Efficient medium access protocol for Internet of things applications

The recent progresses made in microelectronics and sensor networks led to the emergence of a new family of networks called Internet of things (IoT). Several factors may degrade seriously IoT applications performance and prevent the connected objects to accomplish out their services. One factor is the inability of medium access control (MAC) protocol, namely, DCF 802.11 function, to distinguish between different sources of frame losses. To address this problem, we propose in this article an improvement called MAC protocol with distinction between data losses (MAC‐DL), which consists mainly to consider the different sources of frame losses in the functioning of the backoff algorithm. After the evaluation of MAC‐DL performance, the results showed a better performance compared with MAC protocol with the original DCF 802.11 function and to 2 other protocols proposed in the literature. Our solution improved significantly the quality of service and the energy efficient for typical IoT scenarios.     

Efficient authentication scheme for double-layer satellite network

To solve the issue of networking authentication among GEO and LEO satellites in double-layer satellite network,a secure and efficient authenticated key agreement scheme was proposed.Based on symmetric encryption,the proposed scheme can achieve trust establishment and secure communication between satellites without the trusted third party.Meanwhile,considering characteristics of highly unified clock and predictable satellite trajectory in satellite networks,a pre-calculation method was designed,which can effectively improve the authentication efficiency of satellite networking.Moreover,formal proof and security analysis demonstrate that the scheme can satisfy various security requirements during satellite networking.Performance analysis and simulation results show that the scheme has low computation and communication overhead,which can achieve the authentication of satellite networking in resource-limited scenarios.     

Secure multi‐factor remote user authentication scheme for Internet of Things environments

Because of the exponential growth of Internet of Things (IoT), several services are being developed. These services can be accessed through smart gadgets by the user at any place, every time and anywhere. This makes security and privacy central to IoT environments. In this paper, we propose a lightweight, robust, and multi‐factor remote user authentication and key agreement scheme for IoT environments. Using this protocol, any authorized user can access and gather real‐time sensor data from the IoT nodes. Before gaining access to any IoT node, the user must first get authenticated by the gateway node as well as the IoT node. The proposed protocol is based on XOR and hash operations, and includes: (i) a 3‐factor authentication (ie, password, biometrics, and smart device); (ii) mutual authentication ; (iii) shared session key ; and (iv) key freshness . It satisfies desirable security attributes and maintains acceptable efficiency in terms of the computational overheads for resource constrained IoT environment. Further, the informal and formal security analysis using AVISPA proves security strength of the protocol and its robustness against all possible security threats. Simulation results also prove that the scheme is secure against attacks.     

Security and key management in IoT‐based wireless sensor networks: An authentication protocol using symmetric key

Wireless sensor networks (WSN) consist of hundreds of miniature sensor nodes to sense various events in the surrounding environment and report back to the base station. Sensor networks are at the base of internet of things (IoT) and smart computing applications where a function is performed as a result of sensed event or information. However, in resource‐limited WSN authenticating a remote user is a vital security concern. Recently, researchers put forth various authentication protocols to address different security issues. Gope et al presented a protocol claiming resistance against known attacks. A thorough analysis of their protocol shows that it is vulnerable to user traceability, stolen verifier, and denial of service (DoS) attacks. In this article, an enhanced symmetric key‐based authentication protocol for IoT‐based WSN has been presented. The proposed protocol has the ability to counter user traceability, stolen verifier, and DoS attacks. Furthermore, the proposed protocol has been simulated and verified using Proverif and BAN logic. The proposed protocol has the same communication cost as the baseline protocol; however, in computation cost, it has 52.63% efficiency as compared with the baseline protocol.     

一种RFID系统的Tag-Reader双向安全认证协议

为了保证RFID系统的信息安全,本文在分析现有RFID认证协议的基础上,提出一种基于Grain-Mac流密码加密算法的双向安全认证协议,采用流密码和密钥动态更新的方法实现了标签与阅读器的双向认证。仿真结果表明,该协议成本低、效率高、安全性好,且能够有效抵抗拒绝服务攻击,达到了预期的效果。     

RFID匿名认证协议的设计

在分析RFID协议安全需求的基础上,基于通用可组合安全模型,设计了一个低成本的RFID匿名认证协议,在标准模型下证明了RFID匿名认证协议的安全性.设计的协议提供匿名、双向认证和并发安全,并且协议的实现对于一般的RFID结构都是切实可行的.     

