A lightweight conditional privacy-preserving authentication and access control scheme for pervasive computing environments

Vehicular ad hoc networks (VANETs) play an ever-increasing important role in improving traffic management and enhancing driving safety. However, vehicular communication using a wireless channel faces security and privacy challenges. The conditional privacy-preserving authentication (CPPA) scheme is suitable for solving the above challenges, but the existing identity-based CPPA schemes suffer from inborn key escrow issues. Motivated by this, we propose a lightweight CPPA scheme based on elliptic curve cryptography to solve the above issues, in which the pseudonym and public/private key pair of the vehicle is generated by itself, so that the proposed scheme avoids the key escrow issue. Furthermore, to achieve efficient vehicular communication, a CPPA scheme is proposed using a fog computing model that supports mobility, low latency, and location awareness. The pseudonym of the vehicle is generated by two hash chains in the proposed scheme, so that the storage overhead can be reduced efficiently under the condition that backward security is guaranteed. Security analysis shows that the scheme is secure under the random oracle and satisfies the security requirements of VANETs. Performance evaluation demonstrates that the proposed scheme outperforms related schemes in terms of computational and communication overhead.

HCPA-GKA: A hash function-based conditional privacy-preserving authentication and group-key agreement scheme for VANETs

With the advent of smart cities, the significance of the Internet of Things (IoT) is gaining greater prominence. At the same time, the safety early warning system in the IoT has a significant impact on real-time monitoring and the response to potential risks. Despite the advancements made in edge-assisted IoT deployments, several challenges and constraints persist. Given the potential threat to life posed by safety-related messages, ensuring the authenticity of messages in the edge-assisted IoT safety warning system is crucial. However, considering the identity privacy of devices participating in the edge-assisted Internet of Things system, directly verifying the identity of the sending device is undesirable. To address this issue, in this work, we design a linkable group signature scheme that allows devices to anonymously send safety-related messages to edge nodes, defending against Sybil attacks while ensuring the traceability of malicious device identities. Then, we present a high-efficiency conditional privacy-preserving authentication (CPPA) scheme based on the designed group signatures for the safety warning system in edge-assisted IoT. This scheme effectively protects device identity privacy while providing a reliable authentication mechanism to ensure the credibility and traceability of alert messages. The proposed scheme contributes to the field of safety warning systems in the context of edge-assisted IoT, providing a robust solution for privacy preservation and authentication.

Conditional privacy preserving authentication (CPPA) schemes preserve privacy of nodes and authenticate warning messages in vehicular ad hoc networks (VANETs). However, the existing key exchange processes are computationally expensive, which compel CPPAs to rely on temper proof devices with pre-installed keys. Moreover, transmission of messages occurs as plaintext, which provides an opportunity to adversaries to intercept and temper communication. Furthermore, CPPAs provide no means for dealing with blackhole attacks. In this paper, we present a novel light-weight encryption-enabled CPPA (LWE-CPPA) scheme that introduces encryption in warning messages. The scheme starts with the exchange of unique symmetric keys among nodes by using our proposed variant of Diffie-Hellman algorithm. After successful key exchange, the scheme uses our proposed VANETs specific novel lightweight encryption algorithm to yield a strong cipher for protection of messages from adversaries. An authentication process follows message encryption that makes our scheme robust. Furthermore, LWE-CPPA provides protection against blackhole attacks by employing a predefined threshold for warning messages acknowledgment. Simulation results demonstrate that LWE-CPPA provides improved security with reduced computational and communication overheads as compared to eminent CPPA schemes.

