Search

Vehicular Ad Hoc Network (VANET) and Internet of Vehicle (IoV) technologies are particularly attracting attention from industrial communities because of the intelligent transportation systems of smart city technologies. Vehicle-to-vehicle (V2V) communication of VANET can guarantee traffic system management and road safety. However, V2V communication cannot manage many vehicles as a whole, so it needs to be segmented and communicated by region. Therefore, considering locality, key agreement is made for V2V communication of the same or different regions. Moreover, traditional public key infrastructure (PKI) and Kerberos systems to be applied in a real environment incur computational overhead. Therefore, we proposed a lightweight protocol for dynamic properties of vehicles for regional segmentation management and overhead resolution. In addition, because vehicle information is transmitted through public channels, our protocol uses mutual authentication and honey_list technology to ensure security against a variety of attacks. It provides verification of safety through a detailed security analysis using the formal analysis using the widely-accepted Real-Or-Random (ROR) model, and verifies formal security using the Automated Validation of Internet Security Protocols and Applications (AVISPA) software tool and non-mathematical (informal) security analysis. In addition, a detailed comparative study that the proposed scheme can be applied in the communication environment between actual vehicles as compared to other existing competing schemes.

Internet of Things (IoT) devices are becoming ubiquitous, and may be arranged to form formal or ad hoc Command and Control (C2) networks. Such networks typically do not have a mechanism to facilitate the sharing of either data or control inputs. This paper examines this problem in the context of IoT devices operating within C2 systems which do not have a trusted relationship with each other. We propose a solution which we call syndication, to provide a controlled mechanism to share data between C2 systems of devices without a fully trusted relationship. This paper builds upon previous work which established a lightweight protocol for secure C2 operations within the IoT. Using the proposed approach enables not only sharing of data but also permits the external controller to submit moderated requests for actions to be performed. The paper concludes by examining how this approach could also be adopted to provide secure guest access to connected systems in a domestic or commercial context.

The Internet of Things (IoT) is increasingly being used in applications ranging from precision agriculture to critical national infrastructure by deploying a large number of resource-constrained devices in hostile environments. These devices are being exploited to launch attacks in cyber systems. As a result, security has become a significant concern in the design of IoT-based applications. In this article, we present a security architecture for IoT networks by leveraging the underlying features supported by software-defined networks (SDNs). Our security architecture not only restricts network access to authenticated IoT devices but also enforces fine granular policies to secure the flows in the IoT network infrastructure. The authentication is achieved using a lightweight protocol to authenticate IoT devices. Authorization is achieved using a dynamic policy driven approach. Such an integrated security approach involving authentication of IoT devices and enables authorized flows to protect IoT networks from malicious IoT devices and attacks. We have implemented and validated our architecture using ONOS SDN Controller and Raspbian Virtual Machines, and demonstrated how the proposed security mechanisms can counteract malware packet injection, DDoS attacks using Mirai, spoofing/masquerading, and man-in-the-middle attacks. An analysis of the security and performance of the proposed security mechanisms and their applications is presented in this article.

The communication security of constrained objects such as radio frequency identification (RFID) tags and wireless sensor network (WSN) is very challenging because it is not always possible to use the conventional on-the-shelf solutions for them, due to their limited available power and computational capabilities. To deal with this demand, many security protocols have been developed by the researchers so far. However, in many cases, the later analyses that have been carried out on these protocols have shown that they are vulnerable to one or few attacks, which could be enough to eliminate any application for such protocols. Following this direction, in this article, we analyze the security of four recent ultra-lightweight/lightweight protocols, by presenting important attacks including secret disclosure attack and desynchronization attack against them. To address the shortcoming of the previous protocols, we present a new security protocol based on lightweight block ciphers name it LBCbAP. In this protocol, we use CRAFT as the core security primitive. CRAFT is a tweakable block cipher which has been recently proposed and independent security analysis confirmed its security. Our detailed security analysis of LBCbAP, which is performed both informally and formally through the GNY logic and the Scyther tool, demonstrates its security against various types of attacks including secret disclosure and desynchronization attacks. The cost analysis of the designed protocol and comparison with the related lightweight protocols show that LBCbAP is cost efficient.

Radio Frequency Identification (RFID) systems authenticate products as well as people without any physical contact. Using RFID systems is an inevitable part of recent identifying and shopping affairs. However, RFID systems have huge hardware limitations in tags side because of their need to be as cheap as possible and in access for vast number of products. Moreover, The identity of the tag owners has to be anonymous and secure from the attackers actions. These critical necessities have made researchers to concentrate on designing lightweight secure authentication protocols. In this paper, four new designed lightweight RFID authentication protocols are analyzed. Security and privacy of each protocol is analyzed, and the weaknesses are proved, discussed and modified. We demonstrate that none of them provide even weak privacy level. Each protocol is improved through a solution to overcome the weaknesses and provide at least the weak privacy. All of the privacy and security analysis are done in the Vaudenay model. Also, we propose a new lightweight protocol which uses the pros of the considered protocols and provides weak privacy level. Moreover, some comprehensive methods are proposed to provide weak privacy in the lightweight authentication protocols.

