ESAP: Efficient and secure authentication protocol for roaming user in mobile communication networks

The Global System for Mobile communication (GSM) network is proposed to mitigate the security problems and vulnerabilities observed in the mobile telecommunication system. However, the GSM network is vulnerable to different kinds of attacks such as redirection attack, impersonation attack and Man in-the Middle (MiTM) attack. The possibility of these attacks makes the wireless mobile system vulnerable to fraudulent access and eavesdropping. Different authentication protocols of GSM were proposed to overcome the drawbacks but many of them lead to network signalling overload and increases the call set-up time. In this paper, an efficient and secure authentication and key agreement protocol (ESAP-AKA) is proposed to overcome the flaws of existing authentication protocol for roaming users in the GSM network. The formal verification of the proposed protocol is presented by BAN logic and the security analysis is shown using the AVISPA tool. The security analysis shows that the proposed protocol avoids the different possible attacks on the communication network. The performance analysis based on the fluid flow mobility model shows that the proposed protocol reduces the communication overhead of the network by reducing a number of messages. On an average, the protocol reduces 60% of network signalling congestion overhead as compared with other existing GSM-AKA protocols. Moreover, the protocol not only removes the drawbacks of existing protocols but also accomplishes the needs of roaming users.     

Lightweight Authentication Protocol Based on Physical Unclonable Function

In the emerging Industrial Internet of Things (IIoT), authentication problems have become an urgent issue for massive resource-constrained devices because traditional costly security mechanisms are not suitable for them. The security protocol designed for resource-constrained systems should not only be secure but also efficient in terms of usage of energy, storage, and processing. Although recently many lightweight schemes have been proposed, to the best of our knowledge, they are unable to address the problem of privacy preservation with the resistance of Denial of Service (DoS) attacks in a practical way. In this paper, we propose a lightweight authentication protocol based on the Physically Unclonable Function (PUF) to overcome the limitations of existing schemes. The protocol provides an ingenious authentication and synchronization mechanism to solve the contradictions amount forward secrecy, DoS attacks, and resource-constrained. The performance analysis and comparison show that the proposed scheme can better improve the authentication security and efficiency for resource-constrained systems in IIoT.     

Lattice-Based Authentication Scheme to Prevent Quantum Attack in Public Cloud Environment

Public cloud computing provides a variety of services to consumers via high-speed internet. The consumer can access these services anytime and anywhere on a balanced service cost. Many traditional authentication protocols are proposed to secure public cloud computing. However, the rapid development of high-speed internet and organizations’ race to develop quantum computers is a nightmare for existing authentication schemes. These traditional authentication protocols are based on factorization or discrete logarithm problems. As a result, traditional authentication protocols are vulnerable in the quantum computing era. Therefore, in this article, we have proposed an authentication protocol based on the lattice technique for public cloud computing to resist quantum attacks and prevent all known traditional security attacks. The proposed lattice-based authentication protocol is provably secure under the Real-Or-Random (ROR) model. At the same time, the result obtained during the experiments proved that our protocol is lightweight compared to the existing lattice-based authentication protocols, as listed in the performance analysis section. The comparative analysis shows that the protocol is suitable for practical implementation in a quantum-based environment.     

Cogent and Energy Efficient Authentication Protocol for WSN in IoT

Given the accelerating development of Internet of things (IoT), a secure and robust authentication mechanism is urgently required as a critical architectural component. The IoT has improved the quality of everyday life for numerous people in many ways. Owing to the predominantly wireless nature of the IoT, connected devices are more vulnerable to security threats compared to wired networks. User authentication is thus of utmost importance in terms of security on the IoT. Several authentication protocols have been proposed in recent years, but most prior schemes do not provide sufficient security for these wireless networks. To overcome the limitations of previous schemes, we propose an efficient and lightweight authentication scheme called the Cogent Biometric-Based Authentication Scheme (COBBAS). The proposed scheme is based on biometric data, and uses lightweight operations to enhance the efficiency of the network in terms of time, storage, and battery consumption. A formal security analysis of COBBAS using Burrows–Abadi–Needham logic proves that the proposed protocol provides secure mutual authentication. Formal security verification using the Automated Validation of Internet Security Protocols and Applications tool shows that the proposed protocol is safe against man-in-the-middle and replay attacks. Informal security analysis further shows that COBBAS protects wireless sensor networks against several security attacks such as password guessing, impersonation, stolen verifier attacks, denial-of-service attacks, and errors in biometric recognition. This protocol also provides user anonymity, confidentiality, integrity, and biometric recovery in acceptable time with reasonable computational cost.     