By regularly broadcasting information about the road and weather conditions around vehicles, a Vehicular Adhoc Network (VANET) is expected to improve traffic congestion and relieve traffic pressure. To guarantee the safe communication of vehicles, the security and privacy problems are urgent to be solved in VANETs. Until now, numerous conditional privacy-preserving authentication (CPPA) schemes have been proposed to solve these problems. However, cross-region authentication still not being taken seriously in CPPA scheme. Although several blockchain-based CPPA scheme have being proposed to realize cross-region authentication, there still exist some imperfection such as frequent interactions or unlinkability. Therefore, this paper proposes a novel blockchain-assisted authentication scheme to solve these existing issues. First, we adopt a puncturable pseudorandom function to complete identity authentication of vehicles. Second, a key derivation algorithm is used to achieve unlinkability of messages. Third, we achieve cross-region authentication by taking advantage of the properties of blockchain. The security analysis shows that the proposed scheme is suitable for VANETs.

An efficient identity-based signature scheme without bilinear pairing for vehicle-to-vehicle communication in VANETs

The potential for vehicular ad hoc networks (VANETs) in improving traffic, enhancing road safety and reducing traffic accidents has attracted attention from academia, industry, and governments. To ensure secure communication in VANETs, a number of authentication schemes, including those with batch verification, were proposed in recent years. However, studies have demonstrated that most of the existing schemes suffer from bad performance or weak security. To address those problems, we construct a new identity-based digital signature (IBDS) scheme using bilinear pairings. The IBDS scheme is then used to construct a new identity-based conditional privacy-preserving authentication (IBCPPA) scheme for VANETs without the need for a map-to-point hash function or double secret keys. Using simulations, we demonstrate that our provably-secure IBCPPA scheme not only achieves better performance than related schemes, but also overcomes the inefficiency problem of the double secret keys in related schemes (i.e., the system does have to manage two secret keys to provide security).

The potential for vehicular ad hoc networks (VANETs) in improving traffic, enhancing road safety and reducing traffic accidents has attracted attention from academia, industry, and governments. To ensure secure communication in VANETs, a number of authentication schemes, including those with batch verification, were proposed in recent years. However, studies have demonstrated that most of the existing schemes suffer from bad performance or weak security. To address those problems, we construct a new identity-based digital signature (IBDS) scheme using bilinear pairings. The IBDS scheme is then used to construct a new identity-based conditional privacy-preserving authentication (IBCPPA) scheme for VANETs without the need for a map-to-point hash function or double secret keys. Using simulations, we demonstrate that our provably-secure IBCPPA scheme not only achieves better performance than related schemes, but also overcomes the inefficiency problem of the double secret keys in related schemes (i.e., the system does have to manage two secret keys to provide security).

A secure light weight scheme for user authentication and key agreement in multi-gateway based wireless sensor networks

SUMMARYWith the use of smart card in user authentication mechanisms, the concept of two‐factor authentication came into existence. This was a forward move towards more secure and reliable user authentication systems. It elevated the security level by requiring a user to possess something in addition to know something. In 2010, Sood et al. and Song independently examined a smart‐card‐based authentication scheme proposed by Xu et al. They showed that in the scheme of Xu et al., an internal user of the system can turn hostile to impersonate other users of the system. Both of them also proposed schemes to improve the scheme of Xu et al. Recently, Chen et al. identified some security problems in the improved schemes proposed by Sood et al. and Song. To fix these problems, Chen et al. presented another scheme, which they claimed to provide mutual authentication and withstand lost smart card attack. Undoubtedly, in their scheme, a user can also verify the legitimacy of server, but we find that the scheme fails to resist impersonation attacks and privileged insider attack. We also show that the scheme does not provide important features such as user anonymity, confidentiality to air messages, and revocation of lost/stolen smart card. Besides, the scheme defies the very purpose of two‐factor security. Furthermore, an attacker can guess a user's password from his or her lost/stolen smart card. To meet these challenges, we propose a user authentication method with user anonymity. We show through analysis and comparison that the proposed scheme exhibits enhanced efficiency in contrast to related schemes, including the scheme of Chen et al. Copyright © 2013 John Wiley & Sons, Ltd.

