Provide Authentication Services Research Articles

An optimized secure dual authentication for VANETs

“Vehicular Ad-hoc Network (VANET)” has emerged as a hotbed of research and development. This technology has been utilized to improve vehicle and road safety by transmitting information about traffic congestion and road conditions during emergencies in order to soothe drivers and passengers. However, such environments are more vulnerable to security risks. Thus, the primary challenge in such an environment is to provide authentication services while maintaining user confidentiality. To that end, a trustworthy authority (TA) is established, which offers services to users as well as authentication of communications transmitted between trusted authorities and VANET nodes. A trusted authority (TA) is established using VANETs to supply clients with a range of online premium services. As a result, preserving the confidentiality and authenticity of messages conducted between the TA and VANET nodes is crucial. Our proposed method minimizes recognition latency by up to 85% when compared to On-site Driver ID, and decreases authentication latency by up to 94%, respectively.

A Secure and Decentralized Authentication Mechanism Based on Web 3.0 and Ethereum Blockchain Technology

Over the past decade, there has been significant evolution in the security field, specifically in the authentication and authorization part. The standard authentication protocol nowadays is OAuth 2.0-based authentication. This method relies on a third-party authentication service provider with complete control over the users’ data, which it can filter or modify at will. Blockchain and decentralization have generated much interest in recent years, and the decentralized web is considered the next significant improvement in the world wide web (also known as Web 3.0). Web3 authentication, also known as decentralized authentication, allows for the secure and decentralized authentication of users on the web. The use cases for this technology include online marketplaces, social media platforms, and other online communities that require user authentication. The advantages of Web3 authentication include increased security and privacy for users and the ability for users to have more control over their data. The proposed system implementation uses Ethereum as the blockchain and a modern web stack to enhance user interaction and usability. The solution brings benefits both to the private and the public sector, proving that it has the capability of becoming the preferred authentication mechanism for any decentralized web application.

Robust and lightweight symmetric key exchange algorithm for next-generation IoE

The Internet of Everything (IoE) is a multi-domain environment where millions of people and smart devices are connected and communicate with each other. IoE demands security services in terms of data or entity authentication, data confidentiality, data integrity, data or services availability, and non-repudiation. There are multiple security protocols that work with secret keys to provide security services. The key exchange or key distribution between two parties over the insecure network is the main challenge. Researchers introduced several state-of-the-art symmetric or asymmetric key exchange algorithms such as RSA, ECC, DH, ECDH, and Curve25519. Asymmetric algorithms are considered heavyweight in terms of computation and communication costs while symmetric key exchange algorithms are considered lightweight. Symmetric key exchange algorithms do not provide authentication services. As a result, the algorithms are exposed to a man-in-the-middle attack. In this research paper, we propose a lightweight and robust symmetric key exchange algorithm for smart devices which have short computational processing power. Furthermore, we implement our proposed algorithm on the Linux-based Ubuntu virtual operating systems by using system programming in C/C++. In addition, we prove the robustness of our proposed algorithm with the help of informal and formal security analysis through the AVISPA tool. Finally, we compare our proposed algorithm with existing algorithms in terms of computation cost, communication overhead, and security features. The comparison results with existing state-of-the-art key exchange algorithms show that our proposed key exchange algorithm is more suitable for smart devices.

A Collaborative Detection Method of Wireless Mobile Network Intrusion Based on Cloud Computing

In order to improve the communication security of wireless mobile network, a collaborative intrusion detection method based on cloud computing is studied. The mobile terminal and the cloud computing platform are connected by the wireless mobile network. The cloud computing platform authentication server adopts a dual server and multifactor authentication scheme for mobile cloud computing to provide authentication services for mobile terminal users. The web server of the cloud computing platform uses the intrusion node detection protocol of the neighbor classification mechanism to provide a communication security protocol for users; Using the HMM algorithm, the intrusion detection module of the computing platform realizes the intrusion detection of wireless mobile network. Finally, using authentication service, security protocol, and intrusion detection module completes the cooperative detection of mobile network intrusion. The experimental results show that this method can realize the cooperative detection of wireless mobile network intrusion, and the detection accuracy is as high as 98%, which ensures the communication security of wireless mobile network.

