Lightweight Cryptographic Primitives Research Articles

Securely sharing outsourced IoT data: A secure access and privacy preserving keyword search scheme

The rapid progress in the field of IoT and its wide-ranging applications emphasize the criticality of robust security measures for effectively sharing, storing, and managing sensitive data generated by IoT devices. Regulations such as the Consumer Data Rights (CDR) highlight the need for the seamless sharing of sensitive data with authorized third parties while ensuring confidentiality and privacy. To enable such secure sharing, a data storage and sharing scheme should fulfill the following core requirements: (a) support multi-client data sharing settings, allowing IoT data owners to authorize multiple clients; (b) a dynamic storage environment permitting IoT owners to add or remove files with minimal privacy leak; (c) decentralized storage for distributing data across servers or Cloud Service Providers (CSPs) for greater security; and (d) efficient privilege revocation mechanism which incurs less computation and communication overhead. To address these requirements, we have proposed a novel keyword search scheme using computationally lightweight cryptographic primitives. Our scheme empowers IoT data owners to securely share, store and manage encrypted data in the CSPs, providing better security and privacy. We have provided formal security proof for our scheme as well as validated its efficiency via extensive experiments on the Docker platform. On a database of 12 million keyword/document pairs (with 105 documents and 103 keywords), our scheme took about 18 ms to return all matched documents.

Secure and lightweight message dissemination framework for internet of vehicles

AbstractThe Internet of Vehicles (IoV) revolutionizes vehicle communication in dynamic networks. Message dissemination in IoV involves sharing critical information for the safety and convenience of the IoV network. It is very crucial to secure message dissemination due to potential cyber‐attacks, traffic disruptions, and privacy breaches. Data integrity, authentication, and privacy are vital to maintaining trust and safety in the IoV network. This network consists of resource‐constrained IoV devices with limited resources due to the availability of embedded components in vehicular systems. Therefore, optimizing algorithms and protocols is crucial for efficient vehicle‐to‐everything (V2X) communication, enhancing safety and transportation efficiency. Solutions often include lightweight protocols and secure message exchange. This paper proposes a machine learning (ML) based secure and lightweight message dissemination framework for resource‐constrained IoV. First, we present an ML‐based threat classification model capable of effectively categorizing adversarial and nonadversarial data streams and delivering an optimized model with superior accuracy. Furthermore, we also propose a secure message dissemination scheme using lightweight cryptographic primitives, which significantly reduces computational, communication, and energy overhead. To validate the robustness of our proposed ML‐based secure and lightweight message dissemination framework, we evaluate it using various security parameters and performance measures such as computation cost, communication cost, energy cost, accuracy, precision, recall, and F1‐score. Our contributions promise to significantly enhance the security and efficiency of message dissemination in IoV environments and advance lightweight, secure, and reliable transportation systems for the future.

Physical Unclonable Function-Based Lightweight and Verifiable Data Stream Transmission for Industrial IoT

The deep integration of informatization and industrialization has resulted in an increasingly close connection between supervisory control and data acquisition (SCADA) systems and the Internet, leading to a growing number of new applications in industrial IoT. The boundaries of the SCADA system are monitored by industrial smart sensors, which only have limited security protection and face severe security threats. One of the major threats is that smart sensors are vulnerable to physical attacks because they are often installed in unsafe areas far from plant protection. Under this attack, the data of sensors can be easily tampered with, which may not only mislead the system with corrupted information but also cheat the system to make incorrect decisions. Moreover, since sensors are resource-constrained physical devices, complex and expensive encryption algorithms are not applicable. In this paper, we design a lightweight industrial smart sensor data stream integrity verification scheme based on physical unclonable function (PUF) for industrial IoT, which can protect the physical security of sensors and the integrity of data streams to ensure the secure transmission of industrial smart sensor data streams. We utilize PUF, fuzzy extractor and bit selection algorithm to generate stable PUF responses. A malicious attacker cannot extract the key information through the physical attack. In addition, we design a lightweight integrity verification algorithm with efficient key updating based on lightweight cryptographic primitives, making it suitable for resource-constrained physical devices. We perform the security analysis to demonstrate the security of the scheme to known security vulnerabilities. We implement the proposed scheme and evaluate the performance of our scheme with extensive experiments. The experimental results show that the proposed scheme is efficient in secret key generation and integrity verification and is superior to existing schemes in computational and communication efficiency.

