Adversary Models for Mobile Device Authentication

Mobile device authentication has been a highly active research topic for over 10 years, with a vast range of methods proposed and analyzed. In related areas, such as secure channel protocols, remote authentication, or desktop user authentication, strong, systematic, and increasingly formal threat models have been established and are used to qualitatively compare different methods. However, the analysis of mobile device authentication is often based on weak adversary models, suggesting overly optimistic results on their respective security. In this article, we introduce a new classification of adversaries to better analyze and compare mobile device authentication methods. We apply this classification to a systematic literature survey. The survey shows that security is still an afterthought and that most proposed protocols lack a comprehensive security analysis. The proposed classification of adversaries provides a strong and practical adversary model that offers a comparable and transparent classification of security properties in mobile device authentication.

A Modular End-to-End Framework for Secure Firmware Updates on Embedded Systems

Firmware refers to device read-only resident code which includes microcode and macro-instruction-level routines. For Internet-of-Things (IoT) devices without an operating system, firmware includes all the necessary instructions on how such embedded systems operate and communicate. Thus, firmware updates are essential parts of device functionality. They provide the ability to patch vulnerabilities, address operational issues, and improve device reliability and performance during the lifetime of the system. This process, however, is often exploited by attackers in order to inject malicious firmware code into the embedded device. In this article, we present a framework for secure firmware updates on embedded systems. This approach is based on hardware primitives and cryptographic modules, and it can be deployed in environments where communication channels might be insecure. The implementation of the framework is flexible, as it can be adapted in regards to the IoT device’s available hardware resources and constraints. Our security analysis shows that our framework is resilient to a variety of attack vectors. The experimental setup demonstrates the feasibility of the approach. By implementing a variety of test cases on FPGA, we demonstrate the adaptability and performance of the framework. Experiments indicate that the update procedure for a 1183-kB firmware image could be achieved, in a secure manner, under 1.73 seconds.

PUF based Secure and Lightweight Authentication and Key-Sharing Scheme for Wireless Sensor Network

The deployment of wireless sensor networks (WSN) in an untended environment and the openness of the wireless channel bring various security threats to WSN. The resource limitations of the sensor nodes make the conventional security systems less attractive for WSN. Moreover, conventional cryptography alone cannot ensure the desired security against the physical attacks on sensor nodes. Physically unclonable function (PUF) is an emerging hardware security primitive that provides low-cost hardware security exploiting the unique inherent randomness of a device. In this article, we have proposed an authentication and key sharing scheme for the WSN integrating Pedersen’s verifiable secret sharing (Pedersen’s VSS) and Shamir’s secret sharing (Shamir’s SS) scheme with PUF which ensure the desired security with low overhead. The security analysis depicts the resilience of the proposed scheme against different active, passive and physical attacks. Also, the performance analysis shows that the proposed scheme possesses low computation, communication and storage overhead. The scheme only needs to store a polynomial number of PUF challenge-response pairs to the user node. The sink or senor nodes do not require storing any secret key. Finally, the comparison with the previous protocols establishes the dominance of the proposed scheme to use in WSN.

An Efficient Certificate-Based Aggregate Signature Scheme for Internet of Drones

Internet of drones (IoD) is a network of small drones that leverages IoT infrastructure to deliver real-time data communication services to users. On the one hand, IoD is an excellent choice for a number of military and civilian applications owing to key characteristics like agility, low cost, and ease of deployment; on the other hand, small drones are rarely designed with security and privacy concerns in mind. Intruders can exploit this vulnerability to compromise the security and privacy of IoD networks and harm the information exchange operation. An aggregate signature scheme is the best solution for resolving security and privacy concerns since multiple drones are connected in IoD networks to gather data from a certain zone. However, most aggregate signature schemes proposed in the past for this purpose are either identity-based or relied on certificateless cryptographic methods. Using these methods, a central authority known as a trusted authority (TA) is responsible for generating and distributing secret keys of every user. However, the key escrow problem is formulated as knowing the secret key generated by the TA. These methods are hampered by key distribution issues, which restrict their applicability in a variety of situations. To address these concerns, this paper presents a certificate-based aggregate signature (CBS-AS) scheme based on hyperelliptic curve cryptography (HECC). The proposed scheme has been shown to be both efficient in terms of computation cost and unforgeable while testing its toughness through formal security analysis.

An Authentication and Secure Communication Scheme for In-Vehicle Networks Based on SOME/IP

The rapid development of intelligent networked vehicles (ICVs) has brought many positive effects. Unfortunately, connecting to the outside exposes ICVs to security threats. Using secure protocols is an important approach to protect ICVs from hacker attacks and has become a hot research area for vehicle security. However, most of the previous studies were carried out on V2X networks, while those on in-vehicle networks (IVNs) did not involve Ethernet. To this end, oriented to the new IVNs based on Ethernet, we designed an efficient secure scheme, including an authentication scheme using the Scalable Service-Oriented Middleware over IP (SOME/IP) protocol and a secure communication scheme modifying the payload field of the original SOME/IP data frame. The security analysis shows that the designed authentication scheme can provide mutual identity authentication for communicating parties and ensure the confidentiality of the issued temporary session key; the designed authentication and secure communication scheme can resist the common malicious attacks conjointly. The performance experiments based on embedded devices show that the additional overhead introduced by the secure scheme is very limited. The secure scheme proposed in this article can promote the popularization of the SOME/IP protocol in IVNs and contribute to the secure communication of IVNs.

