Key Management Mechanism Research Articles

A Certificate-Less Distributed Key Management Scheme for Space Networks

The specificity and complexity of space networks render the traditional key management mechanism no longer applicable. The certificate-less-based distributed spatial network key management scheme proposed in this paper combines the characteristics of space networks, solving the problems regarding the difficulty of implementing centralized key management in space networks and the excessive overhead required for maintaining public key certificates by constructing a distributed key generation center and establishing strategies such as private key updates, master key component updates, and session key negotiation. This method also avoids the key escrow problem inherent in existing identity-based key management schemes. This scheme provides the DPKG construction method for space networks; designs the update strategy for the DPKG node’s master key sharing, providing a specific update algorithm; introduces the batch private key update mechanism; and uses the mapping function to evenly distribute the node’s update requests throughout the update time period, avoiding the problem of overly concentrated update requests. After analysis and simulation verification, it was proven that the scheme can meet the necessary security requirements, offering good stability and scalability.

Lattice-based multi-authority ciphertext-policy attribute-based searchable encryption with attribute revocation for cloud storage

Multi-authority attribute-based searchable encryption (MABSE) is an flexible and efficient way to securely share and search encrypted data. Compared with single-authority systems, MABSE has more complex access control policies and key management mechanism. However, most existing MABSE schemes rely on traditional number-theoretic assumptions, which maybe vulnerable to attack in the era of quantum-computers. Besides, the effective revocation of user attributes is also crucial in searchable encryption. To overcome these challenges, this paper proposes a new multi-authority ciphertext-policy attribute-based searchable encryption scheme for securely sharing encrypted data in the cloud. By calling Shamir’s threshold secret-sharing technology twice, we achieve co-management of the master key by attribute authorities and interactive generation of user private keys. Furthermore, the KUNodes algorithm is employed for attribute revocation, offering a mechanism to update private keys for non-revoked users. Compared to other schemes, MCP-ABSE-AR introduces multiple attribute authorities responsible for managing user attributes collectively. Additionally, it provides functionalities for keyword searching and attribute revocation. Finally, the proposed scheme is proved to be semantically secure under the decision learning with errors problem in the standard model.

Attribute-based key management for patient-centric and trusted data access in blockchain-enabled IoMT

Internet of Medical Things (IoMT) provides real-time data collection and access services to medical entities by connecting their devices to Internet. However, within such a complex architecture, achieving patient-centric data access still presents trustworthiness challenges of transmission security and usage reliability. Ciphertext-policy attribute-based encryption (CP-ABE) and blockchain are both the promising primitives that support patients with secure access control over their data. Nevertheless, both have their unique key management issues. In this paper, we propose a novel patient-centric and trusted data access (PCT-DA) system in blockchain-enabled IoMT. Firstly, we develop an online/offline encryption and verifiable outsourced decryption CP-ABE scheme to relieve the computation pressure on patients and users. Secondly, we design a flexible attribute-based key management mechanism to overcome the security drawbacks of encryption and attribute keys, such as single point of failure, key escrow and privacy leakage. Finally, we build a trusted integrity audit contract to guarantee the incentive fairness between patients and users in access services. Moreover, theoretical analyses prove that the PCT-DA system not only achieves confidentiality, integrity, traceability and forward/backward security, but also guarantees static security under random oracles. Simulation experiments indicate that our proposal reduces the time cost by approximately 14.10 seconds over state-of-the-art and is more practical in blockchain-enabled IoMT system.

Enhancing Network Security through Advanced Authentication and Key Management Mechanisms

This paper introduces the SEAKS-PKMv2 protocol, a robust security mechanism aimed at addressing vulnerabilities within the PKMv2 framework, particularly focusing on mutual authentication, key management, and encryption in mobile WiMAX networks. By integrating RSA-based and EAP-based authentication methods, SEAKS-PKMv2 establishes a secure environment that mitigates risks such as replay, man-in-the-middle and interleaving attacks. The protocol adopts a distributed authentication and localized key management approach, facilitating efficient and secure network access and data transmission. Through simulation, we evaluate the SEAKS-PKMv2 protocol’s performance in terms of packet delivery ratio, overhead, processing time, and resilience against rogue relay station attacks. The findings demonstrate significant improvements in network security and efficiency, confirming the effectiveness of SEAKS-PKMv2 in enhancing the integrity and confidentiality of communications in distributed network settings.

