Pre-shared Key Research Articles

An Observer-Based Key Agreement Scheme for Remotely Controlled Mobile Robots

Remotely controlled mobile robots are important examples of Cyber–Physical Systems (CPSs) that are being deployed in many safety critical applications. Different control schemes that have been proposed to secure such systems against sophisticated cyber-attacks require the exchange of secret messages between their smart actuators and the remote controller. Thus, these schemes require pre-shared secret keys, or an established Public Key Infrastructure that allows for key agreement. Such cryptographic approaches might not always be suitable for the deployment environments of such remotely mobile robots. To address this problem, in this paper, we consider a control theoretic approach for establishing a secret key between the remotely controlled robot and the networked controller without resorting to traditional cryptographic techniques. Our key agreement scheme leverages a nonlinear unknown input observer and an error correction code mechanism to allow the robot to securely agree on a secret key with its remote controller. The effectiveness of the proposed solution is shown by mean of experimental results obtained using a Khepera-IV robot.

Explicit Wiretap Channel Codes via Source Coding, Universal Hashing, and Distribution Approximation, When the Channels’ Statistics are Uncertain

We consider wiretap channels with uncertainty on the eavesdropper channel under (i) noisy blockwise type II, (ii) compound, or (iii) arbitrarily varying models. We present explicit wiretap codes that can handle these models in a unified manner and only rely on three primitives, namely source coding with side information, universal hashing, and distribution approximation. Our explicit wiretap codes achieve the best known single-letter achievable rates, previously obtained non-constructively, for the models considered. Our results are obtained for strong secrecy, do not require a pre-shared secret between the legitimate users, and do not require any symmetry properties on the channel. An extension of our results to compound main channels is also derived via new capacity-achieving polar coding schemes for compound settings.

Mediated authenticated differential phase shift quantum key distribution

This paper proposes the first mediated authenticated differential phase shift quantum key distribution (DPS-QKD) protocol. An untrusted third party is introduced to reduce the burden of the sender and help two participants to share a session key. Besides, a pre-shared secret key between two participants is used for mutual authentication and key distribution without assuming the existence of an ideal authenticated classical channel needed in existing DPS-QKD schemes. The security analysis shows that our modified scheme is resistant to the Trojan-horse attack, and the unconditional security proof is presented.

Integrating an optimised PUF-based authentication scheme in OSCORE

Due to the growth in the amount and type of connected devices, mainly IoT devices, new scalable, lightweight and security-aware protocols, e.g., CoAP and MQTT, have been defined. For the definition of these protocols, the axioms concerning security must cover all the needs regarding authentication, confidentiality, integrity and availability of both devices and servers.CoAP specifies mainly protocol security based on the transport layer through DTLS. Nevertheless, OSCORE (Object Security for Constrained RESTful Environments) has been recently defined to support end-to-end protection of RESTful interactions over the CoAP protocol. It was designed for constrained devices and networks supporting a range of proxy operations, including translation between different transport protocols. The main challenge presents in OSCORE is the establishment and exchange of pre-shared keys required to protect data. For that, this paper defines how use an optimised version of SRAM-based PUF (Physical Unclonable Functions) for a secure authentication, key establishment and exchanging model. The proposal has been implemented and evaluated in a scenario including IoT devices.

Free-space optical stealth communication based on wide-band spontaneous emission

We proposed and experimentally demonstrated a free-space optical stealth communication system that hides the stealth signal in wide-band spontaneous emission noise. Spontaneous emission light sources have been widely used for illuminations and has been recently deployed for short distance and indoor free-space optical communications, such as LiFi. Since free-space optical communication is a broadcasting network, the users’ privacy is exposed to eavesdropping attacks. In this paper, stealth communication is achieved by taking advantage of the existing properties of spontaneous emission light sources, random phase fluctuations, and protects users’ privacy in free-space communication networks. The keys to hide and recover the stealth signal are the optical delays at the transmitter and receiver. Only by matching the delay length with the pre-shared keys can the authorized receiver recover the stealth signal. Without the right key, the eavesdropper receives a constant power that is the same as illumination light sources and cannot detect the existence of the stealth signal.

An Anonymous Authentication and Key Update Mechanism for IoT Devices Based on EnOcean Protocol.

