Tracking Attacks Research Articles

Trajectory tracking attack for vehicular ad‐hoc networks

AbstractMaintaining user privacy and security is a critical concern in vehicular ad hoc networks (VANETs). However, prior research has neglected the study of matrix recovery attack methods in VANETs and the challenge of reducing the number of roadside units (RSUs). In this article, we formulate a path recovery strategy using matrix recovery techniques from an adversarial view. Subsequently, the challenge of minimizing RSUs while monitoring all user vehicles in a region is converted into a set cover problem. We introduce a heuristic algorithm that utilizes clustering to address this issue. To minimize matrix recovery errors, a Kalman filter based method is integrated to enhance the performance. This paper also presents an initial deployment of path recovery attacks, maintaining effectiveness even with certain defense mechanisms in place. Furthermore, we conduct simulation experiments to evaluate the effectiveness of the proposed attack strategy. The simulation results demonstrate the performance across various dimensions. Finally, the results show that the success rate of our proposed counter‐defense strategy in overcoming user defenses surpasses 50%.

Analysis and Improvement of an Authentication Scheme for Fog Computing Services

Fog computing utilizes devices in the edge network to transmit data with very low latency and supports high mobility. However, fog computing inherits security and privacy problems from cloud computing. Therefore, various privacy schemes for fog computing have been proposed to prevent different types of attacks. Recently, Weng et al proposed a fog computing authentication scheme; after analyzing, we found that Weng et al's scheme cannot resist user tracking attack and user impersonation attack. Then, we propose an improved scheme through adding a password, modifying the calculation method of Ei, and adding timestamps. In addition, we also compare the improved scheme with existing authentication schemes in terms of security and computational efficiency. The results show that the improved scheme is more secure and has less computation.

RFTrack: Stealthy Location Inference and Tracking Attack on Wi-Fi Devices

RFTrack: Stealthy Location Inference and Tracking Attack on Wi-Fi Devices

Analysis and Improvement of a Privacy-Preserving Authentication Scheme for Telecare Medical Information System Environment

Telecare Medical Information System (TMIS) can provide various telemedicine services to patients. However, information is communicated over an open channel. An attacker may intercept, replay, or modify this information. Therefore, many authentication schemes are proposed to provide secure communication for TMIS. Recently, Yu et al proposed a privacy-preserving authentication scheme in the Internet of Medical Things (IoMT)-enabled TMIS environments. They emphasize that their scheme is resistant to various attacks and ensures anonymity. Unfortunately, this paper demonstrates that Yu et al's scheme is vulnerable to impersonation attacks, replay attacks, and tracking attacks and cannot mutually authenticate. To overcome the shortcomings of Yu et al's scheme, we mainly improve the authentication and key agreement process and propose a corresponding improved scheme. We also compare the improved scheme with several existing authentication schemes in terms of security and computational efficiency.

A Privacy-Aware Tracking and Tracing System

The ability to track and trace assets in the supply chain is becoming increasingly important. In addition to asset tracking, the technologies used provide new opportunities for collecting and analyzing employee position and biometric data. As a result, these technologies can be used to monitor performance or track worker behavior, resulting in additional risks and stress for employees. Furthermore, contact tracing systems used to contain the COVID-19 outbreak have made positive patients' privacy public, resulting in violations of users' rights and even endangering their lives. To resolve this situation, a verifiable attributebased encryption (ABE) scheme based on homomorphic encryption and zero-knowledge identification (ZKI) is proposed, with ZKI providing anonymity for data owners to resist tracking attacks and homomorphic encryption used to solve the problem of privacy leakage from location inquiries returned from a semi-honest server. Finally, theoretical security analysis and formal security verification show that our scheme is secure against the chosen plaintext attack (CPA) and other attacks. Besides that, our novel scheme is efficient enough in terms of user-side computation overhead for practical applications.