Lightweight authenticated key management mechanism for enhanced data transmission in the Internet of Things framework

The Internet of Things (IoT) system makes it possible for different gadgets to connect to each other and send and receive data without any problems. But it’s not easy to make sure that the data being sent and received within this structure is safe and correct. A Lightweight Authenticated Key Management Mechanism (LAKMM) is suggested as a way to solve this problem. The goal of LAKMM is to improve the security of data transfer in IoT settings while reducing processing waste and resource use, which are important factors for IoT devices that don’t have a lot of resources. LAKMM’s most important parts are its fast key creation, sharing, and identification systems that are designed to work in IoT settings. LAKMM finds a good mix between security and speed by using small cryptographic primitives and speeded-up protocols. It also protects against common attacks like eavesdropping, hacking, and repeat attacks, making sure that the data being sent is kept private and secure. LAKMM also has features for dynamic key changes and revocations, which are important for keeping things safe in IoT settings where devices are always joining and leaving the network. We show that LAKMM works well at offering strong security with little extra work for computers by simulating and analyzing it. So, LAKMM looks like a good way to improve the security of data transfer in the IoT framework.

A practical and UC-secure decentralized key management and authentication scheme based on blockchain for VNDN

In Vehicular Named Data Networking (VNDN), most of the existing key management mechanisms still rely on the hierarchical key trust model or the Public Key Infrastructure (PKI), in which the centralized certificate authority is used as a Trusted Third Party (TTP) to provide a signature for the user?s public key. Thus, the TTP becomes vulnerable to attacks and maybe there exists a singlepoint failure problem. In addition, the in-network caching in the VNDN may incur a threat to the system and make it is vulnerable to the DoS attack caused by Interest flooding aimed at the Content-Store. To tackle these security issues, we firstly propose an efficient decentralized key management solution based on blockchain for VNDN. Secondly, based on the proposed key management scheme, a lightweight mutual authentication scheme and a key agreement protocol for V2X are respectively proposed in this paper. Finally, we analyze the security attributes of our solutions in the Universally Composable (UC) framework. Our analysis results show that our novel schemes can meet the security requirements of our solutions. In addition, our experimental results show our new schemes have highly efficient, lower computation and communication costs than other related schemes.

A Secured Data Storage in Cloud Computing by Using Block Design Based Key Agreement

Cloud computing has emerged as a dominant paradigm for storing and accessing data. In group data sharing scenarios, where multiple users collaborate and exchange sensitive information in the cloud, ensuring secure and efficient key agreement becomes crucial. This paper presents a comprehensive analysis of key agreement mechanisms for group data sharing in cloud computing environments. We explore various cryptographic techniques and protocols specifically designed for establishing secure communication channels among group members. The paper discusses the challenges associated with key agreement in the cloud, proposes potential solutions, and provides insights into the implementation and evaluation of such mechanisms. The proposed framework aims to protect data confidentiality, integrity, and availability, ensuring a robust and reliable cloud storage environment. We explore various cryptographic techniques, including encryption, key management, and authentication mechanisms, and discuss their application in securing cloud-based data storage. The framework addresses common security threats and provides guidelines for implementing a secure cloud storage solution.

Design of Robust Blockchain-Envisioned Authenticated Key Management Mechanism for Smart Healthcare Applications

Design of Robust Blockchain-Envisioned Authenticated Key Management Mechanism for Smart Healthcare Applications

Hierarchical Access Control in Cloud Computing

Access control is an essential security component of cloud computing, and hierarchical access management is of particular interest because different access privileges are granted in practice. As a solution to versatile and fine-grained hierarchical access control in cloud computing, this paper also presents a hierarchical key assignment scheme based on linear geometry. The encryption key of each class in the hierarchy is connected with a private vector and a public vector in our scheme, and the inner product of an ancestor class's private vector as well as the public variable of its decedent’s class could be used to deduce the encryption method of that descendant class. The proposed scheme is among the direct access strategies on hierarchical access control, which also means so each class at a higher level can straight derive this same encryption key of its decedent’s class without and need to iterate. In furthermore to this basic hierarchy key derivation, we propose a dynamic key management mechanism to handle possible changes in the hierarchy efficiently. Under the assumption of pseudo - random number functions, our scheme requires only light computations over a finite field by providing strong key in-distinguishability. Furthermore, the simulation demonstrates that our scheme maximises the trade-off among computation consumption as well as storage space.

