Privacy-preserving Authentication Protocol Research Articles

A secure authentication protocol for remote patient monitoring in an internet‐of‐medical‐things environment

AbstractInternet of Medical Things (IoMT) enable users to avail healthcare services remotely. In IoMT, sensor nodes (SNs), like blood pressure sensors and temperature sensors, collect health data from patients and communicate it to Health Workers (HWs) such as doctors, nurses, and so on. The HWs cater to the patients remotely, known as remote patient monitoring (RPM), by using data obtained from SNs. The communicated health data between SNs and HWs are sensitive in nature. Leakage and modification of such data leads to huge consequences, particularly patient death during medical emergencies. Hence, ensuring mutual authentication along with data integrity and privacy is of utmost important in the healthcare domain. In the literature, many authentication protocols are presented for healthcare applications specific to IoMT‐RPM. But, most of the existing approaches fail to provide adequate security against well‐known attacks includes impersonation and man‐in‐the‐middle attacks. In this paper, we propose a privacy preserving authentication protocol for IoMT‐RPM which is secure against various known attacks. We present a rigorous formal security analysis of our protocol under the extended Canetti‐Krawczyk (eCK) adversary model. In addition, we also perform formal verification using Tamarin Prover, a symbolic formal analysis tool. The results show that the proposed protocol is secure under eCK‐adversary model. We then present the comparative performance analysis to show the efficiency of the proposed protocol over the existing protocols. As a result, the proposed protocol provides high security without compromising the performance over the existing protocols, and therefore, our protocol is very much suitable for real‐time applications.

Multi-TA model-based conditional privacy-preserving authentication protocol for fog-enabled VANET

The rapid growth of Vehicular Ad-hoc Networks (VANET), fueled by advancements in the Internet-of-Things, cloud computing, Intelligent Transportation Systems, and fog computing, has led to the introduction of fog node-based VANET to serve resource-constrained devices. In the traditional security models of VANET, due to the use of a centralized trusted authority, there is a chance of single-point-of-failure and service unavailable with the increased service access requests. Also, there was one-to-one communication between each roadside unit and trusted authority. This may increase the system complexity and increase the traffic load. To address these issues, a novel authentication protocol for fog-enabled VANET based on multiple trusted authority model is discussed which reduces the chance of service unavailability and single-point-of-failure as the entire traffic load is distributed among multiple sub-trusted authority. Due to the incorporation of fog node, a group of roadside units can be controlled centrally, where trusted authority does not need to perform individual authentication for each roadside unit. The proposed protocol's security is rigorously examined through both informal and formal security analysis. Additionally, the protocol exhibits enhanced security features, as demonstrated in a performance comparison section, showcasing its ability to meet the security and privacy requirements while incurring relatively low communication and computation and storage costs. Thus, the proposed protocol offers a secure and efficient authentication protocol for fog-enabled VANET.

Shared group session key-based conditional privacy-preserving authentication protocol for VANETs

Vehicular Ad-Hoc Networks (VANETs) have significantly enhanced driving safety and comfort by leveraging vehicular wireless communication technology. Due to the open nature of VANETs, conditional privacy-preserving authentication protocol should be offered against potential attacks. Efficient and secure authentication among vehicles in VANETs are important requirements, but there are various limitations in the existing conditional privacy-preserving authentication protocols for securing VANETs. To cope with the inherent issues, we propose a conditional privacy-preserving authentication protocol based share group session key (SGSK) by integrating the self-healing key distribution technique, blockchain, and MTI/C0 protocol. In our protocol, we use SGSK instead of the time-consuming Certificate Revocation List (CRL) checking, and we revoke malicious vehicles by updating SGSK. It is shared among unrevoked vehicles within a domain and across-domain. As a result, when a malicious revoked vehicle enters a new domain, it is difficult for it to access the system and send false messages. Furthermore, our protocol can not only achieve computation efficiency by reducing the number of computing operations of bilinear pairing but also resist various attacks while keeping conditional privacy protection. We implement our protocol in the Hyperledger Fabric platform. The experimental results show that our protocol is available to revoke 180 malicious vehicles in across-domain scenarios within one second, and it can meet the requirement of verifying 600 messages per second easily. Moreover, our comprehensive performance evaluations demonstrates that our protocol outperforms other approaches in terms of vehicle revocation checking cost, computation overhead, and communication overhead. In addition, to show the feasibility and validity of our protocol, we use SUMO and NS2 to simulate the actual VANET scenario and validate the efficiency and performance of our protocol. Simulation results prove the practicability of our protocol for VANETs.

