Stolen-verifier Attack Research Articles

Provably Secure Lightweight Mutual Authentication and Key Agreement Scheme for Cloud-Based IoT Environments.

A paradigm that combines cloud computing and the Internet of Things (IoT) allows for more impressive services to be provided to users while addressing storage and computational resource issues in the IoT environments. This cloud-based IoT environment has been used in various industries, including public services, for quite some time, and has been researched in academia. However, various security issues can arise during the communication between IoT devices and cloud servers, because communication between devices occurs in open channels. Moreover, issues such as theft of a user's IoT device or extraction of key parameters from the user's device in a remote location can arise. Researchers interested in these issues have proposed lightweight mutual authentication key agreement protocols that are safe and suitable for IoT environments. Recently, a lightweight authentication scheme between IoT devices and cloud servers has been presented. However, we found out their scheme had various security vulnerabilities, vulnerable to insider, impersonation, verification table leakage, and privileged insider attacks, and did not provide users with untraceability. To address these flaws, we propose a provably secure lightweight authentication scheme. The proposed scheme uses the user's biometric information and the cloud server's secret key to prevent the exposure of key parameters. Additionally, it ensures low computational costs for providing users with real-time and fast services using only exclusive OR operations and hash functions in the IoT environments. To analyze the safety of the proposed scheme, we use informal security analysis, Burrows-Abadi-Needham (BAN) logic and a Real-or-Random (RoR) model. The analysis results confirm that our scheme is secure against insider attacks, impersonation attacks, stolen verifier attacks, and so on; furthermore, it provides additional security elements. Simultaneously, it has been verified to possess enhanced communication costs, and total bit size has been shortened to 3776 bits, which is improved by almost 6% compared to Wu et al.'s scheme. Therefore, we demonstrate that the proposed scheme is suitable for cloud-based IoT environments.

Cryptanalysis of Secure ECC-Based Three Factor Mutual Authentication Protocol for Telecare Medical Information System

Telecare Medical Information System (TMIS) is gaining importance in the present COVID-19 crisis. TMIS as a technology, offers patients a range of remote medical services, incorporated into Wireless Body Area Network (WBAN). The patient’s medical report is confidentially transmitted over an open channel in TMIS environments. An attacker may attempt to compromise the security, such as forgery, replay, and impersonation attacks. To ensure secure communication, various authentication solutions have been introduced for TMIS. Biometrics and Elliptic Curve Cryptography-based mutual authentication protocol was recommended by Sahoo et al. in 2020 and is proved to have some loopholes in the protocol. We discovered, however, Sahoo et al. method is unable to prevent privileged insider attacks and insider attacks along with patient anonymity. Jongseok Ryu et al. recommended a ECC based three-factor mutual authentication protocol and ensures patient’s confidentiality for TMIS with proof of informal analysis. They have also performed formal security studies utilizing the Automated Validation of Internet Security Protocols and Applications (AVISPA), the Burrows-Abadi-Needham (BAN) logic and Real-Or-Random (ROR) model. However, we have reviewed the Jongseok Ryu et al.’s proposal. Based on his attacker model, we have examined that this scheme is unsafe against Message Substitution Attacks, Man-in-the-Middle attacks, Session Key Disclosure attacks, Privileged Insider attacks, and Stolen verifier attacks. we suggest a technique to be safe from the above security threats.

Provably Secure and Lightweight Patient Monitoring Protocol for Wireless Body Area Network in IoHT.

As one of the important applications of Internet of Health Things (IoHT) technology in the field of healthcare, wireless body area network (WBAN) has been widely used in medical therapy, and it can not only monitor and record physiological information but also transmit the data collected by sensor devices to the server in time. However, due to the unreliability and vulnerability of wireless network communication, as well as the limited storage and computing resources of sensor nodes in WBAN, a lot of authentication protocols for WBAN have been devised. In 2021, Alzahrani et al. designed an anonymous medical monitoring protocol, which uses lightweight cryptographic primitives for WBAN. However, we find that their protocol is defenseless to off-line identity guessing attacks, known-key attacks, and stolen-verifier attacks and has no perfect forward secrecy. Therefore, a patient monitoring protocol for WBAN in IoHT is proposed. We use security proof under the random oracle model (ROM) and automatic verification tool ProVerif to demonstrate that our protocol is secure. According to comparisons with related protocols, our protocol can achieve both high computational efficiency and security.