Efficient Key Management Mechanism with Trusted Gateways for Wireless Mesh Networks

Securing wireless mesh networks (WMNs) is a crucial issue due to its intrinsic characteristics. Several endangered features might emerge due to the exposure of the networks to a diversity of medium access control (MAC) layers such as distributed denial of service (DDoS) attacks, false reply attacks, and other identity attacks. Against these attacks, the determination of existing techniques is insufficient to ensure the complete security solutions to protect the backbone network at multiple levels. As a result, effective, scalable, and integrated security solutions for WMNs are required. In WMNs, protecting legitimate gateway nodes and internal mesh routers against malicious attacks at the MAC layer remains a difficult problem. Our proposed trust-based security mechanism includes distributed authentication and deauthentication algorithms that validates backbone mesh routers as well as gateway nodes. Particularly, this proposed model targets DDoS attacks in the network. The proposed DDoS attack prevention mechanism (DAPM) uses distributed authentication and deauthentication algorithms to build trusted group heads for managing secure data communication in the network. Our research and practical results show that the proposed mechanism decreases the severity of malicious nodes and strengthens the security compared to existing centralized schemes such as digital signature authentication (DSA-Mesh, MENSA, Mobisec, and AHKM). The experimental solutions show the significance of the proposed work with 10% to 12% of better performance than the existing techniques.

Emotional Management of Healthcare Professionals in Palliative Care Settings

Palliative care has developed in Russia since the 1990s as an adopted Western institutional form within the ideological framework of a 'good death,' which suggests a holistic approach to patient suffering. The development of palliative care was not linear and has received systematic governmental support only over the last ten years. Psychological care and quality of life were only legally included in palliative care in 2019. As a consequence of the existing structural constraints in most organizations, all of the emotional labour is done by medical professionals often lacking training in the management of emotions. In this case, a key role is played by the leaders of the organization. The main objective of this work is to demonstrate how the management of emotions at the level of personal interactions is connected with the management of emotions at the organizational level. Emotion management in palliative care settings is analysed based on empirical evidence collected during the periods 2018–2019 and 2020–2021. During the research thirty-four interviews with specialists in the field of palliative care were collected. Materials are analysed through dramatic and cultural theories of emotions and theories of rituals. Key emotion management mechanisms in palliative care settings at the organizational level include team building and coordination; maintenance of collective emotions and collective solidarity; and the management of the space of the organization. At the individual level, emotional labour is carried out in accordance with the ideological framework of a 'good death.' Emotional labour is most often done through deep performance and is aimed at overcoming negative emotions such as anger, fear, or disgust. Management of emotions at the organizational level allows, first, to overcome the existing structural limitations; second, to adjust the volume and content of the emotional labour of employees.

An Efficient Key Management and Multi-Layered Security Framework for SCADA Systems

Supervisory Control and Data Acquisition (SCADA) networks play a vital role in industrial control systems. Industrial organizations perform operations remotely through SCADA systems to accelerate their processes. However, this enhancement in network capabilities comes at the cost of exposing the systems to cyber-attacks. Consequently, effective solutions are required to secure industrial infrastructure as cyber-attacks on SCADA systems can have severe financial and/or safety implications. Moreover, SCADA field devices are equipped with microcontrollers for processing information and have limited computational power and resources. This makes the deployment of sophisticated security features challenging. As a result, effective lightweight cryptography solutions are needed to strengthen the security of industrial plants against cyber threats. In this paper, we have proposed a multi-layered framework by combining both symmetric and asymmetric key cryptographic techniques to ensure high availability, integrity, confidentiality, authentication and scalability. Further, an efficient session key management mechanism is proposed by merging random number generation with a hashed message authentication code. Moreover, for each session, we have introduced three symmetric key cryptography techniques based on the concept of Vernam cipher and a pre-shared session key, namely, random prime number generator, prime counter, and hash chaining. The proposed scheme satisfies the SCADA requirements of real-time request response mechanism by supporting broadcast, multicast, and point to point communication.

Decentralized Access Control using Blockchain Technology for Application in Smart Farming

The application of the Internet of Things (IoT) plays a crucial role in the fourth industrial revolution. The sophistication of technology due to the integration of heterogenous smart devices open a new threat from various aspects. Access control is the first line of defence to ensure that IoT resources are secure by preventing illegitimate users from gaining access to these resources. However, access control mechanisms face the limitation of technology in large scale IoT deployments since they are based on a centralized architecture. Significant research concerning decentralized access control solutions for securing IoT resources using combined techniques, such as blockchain, have caught much research attention in recent years. Nevertheless, research for decentralized access control for application in smart farming domain remain as a gap. Thus, this study presented a structured literature review on 81 articles related to the field of access control in IoT and blockchain technology to understand the challenges of centralized access control in securing IoT resources. This study serves as a foundation for decentralized access control using blockchain technology and its application to ensure the IoT actuators and sensors security with the aim to be applied in smart farming. This paper was deliberated based on systematic literature review that was searched from four different database platforms between 2018 and 2021. This study mostly addresses the relevant techniques/approaches including blockchain technology, access control model, key management mechanism and the combination of all three methods. The possible impacts, gap, procedures and evaluation of the decentralized access control are highlighted along with major trends and challenges.