EnOcean, a commonly used control protocol in smart lighting systems, provides authentication, as well as message integrity verification services, and can resist replay attack and tamper attack. However, since the device identity information transmitted between sensors in smart lighting control systems is easily accessible by malicious attackers, attackers can analyze users’ habits based on the intercepted information. This paper analyzed the security of the EnOcean protocol using a formal analysis method based on the colored Petri net (CPN) theory and the Dolev–Yao attacker model and found that the protocol did not anonymize the device identity information and did not have a communication key update mechanism, so an attacker could easily initiate a key compromise impersonation attack (KCIA) after breaking the pre-shared communication key. To address the above security issues, this paper proposed an EnOcean-A protocol with higher security based on the EnOcean protocol. The EnOcean-A protocol introduced a trusted third-party server to send communication keys to communication devices because devices must obtain different communication keys from the trusted third-party server each time they communicated. Thus, this protocol could resist a KCIA and achieve forward security. Meanwhile, the device identity information was anonymized using a homomorphic hash function in the EnOcean-A protocol, and the dynamic update mechanism of the device identity information was added so that an attacker could not obtain the real identity information of the device. Finally, the formal analysis of the EnOcean-A protocol showed that the new protocol could resist a KCIA and ensure the anonymity and untraceability of the communication device, which had higher security compared with the EnOcean protocol.

Authenticated Semi-Quantum Key Distribution Protocol Based on W States.

In 2019, Wen et al. proposed authenticated semi-quantum key distribution (ASQKD) for identity and message using the teleportation of W states and GHZ-like states without pre-shared keys. However, the ASQKD protocol presents a vital issue in the teleportation of W states owing to its inappropriate design. Bob recovers the teleported W states without obtaining the position of the corresponding photons and then returns the recovered photons back to Alice. Hence, the teleportation of W states in Wen et al.’s ASQKD protocol was malfunctioning. Moreover, Wen et al.’s ASQKD protocol requires quantum memory, which strongly disobeys the definition of semi-quantum proposed by Boyer et al. Therefore, in this study, we discover the flaws of Wen et al.’s ASQKD protocol and propose an authenticated semi-quantum key distribution protocol. When compared to Wen et al.’s ASQKD protocol, the proposed ASQKD protocol has the following advantages: legal semi-quantum environment (i.e., does not require quantum memory), reduced quantum hardware requirement (i.e., based only on W states), does not involve classical cryptography (i.e., the hash function), and provided 1.6 times higher qubit efficiency.

Single-state multi-party semiquantum key agreement protocol based on multi-particle GHZ entangled states

In this paper, we put forward a novel single-state three-party semiquantum key agreement (SQKA) protocol with three-particle GHZ entangled states first. Different with previous quantum key agreement (QKA) protocols, the proposed single-state three-party SQKA protocol can realize the goal that a quantum party and two classical parties who only possess limited quantum capabilities equally contribute to the generation of a shared private key over quantum channels. Detailed security analysis turns out that the proposed single-state three-party SQKA protocol is secure against several famous attacks from an outside eavesdropper, such as the Trojan horse attack, the entangle-measure attack, the measure-resend attack and the intercept-resend attack. Moreover, it can resist the participant attack, which means that the shared private key cannot be determined fully by any nontrivial subset of three parties. The proposed single-state three-party SQKA protocol has the following nice features: (1) it only employs one kind of three-particle GHZ entangled states as initial quantum resource; (2) it does not need pre-shared keys among different parties; (3) it does not need unitary operations or quantum entanglement swapping. Finally, we generalize the proposed single-state three-party SQKA protocol into the case of $$N$$ -party by only employing one kind of $$N$$ -particle GHZ entangled states as initial quantum resource, which inherits the nice features of its three-party counterpart.

Three-Party Secure Semiquantum Summation without Entanglement Among Quantum User and Classical Users

In this paper, a three-party secure semiquantum summation protocol, which can calculate the modulo 2 addition of the private bits from one quantum participant and two classical participants, is constructed by only using single qubits as the initial quantum resource. This protocol needs none of quantum entanglement swapping, the unitary operation or a pre-shared private key. This protocol only requires the quantum participant to perform the $$\left\{ {\left| 0 \right\rangle ,\left| 1 \right\rangle } \right\}$$ basis measurements, the $$\left\{ {\left| + \right\rangle ,\left| - \right\rangle } \right\}$$ basis measurements and the Bell basis measurements. Compared with the existing only semiquantum summation protocol (Int J Theor Phys, 60 (2021) 3478), this protocol has better performance in quantum measurements for quantum participant; moreover, it may also have higher qubit efficiency.

Efficient and Secure Measure-Resend Authenticated Semi-Quantum Key Distribution Protocol against Reflecting Attack

In 2021, Chang et al. proposed an authenticated semi-quantum key-distribution (ASQKD) protocol using single photons and an authenticated channel. However, an eavesdropper can launch a reflective attack to forge the receiver’s identity without being detected. In addition, Chang et al.’s ASQKD protocol assumes an authenticated classical channel between the sender and the receiver. It is considered illogical to have an authenticated channel in the ASQKD protocol. If these security issues are not addressed, the ASQKD protocol will fail to deliver the secret key. Therefore, this study proposes an efficient and secure ASQKD protocol to circumvent these problems using only single photons. Security analysis proves that the proposed ASQKD protocol can effectively avoid reflecting attacks, collective attacks, and other typical attacks. Compared with the existing ASQKD protocols, this study has the following advantages: based on a single photon, it demands less advanced quantum devices, the communication efficiency is higher than most protocols, it reduces the length of the required pre-shared keys, endures reflecting attacks, collective attacks, and there is no need for the classical channel.

