Session Key Security Research Articles

An Enhanced Lightweight Dynamic PseudonymIdentity Based Authentication and Key AgreementScheme Using Wireless Sensor Networks forAgriculture Monitoring.

Agriculture plays an important role for many countries. It provides raw materials for food and provides large employment opportunities for people in the country, especially for countries with a dense population. To enhance agriculture productivity, modern technology such as wireless sensor networks (WSNs) can be utilized to help in monitoring important parameters in thw agricultural field such as temperature, light, soil moisture, etc. During the monitoring process, if security compromises happen, such as interception or modification of the parameters, it may lead to false decisions and bring damage to agriculture productivity. Therefore, it is very important to develop secure authentication and key agreement for the system. Recently, Ali et al. proposed an authentication and key agreement scheme using WSNs for agriculture monitoring. However, it fails to provide user untraceability, user anonymity, and session key security; it suffers from sensor node impersonation attack and perfect forward secrecy attack; and even worse has denial of service as a service. This study discusses these limitations and proposes a new secure and more efficient authentication and key agreement scheme for agriculture monitoring using WSNs. The proposed scheme utilizes dynamic pseudonym identity to guarantee user privacy and eliminates redundant computations to enhance efficiency.

Improvement in new three-party-authenticated key agreement scheme based on chaotic maps without password table

A three-party-authenticated key agreement (3PAKA) scheme allows two participants to establish shared secure session key (3SK) via trusted server over a public network. Recently, Lee et al. (Nonlinear Dyn 79(4):2485–2495, 2015) proposed a new 3PAKA protocol based on chaotic maps without password table. They claimed that the proposed scheme can establish a common session key among two users with security and users anonymity. Unfortunately, Lee et al.’s scheme is vulnerable to impersonation attack when the adversary is an internal user. Furthermore, in this paper, we will prove that Lee et al.’s scheme cannot guarantee user anonymity. To exhibit these flaws, we apply an automatic protocol verifier tool, Proverif. Therefore, we have put forward some improvements to overcome the weaknesses of Lee et al.’s protocol. We apply Proverif to show that the proposed improvement can satisfy security and authentication properties. The performance analysis shows that the proposed enhancement is efficient.

A Dynamic Privacy-Preserving Key Management Protocol for V2G in Social Internet of Things

With the smart grid (SG) and the social Internet of Things (SIoT), an electric vehicle operator can use reliable, flexible, and efficient charging service with vehicle-to-grid (V2G). However, open channels can be vulnerable to various attacks by a malicious adversary. Therefore, secure mutual authentication for V2G has become essential, and numerous related protocols have been proposed. In 2018, Shen et al. proposed a privacy-preserving and lightweight key agreement protocol for V2G in SIoT to ensure security. However, we demonstrate that their protocol does not withstand impersonation, privileged-insider, and offline password guessing attacks, and it does not also guarantee secure mutual authentication, session key security, and perfect forward secrecy. Therefore, this paper proposes a dynamic privacy-preserving and lightweight key agreement protocol for V2G in SIoT to resolve the security weaknesses of Shen et al.'s protocol. The proposed protocol resists several attacks including impersonation, offline password guessing, man-in-the-middle, replay, and trace attacks, ensures anonymity, perfect forward secrecy, session key security, and secure mutual authentication. We evaluate the security of the proposed protocol using formal security analysis under the broadly-accepted real-or-random (ROR) model, secure mutual authentication proof using the widely-accepted Burrows-Abadi-Needham (BAN) logic, informal (non-mathematical) security analysis, and also the formal security verification using the broadly-accepted automated validation of Internet security protocols and applications (AVISPA) tool. We then compare computation costs, and security and functionality features of the proposed protocol with related protocols. Overall, the proposed protocol provides superior security, and it can be efficiently deployed to practical SIoT-based V2G environment.

A secure communication model using lightweight Diffie-Hellman method in vehicular ad hoc networks

Nowadays, vehicular ad hoc networks (VANETs) have become a more interesting research area. A high number of safety, traffic management and even comfort applications have been developed to secure driving and make travellers satisfied. This evolution opens up a vast area of research in several fields. Specifically in the security domain, huge researches are proposed to give new approaches and mechanisms of security. VANETs as wireless and mobile networks require the implementation of secure and lightweight algorithms dealing with its critical characteristics to face different attacks. In this paper, we propose a novel approach of security to face some known attacks. We design a model of communication that combines digital signature, message authentication mechanisms, to securely generate the secret key, and thereby, achieve integrity, confidentiality, session key security and non-repudiation. In the end, we prove the security of our model by analysing different cases of attacks.