Securing the network communication represents one of the most important challenges in wireless sensor networks. The key distribution problem has been widely discussed in classical wireless sensor networks contrarily to heterogeneous ones. HWSNs (Heterogeneous Wireless Sensor Networks) have optimized the network capability and opened new security opportunities by introducing high resource capacity sensor nodes in the network. In this paper, an efficient dynamic authentication and key Management scheme is proposed for heterogeneous WSN. The main idea is to provide a single lightweight protocol for both authentication and key establishment while optimizing the security level. The key distribution algorithm is based on preexisting information to generate dynamic keys and does not require any secure channel and sharing phase which improves the security, energy efficiency and reduces the memory consumption. Experimental results have confirmed the performances of our mechanism compared to some of the existing security protocols.

Internet of Things (IoT) technology has recently been integrated with various healthcare devices to monitor patients&rsquo, health status and share it with their healthcare practitioners. Since healthcare data often contain personal and sensitive information, healthcare systems must provide a secure user authentication scheme. Recently, Adavoudi-Jolfaei et al. and Sharma and Kalra proposed a lightweight protocol using hash function encryption only for user authentication on wireless sensor systems. In this paper, we found some weaknesses in target schemes. We propose a novel three-factor lightweight user authentication scheme that addresses these weaknesses and verifies the security of the proposed scheme using a formal verification tool called ProVerif. In addition, our proposed scheme outperforms other proposed symmetric encryption-based schemes or elliptic curve-based schemes.

Ensuring security to IoT devices is important in order to provide privacy and quality of services. Proposing a security solution is considered an important step towards achieving protection, however, proving the soundness of the solution is also crucial. In this paper, we propose a methodology for the performance evaluation of lightweight IoT-based authentication protocols based on execution time. Then, a formal verification test is conducted on a lightweight protocol proposed in the literature. The formal verification test conducted with Scyther tool proofs that the model provides mutual authentication, authorization, integrity, confidentiality, non-repudiation, and accountability. The protocol also was proven to provide protection from various attacks.

The standard protocol of near field communication (NFC) has concentrated primarily on the speed of communication while ignoring security properties. Message between an NFC-enabled smartphone and a point of sale are exchanged over the air (OTA), which is a message considered an authentication request for payment, billing, ticketing, loyalty services, identification or access control. An attacker who has an antenna can intercept or manipulate the exchanged messages to take advantage of these. In order to solve this problem, many researchers have suggested authentication methods for NFC communications. However, these remain inadequate transaction security and fairness. In this paper, we will propose a technique that ensures mutual authentication, security properties, and strong fairness. Mutual authentication is a security property that prevents replay attacks and man-in-the-middle attacks. Both fair exchange and transaction security are also significant issues in electronic transactions with regards to creating trust among the parties participating in the transaction. The suggested protocol deploys a secure offline session key generation technique to increase transaction security and, importantly, make our protocol lightweight while maintaining the fairness property. Our analysis suggests that our protocol is more effective than others regarding transaction security, fairness, and lightweight protocol. The proposed protocol checks robustness and soundness using Burrows, Abadi and Needham (BAN) logic, the Scyther tool, and automated validation of internet security protocols and applications (AVISPA) that provide formal proofs for security protocols. Furthermore, our protocol can resolve disputes in case one party misbehaves.

The Constrained Application Protocol (CoAP) is a lightweight protocol specially designed to support constrained Internet of Things (IoT) devices and networks having limited bandwidth. The current growth of IoT market means more sensors in the networks and increased network traffic congestion. Since IoT clients prefer servers whose sensor values have been simultaneously updated it is of paramount importance that servers be highly efficient in synchronizing message updates from its sensors. Our research however, finds the legacy CoAP not optimally efficient in that it introduces network traffic and message duplication hence consuming extra bandwidth. We propose a new Set theory scheme that optimizes synchronized message delivery in IoT by reducing the number of duplicated messages. Our proposed scheme eliminates unnecessary duplicated messages, hence reducing network traffic. On comparing the number of messages sent by servers, our scheme outperformed the legacy CoAP by up to a 50% reduction in the number of messages sent.

