Membership Authentication Research Articles

Extremely Lightweight Constant-Round Membership-Authenticated Group Key Establishment for Resource-Constrained Smart Environments toward 5G

AbstractWith rapid development of next-generation mobile networks and communications (5G networks), group-oriented applications in resource-constrained smart environments (RSEs), such as smart homes and smart classrooms, have attracted great attentions. Due to the insecure communications between resource-constrained devices, secure group communications in RSE toward 5G face many challenges. In RSE toward 5G, lightweight communications and low computational overheads are crucial. Besides, the private tokens used to generate the group key are expected to be reused multiple times. However, the conventional frameworks for secure group communications cannot meet these requirements. A practical construction of extremely lightweight constant-round membership authenticated group key establishment framework is proposed in this paper for RSE toward 5G, which not only implements identity authentication among the members and group key establishment but also ensures extremely lightweight computation and communication costs by each group member. In our proposed scheme, the increase in the number of group members will not lead to a linear or logarithmic increase in the communication and calculation costs at the member side. Our framework also resists external and internal attacks and meets all the desirable security features. In this framework, the privacy of tokens can be well protected, so that they can be reused for multiple times. Therefore, our scheme significantly reduces the costs of communication and calculation, and it is more efficient compared with the related schemes in the literature. This proposal is fairly suitable for lightweight membership authentication and group key establishment in RSE toward 5G.

A decentralized lightweight authentication protocol under blockchain

AbstractWith the continuous development of blockchain technology, blockchain gradually becomes to play an important role in the fields of finance, medicine, and new energy. In the certification of the membership of the blockchain, a third‐party certificate authority (CA) is used for certification. Considering the centralized structure of CA, and it is difficult for users to evaluate the credibility of CA. A decentralized blockchain membership authentication scheme and a key agreement protocol based on the elliptic curve are proposed by us. The protocol effectively addresses the credibility and single point of failure problems of centralized CAs in the traditional model. Through analysis, our scheme can effectively perform user registration and membership authentication instead of CAs. The security and correctness of the protocol was also analyzed using the formal protocol analysis tool ProVerif and the Ck model. The key authentication protocol we proposed can resist a variety of attacks, and the computational time consumption and Communication costs are relatively low.

Construction of Lightweight Authenticated Joint Arithmetic Computation for 5G IoT Networks

Abstract The next generation of Internet of Things (IoT) networks and mobile communications (5G IoT networks) has the particularity of being heterogeneous, therefore, it has very strong ability to compute, store, etc. Group-oriented applications demonstrate its potential ability in 5G IoT networks. One of the main challenges for secure group-oriented applications (SGA) in 5G IoT networks is how to secure communication and computation among these heterogeneous devices. Conventional protocols are not suitable for SGA in 5G IoT networks since multiparty joint computation in this environment requires lightweight communication and computation overhead. Furthermore, the primary task of SGA is to securely transmit various types of jointly computing data. Hence, membership authentication and secure multiparty joint arithmetic computation become two fundamental security services in SGA for 5G IoT networks. The membership authentication allows communication entities to authenticate their communication partners and the multiparty joint computations allow a secret output to be shared among all communication entities. The multiparty joint computation result can be used to protect exchange information in the communication or be used as a result that all users jointly compute by using their secret inputs. A novel construction of computation/communications-efficient membership authenticated joint arithmetic computation is proposed in this paper for 5G IoT networks, which not only integrates the function of membership authentication and joint arithmetic computation but also realizes both computation and communication efficiency on each group member side. Our protocol is secure against inside attackers and outside attackers, and also meets all the described security goals. Meanwhile, in this construction the privacy of tokens can be well protected so tokens can be reused multiple times. This proposal is noninteractive and can be easily extended to joint arithmetic computation with any number of inputs. Hence, our design has more attraction for lightweight membership authenticated joint arithmetic computation in 5G IoT networks.