Message Authentication and Provenance Verification for Industrial Control Systems

Successful attacks against industrial control systems (ICSs) often exploit insufficient checking mechanisms. While firewalls, intrusion detection systems, and similar appliances introduce essential checks, their efficacy depends on the attackers’ ability to bypass such middleboxes. We propose a provenance solution to enable the verification of an end-to-end message delivery path and the actions performed on a message. Fast and flexible provenance verification (F2-Pro) provides cryptographically verifiable evidence that a message has originated from a legitimate source and gone through the necessary checks before reaching its destination. F2-Prorelies on lightweight cryptographic primitives and flexibly supports various communication settings and protocols encountered in ICS thanks to its transparent, bump-in-the-wire design. We provide formal definitions and cryptographically prove F2-Pro’s security. For human interaction with ICS via a field service device, F2-Profeatures a multi-factor authentication mechanism that starts the provenance chain from a human user issuing commands. We compatibility tested F2-Proon a smart power grid testbed and reported a sub-millisecond latency overhead per communication hop using a modest ARM Cortex-A15 processor.

An efficient permutation approach for SbPN-based symmetric block ciphers

It is challenging to devise lightweight cryptographic primitives efficient in both hardware and software that can provide an optimum level of security to diverse Internet of Things applications running on low-end constrained devices. Therefore, an efficient hardware design approach that requires some specific hardware resource may not be efficient if implemented in software. Substitution bit Permutation Network based ciphers such as PRESENT and GIFT are efficient, lightweight cryptographic hardware design approaches. These ciphers introduce confusion and diffusion by employing a 4 × 4 static substitution box and bit permutations. The bit-wise permutation is realised by simple rerouting, which is most cost-effective to implement in hardware, resulting in negligible power consumption. However, this method is highly resource-consuming in software, particularly for large block-sized ciphers, with each single-bit permutation requiring multiple sub-operations. This paper proposes a novel software-based design approach for permutation operation in Substitution bit Permutation Network based ciphers using a bit-banding feature. The conventional permutation using bit rotation and the proposed approach have been implemented, analysed and compared for GIFT and PRESENT ciphers on ARM Cortex-M3-based LPC1768 development platform with KEIL MDK used as an Integrated Development Environment. The real-time performance comparison between conventional and the proposed approaches in terms of memory (RAM/ROM) footprint, power, energy and execution time has been carried out using ULINKpro and ULINKplus debug adapters for various code and speed optimisation scenarios. The proposed approach substantially reduces execution time, energy and power consumption for both PRESENT and GIFT ciphers, thus demonstrating the efficiency of the proposed method for Substitution bit Permutation Network based symmetric block ciphers.

Funshade: Function Secret Sharing for Two-Party Secure Thresholded Distance Evaluation

We propose a novel privacy-preserving, two-party computation of various distance metrics (e.g., Hamming distance, Scalar Product) followed by a comparison with a fixed threshold, which is known as one of the most useful and popular building blocks for many different applications including machine learning, biometric matching, etc. Our solution builds upon recent advances in function secret sharing and makes use of an optimized version of arithmetic secret sharing. Thanks to this combination, our new solution named Funshade is the first to require only one round of communication and two ring elements of communication in the online phase, outperforming all prior state-of-the-art schemes while relying on lightweight cryptographic primitives. Lastly, we implement our solution from scratch in portable C and expose it in Python, testifying its high performance by running secure biometric identification against a database of 1 million records in ~10 seconds with full correctness and 32-bit precision, without parallelization.

Privacy-Preserving Three-Factor Authentication Protocol for Wireless Sensor Networks Deployed in Agricultural Field

