Secure Authentication in the Smart Grid

A secure and efficient AKE scheme for IoT devices using PUF and cancellable biometrics

An unresolved problem in research on authenticated key exchange (AKE) is to construct a secure protocol against advanced attacks such as key compromise impersonation and maximal exposure attacks without relying on random oracles. HMQV, a state of the art AKE protocol, achieves both efficiency and the strong security model proposed by Krawczyk (we call it the CK + model), which includes resistance to advanced attacks. However, the security proof is given under the random oracle model. We propose a generic construction of AKE from a key encapsulation mechanism (KEM). The construction is based on a chosen-ciphertext secure KEM, and the resultant AKE protocol is CK + secure in the standard model. The protocol gives the first CK + secure AKE protocols based on the hardness of integer factorization problem, code-based problems, or learning problems with errors. In addition, instantiations under the Diffie-Hellman assumption or its variant can be proved to have strong security without non-standard assumptions such as πPRF and KEA1.

The electric power industry is currently undergoing fundamental changes not only driven by the introduction of Information and Communication Technologies ( ICT ) into the grid, transforming it into a Smart Grid ( SG ), but also due to the incorporation of renewable electricity sources into customer supply, in conjunction with the rapidly decreasing costs of new technologies for electricity generation, storage, and consumption. These evolutions are happening in parallel with the deployment of the Energy Internet of Things ( EIoT ), whose aim is to tie all of these elements together and to provide maximum visibility, monitoring, control, and business proactivity. This chapter describes a number of key developments that are required to pollinate the full deployment of a dynamic SG , managed under EIoT mechanisms. These developments include the following four critical facets: (i) the reliable deployment of effective distributed energy resources ( DER s); (ii) the deployment of the sensing, transmission, and analysis elements that comprise the EIoT ; (iii) the establishment and deployment of EIoT standards to facilitate interworking and multivendor product availability; and (iv) the development and deployment of the essential mechanisms for security that will need to ensure safe and reliable grid operations.

Telecare medical information systems are developed to establish an online convenient communication platform for patients and medical staff to exchange healthcare related services. Being installed on Internet, these systems are prone to different security and privacy threats, which may result in leakage of sensitive health-related data and privacy compromise of the patients. Hence, a major challenge is to establish a secure communication channel between the patients and medical servers, where parties are mutually authenticated and a session key is agreed upon and shared between them for further information exchange. Recently, Ostad-Sharif et al. presented an ECC- based anonymous authentication and key agreement method for healthcare applications. In this article, we first prove that Ostad- sharif et al.'s scheme is vulnerable to key compromise password guessing attacks and key compromise impersonation attacks. Then, we propose a secure and efficient authentication and key agreement scheme for telecare medical information systems which can provide mutual authentication and perfect forward secrecy, and resists against key compromise password guessing attacks, key compromise impersonation attacks, insider attacks, and replay attacks. The security of the proposed scheme is also proved formally with the Scyther tool.

The increasing integration of Internet of Things (IoT) devices in Wireless Local Area Networks (WLANs) necessitates robust and efficient authentication mechanisms. While existing IoT authentication protocols address certain security concerns, they often fail to provide comprehensive protection against threats such as perfect forward secrecy violations, insider attacks, and key compromise impersonation, or impose significant computational and communication overhead on resource-constrained IoT systems. This paper presents a novel Extensible Authentication Protocol (EAP) based scheme for IoT-WLAN environments that addresses these security challenges while maintaining cost-effectiveness. Our approach utilizes elliptic curve cryptography and incorporates advanced features including perfect forward secrecy, strong identity protection, and explicit key confirmation. We provide a thorough security analysis using informal heuristics, formal methods (Random Oracle Model and BAN Logic), and automated verification with ProVerif. Performance evaluations demonstrate that our protocol achieves lower communication, storage, and computational costs compared to state-of-the-art solutions, with an average 79.6% reduction in computation time. A detailed comparison with existing schemes highlights the efficiency and enhanced security features of our proposed authentication mechanism for IoT-WLAN deployments.

