Hash Tree Research Articles

Efficient Anonymous Authentication Based on Physically Unclonable Function in Industrial Internet of Things

Owing to the open Industrial Internet of Things (IIoT) environment, information interacting between devices and servers is transmitted over the public channel, which may lead to privacy breach of the device identity. Furthermore, communication entities are not fully trusted, and they may maliciously disclose the device identity information. Therefore, the anonymity of devices must be guaranteed. In addition, IIoT is resource-constrained, and complex algorithms are unsuitable for the IIoT system. Several researchers have attempted to design anonymous authentication schemes. The one-authentication-multiple-access approach allows devices to access server resources multiple times after a single authentication, and its authentication overhead is independent of the number of accesses. This can reduce the computational burden for devices that need to access the server frequently. However, existing anonymous authentication schemes do not support multiple accesses after one authentication, and still suffer from privacy issues and low efficiency for devices that need frequent access to the server. To address these issues, we propose a new anonymous authentication scheme that uses group signature technology to ensure device anonymity and uses Merkle hash tree technology to achieve multiple accesses after one authentication, thereby greatly reducing the authentication overhead of IIoT devices. Then, we validate the security of the scheme using the random oracle model and the BAN logic. Finally, compared with other related schemes, the experimental results show that our proposed scheme is more efficient and practical for resource-constrained IIoTs than other schemes.

FAPMIC: Fake Packet and Selective Packet Drops Attacks Mitigation by Merkle Hash Tree in Intermittently Connected Networks

Delay/Disruption Tolerant Networks (DTNs) are a special category of IntermittentlyConnectedNetworks (ICNs). It has features such as long-delay, frequent-disruption, asymmetrical-data-rates, and high-bundle-error-rates. DTNs have been mainly developed for planet-to-planet networks, commonly known as Inter-Planetary-Networks (IPNs). However, DTNs have shown undimmed potency in challenged communication networks, such as DakNet, ZebraNet, KioskNet and WiderNet. Due to unique characteristics (Intermittent-connectivity and long-delay) DTNs face tough/several challenges in various research areas i.e bundle-forwarding, key-distribution, privacy, bundle-fragmentation, and malicious/selfish nodes particularly. Malicious/selfish nodes launch various catastrophic attacks, this includes, fake packet attacks, selective packet drops attacks, and denial-of-service/flood attacks. These attacks inevitably consume limited resources (persistent-buffer and bandwidth) in DTNs. Fake-packet and selective-packet-drops attacks are top among the challenging attacks in ICNs. The focus of this article is on critical analyses of fake-packet and selective-packet-drops attacks. The panoramic view on misbehavior nodes mitigation algorithms are analyzed, and evaluated mathematically through several parameters for detection probability/accuracy. This article presents a novel algorithm to detects/mitigates fake-packet and selective-packet-drops attacks. The proposed algorithm uses Merkle-Hash-Tree to detects the aforementioned attacks. The proposed algorithm added root hash along with all packets, when the malicious nodes drop packets or inject fake packets, the algorithm detects malicious nodes. Moreover, trace-driven simulation results show the proposed algorithm of this article accurately (enhanced detection-accuracy, enhanced packet delivery/packet loss ratios, and reduces false-positive/false-negative rates) detects malicious nodes which launch fake-packet and selective-packet-drops attacks, unlike previously proposed algorithms which detect only one attack (fake-packet or packet-drops at a time) or detect only malicious path (do not exactly detect malicious nodes which launch attacks). Furthermore, this article mathematically analyzed various scenarios to track exactly/position of various vehicular nodes.

Blockchain and Data Integrity Authentication Technique for Secure Cloud Environment

Nowadays, numerous applications are associated with cloud and user data gets collected globally and stored in cloud units. In addition to shared data storage, cloud computing technique offers multiple advantages for the user through different distribution designs like hybrid cloud, public cloud, community cloud and private cloud. Though cloud-based computing solutions are highly convenient to the users, it also brings a challenge i.e., security of the data shared. Hence, in current research paper, blockchain with data integrity authentication technique is developed for an efficient and secure operation with user authentication process. Blockchain technology is utilized in this study to enable efficient and secure operation which not only empowers cloud security but also avoids threats and attacks. Additionally, the data integrity authentication technique is also utilized to limit the unwanted access of data in cloud storage unit. The major objective of the projected technique is to empower data security and user authentication in cloud computing environment. To improve the proposed authentication process, cuckoo filter and Merkle Hash Tree (MHT) are utilized. The proposed methodology was validated using few performance metrics such as processing time, uploading time, downloading time, authentication time, consensus time, waiting time, initialization time, in addition to storage overhead. The proposed method was compared with conventional cloud security techniques and the outcomes establish the supremacy of the proposed method.

