User Traceability Research Articles

Co-Design and Energy Management for Future Vessels

The maritime industry is undergoing a significant shift towards more sustainable and efficient forms of transportation. As a result, designing Power, Propulsion and Energy (PPE) Systems for future vessels presents new challenges that require a systematic approach that reduces the risk in development and implementation. This paper focuses on three aspects of such a systematic approach: Model-Based System Engineering (MBSE), Co-design, and Verification and Validation. The MBSE approach can be used to mitigate the risks associated with the transition by maintaining a clear traceability of user needs, functional requirements and physical realizations. A rigorous needs analysis and functional design reduces the optimisation design space that results in a significant reduction in the complexity of a design optimisation problem. Further, co-design is discussed as a methodology for a combined optimisation of the hardware and software design where the Modular Energy Management approach supports automated controller generation for the optimisation, a key challenge when optimising PPE systems. An important aspect of the MBSE approach is the use of models for the verification and validation of the developed designs. However, the successful use of models is contingent on their applicability. This paper proposes a way to categorise model confidence for verification and validation studies.

A Multifactor Combined Data Sharing Scheme for Vehicular Fog Computing Using Blockchain

Vehicular Fog Computing (VFC), as an extended model of fog computing, combines fog computing with traditional in-vehicle networks to provide real-time response services for users. However, in such a dynamic system architecture, achieving secure and efficient data sharing is an enormous challenge. Ciphertext-policy attribute-based encryption (CP-ABE) is widely regarded as an excellent way of achieving one-to-many data sharing. Nevertheless, several practical challenges hinder its widespread application in VFC, such as inefficient attribute revocation, single-factor access control, and centralized data storage. For this purpose, we design a multi-factor combined data sharing scheme for VFC with CP-ABE and blockchain (MC-DS-VFC, in short). We first propose an efficient attribute revocation mechanism that does not require complex key update operations. We then embed time, user attributes, and access interests into data sharing for more fine-grain access control, which enables users with sufficient attributes to efficiently access real-time shared data according to their access interests. Finally, we combine the interplanetary file system (IPFS) and the blockchain maintained by roadside units (RSUs) to achieve distributed collaborative storage. Furthermore, our mechanism also supports user traceability, attribute joining, online/offline encryption, and verifiable outsourced decryption. Our proposal is shown to satisfy the indistinguishability under chosen plaintext attack (IND-CPA) in the standard model. Theoretical analysis and simulation experiments indicate that the MC-DS-VFC scheme is efficient and practical for VFC.

A secure and efficient AKE scheme for IoT devices using PUF and cancellable biometrics

As the Internet of Things (IoT) continues to grow, there is an increasing need for secure and efficient authentication protocols for IoT devices. The design of IoT authentication schemes requires several essential features such as real two-factor security, Key Compromise Impersonation (KCI) resilience, and Perfect Forward Secrecy (PFS). In this paper, we perform a cryptanalysis of two state-of-the-art PUF-based Authentication and Key Exchange(AKE) schemes and show informally how they fail to achieve real two-factor security, PFS and suffer KCI, user traceability, and database attacks. To address these limitations, we propose an improved two-party AKE scheme between the user-device and the server based on a combination of a physically unclonable function (PUF) and a cancellable biometric (CB). Our proposed scheme provides real two-factor security, KCI resilience, PFS, and user untraceability, achieving all desired properties based on the Computational Diffie–Hellman (CDH) assumption in the random oracle model. To establish the security of our proposed scheme, we utilize formal analysis methods, including the RoR model and ProVerif, and perform an informal security analysis to demonstrate its resilience against potential attacks. Additionally, we analyze the computational and communication performance of our proposed scheme against related PUF-based schemes. Our proposed scheme exhibits a computational and communicational feasible overhead for deployment in the context of the IoT, with a lower magnitude than most previous related PUF-based schemes.Overall, our proposed scheme provides an efficient and secure authentication solution for IoT devices, with improved security and reduced communication overhead compared to previous PUF-based schemes. The combination of formal and informal analysis provides robust evidence of the strength and reliability of our proposed scheme, and its scalability makes it a viable solution for large-scale IoT deployments.