With the increasing application of wireless sensor network technology in various areas of social life, the security issues it faces have become an important factor restricting its development. IPSEC is a standard framework defined by the IETF, which provides transparent security services for IP network communications. Based on the reference of the IPSEC protocol framework, this paper uses tunnel mode to perform AH and ESP security processing on data packets, and deletes the key management module. In this paper, the functions of AH and ESP are verified in the minimal.net environment. The experimental results show that the lightweight protocol based on IPSEC proposed in this paper can provide multiple pre-designed information security functions, and has passed AES and DES. Tests of commonly used encryption algorithms have concluded that the AES encryption algorithm is more suitable for IPv6 wireless sensor networks. The research results of this paper will provide a good paradigm role for solving network security.

It is increasingly difficult to manage the user identities (IDs) of rapidly developing and numerous types of online web-based applications in the present era. An innovative ID management system is required for managing the user IDs. The OpenID lightweight protocol is a better solution to manage the user IDs. In an OpenID communication environment, OpenID URL is not secured in a session hijacking situation because in other existing OpenID communication methods such double factor authentication has more chances of valid user session hijacked. The proposed communication protocol secures the OpenID URL with the help of additional innovative parameters such as Special Alphanumeric String (SAS) and Special Security PIN (SSP). The anticipated triple authentication protocol authenticated client unique OpenID URL at OpenID Provider (OP) side once and SAS and SSP field at Relying Party (RP) side. The anticipated protocol provides unique Single-Sign-On (SSO) services to OpenID users. The experimental website is tested by experts of web developers for avoiding session hijacking situation in the presence of hackers. The findings demonstrated that Dense Authentication Authorization and Accounting (DAAA) protocol minimizes the risk of a session hijacking in OpenID communication environment.

Vehicle-to-Grid (V2G) systems promoted by the federated Internet of Things (IoT) technology will be ubiquitous in the future; therefore, it is crucial to provide trusted, flexible and efficient operations for V2G services using high-quality measures for security and privacy. These can be achieved by access and authority authentication. This paper presents a lightweight protocol for capacity-based security access authentication named A c c e s s A u t h . Considering the overload probability and system capacity constraints of the V2G network domain, as well as the mobility of electric vehicles, the ideal number of admissible access requests is first calculated adaptively for each V2G network domain to actively achieve capacity-based access admission control. Subsequently, to provide mutual authentication and maintain the data privacy of admitted sessions, by considering whether there is prior knowledge of the trust relationship between the relevant V2G network domains, a high-level authentication model with specific authentication procedures is presented to enforce strict access authentication such that the sessions are conducted only by authorized requesters. Additionally, efficient session revocation with forward security and session recovery with no extra authentication delay are also discussed. Finally, analytical and evaluation results are presented to demonstrate the performance of A c c e s s A u t h .

Nowadays wireless sensor networks (WSNs) have drawn great attention from both industrial world and academic community. To facilitate real-time data access for external users from the sensor nodes directly, password-based authentication has become the prevalent authentication mechanism in the past decades. In this work, we investigate three foremost protocols in the area of password-based user authentication scheme for WSNs. Firstly, we analyze an efficient and anonymous protocol and demonstrate that though this protocol is equipped with a formal proof, it actually has several security loopholes been overlooked, such that it cannot resist against smart card loss attack and violate forward secrecy. Secondly, we scrutinize a lightweight protocol and point out that it cannot achieve the claimed security goal of forward secrecy, as well as suffering from user anonymity violation attack and offline password guessing attack. Thirdly, we find that an anonymous scheme fails to preserve two critical properties of forward secrecy and user friendliness. In addition, by adopting the “perfect forward secrecy (PFS)” principle, we provide several effective countermeasures to remedy the identified weaknesses. To test the necessity and effectiveness of our suggestions, we conduct a comparison of 10 representative schemes in terms of the underlying cryptographic primitives used for realizing forward secrecy.

The rapid growth of connected things across the globe has been brought about by the deployment of the Internet of things (IoTs) at home, in organizations and industries. The innovation of smart things is envisioned through various protocols, but the most prevalent protocols are pub-sub protocols such as Message Queue Telemetry Transport (MQTT) and Advanced Message Queuing Protocol (AMQP). An emerging paradigm of communication architecture for IoTs support is Fog computing in which events are processed near to the place they occur for efficient and fast response time. One of the major concerns in the adoption of Fog computing based publish-subscribe protocols for the Internet of things is the lack of security mechanisms because the existing security protocols such as SSL/TSL have a large overhead of computations, storage and communications. To address these issues, we propose a secure, Fog computing based publish-subscribe lightweight protocol using Elliptic Curve Cryptography (ECC) for the Internet of Things. We present analytical proofs and results for resource efficient security, comparing to the existing protocols of traditional Internet.

