Message Authentication Code Research Articles

Chaotic neural networks and farfalle construction based parallel keyed secure hash function

AbstractParallel computing of hash functions along with the security requirements have great advantage in order to reduce the time consumption and overhead of the CPU. In this article, a keyed hash function based on farfalle construction and chaotic neural networks (CNNs) is proposed, which generates a hash value with arbitrary (defined by user) length (eg, 256 and 512 bits). The proposed hash function has parallelism merit because it is built over farfalle construction which avoids the dependency between the blocks of a given message. Moreover, the proposed hash function is chaos based (ie, it relies on chaotic maps and CNNs which have non‐periodic behavior). The security analysis shows that the proposed hash function is robust and satisfies the properties of hash algorithms, such as random‐like (non‐periodic) behavior, ideal sensitivity to original message and secret key, one‐way property and optimal diffusion effect. The speed performance of the hash function is also analyzed and compared with a hash function which was built based on sponge construction and CNN, and compared with secure hash algorithm (SHA) variants like SHA‐2 and SHA‐3. The results have shown that the proposed hash function has lower time complexity and higher throughput especially with large size messages. Additionally, the proposed hash function has enough resistance to multiple attacks, such as collision attack, birthday attack, exhaustive key search attack, preimage and second preimage attacks, and meet‐in‐the‐middle attack. These advantages make it ideal to be used as a good collision‐resistant hash function.

An Area-Optimized and Power-Efficient CBC-PRESENT and HMAC-PHOTON

This paper introduces an area-optimized and power-efficient implementation of the Cipher Block Chaining (CBC) mode for an ultra-lightweight block cipher, PRESENT, and the Keyed-Hash Message Authentication Code (HMAC)-expanded PHOTON by using a feedback path for a single block in the scheme. The proposed scheme is designed, taped out, and integrated as a System-on-a-Chip (SoC) in a 65-nm CMOS process. An experimental analysis and comparison between a conventional implementation of CBC-PRESENT/HMAC-PHOTON with the proposed feedback basis is performed. The proposed CBC-PRESENT/HMAC-PHOTON has 128-bit plaintext/text and a 128-bit secret key, which have a gate count of 5683/20,698 and low power consumption of 1.03/2.62 mW with a throughput of 182.9/14.9 Mbps at the maximum clock frequency of 100 MHz, respectively. The overall improvement in area and power dissipation is 13/50.34% and 14.87/75.28% when compared to a conventional design.

Light Weight Authentication Scheme for Smart Home IoT Devices

In today’s world, the use of computer networks is everywhere, and to access the home network we use the Internet. IoT networks are the new range of these networks in which we try to connect different home appliances and try to give commands from a remote place. Access to any device over an insecure network invites various types of attacks. User authentication can be performed using some password or biometric technique. However, when it comes to authenticating a device, it becomes challenging to maintain data security over a secure network such as the Internet. Many encryptions and decryption algorithms assert confidentiality, and hash code or message authentication code MAC is used for authentication. Traditional cryptographic security methods are expensive in terms of computational resources such as memory, processing capacity, and power consumption. They are incompatible with the Internet of Things devices that have limited resources. Although automatic Device-to-Device communication enables new potential applications, the limited resources of the networks’ machines and devices impose various constraints. This paper proposes a home device authentication scheme when these are accessed from a remote place. An authentication device is used for the home network and controller device to control home appliances. Our scheme can prevent various attacks such as replay attacks, server spoofing, and man-in-the-middle attack. The proposed scheme maintains the confidentiality and authenticity of the user and devices in the network. At the same time, we check the system in a simulated environment, and the results show that the network’s performance does not degrade much in terms of delay, throughput, and energy consumed.