An HSS‐based robust and lightweight multiple group authentication for ITS towards 5G

The next generation of network communications (5G) has the particularity of being heterogeneous, which has different abilities with storage, computing and communication. Group communications is more and more popular for Intelligent Transportation Systems (ITS) in 5G since various smart devices have been constantly connected to ITS over the past decades. One of the main challenges faced by the group communications for ITS towards 5G is how to make the communications secure among these heterogeneous devices. Membership authentication is used to ensure that all users are legitimate group members in ITS communication systems towards 5G. A new type of authentication, called t-secure m-user n-group authentication scheme ((t, m, n) GAS), has been proposed in 2013. GAS is different from conventional peer-to-peer authentications which authenticate users one at a time. GAS can authenticate m users at once. GAS is specially designed for group communications which involve multiple users. Since then, extended research papers on group authentication have been published. A discrete-logarithm-based GAS with multiple authentications has been proposed in the original paper. In this paper, based on homomorphic secret sharing (HSS), a novel multiple group authentication is presented, which is more lightweight and robust than the original scheme. The security of the proposed scheme is unconditionally secure without any assumption. More importantly, since polynomial evaluations with a smaller modulus are needed in our proposed scheme, it is more efficient than the original scheme which needs modular exponentiations with a larger modulus, thus this design is more suitable for lightweight multiple group authentication in ITS towards 5G.

How not to secure wireless sensor networks: a plethora of insecure polynomial‐based key pre‐distribution schemes

Three closely related polynomial-based group key pre-distribution schemes have recently been proposed, aimed specifically at wireless sensor networks. The schemes enable any subset of a predefined set of sensor nodes to establish a shared secret key without any communications overhead. It is claimed that these schemes are both secure and lightweight, that is, making them particularly appropriate for network scenarios where nodes have limited computational and storage capabilities. Further studies have built on these schemes, for example, to propose secure routing protocols for wireless sensor networks. Unfortunately, as shown by the author, all three schemes are completely insecure; whilst the details of their operation vary, they share common weaknesses. In two cases, we show that an attacker equipped with the information built into just one sensor node can compute all possible group keys, including those for which the attacked node is not a member; this breaks a fundamental design objective. In the other case, an attacker equipped with the information built into at most two sensor nodes can compute all possible group keys. In the latter case, the attack can also be achieved by an attacker armed with the information from a single node together with a single group key to which this sensor node is not entitled. Repairing the schemes appears difficult, if not impossible. The existence of major flaws is not surprising given the complete absence of any rigorous proofs of security for the proposed schemes. A further recent work proposes a group membership authentication and key establishment scheme based on one of the three key pre-distribution schemes analysed here; as the author demonstrates, this scheme is also insecure, as the attack we describe on the corresponding pre-distribution scheme enables the authentication process to be compromised.

Non‐interactive integrated membership authentication and group arithmetic computation output for 5G sensor networks

Non‐interactive integrated membership authentication and group arithmetic computation output for 5G sensor networks

Lightweight Noninteractive Membership Authentication and Group Key Establishment for WSNs

Wireless sensor networks (WSNs) exhibit their potential capacity in the next generation of mobile communication networks and wireless systems (5G). Collected data in WSNs are different from most data transmitted in digital communication applications. Most collected data in WSNs contain only few bits of information. Conventional protocols are not suitable for WSNs since this environment needs more flexible and lightweight protocols for secure group communications. Hence, how to realize the mutual secure and lightweight communication is a big challenge for WSNs. User authentication and key establishment are two fundamental security services in secure communications for WSNs. In this paper, we propose a novel design which embeds the function of membership authentication and group key establishment in WSNs. By using an asymmetric bivariate polynomial, membership authentication and pairwise shared keys distribution are realized. Then, each member mixes his/her input with pairwise shared keys with other members and releases the encrypted value in a broadcast channel. After collecting all released values, each member can compute the group key efficiently. Our proposal is noninteractive and lightweight. As it enjoys low computation and communication costs compared with the state-of-the-art cryptographic solutions, this design is more suitable for efficient membership authentication and group key establishment in WSNs.