Assessing Secure OpenID-Based EAAA Protocol to Prevent MITM and Phishing Attacks in Web Apps

To secure web applications from Man-In-The-Middle (MITM) and phishing attacks is a challenging task nowadays. For this purpose, authentication protocol plays a vital role in web communication which securely transfers data from one party to another. This authentication works via OpenID, Kerberos, password authentication protocols, etc. However, there are still some limitations present in the reported security protocols. In this paper, the presented anticipated strategy secures both Web-based attacks by leveraging encoded emails and a novel password form pattern method. The proposed OpenID-based encrypted Email’s Authentication, Authorization, and Accounting (EAAA) protocol ensure security by relying on the email authenticity and a Special Secret Encrypted Alphanumeric String (SSEAS). This string is deployed on both the relying party and the email server, which is unique and trustworthy. The first authentication, OpenID Uniform Resource Locator (URL) identity, is performed on the identity provider side. A second authentication is carried out by the hidden Email’s server side and receives a third authentication link. This Email’s third SSEAS authentication link manages on the relying party (RP). Compared to existing cryptographic single sign-on protocols, the EAAA protocol ensures that an OpenID URL’s identity is secured from MITM and phishing attacks. This study manages two attacks such as MITM and phishing attacks and gives 339 ms response time which is higher than the already reported methods, such as Single Sign-On (SSO) and OpenID. The experimental sites were examined by 72 information technology (IT) specialists, who found that 88.89% of respondents successfully validated the user authorization provided to them via Email. The proposed EAAA protocol minimizes the higher-level risk of MITM and phishing attacks in an OpenID-based atmosphere.     

A privacy-preserving authentication protocol with secure handovers for the LTE/LTE-A networks

Long-Term Evolution/Long-Term Evolution Advanced (LTE/LTE-A) is the latest mobile communication technology that is offering high data rates and robust performance to the subscribers. Since LTE/LTE-A standards are established on the Internet Protocol (IP) connectivity and provide compatibility with the heterogeneous networks, these new features create availability of the new security challenges in the LTE/LTE-A networks. Taking into consideration the issues of serious signalling congestion and security loopholes in LTE/LTE-A networks, the authors propose an Efficient Authentication and Key Agreement Protocol for Evolved Packet System (EAKA-EPS) with secure handover procedures. The proposed protocol achieves outstanding results in terms of the optimization of computation and signalling overhead. With this, the protocol guarantees the needed security requirements like protected wireless interface and strong mutual authentication between the entities, and ensures access stratum secrecy at the time of handovers. The formal verification results of the proposed scheme over the security verification and simulation tool “Automated Validation of Internet Security Protocols and Applications (AVISPA)” show that the suggested protocol is safe against various malicious attacks, which are still possible in LTE/LTE-A networks. To the best of the authors’ knowledge, the suggested approach is the first approach that provides perfect secrecy with less computation and communication overhead in the LTE/LTE-A networks.     

An End-to-End Authentication Scheme for Healthcare IoT Systems Using WMSN

The healthcare internet of things (IoT) system has dramatically reshaped this important industry sector. This system employs the latest technology of IoT and wireless medical sensor networks to support the reliable connection of patients and healthcare providers. The goal is the remote monitoring of a patient’s physiological data by physicians. Moreover, this system can reduce the number and expenses of healthcare centers, make up for the shortage of healthcare centers in remote areas, enable consultation with expert physicians around the world, and increase the health awareness of communities. The major challenges that affect the rapid deployment and widespread acceptance of such a system are the weaknesses in the authentication process, which should maintain the privacy of patients, and the integrity of remote medical instructions. Current research results indicate the need of a flexible authentication scheme. This study proposes a scheme with enhanced security for healthcare IoT systems, called an end-to-end authentication scheme for healthcare IoT systems, that is, an E2EA. The proposed scheme supports security services such as a strong and flexible authentication process, simultaneous anonymity of the patient and physician, and perfect forward secrecy services. A security analysis based on formal and informal methods demonstrates that the proposed scheme can resist numerous security-related attacks. A comparison with related authentication schemes shows that the proposed scheme is efficient in terms of communication, computation, and storage, and therefore cannot only offer attractive security services but can reasonably be applied to healthcare IoT systems.     

