Session Key Generation Research Articles

A network security protection scheme for tax system based on elliptic curve cryptography

With the rapid development of modern information technology and network technology, the construction of tax informatization plays an important role in improving the level of tax management and work efficiency. However, in the centralized data processing mode, the establishment of large data center and the efficient, stable, and secure connection of server bandwidth have become key challenges. Moreover, the openness and interconnectivity of the tax system network pose various network security threats, seriously threatening the integrity and security of data. For the above issues, this article proposes a tax system network security protection scheme based on elliptic curve cryptography. This scheme combines hash function and elliptic curve cryptography to achieve user anonymity and secure generation of session keys, effectively ensuring the secure transmission of confidential information. The security and effectiveness of the scheme are verified through informal and formal security analysis based on security proof, BAN logic and AVISPA tool. And a comprehensive evaluation of the scheme is conducted, and the results show that the scheme significantly reduced the costs while providing security features.

Blockchain-enhanced efficient and anonymous certificateless signature scheme and its application

Although the Internet of Things (IoT) brings efficiency and convenience to various aspects of people’s lives, security and privacy concerns persist as significant challenges. Certificateless Signatures eliminate digital certificate management and key escrow issues and can be well embedded in resource-constrained IoT devices for secure access control. Recently, Ma et al. designed an efficient and pair-free certificateless signature (CLS) scheme for IoT deployment. Unfortunately, We demonstrate that the scheme proposed by Ma et al. is susceptible to signature forgery attacks by Type-II adversaries. That is, a malicious-and-passive key generation center (KGC) can forge a legitimate signature for any message by modifying the system parameters without the user’s secret value. Therefore, their identity authentication scheme designed based on vehicular ad-hoc networks also cannot guarantee the claimed security. To address the security vulnerabilities, we designed a blockchain-enhanced and anonymous CLS scheme and proved its security under the Elliptic curve discrete logarithm (ECDL) hardness assumption. Compared to similar schemes, our enhanced scheme offers notable advantages in computational efficiency and communication overhead, as well as stronger security. In addition, a mutual authentication scheme that satisfies the cross-domain scenario is proposed to facilitate efficient mutual authentication and negotiated session key generation between smart devices and edge servers in different edge networks. Performance evaluation shows that our protocol achieves an effective trade-off between security and compute performance, with better applicability in IoT scenarios.

TrustHealth: Enhancing eHealth Security with Blockchain and Trusted Execution Environments

The rapid growth of electronic health (eHealth) systems has led to serious security and privacy challenges, highlighting the critical importance of protecting sensitive healthcare data. Although researchers have employed blockchain to tackle data management and sharing within eHealth systems, substantial privacy concerns persist as a primary challenge. In this paper, we introduce TrustHealth, a secure data sharing system that leverages trusted execution environment (TEE) and blockchain technology. TrustHealth leverages blockchain to design smart contracts to offer robust hashing protection for patients’ healthcare data. We provide a secure execution environment for SQLCipher, isolating all sensitive operations of healthcare data from the untrusted environment to ensure the confidentiality and integrity of the data. Additionally, we design a TEE-empowered session key generation protocol that enables secure authentication and key sharing for both parties involved in data sharing. Finally, we implement TrustHealth using Hyperledger Fabric and ARM TrustZone. Through security and performance evaluation, TrustHealth is shown to securely process massive encrypted data flows at a rate of 5000 records per second, affirming the feasibility of our proposed scheme. We believe that TrustHealth offers valuable guidelines for the design and implementation of similar systems, providing a valuable contribution to ensuring the privacy and security of eHealth systems.