Model for Storing Tokens in Local Storage (Cookies) Using JSON Web Token (JWT) with HMAC (Hash-based Message Authentication Code) in E-Learning Systems

E-learning is a technology that may be used in the learning process to improve not only the distribution of learning materials but also the ability of learners to modify their abilities of various competencies contained in a database. A Web Service is used to integrate the data. Web Service is a set of standards and programming methods for sharing data between different software applications, distributing services over the internet that supports system interoperability. In this digital era, the system that will survive is one that can function on multiple platforms, and one of the options is to use web servicess. Data is exchanged in JSON format, and JSON Web Tokens are used for authentication security (JWT). The use of JWT for token-based authentication on web services can help overcome interoperability issues. JWT is stateless and allows for the inclusion of data in the token authorisation. JWT includes a number of algorithm possibilities, including HMAC. Overall, the adoption of HMAC outperforms the criteria of token generation time, token size, and token transfer speed. Storing JSON Web Token into local storage in the client browser using the HMAC algorithm has been presented in this paper. The proposed work has shown that JWTs do not need to be stored on the server but can be stored on the client browser side using local storage.

Hardware Implementation of Effective Framework for the Trade-off between Security and QoS in Wireless Sensor Networks

The trade-off between security and quality of service (QoS) in wireless networks has attracted great attention in recent years. This paper presents a hardware implementation of a novel framework for realizing the trade-off between security and QoS in wireless sensor networks (WSNs) regarding the hostility of the operating environment and the available resources of our objects. For evaluating the hostility of the operating environment, we developed an effective intrusion detection unit that sends an alarm signal to a control unit that also collects the data-carrying information about the available resources. As our work is concerned with WSNs, we focus on the power consumption of sensor nodes as the considered object resources. According to the collected data from the intrusion detection unit and resources status unit, the control unit can evaluate the situation of the object in the operating environment and sends control signals to a security unit to select the appropriate level of security among three levels (low, medium, and high) available in our developed framework. The three security levels consider different combinations of the cryptographic algorithms Hash-based Message Authentication Code (HMAC) and Advanced Encryption Standard (AES), with different key lengths, regarding the required security services (confidentiality, authentication and integrity) and available resources. To reinforce the QoS, we considered the advantages of hardware implementation in addition to maintaining the object resources. Our framework has been implemented using Field Programmable Gate Array (FPGA), Virtex-7 (xc7v585tffg1761–3), which helps in achieving reasonable performance with a maximum operating frequency of 206.838 MHz and throughput of 2.3 Gbps.

A cluster-based routing method with authentication capability in Vehicular Ad hoc Networks (VANETs)

Routing is challenging in vehicular ad hoc networks due to their features, such as high mobility of nodes and unstable wireless communication links. Therefore, it is an interesting issue for researchers. In addition, it is very important to design an authentication mechanism between the source node and the destination node because these networks are exposed to many attacks due to their features mentioned above. In this paper, we present a fuzzy logic-based routing method with authentication capability in vehicular ad hoc networks. The proposed routing method has three phases: clustering phase, routing phase between cluster head nodes, and authentication phase. In the first phase, vehicles are clustered using an efficient scheme. In the proposed method, we define two types of data packets: immediate and ordinary. Various data packets have different route discovery processes that are described in Phase 2. Note that any data packet type is divided into two groups: simple and secure. Simple data packets have no authentication mechanism. On the other hand, secure data packets use an authentication mechanism based on message authentication code (MAC) and symmetric key cryptography. We simulate the proposed method using NS2. Simulation results are compared with three routing protocols including, AODV, R2SCDT, and 3VSR. Experiments show that the proposed method outperforms others in terms of end-to-end delay, packet collision, packet delivery rate (PDR), packet loss rate (PLR), and throughput. However, it increases the routing overhead slightly.

Multi‐channel attack detection based on lightweight message authentication code access control using Internet of Things design

AbstractThe Internet of Things (IoT) is a network of interconnected, Internet‐connected items that can gather and transmit data without the need for human interaction through a wireless network. Cryptography is a way of using codes to safeguard information and communications so that only those who are supposed to read and process it may do so. Existing system shows privacy and replication issues caused during cipher text attribute set based encryption. The technical issues in achieving secured authentication is removed by using multi‐channel attack detection based on lightweight message authentication code (LMAC) access control using IoT design in which collision attack can be removed by using secure hash algorithm based Merkle tree and to control sinkhole attacks agent navigation algorithm is proposed and long short‐term memory (LSTM) recurrent neural network (RNN) is proposed to provide the conformity of the user login password. Moreover, to identify attackers on the transmitter side by ensuring authentication, multichannel detection method is proposed. Finally, the security and privacy is improved by using LMAC and user revocation. Thus the multi‐channel attack detection based on LMAC using IoT design can be outperforming the other existing model with higher throughput and low execution time.

