Cyber Secure Framework for Smart Containers Based on Novel Hybrid DTLS Protocol

The Internet of Things (IoTs) is apace growing, billions of IoT devices are connected to the Internet which communicate and exchange data among each other. Applications of IoT can be found in many fields of engineering and sciences such as healthcare, traffic, agriculture, oil and gas industries, and logistics. In logistics, the products which are to be transported may be sensitive and perishable, and require controlled environment. Most of the commercially available logistic containers are not integrated with IoT devices to provide controlled environment parameters inside the container and to transmit data to a remote server. This necessitates the need for designing and fabricating IoT based smart containers. Due to constrained nature of IoT devices, these are prone to different cyber security attacks such as Denial of Service (DoS), Man in Middle (MITM) and Replay. Therefore, designing efficient cyber security framework are required for smart container. The Datagram Transport Layer Security (DTLS) Protocol has emerged as the de facto standard for securing communication in IoT devices. However, it is unable to minimize cyber security attacks such as Denial of Service and Distributed Denial of Service (DDoS) during the handshake process. The main contribution of this paper is to design a cyber secure framework by implementing novel hybrid DTLS protocol in smart container which can efficiently minimize the effects of cyber attacks during handshake process. The performance of our proposed framework is evaluated in terms of energy efficiency, handshake time, throughput and packet delivery ratio. Moreover, the proposed framework is tested in IoT based smart containers. The proposed framework decreases handshake time more than 9% and saves 11% of energy efficiency for transmission in compare of the standard DTLS, while increases packet delivery ratio and throughput by 83% and 87% respectively.     

基于标识密码的数据报传输层安全协议

TLS作为目前应用最为广泛的安全传输协议,只能保证可靠传输TCP上数据的安全性.DTLS（datagram TLS）在TLS协议架构上进行了修改,能够为UDP提供安全保护.但DTLS在会话建立过程中仍然需要依赖第三方认证中心和证书完成通信双方的认证,连接建立过程时间长,安全开销大,不能满足物联网等资源受限的网络通信环境.将标识密码引入DTLS中,避免了握手协议中处理证书所带来的各种开销,在计算会话密钥的同时完成通信双方的认证;并使用新的密钥协商协议重新设计DTLS的握手协议,减少交互次数和消息数量,缩短连接建立时间.实验结果表明,基于标识密码的DTLS在不降低安全性的同时,将通信建立时间缩短了近50%.     

基于批量化密钥重分配的SSL握手协议*

SSL(安全套接层)握手协议利用公开密钥体制(RSA)保护通信实体之间传输信息的机密性和完整性,其存在信息处理速度过慢的缺点,基于batch RSA的SSL握手协议能较好地解决这一问题,但当服务器收到大量客户端请求或遭受DoS攻击时,易导致服务器性能下降。为此,提出一种基于批量化密钥重分配 (batch key redistribution)的改进协议。协议将密钥分解成两个密钥序列分支,并将一个密钥序列分支发送至客户端,由客户端来部分解密,以减少服务器的计算开销,从而克服服务器性能下降的问题。分析和实验结果表明,协议能很好地保证信息传输的安全,且有效提高了信息处理的速度。     

IEEE802.11i中四次握手过程的安全分析和改进

对IEEE802.11i协议中四次握手过程的临时会话密钥的协商和建立过程中的安全性进行了分析，发现在四次握手过程中存在安全隐患，并因此可能受到DoS(拒绝服务)攻击。在此基础上提出了一种改进方法，使四次握手过程的安全性得到进一步增强。     

改进的三方口令认证密钥交换协议

基于三方的口令认证密钥交换（3PAKE）协议是客户通过与可信服务器共享一个口令验证元,在两客户进行通信时通过此可信服务器进行会话密钥的建立与共享,从而进行通信。首先对李文敏等人提出的协议进行安全性分析,发现该协议易受离线字典攻击和服务器泄露攻击。提出了一个改进协议,该协议能够提供双向认证、会话密钥机密性和前向安全性,能够有效抵抗多种攻击,包括离线字典攻击和服务器泄露攻击。     

Zero knowledge based client side deduplication for encrypted files of secure cloud storage in smart cities