Fast Multivariate-Polynomial-Based Membership Authentication and Key Establishment for Secure Group Communications in WSN

The primary task of secure group communications in wireless sensor networks (WSNs) is to securely transmit various types of data, for example weather data, traffic data, etc. Collected data in WSNs is different from most data transmitted in digital communication applications. Most collected data in WSNs contains only few bits of information. Conventional protocols are not suitable for WSNs since WSNs need more fast and lightweight protocols for secure group communications. User authentication and key establishment are two fundamental security services in secure communications for WSNs. The user authentication allows communication entities to authenticate their communication partners and the key establishment allows a secret session key to be shared among all communication entities. The session key can be used to protect exchange information in the communication. Communication has been moved from traditional one-to-one communications to many-to-many communications, also called group communications. Traditional user authentication which authenticates one user at one time is no longer suitable for a group communication which involves multiple users. In this paper, we propose a protocol which provides both membership authentication and key establishment simultaneously for WSNs. However, all existing solutions can only provide either user authentication or key establishment separately. Furthermore, our proposed membership authentication has complexity O(n), where n is the number of users in a group communication, which is different from all existing user authentication schemes which are one-to-one authentications with complexity O(n 2 ).

TAW: Cost-Effective Threshold Authentication With Weights for Internet of Things

In the Internet of Things, based on the collaboration of sensing nodes, sensing data are collected and transmitted. The collaboration of sensing nodes also plays an important role in the safeguard of the Internet of Things. Owing to the limited ability of the single sensing node, the threshold authentication based on the collaboration of sensing nodes can improve the trust of security authentication of sensing nodes. The current threshold authentication schemes may require high-computational complexity, and more importantly, most of them are instantiated by membership authentication. It’s challenging to apply the current state of the arts to the case where sensing nodes with various weights join together to fulfill a relatively lightweight authentication. In this paper, we first design a communication key distribution scheme for sensing networks based on a symmetric operator. Using the permutation function, the scheme is able to generate characteristic sequences to improve the efficiency of key distribution in sensing networks. In addition, we propose a threshold authentication scheme based on weights, in which the higher weight represents the more important role in authentication. Our authentication scheme only requires lightweight operations, so that, it is extremely friendly to the IoT nodes with restricted computation power. The security analysis and the case verification demonstrate that our novel authentication protects IoT nodes without yielding significantly computational burden to the nodes.

Anonymous and Unlinkable Membership Authentication with Illegal Privilege Transfer Detection

Anonymous authentication schemes, mostly based on the notion of group signatures, allow a group member to obtain membership from a server and gain access rights if the member can prove their authenticity to the verifier. However, existing authentication schemes are impractical because they neglect to provide an exclusive verification of the blacklist. In addition, the schemes are unaware of malicious members who are involved in privilege transferring. In this paper, a novel membership authentication scheme providing detection of membership transfer and proof of membership exclusiveness to the blacklist is proposed.

A New Transitively Closed Undirected Graph Authentication Scheme for Blockchain-Based Identity Management Systems

Blockchain can potentially be deployed in a wide range of applications due to its capability to ensure decentralization, transparency, and immutability. In this paper, we design a cryptographic membership authentication scheme (i.e., authenticating graph data) to support blockchain-based identity management systems (BIMS). Such a system is designed to bind a digital identity object to its real-world entity. Specifically, we introduce a new transitively closed undirected graph authentication (TCUGA) scheme, which only needs to use node signatures (e.g., certificates for identifying nodes). The trapdoor hash function used in our scheme allows the signer to efficiently update the certificates without the need to re-sign the nodes. In other words, our scheme is efficient even though the graph dynamically adds or deletes vertices and edges. Moreover, our proposal can efficiently provide a proof when the edge between two vertices does not exist, thus solving the existing intractability issue in transitive signature (the main tool for authenticating graph data). Finally, we prove the security of our proposed TCUGA in the standard model and evaluate its performance to show its feasibility for BIMS.

