One-way Hash Chain Research Articles

Dynamic Swarm Attestation With Malicious Devices Identification

Nowadays, there is a rapid development of smart sensor network solutions. To prevent potential malicious attacks and make sure that the activities of devices are correct, there is a pressing need to ensure the software integrity of devices in the large-scale, dynamic, and self-organization swarm. Different from those single device attestation studies, Asokan et al. are the first to consider the secure swarm attestation problem and provide implementations based on two remote attestation architectures for embedded systems. However, their scheme could not provide a correct attestation result with dynamic swarm topology. Also, their scheme could not prevent a malicious device from launching a new attestation, and the adversary can use this weakness to conduct energy exhausting attack. In this paper, we mainly focus on secure and efficient identity attestation of compromised devices over swarm with dynamic topology and design an interactive swarm attestation scheme. Furthermore, we introduce multi-hop attestation security in swarm attestation and provide a verifiable solution for new attestation launching solution based on the one-way hash chain. Moreover, theoretical and practical analyses prove that our scheme is secure and efficient in attestation security and energy saving for dynamic swarm topology.

Ridra: A Rigorous Decentralized Randomized Authentication in VANETs

Ensuring the security and privacy of vehicle is one of the critical requirements for the safety and reliability of vehicular ad hoc networks. A variety of (conditional) anonymous authentication schemes, including group/ring signatures, pseudo-identity-based and PKI-based approaches, have been proposed to achieve highly effective privacy-preserving authentications. A recent effort, i.e., randomized authentication, leverages homomorphic encryption for vehicles to self-generate authenticated identities to achieve full anonymity. Notwithstanding a very attractive feature to prevent single-party traceability, randomized authentication faces a great challenge on the centralized data updating and the frequent clock synchronizations. It also fails to meet the necessity of non-repudiation. In this paper, we present a rigorous decentralized randomized authentication framework with conditional privacy preservation. We use homomorphic encryption and a one-way hash chain for a vehicle to self-generate randomized pseudo-identities. We deploy the pseudonym validation mechanism over the roadside units in order to support decentralized mutual identity authentication and ownership validation of vehicles in a loosely coupled or a compound manner. Our framework can provide rigorous Level 3 privacy and traceability of vehicles. We also provide a security condition on valid random values to ensure the uniqueness of pseudonym and non-repudiation of vehicles. The performance evaluation shows that our framework is generally more efficient on infrastructures in terms of computational and communication overheads than the state-of-the-art randomized authentications.

A Lightweight Privacy-Preserving Data Aggregation Scheme for Fog Computing-Enhanced IoT

Fog computing-enhanced Internet of Things (IoT) has recently received considerable attention, as the fog devices deployed at the network edge can not only provide low latency, location awareness but also improve real-time and quality of services in IoT application scenarios. Privacy-preserving data aggregation is one of typical fog computing applications in IoT, and many privacy-preserving data aggregation schemes have been proposed in the past years. However, most of them only support data aggregation for homogeneous IoT devices, and cannot aggregate hybrid IoT devices’ data into one in some real IoT applications. To address this challenge, in this paper, we present a lightweight privacy-preserving data aggregation scheme, called Lightweight Privacy-preserving Data Aggregation, for fog computing-enhanced IoT. The proposed LPDA is characterized by employing the homomorphic Paillier encryption, Chinese Remainder Theorem, and one-way hash chain techniques to not only aggregate hybrid IoT devices’ data into one, but also early filter injected false data at the network edge. Detailed security analysis shows LPDA is really secure and privacy-enhanced with differential privacy techniques. In addition, extensive performance evaluations are conducted, and the results indicate LPDA is really lightweight in fog computing-enhanced IoT.

Implementation of Node Authentication for WSN Using Hash Chains

This paper presents the design and implementation of a lightweight node authentication protocol which comprises of node registration, node authentication and key establishment phases. The solution leverages the low computational overheads associated with cryptographically secure one-way hash chains and Elliptical Curve Crytography (ECC) without using any digital signature algorithm or any public key cryptography. The usage of hidden generator point derived from hash-chains provides defense against a man-in-the-middle attack which is prominent in ECDH (Elliptical Curve Diffie-Hellman) due to lack of entity authentication. The authentication protocol has been simulated on Tossim and its performance bench marking has also been carried out.