A novel and provably secure mutual authentication protocol for cloud environment using elliptic curve cryptography and fuzzy verifier

SummaryCloud computing is an emerging paradigm that enables on‐demand data storage without considering the local infrastructure limitations of end‐users. The extensive growth in number of servers, resources, and networks intensifies security and privacy concerns in clouds. This necessitates secure mutual authentication and key agreement mechanism to verify the legitimacy of participating entities. In accordance, several authentication protocols have been designed to authenticate end‐users over insecure channels. This article presents security analysis of recent protocols that claim to render security and privacy features. We demonstrate that Kaur et al.'s protocol is vulnerable to replay attack, Dharminder et al.'s protocol is prone to user traceability and known session‐specific temporary information (KSSTI) attacks, and Bouchaala et al.'s protocol is prone to replay and KSSTI attacks. To withstand the aforementioned attacks, we propose an enhanced protocol based on fuzzy verifier and elliptic curve cryptography for clouds. Our protocol safeguards against security attacks while providing privacy functionalities. The security analysis is illustrated under real‐or‐random model, and correctness is verified under the Scyther security verification tool. Finally, comparative analysis with existing protocols shows that our protocol delivers robust security with reasonable computational and communication overheads than state‐of‐the‐art protocols.

Enabling Traceable and Verifiable Multi-User Forward Secure Searchable Encryption in Hybrid Cloud

Forward secure searchable encryption (FSSE) scheme allows one data user to search on encrypted databases while resisting the file injection attack. The data utilization can be further improved by extending the single-user scenario to the multi-user scenario. However, there are some issues needed to be considered when a data owner shares data with multiple data users. First, the public cloud server can not be completely trusted as it may be dishonest returning incorrect or incomplete results. Second, authorized users may trade their private keys for financial benefit. To our knowledge, state-of-the-art searchable encryption schemes only consider part of the following desirable features: the verifiability of results, the resistance to file injection attacks, the traceability and revocation of malicious users who abuse their private keys in the multi-user setting. Based on these motivations, we first propose enabling traceable and verifiable multi-user FSSE, which achieves the above functionalities. Besides, we carry out the security proof which demonstrates that our scheme can meet the requirements of security. We also assess the performance from theoretical analysis and experimental analysis, which shows that compared with other similar schemes, our scheme has richer functionalities with comparable efficiency.

Efficient, Traceable and Privacy-Aware Data Access Control in Distributed Cloud-Based IoD Systems

The emerging combination of Internet of Things (IoT) and aerospace integration aided by satellite and 6G communication techniques has stimulated the Internet of Unmanned Aerial Vehicles (UAVs), i.e., Internet of Drones (IoD). To accommodate and share the enormous real-time UAV data, cloud-based IoD is an inevitable choice to lower the heavy burden of mobile UAVs. Nevertheless, how to protect highly sensitive UAV data in such a honest-but-curious, open and distributed environment with resource-limited UAVs is a significant challenge. Although our previous work (PATLDAC) in SPNCE’21 devises a cloud-based UAV data access control scheme with policy privacy protection, limited access time and user traceability, it incurs inflexible and centralized cloud data storage and access as well as untrustworthy metadata in untrusted cloud environment for data access and user tracing. To this end, we further propose a blockchain-based privacy-aware data access control (BPADAC) scheme for distributed and secure UAV data sharing in cloud-based IoD. Based on fine-grained, traceable and privacy-preserving UAV data access characteristic of our previous work, we extend it by leveraging blockchain and Distributed Hash Table (DHT) for distributed and trustful UAV data access and storage, together with reliable and limited access mechanism to guarantee cloud UAV data sharing service provision. We also design public and undeniable user tracing mechanism to prevent user key abuse with traitor denial. Finally, we present formal security analysis and prototype the system leveraging the smart contracts of Ethereum blockchain for performance evaluation to show the feasibility of BPADAC.

Blockchain-based multi-authority revocable data sharing scheme in smart grid.