An Efficient Key Management and Multi-Layered Security Framework for SCADA Systems

Supervisory Control and Data Acquisition (SCADA) networks play a vital role in industrial control systems. Industrial organizations perform operations remotely through SCADA systems to accelerate their processes. However, this enhancement in network capabilities comes at the cost of exposing the systems to cyber-attacks. Consequently, effective solutions are required to secure industrial infrastructure as cyber-attacks on SCADA systems can have severe financial and/or safety implications. Moreover, SCADA field devices are equipped with microcontrollers for processing information and have limited computational power and resources. This makes the deployment of sophisticated security features challenging. As a result, effective lightweight cryptography solutions are needed to strengthen the security of industrial plants against cyber threats. In this paper, we have proposed a multi-layered framework by combining both symmetric and asymmetric key cryptographic techniques to ensure high availability, integrity, confidentiality, authentication and scalability. Further, an efficient session key management mechanism is proposed by merging random number generation with a hashed message authentication code. Moreover, for each session, we have introduced three symmetric key cryptography techniques based on the concept of Vernam cipher and a pre-shared session key, namely, random prime number generator, prime counter, and hash chaining. The proposed scheme satisfies the SCADA requirements of real-time request response mechanism by supporting broadcast, multicast, and point to point communication.

Asymptotically Guaranteed Anti-Jamming Spread Spectrum Random Access Without Pre-Shared Secret

Our main contribution is the design of a spread spectrum random access scheme without pre-shared secret with asymptotically guaranteed availability against electronic/cyber-based jamming attacks. In order to establish asymptotic anti-jamming guarantees, first we develop the system model and show that for reactive jamming (only limited by the laws of physical propagation), the required location for a successful attack can be controlled by design. Then, for non-reactive protocol-aware jamming, we map a random selection of (publicly known) spreading codes to the computational birthday problem. Differently to the related literature, we formulate the birthday problem using entropic measures (Rényi entropy), which allows to obtain the optimal spreading code set sizes that guarantee asymptotically zero collision probability. Accordingly, the birthday attack is the best strategy to optimize the (trial and error) blind acquisition at the legitimate detector. We obtain numerical results that illustrate how to use our entropic method as a system design degree of freedom to identify realistic spreading code set sizes. We also derive an upper bound of the detection latency. Finally, we show that the resulting anti-jamming throughput is higher than the throughput under conventional operation (i.e. without anti-jamming guarantees) due to the control of collision probability by-design.

Physical-Layer Secret Key Generation in Power Line Communication Networks

Due to the inherent broadcast nature, power line communication (PLC) is vulnerable to eavesdropping. Traditionally, the secret keys are generated/distributed by pre-shared keys, adaptive tone mapping, or asymmetric encryption algorithm. All of these methods face problems such as high computational complexity, high cost, or less security. To solve the problem, a physical layer security (PLS)-based secret key generation (SKG) scheme aiming at the typical in-home broadband PLC network is proposed in this paper. However, the slowly time-varying characteristic and the serious noise interference in PLC channels will degrade the performance of the PLS-based SKG scheme. To break through the limitation of the randomness of PLC channels, two-way random signals are introduced. To make the SKG system more resistant to noise, the channel frequency response-based adaptive quantization (CFR-AQ) algorithm is designed, in which the amplitude threshold and the quantization level are adaptive to the noise power and the target key disagreement rate (KDR) to maximize the key generation rate (KGR). The performance is analyzed in two scenarios: single eavesdropper and multiple eavesdroppers. The simulation results demonstrate that the proposed scheme has a good overall performance in terms of KDR, KGR, and security with a lower complexity in the presence of single or multiple non-collusive eavesdroppers, and it can be regarded as an alternative solution to generate secret keys in PLC networks.

An efficient semi-quantum private comparison without pre-shared keys

An efficient semi-quantum private comparison without pre-shared keys

Design of Psk Based Trusted Dtls for Smart Sensor Nodes

Background: RSA based key exchange is a heavy and time-consuming process, as it involves numerous message exchange between a client and the server. Pre-shared key (PSK) based handshake process attempts to reduce the messages while the key exchange between a client and the server. Method: This paper extends the TEE enabled dtls handshake design based on RSA to the TEE enabled pre-shared key based handshake. A dtls client and the server installs the pre-shared key in advanced so that the message exchanges can be reduced while session key generation. Result: In this article, the authors have significantly reduced this penalty by fine-tuning of the tdtls algorithm for psk based handshake. On average, this gain is over 2 ms (50% - from 3.5 ms to 1.5 ms) across various cipher-suites. Conclusion: The tdtls approach increases the security of the session key and its intermediate keying materials which is a huge gain as compared to minor handshake time increase. The algorithm ensures an end-to-end security to the PSK based session key as well as its keying materials between a dtls client and a server.