User-empowered secure privacy-preserving authentication scheme for Digital Twin

Digital Twin (DT) is a revolutionary technology changing how a smart manufacturing industry carries out its day-to-day activities. DT can provide numerous advantages such as real-time synchronised functioning, monitoring and data analysis. However, security and privacy issues in DT have not been thoroughly investigated. This article proposes a user-empowerment-based privacy-preserving authentication protocol for a cloud-based Digital Twin using a Decentralised Identifier (DID) and Verifiable Credential (VC). Here, user empowerment provides full control to users over their identities, and with the help of VC, users can prove their authenticity and preserve their privacy. Although DID has emerged as a promising technology for introducing user empowerment, it suffers from some fundamental problems such as usability and auditability. Here we address all these issues and propose a user-revocation-enabled security solution for the DT. A security analysis of the proposed scheme shows that it is secured against significant security threats. With the help of performance analysis, we prove that the proposed work effectively ensures security and privacy in DT.

BAP: A Blockchain-Assisted Privacy-Preserving Authentication Protocol With User-Controlled Data Linkability for VANETs

BAP: A Blockchain-Assisted Privacy-Preserving Authentication Protocol With User-Controlled Data Linkability for VANETs

A Lightweight and Privacy-Preserving Authentication Protocol for Healthcare in an IoT Environment

In Internet of Things (IoT)-based healthcare, sensor nodes are deployed to detect the patient’s physiological data in a wireless sensor network. In order to prevent unwarranted users from accessing the sensor network to obtain patients’ data, designing lightweight and privacy-preserving authentication protocols plays a crucial role. Many lightweight authentication protocols for IoT-based healthcare have been proposed in recent years, but most of them may suffer from one or more security problems. In particular, few protocols can resist sensor node-captured attacks and achieve n-factor secrecy, which leads to unauthorized personnel being able to access the patient’s physiological data and obtain patients’ privacy. Therefore, a lightweight and privacy-preserving authentication protocol for healthcare based on elliptic curve cryptography (ECC) and physical unclonable function (PUF) is proposed to surmount the above obstacles. We design a dynamic anonymity strategy to achieve users’ anonymity and unlinkability and use PUF to protect information stored in users’ devices and sensor nodes. In addition, higher security features such as three-factor secrecy, perfect forward secrecy, resistance to sensor node-captured attacks, and update asynchronous attacks are guaranteed. The proposed protocol is proven to be secure under the random oracle model and maintains lightweight computing efficiency.

MCPAP: A MSIS-based conditional privacy-preserving authentication protocol for smart grids

The smart grid is considered a promising second-generation power grid because electricity service companies can use it to store energy more securely and deliver energy more efficiently. To protect the reliability of power consumption information and the privacy of users’ identity information in a smart grid, many conditional privacy-preserving authentication protocols have been proposed in the last decade. However, these protocols are vulnerable to attacks from the quantum computer because of the large integer factorization problem or the discrete logarithm problem embedded in these protocols. To solve this problem, a security-enhanced conditional privacy-preserving authentication protocol is designed in this paper by using the module small integer solution problem. Besides, we show that our protocol has superior security in the random oracle model. The potential utility of this protocol in the smart grid is also demonstrated through our detailed performance analysis. Moreover, our protocol can use the batch verification method to improve its efficiency significantly.

Hash and Physical Unclonable Function (PUF)-Based Mutual Authentication Mechanism.

The security of web applications in an enterprise is of paramount importance. To strengthen the security of applications, the identification and mitigation of vulnerabilities through appropriate countermeasures becomes imperative. The Open Web Application Security Project (OWASP) Top 10 API Security Risks, 2023 Edition, indicates the prominent vulnerabilities of API security risks. Broken authentication, however, is placed in second position with level-3 exploitability, level-2 prevalence, level-3 detectability, and level-3 technical impact. To mitigate this vulnerability, many mitigation strategies have been proposed by using the cryptographic primitives wherein two techniques, namely hashing and PUF, are used. Some of the proposals have integrated the concepts of hashing and PUF. However, the unnecessarily lengthy and complex mathematics used in these proposals makes them unsuitable for current API-based application scenarios. Therefore, in this paper, the authors propose a privacy-preserving authentication protocol that incorporates the capability of both mechanisms in an easy and low-complexity manner. In addition to overcoming existing limitations, the proposed protocol is tested to provide more security properties over existing schemes. Analysis of their performance has demonstrated that the proposed solutions are secure, efficient, practical, and effective for API-based web applications in an enterprise environment.

