Key Establishment Scheme Research Articles

Secured lightweight authentication for 6LoWPANs in machine-to-machine communications

The development of machine-to-machine (M2M) technologies is becoming increasingly important in the rapidly growing domain of wireless sensor networks (WSNs) and the Internet of Things (IoT). Adopting IPv6 over 6LoWPANs (Low-Power Wireless Personal Area Networks) is instrumental in communicating across diverse domains within WSNs, albeit with its challenges. Particularly, resource limitations and security vulnerabilities remain significant concerns. 6LoWPAN-based M2M protocols that rely on authentication and key establishment schemes (AKE) often fall short due to inadequate security issues and excessive resource requirements. This paper addresses these challenges by introducing a secure and resource-efficient framework—Lightweight AKE for 6LoWPAN Nodes (LAKE-6LN). LAKE-6LN capitalizes on the clustering architecture's merits and contrasts conventional router-centric approaches. To ensure lightweight and efficient operation, it uses hash functions, XOR functions, and symmetric encryption techniques. Pseudo-identity, sequence tracking numbers, and secure parameters ensure privacy and protection against attacks, including traceability, perfect forward secrecy, ephemeral secret leakage, and secure the session key. An informal analysis of LAKE-6LN's security confirms that compliance with all essential security properties has been achieved. In addition, the framework's logical robustness and security analysis are rigorously verified using BAN logic, AVISPA, and Scyther tools. LAKE-6LN has demonstrated superior performance over related schemes, demonstrating a reduction in storage costs (by 33.33 % to 85.71 %), computational overhead (by 14.28 % to 95.97 %), communication overhead (by 16.12 % to 51.85 %), and energy consumption (by 22.04 % to 99.40 %). In our comparative analysis, LAKE-6LN demonstrates its resilience against various security threats, demonstrating its potential to secure 6LoWPAN networks in M2M.

PUF-Based Robust and Anonymous Authentication and Key Establishment Scheme for V2G Networks

PUF-Based Robust and Anonymous Authentication and Key Establishment Scheme for V2G Networks

Fog Computing for Data Security and Privacy in Health-Care System¬¬

Abstract: The application of the Internet of Things has been greatly expanded; meanwhile, real-time and efficient communication has become an important feature of the Internet of Things. However, the centralized characteristics of cloud computing cannot meet the needs of low latency and high computing efficiency. To solve these issues, we utilized fog computing which is a new distributed computing paradigm that extends cloud services to the edge of the network, with mobility and low latency. Nevertheless, fog computing also brings new security issues, especially identity authentication. Authentication and key exchange are significant challenges that need to be taken into consideration in fog computing. We proposed the architecture of the mutual authentication key establishment scheme based on elliptic curve cryptography for fog computing. After mutual authentication, the cloud server can transfer the remaining verification work to fog nodes. Fog nodes will be responsible for authenticating the device and distributing the established session key, thereby reducing the computational cost of the cloud server. After mutual authentication is completed, the cloud server, fog nodes, and devices can communicate with each other. The Security of the proposed scheme proved that it is strong enough against several attacks

Group Authentication and Key Establishment Scheme

Group Authentication and Key Establishment Scheme

Scenario-Adaptive Key Establishment Scheme for LoRa-enabled IoV Communications

Scenario-Adaptive Key Establishment Scheme for LoRa-enabled IoV Communications

Electrocardiogram Based Group Device Pairing for Wearables

The widespread usage of wearables to provide healthcare services prompts the need for secure group communication among multiple devices using group keys. Gait-based group key establishment schemes are either vulnerable to video attacks, or fail to offer a secure group key update mechanism when group device changes. In this paper, we present an electrocardiogram (ECG) signals based group device pairing protocol, which can strengthen the security and reduce the overhead of wearables. Specifically, we first design a robust and lightweight fuzzy extractor that supports secure and efficient group device association between wearables. Meanwhile, we propose Improved Martingale Randomness Extraction (IMRE) algorithm, which utilizes the trend of InterPulse Interval (IPI) from ECG signal to extract high-entropy keys. Then we present a membership management mechanism that enables group key dynamic update when group device changes. Finally, we simulate our protocol and evaluate the accuracy and efficiency by various experiments. The experimental results demonstrate that the proposed work is robust and efficient, and the threat model-based security analysis shows that the proposed protocol can prevent both active and passive attacks.