A Novel Threshold Cryptography with Membership Authentication and Key Establishment

Threshold cryptography has become one of most important tools in providing secure applications such as password protection, cloud computing, etc. Threshold cryptography splits a secret into multiple pieces in such a way that only with enough number (i.e., threshold) of pieces of secret can recover the secret and therefore enable the application; but with fewer than the threshold cannot recover the secret. Shamir’s \((t,n)\) threshold scheme based on a univariate polynomial is the most popular secret sharing scheme so far. The public-key based threshold cryptography which incorporates a public-key algorithm, such as digital signature or encryption scheme, with a secret sharing, called threshold signature/decryption scheme, has become an active research area. While implementing threshold cryptographic schemes over networks, it involves multiple users. All secure multi-user network applications need to have membership authentication and key establishment in prior of applications; otherwise attackers can participated in the threshold cryptographic applications without being detected. Membership authentication is used to ensure that all users are legitimate members. Key establishment is used to establish session keys among members and the session keys are used to protect exchange information in application. In this paper, we propose a novel design which embeds the function of membership authentication and key establishment in threshold cryptographic schemes. Tokens of members obtained during registration can be used for (a) membership authentication; (b) key establishment and (c) threshold cryptographic applications. However, all existing threshold cryptographic solutions need additional membership authentication and key establishment.

A Novel Design of Membership Authentication and Group Key Establishment Protocol

A new type of authentication, called group authentication, has been proposed recently which can authenticate all users belonging to the same group at once in a group communication. However, the group authentication can only detect the existence of nonmembers but cannot identify who are the nonmembers. Furthermore, in a group communication, it needs not only to authenticate memberships but also to establish a group key among all members. In this paper, we propose a novel design to provide both membership authentication and group key establishment. Our proposed membership authentication can not only detect nonmembers but also identify who are the nonmembers. We first propose a basic membership authentication and key establishment protocol which can only support one-time group communication. Then, we extend the basic protocol to support multiple group communications. Our design is unique since tokens of users issued by a group manager (GM) during registration are used for both membership authentication and group key establishment.

A Group Key based Security Model for Big Data System

Recently Big data is in the spotlight and several NoSQL systems have been appeared in order to process large scale data. Among them Cassandra provides high scalability and availability with internal cluster structure. However, it does not provide enough security functionalities, especially transferred messages between internal cluster nodes are easily exposed by outside adversaries. In this paper a group key based security model for Cassandra is proposed. Cluster membership authentication and message confidentiality is provided by using of the group key, and the key is efficiently updated by decentralized approach where the cluster is divided into several subgroups considering Cassandra structure. Our model contributes preventing Cassandra cluster from illegal outside access attempts.

Dynamic class imbalance learning for incremental LPSVM

Linear Proximal Support Vector Machines (LPSVMs), like decision trees, classic SVM, etc. are originally not equipped to handle drifting data streams that exhibit high and varying degrees of class imbalance. For online classification of data streams with imbalanced class distribution, we propose a dynamic class imbalance learning (DCIL) approach to incremental LPSVM (IncLPSVM) modeling. In doing so, we simplify a computationally non-renewable weighted LPSVM to several core matrices multiplying two simple weight coefficients. When data addition and/or retirement occurs, the proposed DCIL-IncLPSVM11Matlab source code is available at http://www.dmli.info/index.php/incremental-learning.html. accommodates newly presented class imbalance by a simple matrix and coefficient updating, meanwhile ensures no discriminative information lost throughout the learning process. Experiments on benchmark datasets indicate that the proposed DCIL-IncLPSVM outperforms classic IncSVM and IncLPSVM in terms of F-measure and G-mean metrics. Moreover, our application to online face membership authentication shows that the proposed DCIL-IncLPSVM remains effective in the presence of highly dynamic class imbalance, which usually poses serious problems to previous approaches.