Comments on “A Secure and Lightweight Drones-Access Protocol for Smart City Surveillance”

Recently, Akram et al. (2021) proposed a drones-access protocol for monitoring urban security. Akram et al. claimed that their protocol is secure and can resist known security attacks. However, in this comment article, we demonstrate that their protocol is still vulnerable to drone capture attacks and stolen-verifier attacks. In addition, their protocol does not provide perfect forward secrecy. Finally, we present an improved protocol to manage the security weaknesses we found.

SELWAK: A Secure and Efficient Lightweight and Anonymous Authentication and Key Establishment Scheme for IoT Based Vehicular Ad hoc Networks.

In recent decades, Vehicular Ad Hoc Networks (VANET) have emerged as a promising field that provides real-time communication between vehicles for comfortable driving and human safety. However, the Internet of Vehicles (IoV) platform faces some serious problems in the deployment of robust authentication mechanisms in resource-constrained environments and directly affects the efficiency of existing VANET schemes. Moreover, the security of the information becomes a critical issue over an open wireless access medium. In this paper, an efficient and secure lightweight anonymous mutual authentication and key establishment (SELWAK) for IoT-based VANETs is proposed. The proposed scheme requires two types of mutual authentication: V2V and V2R. In addition, SELWAK maintains secret keys for secure communication between Roadside Units (RSUs). The performance evaluation of SELWAK affirms that it is lightweight in terms of computational cost and communication overhead because SELWAK uses a bitwise Exclusive-OR operation and one-way hash functions. The formal and informal security analysis of SELWAK shows that it is robust against man-in-the-middle attacks, replay attacks, stolen verifier attacks, stolen OBU attacks, untraceability, impersonation attacks, and anonymity. Moreover, a formal security analysis is presented using the Real-or-Random (RoR) model.

Enhanced Authentication Protocol for the Internet of Things Environment

The Internet of Things (IoT) is among the most promising technologies of the future, and its development has garnered attention worldwide. However, the rise of the IoT has been accompanied by a proportionate increase in security concerns regarding communication between IoT entities. Recently, Alzahrani et al. proposed an identity-based authentication and key agreement protocol for an IoT environment, wherein a physically unclonable function was employed. They claimed that their protocol can resist various types of attacks; however, after thorough analysis, we determined it to be ineffective against privileged internal attacks, physical IoT device capture attacks, stolen-verifier attacks, and known temporary information exposure attacks. To resolve these security weaknesses, we propose a new authentication and key agreement protocol. In addition, we demonstrate that the proposed protocol is provably secure in real-or-random (ROR) model and Burrows–Abadi–Needham (BAN) logic, resisting known attacks while incurring low communication and computation costs.

A Mutual Authentication and Cross Verification Protocol for Securing Internet-of-Drones (IoD)

With the rapid miniaturization in sensor technology, Internet-of-Drones (IoD) has delighted researchers towards information transmission security among drones with the control station server (CSS). In IoD, the drone is different in shapes, sizes, characteristics, and configurations. It can be classified on the purpose of its deployment, either in the civilian or military domain. Drone’s manufacturing, equipment installation, power supply, multi-rotor system, and embedded sensors are not issues for researchers. The main thing is to utilize a drone for a complex and sensitive task using an infrastructure-less/self-organization/resource-less network type called Flying Ad Hoc Network (FANET). Monitoring data transmission traffic, emergency and rescue operations, border surveillance, search and physical phenomenon sensing, and so on can be achieved by developing a robust mutual authentication and cross-verification scheme for IoD deployment civilian drones. Although several protocols are available in the literature, they are either design issues or suffering from other vulnerabilities; still, no one claims with conviction about foolproof security mechanisms. Therefore, in this paper, the researchers highlighted the major deficits in prior protocols of the domain, i.e., these protocols are either vulnerable to forgery, side channel, stolen-verifier attacks, or raised the outdated data transmission flaw. In order to overcome these loopholes and provide a solution to the existing vulnerabilities, this paper proposed an improved and robust public key infrastructure (PKI) based authentication scheme for the IoD environment. The proposed protocol’s security analysis section has been conducted formally using BAN (Burrows-Abadi-Needham) logic, ProVerif2.03 simulation, and informally using discussion/pragmatic illustration. While the performance analysis section of the paper has been assessed by considering storage, computation, and communication cost. Upon comparing the proposed protocol with prior works, it has been demonstrated that it is efficient and effective and recommended for practical implementation in the IoD environment.

