One-way Hash Chain Research Articles

Lightweight Authentication Scheme for Healthcare With Robustness to Desynchronization Attacks

Remote healthcare monitoring systems are gaining a lot of interest as they enable doctors to use public channels to get real-time data from the sensors placed in/on the patient’s body. This necessitates the implementation of a robust authentication scheme to ensure secure communication between trusted healthcare providers and sensors which are usually low in resources. To address these issues, in 2021, Masud et al. presented a lightweight anonymous user authentication scheme for securely obtaining patient’s real-time data. Their protocol is considered practical for deployment on sensor nodes as it only utilizes hash functions and does not require any public key cryptography. In this work, we demonstrate how their protocol loses synchronization when a message is blocked/jammed and how in some scenarios, the protocol is exposed to the risk of session key disclosure and cannot ensure forward secrecy. To overcome these threats, we propose, a Lightweight mutual Authentication Protocol that provides Robustness to Desynchronization attacks. The proposed scheme uses a one-way hash chain technique to ensure forward secrecy and enable resynchronization between the protocol entities in the event of a desynchronization attack. also achieves user and sensor node anonymity, thus ensuring privacy of the communicating entities. With the demonstration of both formal and informal analysis, the proposed protocol is ensured to withstand the identified attacks in Masud et al.’s scheme. The comparative analysis in terms of security and performance with relevant protocols indicates that the proposed protocol ensures higher security with considerably low computation and communication overheads, making it suitable for practical implementation in a lightweight healthcare environment.

An Anonymous Authentication Scheme Based on Chinese Residue Theorem in Wireless Body Area Networks

Considering the resource limitations of low-cost wireless sensors, there is a growing inclination to utilize cryptographic primitives that are optimized for efficiency, such as symmetric key encryption/decryption and hash functions, when designing authentication schemes. However, designing a lightweight authentication scheme that can meet various security requirements poses a significant challenge. In recent years, numerous lightweight authentication schemes have been proposed in order to address these security needs. Nevertheless, recent research has revealed that many of these schemes exhibit security vulnerabilities and design deficiencies, including challenges related to asynchronization and impractical gateway-node search operations. Due to the inadequate security of existing schemes, this study introduces a novel privacy-preserving authentication scheme that aims to provide adaptive resilience against desynchronization attacks in wireless body area networks (WBANs). The proposed scheme utilizes lightweight cryptographic modules to optimize efficiency. To ensure user anonymity, the Chinese Remainder Theorem technique is employed, whereas forward secrecy and resistance to desynchronization attacks are achieved through the use of one-way hash chains and serial numbers, respectively. Through extensive analysis and comparisons, the proposed scheme is demonstrated to strike a fine balance between security and efficiency.

A multipath routing protocol for secure energy efficient communication in Wireless Sensor Networks

A Wireless Sensor Network (WSN) is comprised of a number of sensor nodes (SNs) that are randomly placed in an open, harsh environment for many applications. Due to the resource-constrained nature of SNs and hostile deployment environments, energy efficiency and security are considered two key factors in designing WSN routing protocols. This paper proposes an Energy Efficient Secure Multipath (EESM) routing protocol to securely construct efficient routes and transmit data packets between SNs and the base station (BS). EESM achieves energy efficiency through minimal task allocation among SNs whereas all computation-intensive tasks such as network information collection, routing table generation, and network maintenance are performed by the BS. The proposed protocol incorporates lightweight security mechanisms including a one-way hash chain, message authentication code, encryption, and clique-based coordinator selection and monitoring schemes to defend against numerous security attacks. Simulation results show that EESM can successfully detect and protect the network against various security attacks such as replay attacks, sybil attacks, sinkhole attacks, spoofing attacks, compromised node attacks, and so on. In terms of energy efficiency, the proposed protocol achieves an up to 37% increase in network lifetime and a 6% increase in throughput over Secure and Energy Efficient Multipath (SEEM) routing, Secure and Reliable Multipath Routing (SRMR), and Reliable and Multipath Encounter Routing (RMER) protocols. The paper implements the protocol in a real environment using Arduino motes to analyze security overheads and network setup time.