As typical applications in the field of the cloud computing, cloud storage services are popular in the development of smart cities for their low costs and huge storage capacity. Proofs-of-ownership (PoW) is an important cryptographic primitive in cloud storage to ensure that a client holds the whole file rather than part of it in secure client side data deduplication. The previous PoW schemes worked well when the file is in plaintext. However, the privacy of the clients’ data may be vulnerable to honest-but-curious attacks. To deal with this issue, the clients tend to encrypt files before outsourcing them to the cloud, which makes the existing PoW schemes inapplicable any more. In this paper, we first propose a secure zero-knowledge based client side deduplication scheme over encrypted files. We prove that the proposed scheme is sound, complete and zero-knowledge. The scheme can achieve a high detection probability of the clients’ misbehavior. Then we introduced a proxy re-encryption based key distribution scheme. This scheme ensures that the server knows nothing about the encryption key even though it acts as a proxy to help distributing the file encryption key. It also enables the clients who have gained the ownership of a file to share the file with the encryption key generated without establishing secure channels among them. It is proved that the clients’ private key cannot be recovered by the server or clients collusion attacks during the key distribution phase. Our performance evaluation shows that the proposed scheme is much more efficient than the existing client side deduplication schemes.     

SecureSense: End-to-end secure communication architecture for the cloud-connected Internet of Things

Constrained Application Protocol (CoAP) has become the de-facto web standard for the IoT. Unlike traditional wireless sensor networks, Internet-connected smart thing deployments require security. CoAP mandates the use of the Datagram TLS (DTLS) protocol as the underlying secure communication protocol. In this paper we implement DTLS-protected secure CoAP for both resource-constrained IoT devices and a cloud backend and evaluate all three security modes (pre-shared key, raw-public key, and certificate-based) of CoAP in a real cloud-connected IoT setup. We extend Sics^thSense– a cloud platform for the IoT– with secure CoAP capabilities, and compliment a DTLS implementation for resource-constrained IoT devices with raw-public key and certificate-based asymmetric cryptography. To the best of our knowledge, this is the first effort toward providing end-to-end secure communication between resource-constrained smart things and cloud back-ends which supports all three security modes of CoAP both on the client side and the server side. SecureSense– our End-to-End (E2E) secure communication architecture for the IoT– consists of all standard-based protocols, and implementation of these protocols are open source and BSD-licensed. The SecureSense evaluation benchmarks and open source and open license implementation make it possible for future IoT product and service providers to account for security overhead while using all standardized protocols and while ensuring interoperability among different vendors. The core contributions of this paper are: (i) a complete implementation for CoAP security modes for E2E IoT security,  (ii) IoT security and communication protocols for a cloud platform for the IoT, and (iii) detailed experimental evaluation and benchmarking of E2E security between a network of smart things and a cloud platform.     

基于身份的无线传输层安全握手协议改进方案

现有无线传输层安全(WTLS)协议主要基于数字证书构建,存在通信与计算开销较大、未对服务器证书的有效性进行在线验证等不足。以基于身份的密码体制思想,综合运用基于身份的加密(IBE)、基于身份的签名(IBS)及基于身份的密钥协商(IBAKA)等机制,提出了一种基于身份的密码系统(IBC)的WTLS改进协议。改进协议以身份标识为核心,以传递身份标识代替传递证书,使用IBE、IBS及IBAKA分别完成加密、签名及密钥协商等操作,并在密钥计算中融入了加密者的身份信息,使得密文具有消息源的可认证性。对改进协议的安全性及效率的分析表明,改进协议在确保安全的前提下降低了通信开销。     

End-to-end security scheme for mobility enabled healthcare Internet of Things

We propose an end-to-end security scheme for mobility enabled healthcare Internet of Things (IoT). The proposed scheme consists of (i) a secure and efficient end-user authentication and authorization architecture based on the certificate based DTLS handshake, (ii) secure end-to-end communication based on session resumption, and (iii) robust mobility based on interconnected smart gateways. The smart gateways act as an intermediate processing layer (called fog layer) between IoT devices and sensors (device layer) and cloud services (cloud layer). In our scheme, the fog layer facilitates ubiquitous mobility without requiring any reconfiguration at the device layer. The scheme is demonstrated by simulation and a full hardware/software prototype. Based on our analysis, our scheme has the most extensive set of security features in comparison to related approaches found in literature. Energy-performance evaluation results show that compared to existing approaches, our scheme reduces the communication overhead by 26% and the communication latency between smart gateways and end users by 16%. In addition, our scheme is approximately 97% faster than certificate based and 10% faster than symmetric key based DTLS. Compared to our scheme, certificate based DTLS consumes about 2.2 times more RAM and 2.9 times more ROM resources. On the other hand, the RAM and ROM requirements of our scheme are almost as low as in symmetric key-based DTLS. Analysis of our implementation revealed that the handover latency caused by mobility is low and the handover process does not incur any processing or communication overhead on the sensors.     

