Pairwise Keys Research Articles

Dynamic coefficient symmetric polynomial-based secure key management scheme for Internet of Things (IoT) networks.

With the extensive application and continuous expansion of the Internet of Things (IoT), the access of a large number of resource-limited nodes makes the IoT application face a variety of security vulnerabilities and efficiency limitations, and the operating efficiency and security of IoT are greatly challenged. Key management is the core element of network security and one of the most challenging security problems faced by wireless sensor networks. A suitable key management scheme can effectively defend against network security threats. However, among the key management schemes that have been proposed so far, most of them do not take into account the efficiency in terms of connectivity rate and resource overhead, and some of them even have security risks. In this article, based on the symmetric polynomial algorithm, a dynamic coefficient symmetric polynomial key management scheme is proposed to better solve the IoT security problem. In this scheme, the nodes' IDs are mapped into the elements of the shared matrix M by the identity mapping algorithm, and these elements are used to construct polynomials P(x,y) to generate pairwise keys. The communicating nodes have their own coefficients of P(x,y) and thus have higher connectivity. The overall performance evaluation shows that the scheme significantly improves the resilience against node capture and effectively reduces the communication and storage overheads compared to the previous schemes. Moreover, the scheme overcomes the λ-security of symmetric polynomial key management scheme, and is able to provide a large pool of polynomials for wireless sensor networks, facilitating large-scale application of nodes.

Lightweight Cryptography Using Pairwise Key Generation and Malicious Node Detection in Large Wireless Sensor Network

Lightweight Cryptography Using Pairwise Key Generation and Malicious Node Detection in Large Wireless Sensor Network

Simple and efficient threshold changeable secret sharing

Shamir's (t, n) threshold secret sharing (SS) is one of the most important cryptographic primitives in various security applications designed to protect highly sensitive information, such as intellectual property and network security. A dealer in a (t, n) threshold SS divides the secret into n shares such that with t or more than t of these shares, the secret can be retrieved; but with less than t of these shares, no information of the secret can be revealed. In order to adapt the dynamic environment in various applications, the threshold changeable SS (TCSS) allows the threshold of the original secret to be dynamically adjusted. Note that Shamir's original SS is unable to achieve this property. In the literature, most existing TCSS schemes are suffering from limitations that either it requires a trusted dealer to generate and distribute new shares, or requires interactions among shareholders to generate new shares. In this paper, we propose a novel idea to construct a dealer-free and non-interactive TCSS based on pairwise keys between users. Research papers related to pairwise key distribution schemes have been published over last 40 years and it has become one of fundamental tools used in design of cryptographic solutions. First, we show that our idea can be used to construct a scheme for anonymously releasing data and a secure multiparty computation scheme. Both schemes are very simple and security analysis can be understood easily. Second, we demonstrate that a TCSS can also be designed based on same approach. Our design of TCSS is novel and it can be applied to convert any existing SS into a TCSS.

Lightweight Encryption and Authentication for Controller Area Network of Autonomous Vehicles

With the rapid development of autonomous vehicles (AVs), vehicle safety has attracted attention. Controller area network (CAN) bus without authentication and encryption mechanisms is a weakness of the in-vehicle network (IVN), and attackers always primarily target the CAN bus. Attacks on the AVs' CAN bus are more frequent because AVs have more external interfaces and sensors than ordinary vehicles. To address the abovementioned issues, this paper proposes a lightweight encryption and authentication scheme for the CAN bus of AVs using message authentication codes and Grain stream cipher. The scheme realizes efficient authentication between electronic control units and a counter re-synchronization protocol is used to ensure that authentication failure owing to counter inconsistency is prevented. Blom key management scheme is employed to rapidly distribute and update session keys, avoiding the complicated process of updating pairwise keys. In addition, considering the scalability of the IVN, a key distribution protocol for new nodes was provided. The security proof using Burrows-Abadi-Needham logic and security analysis prove that the proposed scheme can satisfy the security requirements of the IVN. In addition, performance analysis shows that the proposed scheme can meet real-time requirements and has little impact on the busload.