A Drone-Assisted Anonymous Authentication and Key Agreement Protocol with Access Control for Accident Rescue in the Internet of Vehicles

The drone-assisted Internet of Vehicles (DIoV) displays great potential in the punctual provision of rescue services without geographical limitations. To ensure data security in accident response and rescue services, authentication schemes with access control are employed. These schemes ensure that only specific rescue vehicle operators acting within a valid period can achieve mutual authentication from a designated processor, while access for mismatched, revoked, or expired users is denied. However, the current alternatives fail to ensure session key forward secrecy, entities’ mutual authentication, and user anonymity, thereby compromising users’ privacy and the security of communications. Moreover, executing too many time-consuming operations on vehicles’ resource-constrained devices inevitably degrades the performance of the authentication protocol. Balancing security and performance in the design of an authentication protocol with access control presents a significant challenge. To address this, a more efficient and robust authentication with access control has been designed. The proposed protocol ensures user anonymity through dynamic pseudonym allocation, achieves forward secrecy by excluding the long-term key from session key generation, and obtains mutual authentication by verifying the integrity of the messages exchanged. According to the security and performance analysis, it is demonstrated that the proposal is a robust, efficient, and cost-effective solution. In particular, the proposal can reduce the computational overhead by 66% compared to recent alternatives.

An All-Inclusive Taxonomy and Critical Review of Blockchain-Assisted Authentication and Session Key Generation Protocols for IoT

Authentication and Session Key Generation Protocols (SKGPs) play an essential role in securing the communication channels of connected Internet of Things (IoT) devices. Recently, through blockchain integration, scholars have tried to enhance the security and applicability of SKGPs. In brief, blockchain is a distributed ledger technology that can provide interesting features such as immutability, transparency, and accountability without any need for the active participation of trusted parties. This survey presents a comprehensive critical review of blockchain-assisted authentication and SKGPs, suggested for different IoT domains, including Internet of Vehicles, Internet of Drones, and Industrial IoT. Our survey categorizes existing schemes based on several criteria, including IoT application domains, security aspects, and blockchain components. By presenting an unbiased critical review and taxonomy of protocols, we aim to clarify the key challenges. Our review will specifically indicate what properties authors gained or lost through the integration of blockchain. To our best knowledge, this survey is the only one that offers all prerequisites for interested readers in blockchain-integrated SKGPs, such as security features and attacks, attack models, verification tools, blockchain types, blockchain platforms, and consensus mechanisms. Further, our survey elaborates existing research gaps in blockchain-assisted SKGPs. In doing so, we aim to guide future research in this field and provide researchers with the essential information they require.

Mechanism for Device Authentication and Session Key Generation in Industrial Internet of Things Networks

Mechanism for Device Authentication and Session Key Generation in Industrial Internet of Things Networks

Simple, secure and lightweight authentication protocol with session-key generation for IIoT device in IIoT networks

Simple, secure and lightweight authentication protocol with session-key generation for IIoT device in IIoT networks

Formal Security Analysis of ECC-Based RFID in Logic of Events Theory

Radio frequency identification (RFID) is a crucial component of the Internet of Things (IoT), and RFID using elliptic curve Cryptography (ECC) is a public key cryptosystem authentication approach that tackles the problem of electronic tag data encryption in RFID systems. The commercialisation and large-scale deployment of RFID systems has raised a number of security-related issues that suggest the need for security protocols. Logic of events theory (LoET) is a formal method for constructing and reasoning about distributed systems and protocols involving security concepts. This paper proposes three event classes, Compute, Retrieve, and Generate, and related axioms and inference rules to formally abstract the ECC session key generation function and formally institute the authentication process of both parties, and the ex-tended LoET is used to analyse the security properties of ECC-based RFID security protocols. Under reasonable assumptions, an ECC-based RFID mutual authentication scheme is shown to satisfy the strong mutual authentication feature. It is shown that extended logic of events theory may be used to prove the security properties of this class of ECC-based RFID protocols.

A Rubik's Cube Cryptosystem-based Authentication and Session Key Generation Model Driven in Blockchain Environment for IoT Security

Over the past decade, IoT has gained huge momentum in terms of technological exploration, integration, and its various applications even after having a resource-bound architecture. It is challenging to run any high-end security protocol(s) on Edge devices. These devices are highly vulnerable toward numerous cyber-attacks. IoT network nodes need peer-to-peer security, which is possible if there exists proper mutual authentication among network devices. A secure session key needs to be established among source and destination nodes before sending the sensitive data. To generate these session keys, a strong cryptosystem is required to share parameters securely over a wireless network. In this article, we utilize a Rubik's cube puzzle-based cryptosystem to exchange parameters among peers and generate session key(s). Blockchain technology is incorporated in the proposed model to provide anonymity of token transactions, on the basis of which the network devices exchange services. A session key pool randomizer is used to avoid network probabilistic attacks. Our hybrid model is capable of generating secure session keys that can be used for mutual authentication and reliable data transferring tasks. Cyber-attacks resistance and performance results were verified using standard tools, which gave industry level promising results in terms of efficiency, light weightiness, and practical applications.