PSEH: A provably secure and efficient handover AKA protocol in LTE/LTE-A network

In order to accomplish the increasing security demands of handover-based applications such as mobile multimedia services and transportation system, various handover Authentication and Key Agreement (AKA) protocols were proposed by the researchers in Long Term Evolution-Advanced (LTE-A) network. However, these AKA protocols fail to preserve the privacy of communication entities and suffer from numerous attacks. In addition, these protocols incur high network overhead which doesn’t suit for the resource-constrained mobile devices in LTE/LTE-A network. Also, the protocols can’t establish the key forward/backward secrecy (KFS/KBS) and overcome the key escrow problem. To avoid the above-mentioned security issues, we propose the provably secure and efficient handover (PSEH)-AKA protocol based on double-trapdoor chameleon hash function. The PSEH-AKA protocol is proven secure under random oracle model to obtain the mutual authentication, session key secrecy, integrity and resistance from malicious attacks. The proposed handover protocol accommodates all the security demands such as KFS/KBS, privacy-preservation and establishes the secure session key between the communication entities. Furthermore, the formal verification using Automated Validation of Internet Security Protocols and Applications (AVISPA) tool shows the correctness and informal analysis shows the security properties of the protocol. The performance evaluation of the PSEH-AKA protocol is carried out with existing handover AKA protocols in terms of storage, communication, and computation overhead. The evaluation results show that the protocol achieves substantial efficiency and secure against the identified attacks.

The generic construction of continuous leakage-resilient identity-based cryptosystems

In the leakage setting, the adversary is allowed to access the internal secret states of a cryptosystem, such as the private key of user and the master secret key. In the continuous leakage model, there is no predetermined bound on the leakage of internal secret states; therefore, it is more challenging. In this paper, we present a new primitive called updatable identity-based hash proof system (U-IB-HPS), which can serve as a fundamental tool for constructing continuous leakage-resilient identity-based cryptosystems. With the U-IB-HPS, we obtain the generic constructions of identity-based cryptosystem with continuous leakage-resilience, such as the continuous leakage-resilient identity-based encryption with leakage amplification, the continuous leakage-resilient identity-based hybrid encryption with leakage amplification, etc. As a feature of our generic constructions, we allow the leakage of multiple keys, i.e., leakage of the master secret key and the private key of user. In addition, we present a generic framework of one-round identity-based authenticated key exchange (AKE) protocol with continuous leakage resilience, which ensures the session key security even if the adversary performs continuous leakage attacks during the execution of a session. We also present instantiations of U-IB-HPS from bilinear groups and composite order bilinear groups, respectively. The security of our instantiations is based on the standard static assumptions, such as the decisional bilinear Diffie–Hellman assumption, the corresponding complexity assumptions over composite order bilinear groups, etc. Our instantiations can be easily extended to construct the updatable hierarchical identity-based hash proof system.

Efficient and Provably Secure Key Agreement for Modern Smart Metering Communications

Security in modern smart metering communications and in smart grid networks has been an area of interest recently. In this field, identity-based mutual authentication including credential privacy without active involvement of a trusted third party is an important building block for smart grid technology. Recently, several schemes have been proposed for the smart grid with various security features (e.g., mutual authentication and key agreement). Moreover, these schemes are said to offer session key security under the widely accepted Canetti-Krawczyk (CK) security model. Instead, we argue that all of them are still vulnerable under the CK model. To remedy the problem, we present a new provably secure key agreement model for smart metering communications. The proposed model preserves the security features and provides more resistance against a denial of service attack. Moreover, our scheme is pairing-free, resulting in highly efficient computational and communication efforts.