IFKMS: Inverse Function-based Key Management Scheme for IoT networks

Due to the rapid growth of the Internet of Things (IoT), secure communication is becoming a significant concern. Nodes that compose such a dynamic network need to exchange sensitive and valuable data. The data must be kept safe against attacks. This protection requires the development of efficient key management protocols. However, this task is challenging because of the high resource constraints of most IoT devices in terms of storage, communication, processing, and energy capabilities. Some existing key management techniques have certain weaknesses since sensitive parameters are not protected during transmission, and cryptographic keys are stored in plain text and usually renewed at a fixed period of time. This paper proposes a new key management protocol aiming to secure communications before and after key establishment. Our scheme uses hash and one–one functions to achieve security during the key establishment process. The symmetrical character of the invertible functions is thus exploited to conceal critical data and pairwise keys stored in nodes’ memories. Moreover, the key refresh period is variable, which can be adjusted according to the number of occurred attacks in the network. BAN (Burrows Abadi Needham) logic is employed to assess the correctness of the proposed scheme. The results show that our scheme operates correctly and does not have redundancies or security flaws. Furthermore, the security and performance analysis point out that the proposed scheme is resilient against well-known attacks, and efficient in terms of storage, communication, computation overhead, and energy consumption.

Do not forget the past: A buffer-aided framework for relay based key generation

We address relay-assisted key generation wherein two wireless nodes, that have no direct channel between them, seek the assistance of an intermediate relay to generate secret keys. In a celebrated version of the relay-assisted protocol, as applied by Lai et al., Zhou et al., Wang et al., and Waqas et al., the relay node generates pair-wise keys with the two nodes, and then broadcasts an XOR version of the two keys. Although such protocols are simple and effective, we observe that they face reduction in key rates due to two problems. First, for confidentiality, the relay broadcasts an XOR function of the pair-wise keys thereby pruning the length of the shared key to be the minimum of the key lengths of the pair-wise keys. Secondly, the broadcast phase may also experience outages thereby not being able to share the generated key in every round of the protocol. Identifying these issues, we propose a buffer-aided relaying protocol wherein buffer is used at the relay to store unused secret bits generated in the previous rounds of the protocol so as to provide confidentiality in the subsequent rounds of broadcast. On this buffer-aided protocol, we propose a power-allocation strategy between the phases of key generation and broadcast so as to maximize the throughput and key rate. Rigorous analyses show that buffer-aided relay when implemented along with the proposed power-allocation strategy offer remarkable advantages over existing baselines.

Lightweight group key distribution schemes based on pre‐shared pairwise keys

In a secure communication, a one-time session key is needed to be shared among all participants. Most well-known key distribution schemes, such as Diffie–Hellman public-key key distribution scheme invented in 1976 and quantum key distribution scheme invented in 1984 (also called the BB84 scheme), can only allow two users to share a key in conventional one-to-one communications. There are many research papers in the literature to propose group key distribution schemes for multiple participants in modern group communications. In this study, the authors propose lightweight group key distributions using pre-shared pairwise keys. The authors first propose a three-party group key distribution scheme. They then extend the basic three-party scheme to establish a group key for a large size of group communications. The proposed generalised schemes can be based to any type of pairwise key distribution schemes, e.g. either quantum or non-quantum. Moreover, both generalised multi-party group key distribution schemes are lightweight. The main operations in the proposed schemes are key comparison between two or more than two keys (i.e. logic XOR operation) and the computation of key derivation functions.

Security, usability, and biometric authentication scheme for electronic voting using multiple keys

We propose electronic voting authentication scheme, which is a key management mechanism for electronic voting system intended to limit the number of attacks on a polling station and strengthen the security control. The motivation is to diversify security requirements of messages exchanged between polling stations. There are different types of messages exchanged between polling stations and each type of message has different security needs. A security mechanism developed on the basis of a single key is not enough to ensure the diverse security needs of voting network. In electronic voting authentication scheme, every polling station is responsible to support three different types of keys. These are global key, pairwise key, and individual key. The global keys are public keys shared with all polling stations in the voting network. The pairwise key can be used for communication with polling stations. Individual keys will be used for communication with the server. To ensure authentication of local broadcast, electronic voting authentication scheme uses one-way key chains in a well-organized way. The support of source authentication is a visible advantage of this scheme. We examine the authentication of electronic voting authentication scheme on numerous attack models. The measurement demonstrates that electronic voting authentication scheme is very operative in protecting against numerous elegant attacks such as wormhole attack, Sybil attack, and HELLO Flood attack. The proposed system is evaluated and the results demonstrate that the proposed system is practical and secure as compared to the direct recording electronic and manual systems.