A secure and energy saving protocol for wireless sensor networks

The research domain for wireless sensor networks (WSN) has been extensively conducted due to innovative technologies and research directions that have come up addressing the usability of WSN under various schemes. This domain permits dependable tracking of a diversity of environments for both military and civil applications. The key management mechanism is a primary protocol for keeping the privacy and confidentiality of the data transmitted among different sensor nodes in WSNs. Since node's size is small; they are intrinsically limited by inadequate resources such as battery life-time and memory capacity. The proposed secure and energy saving protocol (SESP) for wireless sensor networks) has a significant impact on the overall network life-time and energy dissipation. To encrypt sent messsages, the SESP uses the public-key cryptography’s concept. It depends on sensor nodes' identities (IDs) to prevent the messages repeated; making security goals- authentication, confidentiality, integrity, availability, and freshness to be achieved. Finally, simulation results show that the proposed approach produced better energy consumption and network life-time compared to LEACH protocol; sensors are dead after 900 rounds in the proposed SESP protocol. While, in the low-energy adaptive clustering hierarchy (LEACH) scheme, the sensors are dead after 750 rounds.

Circular economy supply network management: A complex adaptive system

The circular economy is gaining momentum in political and academic agendas. However, little is empirically known about circular economy supply network configurations, dynamics and coordination mechanisms. In aiming to fill this theoretical and practical gap, this study employs a multiple case study of seven circular supply networks from different industries using coding, within- and cross-case analysis. As the study's main theoretical contribution, an innovative framework is proposed, characterizing circular economy supply network management as a complex adaptive system leading to three different configurations: a closed loop supply network, an open loop supply network and a combination of both, adding new industries' supply chains and nonlinear connections and resulting in a hybrid loop supply network. This framework is composed of three key elements, management mechanisms, the internal and external environment, and emergent properties, and three sets of propositions, which relate each of these key elements to different circular economy supply network management configurations that dynamically adapt to internal and external environment changes. The framework also introduces two types of leverage points, one upstream and another downstream, in that agents with different roles and positions might be responsible for coordinating or initiating the postconsumption product or byproduct physical reverse flow, merging sourcing and customer strategy. Managers and policy-makers could benefit from this framework, as it could help them make decisions on how to foster circular economy implementation, even amid lacking government incentives and regulation complexity.

Resource Allocation in NOMA-Based Self-Organizing Networks Using Stochastic Multi-Armed Bandits

To achieve better connectivity in future communication networks, the deployment of different types of access points (APs) is underway. APs are expected to be equipped with self-organizing capabilities to reduce costs. Moreover, due to the spectrum crunch, frequency reuse among the deployed APs is inevitable, exacerbating the problem of inter-cell interference (ICI). Therefore, ICI mitigation in self-organizing networks (SONs) is commonly identified as a key radio resource management mechanism to enhance performance. To this end, this paper proposes a novel solution for the uncoordinated channel and power allocation problems. Based on the multi-armed bandits (MAB) framework, the proposed technique does not require any communication between the APs. The case of varying channel rewards across APs is considered. In contrast to previous work on channel allocation using the MAB framework, APs are permitted to choose multiple channels for transmission. Moreover, non-orthogonal multiple access is used, allowing multiple APs to access each channel simultaneously. This results in an MAB model with varying channel rewards, multiple plays and non-zero reward on collision. The proposed algorithm has an expected regret in the order of <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</i> (log <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> T), with extensive numerical results revealing it significantly outperforms a well-known baseline algorithm in terms of energy efficiency.

Efficient Multi-linear Key Pairing Cryptosystem for Reliable Cloud-based Service Provisioning

Cloud computing has gained rapid growth in the development of different fields of science and engineering. However, due to the distributed nature of cloud computing, session key generation and establishment is the pressing issue. Session key management plays the utmost important role in the secure exchange of sensitive login credentials and transaction information. Moreover, conventional session key management mechanisms are inadequate and cannot be directly adopted in cloud-based environments. Hence, session key management is very much solely needed solution for reliable cloud-based service provisioning. In mutual authentication, bi-linear key pairing cryptosystem plays a critical role to generate and establish a session key. The existing mutual authentication schemes fail to support true mutual authentication in cloud-based environments as they are vulnerable to secret key leakage, perfect forward secrecy, and untraceability. To mitigate the effect of these attacks, this research develops an efficient multi-linear key pairing cryptosystem. In this cryptosystem, challenge-response messages are used for generating and establishing a one-time shared session key. Furthermore, the performance analysis of the proposed cryptosystem depicts a significant reduction of computation cost, authentication accuracy rates, and resistance to the aforementioned attacks.