A Verifiable Arbitrated Quantum Signature Scheme Based on Controlled Quantum Teleportation

In this paper, we present a verifiable arbitrated quantum signature scheme based on controlled quantum teleportation. The five-qubit entangled state functions as a quantum channel. The proposed scheme uses mutually unbiased bases particles as decoy particles and performs unitary operations on these decoy particles, applying the functional values of symmetric bivariate polynomial. As such, eavesdropping detection and identity authentication can both be executed. The security analysis shows that our scheme can neither be disavowed by the signatory nor denied by the verifier, and it cannot be forged by any malicious attacker.

A trusted de-swinging k-anonymity scheme for location privacy protection

K-anonymity has been gaining widespread attention as one of the most widely used technologies to protect location privacy. Nevertheless, there are still some threats such as behavior deception and service swing, since utilizing distributed k-anonymity technology to construct an anonymous domain. More specifically, the coordinate of the honest node will be a leak if the malicious nodes submit wrong locations coordinate to take part in the domain construction process. Worse still, owing to service swing, the attacker increases the reputation illegally to deceive honest nodes again. To overcome those drawbacks, we propose a trusted de-swinging k-anonymity scheme for location privacy protection. Primarily, we introduce a de-swinging reputation evaluation method (DREM), which designs a penalty factor to curb swinging behavior. This method calculates the reputation from entity honesty degree, location information entropy, and service swing degree. Besides, based on our proposed DREM, a credible cloaking area is constructed to protect the location privacy of the requester. In the area, nodes can choose some nodes with a high reputation for completing the construction process of the anonymous domain. Finally, we design reputation contracts to calculate credit automatically based on smart contracts. The security analysis and simulation results indicate that our proposed scheme effectively resists malicious attacks, curbs the service swing, and encourages nodes to participate honestly in the construction of cloaking areas.

SVBE: searchable and verifiable blockchain-based electronic medical records system

Central management of electronic medical systems faces a major challenge because it requires trust in a single entity that cannot effectively protect files from unauthorized access or attacks. This challenge makes it difficult to provide some services in central electronic medical systems, such as file search and verification, although they are needed. This gap motivated us to develop a system based on blockchain that has several characteristics: decentralization, security, anonymity, immutability, and tamper-proof. The proposed system provides several services: storage, verification, and search. The system consists of a smart contract that connects to a decentralized user application through which users can transact with the system. In addition, the system uses an interplanetary file system (IPFS) and cloud computing to store patients’ data and files. Experimental results and system security analysis show that the system performs search and verification tasks securely and quickly through the network.

The security analysis of the BB84 protocol in the case of Calderbank–Shor–Steane code leakage

Quantum key distribution (QKD) allows authenticated parties to share secure keys. Its security comes from quantum physics rather than computational complexity. The previous work has been able to demonstrate the security of the BB84 protocol based on the uncertainty principle, entanglement purification and information theory. In the security proof method based on entanglement purification, it is assumed that the information of Calderbank–Shor–Steane (CSS) error correction code cannot be leaked, otherwise, it is insecure. However, there is no quantitative analysis of the relationship between the parameter of CSS code and the amount of information leaked. In the attack and defense strategy of the actual quantum key distribution system, especially in the application of the device that is easy to lose or out of control, it is necessary to assess the impact of the parameter leakage. In this paper, we derive the relationship between the leaked parameter of CSS code and the amount of the final key leakage based on the BB84 protocol. Based on this formula, we simulated the impact of different CSS code parameter leaks on the final key amount. Through the analysis of simulation results, the security of the BB84 protocol is inversely proportional to the value of [Formula: see text] and [Formula: see text] in the case of the CSS code leak.

Lightweight and Anonymous Mutual Authentication Protocol for Edge IoT Nodes with Physical Unclonable Function

Internet of Things (IoT) has been widely used in many fields, bringing great convenience to people’s traditional work and life. IoT generates tremendous amounts of data at the edge of network. However, the security of data transmission is facing severe challenges. In particular, edge IoT nodes cannot run complex encryption operations due to their limited computing and storage resources. Therefore, edge IoT nodes are more susceptible to various security attacks. To this end, a lightweight mutual authentication and key agreement protocol is proposed to achieve the security of IoT nodes’ communication. The protocol uses the reverse fuzzy extractor to acclimatize to the noisy environment and introduces the supplementary subprotocol to enhance resistance to the desynchronization attack. It uses only lightweight cryptographic operations, such as hash function, XORs, and PUF. It only stores one pseudo-identity. The protocol is proven to be secure by rigid security analysis based on improved BAN logic. Performance analysis shows the proposed protocol has more comprehensive functions and incurs lower computation and communication cost when compared with similar protocols.