Successful Authentication Research Articles

S6AE: Securing 6LoWPAN Using Authenticated Encryption Scheme.

IPv6 over Low Power Wireless Personal Area Networks (6LoWPAN) has an ample share in the Internet of Things. Sensor nodes in 6LoWPAN collect vital information from the environment and transmit to a central server through the public Internet. Therefore, it is inevitable to secure communications and allow legitimate sensor nodes to access network resources. This paper presents a lightweight Authentication and Key Exchange (AKE) scheme for 6LoWPAN using an authenticated encryption algorithm and hash function. Upon successful authentication, sensor nodes and the central server can establish the secret key for secure communications. The proposed scheme ensures header verification during the AKE process without using IP security protocol and, thus, has low communication and computational overheads. The logical correctness of the proposed scheme is validated through Burrows–Abadi–Needham logic. Furthermore, automatic security analyses by using AVISPA illustrate that the proposed scheme is resistant to various malicious attacks in 6LoWPANs.

Emergence of Blockchain Technology: Fundamentals, Working and its Various Implementations

In this paper, we discuss that blockchain is a decentralized system which provides peer-to-peer network over which thousands of clients get connected without the involvement of trusted third parties. Involvement of trusted third parties provides security, privacy and trust and also limits the transaction size and increases time and cost to settle transaction. Blockchain is made up of several blocks and these blocks contain several transactions before initiating a transaction from sender, it is first authenticated and after successful authentication, a block is created. This block is again authenticated by all the nodes in the network and later this block is connected to a chain of blocks and all the blocks in the network are updated about this transaction and finally receiver at other end receives money. Layers of blockchain play significant role in designing architecture of blockchain since each layer filters out unnecessary info and lighters node traffic. Further we discuss blockchain applications, benefits for effective businesses and its adoption in several industrial sectors, financial sector, health and research sector.

LAKE-IoD: Lightweight Authenticated Key Exchange Protocol for the Internet of Drone Environment

A drone is an unmanned aerial vehicle, which is deployed in a particular Fly Zone (FZ), and used to collect crucial information from its surrounding environment to be transmitted to the server for further processing. Generally, a Mobile User (MU) is required to access the real-time information collected by the drone stationed in a specific FZ securely. Therefore, to ensure secure and reliable communications an Authenticated Key Exchange (AKE) protocol is imperative to the Internet of Drone (IoD) environment. An AKE scheme ensures only authentic MU to access IoD network resources. Upon successful authentication, MU and drone can set up a secret session key for secure communication in the future. This paper presents a novel Lightweight AKE Protocol for IoD Environment (LAKE-IoD), which first ensures the authenticity of MU and also renders session key establishment mechanism between MU and drone with the help of a server. LAKE-IoD is an AKE protocol, which is based on an authenticated encryption scheme AEGIS, hash function, and bit-wise XOR operation. Meticulous formal security verification by employing a software tool known as Scyther and informal security analysis demonstrates that LAKE-IoD is protected against different well-known active and passive security attacks. Additionally, Burrows-Abadi-Needham logic is applied to verify the logical completeness of LAKE-IoD. Furthermore, a comparison of LAKE-IoD with the related schemes shows that LAKE-IoD incurs less communication, computational and storage overhead.

XDBAuth: Blockchain Based Cross Domain Authentication and Authorization Framework for Internet of Things