The agriculture is the backbone of economic system, and it plays an essential part in the survival of a nation’s prosperity. In addition to providing raw materials and food, it also offers numerous employment opportunities. Consequently, agriculture necessitates modern technology to increase productivity. In these circumstances, Wireless Sensor Networks (WSNs) are used to detect climatic parameters like light, humidity, carbon dioxide, acidity, soil moisture, and temperature in an agricultural field. However, the research that is being done at the moment is unable to circumvent the issue that safety and effectiveness cannot coexist. Several studies employ time-consuming cryptographic security structures, whereas the majority of lightweight systems are designed without reviewing certain security aspects like resistance to ephemeral secret leakage (ESL) attacks, perfect forward secrecy, and so on. According to our opinion, this issue may be overcome through the use of lightweight cryptographic primitives, paying particular attention to protocol weaknesses, and keeping in mind the ever-changing security needs of individuals. We present an extensive lightweight three-factor authentication protocol with diverse security criteria, along with the adaptive privacy preservation, that is suited for user-friendly situation in the WSN enviroment. This is accomplished by removing all extraneous cryptographic structures. It has been illustrated that proposed protocol is much better in terms of the privacy and security aspects via the usage of security aspects, proof of the real-or-random (ROR) model, protocols of internet security, and applications that are subjected to experimental validation utilizing automated validation. and comparison with other protocols’ security aspects. The performance analysis shows how superior our proposed protocol is to other competing protocols in terms of communication and computational overheads, with respective efficiencies of 53% and 39%. Moreover, using the ROR model reveals that this study has benefits in performance compared with other competing research.

Fast Novel Efficient S-Boxes with Expanded DNA Codes

IoT is one of the most popular technologies in recent years due to the interconnection of various infrastructures, physical devices, and software. To guarantee the security of Internet of Things (IoT) pervasiveness, lightweight cryptographic solutions are needed and this requires lightweight cryptographic primitives. The choice of S-box in light block ciphers plays an important role in characterizing the security-performance trade-off. The choice of the 4 × 4 S-box for the lightweight constructions results in compact hardware, speeding up the computational capability of the security algorithm unlike the 8 × 8 S-box. This work presents efficient algebraic S-boxes for a fast image cryptosystem based on a strong nonlinear function which is expanded by a biological technique depending on DNA. The robustness of the proposed S-boxes is analysed and tested against various standard attack criteria such as interpolation attacks, avalanche effect, and nonlinearity. The great advantage of introducing S-boxes is that its DSAC is the ideal value which is equal to zero. Also, other tests executed on these S-boxes guaranteed its robustness and excellent security performance. Moreover, the experiments are applied with full description in two different modes; RGB and gray images. The results of all tests proved to have fast and strong effective S-boxes.

Provably Secure and Lightweight Patient Monitoring Protocol for Wireless Body Area Network in IoHT.

As one of the important applications of Internet of Health Things (IoHT) technology in the field of healthcare, wireless body area network (WBAN) has been widely used in medical therapy, and it can not only monitor and record physiological information but also transmit the data collected by sensor devices to the server in time. However, due to the unreliability and vulnerability of wireless network communication, as well as the limited storage and computing resources of sensor nodes in WBAN, a lot of authentication protocols for WBAN have been devised. In 2021, Alzahrani et al. designed an anonymous medical monitoring protocol, which uses lightweight cryptographic primitives for WBAN. However, we find that their protocol is defenseless to off-line identity guessing attacks, known-key attacks, and stolen-verifier attacks and has no perfect forward secrecy. Therefore, a patient monitoring protocol for WBAN in IoHT is proposed. We use security proof under the random oracle model (ROM) and automatic verification tool ProVerif to demonstrate that our protocol is secure. According to comparisons with related protocols, our protocol can achieve both high computational efficiency and security.

Lightweight and efficient privacy‐preserving mutual authentication scheme to secure Internet of Things‐based smart healthcare

AbstractIn recent years, Internet of Things (IoT) technology has been adopted in numerous application areas, such as healthcare, agriculture, industrial automation, and many more. The use of IoT and other technologies like cloud computing and machine learning has made the modern healthcare system to be smart, automated, and efficient. However, the continuous proliferation of cyber‐attacks on IoT devices has increased IoT challenges like data security, privacy protection, authentication, and so forth. In smart healthcare systems, due to the lack of authentication protocols, attackers can undermine the availability, confidentiality, and integrity of both smart healthcare devices and data, which can be life‐threatening in some situations. In this article, a privacy‐preserving mutual authentication scheme for IoT‐enabled healthcare systems is proposed to achieve lightweight and effective authentication of network devices. To support the processing capabilities of the IoT devices, this proposed authentication scheme is designed using lightweight cryptographic primitives, namely XOR, concatenation, and hash operation. The proposed scheme can establish a secure session between an authorized device and a gateway, and prevent unauthorized devices from getting access to healthcare systems. The security analysis and performance analysis assess the proposed authentication technique's effectiveness over existing well‐known schemes.