Notice of Violation of IEEE Publication Principles: Beyond Traditional Message Authentication Codes: Future Solutions for Efficient Authentication of Message Streams in IoT Networks

Notice of Violation of IEEE Publication Principles <br><br>“Beyond Traditional Message Authentication Codes: Future Solutions for Efficient Authentication of Message Streams in IoT Networks” <br>by Gaurang Bansal and Biplab Sikdar <br>in the IEEE Internet of Things Magazine, Volume 5, Issue 2, June 2022 <br><br>After careful and considered review of the content and authorship of this paper by a duly constituted expert committee, this paper has been found to be in violation of IEEE’s Publication Principles. <br><br>This paper contains portions of original text from the paper cited below. The original text was copied without attribution (including appropriate references to the original author(s) and/or paper title) and without permission. <br><br>“Take a Bite of the Reality Sandwich: Revisiting the Security of Progressive Message Authentication Codes” <br>by Eric Wagner, Jan Bauer, and Martin Henze <br> in the Proceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks, May 2022 <br><br> <br/> One of the major issues of secure communication in resource-constrained contexts is the overhead of integrity protection. A message authentication code (MAC) is a few-byte block used to authenticate a message. The receiver can check this block to ensure that a third party has not tampered with the message. A MAC is a tag attached to a message to ensure the message's integrity and authenticity. It is created by applying a MAC algorithm to a message in conjunction with a secret key. Traditional MAC schemes' tags (e.g., HMAC) are generally quite long and thus consume the majority of the total payload in IoT networks. This article proposes a new MAC approach that uses state chaining, random access messaging, and tag truncation for improved performance and security levels to address the issue. The proposed MAC protocol improves on existing MAC solutions such as CuMACs, Mini-MACs, and ProMACs.

A Link Fabrication Attack Mitigation Approach (LiFAMA) for Software Defined Networks

In software defined networks (SDNs), the controller is a critical resource, yet it is a potential target for attacks as well. The conventional OpenFlow Discovery Protocol (OFPD) used in building the topological view for the controller has vulnerabilities that easily allow attackers to poison the network topology by creating fabricated links with malicious effects. OFDP makes use of the link layer discovery protocol (LLDP) to discover existing links. However, the LLDP is not efficient at fabricated link detection. Existing approaches to mitigating this problem have mostly been passive approaches that depend on observing unexpected behaviour. Examples of such behaviour include link latency and packet patterns to trigger attack alerts. The problem with the existing solutions is that their implementations cause longer link discovery time. This implies that a dense SDN would suffer from huge delays in the link discovery process. In this study, we propose a link fabrication attack (LFA) mitigation approach (LiFAMA), which is an active mitigation approach and one that minimises the link discovery time. The approach uses LLDP packet authentication together with keyed-hash-based message authentication code (HMAC) and a link verification database (PostgreSQL) that stores records of all known and verified links in the network. This approach was implemented in an emulated SDN environment using Mininet and a Python-based open-source OpenFlow (POX) controller. The results show that the approach detects fabricated links in an SDN in real time and helps mitigate them. Additionally, the link discovery time of LiFAMA out-competes that of an existing LFA mitigation approach.