A lightweight encrypted deduplication scheme supporting backup

Data deduplication technology is frequently used by many cloud service providers to handle the exponential growth in data. To protect their data privacy, users frequently encrypt their data before uploading it to a cloud storage provider. Therefore, efficient encrypted deduplication technology has been widely studied. Although cloud storage provides convenience for users, it also has the problem of high data concentration. Once an accident occurs in the data center, the impact is enormous. Therefore, it is necessary to back up the ciphertext data after deduplication. In this paper, we propose an efficient encrypted data deduplication technology that supports backup. Our scheme uses a one-way hash chain to verify the legitimacy of a user’s identity. It updates the user’s ownership of the data using the user’s index table. In this paper, we use the XOR operation to re-encrypt data to obtain backup ciphertext, reducing computational complexity. In LEDB, the user can extract the key from the data label. Therefore, the user does not need to manage the key separately. In addition, LEDB supports a two-level deduplication mechanism, which can not only ensure transmission security but also reduce network transmission bandwidth. Finally, LEDB allows the user to determine the integrity of the data before decrypting the ciphertext. Security analysis and experimental results show that our scheme is secure and efficient for data encryption and decryption.

Enhance Security and Privacy in VANET Based Sensor Monitoring and Emergency Services

VANET performs analysis of patient records and sends security warnings to the carer through VANET so that they may provide urgent assistance while keeping patient data safe. Threat actors might potentially access data packets that go between biological sensors and smart ambulances in the vehicular network. When healthcare professionals use a VANET, they run the risk of receiving inaccurate or delayed data as a result of assaults like the Sybil attack, denial of service attacks, and impersonation attacks. As a result, protecting people’s personal information and data has become an important task for academics. In this research, we propose the use of an Urbanized Block Chain Key Agreement Protocol (UB-KAP) based on a one-way hash chain model to increase protections for individual privacy and data integrity in VANET-based healthcare networks. The messages include timestamps in case the messages that have already expired cause excessive delays. The beacons’ packet classification mechanism separates them into benign and harmful emergency signals to speed up response times. The suggested model is tested by road traffic simulation using SUMO (Simulation of Urban Mobility). Data collection per user, message delivery ratio, total data gathered, delay, and energy usage are all included in the model’s overall evaluation.

BSKM-FC: Blockchain-based secured key management in a fog computing environment

With an increase in the number of devices in the edge layer connected to the fog server of the fog computing environment, it is found that vulnerable and unauthorized activities are also increasing relatively. Thus, there is a requirement for authorized access control in such an environment that is governed by secured and efficient key management between the communicating devices. Many researchers have presented conventional solutions for key management depending on a third party. The third party operated for a key generation or key distribution in a fog computing environment based on a centralized architecture which leads to the drawbacks like a single-point failure and inconsistency of key management. So, effective and secured key management between the edge devices which are willing to communicate is the major concern to be addressed in the current digital world to achieve access control. This paper proposes a BSKM-FC (Blockchain-based Secured Key Management in a Fog Computing Environment) which is a decentralized system in a fog computing environment without using a third party. The BSKM-FC makes use of a one-way hash chain for the generation of private and public key pairs and ECC (Elliptic Curve Cryptography) for secured sharing. Upon successful authentication, the session key generation at both edge devices is based on the key pair provided by the fog server and stored securely in the blockchain. The BSKM-FC system uses private blockchain technology in the fog layer to provide secured storage and management. The work is implemented in the Truffle Blockchain and found that BSKM-FC performs better in terms of overall block preparation time. The security analysis of the proposed scheme is carried out based on the ROR model and also verified using AVISPA for some known attacks. Informal security analysis of the proposed work is performed by considering some of the known attacks where we observe that the proposed scheme overcomes such attacks. Performance overhead analysis is demonstrated using MIRACL considering computation cost, communication cost, and storage cost. The results show that the proposed scheme meets security requirements and performs effectively. The computation overhead, communication overhead, storage overhead, and block preparation time of the proposed scheme were improved by 7% to 14%, 9% to 18%, 7% to 17%, and 14% to 28%, respectively, as compared to existing schemes.

