PRIDA-ME: A Privacy-Preserving, Interoperable and Decentralized Authentication Scheme for Metaverse Environment

Internet of Drones (IoD), designed to coordinate the access of unmanned aerial vehicles (UAVs), is a specific application of the Internet of Things (IoT). Drones are used to control airspace and offer services such as rescue, traffic surveillance, environmental monitoring, delivery and so on. However, IoD continues to suffer from privacy and security issues. Firstly, messages are transmitted over public channels in IoD environments, which compromises data security. Further, sensitive data can also be extracted from stolen mobile devices of remote users. Moreover, drones are susceptible to physical capture and manipulation by adversaries, which are called drone capture attacks. Thus, the development of a secure and lightweight authentication scheme is essential to overcoming these security vulnerabilities, even on resource-constrained drones. In 2021, Akram et al. proposed a secure and lightweight user–drone authentication scheme for drone networks. However, we discovered that Akram et al.’s scheme is susceptible to user and drone impersonation, verification table leakage, and denial of service (DoS) attacks. Furthermore, their scheme cannot provide perfect forward secrecy. To overcome the aforementioned security vulnerabilities, we propose a secure mutual authentication and key agreement scheme between user and drone pairs. The proposed scheme utilizes physical unclonable function (PUF) to give drones uniqueness and resistance against drone stolen attacks. Moreover, the proposed scheme uses a fuzzy extractor to utilize the biometrics of users as secret parameters. We analyze the security of the proposed scheme using informal security analysis, Burrows–Abadi–Needham (BAN) logic, a Real-or-Random (RoR) model, and Automated Verification of Internet Security Protocols and Applications (AVISPA) simulation. We also compared the security features and performance of the proposed scheme and the existing related schemes. Therefore, we demonstrate that the proposed scheme is suitable for IoD environments that can provide users with secure and convenient wireless communications.

Wireless medical sensor networks (WMSNs) are used in remote medical service environments to provide patients with convenient healthcare services. In a WMSN environment, patients wear a device that collects their health information and transmits the information via a gateway. Then, doctors make a diagnosis regarding the patient, utilizing the health information. However, this information can be vulnerable to various security attacks because the information is exchanged via an insecure channel. Therefore, a secure authentication scheme is necessary for WMSNs. In 2021, Masud et al. proposed a lightweight and anonymity-preserving user authentication scheme for healthcare environments. We discover that Masud et al.’s scheme is insecure against offline password guessing, user impersonation, and privileged insider attacks. Furthermore, we find that Masud et al.’s scheme cannot ensure user anonymity. To address the security vulnerabilities of Masud et al.’s scheme, we propose a three-factor-based mutual authentication scheme with a physical unclonable function (PUF). The proposed scheme is secure against various security attacks and provides anonymity, perfect forward secrecy, and mutual authentication utilizing biometrics and PUF. To prove the security features of our scheme, we analyze the scheme using informal analysis, Burrows–Abadi–Needham (BAN) logic, the Real-or-Random (RoR) model, and Automated Verification of Internet Security Protocols and Applications (AVISPA) simulation. Furthermore, we estimate our scheme’s security features, computation costs, communication costs, and energy consumption compared with the other related schemes. Consequently, we demonstrate that our scheme is suitable for WMSNs.

Using Physical Unclonable Functions (PUFs) within the server-side has been recently proposed to address security vulnerabilities of the password (PW) authentication mechanism, including attacks on the database (DB) of user credentials. Practicing this idea using available memory technologies and constrained hardware modules may offer an additional hardware security layer. Thus, finding the PWs would require the attacker to access both the hardware containing the PUF and the information stored in the DB. PUFs have been used with other cryptographic algorithms in previous studies to improve the system’s security further. However, these studies have overlooked the challenges of implementing these algorithms with constrained hardware devices. Therefore, the trade-off between the achieved security and desired efficiency is still a challenge. The presented hardware-software PUF-based solutions lead to faster computation in the server-side hardware. Also, the client-side protocol can cope with the resource limitations existing in essential applications, including constrained IoTs. Moreover, the scheme handles the instability and bit alias of the Static Random-Access Memory (SRAM) PUF. This paper’s reliable, low-cost, and efficient prototype shows the functionality of a hardware-dependent protocol that is resistant to insider, PW guessing, and man-in-the-middle attacks. The presented hardware-software can be easily integrated with the server-side. Statistical tests on the embedded SRAM show that this paper protocol improves PUF entropy responses stored in the DB. Besides, the experimental results of this work show the possibility of obtaining an SRAM with very low intra-PUF variation without using any extra hardware overhead.