Improved one-way hash chain and revocation polynomial-based self-healing group key distribution schemes in resource-constrained wireless networks.

Self-healing group key distribution (SGKD) aims to deal with the key distribution problem over an unreliable wireless network. In this paper, we investigate the SGKD issue in resource-constrained wireless networks. We propose two improved SGKD schemes using the one-way hash chain (OHC) and the revocation polynomial (RP), the OHC&RP-SGKD schemes. In the proposed OHC&RP-SGKD schemes, by introducing the unique session identifier and binding the joining time with the capability of recovering previous session keys, the problem of the collusion attack between revoked users and new joined users in existing hash chain-based SGKD schemes is resolved. Moreover, novel methods for utilizing the one-way hash chain and constructing the personal secret, the revocation polynomial and the key updating broadcast packet are presented. Hence, the proposed OHC&RP-SGKD schemes eliminate the limitation of the maximum allowed number of revoked users on the maximum allowed number of sessions, increase the maximum allowed number of revoked/colluding users, and reduce the redundancy in the key updating broadcast packet. Performance analysis and simulation results show that the proposed OHC&RP-SGKD schemes are practical for resource-constrained wireless networks in bad environments, where a strong collusion attack resistance is required and many users could be revoked.

Lightweight and Confidential Data Discovery and Dissemination for Wireless Body Area Networks

As a special sensor network, a wireless body area network (WBAN) provides an economical solution to real-time monitoring and reporting of patients' physiological data. After a WBAN is deployed, it is sometimes necessary to disseminate data into the network through wireless links to adjust configuration parameters of body sensors or distribute management commands and queries to sensors. A number of such protocols have been proposed recently, but they all focus on how to ensure reliability and overlook security vulnerabilities. Taking into account the unique features and application requirements of a WBAN, this paper presents the design, implementation, and evaluation of a secure, lightweight, confidential, and denial-of-service-resistant data discovery and dissemination protocol for WBANs to ensure the data items disseminated are not altered or tampered. Based on multiple one-way key hash chains, our protocol provides instantaneous authentication and can tolerate node compromise. Besides the theoretical analysis that demonstrates the security and performance of the proposed protocol, this paper also reports the experimental evaluation of our protocol in a network of resource-limited sensor nodes, which shows its efficiency in practice. In particular, extensive security analysis shows that our protocol is provably secure.

Anti-collusive self-healing key distributions for wireless networks

We introduce three efficient anti-collusive self-healing key distribution schemes with t-revocation capability. Our proposed key distribution mechanism uses one-way hash chain. We obtain reduced storage, communication and computation costs over the previous approaches, which make our designs scalable to very large groups in highly mobile, volatile and hostile wireless networks. Our schemes are properly analysed in an appropriate security model and are proven to be computationally secure and achieve both forward and backward secrecy. Also our schemes can resist collusion between the newly joint users and the revoked users. Our set-up allows each user to choose its joining session at its will, whereas the session for user's revocation is pre-selected by the group manager. Unlike the existing self-healing key distribution schemes, rejoining of revoked users is permitted in our schemes at a later session with new identities. These features facilitate the group manager no longer to execute expensive traitor tracing mechanisms to keep track of individual compromised users.

Enhancing security of cookie-based sessions in mobile networks using sparse caching

The exponential growth in the use of mobile phones and tablets to gain wireless access to the Internet has been accompanied by a similar growth in cyber attacks over wireless links to steal session cookies and compromise private users' accounts. The popular one-way hash chain authentication technique in its conventional format is not optimal for mobile phones and other handheld devices due to its high computational overhead. In this paper, we propose and evaluate the use of sparse caching techniques to reduce the overhead of one-way hash chain authentication. Sparse caching schemes with uniform spacing, non-uniform spacing and geometric spacing are designed and analyzed. A Weighted Overhead formula is used to obtain insight into the suitable cache size for different classes of mobile devices. Additionally, the scheme is evaluated from an energy consumption perspective. We show that sparse caching can also be effective in the case of uncertainty in the number of transactions per user session. Our extensive performance tests have shown the significant improvement achieved by the sparse caching schemes.