SAVE: Efficient Privacy-Preserving Location-Based Service Bundle Authentication in Self-Organizing Vehicular Social Networks

Self-organizing vehicular social networks underpin many location-based services (LBS) such as those that collect and share environmental information (e.g., traffic and weather conditions) among vehicular users and the infrastructure. There are, however, security and privacy considerations in the sharing of such information, and one popular approach is to design lightweight authentication solutions for LBS. Existing approaches may suffer from limitations such as significant computational and/or storage overheads, latency and time delays, and consequently impractical for resource-constrained on-board units. In this paper, we propose an efficient privacy-preserving LBS bundle authentication scheme (hereafter referred to as SAVE) through secure redundancy filtering in self-organizing vehicular social networks. Firstly, an enhanced self-healing key distribution protocol with distributed revocation is proposed to reduce communication cost for retransmitting lost key material and resist free-riding attacks to enhance the authentication efficiency. Then, based on it, a generalized version of online/offline aggregate signature is proposed to achieve batch LBS bundle verification based on arbitrary one-way function holding the property of multiplicative homomorphism. Finally, an efficient zero-knowledge range proof based on lightweight one-way hash chain is designed to decide the redundancy of LBS bundles without disclosing vehicular users’ location privacy. Formal security proof and extensive simulation results demonstrate that our proposed SAVE achieves identity privacy, two levels of location privacy and the practicability in reality.

A New Approach to Constructing Decentralized Identifier for Secure and Flexible Key Rotation

Owing to the introduction of blockchain (BC) technology, a decentralized identity (DID) model has been proposed to replace conventional identity models based on centralized authorities. The BC platform operated by various participants provides a new root-of-trust functionality for entity identification and access control. Each entity generates and registers its own identifier and credential (public key) to the BC such that any entity can obtain the other entity’s public key. When the corresponding private key is compromised, the key rotation to generate and register a new key pair should be performed. However, the current approach for cryptographically binding a decentralized identifier with a public key induces a serious security problem that results in both identity-stealing attacks and multiple identifiers for a single entity. A new DID to address the security problem above is proposed herein, which is based on a newly proposed cryptographic primitive (infinite one-way hash chain), as well as its security analysis and performance evaluation on <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Hyperledger Fabric</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Contiki Cooja</i> simulator. To demonstrate the applicability of the proposed DID to various security protocols, an authenticated key exchange protocol is also designed.

PPDMIT: a lightweight architecture for privacy-preserving data aggregation in the Internet of Things

Data is generated over time by each device in the Internet of Things (IoT) ecosphere. Recent years have seen a resurgence in interest in the IoT due to its positive impact on society. However, due to the automatic management of IoT devices, the possibility of disclosing sensitive information without user consent is high. A situation in which information should not be unintentionally disclosed to outside parties we do not trust, i.e., privacy-preservation. Additionally, IoT devices should share their data with others to perform data aggregation and provide high-level services. There is a trade-off between the amount of data utility and the amount of disclosure of data. This trade-off has been causing a big challenge in this field. To improve the efficiency of this trade-off rather than current studies, in this study, we propose a Privacy-Preserving Data Aggregation architecture, PPDMIT, that leverages Homomorphic Paillier Encryption (HPE), K-means, a One-way hash chain, and the Chinese Remainder Theorem (CRT). We have found that the proposed privacy-preserving architecture achieves more efficient data aggregation than current studies and improves privacy preservation by utilizing extensive simulations. Moreover, we found that our proposed architecture is highly applicable to IoT environments while preventing unauthorized data disclosure. Specifically, our solution depicted an 8.096% improvement over LPDA and 6.508% over PPIOT.