An Effective Data Privacy Mechanism through Secure Session Key Exchange Model for MANET

<p>Data privacy in the mobile ad-hoc network is a problem due to wireless medium, frequent node movement and lack of any centralized infrastructure support. In such case, it is very important to build a reliable and secure network and achieve high throughput in MANET. The reliability and security of a network depend on whether the network remains linked to different failures and malicious activities, which is the fundamental issue that needs to be focused when designing a secure routing protocol in MANET. This paper proposes an effective privacy mechanism to handle data security through a novel secure session key exchange model, which provides the node data privacy and network stability for a longer period of time and prevents abnormal behavior changes due to malicious behavior and different type of attacks in the network. The simulation results show improvement in throughput with nominal overhead and end-to-end delay in different malicious conditions against existing protocols.</p>

A secure elliptic curve cryptography based mutual authentication protocol for cloud-assisted TMIS

With the fast progress of network communication, its technologies and the developing popularity of telecare medical information system (TMIS), doctors provide treatment to patients via Internet without visiting hospitals. By using mobile device, wireless body area network and cloud based architecture, the patients can gather their physiological information and upload to cloud via their mobile devices. The authenticated doctor provides online treatment to patient at anytime and anywhere. Moreover, TMIS maintains security and privacy of the patients in information communication and authenticated to all the participants before assessing this system. Recently Li et al. (2018) presented a cloud-assisted authentication and privacy preservation scheme for TMIS. They believed that their scheme secure against all well-known privacy and security attributes. In the proposed work, we reviewed Li et al. authentication protocol and found that it has various security flaws like as message authentication fails in healthcare center upload phase, session key is not possible in healthcare center upload phase, impersonation attack in patient data upload phase, patient anonymity and patient unlinkability. Further, we introduced enhance protocol in similar environment. The proposed protocol secure against man-in-the-middle attack, patient anonymity, replay attack, known-key security property, data confidentiality, data non-repudiation, message authentication, impersonation attack, session key security and patient unlinkability. We compared the proposed protocol with existing related protocols in same cloud based TMIS. The proposed protocol ensures of all desirable security prerequisites and managed the efficiency in terms of computation and communication costs for cloud-assisted TMIS.

Secure Authentication Protocol for Wireless Sensor Networks in Vehicular Communications.

With wireless sensor networks (WSNs), a driver can access various useful information for convenient driving, such as traffic congestion, emergence, vehicle accidents, and speed. However, a driver and traffic manager can be vulnerable to various attacks because such information is transmitted through a public channel. Therefore, secure mutual authentication has become an important security issue, and many authentication schemes have been proposed. In 2017, Mohit et al. proposed an authentication protocol for WSNs in vehicular communications to ensure secure mutual authentication. However, their scheme cannot resist various attacks such as impersonation and trace attacks, and their scheme cannot provide secure mutual authentication, session key security, and anonymity. In this paper, we propose a secure authentication protocol for WSNs in vehicular communications to resolve the security weaknesses of Mohit et al.’s scheme. Our authentication protocol prevents various attacks and achieves secure mutual authentication and anonymity by using dynamic parameters that are changed every session. We prove that our protocol provides secure mutual authentication by using the Burrows–Abadi–Needham logic, which is a widely accepted formal security analysis. We perform a formal security verification by using the well-known Automated Validation of Internet Security Protocols and Applications tool, which shows that the proposed protocol is safe against replay and man-in-the-middle attacks. We compare the performance and security properties of our protocol with other related schemes. Overall, the proposed protocol provides better security features and a comparable computation cost. Therefore, the proposed protocol can be applied to practical WSNs-based vehicular communications.

Provably Secure Anonymous Single-Sign-On Authentication Mechanisms Using Extended Chebyshev Chaotic Maps for Distributed Computer Networks

Single-sign-on authentication mechanisms enable a legal user to access various service providers efficiently and conveniently by using a unitary token. These mechanisms are widely used in distributed computer networks. This investigation proposes an efficient and secure single-sign-on authentication scheme that uses extended chaotic maps, exhibits operations that satisfy the semigroup property and commutative under composition, and has a higher efficiency than modular exponential computations and scalar multiplications on the elliptic curve. The session key security of the proposed scheme is based on Chebyshev chaotic-map-based assumptions, and the scheme is proven to be secure using the real-or-random model. The proposed authentication scheme retains the security properties of earlier schemes, requires fewer transmissions, has a lower computational cost, and uses fewer variables; it is therefore efficient in computation and communication.

A secure and enhanced elliptic curve cryptography‐based dynamic authentication scheme using smart card

SummaryIn remote system security, 2‐factor authentication is one of the security approaches and provides fundamental protection to the system. Recently, numerous 2‐factor authentication schemes are proposed. In 2014, Troung et al proposed an enhanced dynamic authentication scheme using smart card mainly to provide anonymity, secure mutual authentication, and session key security. By the analysis of Troung et al's scheme, we observed that Troung et al' s scheme does not provide user anonymity, perfect forward secrecy, server's secret key security and does not allow the user to choose his/her password. We also identified that Troung et al's scheme is vulnerable to replay attack. To fix these security weaknesses, a robust authentication scheme is proposed and analyzed using the formal verification tool for measuring the robustness. From the observation of computational efficiency of the proposed scheme, we conclude that the scheme is more secure and easy to implement practically.