Multi-party pairwise key agreement in linear number of Diffie–Hellman key exchanges

We consider a classical problem of multi-party pairwise key agreement (MP-KA): n parties wish to establish a secure communication channels to each other. Currently, this problem is easily solved with involvement of a trusted Key Distribution Center (KDC) or Key Translation Center (KTC), public key encryption or key pre-distribution protocols. But these solutions are not applicable when some parties are corrupted and all of them have only a link to the Certificate Verification Center (CVC). We develop MP-KA protocol without Trusted Setup and involvement of KDC or KTC, which reduces the number $$(n(n-1))/2$$ of Diffie–Hellman key exchanges (DH-KE). Precisely, for an adversary, who corrupts no more then t-out-of-n parties, $$t \le [n/2]-1$$ , we reduce this number to $$(n-t-1)\cdot (t+1)$$ , and thus to O(n) for the constant value of t. Our protocol consists of two phases: (1) $$k = (n-t-1)\cdot (t+1)$$ DH-KE runs to establish secure channels between a subset of all parties and (2) a protocol based on secret sharing, intended to agree on pairwise keys between other parties. We prove that the second phase of protocol is perfectly secure against semi-honest threshold adversary. As a result, we improve the efficiency of multi-party pairwise key agreement in comparison with direct Diffie–Hellman-based approach.

Security Architecture for Secure Multicast CoAP Applications

Multicast communication has been recently supported by the constrained application protocol (CoAP), for the purpose of managing and controlling a group of homogeneous sensor devices. It can improve the efficiency of communication and reduce bandwidth requirements for several Internet of Things (IoT) and industrial IoT (IIoT) applications. To prevent unauthorized access to the sensing/actuating devices, both unicast and multicast CoAP messages should be secured to guarantee both confidentiality and integrity. For unicast CoAP applications, the datagram TLS (DTLS) Handshake can be applied for mutual authentication and session key derivation. However, it cannot be used for multicast CoAP applications since it is basically applied between two CoAP endpoints. Especially, two kinds of keys, a group key and a set of pairwise keys, are required to secure the multicast CoAP messages. In this article, the security architecture and associated protocols for multicast CoAP security are proposed. With the exchange of a pair of multicast CoAP messages, the group key and the set of pairwise keys can be established between a CoAP client and a set of CoAP servers without employing the DTLS Handshake . The security and performance analysis show that it is a viable solution for multicast CoAP applications even over the unreliable user datagram protocol.

LSTR: Lightweight and Secure Tree-Based Routing for Wireless Sensor Networks

This paper proposes a Lightweight and Secure Tree-based Routing protocol (LSTR) for Wireless Sensor Networks. The security of data routing from sensor nodes to the Base Station (BS) is achieved based on an efficient ID-based authenticated key-agreement protocol. LSTR reduces the number of required keys to a single permanent private-key preloaded in sensor nodes. This key is used subsequently to generate authenticated pairwise keys with other nodes without further digital signatures or certificates. As a result, LSTR achieves both node’s authenticity and confidentiality during data delivery at low cost and without involving the BS. In addition, a single message must be transmitted by the nodes for both the routing-tree construction and key-establishment at the same time, and which reduces the communication overheads. The performance analysis results show that LSTR reduces the storage requirements, the communication overheads and the energy dissipation compared to similar relevant works, particularly during the key-establishment. Additionally, the robustness of our scheme is highlighted through a security analysis.