Enhancing Security in Key Management Using Hybrid Cache Supported One Way Hash Chain Technique

Background: Collusion resistance is preserving the value generated at individual nodes secret so that if any nodes share the information together or collude with each other, the secret values cannot be revealed.It is really a challenging task to securely resist the collusion of cloud server and users Collusion resistance also involves growing the number of people. Objective: Users can achieve an effective and economical approach for data sharing among group members in the cloud with the characters of low maintenance and little management cost. Method: Hybrid Cache supported One way hash chain Technique. Result: To test with the sparse caching HHCS and one-way hash chain model and the various sparse caching configurations are fully implemented by this work. Multiple situations and various scenarios are considered in the experiments and tests for the estimation of HHCS’ performance. The results which are measured in terms of storage units needed for the completion of one internet session and in terms of efficiency (which is the number of hash operations done in one session) are compared and then contrasted. Conclusion: Security improvement is proposed in this paper in group key management method, in order to solve the issue of collusion attack between whole members of the group for a secure group communication. It is shown that using lightweight is easy for the implementation of sparse caching method which can greatly improve the cryptographic one-way hash chain method’s performance which is used widely, for securing the transmission of data in cloud by using two levels of security scheme. A memory-times computation complexity metric has been introduced to help choose the best size of cache depending on storage requirements of the cloud application. For demonstrating various connection behaviors, various cache spacing methods have been evaluated. This paper presented and evaluated the potential of hybrid solution in which one-way hash chains which are divided are provided with caching capacities in order to store the values of session key and retrieve them when needed for authenticating a user session. Lower computational overhead is achieved by us as measured by the count of hash operations and computation time needed to give protection.

A Lightweight Three-Factor Anonymous Authentication Scheme With Privacy Protection for Personalized Healthcare Applications

Security and privacy issues in wireless medical sensor networks (WMSNs) have attracted lots of attention in both academia and industry due to the sensitiveness of medical system. In the past decade, extensive research has been carried out on these security issues, but no single study exists that addresses them adequately, especially for some important security properties, such as user anonymity and forward secrecy. As a step towards this direction, in this paper, the authors propose a lightweight three-factor anonymous authentication scheme with forward secrecy for personalized healthcare applications using only the lightweight cryptographic primitives. The proposed scheme adopts pseudonym identity technique to protect users' real identities and employs one-way hash chain technique to ensure forward secrecy. Analysis and comparison results demonstrate that the proposed scheme can not only reduce execution time by 34% as compared with the most effective related schemes, but also achieve more security and functional features.

Authentication and Key Management in Distributed IoT Using Blockchain Technology

The exponential growth in the number of connected devices as well as the data produced from these devices call for a secure and efficient access control mechanism that can ensure the privacy of both users and data. Most of the conventional key management mechanisms depend upon a trusted third party like a registration center or key generation center for the generation and management of keys. Trusting a third party has its own ramifications and results in a centralized architecture; therefore, this article addresses these issues by designing a Blockchain-based distributed IoT architecture that uses hash chains for secure key management. The proposed architecture exploits the key characteristics of the Blockchain technology, such as openness, immutability, traceability, and fault tolerance, to ensure data privacy in IoT scenarios and, thus, provides a secure environment for communication. This article also proposes a scheme for secure and efficient key generation and management for mutual authentication between communication entities. The proposed scheme uses a one-way hash chain technique to provide a set of public and private key pairs to the IoT devices that allow the key pairs to verify themselves at any time. Experimental analysis confirms the superior performance of the proposed scheme to the conventional mechanisms.

Enhanced Reliable ACK (ERACK) Scheme for Detecting Misbehaving Nodes in MANETs

In Mobile Ad Hoc Networks (MANETs), the process of sending end-to-end acknowledgement (ACK) for each packet by the destination, causes unnecessary overhead. This paper proposes an Enhanced Reliable ACK (ERACK) scheme for detecting misbehaving attacks in MANET. Initially, reliable multiple paths are established by measuring the path reliability. For defending the data transferred from the dispatcher, one-way hash chain based Message Authentication Code (MAC) is utilised. If the packet loss count is above a threshold, then Secure ACK (S-ACK) mode is activated which identifies the misbehaving node. The source then generates a Misbehavior Report Authentication (MRA) message which is transmitted to the destination using the path with next higher reliability. By experimental results it is shown that the ERACK method decreases the packet loss and delay while ensuring the successful delivery of MRA to the destination.