A Secure and Privacy-Preserving Three-Factor Anonymous Authentication Scheme for Wireless Sensor Networks in Internet of Things

The Internet of things is playing more and more important role in smart healthcare, smart grids, and smart transportation, and using wireless sensor network (WSN), we can easily obtain and transmit information. However, the data security and users’ privacy are the biggest challenges for WSN because sensor nodes have low computing power and low storage capacity and are easy to be captured, and wireless networks are vulnerable. In 2021, Shuai et al. proposed a lightweight three-factor anonymous authentication scheme for WSN. However, we found that their protocol is vulnerable to stolen-verifier attack, modification of messages’ attack, and no perfect forward secrecy. Then, a new three-factor anonymous authentication scheme using elliptic curve cryptography (ECC) is proposed. Through informal and formal security analyses, our scheme can resist various known attacks and maintains low computational complexity.

Design, Analysis, and Implementation of a Twofactor Authentication Scheme using Graphical Password

With the increase in the number of e-services, there is a sharp increase in online financial transactions these days. These services require a strong authentication scheme to validate the users of these services and allow access to the resources for strong security. Since two-factor authentication ensures the required security strength, various organizations employ biometric-based or Smart Card or Cryptographic Token-based methods to ensure the safety of user accounts. But most of these methods require a verifier table for validating users at a server. This poses a security threat of stolen-verifier attack. To address this issue, there is a strong need for authentication schemes for e-services that do not require a verifier table at the server. Therefore, this paper proposes the design of an authentication scheme for eservices which should be resistant to various attacks including a stolen verifier attack. The paper will also discuss: 1) The proposed scheme analyzed for security provided against the known authentication attacks 2) The concept mplementation of the proposed scheme.

An enhanced and provably secure multi-factor authentication scheme for Internet-of-Multimedia-Things environments

The Internet-of-Multimedia-Things (IoMT) opens new doors towards various contingencies to improve applications and services through efficient multimedia data usage. The ever-enlarging content of multimedia information in an IoT system makes it a critical security concern. Whenever users access services or information through a public channel, he/she is exposed to numerous security threats. Many security schemes have been introduced for IoMT environments to tackle the above-said concerns. Still, most of them do not fulfill all the security requirements of the IoMT systems. Recently, Dhillon and Karla have presented an authentication scheme for the IoMT environment. They have declared that the scheme is robust and can resist significant security attacks. However, we noticed that Dhillon and Kalra’s scheme is susceptible to user masquerading attacks and a stolen verifier attack. Besides, their scheme also violates the anonymity and traceability of a user. This paper proposes a more secure remote user authentication scheme using the elliptic curve cryptosystem for the IoMT system. We have evaluated our scheme formally through the random oracle model. The informal security description proves that our scheme provides resistance against significant security attacks. Further, the performance analysis reveals that our scheme is more flexible, robust, and efficient than the relevant schemes.

Cryptanalysis and improvement of mutual authentication protocol for real-time data access in industrial wireless sensor networks

Wireless Sensor Networks (WSNs) have a very large number of applications in different domains of the industry. One of those applications is the industrial use of WSN. Industrial Wireless Sensor Networks (IWSNs) are generally used in places which are isolated from human involvement. Thus their security and privacy are a major concern. Recently, Gope et al. have discussed a lightweight mutual user authentication protocol for IWSN. In this paper, we perform the security analysis of their scheme and find that their scheme is vulnerable to the following attacks: user device loss attack, stolen verifier attack, and denial of service attack. We also propose an improved scheme that overcomes these vulnerabilities. The proposed scheme uses the Physically Unclonable Function (PUF), Exclusive OR (XOR), and one-way cryptographic hash function operations, which are all lightweight cryptographic functions. The analysis of formal security in our scheme uses random oracle model to prove the safety of the user identity, password, and session key. Through the informal security, we show that our scheme resists many known attacks. The formal verification of security is done using ProVerif tool. In the performance analysis, we present that our scheme provides better security features than the other related schemes.

An improved lightweight anonymous user authenticated session key exchange scheme for Internet of Things

Due to the myriad applications of the Internet of Things (IoT) in various sectors like healthcare, military, industry, safety, etc., there is also a need to secure these systems efficiently. The devices in such networks need to provide services to users in a secure manner. User authentication is a mechanism through which we can provide secure communication between IoT devices. Recently Banerjee et al. outlined a lightweight anonymous user authenticated session key exchange scheme for Internet of Things deployment, which uses three-factor authentication of a user such as smart card, password and biometric. In this paper, we cryptanalyze their scheme and find that it is not secure against smart card loss attack and stolen verifier attack. Then we have proposed an improved scheme to overcome the weaknesses of their scheme. We present the formal security analysis of our scheme using the random oracle model and informal security analysis to show that our scheme is secure against many known attacks. Its formal security verification is carried out using ProVerif tool. Its performance analysis is carried out with the related schemes which shows that our scheme is more secure than other schemes. Also, our scheme does not contain any storage table at the gateway side for authentication.

