基于相邻区域协作的轻量级无线传感器网络安全认证协议

为资源受限的无线传感器网络节点提供秘钥认证方案是一项具有挑战性的工作。文章提出了一种轻量级的基于相邻区域协作的无线传感器网络安全认证协议,采用对称密钥加密技术以及密钥预分配的策略。每个节点只需要发送两条广播信息,即可完成对网络的密钥分配任务从而达到高效节能的目的。通过与其他传统的安全认证协议进行比较分析可以看出,我们的秘钥分配方案在安全认证、抵御重放攻击以及节能等方面更具优势。     

基于智能卡和密码保护的WSN远程用户安全认证方案

针对无线传感器网络（WSN）用户远程安全认证问题,分析现有方案的不足,提出一种新颖的基于智能卡的WSN远程用户认证方案。通过用户、网关节点和传感器节点之间的相互认证来验证用户和节点的合法性,并结合动态身份标识来抵抗假冒攻击、智能卡被盗攻击、服务拒绝攻击、字典攻击和重放攻击。同时对用户信息进行匿名保护,且用户能够任意修改密码。性能比较结果表明,该方案具有较高的安全性能,且具有较小的计算开销。     

结合双线性对和DLP的无证书两方认证协议

为解决无线通信网络中不同用户之间的通信安全问题,通常会采用身份认证协议来确保通信双方身份的合法性。该认证协议应能抵抗重放攻击、延时攻击等威胁,同时认证过程中的计算量应尽量小。本文针对SEAHA (secure and efficient handover authentication)认证方案存在的计算量大、不能抵抗伪装攻击的问题提出了一种基于双线性对和离散对数难题（DLP）的无证书两方认证协议。该协议中基站和节点共同生成节点密钥对来抵抗伪装攻击,利用离散对数难题生成会话密钥降低认证过程中的计算量。安全分析和性能分析结果表明,提出协议在保证安全性的前提下,有效降低了认证过程计算量。      

基于Tinyos的低功耗MAC协议研究

由于无线传感器网络中的能量有限的特性,所以降低节点能耗,延长网络寿命在无线传感器网络中显得十分重要。低功耗的无线传感器网络协议,是无线传感器网络在应用中的一项重要技术。本文从无线传感器网络能耗方面出发,对BMAC、XMAC的优缺点进行了详细分析、提出了一个改进,并且基于Tinyos平台进行了实验,验证了低功耗协议良好的能耗特性。     

针对虫洞攻击的无线传感器网络安全定位方法

节点定位技术是无线传感器网络的关键技术之一,是很多基于无线传感器网络的应用的基础。然而,无线传感器网络通常部署在无人值守的敌对环境中,攻击节点能够很容易地破坏网络中节点的定位过程。本文针对无线传感器网络中距离无关的定位技术,分析了虫洞攻击对DV-Hop定位过程的影响,提出了一种无线传感器网络中抵御虫洞攻击的DV-Hop安全定位方法。仿真结果表明所提出的安全定位方法能够有效降低虫洞攻击对DV-Hop定位过程的影响,验证了该方法的有效性。     

WSNs中基于三因素节点评估的安全认证方案

为了减少传感器节点的资源利用并提高网络的安全性,提出了一种基于信任度的认证方案。该方案在计算节点信任度时引入时间片、安全行动系数和交互频度来计算节点信任度,这样使得自私节点很难伪装成正常节点,信任度与当前节点行为紧密相关,并防止节点通过很少的交易次数来达到较高的信任度,再利用信任度来判断一个节点是否可信,有效地提高了应用的安全性,对恶意节点的攻击起到一定的阻碍作用。然后设计了身份标识、密码、智能卡相结合的认证方案,并且用户在与传感器节点认证之前,网关查询网络中节点的信任度,从而找到可信的节点与用户进行认证,实现可信的传感器节点、网关节点和用户三者之间的交互认证,并且用户能方便地更改密码。安全性分析、性能分析及仿真实验的结果表明,与已提出的认证方案相比,该方案能够抵制重放攻击、内部攻击、伪装攻击等,同时计算花费少,适合于对安全性和性能有要求的无线传感器网络。本文网络版地址：http：//www.eepw.com.cn/article/276364.htm     