A lightweight anonymous two‐factor authentication protocol for wireless sensor networks in Internet of Vehicles

Internet of Vehicles (IoV), as the next generation of transportation systems, tries to make highway and public transportation more secure than used to be. In this system, users use public channels for their communication so they can be the victims of passive or active attacks. Therefore, a secure authentication protocol is essential for IoV; consequently, many protocols are presented to provide secure authentication for IoV. In 2018, Yu et al proposed a secure authentication protocol for WSNs in vehicular communications and claimed that their protocol could satisfy all crucial security features of a secure authentication protocol. Unfortunately, we found that their protocol is susceptible to sensor capture attack, user traceability attack, user impersonation attack, and offline sink node's secret key guessing attack. In this paper, we propose a new authentication protocol for IoV which can solve the weaknesses of Yu et al's protocol. Our protocol not only provides anonymous user registration phase and revocation smart card phase but also uses the biometric template in place of the password. We use both Burrow‐Abadi‐Needham (BAN) logic and real‐or‐random (ROR) model to present the formal analysis of our protocol. Finally, we compare our protocol with other existing related protocols in terms of security features and computation overhead. The results prove that our protocol can provide more security features and it is usable for IoV system.     

基于SIM卡的移动互联网应用鉴权研究

智能终端的普及和移动互联网的迅速发展极大地改变了通信服务产业链。面对移动互联网行业,SIM卡作为天然的鉴权工具却无法发挥其优势。我们希望探索一种基于SIM卡的移动互联网应用鉴权机制,利用SIM卡现有能力,将SIM卡通信鉴权的便利性带到移动互联网的应用鉴权中,使用户享受更安全便捷,无感知的应用鉴权方式,同时为众多移动互联网应用提供开放性的平台化接入服务。     

轻型的RFID安全认证协议LAP

RFID标签存在着处理能力弱、存储空间小和电源供给有限等局限性,传统的公钥算法或散列函数等复杂运算不能满足实际应用的需求。针对现有轻量级RFID认证协议的不足,设计了基于广义逆矩阵的RFID安全认证协议LAP。该协议采用了硬件复杂度较低的CRC校验及计算量较小的矩阵运算。通过安全隐私和性能分析,LAP协议适用于低成本、存储与计算受限的RFID标签。     

标准模型下可证明安全的RFID双向认证协议

目前RFID(radio frequency identification)系统安全问题日益突出,为了实现RFID系统信息安全与隐私保护,在标准模型提出了一个基于HB协议的RFID双向安全认证协议。利用规约技术证明协议的安全性,将攻击者的困难规约到伪随机函数与真正随机函数的不可区分性上。协议仅使用轻量级的伪随机发生器以及向量点乘运算,具有较高的安全性和效率。通过从安全性及性能两方面与其他认证协议进行比较,表明协议适用于低成本及存储资源受限的RFID标签。     

ATM网络自愈恢复椭圆搜索

本文在分析ＡＴＭ网络自愈恢复搜索基础上，提出一种减少无用搜索消息范围的椭圆搜索算法。并对自愈恢复过程进行计算机模拟，结果表明：椭圆搜索比单向搜索和双向搜索的无用搜索消息范围小，影响的节点数少，范围大小可以合理设置。所花费的代价是：必须在每个节点中建立一个最小搜索范围表。     

基于博弈论的身份认证协议的分析——NGUYEN L H方案的改进

NGUYEN L H在博弈论思想的指导下来对身份认证协议进行了修改,协议参与方在进行协议交互之前以一定的概率α来发送无用数据,使得攻击者攻击协议所获得的收益比不攻击协议所获得的收益还要小,以此保证了协议的安全性。但该方案存在2个缺陷：考虑的攻击者过于强大,且仅仅考虑了其收益,忽略了其发起攻击所要消耗的代价;没有考虑诚实节点在什么条件下才会选择发送无用数据。针对这2个缺陷对NGUYEN L H方案进行改进,给出了更具有一般意义的α值。同时引入了攻击概率β,给出了诚实节点发送无用数据的前提条件以及在不同的β值下α的取值范围。相对于原方案,改进方案的结论更具有一般性,且更全面。同时,通过 P2P下面的一个具体案例分析证明了所提结论的正确性。     

Openstack authentication protocol based on digital certificate

As the industry standard for open source cloud platforms,openstack uses the single-factor authentication method based on username and password that provides by keystone components to identity authentication mechanism,while it is not suitable for application scenarios with high security level requirements.A digital certificate-based identity authentication protocol which had cloud user identification protocol and authentication protocol was designed to meet the requirements.With expending the keystone component to achieve a digital certificate-based identity authentication system,a combination of authentication server,UKey technology,encryption technology and well-established key management and so on was used.According to the research,the system can effectively resist multiple cyber-attacks and improve the security of cloud users when they log in to the cloud platform.     