Improving RFID/IoT-based generalized ultra-lightweight mutual authentication protocols

With the increase of connected devices being introduced into the market each day, the Internet of Things (IoT) vision is progressively becoming a reality. This phenomenon however increases key security risks flagged by the scientific and research community and industry professionals. Devices featuring limited security capabilities are of particular concern in IoT adoption, including passive Radio Frequency Identification (RFID) tags. In response to such security limitations, several ultra-lightweight authentication protocols have been proposed, although, most of them exhibit various vulnerabilities. In this study, we evaluate the security level of recent ultra-lightweight mutual authentication protocols and show their susceptibility to replay and desynchronization attacks. Through this research, we also show that these protocols can be grouped into a generalized version of ultra-lightweight mutual authentication protocols (GUMAPs) and classify them into two categories: (i) GUMAP1, where both parties (tag and reader) maintain a history of old parameters; and (ii) GUMAP2, where only one party maintains a history of old parameters. We then establish that both groups are vulnerable to replay and desynchronization attacks. To eliminate these vulnerabilities, we propose a more secure generalized improved mutual authentication protocol (GIMAP). To address the security issues, we present a new message authentication code (MAC) function for GIMAP and prove that the new protocol can satisfy the security requirement involved in lightweight protocols. The security analysis of GIMAP is also supported by the formal security analysis, using two widely accepted approaches, namely BAN logic and the Scyther tool.

Secure Cryptography by Using Hash Application

This project is basically design for ensuring security to all kinds of data format file such as pdf, text, images, audio, videos etc. This is carried out using various keys and hashing algorithm. This project basically helps the end user to protect his/her personal files from the unauthorized user and can also restrict its access to the limited people. This complete process is carried out in two methods that are encryption and decryption. Encryption process required varchar key while encryption the data file which convert the original file in to incomprehensible format. Further in decryption process, again by providing the same key file can be converted in to its original format. This helps the user to protect personal file on a public systems like schools, colleges, cyber cafes, hospitals, banks etc. The cryptography is acquired through various algorithms and keys. We are using a XOR key function and Hash function for encrypting and decrypting the data. In this certain key given by user will be XOR with the actual byte code of file for encryption and vice versa for decryption. This ensures to restrict the personal files on a public system.

Secure medical data management with privacy-preservation and authentication properties in smart healthcare system

The potential of combining Internet-of-Medical-Things technology with medical cloud storage can greatly improve the current smart healthcare environment. But some critical obstacles arise when developing the two technologies. One of the most difficult aspects is how to efficiently guarantee medical data’s privacy and authentication since the biomedical sensors (BMSs), implanted on patient’s body, have very limited battery life and computing abilities. Another one is to check the integrity of data stored on medical cloud. In this paper, we propose a secure and lightweight, especially for the BMSs, data management model for healthcare system, in which a BMS only needs to perform symmetric encryption consisting of XOR and message-authentication-code (MAC) operations. The adopted encryption technique ensures the privacy and authentication of medical data. Moreover, an aggregated homomorphic certificateless signature scheme is also proposed for the personal-assisted device and server device, which guarantees the public verifiability of medical data stored on cloud. Meanwhile, the certificateless property naturally implies that the whole system is immune to key-escrow attack. Finally, the detailed performance analysis and comparisons with related works show that our proposed system is very competitive in terms of communication overheads and computational costs.

Formal Verification and Analysis of 5G AKA Protocol Using Mixed Strand Space Model

The 5th generation mobile communication technology (5G) authentication and key management (AKA) protocol specified by the 3rd generation partnership project (3GPP) includes three cases because it introduces synchronization failure and message authentication code (MAC) failure procedures. Thus, there may be interactions between these cases, forming vulnerabilities that do not exist in any single case. However, this is not fully considered in the existing formal analysis and improvement of the 5G AKA protocol. To solve this problem, this paper formally analyzes the security of the latest version of the 5G AKA protocol based on the mixed strand space model for mixed protocols and finds many new attacks, including cross attacks for mixed cases. Then, a secure and efficient primary authentication and key agreement protocol for 5G networks is proposed, which is named the 5G-AKA’. In the 5G-AKA’ protocol, the pre-shared key between the user equipment (UE) and the home network (HN) is replaced with a derivation key of the pre-shared key, the challenge–response mechanism between the serving network (SN) and the HN is added, the subscription permanent identifier (SUPI) of the UE is added to the second message between the SN and the HN, and the MAC failure is replaced with a timeout mechanism on the HN. Finally, the 5G-AKA’ protocol is proved secure in the mixed strand space model and can overcome these attacks of the latest version of the 5G AKA protocol. Additionally, the comparative analysis shows that the 5G-AKA’ protocol is better than the recently improved 5G AKA protocols in security, and the 5G-AKA’ protocol is efficient and is backward compatible with the 5G AKA protocol.