Lightweight and secure authentication scheme for IoT network based on publish–subscribe fog computing model

The Internet of Things (IoT) has converged with Cloud computing to provide comprehensive services to users in different places. However, with the exponential growth of smart devices connected to the Internet, Cloud computing has severe challenges, especially for applications that require low-latency and real-time processing. Therefore, the Fog computing paradigm emerged that is more compatible with the IoT, in which events are processed near where they occurred for practical and quick response time. Authentication is an essential issue for fog computing security since fog gateways and IoT devices are subject to many attacks. The main problem to provide authentication between IoT devices is that they have limited resources and computational processing. On the one hand, certificate-based authentication algorithms are secure, but they are heavy for IoT devices. On the other hand, Pre-shared authentication algorithms such as PSK are suitable for low-resource devices, but are not widely used due to their low security. Therefore, this paper proposes to use the Elliptic Curve Diffie–Hellman Ephemeral (ECDHE) key exchange algorithm along with the Pre-Shared Key (PSK) as a lightweight and secure authentication scheme between the fog gateway and IoT device based on the Message Queuing Telemetry Transport (MQTT) publish–subscribe protocol in a distributed fog computing architecture. The proposed ECDHE-PSK authentication scheme uses Ephemeral Pre-shared key instead of heavy certificates that is very lightweight and also provides Perfect Forward Secrecy (PFS) feature to enhance security in comparison with the static PSK algorithm. To evaluate the resource consumption and security resistance of the proposed scheme it was implemented on the real test environment and then was compared with two state-of-the-art certificate-based authentication schemes and a static PSK-based scheme. The comprehensive performance and security evaluations showed that in the distributed publish–subscribe fog computing architecture the proposed ECDHE-PSK is almost as light as the PSK algorithm while has all security features of certificate-based algorithms.

Key generation schemes for channel authentication in quantum key distribution protocol

Quantum key distribution (QKD) systems enable secure key generation between two parties. Such systems require an authenticated classical channel for QKD protocols to work. Usually, the initial authentication key for this channel is pre-shared. In this work, methods that are used to renew the pre-shared keys ensuring a high level of security and performance for the subsequent quantum key generation are discussed. The model of QKD systems in terms of the lifecycle of the keys is formalised and a full set of parameters that can be used for key renewal functions is described. A detailed adversary model allows us to compare key renewal schemes by the probabilities of successful attacks and their consequences. As a result, it is shown that a hybrid key renewal scheme, which uses both the auxiliary pre-shared key and a part of the quantum sequence, has the higher security properties among considered schemes and is recommended to be used in QKD systems.

Measure-resend authenticated semi-quantum key distribution with single photons

This paper proposes a new measure-resend ASQKD protocol. The proposed ASQKD protocol uses only single photons, needs fewer pre-shared keys and even provides better qubit efficiency than the state-of-the-art ASQKD protocols. The security proof shows the robustness of the proposed protocol under the collective attack.

An improved QKD protocol without public announcement basis using periodically derived basis

The quantum key distribution (QKD) protocol provides an absolutely secure way to distribute secret keys, where security can be guaranteed by quantum mechanics. To raise the key generation rate of classical BB84 QKD protocol, Hwang et al. (Phys Lett A 244(6):489–494, 1998) proposed a subtle variation (Hwang protocol), in which a pre-shared secret string is used to generate the consistent basis. Although the security of Hwang protocol has been verified in ideal condition, its practicality is still being studied in more depth. In this work, we propose a simple attack strategy to obtain all preparation basis by stealing partial information in each round. To eliminate this security threat, we further propose an improved QKD protocol using the idea of iteratively updating the basis. Furthermore, we apply our improved method to decoy-state QKD protocol and double its key generation rate.

A One-Round Quantum Mutual Authenticated Key Agreement Protocol with Semi-Honest Server Using Three-Particle Entangled States

In this paper, we propose a mutual authenticated quantum key agreement scheme based on three-particle entangled states, which can achieve both completely secure and more efficient. In our scheme, the pre-shared keys are classical bit strings between the semi-honest server (SHS) and the client (Alice or Bob), so they are kept and use to authenticate each other easily. More important, by the SHS’s helping with three-particle entangled states, SHS and Alice/Bob can authenticate each other, and at the same time anyone else cannot get the session key between Alice and Bob even for SHS. The proposed scheme has the properties of completeness, information theoretic security, non-repudiation and unforgeability. Its information-theoretic security is ensured by quantum indistinguishability mechanics. Compared with the related works, our proposed scheme can increase efficiency factors η1 and η2 to 50% and 80% respectively in one communication round.