A puf-based three-party authentication key establishment scheme for fog-enabled smart home

With the rise of Internet of Things (IoT), the smart home is another emerging concept and application of IoT, where security and private data of devices are important. In this paper, fog computing is applied to the smart home environment, where fog can provide many smart features and services to the smart home. Fog computing has many advantages, such as low latency and real-time interaction. However, when fog computing is combined with smart home, it also faces some security threats: first, some fog nodes and smart home devices are deployed in public places, vulnerable to damage or theft by attackers, not considered fully trusted, and vulnerable to device loss/theft attacks, impersonation attacks, and message tampering attacks, etc. These threats can lead to adversaries controlling devices in the smart home or modifying messages to make smart home devices execute wrong commands, causing irreparable damage; Second, the smart home system should have good real-time interaction, and the authentication process using the low latency feature of fog computing should not be involved by the cloud. Considering these, it is necessary to design a secure and effective fog-enabled smart home authentication system that is secure against various known attacks, especially when the fog node is not fully trusted or the smart home device is captured as well. Finally, the authentication scheme should also be lightweight due to the limited resources of many smart home devices. To address these issues, this paper proposes a lightweight authentication scheme for the fog-enabled smart home system. It also employs a physical unclonable function to achieve mutual authentication among three parties: smart home devices, fog nodes and users. Formal security analysis under the Real-Or-Random model shows that this scheme is provably secure. And informal security analysis shows that our scheme is robust against various known attacks. At the same time, the proposed scheme requires less computation cost (8.239 ms) and is approximately 40% to 390% faster than existing related schemes. Although the communication cost is slightly higher (4512 bits), it is reasonable because the proposed scheme implements fog/gateway node compromised attack that has not been achieved by any other existing related schemes.

Design and Testbed Experiments of User Authentication and Key Establishment Mechanism for Smart Healthcare Cyber Physical Systems

Smart healthcare technologies transform the traditional healthcare system in all possible ways. Smart healthcare has enormous number of benefits over the traditional system. However, at the same time, it also suffers from some healthcare data security and privacy related issues as the potential Internet attackers may get access to the sensitive healthcare through the deployment of various kinds of attacks. To mitigate these issues, in this paper, a new lightweight remote user authentication and key establishment scheme (in short, UAKM-SH) has been proposed by making the use of lightweight cryptographic operations. The security analysis of UAKM-SH is conducted to prove its robustness against various possible attacks. A detailed comparative study among the proposed UAKM-SH and other existing schemes shows that UAKM-SH performs better in terms of computation cost, communication cost, and the offered security and functionality features. Finally, the testbed implementation of UAKM-SH is given to observe its behavior in the real time scenario.

A Practical Lightweight Anonymous Authentication and Key Establishment Scheme for Resource-Asymmetric Smart Environments

With the rapid developments of Internet of Things (IoT) technologies, the security of sensitive data has attracted more and more attention for many resource-asymmetric smart environments, such as smart home, smart agriculture and so on. The resource-asymmetry environment refers to the uneven distribution of resources on different devices side, which is specifically manifested as gateway side is resource-rich, user side and device side are resource-restricted. Hence, a secure and practical authentication key establishment scheme for such smart environments is urgently needed. Recently many researchers have designed authentication and key establishment schemes for security purpose, however most of them cannot consider the excess of gateway resources and guarantee the anonymity of user, and further, they are not suitable for resource-asymmetric smart environments because they are not lightweight enough in user side and smart device side. Due to the fact that Rabin cryptosystem has the large difference in time-consuming between encryption and decryption, it is extremely suitable for constructing authentication and key establishment scheme for resource-asymmetric smart environments. So, a new practical authentication and key establishment scheme based on the Rabin cryptosystem for resource-asymmetric smart environments is proposed, which can make better use of the advantages of abundant gateway resources and realize the lightweight operations on device side and user side, and at the same time can provide user anonymity. With Proverif and BAN logic, we can prove that our solution not only provides anonymity, but also satisfies all defined security features. Simultaneously, compared with latest similar protocols in computation cost and communication overhead, the results show that our scheme is more effective. Hence, our design has more attraction for authentication and key establishment scheme in resource-asymmetric smart environments.