The innovation of ubiquitous and pervasive computing helps service-oriented organizations in the realization of a virtual coalition. The virtual coalition is a set of IoT domains i.e., smart homes and smart hospitals that are linked together through communication lines to share resources. Such virtual coalitions need secure cross-domain permission delegation and access control mechanisms. In existing approaches, permission delegation and access control are performed at the resource owner domain or by a single trusted third party. This single trusted third party may fail to work or compromise. Therefore, it will collapse either the whole system or the security of the system. We propose xDBAuth, a decentralized Blockchain (BC) based permission delegation and access control framework for the Internet of Things (IoT). Also, we proposed a hierarchy of local and global smart contracts that perform permission delegation and access control for both internal and external user/IoT devices. Additionally, the proposed framework preserves an external user's privacy by allowing them to get authentication in their parent IoT domains. During authentication, Proof-of-Authenticity/Integrity (PoAI) mechanism is used to find and retrieve user/IoT device platform hashes stored on local BC. After successful authentication, BC authorizes the user/IoT device based on the validation of delegation policies stored on BC. We implemented the proposed framework using Node.js. The results show that the proposed xDBAuth is a lightweight framework with less computational overhead. xDBAuth produces high throughput in an environment having a large number of concurrent requests.

A Reversible Secret Image Sharing Scheme Based on Stick Insect Matrix

This paper first proposes a generation algorithm of a stick insect matrix. Then, a novel reversible secret image sharing scheme based on the stick insect matrix is presented. With the help of our matrix, secret data can be embedded in a cover image to generate two meaningful shadows. It is worth mentioning that the stick insect structure of the proposed matrix can be extended according to the embedding rate of the secret data, meanwhile the generating rules of the stick insect matrix can guarantee optimal visual quality of the generated shadows. Moreover, our scheme also provides an authentication mechanism. The embedded secret data can be retrieved and the cover image can be recovered exactly after successful authentication of two shadows. Experimental results show that our proposed scheme provides excellent visual quality and good authentication ability.

High-efficiency optical image authentication scheme based on ghost imaging and block processing

Ghost imaging (GI) is a hot technique in optical image encryption and authentication field due to its remarkable characteristics, such as strong ability against turbulence and high security. However, since the large number of private keys need to be stored and transmitted in the cryptosystems based on GI technique, the practical application of these cryptosystems is limited. To address this issue, we propose a high-efficiency optical image authentication scheme in which the private keys are a series of one-dimensional (1D) vectors used in block division. Each obtained reference intensity pattern behaves as a public key after being divided by two block-division vectors into blocks and further processed. Unlike the traditional GI based optical encryption and authentication schemes in which a series of two-dimensional (2D) phase-only masks (POMs) or reference intensity patterns are used as principal keys to be transmitted privately, the private keys in our proposed system to be transmitted are a series of 1D vectors. Consequently, the burden of the storage or transmission of private keys can be decreased considerably and high efficiency can be achieved. Since the numbers, sizes, repetition times and arrangement sequences of elements in the vectors could vary in a wide range, the vector selection possess high randomness, which guarantees the security of the proposed system. Using the private and the public keys, a correct reconstructed image and successful authentication result can be obtained by the authorized users. Numerical simulations are conducted to validate the feasibility, security and ability to resist noise and occlusion of the proposed scheme.

Blockchain for secure location verification

In location-sensitive applications, dishonest users may submit fake location claims to illegally access a service or obtain benefit. To address this issue, a number of location proof mechanisms have been proposed in literature. However, they confront various security and privacy challenges, including Prover–Prover collusions (Terrorist Frauds), Prover–Witness collusions, and location privacy threats. In this paper, we utilize the unique features of the blockchain technology to design a decentralized scheme for location proof generation and verification. In the proposed scheme, a user who needs a location proof (called a prover) broadcasts a request to the neighbor devices through a short-range communication interface, e.g. Bluetooth. Those neighbor devices that decide to respond (called witnesses) start to authenticate the requesting user. We integrate an incentive mechanism into the proposed scheme to reward such witnesses. Upon successful authentication, a transaction is generated as a location proof and is broadcast onto a peer-to-peer network where it can be picked up by verifiers for final verification. Our security analysis shows that the proposed scheme achieves a reliable performance against Prover–Prover and Prover–Witness collusions. Moreover, our prototype implementation on the Android platform shows that the proposed scheme outperforms other currently deployed location proof schemes.