Impact of endorsement policy on the performance of blockchain‐based VANET

AbstractWith the revolution in technology, VANET has emerged as a new generation of technology and used globally for intelligent traffic management systems. VANET uses a PKI‐based protocol to maintain privacy and security. Still, some crucial issues remain unresolved, like blind belief in communicated messages, lack of vehicle's interest in participation, revealing the sender vehicle's identity, and maintaining integrity. The solution to these issues will prevent vehicles from propagating fake messages while concurrently protecting the confidentiality of each involved vehicle against tracking attacks. Blockchain, a peer‐to‐peer, immutable, distributed ledger‐based technology, can be adapted as a robust solution to overcome critical challenges and make VANET more secure and reliable. This paper proposes a novel blockchain‐based VANET architecture, blockchain‐based vehicular ad‐hoc network (B‐VANET), implemented on the Hyperledger Fabric platform. B‐VANET aims to secure the network by validating road events before actually updating it on the network. For validation, the trust factor of each vehicle and their past involvement in the network is maintained. Trust factor value decides the trustworthiness of a vehicle. Based on this trust factor, a dynamic endorsement policy is designed. Endorsement policy, part of the smart contract, plays a vibrant role in Hyperledger Fabric. It decides how many and which particular peers can endorse the transaction to make it valid and add it to the ledger. Multiple possible approaches to endorsement policies are identified for B‐VANET and are analyzed using the Hyperledger Caliper tool. These approaches are evaluated for data integrity, confidentiality, and real‐time system issues. An appropriate approach for the B‐VANET system is recognized, giving the best throughput and latency in all possible scenarios. It is analyzed that compared to the worst approach, the best approach achieves an almost 15% increase in throughput and reduces latency by nearly half. We also compared the performance of B‐VANET and other approaches to show that our proposed system better meets VANET's security needs.

Analysis and Improvement of PUF-based Secure Anonymous User Authentication Scheme in Smart Home Environment

With the rapid development of IoT technology, smart home is attracting much attention due to its convenience and comfort. In 2022, CHO et al. proposed an anonymous user authentication scheme using PUFs in smart home environment. However, this paper conducts a security analysis and finds that CHO et al.'s scheme cannot resist tracking attacks, replay attacks and cannot reach session keys. In order to overcome the shortcomings of CHO et al.'s scheme, this paper proposes an improved PUF-based secure anonymous user authentication scheme. After security analysis and comparison with related authentication schemes in terms of security and computational cost, it is demonstrated that the improved scheme is resistant to a variety of attacks and can achieve secure and efficient authentication.

USER AUTHENTICATION USING EYE-BLINK PASSWORD

Personal identification numbers (PINS) are used to authenticate a user for security purpose. In order to authenticate himself the user should physically input the PIN, which might be susceptible to password cracking via shoulder surfing or thermal tracking. Authenticating a PIN with hands-off eye blinks PIN entry techniques, on the opposite hand, offers a safer password entry option by not leaving any physical footprints behind. User authentication using eye-blink password refers to finding the attention blinks in sequential image frames, and generation of PIN. This paper presents an application with three layer authentication system that are face detection, PIN entry by eye blink and OTP (One Time Password) to avoid thermal tracking attacks and shoulder surfing.

Scalable Lightweight Protocol for Interoperable Public Blockchain-Based Supply Chain Ownership Management

Scalability prevents public blockchains from being widely adopted for Internet of Things (IoT) applications such as supply chain management. Several existing solutions focus on increasing the transaction count, but none of them address scalability challenges introduced by resource-constrained IoT device integration with these blockchains, especially for the purpose of supply chain ownership management. Thus, this paper solves the issue by proposing a scalable public blockchain-based protocol for the interoperable ownership transfer of tagged goods, suitable for use with resource-constrained IoT devices such as widely used Radio Frequency Identification (RFID) tags. The use of a public blockchain is crucial for the proposed solution as it is essential to enable transparent ownership data transfer, guarantee data integrity, and provide on-chain data required for the protocol. A decentralized web application developed using the Ethereum blockchain and an InterPlanetary File System is used to prove the validity of the proposed lightweight protocol. A detailed security analysis is conducted to verify that the proposed lightweight protocol is secure from key disclosure, replay, man-in-the-middle, de-synchronization, and tracking attacks. The proposed scalable protocol is proven to support secure data transfer among resource-constrained RFID tags while being cost-effective at the same time.