In view of the problems of inefficient data encryption, non-support of malicious user revocation and data integrity checking in current smart grid data sharing schemes, this paper proposes a blockchain-based multi-authority revocable data sharing scheme in the smart grid. Using online/offline encryption technology with hybrid encryption technology enhances the encryption performance for the data owner. The use of user binary tree technology enables the traceability and revocability of malicious users. The introduction of multiple attribute authorization authorities eliminates the threat of collusive attacks that exist in traditional data-sharing schemes. In addition, the semi-honest problem of third-party servers is solved by uploading data verification credentials to the blockchain. The security analysis results show that the scheme can resist selective plaintext attacks and collusion attacks. The performance analysis results show that the proposed scheme has lower computational overhead and better functionality than similar schemes, which is suitable for secure data sharing in smart grids.

A Study on Data Sharing Scheme using ECP-ABSC that Provides Data User Traceability in the Cloud

A Study on Data Sharing Scheme using ECP-ABSC that Provides Data User Traceability in the Cloud

Multi-Issuer Attribute-based Anonymous Credential with Traceability and Revocation

Attribute-based anonymous credential schemes allow users to obtain credentials from the issuer and prove the possession of their attributes interactively and anonymously with service providers. So far, most existing schemes only consider single-issuer, where some of them are extended to be traceable or revocable. In the reality, anonymous credential schemes under multi-issuer are more practical, since users could query for credentials from different issuers and use some of them simultaneously, which is more efficient than showing them individually. Although there are also multi-issuer schemes where users obtain credentials from different issuers and show an aggregated credential to service providers, however, these schemes lack practical properties, for example, revocation of invalid users. In this paper, we propose a multi-issuer attribute-based anonymous credential with traceability and revocation, which provides traceability of invalid users, and revocation of the specific users. Users receive credentials from multiple issuers and show an aggregated credential of selective disclosures of attributes. We provide the security model of our scheme of anonymity and unforgeability. Finally, we discuss the computational complexity, which shows the practicality and efficiency of our scheme.

Cryptanalysis and design flaws of anonymous ECC based self-certified key distribution scheme for smart grid

The smart grid (SG) is seen as a possible solution to the energy crises and carbon emissions. The power consumption data is collected through SG communication in order to optimize energy usage. Security problems in smart grid communications on the other hand continue to be virtual concerns. Various key agreement and authentication systems have recently been proposed in the context of SG communication in order to protect the users privacy and provide secure communication. Mood and Nikooghadam published a paper entitled Anonymous ECC-Based Self-Certified Key Distribution Scheme for Smart Grid in IEEE Transactions on Industrial Electronics [https://doi.org/10.1109/TIE.2018.2807383]. In this proposed work, we analyze Mood and Nikooghadam protocol and found security flaws such as the inability to protect anonymity, fails user traceability, DoS attack, insider attack, no updating the identity and keys and no login phase. Thus, Mood and Nikooghadam protocol is not convenient for smart grid communication. Further, we provide suggested improvement for Mood and Nikooghadam framework.

A Fair and Privacy-Preserving Image Trading System Based on Blockchain and Group Signature

With the rise of digital images in our daily lives, there is a growing need to provide an image trading market where people can monetize their images and get desired images at prices that fit their budget. Those images are usually uploaded and stored onto centralized image trading service providers’ servers and the transactions for image trading are processed by these providers. Unfortunately, transaction unfairness and users’ privacy breaches have become major concerns since the service providers might be untrusted and able to manipulate image trading prices and infer users’ private information. Recently, several approaches have been proposed to address the unfairness issue by using the decentralized ledger technique and smart contract, but users’ privacy protection is not considered. In this paper, we propose a fair and privacy-preserving protocol that supports image fair exchange and protect user privacy. In particular, we exploit blockchain and Merkle tree to construct a fair image trading protocol with low communication overhead based on smart contract, which serves as an external judge that resolves disputes between buyers and sellers in image transactions. Moreover, we extend a popular short group signature scheme to protect users’ identity privacy, prevent linkability of transactions from being inferred, and ensure traceability of malicious users who may sell fake images and/or refuse to pay. Finally, we design and build a practical and open-source image trading system to evaluate the performance of our proposed protocol. Experimental results demonstrate its effectiveness and efficiency in real-world applications.