一种具有用户匿名性和前向安全性的WTLS握手协议的安全性分析及其改进

对为实现用户匿名性和前向安全性的安全目标而提出的两种改进的WTLS握手协议——基于EC_DH密钥交换的握手协议和基于RSA密钥交换的握手协议进行了分析和研究,研究结果表明,基于RSA密钥交换的WTLS握手协议不能提供所预期的前向安全性。本文对该协议进行了改进,改进后的握手协议可以提供前向安全性。最后,对改进后的握手协议进行了简要的安全性与性能分析。     

Efficient Hierarchical Multi-Server Authentication Protocol for Mobile Cloud Computing

With the development of communication technologies, various mobile devices and different types of mobile services became available. The emergence of these services has brought great convenience to our lives. The multi-server architecture authentication protocols for mobile cloud computing were proposed to ensure the security and availability between mobile devices and mobile services. However, most of the protocols did not consider the case of hierarchical authentication. In the existing protocol, when a mobile user once registered at the registration center, he/she can successfully authenticate with all mobile service providers that are registered at the registration center, but real application scenarios are not like this. For some specific scenarios, some mobile service providers want to provide service only for particular users. For this reason, we propose a new hierarchical multi-server authentication protocol for mobile cloud computing. The proposed protocol ensures only particular types of users can successfully authenticate with certain types of mobile service providers. The proposed protocol reduces computing and communication costs by up to 42.6% and 54.2% compared to two superior protocols. The proposed protocol can also resist the attacks known so far.     

Secure Multifactor Remote Access User Authentication Framework for IoT Networks

The term IoT refers to the interconnection and exchange of data among devices/sensors. IoT devices are often small, low cost, and have limited resources. The IoT issues and challenges are growing increasingly. Security and privacy issues are among the most important concerns in IoT applications, such as smart buildings. Remote cybersecurity attacks are the attacks which do not require physical access to the IoT networks, where the attacker can remotely access and communicate with the IoT devices through a wireless communication channel. Thus, remote cybersecurity attacks are a significant threat. Emerging applications in smart environments such as smart buildings require remote access for both users and resources. Since the user/building communication channel is insecure, a lightweight and secure authentication protocol is required. In this paper, we propose a new secure remote user mutual authentication protocol based on transitory identities and multi-factor authentication for IoT smart building environment. The protocol ensures that only legitimate users can authenticate with smart building controllers in an anonymous, unlinkable, and untraceable manner. The protocol also avoids clock synchronization problem and can resist quantum computing attacks. The security of the protocol is evaluated using two different methods: (1) informal analysis; (2) model check using the automated validation of internet security protocols and applications (AVISPA) toolkit. The communication overhead and computational cost of the proposed are analyzed. The security and performance analysis show that our protocol is secure and efficient.     

Two-Stage High-Efficiency Encryption Key Update Scheme for LoRaWAN Based IoT Environment

Secure data communication is an essential requirement for an Internet of Things (IoT) system. Especially in Industrial Internet of Things (IIoT) and Internet of Medical Things (IoMT) systems, when important data are hacked, it may induce property loss or life hazard. Even though many IoT-related communication protocols are equipped with secure policies, they still have some security weaknesses in their IoT systems. LoRaWAN is one of the low power wide-area network protocols, and it adopts Advanced Encryption Standard (AES) to provide message integrity and confidentiality. However, LoRaWAN's encryption key update scheme can be further improved. In this paper, a Two-stage High-efficiency LoRaWAN encryption key Update Scheme (THUS for short) is proposed to update LoRaWAN's root keys and session keys in a secure and efficient way. The THUS consists of two stages, i.e., the Root Key Update (RKU) stage and the Session Key Update (SKU) stage, and with different update frequencies, the RKU and SKU provide higher security level than the normal LoRaWAN specification does. A modified AES encryption/decryption process is also utilized in the THUS for enhancing the security of the THUS. The security analyses demonstrate that the THUS not only protects important parameter during key update stages, but also satisfies confidentiality, integrity, and mutual authentication. Moreover, The THUS can further resist replay and eavesdropping attacks.     