Secure and Lightweight Authentication Protocol for Privacy Preserving Communications in Smart City Applications

A smart city is a concept that leverages technology to improve the quality of life for citizens, enhance sustainability, and streamline urban services. The goal of a smart city is to use data and technology to manage resources and assets efficiently, make informed decisions, and create a more livable and thriving city for its residents. Smart cities rely on a range of technologies including the Internet of Things (IoT), Artificial Intelligence (AI), big data analytics, and cloud computing to gather, process, and analyze data from various sources. The aim is to create a city that is more connected, responsive, and sustainable, and that provides its residents with a better quality of life, opportunities, and services. A secure and efficient message communication protocol for sensitive information and real-time communication is critical for the functioning of a smart city environment. The main findings of this paper are to develop a new authentication protocol that meets the specific requirements and constraints of smart city applications. The message communication between smart cities is conducted with the help of a gateway. The challenge in constructing a working, viable infrastructure for a smart city is to provide secure authentication for message communication between the user and gateway node in one network, and the gateway node of one network to the gateway node of the other network. The objective for doing research to develop an authentication protocol that ensures the privacy and security of data transmitted in smart city applications while maintaining a lightweight and efficient design. This paper proposes a secure authentication protocol and key establishment scheme for access to the application in smart cities to make feasible access through the IoT environment. The proposed protocol ensures the mutual authentication between user and gateways, and the security analysis shows that the proposed protocol is effective against energy consumption and have less computational cost. The performance of the proposed method is analyzed and tested using BAN Logic and AVISPA security verification to confirm the authenticity of the security protocol. We do compare with past studies of which our proposed method outperformed.

Radio Frequency Fingerprints vs. Physical Unclonable Functions - Are They Twins, Competitors, or Allies?

Privacy breaches and online frauds are grave concerns in pervasive computing. Device identification is the first line of defense to detect and stop fraud. Conventional device authentication schemes using software addresses as identities or static pre-programmed secret keys are vulnerable to tampering and memory attacks. This article reviews two emerging lightweight hardware-oriented solutions to avoid these problems, namely radio frequency fingerprint (RFF) identification and physical unclonable function (PUF) authentication. Their operating principles and protocols are first introduced, followed by a scrutiny of their common and distinctive features, and a discussion of the stumbling blocks in the way of their market adoption. Finally, we envisage a combined mutual authentication and key establishment scheme to shed light on their synergy.

Status report on the third round of the NIST post-quantum cryptography standardization process

In recent years, there has been steady progress in the creation of quantum computers. If large-scale quantum computers are implemented, they will threaten the security of many widely used public-key cryptosystems. Key-establishment schemes and digital signatures based on factorization, discrete logarithms, and elliptic curve cryptography will be most affected. Symmetric cryptographic primitives such as block ciphers and hash functions will be broken only slightly. As a result, there has been an intensification of research on finding public-key cryptosystems that would be secure against cryptanalysts with both quantum and classical computers. This area is often called post-quantum cryptography (PQC), or sometimes quantum-resistant cryptography. The goal is to design schemes that can be deployed in existing communication networks and protocols without significant changes. The National Institute of Standards and Technology is in the process of selecting one or more public-key cryptographic algorithms through an open competition. New public-key cryptography standards will define one or more additional digital signatures, public-key encryption, and key-establishment algorithms. It is assumed that these algorithms will be able to protect confidential information well in the near future, including after the advent of quantum computers. After three rounds of evaluation and analysis, NIST has selected the first algorithms that will be standardized as a result of the PQC standardization process. The purpose of this article is to review and analyze the state of NIST's post-quantum cryptography standardization evaluation and selection process. The article summarizes each of the 15 candidate algorithms from the third round and identifies the algorithms selected for standardization, as well as those that will continue to be evaluated in the fourth round of analysis. Although the third round is coming to an end and NIST will begin developing the first PQC standards, standardization efforts in this area will continue for some time. This should not be interpreted as meaning that users should wait to adopt post-quantum algorithms. NIST looks forward to the rapid implementation of these first standardized algorithms and will issue future guidance on the transition. The transition will undoubtedly have many complexities, and there will be challenges for some use cases such as IoT devices or certificate transparency.

SELWAK: A Secure and Efficient Lightweight and Anonymous Authentication and Key Establishment Scheme for IoT Based Vehicular Ad hoc Networks.