A Novel Multifaceted Trust Management Framework for Vehicular Networks

Maintaining interconnectivity between dynamic vehicular nodes and ensuring trust in vehicular networking is still a challenging issue. It is crucial for the vehicular environments to maintain a stable interconnectivity between the vehicular nodes and further to prevent the vehicular nodes from broadcasting fake messages and simultaneously protect the vehicles against tracking attacks. An efficient Trust Management System (TMS) is proposed in this paper that will ensure trustworthiness and stable interconnectivity between vehicular entities to assure road safety and reliable communication. The proposed approach incorporates a novel timestamp mechanism and block chain concepts to ensure the steady inter-connectivity between the dynamic vehicular nodes. Further, the framework leverages block chain concepts to verify the correctness of the events stored in the Road Side Units (RSUs). It also proposes a versatile hybrid trust model that uses innovative direct and recommended trust evaluation techniques to compute trust between the vehicular entities. Moreover, the framework integrates a threading mechanism to schedule message execution in direct trust evaluation, and clustering techniques to group similar messages in indirect trust evaluation. Various experimental and comparative analyses with other related studies are carried out in a simulated environment to evaluate the performance of the proposed hybrid trust model. The findings show that the proposed trust model produces an accuracy of 92% in identifying malicious nodes.

Blockchain and PUF-Based Lightweight Authentication Protocol for Wireless Medical Sensor Networks

Due to the emergence of heterogeneous Internet of Medical Things (IoMT) (e.g., wearable health devices, smartwatch monitoring, and automated insulin delivery systems), large volumes of patient data are dispatched to central cloud servers for disease analysis and diagnosis. Although this direct mode brings a lot of convenience for both patients and medical professionals (MPs), the open communication channel between them also incurs several security and privacy issues, such as man-in-the-middle attacks, eavesdropping attacks, and tracking attacks. Based on the unsolved challenges in wireless medical sensor networks (WMSNs), several researchers have proposed various authentication and key agreement (AKA) protocols for this type of healthcare system recently. However, most of these protocols do not perceive physical-layer security and over-centralized server problem in WMSN. In this article, to address these two open problems, we propose a lightweight and reliable authentication protocol for WMSN, which is composed of cutting-edge blockchain technology and physically unclonable functions (PUFs). In addition, a fuzzy extractor scheme is introduced to deal with biometric information. Subsequently, two security evaluation methods are used to prove the high reliability of our proposed scheme. Finally, performance evaluation experiments illustrate that the proposed mutual authentication protocol requires the least computation and communication cost among the compared schemes.

Efficient and Privacy-Preserving Infection Control System for Covid-19-Like Pandemics Using Blockchain

Contact tracing is a very effective way to control the COVID-19-like pandemics. It aims to identify individuals who closely contacted an infected person during the incubation period of the virus and notify them to quarantine. However, the existing systems suffer from privacy, security, and efficiency issues. To address these limitations, in this article, we propose an efficient and privacy-preserving Blockchain-based infection control system. Instead of depending on a single authority to run the system, a group of health authorities, that form a consortium Blockchain, run our system. Using Blockchain technology not only secures our system against single point of failure and denial of service attacks, but also brings transparency because all transactions can be validated by different parties. Although contact tracing is important, it is not enough to effectively control an infection. Thus, unlike most of the existing systems that focus only on contact tracing, our system consists of three integrated subsystems, including contact tracing, public places access control, and safe-places recommendation. The access control subsystem prevents infected people from visiting public places to prevent spreading the virus, and the recommendation subsystem categorizes zones based on the infection level so that people can avoid visiting contaminated zones. Our analysis demonstrates that our system is secure and preserves the privacy of the users against identification, social graph disclosure, and tracking attacks, while thwarting false reporting (or panic) attacks. Moreover, our extensive performance evaluations demonstrate the scalability of our system (which is desirable in pandemics) due to its low communication, computation, and storage overheads.