条件接收系统中机顶盒和智能卡安全通信协议

提出了条件接收系统中智能卡和机顶盒安全通信的协议.协议使用了Schnorr身份方案实现机顶盒对智能卡的认证,并使用一个非对称密码系统实现智能卡对机顶盒的认证.协议最小化了智能卡的在线计算负担,同时保持与其它协议同样的安全水平.对协议的安全性和性能进行了分析.分析结果表明,协议对于恶意攻击是鲁棒的,并且非常适合于只有有限处理能力的智能卡.而且,协议为不同的条件接收系统使用同样的机顶盒提供了可能,因为在协议中机顶盒不需要事先存储任何条件接收系统的秘密私有数据.     

基于串空间理论的Kerberos协议安全性分析

在对串空间理论和Kerberos协议进行深入研究的基础上,采用串空间理论模型对Kerberos协议进行了安全性分析.分析的过程和结果证明,Kerberos协议满足串空间理论的认证性和服务器串随机数的秘密性,但不能保证发起者串随机数的秘密性,因此Kerberos协议能实现安全认证功能,但存在口令猜测攻击.针对此问题,对Kerberos协议进行改进,改进后的协议满足发起者串随机数秘密性,增强了抗口令猜测攻击的能力.     

基于Hash的RFID安全协议的设计

射频识别系统(RFID)由于运行在开放系统环境而存在诸多安全问题,针对各种安全隐患,在分析几种典型的安全协议的认证过程及优缺点的基础上,提出一种基于Hash的RFID安全协议的设计方法,该协议利用Hash函数的单向性及R、S参数的随机性,有效的实现了RFID系统的安全保护.该安全协议能有效的防止重放攻击、假冒攻击、窃听攻击和位置跟踪,具有前向安全,计算量低、成本低的特点,适合于大量射频标签的场合.     

基于SET协议的一种身份认证新模型

SET是电子商务中最有生命力的一种标准 ,也提出了一种最为完善的身份认证模型 ,但极其复杂 ,计算量过大 .本文通过引入身份标识码和支付期有效码等概念 ,提出了一种身份认证新模型 ,减少了计算量 ,且确保了信息的安全性、完整性和不可抵赖性     

一种新的轻量级的RFID认证协议(英文)

无线射频识别技术(RFID)有望在不久的将来取代条形码系统,它的信息存储量以及传输信息的能力相比条形码都有明显的优势。然而,由此引发的用户隐私入侵和系统安全威胁一直是用户日益关注的问题。由于其设备的资源受限,以及无法执行强加密算法,因此于RFID系统中安全协议的执行是一个极大的挑战。为此,近来许多认证协议已被提出以防止未经授权的定位跟踪、检测、假冒、克隆等。本文提出了一种新的有效的轻量级射频识别认证协议,对于某些应用,它已能提供足够的安全级别。该协议中标签只需执行hash和异或运算而阅读器和后台服务器承担大部分的运算量包括伪随机数的产生以及加解密的运算。相比于其他协议,我们实现了防止隐私泄露、伪装等安全攻击的特点,适合于低成本、低计算量的RFID系统。     

Beyond the Durfee square: Enhancing the h-index to score total publication output

An individual’s h-index corresponds to the number h of his/her papers that each has at least h citations. When the citation count of an article exceeds h, however, as is the case for the hundreds or even thousands of citations that accompany the most highly cited papers, no additional credit is given (these citations falling outside the so-called “Durfee square”). We propose a new bibliometric index, the “tapered h-index” (h _T), that positively enumerates all citations, yet scoring them on an equitable basis with h. The career progression of h _T and h are compared for six eminent scientists in contrasting fields. Calculated h _T for year 2006 ranged between 44.32 and 72.03, with a corresponding range in h of 26 to 44. We argue that the h _T-index is superior to h, both theoretically (it scores all citations), and because it shows smooth increases from year to year as compared with the irregular jumps seen in h. Conversely, the original h-index has the benefit of being conceptually easy to visualise. Qualitatively, the two indices show remarkable similarity (they are closely correlated), such that either can be applied with confidence. Sadly, after a long and distinguished career, Peter Killworth died on 28 Jan 2008.     