传感器编码网络广播认证协议研究

广播认证技术能抵御污染攻击,保障传感器编码网络广播通信安全。但由于网络资源受限,广播认证技术所引入的计算量使得网络又易遭受拒绝服务攻击。为了有效抵御污染攻击与拒绝服务攻击,并兼顾网络安全性与时间延迟,本文以节点遭受污染攻击概率为决策因子,采用博弈论的思想研究广播认证协议。首先考察安全传感器编码网络中中间节点的策略行为,归纳与总结典型的广播认证协议模式;针对广播认证协议模式选择中存在的两次博弈过程,研究先转发策略、先认证策略与先聚合策略,对各策略的博弈成本/收益进行量化;构造广播认证协议二阶段博弈模型,博弈的纳什均衡即为节点应选择的广播认证协议模式。实例分析验证了各策略成本/收益量化及博弈模型的有效性。      

基于内容的无线传感器网络路由协议

针对无线传感器网络环境下低功耗路由问题,根据无线传感器网络是一种以数据为中心的网络的特点,提出了一种基于内容的低功耗路由协议CBP。其基本思想是:Sink节点根据上层应用构造谓词,并对谓词进行广播,网络中所有传感节点以Sink节点的谓词为依据建立路由表,实现数据路由。与现有无线传感器网络路由协议相比较,此路由协议具有低功耗,占用节点资源少,网络容错能力强等特点。仿真结果表明,在节点数量大于100的大规模网络中,基于内容的无线传感器网络路由协议功耗比定向扩散协议功耗降低19%。     

WSN中基于身份的高效多播认证协议

分析了无线传感器网络中已有多播认证协议的不足,给出了基于PKC的WSN安全协议研究进展,并提出一种基于身份的高效多播认证协议.该协议具有消息恢复功能,可有效缩短签名长度,减少协议的通信和计算开销,克服公钥密码体制开销大的缺点.在随机预言模型下证明了协议在适应性选择消息攻击和身份攻击下是存在性不可伪造的.最后,基于MICA2DOT无线传感器网络节点对协议的能量消耗进行了定量分析,结果表明,本协议的性能优于HESS、Zhang和BLS等协议,能更好地适用于资源受限的WSN环境.     

无线传感器网络中一种基于共享密钥的节点鉴别机制

在无线传感器网络中,信息的传输需要保证通信双方的节点是本次通信的节点,而不是网络中的其他节点或者一些恶意节点,这就需要对通信双方的身份进行身份鉴别。提出了一种基于共享密钥的节点鉴别机制,实现了网内节点间在通信前确认彼此身份的合法性和有效性。分析表明,该方案有效抵御了传感器网络中一些常见的安全威胁,例如女巫攻击等。同时,该方案还具有很强的攻击容忍性。     

无线传感器网络节点复制攻击和女巫攻击防御机制研究

在无线传感器网络(WSNs)中,节点复制攻击和女巫攻击可扰乱数据融合和阈值选举等网络操作.发起这两种攻击需先通过邻居发现认证过程.考虑到在WSNs中发起邻居认证是不频繁的,提出了一种基于单向密钥链的ID认证防御机制(OKCIDA),降低攻击者在任何时间段发起这两种攻击的可能性.然后基于椭圆曲线离散对数问题,构造对称参数,并组合OKCIDA和利用节点邻居关系,提出了一种无需位置的邻居认证协议(LFNA),以阻止复制节点和女巫节点成功加入网络.最后给出了安全性证明和分析,并在安全和开销方面将LFNA与已有典型防御方案进行了比较,结果表明该方案具有一定的优势.     

A Robust Mutual Authentication Protocol for Wireless Sensor Networks

Authentication is an important service in wireless sensor networks (WSNs) for an unattended environment. Recently, Das proposed a hash‐based authentication protocol for WSNs, which provides more security against the masquerade, stolen‐verifier, replay, and guessing attacks and avoids the threat which comes with having many logged‐in users with the same login‐id. In this paper, we point out one security weakness of Das' protocol in mutual authentication for WSN's preservation between users, gateway‐node, and sensor nodes. To remedy the problem, this paper provides a secrecy improvement over Das' protocol to ensure that a legal user can exercise a WSN in an insecure environment. Furthermore, by presenting the comparisons of security, computation and communication costs, and performances with the related protocols, the proposed protocol is shown to be suitable for higher security WSNs.     