ID-CEPPA: Identity-based Computationally Efficient Privacy-Preserving Authentication scheme for vehicle-to-vehicle communications

The rapid advancement of technology, alongside state-of-the-art techniques is at an all-time high. However, this unprecedented growth of technological prowess also brings forth potential threats, as oftentimes the security encompassing these technologies is imperfect. Particularly within the automobile industry, the recent strides in technology have brought about increased complexity. A notable flaw lies in the CAN-FD protocol, which lacks robust security measures, making it vulnerable to data theft, injection, replay, and flood data attacks. With the rising complexity of in-vehicular networks and the widespread adoption of CAN-FD, the imperative to safeguard the protocol has never been more crucial. This paper aims to provide a comprehensive review of the existing in-vehicle communication protocol, CAN-FD. It explores existing security approaches designed to fortify CAN-FD, demonstrating multiple multi-layer solutions that leverage modern techniques including Physical Unclonable Function (PUF), Elliptical Curve Cryptography (ECC), Ethereum Blockchain, and Smart contracts. The paper highlights existing multi-layer security measures that offer minimal overhead, optimal performance, and robust security. Moreover, it identifies areas where these security measures fall short and discusses ongoing research along with suggestions for implementing software and hardware-level modifications. These proposed changes aim to streamline complexity, reduce overhead while ensuring forward compatibility. In essence, the methods outlined in this study are poised to excel in real-world applications, offering robust protection for the evolving landscape of in-vehicular communication systems.

ABSTRACT:-In the past few years, biometrics-based remote user authentication has become a topic of interest for cryptographers. Given the fact that applying biometrics in a remote user authentication scheme increases the security, several biometrics-based authentication schemes have been proposed. In 2011, Li et al. proposed an improvement for Li-Hwang’s biometrics-based remote user authentication scheme using a smart card. In their paper they have claimed that their scheme removes the weaknesses of Li-Hwang’s efficient scheme. This paper reviews and analyzes Li et al.’s scheme and demonstrates the flaws in its login, authentication and password change phases. It shows that this scheme has infrastructural deficiencies in its phases when the user enters a wrong password. It is also shown that these flaws could be removed with the verification of the entered password. Improvements in login phase, authentication phase and password change phase are proposed in this paper in order to remove these weaknesses

The lack of stability is one of the limitations that constrain physical unclonable function (PUF) from being put in widespread practical use. In this paper, we propose a weak PUF and a strong PUF that are both completely stable. These PUFs are called locally enhanced defectivity physical unclonable function (LEDPUF). An LEDPUF is a pure functional PUF that does not require any kinds of correction schemes as conventional parametric PUFs do. The source of randomness of an LEDPUF is extracted from locally enhance defectivity without affecting other parts of the chip. In this paper, we construct a weak LEDPUF by forming arrays of directed self-assembly random connections, and the strong LEDPUF is implemented by using the weak LEDPUF as the key of a keyed-hash message authentication code. Our simulation and statistical results show that the entropy of the weak LEDPUF bits is close to ideal, and the inter-chip Hamming distances of both weak and strong LEDPUFs are about 50%, which means that these LEDPUFs are not only stable but also unique. We develop a new unified framework for evaluating the security of PUFs, based on password security, by using information theoretic tools of guesswork. The guesswork model allows us to quantitatively compare, with a single unified metric, PUFs with varying levels of stability, bias, and available side information. In addition, it generalizes other measures to evaluate the security level, such as min-entropy and mutual information. We evaluate the guesswork-based security of some measured static random access memory and ring oscillator PUFs as an example and compare them with an LEDPUF to show that the stability has a more severe impact on the PUF security than biased responses. Furthermore, we find the guesswork of two new problems: guesswork under the probability of attack failure and the guesswork of strong PUFs that are used for authentication.