Privacy-Preserving Quantum Two-Party Geometric Intersection

Privacy-preserving computational geometry is the research area on the intersection of the domains of secure multi-party computation (SMC) and computational geometry. As an important field, the privacy-preserving geometric intersection (PGI) problem is when each of the multiple parties has a private geometric graph and seeks to determine whether their graphs intersect or not without revealing their private information. In this study, through representing Alice’s (Bob’s) private geometric graph G_A (G_B) as the set of numbered grids S_A (S_B), an efficient privacy-preserving quantum two-party geometric intersection (PQGI) protocol is proposed. In the protocol, the oracle operation O_A (O_B) is firstly utilized to encode the private elements of S_A =(a₀,a₁,…,a_M-1) (S_B =(b₀,b₁,…,b_N-1)) into the quantum states, and then the oracle operation O_f is applied to obtain a new quantum state which includes the XOR results between each element of S_A and S_B. Finally, the quantum counting is introduced to get the amount (t) of the states |a_i⊕b_j| equaling to |0|, and the intersection result can be obtained by judging t >0 or not. Compared with classical PGI protocols, our proposed protocol not only has higher security, but also holds lower communication complexity.     

Full-Blind Delegating Private Quantum Computation

The delegating private quantum computation (DQC) protocol with the universal quantum gate set {X,Z,H,P,R,CNOT} was firstly proposed by Broadbent et al. [Broadbent (2015)], and then Tan et al. [Tan and Zhou (2017)] tried to put forward a half-blind DQC protocol (HDQC) with another universal set {H,P,CNOT,T}. However, the decryption circuit of Toffoli gate (i.e. T) is a little redundant, and Tan et al.’s protocol [Tan and Zhou (2017)] exists the information leak. In addition, both of these two protocols just focus on the blindness of data (i.e. the client’s input and output), but do not consider the blindness of computation (i.e. the delegated quantum operation). For solving these problems, we propose a full-blind DQC protocol (FDQC) with quantum gate set {H,P,CNOT,T}, where the desirable delegated quantum operation, one of {H,P,CNOT,T}, is replaced by a fixed sequence (H,P,CZ,CNOT,T) to make the computation blind, and the decryption circuit of Toffoli gate is also optimized. Analysis shows that our protocol can not only correctly perform any delegated quantum computation, but also holds the characteristics of data blindness and computation blindness.     

Quantum Secure Direct Communication Protocol with Mutual Authentication Based on Single Photons and Bell States

Quantum secure direct communication (QSDC) can transmit secret messages directly from one user to another without first establishing a shared secret key, which is different from quantum key distribution. In this paper, we propose a novel quantum secure direct communication protocol based on signal photons and Bell states. Before the execution of the proposed protocol, two participants Alice and Bob exchange their corresponding identity IDA and IDB through quantum key distribution and keep them secret, respectively. Then the message sender, Alice, encodes each secret message bit into two single photons (| 01〉or|10〉) or a Bell state , and composes an ordered secret message sequence. To insure the security of communication, Alice also prepares the decoy photons and inserts them into secret message sequence on the basis of the values of IDA and IDB. By the secret identity IDA and IDB, both sides of the communication can check eavesdropping and identify each other. The proposed protocol not only completes secure direct communication, but also realizes the mutual authentication. The security analysis of the proposed protocol is presented in the paper. The analysis results show that this protocol is secure against some common attacks, and no secret message leaks even if the messages are broken. Compared with the two-way QSDC protocols, the presented protocol is a one-way quantum communication protocol which has the immunity to Trojan horse attack. Furthermore, our proposed protocol can be realized without quantum memory.