A lightweight anonymous two‐factor authentication protocol for wireless sensor networks in Internet of Vehicles

Internet of Vehicles (IoV), as the next generation of transportation systems, tries to make highway and public transportation more secure than used to be. In this system, users use public channels for their communication so they can be the victims of passive or active attacks. Therefore, a secure authentication protocol is essential for IoV; consequently, many protocols are presented to provide secure authentication for IoV. In 2018, Yu et al proposed a secure authentication protocol for WSNs in vehicular communications and claimed that their protocol could satisfy all crucial security features of a secure authentication protocol. Unfortunately, we found that their protocol is susceptible to sensor capture attack, user traceability attack, user impersonation attack, and offline sink node's secret key guessing attack. In this paper, we propose a new authentication protocol for IoV which can solve the weaknesses of Yu et al's protocol. Our protocol not only provides anonymous user registration phase and revocation smart card phase but also uses the biometric template in place of the password. We use both Burrow‐Abadi‐Needham (BAN) logic and real‐or‐random (ROR) model to present the formal analysis of our protocol. Finally, we compare our protocol with other existing related protocols in terms of security features and computation overhead. The results prove that our protocol can provide more security features and it is usable for IoV system.     

A New Lightweight User Authentication and Key Agreement Scheme for WSN

The Internet of Things (IoT) is one of the most up-to-date and newest technologies that allows remote control of heterogeneous networks and has a good outlook for industrial applications. Wireless sensor networks (or in brief WSNs) have a key role on the Internet of industrial objects. Due to the limited resources of the sensor nodes, designing a balanced authentication scheme to provide security in reasonable performance in wireless sensor networks is a major challenge in these applications. So far, several security schemes have been presented in this context, but unfortunately, none of these schemes have provided desired security in reasonable cost. In 2017, Khemissa et al. proposed a security protocol for mutual authentication between sensor node and user in WSNs, however, in this paper we show that this protocol is not safe enough in the confrontation of desynchronization, user impersonation and gateway impersonation attacks. The proposed attacks succeed with the probability of one and to be realized only require an execution of the protocol. Given merits of the Khemissa et al.’s protocol, we also improved their protocol in such a way that provides suitable level of security, and also we prove its security using two formal ways, i.e. BAN logic and also the Scyther tool. We also argue informally about the improved protocol’s security.

     

Cryptanalysis of smart‐card‐based password authenticated key agreement protocol for session initiation protocol of Zhang et al.

As the core signaling protocol for multimedia services, such as voice over internet protocol, the session initiation protocol (SIP) is receiving much attention and its security is becoming increasingly important. It is critical to develop a roust user authentication protocol for SIP. The original authentication protocol is not strong enough to provide acceptable security level, and a number of authentication protocols have been proposed to strengthen the security. Recently, Zhang et al. proposed an efficient and flexible smart‐card‐based password authenticated key agreement protocol for SIP. They claimed that the protocol enjoys many unique properties and can withstand various attacks. However, we demonstrate that the scheme by Zhang et al. is insecure against the malicious insider impersonation attack. Specifically, a malicious user can impersonate other users registered with the same server. We also proposed an effective fix to remedy the flaw, which remedies the security flaw without sacrificing the efficiency. The lesson learned is that the authenticators must be closely coupled with the identity, and we should prevent the identity from being separated from the authenticators in the future design of two‐factor authentication protocols. Copyright © 2014 John Wiley & Sons, Ltd.     

On the design of secure user authenticated key management scheme for multigateway‐based wireless sensor networks using ECC

In wireless sensor networks (WSNs), there are many critical applications (for example, healthcare, vehicle tracking, and battlefield), where the online streaming data generated from different sensor nodes need to be analyzed with respect to quick control decisions. However, as the data generated by these sensor nodes usually flow through open channel, so there are higher chances of various types of attacks either on the nodes or on to the data captured by these nodes. In this paper, we aim to design a new elliptic curve cryptography–based user authenticated key agreement protocol in a hierarchical WSN so that a legal user can only access the streaming data from generated from different sensor nodes. The proposed scheme is based upon 3‐factor authentication, as it applies smart card, password, and personal biometrics of a user (for ticket generation). The proposed scheme maintains low computation cost for resource‐constrained sensor nodes, as it uses efficient 1‐way cryptographic hash function and bitwise exclusive‐OR operations for secure key establishment between different sensor nodes. The security analysis using the broadly accepted Burrows‐Abadi‐Needham logic, formal security verification using the popular simulation tool (automated validation of Internet security protocols and applications), and informal security show that the proposed scheme is resilient against several well‐known attacks needed for a user authentication scheme in WSNs. The comparison of security and functionality requirements, communication and computation costs of the proposed scheme, and other related existing user authentication schemes shows the superior performance of the proposed scheme.     