适合可信计算环境基于口令的双向匿名认证密钥协商协议

如何保持双向匿名性是构建可信计算环境的核心问题之一,针对可信计算环境的特点,提出了一个基于口令的匿名认证密钥协商协议,并且在计算性Diffie-Hellman假设和存在强抗碰撞的单向杂凑函数条件下,基于随机预言机模型证明了该协议是安全的。另外,该协议可以有效抵抗字典攻击和资源耗尽型拒绝服务攻击。分析结果表明,该协议能够为密钥协商双方提供隐私保护,而且在执行效率方面明显优于VIET等其它方案     

基于口令的客户端/服务器认证协议

身份认证是建立客户端和服务器之间安全会话的前提条件。Kim和Chung提出了一种双方的双向认证方案,其以较小的计算量得到了学者们的关注。但经分析发现,该方案并不安全：无法抵抗离线口令猜测攻击和无限次在线口令猜测攻击,也不能防止服务器伪装攻击。为了解决这些安全隐患,利用非对称Rabin密码体制提出了一种改进的方案,并基于BAN逻辑对方案的正确性进行了严格验证。最后还分析了新方案的安全性和性能。     

标准模型下高效的三方口令认证密钥交换协议

三方口令认证密钥交换协议允许两个分别与服务器共享不同口令的用户在服务器的协助下建立共享的会话密钥,从而实现了用户间端到端的安全通信.现阶段,多数的三方口令认证密钥交换协议都是在随机预言模型下可证明安全的.但在实际应用中,利用哈希函数对随机预言函数进行实例化的时候会给随机预言模型下可证明安全的协议带来安全隐患,甚至将导致协议不安全.以基于ElGamal加密的平滑投射哈希函数为工具,在共同参考串模型下设计了一种高效的三方口令认证密钥交换协议,并且在标准模型下基于DDH假设证明了协议的安全性.与已有的同类协议相比,该协议在同等的安全假设下具有更高的计算效率和通信效率,因此更适用于大规模的端到端通信环境.     

具有强匿名性的网关口令认证密钥交换协议

网关口令认证密钥交换协议允许用户和网关在服务器的协助下建立起一个共享的会话密钥,其中用户和服务器之间的认证通过低熵的口令来完成.已有的网关口令认证密钥交换协议对用户的匿名性研究不足.该文基于Diffie-Hellman密钥交换提出了具有强匿名性的网关口令认证密钥交换协议,并且在随机预言模型下基于标准的DDH假设证明了协议的安全性.新协议可以抵抗不可检测在线字典攻击并且计算效率高,安全性和计算效率都优于已有的同类协议.     

A secure cookie scheme

Cookies are the primary means for web applications to authenticate HTTP requests and to maintain client states. Many web applications (such as those for electronic commerce) demand a secure cookie scheme. Such a scheme needs to provide the following four services: authentication, confidentiality, integrity, and anti-replay. Several secure cookie schemes have been proposed in previous literature; however, none of them are completely satisfactory. In this paper, we propose a secure cookie scheme that is effective, efficient, and easy to deploy. In terms of effectiveness, our scheme provides all of the above four security services. In terms of efficiency, our scheme does not involve any database lookup or public key cryptography. In terms of deployability, our scheme can be easily deployed on existing web services, and it does not require any change to the Internet cookie specification. We implemented our secure cookie scheme using PHP and conducted experiments. The experimental results show that our scheme is very efficient on both the client side and the server side.A notable adoption of our scheme in industry is that our cookie scheme has been used by Wordpress since version 2.4. Wordpress is a widely used open source content management system.     