Securely Outsourcing Neural Network Inference to the Cloud With Lightweight Techniques

Neural network (NN) inference services enrich many applications, like image classification, object recognition, facial verification, and more. These NN inference services are increasingly becoming an essential offering from cloud computing providers, where end-users’ data are offloaded to the cloud for inference under a customized model. However, current cloud-based inference services operate on clear inputs and NN models, raising paramount privacy concerns. Individual user data may contain private information that should always remain confidential. Meanwhile, the NN model is deemed proprietary to the model owner as model training requires substantial resources. In this article, we present, tailor, and evaluate <monospace>Sonic</monospace> , a lightweight secure NN inference service delegated in the cloud. <monospace>Sonic</monospace> leverages the cloud computing paradigm to fully outsource the secure inference, freeing end devices and model owners from being actively online for assistance. <monospace>Sonic</monospace> guards both user input and model privacy along the whole service flow. We design a series of secure and efficient NN layer functions purely using lightweight cryptographic primitives. Extensive evaluations demonstrate that <monospace>Sonic</monospace> achieves up to <inline-formula><tex-math notation="LaTeX">$60\times$</tex-math></inline-formula> bandwidth saving in online inference compared to prior art.

PUF-based user access control scheme for IoT environment

A very important part of any software or hardware associated with the Internet of Things (IoT) is the User Access Control. User Access Control deals with the important security features like authenticating a legitimate user, authorizing a user, etc. A very effective and secure way to ensure the user access control is: three factor user access control. Some three factor user authentication schemes have been developed in the past, brief details regarding them can be found in further sections of the paper. In this paper, we propose a new three factor user access control scheme. Our proposed scheme is based on Mandal et. al.’s user access control scheme published recently. Our scheme involves the use of lightweight cryptographic primitives like Physically Unclonable Function (PUF), one way cryptographic hash function and bitwise exclusive OR (XOR) operations. PUFs make the scheme very lightweight and efficient as compared to other schemes of similar nature. The three factors used in our scheme are: registered device of the user, personal biometrics of the user and password of the user. We present the informal security analysis to show that our scheme is safe from several known attacks.

SAMPARK: Secure and lightweight communication protocols for smart parking management

Many vehicles on the road create significant problems, like parking, traffic congestion, fuel/energy consumption, and so on. Specifically, finding an appropriate parking spot is challenging for vehicle users while moving. Renting private parking spots is worthwhile using information and communications technology to solve parking challenges and offers mutual benefits to vehicle users and parking spot owners. However, security and privacy are prime concerns, as unknown vehicle users use private parking spots. The existing parking schemes are vulnerable to important security and privacy attributes and also inefficient due to high computational costs.We propose secure and lightweight communication protocols for smart parking management (named as SAMPARK) using lightweight cryptographic primitives, (i) to send available parking information and (ii) to reserve a parking spot ahead of time. Security proofs are discussed based on the random oracle model to confirm the security robustness of SAMPARK, considering vital vehicular communication attacks for security analysis. The test-bed results (on Raspberry Pi 3B+) show that the SAMPARK is relatively efficient in computation time, storage cost, and communication overhead.

EV-Auth: Lightweight Authentication Protocol Suite for Dynamic Charging System of Electric Vehicles With Seamless Handover

Electric vehicle adoption has accelerated globally, necessitating the development of an efficient charging technology. Static and partially dynamic charging are currently in use, but such types of charging reduce vehicles’ ability to stand charge, contributing to range anxiety. Dynamic charging of electric vehicles will be a promising technology in the near future, allowing an electric vehicle to charge by itself while in motion. However, assessing the security risks before enabling dynamic charging is mandatory, with authentication being a necessary step. Hence, a protocol suite EV-Auth is proposed for communicating entities in a dynamic charging system capable of mutual authentication and session key computation. To achieve practical capabilities, EV-Auth is built using lightweight cryptographic primitives. Additionally, it includes a unique feature known as seamless electric vehicle handover. The security of the proposed protocol suite is assessed both informally and formally using random oracle model and scyther tool. The performance analysis demonstrates that the proposed protocol suite satisfies the communication and computation time requirements.