Secure Remote User Mutual Authentication Scheme with Key Agreement for Cloud Environment

Authentication schemes are widely used mechanisms to thwart unauthorized access of resources over insecure networks. Several smart card based password authentication schemes have been proposed in the literature. In this paper, we demonstrate the security limitations of a recently proposed password based authentication scheme, and show that their scheme is still vulnerable to forgery and offline password guessing attacks and it is also unable to provide user anonymity, forward secrecy and mutual authentication. With the intention of fixing the weaknesses of that scheme, we present a secure authentication scheme. We show that the proposed scheme is invulnerable to various attacks together with attacks observed in the analyzed scheme through both rigorous formal and informal security analysis. Furthermore, the security analysis using the widely-accepted Real-Or-Random (ROR) model ensures that the proposed scheme provides the session key (SK) security. Finally, we carry out the performance evaluation of the proposed scheme and other related schemes, and the result favors that the proposed scheme provides better trade-off among security and performance as compared to other existing related schemes.

Cryptanalysis and improvement of 2 mutual authentication schemes for Session Initiation Protocol

SummaryRecently, Chaudhry et al and Kumari et al proposed an advanced mutual authentication protocol for Session Initiation Protocol on the basis of the protocol of Lu et al. The authors claimed that their schemes can be resistant to various attacks. Unfortunately, we observe some important flaws in their respective schemes. We point out that their schemes are prone to off‐line password guessing and privileged insider attacks. To remedy their protocols's drawbacks, in this paper, we present a new improved authentication scheme keeping apart the threats encountered in the design of the schemes of Chaudhry et al and Kumari et al. Furthermore, the security analysis illustrates that our proposed scheme not only removes these drawbacks in their schemes but also can resist all known attacks and provide session key security. We give a heuristic security analysis and also provide the security analysis of the proposed scheme with the help of widespread Burrows‐Abadi‐Needham Logic. Finally, our scheme is compared with the previously proposed schemes on security and performance.

An Improved and Secure Two-factor Dynamic ID Based Authenticated Key Agreement Scheme for Multiserver Environment

The smart card based password authentication scheme is one of the most important and efficient security mechanism, which is used for providing security to authorized users over an insecure network. In this paper, we analyzed major security flaws of Jangirala et al.’s scheme and proved that it is vulnerable to forgery attack, replay attack, user impersonation attack. Also, Jangirala et al.’s scheme fail to achieve mutual authentication as it claimed. We proposed an improved two factor based dynamic ID based authenticated key agreement protocol for the multiserver environment. The proposed scheme has been simulated using widely accepted AVISPA tool. Furthermore, mutual authentication is proved through BAN logic. The rigorous security and performance analysis depicts that the proposed scheme provides users anonymity, mutual authentication, session key agreement and secure against various active attacks.

One-Round Authenticated Identity-Based Tri-Partite Key Agreement Protocol for Internet of Things Based Sensors

Key exchange protocol is a cryptographic protocol that provides a secure communication in the sensor network in which sensor devices have low power and low memory. Joux proposed the key agreement protocol for three-party based on the pairing. Later many schemes have been proposed for three-party but could not suitable for the sensor network. In this article, we proposed one-round three-party authenticated ID-based key establishment protocol for sensor network whose security is based on solving ECDLP and BDHP. We show that our proposed scheme is secure against man-in-middleattack, perfect forward secrecy, no key control, and Known session key security. The proposed system has less computational cost, bandwidth cost and message exchange as compared to the other related schemes.

A secure enhanced privacy-preserving key agreement protocol for wireless mobile networks

The rapid proliferation of mobile networks has made security an important issue, particularly for transaction oriented applications. Recently, Jo et al. presented an efficient authentication protocol for wireless mobile networks and asserted that their proposed approach provides all known security functionalities including session key (SK) security under the assumption of the widely-accepted Canetti–Krawczyk (CK) model. We reviewed Jo et al.’s proposed roaming protocol and we demonstrate that it fails to provide the SK-security under the CK-adversary setting. We then propose an enhancement to Jo et al.’s roaming protocol to address the security drawback found in Jo et al.’s protocol. In the enhanced roaming protocol, we achieve the SK-security along with reduced computation, communication and storage costs. We also simulate the enhanced roaming protocol using NS2 for end-to-end delay and network throughput, and the simulation results obtained demonstrate the efficiency of our protocol.