다회 사용가능한 안전한 모바일 쿠폰 프로토콜

모바일 기기의 성능 향상과 모바일 인터넷 서비스의 성장으로 모바일 쿠폰 시장은 사용자들에게 중요한 시장으로 자리잡고 있다. 모바일 쿠폰은 사용자에게 이동성을 제공해주고 발급자에게 발급의 편리성도 제공해줄 수 있다. 본 논문에서는 해쉬 함수와 XOR 연산과 같이 간단한 암호학적인 기법을 적용하여 모바일에서 효율적으로 수행할 수 있는 모바일 쿠폰시스템에 대하여 제안한다. 제안하는 시스템은 사용자가 모바일 쿠폰의 횟수를 선택하고 발급자는 이중 사용을 방지할 수 있다. 사용자는 모바일 기기에서 프로토콜 수행시 지수연산과 암호화 또는 복호화연산과 같은 복잡한 연산을 수행하지 않아도 된다. 제안한 스킴은 payword의 해쉬 체인을 이용하여 사용자의 이중 사용을 방지하였다. Since nowadays mobile phone messages are flourishing, the application of electronic coupon (e-coupon) will become a trend for mobile users. E-coupon for mobile commerce can provide mobility for users and distribution flexibility for issuers. In this paper, we propose a mobile e-coupon system that just applies some simple cryptographic techniques, such as one-way hash function and XOR operation. In our system, the customer can control the number of issued e-coupons and the issuer can prevent them from double-redeeming. The customer does not need to perform any exponential computation in redeeming and transferring the coupons. Our scheme uses one-way hash chains for preventing from double-spending.

Improving scalability in vehicular communication using one-way hash chain method

Improving road safety and optimizing road traffic relies on both Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) communications. The successful deployment of vehicular communication depends on the two contentious factors, security and privacy. Though several researches have been conducted on the issuance of pseudonyms to deal with these issues, the traditional PKI based schemes used for the generation of these pseudonyms produce an enormous signing and verification costs. In order to address this problem, we propose a novel scheme in which the RSUs in a VANET use a one-way hash chain scheme to generate a series of public/private key pairs and to distribute them along with an n bit hash code H^ and a proof cipher C^ to the vehicles in its range. Since the RSU will provide a synchronized clock to all vehicles, anytime a vehicle can verify another vehicle by combining the vehicle’s public key and its n bit hash code, which should prove the same cryptographic hash function of the receiving vehicle. Through this proposed Hash-chain based Authentication Protocol (HAP), the certificate costs of messages are immensely reduced. Moreover, if an attacker tries to compromise a node’s public key it will be infeasible for him/her to achieve the desired task, as the vehicle frequently changes its public/private keys in a random fashion and hence guarantees a secured vehicle communication. We analyzed the proposed protocol extensively to validate its better performance when compared to its counterparts.

One-way hash chain-based self-healing group key distribution scheme with collusion resistance capability in wireless sensor networks

In order to resolve the collusion resistance problem in the one-way hash chain-based self-healing group key distribution schemes and improve the performance of previous self-healing group key distribution schemes, we propose a self-healing group key distribution scheme based on the revocation polynomial and a special one-way hash key chain for wireless sensor networks (WSNs) in this paper. In our proposed scheme, by binding the time at which the user joins the group with the capability of recovering previous group session keys, a new method is addressed to provide the capability of resisting the collusion attack between revoked users and new joined users, and a special one-way hash chain utilization method and some new methods to construct the personal secret, the revocation polynomial and the key updating broadcast packet are presented. Compared with existing schemes under same conditions, our proposed scheme not only supports more revoked users and sessions, but also provides a stronger security. Moreover, our proposed scheme reduces the communication overhead, and is especially suited for a large scale WSN in bad environments where a strong collusion attack resistance capability is required and many users will be revoked.