Secure Data Aggregation Aided by Privacy Preserving in Internet of Things

With the rapid development of Internet of Things (IoT), more and more wireless smart devices are widely deployed in its typical applications. These devices acquire numerous data, and their security transmission is a challenge issue due to the openness and broadcast nature of wireless network. Security data aggregation (SDA) plays a significant role in IoT which can not only protect the data privacy but also reduce the network traffic among smart devices. In this paper, a multiple application SDA (MASDA) mechanism is proposed and it can ensure the data confidentiality without losing the integrity of data transmission. Firstly, we discuss an improved homomorphic message authentication code (iHMAC) which can verify the integrity of sensing data and eliminate the injection of false data. Secondly, a multiple application elliptic curve cryptography mechanism (iECC) is described. We introduce multiple types of data simultaneous encryption into an elliptic curve encryption system. This encryption mechanism aggregates the encrypted sensing data and prevents the sensing from being tampered and leaked in relay nodes. Finally, MASDA is a multiple application mechanism and provide both the confidentiality and integrity compared with other SDA schemes. It fuses the sensing data of different applications in a single data packet, and the base station can recover them one-by-one. The security analysis and the simulation experiments verify that MASDA has better performances in terms of the security, the computation cost, the communication overhead, and the data accuracy.

5G-IPAKA: An Improved Primary Authentication and Key Agreement Protocol for 5G Networks

The 3rd generation partnership project (3GPP) has been enhancing the security of the 5G AKA (authentication and key agreement) protocol. However, there may still be some shortcomings in the latest version of the 5G AKA protocol. According to the analysis of the latest version of the 5G AKA protocol, this paper points out seven of its shortcomings. To overcome these shortcomings, an improved primary authentication and key agreement protocol for 5G networks is proposed, which is named 5G-IPAKA. Compared with the latest version of the 5G AKA protocol, the main improvements include that the pre-shared key between the user equipment (UE) and the home network (HN) is replaced with a derivation key as the pre-shared key, the challenge-–response mechanism for the serving network (SN) is added, the mutual authentication and key confirmation occurs between the UE and the SN, and the message authentication code (MAC) failure procedure is replaced with a timeout mechanism on the HN. Then, the 5G-IPAKA protocol is proven secure in the mixed strand space model for mixed protocols. Further discussion and comparative analysis show that the 5G-IPAKA protocol can overcome the above shortcomings of the latest version of the 5G AKA protocol, and is better than the recently improved 5G AKA protocols. Additionally, the 5G-IPAKA protocol is efficient and backward-compatible.

Man-in-the-Middle Attack Mitigation in Internet of Medical Things

The Internet of Medical Things are susceptible to Man-in-the-Middle (MitM) attack, which can identify healthcare emergency of monitored patients and replay normal physiological data to prevent the system from raising an alarm. In this article, we propose a framework to prevent a MitM from disrupting the operations and prohibiting the raise of alarms by the remote healthcare monitoring system. To reduce energy consumption for normal data transmission, and preserve the privacy of health data, our framework transmits a smaller size signature derived from acquired data with message authentication code, where the key is derived from received signal strength indication. Our experimental results for emergency detection show that our approach can achieve a high detection accuracy with a low false alarm rate of 3%.