Lightweight and privacy‐preserving authentication scheme with the resilience of desynchronisation attacks for WBANs

With the advances in wireless communication and Internet of things, wireless body area networks (WBANs) have attracted more and more attention because of the potential in improving the quality of health care services. With the help of WBANs, the user can access the patient's life-critical data generated by miniaturised medical sensors, and remote health care monitoring services are provided. Since the open nature of wireless channel and sensitivity of transmitted information, the security and privacy of such personal data are becoming important issues that must be dealt with. In the past few years, a large number of authentication schemes had been proposed to solve these issues. However, most of the existing schemes are not secure enough. As a step toward this direction, in this study, the authors present a privacy-preserving authentication scheme with adaptive resilience of desynchronisation attacks for WBANs, in which lightweight crypto-modules are adopted to pursue the best efficiency. The proposed scheme adopts the pseudonym identity technique to provide user anonymity, and one-way hash chain technique and serial number method are employed to ensure forward secrecy and resist desynchronisation attack, respectively. Analysis and comparison results demonstrate that the proposed scheme achieves a delicate balance between security and efficiency.

Navigation Message Authentication Based on One-Way Hash Chain to Mitigate Spoofing Attacks for GPS L1

Global Navigation Satellite Systems (GNSS) is vulnerable to significant threats such as spoofing attacks. Data and signal authentication can be used as an effective approach to mitigate such security threats. This paper proposes a Navigation Message Authentication (NMA) method based on Timed Efficient Stream Loss-tolerant Authentication (TESLA), which is using one-way encryption chains. The contributions of this paper are two techniques for implementing TESLA using reserved bits for GPS L1 data. The TESLA algorithm is applied to the extracted navigation message of the GPS L1C/A. Due to the flexibility of the GPS L1C message structure, the protocol is also implemented on Civil Navigation signals (CNAV-2) of GPS L1C. In comparison with Elliptic Curve Digital Signature Algorithm (ECDSA), the Authentication Rate (AR) increases to two minutes for each authentication and performance in term of the Authentication Error Rate (AER) is optimized, by using the TESLA method.

Time-Based Access Control for Multi-attribute Data in Internet of Things

Internet of Things (IoT) has become a vital part of our infrastructure to enrich lives and make processes easier. In these people-centric IoT applications, massive personal data are collected in real-time and stored by the resource constrained sensor network. Because any misusage of these personal data might result in the leakage of privacy and economic losses, it is expected that the data requesters can only access to the data what they have purchased, or are entitled to use. How to accurately control data access permissions is one of the prerequisites for IoT data protection. Based on a revised one-way hash chain technique, we proposed a novel Time-based Access Control (TAC) scheme for multi-attribute data in Internet of Things. All the data are partitioned into 2-D subspaces representing generation time and data attribute. Data in each subspace is encrypted with the corresponding sub-key before its transmission to the base station to achieve data privacy and access control. Anyone who wants to read or use data with specified attribute at a particular time must get the corresponding sub-key from the data source node or the owner. TAC can generate a sub-key for data in each subspace in an efficient manner in terms of less sub-key generation time and low memory space usage. We proposed three improved schemes to further reduce sub-key computation time according to different application scenarios. The experimental results show that TAC can be applied to the resource limited WSNs efficiently.

Secure Fog-Assisted Crowdsensing With Collusion Resistance: From Data Reporting to Data Requesting