An Indoor Positioning-Based Mobile Payment System Using Bluetooth Low Energy Technology.

The development of information technology has paved the way for faster and more convenient payment process flows and new methodology for the design and implementation of next generation payment systems. The growth of smartphone usage nowadays has fostered a new and popular mobile payment environment. Most of the current generation smartphones support Bluetooth Low Energy (BLE) technology to communicate with nearby BLE-enabled devices. It is plausible to construct an Over-the-Air BLE-based mobile payment system as one of the payment methods for people living in modern societies. In this paper, a secure indoor positioning-based mobile payment authentication protocol with BLE technology and the corresponding mobile payment system design are proposed. The proposed protocol consists of three phases: initialization phase, session key construction phase, and authentication phase. When a customer moves toward the POS counter area, the proposed mobile payment system will automatically detect the position of the customer to confirm whether the customer is ready for the checkout process. Once the system has identified the customer is standing within the payment-enabled area, the payment system will invoke authentication process between POS and the customer’s smartphone through BLE communication channel to generate a secure session key and establish an authenticated communication session to perform the payment transaction accordingly. A prototype is implemented to assess the performance of the proposed design for mobile payment system. In addition, security analysis is conducted to evaluate the security strength of the proposed protocol.

Privacy Protection for E-Health Systems by Means of Dynamic Authentication and Three-Factor Key Agreement

During the past decade, the electronic healthcare (e-health) system has been evolved into a more patient-oriented service with smaller and smarter wireless devices. However, these convenient smart devices have limited computing capacity and memory size, which makes it harder to protect the user's massive private data in the e-health system. Although some works have established a secure session key between the user and the medical server, the weaknesses still exist in preserving the anonymity with low energy consumption. Moreover, the misuse of biometric information in key agreement process may lead to privacy disclosure, which is irreparable. In this study, we design a dynamic privacy protection mechanism offering the biometric authentication at the server side whereas the exact value of the biometric template remains unknown to the server. And the user anonymity can be fully preserved during the authentication and key negotiation process because the messages transmitted with the proposed scheme are untraceable. Furthermore, the proposed scheme is proved to be semantic secure under the real-or-random model. The performance analysis shows that the proposed scheme suits the e-health environment at the aspect of security and resource occupation.

2PAKEP: Provably Secure and Efficient Two-Party Authenticated Key Exchange Protocol for Mobile Environment

With the increasing use of mobile devices, a secure communication and key exchange become the significant security issues in mobile environments. However, because of open network environments, mobile user can be vulnerable to various attacks. Therefore, the numerous authentication and key exchange schemes have been proposed to provide the secure communication and key exchange. Recently, Qi and Chen proposed an efficient two-party authentication key exchange protocol for mobile environments in order to overcome the security weaknesses of the previous authentication and key exchange schemes. However, we demonstrate that Qi and Chen’s scheme is vulnerable to various attacks such as impersonation, offline password guessing, password change, and privileged insider attacks. We also show that Qi and Chen’s scheme does not provide anonymity, efficient password change mechanism, and secure mutual authentication. In this paper, to overcome the outlined abovementioned security vulnerabilities, we propose a secure and efficient two-party authentication key exchange protocol, called 2PAKEP, that hides user’s real identity from an adversary using a secret parameter. 2PAKEP also withstands various attacks, guarantees anonymity, and provides efficient password change mechanism and secure mutual authentication. In addition, we prove that 2PAKEP provides the secure mutual authentication using the broadly accepted Burrows–Abadi–Needham logic and the session key security using the formal security analysis under the widely accepted real-or-random model. Moreover, the formal security verification using the popular simulated software tool, Automated Validation of Internet Security Protocols and Applications, on 2PAKEP shows that the replay and man-in-the-middle attacks are protected. In addition, we also analyze the performance and security and functionality properties of 2PAKEP and compare these with the related existing schemes. Overall, 2PAKEP provides better security and functionality features, and also the communication and computational overheads are comparable with the related schemes. Therefore, 2PAKEP is applicable to mobile environment efficiently.