In Vehicular Ad-hoc Networks (VANETs), the ability of emergency vehicles (EVs) to reach their destinations quickly can maximize the protection of people’s lives and property safety, and minimize the losses and impacts caused by various emergencies. In this endeavor, the emergency vehicle avoidance protocol is of paramount importance. However, the existing authentication protocol is vulnerable to side-channel attacks, Roadside Units (RSUs) captured attacks, as well as untraceability, etc. Therefore, for wider and more practical realizability, we propose an efficient and secure authentication scheme based on Elliptic Curves Cryptography (ECC), fuzzy extraction algorithm and Physical Unclonable Function (PUF) for EVs avoidance. In the protocols, PUF and biometric key are used for protecting RSUs’ and EVs’ privacy information respectively. Additionally, a conditional privacy-preserving and traceable message authentication strategy is designed for emergency messages propagation, the avoidance messages can be forwarded to ordinary vehicles before the EVs arriving. Compared with related EVs avoidance protocols, our protocol can resist side-channel attacks and other various known attacks. In our scheme, the first authentication efficiencies have increased by 11.72% and the subsequent authentication increased by 25.99% than the previous protocols in the same scenario. Security and performance analysis demonstrate that the proposed scheme is secure, efficient, and practical.

The incorporation of information and communication technologies in the power grids has greatly enhanced efficiency in the management of demand-responses. In addition, smart grids have seen considerable minimization in energy consumption and enhancement in power supply quality. However, the transmission of control and consumption information over open public communication channels renders the transmitted messages vulnerable to numerous security and privacy violations. Although many authentication and key agreement protocols have been developed to counter these issues, the achievement of ideal security and privacy levels at optimal performance still remains an uphill task. In this paper, we leverage on Hamming distance, elliptic curve cryptography, smart cards and biometrics to develop an authentication protocol. It is formally analyzed using the Burrows-Abadi-Needham (BAN) logic, which shows strong mutual authentication and session key negotiation. Its semantic security analysis demonstrates its robustness under all the assumptions of the Dolev-Yao (DY) and Canetti- Krawczyk (CK) threat models. From the performance perspective, it is shown to incur communication, storage and computation complexities compared with other related state of the art protocols.

Urban air mobility (UAM) is a future air transportation system to solve the air pollution and movement efficiency problems of the traditional mobility system. In UAM environments, unmanned aerial vehicles (UAV) are used to transport passengers and goods providing various convenient services such as package delivery, air bus, and air taxi. However, UAVs communicate with ground infrastructures through open channels that can be exposed to various security attacks. Therefore, a secure mutual authentication scheme is necessary for UAM environments. Moreover, a handover authentication is also necessary to ensure seamless communication when the service location is changed. In this paper, we design a secure and efficient handover authentication scheme for UAM environments considering various security vulnerabilities and efficiency using elliptic curve cryptography (ECC). We utilize informal security analysis, Real-or-Random (RoR), Burrows–Abadi–Needham (BAN) logic, and Automated Validation of Internet Security Protocols and Applications (AVISPA) to prove the security of the proposed scheme. Furthermore, we compare the computation and communication cost comparisons of the proposed scheme with the other related schemes. The results show that the proposed scheme is secure and efficient for UAM environments.

Smart grid (SG) achieves more convenient and efficient power transmission through the rapid development of the information and communication technology. In addition to the transmission of electrical energy, the SG system also involves privacy and control information of service providers, which is closely related to people's livelihood. However, at present, the data in the SG system are transmitted in the form of plaintext, which does not have complete protection measures for entity privacy and communication data security. Focusing on preserving entity privacy and data security, this article proposes an anonymous secure authentication protocol (ASAP-SG) for the SG environment. Based on elliptic curve cryptography and physical unclonable function, ASAP-SG can realize authentication and key agreement between smart meters and service providers. The security of ASAP-SG has been verified with proverif tool and proven strictly under the real-or-random model. Furthermore, heuristic analysis manifests that ASAP-SG can successfully resist known security attacks. Finally, a fully comparison with the other five most advanced schemes reveals that ASAP-SG consumes the optimal computation cost on both smart meters and service providers and reduces the communication overhead by 33.3%–45.8%, on the basis of satisfying ten security objectives. These features make ASAP-SG more suitable for resource-constrained SG environment.