TCALAS: Temporal Credential-Based Anonymous Lightweight Authentication Scheme for Internet of Drones Environment

A user (external party) is interested in accessing the real-time data from some designated drones of a particular fly zone in the Internet of Drones (IoD) deployment. However, to provide this facility, the user needs to be authenticated by an accessed remote drone and vice-versa. After successful authentication both parties can establish a secret session key for the secure communication. To handle this important problem in IoD environment, we design a novel temporal credential based anonymous lightweight user authentication mechanism for IoD environment, called TCALAS. A detailed security analysis using formal security under the broadly applied real-or-random (ROR) model, formal security verification under the broadly used software verification tool, known as automated validation of internet security protocols and applications, and also informal security analysis reveal that TCALAS has the capability to resist various known attacks against passive/active adversary. In addition, a detailed comparative study has been conducted for TCALAS and other related schemes, and the study also reveals that TCALAS provides better security and functionality features, and lower costs in both computation and communication as compared to existing schemes.

Design of Robust, High-Entropy Strong PUFs via Weightless Neural Network

Physically unclonable functions (PUFs) have been explored as lightweight hardware primitives for the purpose of realizing robust security via strong authentication or secure key/ID generation. PUF harness manufacturing process variations for the purpose of generating binary keys or binary functions. An ideal strong PUF is a binary function that maps an m-bit input challenge to an uniquen-bit output response, making it attractive for authentication applications. Unfortunately, real strong PUF implementations suffer from reliability issues where the same challenge may produce different responses in the presence of noise. To overcome this problem, strong PUF leverages the availability of exponential number of challenge-response pairs (CRPs). A successful authentication event requires acquiring multiple CRPs and applying a threshold. In contrast, weak PUFs produce limited keys and are required to be highly reliable. Multiple techniques have been developed to achieve the necessary reliability. An additional prerequisite for strong PUFs is resilience against model-building attacks (cloning) by an adversary, who has observed a few CRPs, to prevent successful prediction of future CRPs. In this work, we first illustrate a strong PUF design that re-purposes a weightless neural network (WNN). Second, we showcase the robustness of WNN-based strong PUFs with respect to machine learning attacks, while providing desirable uniqueness and reliability metrics. Finally, we employ an initial entropy source of highly reliable weak PUF bits mapped to weightless neural networks (WNNs) for the purpose of creating a near-ideal strong PUF in terms of reliability. Our results show that it is possible to create highly reliable WNN–based strong PUFs with < 65 % ML accuracy by using as few as 32 initial reliable weak PUF bits.

A Proposed Mobile Based Payment System (Quickpay) for Nigerian Universities

Objectives: In this research work, we proposed and designed a QR code, 2FA authentication based mobile payment system (Quickpay) for Nigerian universities with focus on Ebonyi State University, Abakaliki. Quickpay mobile payment system will aide student in the payment of all the necessary fees required by the university. Methods and Analysis: We deployed object oriented analysis and methodology where we utilized Unified Modelling Language (UML) in analyzing and modelling the new system. Then, the methodology facilitated the use of competent high level programming tool (PHP programming language) for the development of the software (Quickpay mobile app) after detailed system analysis and design. Findings: When using the system proposed in this study, the different security model used in design of mobile payment solution which was seamlessly integrated into the system that will ensure authorized access. This model deploys 2FA authentication system at the initial stage of verification and an SMS token (request for SMS code and User ID) at the second stage of verification to guarantee user access to the system. On successful authentication, the user uses phone to scan the QR code and send an SMS using USSD code and payment code user will click on generate invoice in the form QR code, the user will use a mobile generated form of the invoice to complete the payment transaction. Application Improvements: Despite the QR code system as deployed in most mobile payment system, Quickpay is designed to seamlessly interface with the university portal while utilizing several layers of possession factor authentication methods. This includes an SMS module to generate a security token for authentication and the 2FA authentication system. Keywords: Mobile Payment, Mobile Technology, QR code, 2FA Authentication, USSD Code

Wireless access point protection from un-authorized user in an office environment

Extensible Authentication Protocol (EAP) is authentication method to protect wireless local area network from un-authorized user which there was interaction between radius servers, access point and client device. When EAP was used as authentication method, the authentication can be strengthened by using TLS (Transport Layer Security) certificate where client device and server will use certificate to verify the identity of each other. The certificate must meet requirement on the server and client for the successful authentication. For this time, the authentication method provides highest level for security in wireless local area network because this method can protect man-in-middle vulnerability.The proposed framework is evaluated by using scenario in testing and live environment to ensure that the authentication has been securely for mutual device authentication.