Concurring of Neural Machines for Robust Session Key Generation and Validation in Telecare Health System During COVID-19 Pandemic.

In this technique, it has been proposed to agree the session keys that have been generated through dual artificial neural networks based on the Telecare Health COVID-19 domain. Electronic health enables secure and protected communication between the patients and physicians, especially during this COVID-19 pandemic. Telecare was the main component which served the remote and non-invasive patients in the crisis period of COVID-19. Neural cryptographic engineering support in terms of data security and privacy is the main theme for Tree Parity Machine (TPM) synchronization in this paper. The session key has been generated on different key lengths and key validation done on the proposed set of robust session keys. A neural TPM network receives a vector designed through same random seed and producing a single output bit. Duo neural TPM networks' intermediate keys would be partially shared between the patient and doctor for the purpose neural synchronization. Higher magnitude of co-existence has been observed at the duo neural networks at the Telecare Health Systems in COVID-19. This proposed technique has been highly protective against several data attacks in the public networks. Partial transmission of the session key disables the intruders to guess the exact pattern, and highly randomized through different tests. The average p-values of different session key lengths of 40 bits, 60 bits, 160 bits, and 256 bits were observed to be 221.9, 259.3, 242, and 262.8 (taken under multiplicative of 1000) respectively.

State-of-the-art session key generation on priority-based adaptive neural machine (PANM) in telemedicine.

Telemedicine is one of the safest methods to provide healthcare facilities to the remote patients with the help of digitization. In this paper, state-of-the-art session key has been proposed based on the priority oriented neural machines followed by its validation. State-of-the-art technique can be mentioned as newer scientific method. Soft computing has been extensively used and modified here under the ANN domain. Telemedicine facilitates secure data communication between the patients and the doctors regarding their treatments. The best fitted hidden neuron can contribute only in the formation of the neural output. Minimum correlation was taken into consideration under this study. Hebbian learning rule was applied on both the patient's neural machine and the doctor's neural machine. Lesser iterations were needed in the patient's machine and the doctor's machine for the synchronization. Thus, the key generation time has been shortened here which were 4.011ms, 4.324ms, 5.338ms, 5.691ms, and 6.105ms for 56 bits, 128 bits, 256 bits, 512 bits, and 1024 bits of state-of-the-art session keys, respectively. Statistically, different key sizes of the state-of-the-art session keys were tested and accepted. Derived value-based function had yielded successful outcomes too. Partial validations with different mathematical hardness had been imposed here too. Thus, the proposed technique is suitable for the session key generation and authentication in the telemedicine in order to preserve the patients' data privacy. This proposed method has been highly protective against numerous data attacks inside the public networks. Partial transmission of the state-of-the-art session key disables the intruders to decode the same bit patterns of the proposed set of keys.