Linearly Homomorphic Signatures from Lattices

AbstractLinearly homomorphic signatures (LHSs) allow any entity to linearly combine a set of signatures and to provide authentication service for the corresponding (combined) data. The public key of the current known LHSs from lattices in the standard model requires $O(l)$ matrices and $O(k)$ vectors, where $l$ is the length of file identifier and $k$ is the maximum data set size that linear functions support. In this paper, we construct two lattice-based LHS schemes with provable security in the standard model and both schemes can authenticate vectors defined over finite field. First, we present a basic LHS scheme satisfying selective security, based on the full-rank difference hash functions. Second, we modify the chameleon hash function constructed by (Cash, D., Hofheinz, D., Kiltz, E. and Peikert, C. (2010) Bonsai Trees, or How to Delegate a Lattice Basis. In Proc. EUROCRYPT 10, Monaco/French Riviera, May 30 to June 3, pp. 523–552. Springer, Berlin) to construct a linearly homomorphic chameleon hash function (LHCHF), which can be applied to all transformations from selectively secure LHS scheme that authenticates vectors defined over finite field $\mathbb{F}_{p}$ ($p=poly(n)$) to fully secure one, except for a new one that authenticates vectors defined over a small field. Starting from LHCFH and the basic scheme as above, we obtain a fully secure LHS scheme. Both schemes can be used to sign multiple files and have relatively short public keys consisting of $O(1)$ matrices and $O(k)$ vectors.

Partial DCT-based cancelable biometric authentication with security and privacy preservation for IoT applications

Biometric authentication is being vastly used in identity verification for several IoT applications, nowadays. The security and privacy of the biometrics templates used in the authentication process becomes mandatory as it contains rich personal information of the user. Cancelable Biometric System (CBS) is a template securing approach using repeated distortions/transformations at feature/signal level. It is an effective template securing approach which provides non-invertibility, revocability and diversity to the users enrolled with the cancelable template database. The cancelable template database containing cancelable biometric templates of the users is typically stored in a trusted standalone server. To meet the growing demand of IoT applications, cloud computing with provision to store and process even large database, is being largely deployed. However, the security and privacy of the data stored in the cloud is uncertain. In this paper, we have proposed a novel partial DCT-based CBS with privacy and security preservation for providing authentication services in various IoT applications. We have also devised techniques for session key agreement, data encryption and data integrity in the proposed framework to solve the issues of confidentiality, integrity, and availability (CIA) during cancelable template enrolment and authentication. The experimental results and analysis prove that proposed approach performs user authentication with high accuracy and minimal overhead while preserving security and privacy of sensitive cancelable biometric templates.

PTAS: Privacy-preserving Thin-client Authentication Scheme in blockchain-based PKI

Recent years have witnessed tremendous academic efforts and industry growth in Internet of Things (IoT). Security issues of IoT have become increasingly prominent. Public Key Infrastructure (PKI) can provide authentication service to IoT devices which is a crucial element to the security of IoT. However, the conventional PKIs are organized as a tree-like centralized structure which has demonstrated serious usability and security shortcomings such as the single point of failure. Blockchain has numerous desirable properties, such as decentralized nature, cryptographic technology and unalterable transaction record, these properties make it a potential tool to build a decentralized blockchain-based PKI. Nevertheless, the latest proposals for blockchain-based PKI did not take thin-clients into consideration where thin-clients indicate those users who cannot download the entire blockchain due to the limited storage capacity of their equipment (most IoT devices fall into this category). To settle this problem, we firstly present a Privacy-preserving Thin-client Authentication Scheme (PTAS) employing the idea of private information retrieval (PIR), which enables thin-clients to run normally like full node users and protect their privacy simultaneously. Furthermore, in order to enhance security, we further propose a (m-1)-private PTAS which means thin-client’s information can be protected against a collusion of at most (m-1) full node users. Besides, security analysis and functional comparison are performed to demonstrate high security and comprehensive functionality of our schemes. Finally, extensive experiments are conducted to compare computational overhead and communication overhead of PTAS and (m-1)-private PTAS.