Data Integrity Audit Scheme Based on Quad Merkle Tree and Blockchain

Cloud storage is an essential method for data storage. Verifying the integrity of data in the cloud is critical for the client. Traditional cloud storage approaches rely on third-party auditors (TPAs) to accomplish auditing tasks. However, third-party auditors are often not trusted. To eliminate over-reliance on third-party auditors, this paper designs a blockchain-based auditing scheme that uses blockchain instead of third-party auditors to ensure the reliability of data auditing. Meanwhile, our scheme is based on the audit method of the quad Merkle hash tree, using the root of the quad Merkle hash tree to verify the integrity of data, which significantly improves computing and storage efficiency. Automated verification of auditing activities by deploying smart contracts on the blockchain allows us to have a more up-to-date picture of data integrity. The performance of the scheme is evaluated through security analysis and experiments, which prove that the proposed scheme is secure and effective.

Integrity of virtual testing for crash protection

The interest in virtual testing is globally rapidly increasing because of several advantages compared to physical tests in laboratories. In the area of passive car safety, finite element simulations can be used to get further insights, use more biofidelic human models and make the overall assessment more robust by incorporating more variety in the virtual testing load cases. For a successful implementation of virtual testing in regulations or consumer information, the integrity of the procedure has to be ensured. As car simulation models used within the virtual testing are usually not shared with the evaluation institutions due to intellectual property (IP) issues, this is a challenging task. Stringent validation and certification procedures are needed and it has to be ensured that the models used in these steps are the same as the ones used for the virtual testing. In this paper, we developed a secure procedure for model version control. Through analysis of possible threats for both sides, car manufacturer and evaluation institution, we defined requirements, which the new procedure should satisfy. These requirements state that the integrity and authenticity of all shared documents should be protected, as well as the confidentiality of the simulation model. By considering all prerequisites, we developed an architecture for a new procedure. This architecture uses cryptographic algorithms such as hash functions and digital signatures to ensure integrity and authenticity, as well as secure computation mechanisms such as Intel Software Guard Extensions (SGX). In our proof-of-concept implementation, we demonstrated how a secure wrapper around LS-DYNA can produce a signed report to authenticate the input model files based on a hash tree and link them to the simulation results. The evaluation institution can use a matching verification tool to verify that the models were not manipulated compared to other simulation runs or the qualification process. The developed procedure can be used for trustworthy implementation of virtual testing into consumer information or regulation for the assessment of car safety with strengthened integrity. Further research is needed to develop comparable procedures for other simulation software packages or ideally integrate it directly into the simulation software.

A multikey fully homomorphic encryption privacy protection protocol based on blockchain for edge computing system

SummaryIn order to protect private data in edge computing system and ensure that ciphertexts encrypted under different keys can be processed in the cloud, we propose a privacy protection protocol for edge computing, which is based on blockchain technology and multikey fully homomorphic encryption (MFHE). By constructing a Merkle hash tree and saving the Merkle root node to the blockchain, the integrity of the data in edge nodes is protected. For the data with high computational complexity in edge nodes, the GSW fully homomorphic encryption scheme is employed to process the encrypted private data of a single edge node by the CMS. The LinkAlgo algorithm is applied to link different keys by the relation between them, which enables the CMS to process the encrypted private data of multiple edge nodes. The security analysis and performance evaluation of the proposed privacy protection protocol show that our protocol has high security and good efficiency.