Securing one-way hash chain based incentive mechanism for vehicular ad hoc networks

One of the most promising applications of yet to come vehicular ad hoc networks (VANETs) is commercial advertising. However, in order to realize commercial advertising over VANET, proper incentives and security mechanisms must be taken into consideration due to the existence of selfish and/or malicious users in the real-world scenario. In this paper, we propose a secure incentive scheme for VANET advertising systems based on one-way hash chains. We also analyze the advertisement propagation behavior in our VANET advertising system using a mathematical model.

Secure Multihop Network Programming with Multiple One-Way Key Chains

Current network programming protocols provide an efficient way to update program images running on sensor nodes without having physical access to them. Securing these updates, however, remains a challenging and important issue, given the open environment where sensor nodes are often deployed. Several approaches addressing these issues have been reported, but their use of cryptographically strong protocols means that their computational costs (and hence, power consumption and communication costs) are relatively high. In this paper, we propose a novel scheme to secure a multihop network programming protocol through the use of multiple one-way hash chains. The scheme is shown to be lower in computational, power consumption, and communication costs yet still able to secure multihop propagation of program images. We demonstrate the use of this scheme and provide some results using the popular network programming protocol, Deluge. In addition, we include a performance evaluation of our scheme, implemented in TinyOS, in terms of latency and energy consumption.

A Secure Destination-Sequenced Distance-Vector Routing Protocol for Ad Hoc Networks

This paper presents a secure destination-sequenced distance-vector (SDSDV) routing protocol for mobile ad hoc wireless networks. The proposed protocol is based on the regular DSDV protocol. Within SDSDV, each node maintains two one-way hash chains about each node in the network. Two additional fields, which we call AL (alteration) field and AC (accumulation) field, are added to each entry of the update packets to carry the hash values. With proper use of the elements of the hash chains, the sequence number and the metric values on a route can be protected from be-ing arbitrarily tampered. In comparison with the secure efficient ad hoc distance vector (SEAD) protocol previously proposed in the literature provides only a non-decreasing protection on the metrics, SDSDV can provide complete protection.

A Secure Routing Protocol and its application in Multi-sink Wireless Sensor Networks

Wireless sensor networks are increasingly deployed in security-critical areas, such as battle field. However, general sensor nodes are manufactured with inexpensive components, and they are short of security enhancement. Therefore, an adversary could capture and compromise sensor nodes easily, then launch some malicious attacks (including tampering or discarding useful data collected from source nodes). In this paper, we propose a secure routing and aggregation protocol with low energy cost for sensor networks (named STAPLE), which utilizes one-way hash chain and multi-path mechanism to achieve security of wireless sensor networks, and develop a network expanding model to control communication cost incurred by multi-path routing. Then we discuss the protocol application in multi-sink wireless sensor networks. Finally, we perform the simulation of STAPLE in comparison with INSENS, the results demonstrate that STAPLE achieves a higher level security with considerably low communication overhead.

A Novel Algorithm for Defending Path-Based Denial of Service Attacks in Sensor Networks

Existing end-to-end security mechanisms are vulnerable to path-based denial of service attacks (PDoS). If checking integrity and authenticity of a message is done only at the final destination, the intermediate nodes are going to forward bogus packets injected by an adversary many hops before they are detected. Therefore, the adversary can easily overwhelm intermediate nodes by bogus or replayed packets. This attack exhausts the nodes along the path. In addition, other downstream nodes that depend on the exhausted nodes as intermediate nodes will be isolated, and they have to find alternative paths. Regarding broadcast traffic that originated from the base station, if packets were injected by an adversary, the whole network's nodes will be exhausted. Therefore, there is a need to enable intermediate nodes to filter out bogus packets. We adopted a link layer security scheme to enable en route intermediate nodes to filter out any bogus or replayed packet as soon as it is injected into the network. Our scheme can handle different types of traffic. Simulation results show that our algorithm outperforms the one-way hash chain (OHC) algorithm and that it is more scalable.