A New Secure Passwordless Multi-Server Modified Authenticated Master-Key Agreement Scheme Based on Hardware-Software and Iriscode Identifiers Through SSL/TLS Protocol for E-learning and Similar Web-based Services

There is a growing concern about systems security and how to organize it. This is because the internet which is the backbone of all systems is regarded as unsafe. Also, the internet transmits all connection transactions in the E-learning and similar web-based systems and as a result, intruders and attackers by abusing security holes can compromise the system. The E-learning and other similar systems should be safe against threats and manipulation by intruders and should protect the privacy of users. The purpose of this paper is to provide an authentication model based on hardware, software and iriscode identifiers through the SSL/TLS protocol, in order to significantly improve the security and privacy level, while at the same time, maintain the system performance at an acceptable level. There are major differences between our model and other similar works, such as: no need to password in registration and login phase, using of iriscode identifier, isolation of users profiles based on hardware and software identifiers of relying party, enhancing master secret key exchange phase in the SSL/TLS protocol, no need to password change phase, strong performance in comparison with other approaches because of using SHA-3 function and removing password change phase, capability of providing authentication services over large networks and internet. Also according to conducted studies and tests, the mentioned solution can significantly improve the system security, as well as maintain its function at an acceptable level. Therefore the proposed model easily can be used for immunize E-learning and similar web-based systems that works through internet. The proposed model improves the 32.50% security and 63.58% execution time in comparison to average of five newest methods.

An enhanced Kerberos protocol with non‐interactive zero‐knowledge proof

AbstractAs one of the most important trusted third‐party‐based authentication protocols, Kerberos is widely used to provide authentication service in distributed networks. However, it is vulnerable to common brute force password‐guessing attacks because of its password‐based mechanism. Some enhanced Kerberos protocols based on public key cryptography were proposed as solutions, but they require excessive computation and communication resources. In this paper, a new enhanced Kerberos protocol with non‐interactive zero‐knowledge proof is proposed, in which the clients and the authentication server can mutually authenticate each other without revealing any information during the authentication process. Our security analysis and experimental results have shown that the proposed scheme can resist password‐guessing attacks and is more convenient and efficient than previous schemes. Copyright © 2014 John Wiley & Sons, Ltd.

Architecting Service Based Sensor Networks for the Intelligent Assimilation

The aim of this paper is to propose an architectural model for assimilating distributed sensor networks through cloud paradigm. This strategy can be applied to monitor and control the physical parameters such as temperature, pressure, and level. It is proposed to consider the use of service oriented architecture to program and deploy the sensed parameters. The service oriented architecture for sensor network has been implemented in such a way that, for every specific requirement of the monitor center, the assimilation agent invokes the services of the sensors through a registry and the specific changes in the sensed parameters are also notified as auditable event using push interaction pattern of SOA. The assimilation agent serves as an intelligent component by providing authentication services. This SOA is extended to integrate different types of sensor networks through cloud environment. Hence several sensors can be networked together to monitor different process parameters and they have been assimilated with Internet by registering them as services, hence a complete distributed assimilation environment is exploited.

Authentication Schemes for Open Distributed Network: A Classification

An authentication protocol is a sequence of message exchanges between entities that either distributes secrets to some of those principals or allows the use of some secret to be recognized .Distributed Network, such as sensor and mobile ad hoc networks, must conquer a numerous of security challenges to realize their potential in both civil and military applications. Usually, a Distributed Network like ad hoc networks are deployed in untrusted environments. Therefore, authentication is a pioneer to any secure interactions in these networks. Recently, v a r i o u s a u t h e n t i c a t i o n p r o t o c o l s h a ve b e e n proposed for ad hoc networks. In distributed authentication services in ad hoc networks. Two nodes authenticate each other via signed, unforgeable certificates released by a ”virtual“ trusted certification authority. Compared with regular network authentication solutions [28, 29] that rely on physically present, third-party trusted (certification authority) server(s), our design takes a self organized securing approach, in which multiple nodes (say, k) collaboratively serve the role of a certification authority server. Therefore, the authority and functionality of the authentication server are spread to each node’s locality. Any local k nodes are trusted as a whole and collaboratively provide authentication services. This paper describes the authentication procedure and a classification that clarifies similarities and differences among authentication protocol described in the literature. The classification is based upon the role of nodes in the authentication function, establishment of certificate, and type of certificate.