A secure and efficient Internet of Things cloud encryption scheme with forensics investigation compatibility based on identity-based encryption

Data security is a challenge for end-users of cloud services as the users have no control over their data once it is transmitted to the cloud. A potentially corrupt cloud service provider can obtain the end-users’ data. Conventional PKI-based solutions are insufficient for large-scale cloud systems, considering efficiency, scalability, and security. In large-scale cloud systems, the key management requirements include scalable encryption, authentication, and non-repudiation services, as well as the ability to share files with different users and data recovery when the user keys of encrypted data are not accessible. Further requirements in cloud systems include the ability to provide the means for digital forensic investigations on encrypted data. Once data on the cloud is encrypted with a user’s key it becomes impossible to access by forensic investigation teams. In this regard, distributing the trust of key management into multiple authorities is desirable. In the literature, there is no available secure cloud storage system with secure and efficient Type-3 pairings, supporting Encryption-as-a-Service (EaaS) and multiple Public Key Generators (PKGs). This paper proposes an efficient Identity-based cryptography (IBC) architecture for secure cloud storage, named Secure Cloud Storage System (SCSS), which supports distributed key management and encryption mechanisms and support for multiple PKGs. During forensic investigations, the legal authorities will be able to use the multiple PKG mechanism for data access, while an account locking mechanism prevents a single authority to access user data due to trust distribution. We also demonstrate that, the IBC scheme used in SCSS has better performance compared to similar schemes in the literature. For the security levels of 128-bits and above, SCSS has better scalability compared to existing schemes, with respect to encryption and decryption operations. Since the decryption operation is frequently needed for forensic analysis, the improved scalability results in a streamlined forensic investigation process on the encrypted data in the cloud.

Key Distribution Strategy of Wireless Sensor Network Based on Multi-Hash Chain

Key management is the basis of the security mechanism for wireless sensor networks and services, and random key pre-distribution is the most effective key management mechanism at present. However, there is a potential challenge to most current random key pre-distribution strategies: it is difficult to achieve both ideal network security connectivity and network survivability. In this paper, we present a novel random key pre-distribution scheme based on the hash chain. By adjusting certain system parameters, such as the hash chain length, the number of common auxiliary nodes and the number of hash chains, a sensor node only need to preload a few of keys, making it possible to establish the pairwise key with high probability among its neighboring nodes. The proposed scheme can still maintain strong network survivability even if there are many compromised nodes. The theoretical analysis and simulation experiments show that the proposed scheme is not only effective and secure, but also scalable.

A lightweight key management scheme for key-escrow-free ECC-based CP-ABE for IoT healthcare systems

The rapid increase in the implementation of Internet of Things (IoT) solutions in diverse healthcare sectors raises the IoT in the healthcare market. The real-time health monitoring to manage the chronic diseases is likely to drive the demand of IoT in healthcare. Moreover, the enhancement in communication technologies like real-time data transmission has improved the patients’ confidence in managing the chronic disease and medication dosage. Although IoT in healthcare makes a positive impact on patients and healthcare providers, however, it gets the challenges like data security and privacy. One means of sustaining security in IoT based healthcare system is through key management and at the same time an effective security mechanism for outsourced data to obtain fine-grained access control is the Ciphertext Policy-Attribute Based Encryption (CP-ABE). However, the overhead of complex decryption operations and key-escrow problem of CP-ABE hinders its applicability in IoT. Hence, in this work, we design a lightweight key management mechanism for the CP-ABE scheme using Elliptic Curve Cryptography (ECC). The novelty in this scheme is that irrespective of the secret key generation by the semi-trusted authority (honest, but curious to know the secret information), it is not capable to decrypt any message using these keys until and unless it has an additional private key of the receiver. For a constraint environment like IoT, the applicability of CP-ABE has two major issues: complex decryption operations and key-escrow problem. Hence, in this paper, a lightweight CP-ABE scheme for IoT based health care system using ECC has been designed. The proposed key management mechanism in the CP-ABE scheme is key-escrow free as well as significantly reduces the decryption overhead of the data receiver. The performance analysis shows that the proposed scheme is more effective as compared to the existing competing schemes.