ILAS-IoT: An improved and lightweight authentication scheme for IoT deployment

In 2019, Banerjee et al. (IEEE Int Things J 6(5):8739–8752, 2019; https://doi.org/10.1109/JIOT.2019.2931372 ) proposed an authenticated key agreement scheme to facilitate the session establishment resulting into a session key between a user and a smart device for IoT based networks. As per their claim, the scheme of Banerjee et al. provides known security features and resist all known attacks using only lightweight symmetric key primitives. The analysis in this paper; however, shows that the scheme of Banerjee et al. cannot complete normally. The user in their scheme, after sending a request message may never receive the response from smart device. This incorrectness results into total in applicability of Banerjee et al.’s scheme. Moreover, it is also shown that their scheme has weaknesses against stolen verifier attack. Then an improved lightweight authentication scheme for IoT deployments (ILAS-IoT) is proposed in this article. ILAS-IoT performs the process correctly by increasing very little computation and communication overheads. The proposed ILAS-IoT also resists stolen verifier and all known attacks, which is evident from the formal and informal security analysis.

A Robust user authentication protocol with privacy-preserving for roaming service in mobility environments

The authentication system plays a crucial role in the context of GLObal MObility NETwork (GLOMONET) where Mobile User (MU) often need to seamless and secure roaming service over multiple Foreign Agents (FA). However, designing a robust and anonymous authentication protocol along with a user privacy is essential and challenging task. Due to the resource constrained property of mobile terminals, the broadcast nature of a wireless channel, mobility environments are frequently exposed to several attacks. Many researchers focus their interests on designing an efficient and secure mobile user authentication protocol for mobility networks. Very recently (in 2018), Xu et al presented the novel anonymous authentication system for roaming in GLOMONET, and insisted that their protocol is more secure than existing authentication protocols. The security strength of Xu et al.’s authentication protocol is analysed and identified that the protocol is vulnerable to stolen verifier attack, privileged insider attack, impersonation attack and denial of service attack. In-fact, the protocol suffers from clock synchronization problem and cannot afford local password-verification to detect wrong passwords quickly. As a remedy, we proposed an efficient and robust anonymous authentication protocol for mobility networks. The proposed mobile user authentication protocol achieves the provable security and has the ability to resist against numerous network attacks. Besides, the correctness of the novel authentication protocol is validated using formal security tool called AVISPA (Automated Validation of Internet Security Protocols & Applications). Finally, the performance analysis and simulation results reveals that the proposed authentication protocol is computationally efficient and practically implementable in resource limited mobility environments.

Secure and anonymous authentication scheme for the Internet of Things with pairing

The Internet of Things technology allows devices automatically connect with others or a server for the purposes of exchanging data. People can conveniently integrate data from those devices for a smart home, vehicular ad-hoc network, e-Health, etc. In 2017, Wang et al. proposed a simple authentication scheme for the Internet of Things. Although they formally proved that their scheme is secure, they did not consider the privacy of devices and stolen verifier attack. In this paper, we first demonstrate the weaknesses of Wang et al.’s scheme. Accordingly, we present a higher security level authentication scheme to resist the above weaknesses.

A novel authentication and key‐agreement scheme for satellite communication network

SummaryIn these days, satellite communication networks are playing a significant role in facilitating the crucial infrastructural services that include environmental monitoring, electronic surveillance, public safety, intelligence operations for law enforcement, government agencies, and the military. However, security researchers have uncovered that many protocols for these satellite communication networks have some vulnerabilities and flaws that can allow remote attackers to intercept, block, and manipulate critical communication over the network. Therefore, in this article, we introduce an efficient and simple authentication key agreement protocol for securing mobile satellite communication systems. Our proposed protocol resists against denial of service, smart‐card stolen, replay, user impersonation, and stolen verifier attack. Furthermore, our protocol provides various functionality features like perfect‐forward secrecy, mutual‐authentication, dynamic identity, and session‐key agreement. Moreover, the performance analysis of our protocol shows that the communication and computation cost of the proposed protocol is far less than the existing protocols. Hence, our proposed protocol offers simple, efficient, secure authentication, and key agreement for mobile satellite systems.