Quality assurance of intensity modulated radiation therapy treatment planning using head and neck phantom

AbstractPurposeThe purpose of this study is the verification of intensity modulated radiation therapy (IMRT) head neck treatment planning with one-dimensional and two-dimensional (2D) dosimeters using imaging and radiation oncology core (IROC) Houston head &amp;amp; neck (H&amp;amp;N) phantom.MethodThe image of the H&amp;amp;N phantom was obtained by computed tomography scan which was then transferred to Pinnacle@3 treatment planning system (TPS) for treatment planning. The contouring of the target volumes and critical organ were done manually and dose constraints were set for each organ according to IROC prescription. The plan was optimised by adoptive convolution algorithm to meet the IROC criteria and collapse cone convolution algorithm calculated the delivered doses for treatment. Varian Clinac 2110 was used to deliver the treatment plan to the phantom, the process of irradiation and measurement were repeated three times for reproducibility and reliability. The treatment plan was verified by measuring the doses from thermoluminescent dosimeters (TLDs) and GafChromic external beam therapy 2 films. The agreement between the planned and delivered doses were checked by calculating the percentage dose differences, analysing their isodose line profiles and 2D gamma maps.ResultsThe average percent dose difference of 1·8% was obtained between computed doses by TPS and measured doses from TLDs, however these differences were found to be higher for organ at risk. The film dose profile was well in agreement with the planned dose distribution with distance to agreement of 1·5 mm. The gamma analysis of the computed and recorded doses passed the criteria of 3%/3 mm with passing percentages of &amp;gt;96%, which shows successful authentication of delivered doses for IMRT.ConclusionIMRT pre-treatment validation can be done with IROC anthropomorphic phantoms, which is essential for the delivery of modulated radiotherapies. It was concluded that films and TLDs can be used as quality assurance tools for IMRT.

Cryptographic Side-Channel Signaling and Authentication via Fingerprint Embedding

Authentication via fingerprint embedding at the physical layer utilizes noise in the wireless channel to attain a certain degree of information theoretic security that traditional HMAC methods cannot provide. Fingerprint embedding refers to a key-aided process of superimposing a low-power tag to the primary message waveform for the purpose of authenticating the transmission. The tag is uniquely created from the message and key and successful authentication is achieved when the correct tag is detected by the receiver. This paper generalizes a framework for embedding physical layer fingerprints to create an authenticated side-channel for minimal cost. Side-channel information is conveyed to the receiver through the transmitter's choice of tag from a secret codebook generated by the primary message and a shared secret key. In addition, a new linear coding scheme is introduced which enhances the ability to trade off the performance goals of authentication, side-channel rate, secrecy, and privacy.

A Proxy Signature Based Efficient and Robust Handover AKA Protocol for LTE/LTE-A Networks

An efficient and robust handover is one of the essential requirements of several applications in LTE/LTE-A network. These applications are reliable only after a successful authentication of communication entities. Hence, the third generation partnership project has recommended the handover schemes for different mobility scenarios with a new key management approach that increases the complexity of the overall system. To overcome the above problems, researchers have proposed various handover authentication protocols. But, most of the handover protocols can’t avoid the key escrow problem and suffers from key forward/backward secrecy. Also, these protocols are vulnerable to various malicious attacks and incur high computational overhead during the authentication process. Therefore, these protocols don’t suit for handover authentication in LTE/LTE-A networks. However, researchers have proposed the proxy signature based handover protocols but, these protocols fail to achieve an adequate solution for proxy revocation and necessary security demands. In order to mitigate the aforesaid problems, we propose a proxy signature based efficient and robust handover authentication and key agreement protocol with revocation in LTE/LTE-A network. To prove the correctness of the proposed protocol, the formal analysis is carried out by BAN logic and simulated using the AVISPA tool. Moreover, the security analysis illustrates that the proposed protocol fulfills all the security features and avoids the identified attacks. Finally, the performance analysis of the proposed protocol is shown with existing handover protocols. The analysis shows that the protocol has improved results in terms of transmission, storage, message and computation overhead.