As the technology of mobile devices spreads fast, the price of mobile devices is getting cheaper. Most of the people have mobile devices, and these devices have the technology of near field communication (NFC). With the long time development and research, the mobile devices use NFC technology on the payment and authentication applications, and replace the smartcard, the access control card, and the credit card by using the card emulation mode. It helps the development of NFC applications. In recent years, more and more users begin using NFC technology on mobile payment and authentication. Many researches have proposed the related NFC authentication protocols, but their schemes are still lack of some security properties and functions, which are necessary for NFC authentication protocols. In this paper, we propose a secure and efficient NFC authentication scheme between two NFC devices by the help of the authentication server that provides mutual authentication.

With the rapid development of micro-electronics and Information and Communication Technology (ICT), users can utilize various service such as Internet of Things(IoT), smart-healthcare and smart-home using wearable devices. However, the sensitive information of user are revealed by attackers because the medical services are provided through open channel. Therefore, secure mutual authentication and key establishment are essential to provide secure services for legitimate users in Wireless Body Area Networks(WBAN). In 2019, Gupta et al. proposed a lightweight anonymous user authentication and key establishment scheme for wearable devices. We demonstrate that their scheme cannot withstand user impersonation, session key disclosure and wearable device stolen attacks. We also propose a secure and lightweight mutual authentication and key establishment scheme using wearable devices to resolve the security shortcomings of Gupta et al.'s scheme. The proposed scheme can be suitable to resource-limited environments.

Industry 4.0 allows faster data accessibility, improved performance, fault identification, and remote control of machines within any smart factory. Due to the massive generation of delay-sensitive data, this system demands a robust security mechanism against security threats. In order to mitigate such potential attacks and provide security-free services, this article proposes an edge-based conditional privacy-preserving authentication scheme based on quantum key distribution protocol for secure authentication and secure communication within smart grid infrastructure. Apart from guaranteeing security against threats such as node impersonation, message tampering, and repudiation, the scheme also defends man-in-the-middle attacks, replay attacks, etc. We validate the proposed protocol through a simulation study. The result indicates that it performs reasonably well and enables unconditional security for the data exchanged between entities of smart grid infrastructure.

Providing a mechanism to authenticate users in healthcare applications is an essential security requirement to prevent both external and internal attackers from penetrating patients’ identities and revealing their health data. Many schemes have been developed to provide authentication mechanisms to ensure that only legitimate users are authorised to connect, but these schemes still suffer from vulnerable security. Various attacks expose patients’ data for malicious tampering or destruction. Transferring health-related data and information between users and the health centre makes them exposed to penetration by adversaries as they may move through an insecure channel. In addition, previous mechanisms have suffered from the poor protection of users’ authentication information. To ensure the protection of patients’ information and data, we propose a scheme that authenticates users based on the information of both the device and the legitimate user. In this paper, we propose a Robust Authentication Model for Healthcare Users (RAMHU) that provides mutual authentication between the server and clients. This model utilizes an Elliptic Curve Integrated Encryption Scheme (ECIES) and PHOTON to achieve strong security and good overall performance. RAMHU relies on multiple-pseudonym, physical address, and one-time password mechanisms to authenticate legitimate users. Moreover, extensive informal and formal security analysis with the automated validation of Internet security protocols and applications (AVISPA) tool demonstrate that our model offers a high level of security in repelling a wide variety of possible attacks.

The challenge for user authentication in a global file system is allowing people to grant access to specific users and groups in remote administrative domains, without assuming any kind of pre-existing administrative relationship. The traditional approach to user authentication across administrative domains is for users to prove their identities through a chain of certificates. Certificates allow for general forms of delegation, but they often require more infrastructure than is necessary to support a network file system.This paper introduces an approach without certificates. Local authentication servers pre-fetch and cache remote user and group definitions from remote authentication servers. During a file access, an authentication server can establish identities for users based just on local information. This approach is particularly well-suited to file systems, and it provides a simple and intuitive interface that is similar to those found in local access control mechanisms. An implementation of the authentication server and a file server supporting access control lists demonstrate the viability of this design in the context of the Self-certifying File System (SFS). Experiments demonstrate that the authentication server can scale to groups with tens of thousands of members.