Securing Smart City Surveillance: A Lightweight Authentication Mechanism for Unmanned Vehicles

The significance of the Internet of Drones (IoD) is increasing steadily and now IoD is being practiced in many military and civilian-based applications. IoD facilitates real-time data access to the users especially the surveillance data in smart cities using the current cellular networks. However, due to the openness of communication channel and battery operations, the drones and the sensitive data collected through drones are subject to many security threats. To cope the security challenges, recently, Srinivas et al. proposed a temporal credential based anonymous lightweight authentication scheme (TCALAS) for IoD networks. Contrary to the IoD monitoring framework proposed by Srinivas et al., their own scheme can work only when there is one and only one cluster/flying zone and is not scalable. Moreover, despite their claim of robustness, the investigation in this paper reveals that Srinivas et al.'s scheme cannot resist traceability and stolen verifier attacks. Using the lightweight symmetric key primitives and temporal credentials, an improved scheme (iTCALAS) is then proposed. The proposed scheme while maintaining the lightweightness provides security against many known attacks including traceability and stolen verifier. The proposed iTCALAS extends scalability and can work when there are several flying zone/clusters in the IoD environment. The formal security proof along with automated verification using ProVerif show robustness of proposed iTCALAS. Moreover, the security discussion and performance comparisons show that the iTCALAS provides the known security features and completes authentication in just 2.295~ms.

CSEF: Cloud-Based Secure and Efficient Framework for Smart Medical System Using ECC

Smart architecture is the concept to manage the facilities via internet utilization in a proper manner. There are various technologies used in smart architecture such as cloud computing, internet of things, green computing, automation and fog computing. Smart medical system (SMS) is one of the application used in architecture, which is based on communication networking along with sensor devices. In SMS, a doctor provides online treatment to patients with the help of cloud-based applications such as mobile device, wireless body area network, etc. Security and privacy are the major concern of cloud-based applications in SMS. To maintain, security and privacy, we aim to design an elliptic curve cryptography (ECC) based secure and efficient authentication framework for cloud-assisted SMS. There are six phases in the proposed protocol such as: patient registration phase, healthcare center upload phase, patient data upload phase, treatment phase, checkup phase and emergency phase. In CSEF, there are four entities like healthecare center, patient, cloud and doctor. In CSEF, mutual authentication establishes between healthcare center and cloud, patient and cloud, doctor and cloud, and patient and healthcare center by the using ECC and hash function. The CSEF is secure against security attacks, and satisfies many security attributes such as man-in-the-middle attack, impersonation attack, data non-repudiation, doctor anonymity, replay attack, known-key security property, message authentication, patient anonymity, data confidentiality, stolen-verifier attack, parallel session attack and session key security. Further, the CSEF is efficient in terms of computation and communication compared to others related frameworks. As a result, CSEF can be utilized in cloud-based SMS.

Perfect forward secrecy via an ECC-based authentication scheme for SIP in VoIP

With the advent of the internet, Voice over Internet Protocol (VoIP) has obtained a considerable amount of attention due to its low cost, and ease of implementation. Similar to other emerging technologies, VoIP faces several challenges, including security in terms of confidentiality, integrity, and authenticity. Specifically, there is a need for secure and efficient authentication and key agreement scheme to address the security requirements of communications over VoIP networks. Recently, Ravanbakhsh et al. have presented an authentication and key agreement protocol for VoIP networks. Here, in this article, we first prove that Ravanbakhsh et al.’s scheme cannot provide perfect forward secrecy. Next, we present an elliptic curve cryptography-based secure two-factor authentication and key agreement scheme. We analyze the security of the proposed scheme informally, and demonstrate that the proposed scheme can provide different security features, including perfect forward secrecy, and is robust against security attacks such as the impersonation attack, the replay attack, and the stolen-verifier attack. Furthermore, we simulate the protocol and analyze its security formally using Scyther tool. The results show its robustness against different attacks, and its ability to provide perfect forward secrecy. We compare the computation cost of the proposed scheme with the related schemes. Results show that the proposed scheme achieves a satisfiable performance comparable to other ECC-based methods.

A NOVEL SECURITY PROTOCOL FOR WIRELESS SENSOR NETWORKS BASED ON ELLIPTIC CURVE SIGNCRYPTION

With the growing usage of wireless sensors in a variety of applications including Internet of Things, the security aspects of wireless sensor networks have been on priority for the researchers. Due to the constraints of resources in wireless sensor networks, it has been always a challenge to design efficient security protocols for wireless sensor networks. An novel elliptic curve signcryption based security protocol for wireless sensor networks has been presented in this paper, which provides anonymity, confidentiality, mutual authentication, forward security, secure key establishment, and key privacy at the same time providing resistance from replay attack, impersonation attack, insider attack, offline dictionary attack, and stolen-verifier attack. Results have revealed that the proposed elliptic curve signcryption based protocol consumes the least time in comparison to other protocols while providing the highest level of security.