Design and analysis of authenticated key agreement scheme in cloud-assisted cyber–physical systems

With advancements in engineering and science, the application dimensions of Cyber–Physical System (CPS) are increasing due to their improving efficiency, safety, reliability, usability and autonomy. By providing on-demand access to shared processing resources, cloud computing reduces infrastructure costs. Ensuring quality of service and information privacy and security is important in such environments. In this paper, we design a new authentication scheme related to the cloud-assisted CPS in two directions: (1) authentication between a user and a cloud server, and (2) authentication between a smart meter and a cloud server. In the former situation, any external party (user) can access the information stored in a cloud server provided that the user is legal and has the right to access information. In the later situation, a smart meter and a cloud server authentication is needed for secure communication of data stored in the cloud server. In both cases, both entities first mutually authenticate each other and only after successful authentication with the help of a trusted authority, establish a session key for their future secure communication. The proposed scheme deals with both the cases and provides high security as compared to other related works, which is shown through formal and informal security analysis. In addition, the mutual authentication using the widely-accepted Burrows–Abadi–Needham logic (BAN logic) and also formal security verification using the broadly-used Automated Validation of Internet Security Protocols and Applications (AVISPA) simulation tool demonstrate further that the scheme is strong in security. Finally, the proposed scheme is shown to be efficient in terms of communication and computation costs as compared to those for other related existing schemes.

An Automated Approach to Public Distribution System Using Internet of Things

This paper presents an automated and efficient model of Public Distribution System (PDS) using biometric based authentication and networking through a micro-controller. Public Distribution System, also termed as rationing distribution system, is one of the widely disputable area with a scope for many malpractices. The existing ration distribution system has high level of corruption such as inaccurate measurement of food grains, long waiting times in queues, material theft in ration shops and manual distribution of the food grains. As a solution to the problems involved in the existing ration card system, the present paper proposes a fully automated model to provide high transparency at all the stages of PDS. In this system, each customer is provided with a smart card, which is to be used along with fingerprint for their authentication. After successful authentication, the consumers can provide their requirements using a touchscreen interface. The dispensing of the food grains through vending machines will take place automatically with the operation of motors and valves controlled by a micro-controller, after verification of the requirements provided by the user. The same transaction will be reflected immediately in the database along with a message to the customer. All the payments are also handled in a digital mode. In addition, this model also strengthens the Digital India initiative introduced by the government of India recently.

Cryptanalysis and Enhancement of an Anonymous Self-Certified Key Exchange Protocol

Authentication protocols with anonymity have gained much popularity recently which allows users to access any public network without compromising their identity. Several key exchange protocols have been proposed in the literature using either public key infrastructure or identity-based cryptosystem. However, the former suffers from heavy computation cost and latter fails to prevent key escrow problem. Recently, Islam et al. have proposed a self-certified authenticated key agreement protocol based on ECC which removes the above limitations. However, through careful analysis, we found that their scheme lack anonymity and vulnerable to trace the attack, clogging attack, and fails to prevent the replay attack. To overcome these weaknesses, we propose an anonymous self-certified authenticated key exchange protocol by including the required security features. The scheme is formally proved using Automated Validation of Internet Security protocols and Applications software. Also, the formal authentication proofs using Burrows–Abadi–Needham logic ensures successful authentication. Furthermore, the performance analysis demonstrates that the proposed scheme accomplishes less computational cost and is applicable to a client–server architecture.