BSKM-FC: Blockchain-based secured key management in a fog computing environment

With an increase in the number of devices in the edge layer connected to the fog server of the fog computing environment, it is found that vulnerable and unauthorized activities are also increasing relatively. Thus, there is a requirement for authorized access control in such an environment that is governed by secured and efficient key management between the communicating devices. Many researchers have presented conventional solutions for key management depending on a third party. The third party operated for a key generation or key distribution in a fog computing environment based on a centralized architecture which leads to the drawbacks like a single-point failure and inconsistency of key management. So, effective and secured key management between the edge devices which are willing to communicate is the major concern to be addressed in the current digital world to achieve access control. This paper proposes a BSKM-FC (Blockchain-based Secured Key Management in a Fog Computing Environment) which is a decentralized system in a fog computing environment without using a third party. The BSKM-FC makes use of a one-way hash chain for the generation of private and public key pairs and ECC (Elliptic Curve Cryptography) for secured sharing. Upon successful authentication, the session key generation at both edge devices is based on the key pair provided by the fog server and stored securely in the blockchain. The BSKM-FC system uses private blockchain technology in the fog layer to provide secured storage and management. The work is implemented in the Truffle Blockchain and found that BSKM-FC performs better in terms of overall block preparation time. The security analysis of the proposed scheme is carried out based on the ROR model and also verified using AVISPA for some known attacks. Informal security analysis of the proposed work is performed by considering some of the known attacks where we observe that the proposed scheme overcomes such attacks. Performance overhead analysis is demonstrated using MIRACL considering computation cost, communication cost, and storage cost. The results show that the proposed scheme meets security requirements and performs effectively. The computation overhead, communication overhead, storage overhead, and block preparation time of the proposed scheme were improved by 7% to 14%, 9% to 18%, 7% to 17%, and 14% to 28%, respectively, as compared to existing schemes.

LIKA: Lightweight Identity Based Key Agreement Protocol for Secure Data Transmission in Advanced Metering Infrastructure of Smart Grid

Integration of information communication technology via the Internet of Things devices and sensors can enable an efficient power service for utility providers to consumers in advanced metering infrastructure. Authentication and cryptographic mechanisms protect identity, data security and privacy from unauthorised interception for smart meters to servers. In the last couple of years, many key agreement protocols have been prescribed and deployed to fix those issues. Unfortunately, the deployed protocols did not work inside the same protocols, specifically parameter detection and recognition for session key generation, as they entail high computation time and communication bits overheads. Furthermore, the absence of forward secrecy and user anonymity affects the authentication. Therefore, we have proposed a lightweight identity-based key agreement (LIKA) utilising the Diffie–Hellman cryptography with a trusted authority. It seeks to cover both the security and performance criteria with equal weight. The protocol is evaluated by the Canetti and Krawczyk adversarial model, Avispa and cryptographic analysis released the session keys that were not considered as an adversary during mutual authentication. Moreover, as compared to related work, the proposed protocol took the least amount of time (5.319 ms and 1056 bits) for the entire process of session key generation. Furthermore, comparative analysis has shown that the LIKA adequately encompasses computation, communication, and security assessments. Consequently, it is more convenient for practical implementation for a smart grid.

An Enhanced RFID-Based Authentication Protocol using PUF for Vehicular Cloud Computing

RFID (radio frequency identification) is an Internet of Things (IoT) enabling technology. All physical devices can be connected to the Internet of Things thanks to RFID. When RFID is extensively utilized and fast increasing, security and privacy concerns are unavoidable. Interception, manipulation, and replay of the wireless broadcast channel between the tag and the reader are all possible security threats. Unverified tags or readers provide untrustworthy messages. IoT requires a safe and consistent RFID authentication system. PUFs are also physical one-way functions made up of the unique nanoscopic structure of physical things and their reactivity to random occurrences. PUF includes an unclonable feature that takes advantage of physical characteristics to boost security and resistance to physical attacks. We analyze the security of the RSEAP2 authentication protocol that has been recently proposed by Safkhani et al., a hash-based protocol, and elliptic curve cryptosystem-based protocol. Our security analysis clearly shows important security pitfalls in RSEAP2 such as mutual authentication, session key agreement, and denial-of-service attack. In our proposed work, we improved their scheme and enhanced their version using physically unclonable function (PUF), which are used by the proposed protocol in tags. This research proposes a cloud-based RFID authentication technique that is both efficient and trustworthy. To decrease the RFID tag’s overhead, the suggested authentication approach not only resists the aforementioned typical assaults and preserves the tag’s privacy, but also incorporates the cloud server into the RFID system. According to simulation results, our approach is efficient. Moreover, according to our security study, our protocol can withstand a variety of attacks, including tracking, replay, and desynchronization assaults. Our scheme withstands all the 18 security features and further consumes the computation cost as 14.7088 ms which is comparable with the other schemes. Similarly, our scheme consumes the communication cost as 672 bits during the sending mode and 512 bits during the receiving mode. Overall, the performance of our proposed method is equivalent to that of related schemes and provides additional security features than existing protocols. Mutual authentication, session key generation, and ephemeral session security are all achieved. Using the real-or-random concept, we formalize the security of the proposed protocol.