Verifiable Data Search with Fine-Grained Authorization in Edge Computing

In the research of searchable encryption, fine-grained data authorization is a convenient way to manage the search rights for users. Recently, Liu et al. proposed a fine-grained searchable scheme with verification, which can control the search authorization and verify the results. In this paper, we first present a forgery attack against Liu et al.’s scheme and then propose a novel scheme of verifiable data search with fine-grained authorization in edge environment. Based on the key aggregate mechanism and Merkle hash tree, our proposed scheme not only achieves file-oriented search permission management but also implements the correctness and completeness verification of search results. In addition, with the assistance of edge server, resource-constrained users can easily perform the tasks of search and verification. Finally, we prove our scheme is secure based on the decision l -bilinear Diffie–Hellman exponent problem. The performance analysis and experiment results demonstrate that our proposed scheme has lower computation, communication, and storage costs contrast to the existing schemes.

The Shortest Verification Path of the MHT Scheme for Verifying Distributed Data

One of the most common approaches for enhancing network performance is to retrieve data from nearby data holders that have previously obtained the desired data, not only from the original data source itself. In this case, since a data receiver cannot identify a practical data sender, it is necessary to verify both the received data and the data sender. Moreover, a data sender generally fragments the data into several small segments and sends them. Therefore, if these segments are retrieved from multiple unknown senders, the receiver must verify every segment to safely use the data. MHT (Merkle hash tree) is suitable for efficiently verifying the set of segments shared in the network. NDN (named-data networking) and Bitcoin utilize MHT to verify transmitted data. However, a data authentication scheme based on the MHT has an inefficient factor that repeatedly computes the same node values of the MHT and are repeatedly computed. The larger the size of the MHT is, the greater the number of calculation iterations. Therefore, as a result, the authentication scheme’s inefficiency is also more severe. When a sender transmits data consisting of many segments through NDN, the data authentication time may take longer than the data transmission time. Hence, in this paper, the degree of the MHT’s inefficiency and the pattern of the iterated operation of the MHT are analyzed first. The proposed improvement is to find repeatedly used node values, store them internally, and use the stored node values without recalculation when required to reuse them. For that process, a rule to select such node values is given. Additionally, when verifying the leaf node value of the MHT, the MHT-based authentication scheme asks a verifier to compute all node values on the path from the leaf node to the root node of the MHT. This paper demonstrates the proposed shortest path selection for verifying the leaf node value. The proposed scheme, using saved node values and the shortest path, reduces the computational overhead of the MHT and improves service latency. It has been proven from performance evaluations that the proposed scheme decreases the computational overhead by more than one-third if the number of segments is more than 1024.

Identity Access Management via ECC Stateless Derived Key Based Hierarchical Blockchain for the Industrial Internet of Things

Recently, the adoption of the industrial Internet of things (IIoT) has optimized many industrial sectors and promoted industry “smartization.” Smart factories and smart industries connect the real and virtual worlds through cyber-physical systems (CPS). However, these linkages will increase the cyber security danger surface to new levels, putting millions of dollars' worth of assets at risk if communications in big network systems like IIoT settings are left unsecured. To solve these problems, the fundamental method is security, such as authentication and confidentiality, and it should require the encryption key. However, it is challenging the security performance with the limited performance of the sensor. Blockchain-based identity management is emerging for lightweight, integrity and persistence. However, the key generation and management issues of blockchain face the same security performance issues. First, through blockchain smart contracts and hierarchical deterministic (HD) wallets, hierarchical key derivation efficiently distributes and manages keys by line and group in the IIoT environment. Second, the pairing verification value based on an elliptic curve single point called Root Signature performs efficient public key certificate registration and verification and improves the key storage space. Third, the identity log recorded through the blockchain is the global transparency of the key lifecycle, providing system reliability from various security attacks. Keyless Signature Infrastructure (KSI) is adopted to perform efficiently via hash-based scheme (hash calendar, hash tree etc.). We analyze our framework compared to hash-based state commitment methods. Accordingly, our method achieves a calculation efficiency of O(nlog N) and a storage space saving of 60% compared to the existing schemes.