探究物联网中轻量级IPv6协议的研究与应用

为了适应网络的发展要求,将轻量级IPv6技术融入到物联网中,不仅可以解决物联网中节点寻址与通讯的问题,还能够在客观上解决大规模物联网地址不足、缺乏应有的安全机制等问题。在现阶段的研究中,物联网是一个非常庞大的网络,要想在客观上和主观上实现较为理想的运行效果,应积极应用轻量级IPv6协议,该协议可以从多个角度来解释,并且能够融入较多的技术和内容,以此来巩固物联网的发展成果,为我国的经济建设和社会建设,做出更大的努力。综合多方面的信息来看,现阶段的物联网研究,轻量级IPv6协议成为了一项比较重要的内容,今后还需要深入探讨。     

A mutual authentication and privacy mechanism for WLAN security

IEEE 802.11 wireless local area networks (WLAN) has been increasingly deployed in various locations because of the convenience of wireless communication and decreasing costs of the underlying technology. However, the existing security mechanisms in wireless communication are vulnerable to be attacked and seriously threat the data authentication and confidentiality. In this paper, we mainly focus on two issues. First, the vulnerabilities of security protocols specified in IEEE 802.11 and 802.1X standards are analyzed in detail. Second, a new mutual authentication and privacy scheme for WLAN is proposed to address these security issues. The proposed scheme improves the security mechanisms of IEEE 802.11 and 802.1X by providing a mandatory mutual authentication mechanism between mobile station and access point (AP) based on public key infrastructure (PKI), offering data integrity check and improving data confidentiality with symmetric cipher block chain (CBC) encryption. In addition, this scheme also provides some other new security mechanisms, such as dynamic session key negotiation and multicast key notification. Hence, with these new security mechanisms, it should be much more secure than the original security scheme. Copyright © 2006 John Wiley & Sons, Ltd.     

一种基于散列函数的RFID安全认证方法

RFID系统中有限的标签芯片资源,导致数据与信息的安全成为RFID系统的重要问题之一,散列函数的单向性为RFID的识别和认证提供了一种既可靠又有效的途径.在分析了现有几种典型散列认证协议的基础上,提出了一种新的基于散列函数的安全认证协议.本协议旨在解决手持式、无线连接的RFID阅读器与标签、服务器间的识别,利用散列函数实现服务器、阅读器以及电子标签三者之间的相互认证.经过安全性与性能的分析,新协议在采用较小的存储空间和较低的运算开销的情况下,可抵抗已知的大多数攻击,有效地保证了RFID系统中数据和隐私的安全,实现了终端与服务器间的双向认证和匿名认证,非常适合于在大型分布式系统中使用.     

交互式动态网站中的用户安全认证

主要介绍了在交互式动态网站中Http协议的特点和缺陷，阐述了PHP中Session技术的工作方式，在PHP中设计实现了身份认证，并利用Session克服了HTTP协议的缺陷，又防止了信息的泄露，这种机制思想简单，易于实现，而且方便了编程者的使用，是一个比较好的解决方案。     

协议组合逻辑安全的4G无线网络接入认证方案

针对4G无线网络中移动终端的接入认证问题,基于自证实公钥系统设计了新的安全接入认证方案,并运用协议演绎系统演示了该方案形成的过程和步骤,用协议组合逻辑对该方案的安全属性进行了形式化证明.通过安全性证明和综合分析,表明该方案具有会话认证性和密钥机密性,能抵御伪基站攻击和重放攻击,并能提供不可否认服务和身份隐私性,同时提高了移动终端的接入效率     

Lightweight authentication protocol for e-health clouds in IoT-based applications through 5G technology

Modern information technology has been utilized progressively to store and distribute a large amount of healthcare data to reduce costs and improve medical facilities. In this context, the emergence of e-Health clouds offers novel opportunities, like easy and remote accessibility of medical data. However, this achievement produces plenty of new risks and challenges like how to provide integrity, security, and confidentiality to the highly susceptible e-Health data. Among these challenges, authentication is a major issue that ensures that the susceptible medical data in clouds is not available to illegal participants. The smart card, password and biometrics are three factors of authentication which fulfill the requirement of giving high security. Numerous three-factor ECC-based authentication protocols on e-Health clouds have been presented so far. However, most of the protocols have serious security flaws and produce high computation and communication overheads. Therefore, we introduce a novel protocol for the e-Health cloud, which thwarts some major attacks, such as user anonymity, offline password guessing, impersonation, and stolen smart card attacks. Moreover, we evaluate our protocol through formal security analysis using the Random Oracle Model (ROM). The analysis shows that our proposed protocol is more efficient than many existing protocols in terms of computation and communication costs. Thus, our proposed protocol is proved to be more efficient, robust and secure.     

基于802.1x/EAP的WLAN安全认证机制

目前飞机与地面机场之间WLAN的应用部署日益广泛，但对其安全接入通信却没有提过较为合理的设计和规划，由WLAN引起的安全漏洞给飞机与地面之间信息传递带来很大的隐患。主要介绍EAP认证方法以及基于802.1x/EAP无线局域网的安全认证机制。