An enhanced bilinear pairing based authenticated key agreement protocol for multiserver environment

To circumvent using of multiple single servers, the theory of multiserver communication exists and numerous authentication protocols put forward for providing secure communication. Very recently, Amin‐Biswas proposes bilinear pairing–based multiserver scheme by describing some security pitfalls of Hsieh‐Leu protocol and claims that it is secured against related security threats. However, this paper claims that Amin‐Biswas protocol is still susceptible to off‐line identity and password guessing attack, user untraceability attack, and server masquerading attack. The cryptographic protocol should be attacks‐free for real‐time application. To achieve attacks‐free security, we put forward smart card–based multiserver authentication protocol by using the concept of bilinear pairing operation. The formal method strand space model has been used to prove the correctness of the proposed scheme. Additionally, rigorous security analysis ensures pliability of common security threats. The performance and security features of our scheme are also compared with that of the similar existing schemes. The comparison results show that our protocol achieves more security features with less complexity.     

Access control in wireless sensor networks

Nodes in a sensor network may be lost due to power exhaustion or malicious attacks. To extend the lifetime of the sensor network, new node deployment is necessary. In military scenarios, adversaries may directly deploy malicious nodes or manipulate existing nodes to introduce malicious “new” nodes through many kinds of attacks. To prevent malicious nodes from joining the sensor network, access control is required in the design of sensor network protocols. In this paper, we propose an access control protocol based on Elliptic Curve Cryptography (ECC) for sensor networks. Our access control protocol accomplishes node authentication and key establishment for new nodes. Different from conventional authentication methods based on the node identity, our access control protocol includes both the node identity and the node bootstrapping time into the authentication procedure. Hence our access control protocol cannot only identify the identity of each node but also differentiate between old nodes and new nodes. In addition, each new node can establish shared keys with its neighbors during the node authentication procedure. Compared with conventional sensor network security solutions, our access control protocol can defend against most well-recognized attacks in sensor networks, and achieve better computation and communication performance due to the more efficient algorithms based on ECC than those based on RSA.     

A Robust User Authentication Scheme Using Dynamic Identity in Wireless Sensor Networks

In modern, wireless sensor networks (WSNs) stand for the next evolutionary and innovative development step in utilities, industrial, building, home, shipboard, and transportation systems automation. The feature of WSNs is easy to deploy and has wide range of applications. Therefore, in distributed and unattended locations, WSNs are deployed to allow a legitimated user to login to the network and access data. Consequently, the authentication between users and sensor nodes has become one of the important security issues. In 2009, M. L. Das proposed a two-factor authentication for WSNs. Based on one-way hash function and exclusive-OR operation, the scheme is well-suited for resource constrained environments. Later, Khan and Algahathbar pointed out the flaws and vulnerabilities of Das’s scheme and proposed an alternative scheme. However, Vaidya et al. found that both Das’s and Khan–Algahathbar’s schemes are vulnerable to various attacks including stolen smart card attacks. Further, Vaidya et al. proposed an improved two-factor user authentication to overcome the security weakness of both schemes. In this paper, we show that Vaidya et al.’s scheme still exposes to a malicious insider attack that seriously threatens the security of WSNs. Furthermore, we propose an improve scheme that mends those vulnerabilities.     

Secure-AKA: An Efficient AKA Protocol for UMTS Networks

In this paper, we propose an improved and efficient authentication and key agreement (AKA) protocol named “Secure-AKA” to prevent Universal Mobile Telecommunication System (UMTS) network from various attacks like man-in-the-middle attack, redirection attack, replay attack, active attacks in the corrupted UMTS networks, and especially denial of service attack. This protocol completely eliminates the need of counter synchronization between a mobile station and its home network, and protects the actual identity of each user over the network by generating a temporary identity during the authentication. The Secure-AKA protocol generates minimum communication and computation overheads as compared to UMTS-AKA, S-AKA, AP-AKA, EURASIP-AKA, COCKTAIL-AKA, X-AKA, and EXT-AKA protocols. On an average, Secure-AKA protocol reduces 65 % of the bandwidth consumption during the authentication process in comparison to UMTS-AKA, which is the maximum reduction of bandwidth by any AKA protocol referred in the paper.