Blockchain Security Using Merkle Hash Zero Correlation Distinguisher for the IoT in Smart Cities

Internet of Things (IoT) data is one of the most important assets in business models for offering various ubiquitous and brilliant services. The IoT is provided with the advantage of susceptibility that cybercriminals and other malicious users. Even though smart cities are intended to extend productivity and efficiency, residents and authorities face risks when they avoid cybersecurity. The conventional blockchain methods were introduced to ensure the secure management and examination of the smart city big data. But, the blockchains are found to have computationally high costs, and failed to improve the security, not adequate resource-constrained IoT devices have been designated for smart cities. In order to address these issues, the proposed novel blockchain model called blockchain secured Merkle hash zero correlation distinguisher (BSMH-ZCD) is suitable for IoT devices within the cloud infrastructure. The objective of the BSMH-ZCD method is to enhance security and reduce the run time and computational overhead. Initially, the Merkle hash tree is used to create the hash value with every transaction. Next, the zero correlation distinguisher is applied to perform the data encryption and decryption operation for the ARX block for obtaining proficient secure data access in the IoT devices. Experimental assessment of the proposed BSMH-ZCD method and existing methods are carried out by using the taxi driver data set and Novel Corona Virus 2019 data set with different factors, such as running time, computational complexity, and security with respect to a number of blocks and executions. By using the taxi driver data set, the experimental results reveal that the BSMH-ZCD method performs better with a 19% improvement in security, 20% reduction of computational complexity, and 29% faster running time for IoT compared to existing works.

XAuth: Efficient Privacy-Preserving Cross-Domain Authentication

It is well known that each Public Key Infrastructure (PKI) system forms a closed security domain and only recognizes certificates in its own domain (such as medical systems, financial systems, and 5G networks). When users need to access services in other domains, their identities often cannot be recognized or PKI systems require extremely complex operations to authenticate the users’ identities. This is the cross-domain authentication problem. The distributed consensus feature of blockchain provides a technical approach to solve this problem. However, there are some unresolved problems in existing blockchain-based schemes. On one hand, due to the low throughput of blockchain systems, the response speed may be insufferable when the number of cross-domain authentication requirements becomes enormous. On the other hand, these schemes insufficiently consider the privacy risk in the cross-domain scenario. In this article, we propose an efficient privacy-preserving cross-domain authentication scheme called XAuth that is integrated naturally with the existing PKI and Certificate Transparency (CT) systems. Specifically, we design a lightweight correctness verification protocol based on Multiple Merkle Hash Tree for rapid response. To protect users’ privacy, we present an anonymous authentication protocol for cross-domain authentication. The security analysis and experimental results demonstrate that XAuth is secure and efficient.

Metered Boot: Trusted Framework for Application Usage Rights Management in Virtualized Ecosystems

The adoption of virtualization and cloud computing technologies have revolutionized how services and applications can be developed, deployed, and operated to achieve better elasticity, flexibility, and scalability. Multiple stakeholders can be involved for providing online services; each of them plays one or more roles (i.e., service operator, application vendor, and infrastructure provider) to create a customized operating model based on the business requirements. The operating model changes from one business to another, and it may even change at different stages of the same business. A trusted relationship among stakeholders for secure information exchange is the key to enable such flexibility. However, traditional usage compliance methods (e.g., in-person audit, dynamic licensing, and subscription) lack explicit trust among involved parties and the flexibility and scalability to support dynamic sizing of services and applications with low overhead. In this work, we argue the need for a new trust framework to manage application usage rights and propose Metered Boot to provide trusted, capacity/usage-based usage rights management for services and applications deployed in virtualized environments. Metered Boot decouples application workload instantiation for service operators, usage rights governance for application vendors, and resource provisioning for infrastructure providers. We leverage cryptoprocessors (e.g., Trusted Platform Module (TPM)) on commodity servers to generate trusted proofs which are managed by efficient cryptographic construction, Merkle hash tree, for usage rights compliance. We integrated our framework with OpenStack and demonstrate that Metered Boot is able to achieve high scalability and low overhead for instantiating virtual network functions (VNFs).

CREASE: Certificateless and REused-pseudonym based Authentication Scheme for Enabling security and privacy in VANETs