Privacy-Preserving Attribute-Based Keyword Search with Traceability and Revocation for Cloud-Assisted IoT

With the rapid development of cloud computing and Internet of Things (IoT) technology, it is becoming increasingly popular for source-limited devices to outsource the massive IoT data to the cloud. How to protect data security and user privacy is an important challenge in the cloud-assisted IoT environment. Attribute-based keyword search (ABKS) has been regarded as a promising solution to ensure data confidentiality and fine-grained search control for cloud-assisted IoT. However, due to the fact that multiple users may have the same retrieval permission in ABKS, malicious users may sell their private keys on the Internet without fear of being caught. In addition, most of existing ABKS schemes do not protect the access policy which may contain privacy information. Towards this end, we present a privacy-preserving ABKS that simultaneously supports policy hiding, malicious user traceability, and revocation. Formal security analysis shows that our scheme can not only guarantee the confidentiality of keywords and access policies but also realize the traceability of malicious users. Furthermore, we provide another more efficient construction for public tracing.

Accountable Attribute-based Encryption with Public Auditing and User Revocation in the Personal Health Record System

In the system of ciphertext policy attribute-based encryption (CP-ABE), only when the attributes of data user meets the access structure established by the encrypter, the data user can perform decryption operation. So CP-ABE has been widely used in personal health record system (PHR). However, the problem of key abuse consists in the CP-ABE system. The semi-trusted authority or the authorized user to access the system may disclose the key because of personal interests, resulting in illegal users accessing the system. Consequently, aiming at two kinds of existing key abuse problems: (1) semi-trusted authority redistributes keys to unauthorized users, (2) authorized users disclose keys to unauthorized users, we put forward a CP-ABE scheme that has authority accountability, user traceability and supports arbitrary monotonous access structures. Specifically, we employ an auditor to make a fair ruling on the malicious behavior of users. Besides, to solve the problem of user leaving from the system, we use an indirect revocation method based on trust tree to implement user revocation. Compared with other existing schemes, we found that our solution achieved user revocation at an acceptable time cost. In addition, our scheme is proved to be fully secure in the standard model.

Efficient Authentication Protocol for Continuous Monitoring in Medical Sensor Networks

Currently, continuous monitoring on patients with the help of small devices (or sensors), is easy for doctors/nurses to check patients. Due to privacy issues, data collected from devices should be protected. Thus, a lightweight mutual authentication and key agreement protocol is required among doctors/nurses, trusted servers, sensors and patients. In this paper, we provide a secure protocol which could support continuous monitoring on patients. Firstly, user's biometrics will be used to verify users by means of continuous monitoring of physiological data (e.g., ECG signals) in which verification of the patient identity. This could prevent device theft attacks. In addition, dynamic identity is taken to provide user anonymity and mitigate against user traceability. Later, we provide informal and formal security analysis to prove that our protocol can establish a session key between the user and sensor after successfully mutually authentication. Performance analysis proved our scheme to be competitive in comparison to existing schemes relative to the added security benefits it provides.

Cryptanalysis and improvement of a user authentication scheme for wireless sensor networks using chaotic maps

One of the challenging issues in wireless sensor networks (WSNs) is to provide secure communication as the channel used is wireless. User authentication is a mechanism that is used to provide secure communication. The authors analyse the security of a recent authentication scheme for WSNs and show that it is not resistant to smart card loss, insider, and denial of service attacks besides the user traceability problem. Here, they design an improved user authentication scheme using the chaotic maps for WSNs. The chaotic maps-based public key cryptosystem helps a scheme to consider a large integer as the secret key rather than a large prime number and makes it fast. They show its formal security analysis using the random oracle model. They also analyse its security informally to show that it is resistant to various known attacks. They show that their scheme offers more security features than the existing schemes.

An Efficient Anonymous Authentication Scheme for Mobile Pay-TV Systems

As a component of mobile communication, the pay-TV system has attracted a lot of attention. By using mobile devices, users interact with the head end system in service providers to acquire TV services. With the growth of mobile users, how to protect the privacy of users while improving efficiency of the network has become an issue worthy of attention. Anonymous authentication schemes for mobile pay-TV systems came into being. In this paper, we analyze the shortcomings of the existing authentication protocol and then propose an improved one, which is secure against stored set attack and user traceability attack. The proposed scheme is proved to be secure. Moreover, our new scheme performs better in efficiency and storage, compared with several other schemes.