Quantum-Safe Group Key Establishment Protocol from Lattice Trapdoors.

Group communication enables Internet of Things (IoT) devices to communicate in an efficient and fast manner. In most instances, a group message needs to be encrypted using a cryptographic key that only devices in the group know. In this paper, we address the problem of establishing such a key using a lattice-based one-way function, which can easily be inverted using a suitably designed lattice trapdoor. Using the notion of a bad/good basis, we present a new method of coupling multiple private keys into a single public key, which is then used for encrypting a group message. The protocol has the apparent advantage of having a conjectured resistance against potential quantum-computer-based attacks. All functions—key establishment, session key update, node addition, encryption, and decryption—are effected in constant time, using simple linear-algebra operations, making the protocol suitable for resource-constrained IoT networks. We show how a cryptographic session group key can be constructed on the fly by a user with legitimate credentials, making node-capture-type attacks impractical. The protocol also incorporates a mechanism for node addition and session-key generation in a forward- and backward-secrecy-preserving manner.

INVESTIGATION OF LINEAR TRANSFORMATIONS OF THE PROPOSED HUSHING FUNCTION OF THE ADVANCED MODULE OF CRYPTOGRAPHIC PROTECTION IN INFORMATION AND CIRCUMSTANCES

This paper investigates the linear transformations of the hash function, which is part of the developed advanced module of cryptographic protection of information, which by capturing information about the user ID, session ID, sending time, message length and sequence number, as well as using a new session key generation procedure for encryption, allows you to ensure the confidentiality and integrity of data in information and communication systems process control. The object of research is the process of ensuring the confidentiality of data in information and communication systems management systems based on cloud technologies. The subject is the study of linear transformations of the proposed hashing function of the advanced module of cryptographic protection in information and communication systems. The purpose of this work is to study the linear transformations of the proposed hashing function of the advanced module of cryptographic protection in information and communication systems for process control based on cloud technologies. To use this module effectively, it is important to choose crypto-resistant encryption and hashing methods, as well as secret key synchronization. Cryptoalgorithms resistant to linear, differential, algebraic, quantum and other known types of cryptanalysis can be used as functions of cryptographic methods of encryption and hashing. The conducted experimental study of linear transformations of the proposed hashing function of the advanced module of cryptographic protection in information and communication systems confirmed the cryptoresistance of the advanced algorithm to linear cryptanalysis.

HARDWARE SUPPORT PROCEDURES FOR ASYMMETRIC AUTHENTICATION OF THE INTERNET OF THINGS

Subject of research: procedures of asymmetric authentication of Internet of Things nodes to ensure the highest level of security using cryptographic chips. The aim of the article is to study the ways of potential use of cryptographic chips to ensure secure authentication of Internet of Things sites using asymmetric cryptography procedures. The article solves the following tasks: analysis of hardware support technologies for asymmetric cryptography of the Internet of Things; definition of secure procedures for asymmetric authentication of Internet of Things sites and their constituent elements: creation of certificates, verification of public and private keys. Research methods: method of structural and functional analysis and design of complex systems, methods of identification and authentication of information objects, cryptographic methods of information protection, methods of security analysis of distributed information systems. The novelty of the study is the analysis of hardware support technologies for asymmetric cryptography of Internet of Things with cryptographic chips and the definition of structural and functional schemes for the implementation of procedures for asymmetric authentication of Internet of Things. Distinctive features of the provided asymmetric authentication schemes and procedures are: ensuring an increased level of information security through secure storage of cryptographic keys, digital signatures, certificates, confidential data in a novelty security environment protected from external attacks and no need to store private keys on the host side. The results of the work are procedures and schemes of application of cryptomicrops of asymmetric authentication to ensure the protection of Internet of Things. Analysis of the functioning of the presented schemes allowed to draw the following conclusions. The proposed structural and functional schemes for the implementation of procedures for asymmetric authentication of Internet of Things using cryptographic chips give the user an easy opportunity to implement cryptography without expertise in this field. These chips use the ECDSA digital signature computing and verification hardware with elliptical curve advantages, as a proven and reliable authentication algorithm, and the ECDH symmetric encryption session key generation unit. The provided schemes and procedures support three components of information security, namely: confidentiality, integrity and authenticity of data. Examples of potential applications of the provided schemes and procedures can be implemented using any asymmetric authentication chip, but it is recommended that they be used to generate encryption session keys and where digital signatures are required to verify data and code for integrity and authenticity.