A Secure Communication System in Self-Organizing Networks via Lightweight Group Key Generation

Self-organizing networks provide rapid and convenient networking for many situations and have gained extensive research. With the progress of researches, security issues have attracted people's attention. There is no central node in self-organizing networks, and therefore the traditional key distribution methods based on public infrastructure do not work. The standardized pre-shared keys have predictable security risks. The physical-layer secret key generation has become a technology worth considering due to its lightweight, security, and decentralization. However, most of the previous work has focused on two devices, and remains a challenge to expand the pairwise key into the group key. Since the channel reciprocity only exists between two devices, some information would be exchanged on the unencrypted channel, causing information leakage. This paper designs a secure communication system in self-organizing networks. It adopts an adaptive quantizer to generate the pairwise keys and proposes DORCE, Difference Of quantization Results at one deviCE. The authenticated users share the group key via the difference between pairwise keys. The algorithm is implemented in a mesh topology, which is suitable for self-organizing networks because users' joining and leaving will not have a great impact on the network topology. The algorithm's Key Achievable Rate is up to 4 bits. Experimental results demonstrate that DORCE can generate the group keys in seconds. The Key Generation Rate is above 10 bits per second, enabling a group key generation to be used in a communication system for self-organizing networks. All the generated keys pass the NIST Statistical Test Suite.

Transitory Master Key Transport Layer Security for WSNs

Security approaches in Wireless Sensor Networks (WSNs) are normally based on symmetric cryptography. Instead of symmetric encryption, some alternative approaches have been developed by using public-key cryptography. However, the higher computational cost represents a hard limitation to their use. In this paper, a new key management protocol is proposed. A transitory symmetric key is used to authenticate nodes in the network during the key establishment. However, pairwise keys are established using asymmetric cryptography. A theoretical analysis shows that the computational effort required by the public key cryptosystem is greatly reduced, while the security of the network is increased with respect to state-of-the-art schemes based on a transitory master key. Moreover, an experimental analysis demonstrates that this proposed approach can reduce the time spent for key establishment by about 35%.

Multi-tier Framework for Optimizing Pairwise Key Predistribution in Sensory Applications

Security has been always a prominent concern in Wireless Sensor Network (WSN) irrespective of the evolution of various scientific approaches that mainly mechanizes key management approaches to secure the communication system among the resource constraints sensors. Out of various key management approaches, pairwise key is one effective approach to ensure cost effective key management scheme; however, review of existing approaches shows that they still are characterized by various issues connected to optimized performance. Adopting analytical research methodology, the proposed system implements an optimized multi-tier framework for resisting key-based threats and it targets to introduce a lightweight pair wise predistribution of keys by joint integration of enhanced public key encryption and digital signature. The study outcome shows that proposed system offer a better security performance in contrast to existing pair wise predistribution of keys.

A Security Key Management Method using Grid Routing for EDDK in WSNs

Wireless sensor networks (WSNs) utilize event data collected through sensor nodes, which can be employed in different environments. Sensor nodes used in WSNs have limited energy and can be easily compromised by attackers since they are placed in the external environment. Therefore, energy efficiency and security are core requirements in WSNs, and various schemes have been proposed to solve them. The energy-efficient distributed deterministic key management scheme (EDDK) is a security scheme that uses distributed pairwise keys. The EDDK encrypts the packet using the pairwise key of the neighboring node, and transmits the encrypted packet securely to the base station (BS). In addition, the pairwise key shared with neighboring nodes is updated to defend against network attacks such as Denial of Service. However, the energies of the sensor nodes decrease rapidly in environments where key updates occur frequently. Further, since EDDK does not encrypt the sequence number, the attacker can manipulate this sequence number. If such attacks are continually attempted, key updates occur frequently. This paper proposes a scheme that removes the local cluster key from the EDDK and instead uses a grid routing protocol. The proposed scheme reduces the number of key updates by removing the local cluster key. In addition, the proposed scheme constructs the routing as a grid and selects the sensor node nearest to the BS as the master node. the master node of the grid routing scheme transmits routing control messages to the corresponding sensor nodes. In this way, the proposed method improves the sensor network energy efficiency. Experimental results show that the energy efficiency of the sensor network is improved by about 7.8097% compared with EDDK. Additionally, since the proposed scheme removes the local cluster key, sequence number manipulation attacks can be avoided. As a result, the security rate of the proposed scheme is more than double compared with EDDK.