On-Demand Anonymous Access and Roaming Authentication Protocols for 6G Satellite-Ground Integrated Networks.

Satellite-ground integrated networks (SGIN) are in line with 6th generation wireless network technology (6G) requirements. However, security and privacy issues are challenging with heterogeneous networks. Specifically, although 5G authentication and key agreement (AKA) protects terminal anonymity, privacy preserving authentication protocols are still important in satellite networks. Meanwhile, 6G will have a large number of nodes with low energy consumption. The balance between security and performance needs to be investigated. Furthermore, 6G networks will likely belong to different operators. How to optimize the repeated authentication during roaming between different networks is also a key issue. To address these challenges, on-demand anonymous access and novel roaming authentication protocols are presented in this paper. Ordinary nodes implement unlinkable authentication by adopting a bilinear pairing-based short group signature algorithm. When low-energy nodes achieve fast authentication by utilizing the proposed lightweight batch authentication protocol, which can protect malicious nodes from DoS attacks. An efficient cross-domain roaming authentication protocol, which allows terminals to quickly connect to different operator networks, is designed to reduce the authentication delay. The security of our scheme is verified through formal and informal security analysis. Finally, the performance analysis results show that our scheme is feasible.

XAuth: Secure and Privacy-Preserving Cross-Domain Handover Authentication for 5G HetNets

5G networks are highly heterogeneous, with ultradense base stations (BSs), due to the low penetration of millimeter waves and the availability of different access technologies. However, the continuous heterogeneity and densification of 5G networks pose great challenges to network security, especially for user mobility support. In the process of user handover between BSs or between different network domains, user access authentication and security session establishment are far riskier compared to 4G networks. On one hand, the overhead of handover authentication increases significantly as handovers become more frequent in an ultradense network. On the other hand, the differentiation of security schemes in heterogeneous networks poses a big challenge to handover authentication. Successfully designing a secure, privacy-preserving, and efficient handover authentication protocol for heterogeneous and ultra-dense 5G networks would substantially expand the prospects of future 5G network applications. Although numerous solutions (e.g., challengeresponse-based, public key cryptography-based, physical layer information-based, and blockchain-based solutions) have been proposed to solve the cross-domain handover authentication problem, most of them surfer from security and privacy vulnerabilities and unreasonable performance overhead. In this paper, we propose XAuth, a secure and privacy-preserving authentication protocol for both intra-domain and inter-domain handover in 5G Heterogeneous Networks (HetNets) based on blockchain. The proposed protocol can achieve mutual authentication, key agreement between User Equipment (UE) and target network, and is characterized by forward secrecy, backward secrecy, user anonymity, and conditional privacy preservation. Formal security analysis and comprehensive performance evaluation demonstrate the security and effectiveness of the proposed protocol.

Blockchain-based privacy-preserving authentication protocol for UAV networks

Unmanned aerial vehicles (UAVs) are getting common in the market nowadays and being used in numerous real-time applications because they are lightweight, cost-effective, easy to control. With the growth of emerging UAV technology, it also needs to improve the security in many applications that are using this technology for solving multipurpose use cases. However, the malicious use of UAVs threatens privacy and security, so there is an immense need to secure critical information by preventing the UAVs from being tampered with denial of service (DoS) attacks, impersonation attacks, and man-in-the-middle attacks. To fulfill such a goal, in this paper, we design a new blockchain-envisioned authenticated key agreement mechanism in a UAV network. We prove the security of our proposed protocol using the random oracle model and also with the AVISPA tool under the given adversarial model. We also provide the informal security analysis that shows the protocol is secure against various attacks such as man-in-the-middle attack, denial of service attack and impersonation attack. Furthermore, to realize the performance of our proposed protocol, we perform comparative analysis in terms of security features, communication, and computation costs. We show that the proposed protocol performs better than Kaur et al. by 10.45%. Finally, the comparative analysis shows that the proposed protocol offers better communication and computation performance and added security features as compared to the state-of-the-art authentication protocols.