DGBES: Dynamic Group Based Efficient and Secure Authentication and Key Agreement Protocol for MTC in LTE/LTE-A Networks

The machine to machine communication (MTC) has grown into one of the fastest expansion in the area of Information and Communication Technology and is one of the important aspect of the Internet of Things. It allows millions of devices to connect with each other over the internet. MTC has a huge market and massive strength to obtain numerous application scenarios. The applications of MTC are reliable and effective only after a successful authentication of MTC devices. Hence, there are several group based authentication and key agreement (AKA) protocols were proposed by researchers. Whenever a number of MTC devices simultaneously generate the access request to the LTE/LTE-A network, each MTC device needs a separate authentication process to access the core network that leads to genuine signaling congestion problem. In addition, the existing group based AKA protocols did not equip with the group management scheme efficiently and also vulnerable to various known attacks. To avoid the aforesaid problems and mitigate the authentication complexity of the earlier schemes, we propose a dynamic group based efficient and secure (DGBES-AKA) protocol for MTC in LTE/LTE-A network. The proposed protocol consists the group key update scheme with key forward and backward secrecy. The formal verification using ProVerif and security analysis of the proposed protocol represent the security against malicious attacks. Finally, we show the qualitative and quantitative analysis of the DGBES-AKA protocol with the existing protocols. The analysis shows that the proposed protocol has improved results in terms of communication and computation overhead.

Secure Authentication and Prescription Safety Protocol for Telecare Health Services Using Ubiquitous IoT

Internet-of-Things (IoT) include a large number of devices that can communicate across different networks. Cyber-Physical Systems (CPS) also includes a number of devices connected to the internet where wearable devices are also included. Both systems enable researchers to develop healthcare systems with additional intelligence as well as prediction capabilities both for lifestyle and in hospitals. It offers as much persistence as a platform to ubiquitous healthcare by using wearable sensors to transfer the information over servers, smartphones, and other smart devices in the Telecare Medical Information System (TMIS). Security is a challenging issue in TMIS, and resourceful access to health care services requires user verification and confidentiality. Existing schemes lack in ensuring reliable prescription safety along with authentication. This research presents a Secure Authentication and Prescription Safety (SAPS) protocol to ensure secure communication between the patient, doctor/nurse, and the trusted server. The proposed procedure relies upon the efficient elliptic curve cryptosystem which can generate a symmetric secure key to ensure secure data exchange between patients and physicians after successful authentication of participants individually. A trusted server is involved for mutual authentication between parties and then generates a common key after completing the validation process. Moreover, the scheme is verified by doing formal modeling using Rubin Logic and validated using simulations in NS-2.35. We have analyzed the SAPS against security attacks, and then performance analysis is elucidated. Results prove the dominance of SAPS over preliminaries regarding mutual authentication, message integrity, freshness, and session key management and attack prevention.

Personal OAuth authorization server and push OAuth for Internet of Things

Internet of Things will connect millions of things to the Internet to make our lives more convenient. However, Internet of Things security is an essential factor. OAuth is one of the most successful authentication and authorization protocols on the Internet. This article proposes push OAuth and personal OAuth authorization server by expanding OAuth for a secure access to the information on Internet of Things devices. In personal OAuth, the smartphones that communicate with remote servers to deliver information on Internet of Things devices can be the OAuth authorization server. Hospitals (OAuth client) that intend to access the information on Internet of Things devices cannot know millions of OAuth authorization server when the smartphone becomes the OAuth authorization server. This article proposes the push OAuth that changes the OAuth protocol and issues the OAuth token when the OAuth authorization server registers to the OAuth client first. Personal OAuth authorization server is far more trustworthy than using a third-party OAuth authorization server to authenticate because users directly control access to the information generated by Internet of Things devices. The personal OAuth authorization server and push OAuth suggested here are expected to create a more secure Internet of Things environment as users can directly authenticate the OAuth client that can access the information on their Internet of Things devices.