EASBF: An efficient authentication scheme over blockchain for fog computing-enabled internet of vehicles

In 2003, Boyd et al. have proposed two deniable authenticated key establishment protocols for Internet key exchange (IKE). However, both schemes have been broken by Chou et al. in 2005 due to their susceptibility to key-compromise impersonation (KCI) attack. In this paper, we put forward the improved variants of both Boyd et al.'s schemes in order to defeat the KCI attack. On top of justifying our improvements, we further present a detailed security analysis to ensure that the desired security attributes: deniability and authenticity remain preserved.

Smart grid, characterized by high efficiency, security, and flexibility, is gradually replacing the traditional power grid. Data aggregation technology is frequently used to avoid user privacy disclosure as a result of power consumption data transmission in the smart grid. However, traditional one-dimensional data aggregation schemes fail to meet the demands of fine-grained analysis. Therefore, this paper proposes an efficient privacy-preserving multi-dimensional data aggregation (P 2 MDA) scheme in smart grid by virtue of homomorphic encryption and superincreasing sequence. The security analysis indicates that the proposed scheme is proved to be secure in the random oracle model, satisfying all security and privacy requirements. The extensive performance analysis shows that in comparison to the related schemes, the proposed scheme achieves lowest computation and communication costs, thus appropriate for practical applications.

The evolving paradigm of private edge computing seamlessly incorporates the more extensive functionalities of cloud computing with localized processing. This paradigm eliminates the requirement for unmanned aerial vehicles (UAVs) to transmit large volumes of data to a centralized cloud, thereby reducing response times. UAVs’ dynamic nature and dependency on unsecured and publicly accessible wireless channels make secure communication between a private edge cloud and a UAV difficult. Therefore, private edge computing-enabled UAV networks require additional security measures to protect the network and users’ data. This research article introduces a certificate-based ring signcryption scheme that mitigates security concerns by utilizing the concept of hyperelliptic curve cryptography (HECC). By combining digital signature and encryption into a single operation, the proposed method takes advantage of the most advantageous characteristic of HECC (the ability to use a short key, such as 80 bits) while maintaining the same level of security as RSA and ECC. The security properties of the proposed scheme are validated by implementing a formal security evaluation method known as the random oracle model (ROM), in addition to informal security analysis. Furthermore, the computation and communication costs of the proposed scheme are evaluated and compared to those of relevant existing schemes. The performance and security analysis demonstrate that the proposed scheme enhances efficiency and security.

To fully support information management among various stakeholders in smart grid domains, how to establish secure communication sessions has become an important issue for smart grid environments. In order to support secure communications between smart meters and service providers, key management for authentication becomes a crucial security topic. Recently, several key distribution schemes have been proposed to provide secure communications for smart grid. However, these schemes do not support smart meter anonymity and possess security weaknesses. This paper utilizes an identity-based signature scheme and an identity-based encryption scheme to propose a new anonymous key distribution scheme for smart grid environments. In the proposed scheme, a smart meter can anonymously access services provided by service providers using one private key without the help of the trusted anchor during authentication. In addition, the proposed scheme requires only a few of computation operations at the smart meter side. Security analysis is conducted to prove the proposed scheme is secure under random oracle model.

The Data Integrity Based Secure Cloud Data Outsourcing Model involves designing a framework that ensures data outsourced to the cloud remains secure, intact, and authentic. Cloud computing has become an indispensable resource for businesses and individuals alike, providing scalable and cost-effective solutions for data storage and management. However, outsourcing data to external cloud service providers (CSPs) raises serious questions around data security, integrity, and authenticity. It is essential to retain confidence and comply with regulatory criteria to make sure that outsourced data is authentic, obtainable, and unaltered. In this article, the Low-Complexity Elliptic Galois Cryptography based Secure Data Integrity Verification Scheme for Cloud Storage (LCEGC-SDIV-CS) is proposed. Initially, the integration of the advantages in Trusted Execution Environment (TEE) and identity-based encryption using Low-Complexity Elliptic Galois Cryptography (LCEGC) is provided to create a safe data integrity verification scheme. Then, data integrity using Block Access Signature Oriented Merle Hash Tree (BS-MHT) is used for the integrity-preserving structure for encrypted block-oriented storage systems. The random Oracle model's security analysis, depending upon the computational Diffie-Hellman assumption, provides security by preventing attacks when the adversary chooses the messages with targets’ identities. The proposed LCEGC-SDIV-CS model is implemented and the performance metrics like Data uploading with downloading time, Memory usage on data uploading with downloading, Encryption time, Decryption time, and Security levels are examined. The proposed LCEGC-SDIV-CS method attains 21.56%, 23.98%, and 21.19% lower data uploading with downloading time 24.78%, 23.82%, and 23.52% lower encryption time are analyzed with existing methods EDI-SPD-SCS, NSA-SADS-BDEPDP-SDS-RCS respectively.