Distributed Secure Clustering Protocol in Wireless Sensor Networks

PDF HTML阅读 XML下载 导出引用 引用提醒 一种无线传感器网络分布式安全成簇协议 DOI: 作者: 作者单位: 作者简介: 通讯作者: 中图分类号: 基金项目: Supported by the National Natural Science Foundation of China under Grant No.60533110 (国家自然科学基金); the National Basic Research Program of China under Grant No.2006CB303000 (国家重点基础研究发展计划(973)); the Program for New Century Excellent Talents in University of Distributed Secure Clustering Protocol in Wireless Sensor Networks Author: Affiliation: Fund Project: 摘要 | 图/表 | 访问统计 | 参考文献 | 相似文献 | 引证文献 | 资源附件 | 文章评论 摘要:分簇的层次型拓扑控制方式在无线传感器网络中得到广泛研究和应用.然而,由于传感器网络本身所具有的开放性和资源有限的特点,攻击者可以很容易对成簇协议实施有效的误用和破坏.因此,保证成簇协议安全性是其实际广泛应用的基本前提.针对成簇协议所面临的各种安全威胁,提出了一种分布式安全成簇协议,通过网络安全初始化、可信基站的随机数广播和单向密钥链技术来有效地抵御节点伪装和簇首占据攻击、簇成员恶意征募攻击和多重簇成员身份攻击.对协议的安全性和开销进行了广泛和深入的分析,证明了协议的安全性和有效性. Abstract:The cluster-based hierarchical topology control has been widely studied and applied in wireless sensor networks. But because of the open nature and limited resource of the sensor network, clustering protocols are vulnerable to the misuse and disruption attacks from the adversaries. As a result, the security of the clustering protocols is a basic requirement for its wide application. A distributed secure clustering protocol is proposed, in which the secure network initialization, random number broadcast from the base station and one-way hash chain are used to achieve the resiliency against possible attacks including node personating, cluster-head occupying, malicious cluster-member recruiting and multiple cluster-membership attacks. The security and cost of the protocol are evaluated and the results show the resiliency and efficiency of the proposed protocol. 参考文献 相似文献 引证文献

An authenticated group key distribution scheme for wireless sensor networks

In wireless sensor networks (WSNs), group key distribution is the core of secure communications since sensor nodes usually form groups and cooperate with each other in sensing data collection and in-network processing. In this paper, we present a scalable authenticated scheme for group key distribution based on a combinatorial exclusion basis system (EBS) for efficiency and one-way hash chains for authentication. The proposed scheme guarantees a lightweight authenticated group key updating procedure and is efficient in terms of storage, communication and computation overheads.

Efficient User Authentication and Key Management for Peer-to-Peer Live Streaming Systems

Recent development of the peer-to-peer (P2P) live streaming technique has brought unprecedented new momentum to the Internet with the characters of effective, scalable, and low cost. However, before these applications can be successfully deployed as commercial applications, efficient access control mechanisms are needed. This work based on earlier research of the secure streaming architecture in Trust-Stream, analyzes how to ensure that only authorized users can access the original media in the P2P live streaming system by adopting a user authentication and key management scheme. The major features of this system include (1) the management server issues each authorized user a unique public key certificate, (2) the one-way hash chain extends the certificate's lifetime, (3) the original media is encrypted by the session key and delivered to the communication group, and (4) the session key is periodically updated and distributed with the media. Finally, analyses and test results show that scheme provides a secure, scalable, reliable, and efficient access control solution for P2P live streaming systems.

A loss-tolerant group key management scheme with revocation capability for wireless sensor network

A new group key management scheme against the unreliable wireless communication channel and unsafe environment was proposed for wireless sensor network (WSN). In the proposed scheme, broadcast polynomial, generated over finite field Fq based on the secret sharing, was employed to revoke compromised sensor nodes. In order to tolerate key-update message loss, group session keys were generated as one-way hash chain sequence and distributed in advance. The analysis showes that the scheme has better performance in terms of the computation and communication overhead.