Due to the customers’ growing interest in using various intelligent and connected devices, we are surrounded by the Internet of Things (IoT). It is estimated that the number of IoT devices will exceed 60 billion by 2025. One of the primary reasons for such rapid growth is the Internet of Vehicles (IoV). Internet of Vehicles (IoV) has evolved into an emerging concept in intelligent transportation systems (ITS) that integrates VANETs and the IoT to enhance their capabilities. With the emergence of IoV and the interest shown by customers, Vehicular Ad hoc NETworks (VANETs) are likely to be widely deployed in the near future. However, for this to happen, wide participation of vehicle owners in VANET is needed. The primary concerns of vehicle owners to participate in VANET are privacy and security. In this paper, we present a Certificateless and REused-pseudonym based Authentication Scheme for Enabling security and privacy (CREASE) in VANETs. One of the ways to preserve the privacy of vehicles/drivers is to allow vehicles/drivers to use pseudo identities (pseudonyms) instead of their real identities (such as VIN number or driving license number) in all communications. The pseudonym used by a vehicle needs to be changed frequently to prevent the vehicle from being tracked. Our scheme uses Merkle Hash Tree and Modified Merkle Patricia Trie to efficiently store and manage the pseudonyms assigned to a vehicle. This enables a vehicle to pick and use a random pseudonym from a given set of pseudonyms assigned to it as well as change its pseudonym frequently and securely to ensure privacy. Unlike many of the existing schemes, our scheme does not use certificates and certificate revocation lists for authentication. Moreover, it allows vehicles to get a set of pseudonyms only once from the trusted authority. We present a formal proof of correctness of our scheme and also compare our scheme with some of the other contemporary schemes to show the effectiveness of our scheme.

An efficient enhanced prefix hash tree model for optimizing the storage and image deduplication in cloud

SummaryThe popularity of the cloud storage space mainly attracted organizations to store their data in them. Therefore, the avoidance of duplicate data contents is unavoidable and several users share the cloud storage space for data storage, and sometimes this makes higher storage space utilization. Because of the extremely high duplicate copy, memory wastage arises in the case of multimedia data. Identifying the final duplicate copies in the cloud takes more time. To overcome this problem, we employ a significant storage optimization model for deduplication. The digital data hash value is stored by requiring an additional memory space. This study proposed an enhanced prefix hash tree (EPHT) method to optimize the image and text deduplication system to reduce the overhead caused by this procedure. The efficiency of the proposed approach is compared with the interpolation search technique using different levels of tree height (2, 4, 2, 8, 16) in terms of space and time complexity. The proposed EPHT technique shows improvements in terms of speed and space complexity when the number of levels in the EPHT increases.

Collecting Digital Data with the Assurance of Integrity.

It is very common today that systems collect and store sensitive information. The database administrators of these types of systems have access to this sensitive information and can manipulate it. Therefore, data integrity is of core importance in these systems, and methods to detect fraudulent behavior need to be implemented. The objective of this article is to evaluate the features and performance impact of different methods for achieving and implementing data integrity in a database during data collection to improve assurance. Five methods for achieving data integrity were tested. The methods were tested in a controlled environment. This paper evaluates traditional Digital signature, Linked timestamping applied to a Merkle hash tree, and Auditing performance impact and feature impact wise. Two more methods were implemented and tested in a controlled environment, Merkle hash tree and Digital watermarking. In the evaluation, the researcher proved that traditional Digital signature is faster than Linked timestamping. In this study, it was concluded that when choosing a data integrity method to implement, it is of great importance to know which type of operation is more frequently used. The experiments show that the Digital signature method performed better than Linked timestamping and Auditing. Keyword: Data Collection, Integrity, Assurance, Security, Cyber space, cybercrimes,

Dynamic Deduplication Algorithm for Cross-User Duplicate Data in Hybrid Cloud Storage

The escalating growth of distributed big data in hybrid cloud storage architecture introduces a new set of challenges. Constantly, content enrichment puts pressure on capacity. Nonetheless, the explosion of user data places a significant strain on broadband and storage capacity. Consequently, many cloud storage providers will implement deduplication to compress data, reduce transfer bandwidth, and reduce cloud storage space. In cloud storage systems, it is a data compression and storage optimization method. By locating and removing redundant data, it can save storage space and bandwidth. An MTHDedup deduplication strategy based on the Merkle hash tree is presented in a hybrid cloud environment to address the issue of convergent encryption algorithms being susceptible to brute-force attacks and ciphertext computation time overhead. Merkle hash trees are constructed using additional encryption algorithms to generate encryption keys during file- and block-level deduplication, ensuring that generated ciphertexts are unpredictable. The method is effective against both internal and external brute-force attacks, thereby increasing data security. Our method reduces the computational burden of ciphertext generation and the key storage space, and the performance advantage increases with the number of privilege sets.