Hardware Limitations of Lightweight Cryptographic Designs for IoT in Healthcare

Security is an important aspect of healthcare applications that employ Internet of Things (IoT) technology. More specifically, providing privacy and ensuring the confidentiality, integrity and authenticity of IoT-based designs are crucial in the health domain because the collected data are sensitive, and the continuous availability of the system is critical for the user’s wellbeing. However, the IoT consists of resource-constrained devices that increase the difficulty of implementing high-level-security schemes. Therefore, in the current paper, renowned lightweight cryptographic primitives and their most recent architecture, to the best of the authors’ knowledge, are investigated. Their security, architecture characteristics and overall hardware limitations are analyzed and collected in tables. Finally, all the algorithms are compared based on their effectiveness in securing healthcare applications, the utilized device and the overall implementation efficiency.

Survey on Lightweight Primitives and Protocols for RFID in Wireless Sensor Networks

The use of radio frequency identification (RFID) technologies is becoming widespread in all kind of wireless network-based applications. As expected, applications based on sensor networks, ad-hoc or mobile ad hoc networks (MANETs) can be highly benefited from the adoption of RFID solutions. There is a strong need to employ lightweight cryptographic primitives for many security applications because of the tight cost and constrained resource requirement of sensor based networks. This paper mainly focuses on the security analysis of lightweight protocols and algorithms proposed for the security of RFID systems. A large number of research solutions have been proposed to implement lightweight cryptographic primitives and protocols in sensor and RFID integration based resource constraint networks. In this work, an overview of the currently discussed lightweight primitives and their attributes has been done. These primitives and protocols have been compared based on gate equivalents (GEs), power, technology, strengths, weaknesses and attacks. Further, an integration of primitives and protocols is compared with the possibilities of their applications in practical scenarios.

Privacy-Preserving Fog Aggregation of Smart Grid Data Using Dynamic Differentially-Private Data Perturbation

The edge of the smart grid has a massive number of power and resource-constrained interconnected devices. Mainly, smart meters report power consumption data from consumer homes, industrial buildings, and other connected infrastructures. Multiple approaches were proposed in the literature to preserve the privacy of consumers by altering the data via additive noise, masking, or other data obfuscation techniques. A significant body of work in the literature employs differential privacy methods with constraining predefined parameters to achieve the optimal trade-off between privacy and utility of the data. However, billing accuracy can be degraded by using such additive noise techniques. We propose a differentially-private model that perturbs data by adding noise obtained from a virtual chargeable battery, while maintaining billing accuracy. Our model utilizes fog-computing data aggregation with lightweight cryptographic primitives to ensure the authenticity and confidentiality of data generated by low-end devices. We describe our differentially-private model with flexible constraints and a dynamic window algorithm to maintain the privacy-budget loss in infinitely generated time-series data. Our experimental results show a possible decrease in data perturbation error by 51.7% and 61.2% for smart meters and fog-computing data aggregators perturbed data, respectively, compared to the commonly used Gaussian mechanism.

Resource-Aware Cryptography: An Analysis of Lightweight Cryptographic Primitives

Resource-Aware Cryptography: An Analysis of Lightweight Cryptographic Primitives

Securing the future internet of things with post‐quantum cryptography

AbstractTraditional and lightweight cryptography primitives and protocols are insecure against quantum attacks. Thus, a real‐time application using traditional or lightweight cryptography primitives and protocols does not ensure full‐proof security. Post‐quantum cryptography is important for the internet of things (IoT) due to its security against quantum attacks. This paper offers a broad literature analysis of post‐quantum cryptography for IoT networks, including the challenges and research directions to adopt in real‐time applications. The work draws focus towards post‐quantum cryptosystems that are useful for resource‐constraint devices. Further, those quantum attacks are surveyed, which may occur over traditional and lightweight cryptographic primitives.

FogHA: An efficient handover authentication for mobile devices in fog computing

Fog computing is a new distributed computing paradigm that extends cloud services to the edge of the network, with features such as mobile support, location awareness, and low latency. Identity authentication in fog computing should support user mobility. For this reason, this paper proposes an anonymous handover authentication scheme for fog computing, FogHA, which achieves mutual authentication and key agreement between the adjacent fog node and the mobile device. FogHA only uses lightweight cryptographic primitives and eliminates redundant authentication messages with the cooperation of fog nodes, so it has high handover efficiency. The security of FogHA is proved by employing the formal security analysis under the Real-Or-Random (ROR) model. The informal security analysis shows that FogHA can resist known attacks. In addition, the comparison of communication and computation costs along with functionality features shows that the FogHA outperforms other existing schemes of the same type.