Design of Psk Based Trusted Dtls for Smart Sensor Nodes

Background: RSA based key exchange is a heavy and time-consuming process, as it involves numerous message exchange between a client and the server. Pre-shared key (PSK) based handshake process attempts to reduce the messages while the key exchange between a client and the server. Method: This paper extends the TEE enabled dtls handshake design based on RSA to the TEE enabled pre-shared key based handshake. A dtls client and the server installs the pre-shared key in advanced so that the message exchanges can be reduced while session key generation. Result: In this article, the authors have significantly reduced this penalty by fine-tuning of the tdtls algorithm for psk based handshake. On average, this gain is over 2 ms (50% - from 3.5 ms to 1.5 ms) across various cipher-suites. Conclusion: The tdtls approach increases the security of the session key and its intermediate keying materials which is a huge gain as compared to minor handshake time increase. The algorithm ensures an end-to-end security to the PSK based session key as well as its keying materials between a dtls client and a server.

A Semi-Centralized Dynamic Key Management Framework for In-Vehicle Networks

The current in-vehicle network lacks a robust security communication mechanism between Electronic Control Units (ECUs). Although different proposed frameworks aim to secure the Controller Area Network (CAN) bus communication, few of them consider relevant aspects such as key refreshing and management, ECU maintenance, and vehicle manufacturing process. Despite the fact that a centralized key distribution provides an efficient mechanism, security and safety fully depend on this centralized key generator, which may lead to a single point of failure problem. In this work, we present a semi-centralized dynamic key management framework that provides a decentralized and dynamic key generation during the vehicle's operation. Our framework not only increases security and safety even if the centralized key generator is offline but also reduces the number of keys, the communication payload inside the network, and the complexity of cryptographic material sharing during the vehicle's lifetime. Moreover, we propose a dynamic generation of session keys for different groups of ECU and external devices, which is a requirement for intelligent vehicles and future Internet of Vehicles. In order to evaluate the performance, we implement our framework on three hardware platforms with different computational power and validate its advantage, efficiency, and flexibility by comparing it with other frameworks.

A Key Management Protocol Based on the Hash Chain Key Generation for Securing LoRaWAN Networks.

Recently, many Low Power Wide Area Network (LPWAN) protocols have been proposed for securing resource-constrained Internet of Things (IoT) devices with negligible power consumption. The Long Range Wide Area Network (LoRaWAN) is a low power communication protocol that supports message authentication, integrity, and encryption using two-session preshared secret keys. However, although the LoRaWAN supports some security functions, it suffers from session key generation and key update problems. This motivates us to introduce a new key management protocol that resolves the LoRaWAN problems and supports key updates. The proposed protocol is based on hash chain generation using a one-way hash function. Network entities share a common hash chain of n key elements to allow using a unique signing key per message. We also propose a salt hashing algorithm that encrypts the original keys into a different form to avoid the physical attacks at the end device side. We analyzed the proposed key generation performance in terms of the computation time, the required storage, and the communication overhead. We implemented and tested the proposed key generation protocol using the NS-3 network simulator. The proposed lightweight key generation protocol significantly enhances the security of the original LoRaWAN at a negligible overhead. The proposed protocol reduces the power consumption and transmission time by two times compared with some previous protocols. In addition, the proposed key generation protocol can resist attacks, such as key compromising attacks and replay attacks, and it supports the Perfect Forward Secrecy, which was not supported by LoRaWAN.