Energy-Efficient and Secure Communication Toward UAV Networks

Wireless networks ensure the unmanned aerial vehicles (UAVs) communicate and cooperate with each other, which plays an indispensable role among UAVs. The two crucial challenges in UAV wireless networks are energy saving and security. The current lightweight communication approaches lead to insufficient robustness of the encrypted transmission that is insecure. To address this issue, we propose a secure transmission approach with energy efficiency toward UAVs networks. We design a lightweight symmetric encryption algorithm based on SM4 and the relevant key negotiation and update mechanism to protect the confidentiality of communication contents. Moreover, a modified aggregative BLS signature scheme, together with the Merkle Hash tree (MHT), is introduced to guarantee the integrity and authenticity of data packets in transmission. Furthermore, we propose an online/offline revocable identity-based group signature (OORIBGS) scheme and integrate it into our framework for UAV anonymity, traceability, as well as revocability with small key management cost and high efficiency. We give detailed security analysis and prove that our proposal has the properties of data confidentiality, integrity, and authenticity, as well as identity traceability and anonymity. Moreover, we apply our approach in the UAVs networks and evaluate the runtime and anti-attack performance. The experimental results show that the proposed method can be effectively used in UAVs secure communication.

Integrity Auditing for Multi-Copy in Cloud Storage Based on Red-Black Tree

With the rapid development of cloud storage, cloud users are willing to store data in the cloud storage system, and at the same time, the requirements for the security, integrity, and availability of data storage are getting higher and higher. Although many cloud audit schemes have been proposed, the data storage overhead is too large and the data cannot be dynamically updated efficiently when most of the schemes are in use. In order to solve these problems, a cloud audit scheme for multi-copy dynamic data integrity based on red-black tree full nodes is proposed. This scheme uses ID-based key authentication, and improves the classic Merkel hash tree MHT to achieve multi-copy storage and dynamic data manipulation, which improves the efficiency of real-time dynamic data update (insertion, deletion, modification). The third-party audit organization replaces users to verify the integrity of data stored on remote cloud servers, which reduces the computing overhead and system communication overhead. The security analysis proves that the security model based on the CDH problem and the DL problem is safe. Judging from the results of the simulation experiment, the scheme is safe and efficient.

Authenticity Verification for Dynamic Social Data Outsourcing

As with the maturation and diversification of social services, social data outsourcing has become pervasive. In this context, online social networks outsource their real-time social data to a social data provider, who responses to query requests issued from data consumers. However, dishonest or malicious social data providers might tamper with collected social data by adding fake data and deleting/modifying raw data, and further return inauthentic query results to data consumers. In this article, we make the first attempt to study the problem of authenticity verification for dynamic social data. To this end, we first propose a novel authenticity verification framework, and then, propose a self-balancing hash tree scheme to tackle challenges brought on by the vast scale and dynamics of social data. To maximize the search efficiency for the self-balancing hash tree, we introduce a balance factor to define an unbalanced node as its balance factor is not chosen from a predetermined set. Furthermore, we propose three algorithms to balance unbalanced nodes in the self-balancing hash tree. Rigorous theoretical analyses prove that our framework can determinately detect any fake query results returned by data consumers. Experimental results built on a real Twitter dataset show that our scheme is efficient and effective.

Provable Cloud Data Transfer with Efficient Integrity Auditing for Cloud Computing

Due to the promising market prospects, more and more enterprises invest cloud storage and offer on-demand data storage services, which are characterized by distinct quality; thus, users would dynamically change the cloud service providers and transfer their outsourced data. However, the original cloud server might not honestly transfer the outsourced data for saving overhead, and the outsourced data might be polluted during the transfer process. Therefore, how to achieve secure outsourced data transfer has become a primary concern of users. To solve this issue, we put forward a solution for the issue of provable cloud data transfer, which can also simultaneously realize efficient data integrity auditing. By taking the advantages of Merkle sum hash tree (MSHT), our presented scheme can satisfy verifiability without dependency on a third party auditor (TPA). Meanwhile, the formal security proof can demonstrate that our presented scheme meets all of the expected security requirements. Finally, we implement our presented scheme and offer the precise performance evaluation, which can intuitively show the high-efficiency and practicality of our presented scheme in the real-world applications.