An Opportunistic Power Control Scheme for Mitigating User Location Tracking Attacks in Cellular Networks

Cellular networks have been successfully evolved over the decades. Especially, Long-Term Evolution (LTE) has been exceedingly successful and the security threats against LTE systems have increased rapidly. Particularly, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">tracking</i> LTE user devices has been shown to be effective as the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">temporary</i> user identifiers (IDs) are easily extracted and used to locate targeted devices by passive eavesdroppers. We notice that naive approaches, such as frequent updates of temporary user IDs, are <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">insufficient</i> to mitigate user-tracking attacks since the new and old temporary IDs for the same user device are easily <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">linkable</i> by adversaries who can measure the wireless channel characteristics between the user device and herself. In this paper, we propose an opportunistic uplink power control scheme to minimize the probability of successful user tracking by an adversary whose location is unknown. We devise the notion of average inference error probability in order to measure the level of users’ location privacy. Moreover, we derive the closed-form expression of the approximated average inference error probability and formulate an optimization problem to maximize the average inference error probability under a constraint of an allowable power budget for each user. Against a passive adversary, our proposed power control scheme effectively degrades an adversary’s inference ability by 50% when 10 users are scheduled in each transmission time slot, which will lead to almost 100% inference error at the adversary over multiple time slots.

Improving the Privacy-Preserving of Covid-19 Bluetooth-Based Contact Tracing Applications Against Tracking Attacks

Bluetooth is an essential wireless standard for short-distance and low-power wireless networks. Health departments’ contact-tracing applications depended on Bluetooth technology to prevent infectious diseases from spreading, especially COVID-19. The security threats of the Bluetooth-based contact-tracing applications increased because an adversary can use them as surveillance tools that violate the user’s privacy and revealpersonal information. The Bluetooth standard mainly depends on the device address in its authenticated pairing mechanism (Secure Simple Pairing), which can collect with off-the-shelf hardware and software and leads to a tracking attack. To avoid the risk of tracking based on this security vulnerability in the Bluetooth protocol, we suggest a novel authentication protocol based on a noninteractive zero-knowledge scheme to substitute the authentication protocol used in the Bluetooth standard. The new protocol can replace the authentication protocol in the Bluetooth stack without any modification in the device pairing flow. Finally, we prove the security of our proposed scheme against the man-in-themiddle attack and tracking attack. A performance comparison with the authentication algorithm in the BLE standard shows that our method mitigates the tracking attack with low communication messages. Our results help enhance the contact-tracing application’s security in which Bluetooth access is available.

Tracking Based Mix-Zone Location Privacy Evaluation in VANET

Mix-Zone is one of the most effective real-time location privacy preserving techniques over road networks. By breaking the continuity of location exposure and changing pseudonyms, this strategy can effectively keep users from tracking attacks. Existing Mix-Zone evaluation mechanisms are mainly divided into two categories – Calculation and vehicle tracking. Calculation based evaluation methods like K-anonymity and Entropy are more suitable for qualitative analysis and comparison, but lacks accuracy and quantitative criteria, whereas existing tracking methods are too simple to accurately quantify the privacy of the Mix-Zone. Accordingly, it is urgent to bring up more accurate tracking methods to get a better view of the Mix-Zone's privacy. In this paper, we propose two categories of Mix-Zone tracking methods based on the basic BP and the customized artificial neural networks, where the former is used as verification and based on the result analysis of which we designed the latter, which greatly improves the tracking result, revealing the privacy preserving level of the Mix-Zone more reasonably.

Federated learning-based scheme for detecting passive mobile attackers in 5G vehicular edge computing

Detecting passive attacks is always considered difficult in vehicular networks. Passive attackers can eavesdrop on the wireless medium to collect beacons. These beacons can be exploited to track the positions of vehicles not only to violate their location privacy but also for criminal purposes. In this paper, we propose a novel federated learning-based scheme for detecting passive mobile attackers in 5G vehicular edge computing. We first identify a set of strategies that can be used by attackers to efficiently track vehicles without being visually detected. We then build an efficient machine learning (ML) model to detect tracking attacks based only on the receiving beacons. Our scheme enables federated learning (FL) at the edge to ensure collaborative learning while preserving the privacy of vehicles. Moreover, FL clients use a semi-supervised learning approach to ensure accurate self-labeling. Our experiments demonstrate the effectiveness of our proposed scheme to detect passive mobile attackers quickly and with high accuracy. Indeed, only 20 received beacons are required to achieve 95% accuracy. This accuracy can be achieved within 60 FL rounds using 5 FL clients in each FL round. The obtained results are also validated through simulations.