The development and ubiquity of smart mobile devices have produced the idea of crowdsensing, where people report and request data in a community via a cloud server. Recently, fog is introduced to assist the cloud server by providing location-sensitive and latency-aware local data management. However, interaction between users and server without appropriate sanitation puts serious security threats to user’ privacy (e.g., data content and preference). While existing work already has a wide range of privacy-preserving schemes, they hardly consider collusion attacks (CAs) between the server and users, let alone CAs between fog nodes and users. To solve this problem, we first define four specific CAs in fog-assisted crowdsensing and propose a novel privacy-preserving data reporting and requesting (PARE) scheme with collusion resistance. PARE is constructed by leveraging one-way hash chains, marked mix-nets, and grouping-based secure searchable encryption to securely collect users’ reports and respond to users’ requests under CAs. Then, we consider one extreme scenario and provide a solution by introducing a role of sentry reporter while reducing computational costs and communication overhead. Thorough security and privacy analysis shows that PARE is secure and collusion resistant and we also quantitatively measure privacy with mutual information. Extensive performance evaluation results indicate that PARE is lightweight with respect to computational cost and communication overhead. To the best of our knowledge, this paper is the first one that gives four formal definitions of CAs in fog-assisted crowdsensing and aim to defend them at the same time.

Secure Information Sharing System for Online Patient Networks

Recently, privacy emerged as a hot issue again, as the General Data Protection Regulation (GDPR) of EU has become enforceable since May 25, 2018. This paper deals with the problem of health information sharing on a website securely and with preserving privacy. In the context of patient networks (such as ‘PatientsLikeMe’ or ‘CureTogether’), we propose the model Secure Information Sharing System (SISS) with the main method of group key cryptosystem. SISS addresses important problems of group key systems. (1) The new developed equations for encryption and decryption can eliminate the rekeying and redistribution process for every membership-change of the group, keeping the security requirements. (2) The new 3D Stereoscopic Image Mobile Security Technology with AR (augmented reality) solves the problem of conspiracy by group members. (3) SISS uses the reversed one-way hash chain to guarantee forward secrecy and backward accessibility (security requirements for information sharing in a group). We conduct a security analysis of SISS according to group information sharing secrecy and an experiment on its performance. Consequently, although current IT paradigm is changing to be more and more ‘complicated’, ‘overlapped’, and ‘virtualized’, SISS makes it possible to securely share sensitive information from collaborative work.

Reliable and Privacy-Preserving Truth Discovery for Mobile Crowdsensing Systems

Truth discovery has received considerable attention in mobile crowdsensing systems. In real practice, it is vital to resolve conflicts among a large amount of sensory data and estimate the truthful information. Although truth discovery has been widely explored to improve aggregation accuracy, numerous security and privacy issues still need to be addressed. Existing schemes either do not guarantee the privacy of each participating user, or fail to consider practical needs in crowdsensing systems. In this paper, we present two reliable and privacy-preserving truth discovery schemes for different scenarios. Our first design is fit for applications where users are relatively stable. By employing the homomorphic Paillier encryption, one-way hash chain, and super-increasing sequence techniques, this approach not only guarantees strong privacy, but also is highly efficient and practical. Our second design suits applications where users are frequently moving. In such an application, we explore data perturbation and homomorphic Paillier encryption to shift all user workloads to the server side, without compromising users’ privacy. Through detailed security analysis, we demonstrate that both schemes are secure, practical, and privacy-preserving. Moreover, extensive experiments based on real world and simulated mobile crowdsensing systems, we demonstrate the efficiency of our proposed schemes.

LPTD: Achieving lightweight and privacy-preserving truth discovery in CIoT

In recent years, cognitive Internet of Things (CIoT) has received considerable attention because it can extract valuable information from various Internet of Things (IoT) devices. In CIoT, truth discovery plays an important role in identifying truthful values from large scale data to help CIoT provide deeper insights and value from collected information. However, the privacy concerns of IoT devices pose a major challenge in designing truth discovery approaches. Although existing schemes of truth discovery can be executed with strong privacy guarantees, they are not efficient or cannot be applied in real-life CIoT applications. This article proposes a novel framework for lightweight and privacy-preserving truth discovery called LPTD-I, which is implemented by incorporating fog and cloud platforms, and adopting the homomorphic Paillier encryption and one-way hash chain techniques. This scheme not only protects devices’ privacy, but also achieves high efficiency. Moreover, we introduce a fault tolerant (LPTD-II) framework which can effectively overcome malfunctioning CIoT devices. Detailed security analysis indicates the proposed schemes are secure under a comprehensively designed threat model. Experimental simulations are also carried out to demonstrate the efficiency of the proposed schemes.