In recent decades, Vehicular Ad Hoc Networks (VANET) have emerged as a promising field that provides real-time communication between vehicles for comfortable driving and human safety. However, the Internet of Vehicles (IoV) platform faces some serious problems in the deployment of robust authentication mechanisms in resource-constrained environments and directly affects the efficiency of existing VANET schemes. Moreover, the security of the information becomes a critical issue over an open wireless access medium. In this paper, an efficient and secure lightweight anonymous mutual authentication and key establishment (SELWAK) for IoT-based VANETs is proposed. The proposed scheme requires two types of mutual authentication: V2V and V2R. In addition, SELWAK maintains secret keys for secure communication between Roadside Units (RSUs). The performance evaluation of SELWAK affirms that it is lightweight in terms of computational cost and communication overhead because SELWAK uses a bitwise Exclusive-OR operation and one-way hash functions. The formal and informal security analysis of SELWAK shows that it is robust against man-in-the-middle attacks, replay attacks, stolen verifier attacks, stolen OBU attacks, untraceability, impersonation attacks, and anonymity. Moreover, a formal security analysis is presented using the Real-or-Random (RoR) model.

An Ultra-Lightweight Data-Aggregation Scheme with Deep Learning Security for Smart Grid

Various smart meter data aggregation protocols have been developed in the literature to address the rising privacy threats against customers' energy consumption data. However, most of these protocols require a smart meter (installed at the consumer's end) to either maintain a secret key or to run an authenticated key establishment scheme for interacting with the aggregator. Both of these approaches create additional requirements for the system. To address this issue, this article first proposes a machine-learning-based ultra-light-weight data aggregation scheme for smart grids that does not require a secret key to be maintained for communicating with the aggregator. In particular, unlike existing data aggregation schemes, in the proposed data aggregation scheme, neither the server nor the smart meter needs to store any secret. Instead, for every round of data aggregation, each smart meter uses an embedded PUF for generating a unique random response for a given challenge. On the other hand, the server maintains a PUF model for each smart meter for producing the same random response. This unique secret key is used to ensure the privacy of the metering data. Next, we propose an optimized data aggregation scheme using collaborative learning to enhance the performance of the proposed scheme.

Highly Vectorized SIKE for AVX-512

It is generally accepted that a large-scale quantum computer would be capable to break any public-key cryptosystem used today, thereby posing a serious threat to the security of the Internet’s public-key infrastructure. The US National Institute of Standards and Technology (NIST) addresses this threat with an open process for the standardization of quantum-safe key establishment and signature schemes, which is now in the final phase of the evaluation of candidates. SIKE (an abbreviation of Supersingular Isogeny Key Encapsulation) is one of the alternate candidates under evaluation and distinguishes itself from other candidates due to relatively short key lengths and relatively high computing costs. In this paper, we analyze how the latest generation of Intel’s Advanced Vector Extensions (AVX), in particular AVX-512IFMA, can be used to minimize the latency (resp. maximize the hroughput) of the SIKE key encapsulation mechanism when executed on Ice Lake CPUs based on the Sunny Cove microarchitecture. We present various techniques to parallelize and speed up the base/extension field arithmetic, point arithmetic, and isogeny computations performed by SIKE. All these parallel processing techniques are combined in AvxSike, a highly optimized implementation of SIKE using Intel AVX-512IFMA instructions. Our experiments indicate that AvxSike instantiated with the SIKEp503 parameter set is approximately 1.5 times faster than the to-date best AVX-512IFMA-based SIKE software from the literature. When executed on an Intel Core i3-1005G1 CPU, AvxSike outperforms the x64 assembly implementation of SIKE contained in Microsoft’s SIDHv3.4 library by a factor of about 2.5 for key generation and decapsulation, while the encapsulation is even 3.2 times faster.

Comparative Analysis of Energy Costs of Asymmetric vs Symmetric Encryption-Based Security Applications