A Matrix-Based Pair-Wise Key Establishment for Secure and Energy Efficient WSN-Assisted IoT

The Internet of Things (IoT) is getting the reputation as one of the most optimistic networking paradigms that is reducing the gap between the cyber world and physical world. Most of the participating nodes in IoT network are sensors, which are limited in terms of resource such as energy, computation power, memory and so on. In IoT network, nodes communicate with each other via wireless medium, which makes the IoT network vulnerable to many security threats including eavesdropping. The IoT network is deployed in a large area and work on 24/7 hours, so an energy efficient scheme is one of the major issues in IoT. To achieve secure and energy efficient network, this article contributes: (1) A hierarchical topology for IoT network deployment; (2) symmetric matrix-based pair-wise key generation for secure communication; (3) A secure and energy efficient secure routing algorithm for the proposed model.

Dynamic Key Management Schemes in Wireless Sensor Networks and Cyber Physical Systems

With the fast development and widespread comply of wireless sensor networks (WSN) security is one of the prominent issues. WSNs have been used in many applications including environmental monitoring, wireless mobile networks for health monitoring, traffic monitoring, real space monitoring and in military surveillance. Due to the limitations of sensor nodes, traditional key management schemes have some problem’s, therefore efficient key management schemes are required for WSNs for secure communication. The main aim of key management scheme is to establish keys between the communicating nodes to exchange data in Cyber Physical Systems (CPS). Key management schemes are classified into static and dynamic. In static schemes, there are many challenges. Among the communication entities, there is no handshaking in static key management and other approach is distributed pair wise keys which are used for an exchange of data between communication nodes. To overcome those challenges dynamic key management schemes have been introduced. Security services such as authentication, integrity­, non-repudiation, and confidentiality are required for message security. Thus, key management is one of the fundamental issues in CPS security.

A (<inline-formula> <tex-math notation="LaTeX">${M}$ </tex-math> </inline-formula>, <inline-formula> <tex-math notation="LaTeX">${m}$ </tex-math> </inline-formula>) Authentication Scheme Against Mobile Sink Replicated Attack in Unattended Sensor Networks

In some non-real time applications, data is collected by mobile sinks (MSs). This kind of network is vulnerable to MSs replicated attack. In this attack, replicated MSs can collect data from sensor nodes by establishing pairwise keys with them using keys information obtained from captured sensors. In this letter, a ( ${M}$ , ${m}$ ) authentication scheme against the attack is proposed. The analysis and simulation results indicate that the scheme can improve networks’ resilience against MS replicated attack as compared with existing schemes.

A new hybrid key pre-distribution scheme for wireless sensor networks

This article presents a novel hybrid key pre-distribution scheme based on combinatorial design keys and pair-wise keys. For the presented scheme, the deployment zone is cleft into equal-sized cells. We use the combinatorial design based keys to secure intra-cell communication, which helps to maintain low key storage overhead in the network. For inter-cell communication, each cell maintain multiple associations with all the other cells within communication range and these associations are secured with pair-wise keys. This helps to ensure high resiliency against compromised sensor nodes in the network. We provide in-depth analysis for the presented scheme. We measure the resiliency of the presented scheme by calculating fraction of links effected and fraction of nodes disconnected when adversary compromises some sensor nodes in the network. We find that the presented scheme has high resiliency than majority of existing schemes. Our presented scheme also has low storage overhead than existing schemes.

The Impact of Incomplete Secure Connectivity on the Lifetime of Wireless Sensor Networks

Key predistribution schemes accommodate secure connectivity by establishing pairwise keys between nodes. However, ensuring security for all communication links of a wireless sensor network (WSN) is nontrivial due to the memory limitations of the nodes. If some of the links are not available due to the lack of a primary security association between the transmitter and the receiver, nodes can still send their data to the base station but probably not via the best route that maximizes the network lifetime. In this study, we propose a linear programming framework to explore the incomplete secure connectivity problem with respect to its impact on network lifetime, path length, queue size, and energy dissipation. The numerical results show that if any two nodes share a key with a probability of at least 0.3, then we should expect only a marginal drop (i.e., less than 3.0%) in lifetime as compared to a fully connected network.