High‐performance FPGA implementations of the cryptographic hash function JH

Hash functions are included in almost all cryptographic schemes and security protocols for providing authentication services. JH is a new hash function, introduced in 2008 and it is among the five finalists of the international competition for developing the new hash standard SHA-3. In this study, one non-pipelined and four pipelined architectures are introduced for developing high-performance field-programmable gate array (FPGA) designs of the JH function. Special effort has been paid and various design alternatives have been studied to derive efficient FPGA implementations in terms of frequency, area and throughput/area cost factor. Compared with the best existing non-pipelined FPGA implementations, the throughput/area is improved by 48, 13.5 and 17.8% in Xilinx Virtex-4, Virtex-5 and Virtex-6 families, respectively, and by 6.8 and 21.2% in ALTERA Stratix-III and Stratix-IV, respectively. Also, the improvements of the throughput/area factor of the introduced pipelined architectures over the existing ones are 37.5, 73.1, 15 and 26.3% in Virtex-5, Virtex-6, Stratix-III and Stratix-IV technologies, respectively.

SOMA-E: Self-organized mesh authentication—Extended

Community mesh networks have emerged rapidly in every metropolis around the world, however many of the security methods applied are counter-intuitive and usually disrupt the autonomous characteristics of the mesh nodes. In SOMA we present a structured Peer-to-Peer solution providing authentication service based on a scalable, self-organized and fully distributed Web-of-Trust. Our proposal is a hybrid Public Key Infrastructure build on top of Chord, allowing each agent to place its own trust policy while keeping the autonomous characteristics of the nodes intact. Our goal is to create a large-scale authentication system for mesh networks without the need of a Trusted Third Party. We leave the decision of whom to trust in each agent independently taking advantage of the overlay to alleviate the shortcomings of traditional Web-of-Trust models. This is achieved by using the overlay as a meta-structure to infer trust relationships providing a policy-based system, which is further enhanced with a Bayesian reputation based model so as to cope with the different challenges posed by the distributed nature of the system. The possible attacks and limitations of our proposal are also investigated and discussed.

Efficient Homomorphic Hashing Approach for Secure Reprogramming in Wireless Sensor Networks

While existing solutions can provide authentication services, they are insufficient for a new generation of network coding-based reprogramming protocols in wireless sensor networks. We present a security approach that is able to defend pollution attack against reprogramming protocols based on network coding. It employs a homomorphic hashing function and an identity-based aggregate signature to allow sensor nodes to check packets on-the-fly before they accept incoming encoded packets, and introduces an efficient mechanism to reduce the computation overhead at each node and to eliminate bad packets quickly. Castalia simulations show that when the 5% of the nodes in a network of 100 nodes are rogue, using our approach, the efficiency of the secure reprogramming protocol based on network coding improves almost ten-fold for a checking probability of 2%.

Trustworthy Mutual Attestation Protocol for Local True Single Sign-On System: Proof of Concept and Performance Evaluation

In a traditional Single Sign-On (SSO) scheme, the user and the Service Providers (SPs) have given their trust to the Identity Provider (IdP) or Authentication Service Provider (ASP) for the authentication and correct assertion. However, we still need a better solution for the local/native true SSO to gain user confidence, whereby the trusted entity must play the role of the ASP between distinct SPs. This technical gap has been filled by Trusted Computing (TC), where the remote attestation approach introduced by the Trusted Computing Group (TCG) is to attest whether the remote platform integrity is indeed trusted or not. In this paper, we demonstrate a Trustworthy Mutual Attestation (TMutualA) protocol as a proof of concept implementation for a local true SSO using the Integrity Measurement Architecture (IMA) with the Trusted Platform Module (TPM). In our proposed protocol, firstly, the user and SP platform integrity are checked (i.e., hardware and software integrity state verification) before allowing access to a protected resource sited at the SP and releasing a user authentication token to the SP. We evaluated the performance of the proposed TMutualA protocol, in particular, the client and server attestation time and the round trip of the mutual attestation time.