MUMAP: Modified Ultralightweight Mutual Authentication protocol for RFID enabled IoT networks

Flawed authentication protocols led to the need for a secured protocol for radio frequency identification (RFID) techniques. In this paper, an authentication protocol named Modified ultralightweight mutual authentication protocol (MUMAP) has been proposed and cryptanalysed by Juel-Weis challenge. The proposed protocol aimed to reduce memory requirements in the authentication process for low-cost RFID tags with limited resources. Lightweight operations like XOR and Left Rotation, are used to circumvent the flaws made in the other protocols. The proposed protocol has three-phase of authentication. Security analysis of the proposed protocol proves its resistivity against attacks like desynchronization, disclosure, tracking, and replay attack. On the other hand, performance analysis indicates that it is an effective protocol to use in low-cost RFID tags. Juel-Weis challenge verifies the proposed protocol where it shows insusceptibility against modular operations.

Signcryption-Based Security Framework for Low Computing Power Devices

Background: With technological advancements, the use of many kinds of computing devices has given birth to a new era of computing. RFID tags, smart cards, and wireless sensors are the low computing power devices, which are being used massively in sensitive applications. Therefore, securing these low computing environments has become a great concern. Proposed Work: In this paper, an elliptic curve signcryption based security framework for securing low computing power devices has been proposed which provides mutual authentication, confidentiality, non-repudiation, forward secrecy, integrity, availability, key privacy, and anonymity. In addition to this, the proposed security framework has the capability to resist replay attack, desynchronization attack, impersonation attack, key-compromise attack, location tracking attack, denial of service attack, and man-in-the-middle attack. Results: Results have revealed that the proposed framework is efficient in terms of computational time as compared to the other related schemes. Conclusion: The proposed protocol presented in this paper can be used as a building block in designing efficient security protocols for all kinds of low computing power devices including RFID, wireless sensors, and smart cards.

Preserving Privacy Location in 5G by Using Variable Pseudonym

User privacy is one of the most issues addressed extensively in mobile communications evolutions, research literature, and standardization. Location privacy is a key parameter and crucial aspect for user privacy, where most of the tracking, Unsolicited advertising, malicious activities, and location-based terrorism attacks are depending on the location of the victims. For preserving location privacy, various methods in previous mobile networks use a pseudonym instead of permanent identity i.e. Cell Radio Network Temporary Identifiers (C-RNTI), However, these methods based on C-RNII have been proofed that faces many vulnerable due to the clear text used for C-RNII exchange. A man-in-the-middle attack can easily trace users and collect information. The main objective of this paper is to propose a new location privacy algorithm that can greatly enhance the capabilities of the 5G architecture. The proposed algorithm introduces a novel variable pseudonym (V-RNTI) as an identifier for the user radio channel. Also, it provides an enhanced pseudonyms allocation procedure for identification. A new procedure that enabling UE to use different values for V-RNTI changed frequently using agreed equations to generate the values of the identifier. The proposed scheme is compatible with 3GPP standards architecture, where minor modifications/upgrades are needed for UEs eNB. Specifically, we build our model of the 5G V-RNTI authentication protocol and perform an automated security verification tool analysis of the protocol model by using the ProVerif model checker. Our analysis results show that the proposed procedure is working without flaws.

Delay‐aware privacy‐preserving location‐based services under spatiotemporal constraints

SummaryThe ubiquitous use of location‐based services (LBS) through smart devices produces massive amounts of location data. An attacker, with an access to such data, can reveal sensitive information about users. In this paper, we study location inference attacks based on the probability distribution of historical location data, travel time information between locations using knowledge of a map, and short and long‐term observation of privacy‐preserving queries. We show that existing privacy‐preserving approaches are vulnerable to such attacks. In this context, we propose a novel location privacy‐preserving approach, called KLAP, based on the three fundamental obfuscation requirements: minimum k‐locations, l‐diversity, and privacy area preservation. KLAP adopts a personalized privacy preference for sporadic, frequent, and continuous LBS use cases. Specifically, it generates a secure concealing region (CR) to obfuscate the user's location and directs that CR to the service provider. The main contribution of this work is twofold. First, a CR pruning technique is devised to establish a balance between privacy and delay in LBS usage. Second, a new attack model called a long‐term obfuscated location tracking attack, and its countermeasure is proposed and evaluated both theoretically and empirically. We assess KLAP with two real‐world datasets. Experimental results show that it can achieve better privacy, reduced delay, and lower communication costs than existing state‐of‐the‐art methods.