We propose a scheme to prevent the machine learning (ML) attacks against physically unclonable functions (PUFs). A silicon PUF is a security primitive in a semiconductor chip that generates a unique identifier by exploiting device variations. However, some PUF implementations are vulnerable to ML attacks, in which an attacker tries to obtain the mathematical clone of the target PUF to predict its responses. Our scheme adds intentional noise to the responses to disturb ML by an attacker so that the clone fails to be authenticated, while the original PUF can still be correctly authenticated using an error correction code (ECC). The effectiveness of this scheme is not very obvious because the attacker can also use the ECC. We apply the countermeasure to n-XOR arbiter PUFs to investigate the feasibility of the proposed scheme. We explain the relationship between the prediction accuracy of the clone and the number of intentional noise bits. Our scheme can successfully distinguish a clone from the legitimate PUF in the case of 5-XOR PUF.

Secure and efficient mutual authentication and key agreement schemes form the basis for any robust network communication system. Elliptic Curve Cryptography (ECC) has emerged as one of the most successful Public Key Cryptosystem that efficiently meets all the security challenges. Comparison of ECC with other Public Key Cryptosystems (RSA, Rabin, ElGamal) shows that it provides equal level of security for a far smaller bit size, thereby substantially reducing the processing overhead. This makes it suitable for constrained environments like wireless networks and mobile devices as well as for security sensitive applications like electronic banking, financial transactions and smart grids. With the successful implementation of ECC in security applications (e-passports, e-IDs, embedded systems), it is getting widely commercialized. ECC is simple and faster and is therefore emerging as an attractive alternative for providing security in lightweight device, which contributes to its popularity in the present scenario. In this paper, we have analyzed some of the recent password based authentication and key agreement schemes using ECC for various environments. Furthermore, we have carried out security, functionality and performance comparisons of these schemes and found that they are unable to satisfy their claimed security goals.

In recent years, physical unclonable functions (PUFs) have gained a lot of attention as mechanisms for hardware-rooted device authentication. While the majority of the previously proposed PUFs derive entropy using dedicated circuitry, software PUFs achieve this from existing circuitry in a system. Such software-derived designs are highly desirable for low-power embedded systems as they require no hardware overhead. However, these software PUFs induce considerable processing overheads that hinder their adoption in resource-constrained devices. In this article, we propose DTA-PUF, a novel, software PUF design that exploits the instruction- and data-dependent dynamic timing behaviour of pipelined cores to provide a reliable challenge-response mechanism without requiring any extra hardware. DTA-PUF accepts sequences of instructions as an input challenge and produces an output response based on the manifested timing errors under specific over-clocked settings. To lower the required processing effort, we systematically select instruction sequences that maximise error-rate. The application to a post-layout pipelined floating-point unit, which is implemented in 45 nm process technology, demonstrates the effectiveness and practicability of our PUF design. Finally, DTA-PUF requires up to 50× fewer instructions than existing software processor PUF designs, limiting processing costs and resulting in up to 26% power savings.

Privacy breaches and online frauds are grave concerns in pervasive computing. Device identification is the first line of defense to detect and stop fraud. Conventional device authentication schemes using software addresses as identities or static pre-programmed secret keys are vulnerable to tampering and memory attacks. This article reviews two emerging lightweight hardware-oriented solutions to avoid these problems, namely radio frequency fingerprint (RFF) identification and physical unclonable function (PUF) authentication. Their operating principles and protocols are first introduced, followed by a scrutiny of their common and distinctive features, and a discussion of the stumbling blocks in the way of their market adoption. Finally, we envisage a combined mutual authentication and key establishment scheme to shed light on their synergy.