Comment on “Secure and Lightweight Conditional Privacy-Preserving Authentication for Securing Traffic Emergency Messages in VANETs”

In the above paper, Wei et al. proposed a lightweight conditional privacy-preserving authentication protocol in VANET to achieve both ultra-low transmission delay and SSK updating. To decrease communication overhead, their scheme adopts a signature scheme with message recovery to achieve message authentication. And they claimed that the adopted signature was secure against adaptively chosen message attacks, and gave the detailed security proof. Unfortunately, in this work, by analyzing the security of Wei et al. scheme, we show that their scheme is insecure, and it is universally forgeable, i.e., anyone can forge a valid signature on any message; it also makes their scheme does not satisfy conditional privacy. Finally, after analyzing the reasons to produce the attack, we give the corresponding suggestion to overcome the attacks.

Dynamically scalable privacy-preserving authentication protocol for distributed IoT based healthcare service providers

Dynamically scalable privacy-preserving authentication protocol for distributed IoT based healthcare service providers

Provable Secure Authentication Protocol in Fog-Enabled Smart Home Environment

People can access and obtain services from smart home devices conveniently through fog-enabled smart home environments. The security and privacy-preserving authentication protocol play an important role. However, many proposed protocols have one or more security flaws. In particular, almost all the existing protocols for the smart home cannot resist gateway compromised attacks. The adversary can not only know the user’s identity but also launch impersonation attacks. Designing a provable secure authentication protocol that avoids all known attacks on smart homes is challenging. Recently Guo et al. proposed an authentication scheme based on symmetric polynomials in the fog-enabled smart home environment. However, we found that their scheme suffers from gateway compromised attack, desynchronization attack, mobile device loss/stolen and attack, and has no untraceability and perfect forward secrecy. Therefore, we adopt a Physical Unclonable Function (PUF) to resist gateway compromised attack, adopt Elliptic Curve Diffie–Hellman (ECDH) key exchange protocol to achieve perfect forward secrecy, and propose a secure and privacy-preserving authentication protocol, which is provably secure under the random oracle model. According to the comparisons with some related protocols, the proposed protocol has better security and transmission efficiency with the same computation cost level.

A Blockchain-Assisted Privacy-Aware Authentication Scheme for Internet of Medical Things

Benefiting from the progress of Internet of Things (IoT) technology, medical devices, wearables, sensors, and users can be connected with each other to form an Internet of Medical Things (IoMT) ecosystem. IoMT improves efficiency, increases accuracy, and reduces the costs of the traditional healthcare system. However, since IoMT involves different entities and heterogeneous networks and carries a large amount of private information, it is a challenging task to ensure data security and protect privacy in the IoMT ecosystem. In this article, we focus on the issue of privacy-aware authentication between entities. We first propose a blockchain-assisted authentication framework for IoMT applications in the fog computing paradigm. Furthermore, we present two privacy-preserving authentication protocols based on elliptic curve cryptography (ECC) and physically unclonable functions (PUFs), respectively, in terms of the capacity of involved entities. Security analysis and performance evaluation demonstrate that compared with several previous protocols, the proposed protocols have competitive computation and communication costs while achieving expected security requirements.

An efficient conditional privacy-preserving authentication scheme with scalable revocation for VANETs

In Vehicular Ad Hoc Networks (VANETs), secure information sharing between vehicles is critical for improving traffic efficiency and driving safety. However, existing identity-based communication protocols for VANETs face problems of over-reliance on ideal Tamper-Proof Devices (TPDs) and the efficiency of verifying multiple messages in areas of high traffic density. Besides, many existing authentication schemes suffer from the heavy workload of revoking malicious vehicles when they misbehave. For addressing these problems, we propose an efficient Identity-Based conditional privacy-preserving authentication protocol, which does not rely on the ideal TPD. In our scheme, the System Secret Key (SSK) is not directly preloaded with the TPD, thus avoiding a system crash when a vehicle is corrupted. To revoke malicious vehicles’ identity, we propose an efficient key updating method based on Shamir’s secret sharing algorithm, which improves key-update efficiency from linear to logarithmic in the number of unrevoked vehicles. Moreover, our scheme is based on Elliptic Curves Cryptosystem and avoids bilinear pairing operation while supporting batch verification, enabling faster verification even when the number of signatures is increasing. According to the results of exhaustive comparative analysis, our proposed scheme is secure against key leakage attack and efficient in overhead of computation and communication compared to related schemes.