Wireless sensor networks (WSNs) are usually deployed in hostile or unattended areas, and users need to obtain real-time data from WSNs. The data collected by sensor nodes are usually relatively private and sensitive, so users must pass the identity authentication before obtaining the information perceived by sensor nodes. In order to enhance the security of wireless sensor networks and prevent illegal users from accessing sensor nodes, this paper designs an efficient and secure identity authentication protocol for wireless sensor networks. The proposed protocol makes full use of the advantages of lightweight cryptographic primitives such as physical unclonable function, one-way hash function and bitwise exclusive operation. Moreover, users only need to use biometrics (such as fingerprints, iris) to access the remote systems and do not need to rely on any password, which avoids the trouble of memorizing and losing password. To prove the scheme’s security, the well-known formal security proof with random oracle model and traditional heuristic discussion are given. Additionally, the performance comparison results show that our scheme has less communication overhead and computation complexity, and is effective for the resource constrained sensor devices in WSNs.

An integrated and optimized smart grid cannot be achieved without a secure communication network. Due to the large-scale nature of the power system, the variety of technologies used, and limitations of communication bandwidth, supervisory applications for smart grid still use weak security in many deployments. Adversaries can potentially modify measurement values or inject bad commands over the network. In this paper, we propose a novel scheme based on dynamic secrets and encryption with secret keys. The scheme generates a series of dynamic secrets over the communication network, which are used to generate secret keys for data encryption. The generation of dynamic secret is frequent and no adversary can compromise the network for a longer period, even if he/she knows a secret key. The scheme is secure against eavesdropping, malicious communication injection, man-in-the-middle attacks, replay attacks, impersonation attacks, and chosen-plaintext attacks. The security analysis and performance evaluation show that our scheme is feasible to be used in the communications between supervisory and control nodes of various smart grid applications.

A cryptographic scheme is “provably secure” if an attack on the scheme implies an attack on the underlying primitives it employs. A cryptographic scheme is “provably secure in the random-oracle model” if it uses a cryptographic hash function F and is provably secure when F is modeled by a public random function. Demonstrating that a crypto graphic scheme is provably secure in the random-oracle model engenders much assurance in the scheme's correctness. But there may remain some lingering fear that the concrete hash function which instantiates the random oracle differs from a random function in some significant way. So it is good to limit reliance on random oracles. Here we describe two encryption schemes which use their random oracles in a rather limited way. The schemes achieve semantic security and plaintext awareness under specified assumptions. One scheme uses the RSA primitive; another uses Diffie-Hellman. In either case messages longer than the modulus length can be safely and directly encrypted without relying on the hash functions modeled as random-oracles to be good for private-key encryption.

In smart grid, key exchange protocols play a vital role in providing secure channels to read consumption reports from the smart meters. Thus far, several key exchange schemes have been proposed for the networked smart meters. However, for the first time, quite recently, Sha et al . have presented an interesting two-phase authentication and key agreement scheme that exclusively aims at the isolated smart meters. In their scheme, they have properly addressed the computationally constrained smart meters by offering a lightweight key exchange protocol. Nevertheless, after meticulous observation, we found that their proposed scheme cannot resist the desynchronization attack and cannot provide the perfect forward secrecy. Moreover, there are some other weaknesses in their scheme. As a result, to tackle the existing security challenges, in this paper, by utilization of the extended Chebyshev chaotic maps, we propose an efficient anonymous password-authenticated key exchange protocol that not only is free from the limitations of Sha et al .'s scheme, but also provides the anonymity. The security analysis in the random oracle model and using the widely accepted ProVerif tool besides the computational and communication costs comparison demonstrate that the proposed scheme has reached a proper level of efficiency without sacrificing the desired security properties.