Personalized mode transductive spanning SVM classification tree

Personalized transductive learning (PTL) builds a unique local model for classification of individual test samples and is therefore practically neighborhood dependant; i.e. a specific model is built in a subspace spanned by a set of samples adjacent to the test sample. While existing PTL methods usually define the neighborhood by a predefined (dis)similarity measure, this paper introduces a new concept of a knowledgeable neighborhood and a transductive Support Vector Machine (SVM) classification tree (t-SVMT) for PTL. The neighborhood of a test sample is constructed over the classification knowledge modelled by regional SVMs, and a set of such SVMs adjacent to the test sample is systematically aggregated into a t-SVMT. Compared to a regular SVM and other SVMTs, a t-SVMT, by virtue of the aggregation of SVMs, has an inherent superiority in classifying class-imbalanced datasets. The t-SVMT has also solved the over-fitting problem of all previous SVMTs since it aggregates neighborhood knowledge and thus significantly reduces the size of the SVM tree. The properties of the t-SVMT are evaluated through experiments on a synthetic dataset, eight bench-mark cancer diagnosis datasets, as well as a case study of face membership authentication.

Face Membership Authentication Using SVM Classification Tree Generated by Membership-Based LLE Data Partition

This paper presents a new membership authentication method by face classification using a support vector machine (SVM) classification tree, in which the size of membership group and the members in the membership group can be changed dynamically. Unlike our previous SVM ensemble-based method, which performed only one face classification in the whole feature space, the proposed method employed a divide and conquer strategy that first performs a recursive data partition by membership-based locally linear embedding (LLE) data clustering, then does the SVM classification in each partitioned feature subset. Our experimental results show that the proposed SVM tree not only keeps the good properties that the SVM ensemble method has, such as a good authentication accuracy and the robustness to the change of members, but also has a considerable improvement on the stability under the change of membership group size.

Membership authentication in the dynamic group by face classification using SVM ensemble

This paper presents a method for authenticating an individual’s membership in a dynamic group without revealing the individual’s identity and without restricting the group size and/or the members of the group. We treat the membership authentication as a two-class face classification problem to distinguish a small size set (membership) from its complementary set (non-membership) in the universal set. In the authentication, the false-positive error is the most critical. Fortunately, the error can be validly removed by using the support vector machine (SVM) ensemble, where each SVM acts as an independent membership/non-membership classifier and several SVMs are combined in a plurality voting scheme that chooses the classification made by more than the half of SVMs. For a good encoding of face images, the Gabor filtering, principal component analysis and linear discriminant analysis have been applied consecutively to the input face image for achieving effective representation, efficient reduction of data dimension and strong separation of different faces, respectively. Next, the SVM ensemble is applied to authenticate an input face image whether it is included in the membership group or not. Our experiment results show that the SVM ensemble has the ability to recognize non-membership and a stable robustness to cope with the variations of either different group sizes or different group members. Also, we still get a reasonable membership recognition rate in spite of the limited number of membership training data.

Authentication protocols for the broadband ISDN billing system

The broadband integrated services digital network (B-ISDN) offers a wide variety of services to its customers. From both provider's and user's perspective, a fair and flexible billing system is indispensable to the operation of B-ISDN. In this paper, we discuss different billing policies, and their corresponding authentication protocols, which can be used by the B-ISDN billing system. Flat rate and usage-based rate are two most frequently used billing policies. Because of the diversity of B-ISDN services, combining these two billing policies, along with priority pricing, is a feasible scheme for designing a B-ISDN billing system. The membership authentication protocol (MAP) and the personal authentication protocol (PAP) are proposed to support the authentication requirements of the flat rate and usage-based rate billing policies, respectively. The MAP applies the cipher block chaining (CBC) encryption in the two-party authentication protocol, while the PAP is a modified version of the station-to-station (STS) authentication protocol. Both protocols are designed in conjunction with a suggested key management method. Cryptanalysis shows that both the MAP and the PAP are very secure. Simulation results indicate that both protocols are efficient for providing mutual authentication. Together, these two protocols provide a good authentication mechanism to the B-ISDN billing system.