A Secure IoT Firmware Update Scheme Against SCPA and DoS Attacks

In the IEEE S&P 2017,Ronen et al.exploited side-channel power analysis (SCPA) and approximately 5000 power traces to recover the global AES-CCM key that Philip Hue lamps use to decrypt and authenticate new firmware.Based on the recovered key,the attacker could create a malicious firmware update and load it to Philip Hue lamps to cause Internet of Things (IoT) security issues.Inspired by the work of Ronen et al.,we propose an AES-CCM-based firmware update scheme against SCPA and denial of service (DoS) attacks.The proposed scheme applied in IoT terminal devices includes two aspects of design (i.e.,bootloader and application layer).Firstly,in the bootloader,the number of updates per unit time is limited to prevent the attacker from acquiring a sufficient number of useful traces in a short time,which can effectively counter an SCPA attack.Secondly,in the application layer,using the proposed handshake protocol,the IoT device can access the IoT server to regain update permission,which can defend against DoS attacks.Moreover,on the STM32F405+M25P40 hardware platform,we implement Philips' and the proposed modified schemes.Experimental results show that compared with the firmware update scheme of Philips Hue smart lamps,the proposed scheme additionally requires only 2.35 KB of Flash memory and a maximum of 0.32 s update time to effectively enhance the security of the AES-CCM-based firmware update process.     

PSO-SFDD: Defense against SYN flooding DoS attacks by employing PSO algorithm

A DoS attack can be regarded as an attempt of attackers to prevent legal users from gaining a normal network service. The TCP connection management protocol sets a position for a classic DoS attack, namely, the SYN flood attack. In this attack some sources send a large number of TCP SYN segments, without completing the third handshake step to quickly exhaust connection resources of the under attack system. This paper models the under attack server by using the queuing theory in which attack requests are recognized based on their long service time. Then it proposes a framework in which the defense issue is formulated as an optimization problem and employs the particle swarm optimization (PSO) algorithm to optimally solve this problem. PSO tries to direct the server to an optimum defense point by dynamically setting two TCP parameters, namely, maximum number of connections and maximum duration of a half-open connection. The simulation results show that the proposed defense strategy improves the performance of the under attack system in terms of rejection probability of connection requests and efficient consumption of buffer space.     

一个前向安全的基于口令认证的三方密钥交换协议

目前,文献中提出的基于口令认证的密钥交换协议,很多都是针对两方的情形设计的,即通信双方为客户与服务器,它们通过一个预先共享的口令来进行认证的密钥交换.随着现代通信环境的快速变化,需要能为任意客户间构建一个端到端的安全信道,这种应用的情形与那些文献中所考虑的有很大区别.针对这种情形,文中提出了一个可证前向安全的基于口令认证的三方密钥交换协议,使通信双方在认证服务器的帮助下能相互进行认证并建立一个会话密钥.与前人提出的基于口令认证的三方密钥交换协议相比,该协议在计算代价和通信代价上都较有效,因而更适用于资源受限的环境.此协议的安全性是在口令型的选择基Gap Diffie-Hellman问题难解的假设前提下在随机谕示模型下证明的.     

SSL协议拒绝服务攻击及其对策研究

SSL协议是电子商务中常用的一种安全电子交易协议,对信息传输起到了加密和认证的作用。该文针对最新的SSL服务器DoS工具,分析了SSL协议存在的拒绝服务漏洞,讨论了建立一个SSL连接服务端所消耗计算资源远多于客户端的原因,并提出了几种解决方案,以缓解攻击带来的危害,其中基于连接限制的解决方案可有效缓解此类问题。     

一种高效的无线传输层安全握手协议

现有的无线传输层安全(WTLS)握手协议通信量大,且不能对服务器证书的有效性进行在线验证。针对上述问题,提出一种改进的WTLS协议。在无线通信客户端预存服务器证书,握手过程中以证书的唯一标识检索证书,以降低握手协议的通信载荷。引入可信证书验证代理负责服务器证书的在线验证,并生成证书状态凭据。客户端通过验证该凭据的真实性,实现对服务器证书有效性的在线验证,从而提高协议的安全性。     

基于SSL协议的客户端安全代理的研究与实现

对基于SSL协议的客户端安全代理进行了深入的理论研究,并给出了具体的实现方法.该客户端安全代理以Web通讯代理的形式,为浏览器提供128位以上高强度的数据加密传输能力以及身份认证功能等,提高了数据传输的安全性.