A Secure Method for Network Coding-based Reprogramming Protocols in Wireless Sensor Networks

Reprogramming protocols provide a convenient way to update program images via wireless communication. In hostile environments where there may be malicious attacks against wireless sensor networks, the process of reprogramming faces threats from potentially compromised nodes. While existing solutions can provide authentication services, they are insufficient for a new generation of network coding-based reprogramming protocols in wireless sensor networks. We present a security approach that is able to defend pollution attack against reprogramming protocols based on network coding. It employs a homomorphic hashing function and an identity-based aggregate signature to allow sensor nodes to check packets on-the-fly before they accept incoming encoded packets, and introduces an efficient mechanism to reduce the computation overhead at each node and to eliminate bad packets quickly. Castalia simulations show that when the 5% of the nodes in a network of 100 nodes are rogue, using our approach, the efficiency of the secure reprogramming protocol based on network coding improves almost ten-fold for a checking probability of 2%.

A clique-based secure admission control scheme for mobile ad hoc networks (MANETs)

Wireless mobile ad hoc networks (MANETs) do not have centralized infrastructure and it is difficult to provide authentication services. In this paper, we apply Certificate Graph (CG) and identity-based security in designing an admission control scheme for MANETs. We first use one-hop message exchange to build CG at each mobile node. Then we select maximum clique nodes in CG as distributed Certificate Authorities (CAs). We use identity-based key agreement from pairings to protect each session. Then we prove the security by Canetti–Krawczyk (CK) model-based analysis. We demonstrate the effectiveness and feasibility of our protocol through computer simulations.

Secure Rateless Deluge: Pollution-Resistant Reprogramming and Data Dissemination for Wireless Sensor Networks

A network reprogramming protocol is made for updating the firmware of a wireless sensor network (WSN) in situ. For security reasons, every firmware update must be authenticated to prevent an attacker from installing its code in the network.While existing schemes can provide authentication services, they are insufficient for a new generation of network coding-based reprogramming protocols like Rateless Deluge. We propose Secure Rateless Deluge or Sreluge, a secure version of Rateless Deluge that is resistant to pollution attacks (denial-of-service attacks aimed at polluting encoded packets). Sreluge employs a neighbor classification system and a time series forecasting technique to isolate polluters, and a combinatorial technique to decode data packets in the presence of polluters before the isolation is complete. For detecting polluters, Sreluge has zero false negative rate and a negligible false positive rate. TOSSIM simulations and experimental results show that Sreluge is practical.

Providing Authentication Service in Mobile Application Service Provider Environment

Providing Authentication Service in Mobile Application Service Provider Environment

On‐demand public‐key management for mobile ad hoc networks

AbstractA mobile ad hoc network (MANET) is the cooperative engagement of a collection of wireless mobile nodes without the aid of any established infrastructure or centralized administration. The conventional security solutions to provide key management through accessing trusted authorities or centralized servers are infeasible for this new environment since mobile ad hoc networks are characterized by the absence of any infrastructure, frequent mobility, and wireless links. In this paper, we propose an on‐demand, fully localized, and hop‐by‐hop public key management scheme for MANETs. It can be performed by generating public/private key pairs by nodes themselves, issuing certificates to neighboring nodes, holding these certificates in their certificate repositories, and providing authentication service adaptive quickly to the dynamic topology of the network without relying on any servers. Also, our scheme can be performed successfully as long as there is a physical communication line between two nodes, and it is accustomed well to the on‐demand routing for MANETs. Copyright © 2006 John Wiley & Sons, Ltd.