism in large-scale distributed sensor networks, which supports deployment of sensor nodes in multiple phases. In the existing random key distribution schemes, nodes do not refresh their own keys, and thus, the keys in their key rings remain static throughout the lifetime of the network. One good property of our dynamic key distribution scheme is that the already deployed nodes in a deployment phase refresh their own keys in key rings before another deployment phase occurs. The strength of the proposed scheme is that it provides high resilience against node capture as compared to that for the other existing random key distribution schemes. Through analysis and simulation results, we show that our scheme achieves better network performances as compared to those for the existing random key distribution schemes. Finally, we propose an extended version of our scheme for practical usefulness to support high network connectivity and resilience against node capture.

의료 센서 네트워크에서의 효율적인 전송 구조 및 Key Provisioning을 사용한 키 관리 기법 연구

유비쿼터스 기술의 발전과 함께 센서 네트워크는 다양한 분야에서 활용되고 있다. 그 중 특히 의료 분야는 중요한 응용 분야 중의 하나로 바디 센서 네트워크의 표준화 동향과 함께 관심이 집중되고 있다. 의료 센서 네트워크는 기존의 일반적인 환경의 센서 네트워크와는 다른 의료 환경만의 특징들을 가지고 있다. 따라서 본 논문에서는 이와 같은 특징들을 반영하여 계층적인 의료 센서 네트워크 구조를 제안하였고, 계층적인 구조를 바탕으로 하여 센싱 데이터 전송 방식을 소개하였다. 즉, 효율적인 센싱 데이터 전송을 위해서는 환자들의 요구 사항과 건강 상태를 고려하여 각 센서 노드들에게 우선 순위(Priority)와 경계값(Threshold Value)을 주었다. 이를 통해 클러스터 헤드에서 응급 데이터를 우선적으로 빠르게 베이스스테이션으로 전송하도록 하였다. 또한 이와 같은 구조와 전송 방식을 바탕으로 센서 네트워크를 위해 Eschenauer와 Gligor가 제안한 키 메커니즘을 기반으로 하여 새로운 키 관리 기법을 제안하였다. 이는 각 클러스터 헤드들이 높은 우선 순위를 갖는 응급 노드들에 대해서 이웃 클러스터로 응급 노드와의 키를 미리 전송해주는 Key Provisioning 방법을 사용하여 응급 노드들에 대해서 키 설립을 준비하도록 하여 키 설립이 보다 빠르게 이루어지도록 하였다. 이를 통해 키 설립 지연으로 인한 데이터 전송의 기다림 없이 바로 응급 노드들의 데이터를 클러스터 헤드로 전송할 수 있도록 한다. 이와 같은 계층적인 구조에서의 데이터 전송 방식과 이를 바탕으로 제안한 키 관리 기법은 수식 및 QualNet 시뮬레이터를 사용한 시뮬레이션을 통하여 네트워크 트래픽 오버헤드와 에너지 소모량을 분석하였으며, TmoteSKY 센서보드를 사용해 구현함으로써 그 효율성을 증명하고 실제 응용환경에서의 실현가능성을 입증하였다. According to the development of ubiquitous technologies, sensor networks is used in various area. In particular, medical field is one of the significant application areas using sensor networks, and recently it has come to be more important according to standardization of the body sensor networks technology. There are special characteristics of their own for medical sensor networks, which are different from the one of sensor networks for general application or environment. In this paper, we propose a hierarchical medical sensor networks structure considering own properties of medical applications, and also introduce transmission mechanism based on hierarchical structure. Our mechanism uses the priority and threshold value for medical sensor nodes considering patient's needs and health condition. Through this way Cluster head can transmit emergency data to the Base station rapidly. We also present the new key establishment mechanism based on key management mechanism which is proposed by L. Eschenauer and V. Gligor for our proposed structure and transmission mechanism. We use key provisioning for emergency nodes that have high priority based on patients' health condition. This mechanism guarantees the emergency nodes to establish the key and transmit the urgent message to the new cluster head more rapidly through preparing key establishment with key provisioning. We analyze the efficiency of our mechanism through comparing the amount of traffic and energy consumption with analysis and simulation with QualNet simulator. We also implemented our key management mechanism on TmoteSKY sensor board using TinyOS 2.0 and through this experiments we proved that the new mechanism could be actually utilized in network design.

센서네트워크에서 평면 그리드 기반의 키 선 분배 기법

무선 센서 네트워크에서는 센서 노드의 제한된 자원이 보안 기법을 디자인 하는데 많은 영향을 미치기 때문에 적은 자원을 요구하는 보안 연구가 주로 이루어지고 있다. 대칭키 암호는 키 선 분배를 필요로 하지만 요구하는 연산 량이 적기 때문에 센서 네트워크를 위한 보안 연구로 주목받고 있다. 키 선 분배는 전체 네트워크의 통신채널 보안을 위해서 노드를 배치하기 전에 키 또는 키의 재료를 각 노드에 할당하는 것이다. 이와 관련하여 다양한 연구가 이루어 졌지만 연결성과 탄력성은 아직 풀어야할 과제로 남아있다. 따라서 이 논문에서는 무선 센서 네트워크의 연결성 향상과 높은 탄력성을 제공하면서도 적은 자원을 요구하는 그리드 기반의 키 선 분배 기법을 보인다. 제안하는 기법은 평면 기반의 그리드를 이용하여 다항식을 할당하고 키를 생성한다. 제안하는 기법과 다른 키 선 분배 기법들의 네트워크 연결성, 자원의 사용량, 보안성의 비교 분석을 통하여 제안하는 기법의 효율성을 분석하였다. The security of wireless sensor networks is a challenging research area where the resources constraints are a bottleneck for any successful security design. Due to their computational feasibility, symmetric key algorithms that require key pre-distribution are more desirable for use in these networks. In the pre-distribution scheme, keys or keying materials are assigned to each node prior deployment to guarantee a secure communication within the entire network. Though several works are introduced on this issue, yet the connectivity and resiliency are imperfectly handled. In this paper, we revisit the grid based key pre-distribution scheme aiming to improve the connectivity, introduce a higher resiliency level, simplify the logic of key establishment and maintain same level of used of resources usage. The core of our modification relies on introducing the novel plat-based polynomial assignment and key establishment mechanism. To demonstrate the advantageous properties of our scheme over the revisited one, details of consumed resources, resulting connectivity, security and comparisons with relevant works are introduced.