A lightweight anonymous two‐factor authentication protocol for wireless sensor networks in Internet of Vehicles

SummaryInternet of Vehicles (IoV), as the next generation of transportation systems, tries to make highway and public transportation more secure than used to be. In this system, users use public channels for their communication so they can be the victims of passive or active attacks. Therefore, a secure authentication protocol is essential for IoV; consequently, many protocols are presented to provide secure authentication for IoV. In 2018, Yu et al proposed a secure authentication protocol for WSNs in vehicular communications and claimed that their protocol could satisfy all crucial security features of a secure authentication protocol. Unfortunately, we found that their protocol is susceptible to sensor capture attack, user traceability attack, user impersonation attack, and offline sink node's secret key guessing attack. In this paper, we propose a new authentication protocol for IoV which can solve the weaknesses of Yu et al's protocol. Our protocol not only provides anonymous user registration phase and revocation smart card phase but also uses the biometric template in place of the password. We use both Burrow‐Abadi‐Needham (BAN) logic and real‐or‐random (ROR) model to present the formal analysis of our protocol. Finally, we compare our protocol with other existing related protocols in terms of security features and computation overhead. The results prove that our protocol can provide more security features and it is usable for IoV system.

A blockchain‐based traceable group loan system

SummaryDifficulties in financing and low utilization of funds are main financial problems that plague the development of small and medium‐sized enterprises. The key to solving this problem lies in opening up the social data circulation between enterprises. It is a good solution for enterprises with frequent data interactions to form groups. Using group loans, the borrowing enterprises could solve the funding difficulties and the loan enterprises could improve the utilization rate of funds. In this article, we construct a group loan system based on blockchain technology, which can promote the free flow of funds among enterprises in the group. We combine the blockchain with the trusted execution environment to realize the automatic determination of loan conditions and realize the automatic execution of smart contracts. We also use the linkable group signature technology to ensure the traceability of loan users while protecting the anonymity. In addition, we use homomorphic encryption technology to make the statement confidential and computable.

Adaptive Group-Based Zero Knowledge Proof-Authentication Protocol in Vehicular Ad Hoc Networks

Vehicular Ad Hoc Networks (VANETs) are a particular subclass of mobile ad hoc networks that raise a number of security challenges, notably from the way users authenticate the network. Authentication technologies based on existing security policies and access control rules in such networks assume full trust on Roadside Unit (RSU) and authentication servers. The disclosure of authentication parameters enables user's trace-ability over the network. VANETs' trusted entities (e.g. RSU) can utilize such information to track a user traveling behavior, violating user privacy and anonymity. In this paper, we proposed a novel, light-weight, Adaptive Group-based Zero Knowledge Proof-Authentication Protocol (AGZKP-AP) for VANETs. The proposed authentication protocol is capable of offering various levels of users' privacy settings based on the type of services available on such networks. Our scheme is based on the Zero-Knowledge-Proof (ZKP) crypto approach with the support of trade-off options. Users have the option to make critical decisions on the level of privacy and the amount of resources usage they prefer such as short system response time versus the number of private information disclosures. Furthermore, AGZKP-AP is incorporated with a distributed privilege control and revoking mechanism that render user's private information to law enforcement in case of a traffic violation.

An improved user authentication protocol for wireless sensor networks

AbstractWireless sensor networks (WSNs) have its applications in many domains such as agriculture, medicine, safety, and industry. Due to its wireless channel, it is vulnerable to many security threats. To provide end‐to‐end secure communication, various authentication and key agreement protocols have been discussed. Recently, Li et al have designed a mutual authentication and key agreement protocol for WSNs. However, it is found that this scheme does not resist to offline password guessing, device stolen, insider, and replay attacks besides user traceability problem. In this paper, a mutual authentication and key agreement protocol by overcoming the deficiencies of their scheme is proposed. Its formal security verification is shown using ProVerif tool. Its performance analysis is presented in terms of communication cost, computational cost, storage cost, and security features along with the other related schemes. It offers more security features than the other related schemes.