Public key algorithms are heavily used in many digital applications including key establishment schemes, secure messaging apps, and digital signature schemes in cryptocurrencies. Recent developments in the field of quantum computation have placed these algorithms at risk as they enable the implementation of more effective attacks to derive the secret key. Most notably Shor’s algorithm exponentially speeds up solving the factoring, discrete logarithm (DLP), and elliptic-curve discrete logarithm (ECDLP) problems. To address this challenge, NIST has initiated a process to develop and standardize a new quantum-resistant public-key cryptographic algorithm. However, asymmetric encryption schemes are known to be computationally intensive, hence energy demanding. The proliferation of energy-constrained internet of things devices, combined with the need to adopt higher complexity quantum resilient cryptographic algorithms, makes it more challenging to continue to use public-key algorithms for all applications. One approach to address these challenges is to adopt symmetric key systems, which are known to be more energy-efficient and more resilient to quantum computers-based attacks. This work performs a comprehensive comparison of energy costs between asymmetric and symmetric key schemes. This comparison is performed using two methods. The first approach uses the energy cost of data usage (ECDU) metric to evaluate the global energy costs associated with internet data usage. It was found that the annual energy consumed by applications associated with public-key cryptography globally is sufficient to provide electricity for 1000 UK households for a year. The second method uses an experimental technique based on constructing a small-scale network of wireless embedded devices. This is subsequently used to compare two key establishment schemes, symmetric and asymmetric, which allows for comparing the computation and communication costs of each solution in a controlled environment, and more importantly estimating the energy consumed by each device participating in the protocol. Our results show that a 58% saving in global energy costs of public key-based applications can be achieved by adopting symmetric key systems. It was also found that a 20% reduction of the energy consumed by a wireless device during a key agreement protocol, can be achieved if symmetric key encryption is used.

A Secure and LoRaWAN Compatible User Authentication Protocol for Critical Applications in the IoT Environment

Security and privacy are two main concerns in the critical applications in the Internet of Things environments. Long Range Wide Area Network (LoRaWAN) is a protocol, which effectively allows long-range communication for battery-constrained end devices in IoT environments, and it is accepted and used by individuals and industry. In order to facilitate the use of this technology and gain the trust of users, it is necessary to assure security and privacy for the information collected by end devices. The user authentication and key establishment protocols are very paramount in this regard. Although there are some authentication schemes in the literature, they could not be applied in the LoRaWAN networks. Thus, in this article, we introduce a new secure user authenticated key establishment scheme for LoRaWAN networks. The proposed scheme provides mutual authentication among participants, and it allows a user and an end device to establish a secure session key between themselves without trusting the network server unconditionally and completely. In order to prove that the proposed scheme is secure, we constructed formal proof employing the real-or-random model. Besides, we employed Proverif and automated validation of internet security protocols and applications tool to confirm that it satisfies authentication and security characteristics. Further, we show that our proposal is efficient with respect to computation, communication and storage costs in end devices. Eventually, we exhibit a practical demonstration of our proposal applying the NS2 simulator.

An efficient and authenticated key establishment scheme based on fog computing for healthcare system

An efficient and authenticated key establishment scheme based on fog computing for healthcare system

Batching CSIDH Group Actions using AVX-512

Commutative Supersingular Isogeny Diffie-Hellman (or CSIDH for short) is a recently-proposed post-quantum key establishment scheme that belongs to the family of isogeny-based cryptosystems. The CSIDH protocol is based on the action of an ideal class group on a set of supersingular elliptic curves and comes with some very attractive features, e.g. the ability to serve as a “drop-in” replacement for the standard elliptic curve Diffie-Hellman protocol. Unfortunately, the execution time of CSIDH is prohibitively high for many real-world applications, mainly due to the enormous computational cost of the underlying group action. Consequently, there is a strong demand for optimizations that increase the efficiency of the class group action evaluation, which is not only important for CSIDH, but also for related cryptosystems like the signature schemes CSI-FiSh and SeaSign. In this paper, we explore how the AVX-512 vector extensions (incl. AVX-512F and AVX-512IFMA) can be utilized to optimize constant-time evaluation of the CSIDH-512 class group action with the goal of, respectively, maximizing throughput and minimizing latency. We introduce different approaches for batching group actions and computing them in SIMD fashion on modern Intel processors. In particular, we present a hybrid batching technique that, when combined with optimized (8 × 1)-way prime-field arithmetic, increases the throughput by a factor of 3.64 compared to a state-of-the-art (non-vectorized) x64 implementation. On the other hand, vectorization in a 2-way fashion aimed to reduce latency makes our AVX-512 implementation of the group action evaluation about 1.54 times faster than the state-of-the-art. To the best of our knowledge, this paper is the first to demonstrate the high potential of using vector instructions to increase the throughput (resp. decrease the latency) of constant-time CSIDH.

Optimization of Keys Using Grey-Wolf Optimization for Secure Path Key Establishment Schemes in Wireless Sensor Networks

Optimization of Keys Using Grey-Wolf Optimization for Secure Path Key Establishment Schemes in Wireless Sensor Networks