User-empowered Privacy-preserving Authentication Protocol for Electric Vehicle Charging Based on Decentralized Identity and Verifiable Credential

The use of Electric Vehicles (EVs) has been gaining traction in recent years due to various reasons. While charging their EVs, users expose their identity and personal details, and an adversary being able to identify and track where users charge their EVs is a potential privacy threat. In this article, we propose a user-empowered privacy-preserving authentication protocol for EV charging based on Decentralized Identifier (DID) and Verifiable Credential (VC) to provide Zero-Knowledge Proof (ZKP)-security. The proposed method gives users full control over their identities and allows them to remain anonymous while charging from any station. Giving control over their identities empowers users. At the same time, by making use of the concept of VC, other parties can verify that a user is legitimate and authenticate the user before providing charging services. Hence, the proposed protocol makes the charging service available in a secure way, while empowering users and preserving their privacy.

TPM-Based Conditional Privacy-Preserving Authentication Protocol in VANETs

With the establishment of intelligent transportation systems (ITS), research on vehicle ad-hoc networks (VANETs) has played an irreplaceable role in improving traffic safety and efficiency. However, because the deployment of devices based on the IoV is in an open field, the IoV is extremely vulnerable to various attacks without security protection, e.g., remote intrusion, control, trajectory tracking, etc. In order to avoid the above-mentioned attacks and resource abuses, provably secure cryptography primitives are generally considered to guarantee and realize the security of VANETs. This paper proposes a TPM-based conditional privacy-preserving authentication protocol (T-CPPA) which achieves both the integrity and the authenticity of the message/instruct content. The vehicle’s privacy is protected by embedding the system master private key into the trust platform module (TPM) which is responsible for generating pseudonyms and signature keys. The authenticity of message content is ensured by calculating message similarity in a cluster-based model. We give the concrete construction of our T-CPPA authentication scheme in symmetric bilinear groups and design a batch validation algorithm to improve efficiency. Security analysis shows that our scheme can resist various traditional attacks in VANETs, and the experimental results indicate that our scheme is efficient and useful in practice.

Ibn Sina: A patient privacy‐preserving authentication protocol in medical internet of things

The prosperous advancement in Medical Internet of Things (MIoT) technologies has hastened the development of healthcare systems. MIoT improves the traditional medical facilities through periodically monitor of patient’s health records. Electronic Medical Records (EMRs) are sensitive private data and needs efficient secure and private schemes that interchange these EMRs between healthcare providers and patients. Most of the current privacy preserving schemes do not provide the desired privacy level and suffer from computation and communication overheads.The length of an IDentity-based Strong Designated Verifier Signature (IDSDVS) is short. IDSDVS has low communication and computational costs. Moreover, it gives the signer (the patient) a control over whom can verify his signature. This feature allows patients to choose the verifier and keep the privacy of their Electronic Medical Records (EMR). This paper presents a new privacy-preserving authentication protocol in Medical Internet of Things (MIOT) that achieves patient privacy in MIoT. Precisely, we propose two new IDSDVS schemes. Utilizing the random oracle model, we show that these two schemes satisfy the security conditions. Furthermore, we evaluate the proposed IDSDVS schemes by comparing them to related schemes in the literature. The proposed schemes achieve lower costs of communication and computation than related schemes.

Lattice-Based Conditional Privacy-Preserving Authentication Protocol for the Vehicular Ad Hoc Network

Vehicular ad hoc network (VANET) underpins most intelligent transportation systems and given the open nature of the wireless communication environment, edge nodes in the VANET are subject to varying levels of attacks. While there are a large number of conditional privacy-preserving authentication protocols in the literature, most of these protocols (whose security is guaranteed by classical cryptographic primitives) are not designed to resist quantum attacks. In this paper, we propose a lattice-based conditional privacy-preserving authentication protocol for VANETs, designed to simultaneously achieve mutual authentication and privacy protection. We also show that our protocol is secure in the random oracle model, relying on the small integer solution problem. Additionally, we demonstrate the potential utility of our protocol by evaluating its performance.