DRiVe: Detecting Malicious Roadside Units in the Internet of Vehicles With Low Latency Data Integrity

The Internet of Vehicles (IoV) may enhance road safety, improve traffic flow, etc. However, Internet-connected intelligent vehicles (IVs) are vulnerable to cyber-attacks. One of the important challenges in IoV is thus, verifying data integrity with strict latency requirements. The conventional way of providing data integrity in the Internet cannot be applied to IoV due to excessive overhead and latency. Therefore, most commercially available IVs do not use any security mechanisms for delay-sensitive traffic. However, if a road side unit (RSU) has been compromised, it can tamper with the data sent or received by IVs. To solve this issue, this article presents a light-weight mechanism called DRiVe to establish data integrity for the IVs and detect malicious RSUs. The DRiVe is based on a probabilistic model to identify malicious RSUs using specially constructed authentication techniques. The authentication parameters are only sent when a vehicle leaves the coverage area of one RSU and enters that of another. DRiVe does not employ any computationally intensive cryptographic primitives. This significantly reduces the security overhead introduced by sending message authentication codes (MACs) with each packet. A security and performance analysis shows that DRiVe can not only identify malicious RSUs effectively but can do so without introducing any significant communication overhead or latency. The proposed scheme reduces the number of bits transmitted by approximately 7% and decreases the latency incurred by 7.5%. For the scenario where malicious vehicles are present, the proposed scheme achieves a probability of detection close to 99%.

An Efficient Key Management and Multi-Layered Security Framework for SCADA Systems

Supervisory Control and Data Acquisition (SCADA) networks play a vital role in industrial control systems. Industrial organizations perform operations remotely through SCADA systems to accelerate their processes. However, this enhancement in network capabilities comes at the cost of exposing the systems to cyber-attacks. Consequently, effective solutions are required to secure industrial infrastructure as cyber-attacks on SCADA systems can have severe financial and/or safety implications. Moreover, SCADA field devices are equipped with microcontrollers for processing information and have limited computational power and resources. This makes the deployment of sophisticated security features challenging. As a result, effective lightweight cryptography solutions are needed to strengthen the security of industrial plants against cyber threats. In this paper, we have proposed a multi-layered framework by combining both symmetric and asymmetric key cryptographic techniques to ensure high availability, integrity, confidentiality, authentication and scalability. Further, an efficient session key management mechanism is proposed by merging random number generation with a hashed message authentication code. Moreover, for each session, we have introduced three symmetric key cryptography techniques based on the concept of Vernam cipher and a pre-shared session key, namely, random prime number generator, prime counter, and hash chaining. The proposed scheme satisfies the SCADA requirements of real-time request response mechanism by supporting broadcast, multicast, and point to point communication.

Customized AES Using Pad and Chaff Technique Diffie Hellman Key Exchange

Abstract: In today’s world, transferring or exchanging the information on a secure connection has become the most crucial part. Hence in order to have a safe/reliable connection it needs keys exchangement and also they should be transferred on a secure connection. Hence the data that is secured, when passed through the internet should be protected. Hence the data protection can be measured in two ways 1.Confidentiality - ensuring no one except the authorized users or admins can access the data. 2. Integrity - ensuring no one can alter while transferring. Hence Confidentiality, Integrity is achieved using Symmetric Encryption, Message Authentication Code(MAC). Hence in order to achieve these, identical and secret keys are required. For these reasons this algorithm is developed.

A privacy-preserving handover authentication protocol for a group of MTC devices in 5G networks

Machine Type Communication (MTC) has been emerging for a wide range of applications and services for the Internet of Things (IoT). In some scenarios, a large group of MTC devices (MTCDs) may enter the communication coverage of a new target base station simultaneously. However, the current handover mechanism specified by the Third Generation Partnership Project (3GPP) Release 16 incurs high signaling overhead over the access network and the core network for such scenario. Moreover, other existing solutions have several security problems in terms of the failure of key forward secrecy (KFS) and lack of mutual authentication. In this paper, we propose an efficient authentication protocol for a group of MTCDs in all handover scenarios. By the proposal, the messages from two MTCDs are concatenated with an aggregated message authentication code (MAC) and sent by an authenticated group member to reduce the signaling cost. The proposed protocol has been formally evaluated by Scyther tool to prove its security. And it has been analysed on its security functionality to show its ability to resist major typical malicious attacks. Temporary identities of MTCDs have been used to preserve users’ privacy. It can be expected that the proposed protocol is applicable to all kinds of group mobility scenarios such as a platoon of vehicles or a high-speed train. The performance evaluation demonstrates that the proposed protocol is efficient in terms of computational, communication, signaling, and energy cost.