The Constrained Application Protocol (CoAP) is a standard web transfer protocol. The CoAP runs over UDP, resulting in an unreliable message transport. CoAP offers a request/response communication model among application endpoints. The Internet Protocol Security (IPsec) can offer various security services like limited traffic flow confidentiality, anti-replay mechanism, access control, confidentiality, connection-less integrity, and data origin authentication. One way to use IPSec to secure the CoAP transactions can be Encapsulating Security Payload Protocol [RFC 2406] (IPSec-ESP). It can be a special case, if the hardware provisions encryption at layer 2 (it is the situation with some IEEE 802.15.4 radio chips). Another way can be, the 6LowPAN (IPv6 over Low-power Wireless Personal Area Networks) extension, for using the IPSec with Authentication Header (AH) [RFC 2402] and Encapsulation Security Payload (ESP). To give more security to the major User Datagram Protocol (UDP) well-known applications, Datagram Transport Layer Security (DTLS) runs on top of UDP instead of Transmission Control Protocol (TCP). The DTLS offers automatic key management, confidentiality, authentication, and data integrity. It also provisions wide range of dissimilar cryptographic algorithms. We have found that providing end-to-end security is not so easy, so we have developed a Secure Hybrid RSA (SHRSA) cipher. At present, we are using it in personal messaging scheme, and it is able to provide end-to-end security with efficiency and lightweight features. Later, this cipher can be used in lightweight and efficient communication scenario of Internet of Things (IoT) and Internet of Everything (IoE).

While software-defined networking (SDN) has been widely applied in various networking domains including datacenters, WANs (Wide Area Networks), QoS (Quality of Service) provisioning, service function chaining, etc., it also has foreseeable applications in energy internet (EI), which envisions an intelligent energy industry on the basis of (information) internet. Global awareness provided by SDN is especially useful in system monitoring in EI to achieve optimal energy transportation, sharing, etc. Link layer discovery protocol (LLDP) plays a key role in global topology discovery in software-defined energy internet when SDN is applied. Nevertheless, EI-related status information (power loads, etc.) is not collected during the LLDP-based topology discovery process initiated by the SDN controller, which makes the optimal decision making (e.g., efficient energy transportation and sharing) difficult. This paper proposes MonLink, a piggyback status-monitoring scheme over LLDP in software-defined energy internet with SDN-equipped control plane and data plane. MonLink extends the original LLDP by introducing metric type/length/value (TLV) fields so as to collect status information and conduct status monitoring in a piggyback fashion over LLDP during topology discovery simultaneously without the introduction of any newly designed dedicated status monitoring protocol. Several operation modes are derived for MonLink, namely, periodic MonLink, which operates based on periodic timeouts, proactive MonLink, which operates based on explicit API invocations, and adaptive MonLink, which operates sensitively and self-adaptively to status changes. Various northbound APIs are also designed so that upper layer network applications can make full use of the status monitoring facility provided by MonLink. Experiment results indicate that MonLink is a lightweight protocol capable of efficient monitoring of topological and status information with very low traffic overhead, compared with other network monitoring schemes such as sFlow.

Nowadays the operational technologies are constantly changing, and evolving day by day in order to make our life easier. The merger of the operational technologies and information led us into the so-called industrial internet of things. This transition is projected on our daily life, and this forms an essential pillar of industry 4.0. IOT combines the useful to pleasant with its implementation in the industry, it is from this concept that came the idea of the industry 4.0. Today, the most of industrial companies seek the ideal to prove their effectiveness in the field. For this reason, finding adequate solutions to the needs of the company is crucial. Managing a huge amount of data remains the most impressive obstacle that the company can face. Consequently, developing the layers related with data is a necessity. This paper highlights the estimation of latency in transferring data from the field to the cloud taking into consideration lightweight protocol MQTT over different gateways, we put into practice the IoT tool Node-RED in the gateway for simulation.

One interesting radio-frequency identification (RFID) application type is RFID searching that aims to hear a specific RFID tag from a large group of tags, that is, ability of detecting whether a target RFID tag is nearby. Very recently, a lightweight protocol using error-correcting codes has been proposed by Chen et al. to provide a solution in this field. The authors give a detailed analysis of their protocol in terms of security, privacy, communication overhead, and hardware cost, and they claim that it is a realizable scheme with fulfilling security and privacy requirements. In this study, however, we investigate the security aspects of this protocol and clearly demonstrate its security flaws that completely allow an adversary to exploit the system. In particular, by using linear properties of error-correcting coding, we first describe a tag tracing attack that undermines untraceability property, which is one of the design objectives. Then along with its implementation details, we present a key recovery attack that dramatically reduces the search space of a tag's secret key and show that an adversary can compromise it in convenient time by only querying this tag for several times. As an illustrative example, we retrieve the secret key of the protocol in 2 h for the suggested linear block code C(47,24,11). Copyright © 2017 John Wiley & Sons, Ltd.

We present the PalCom Object Notation, a textual data representation format for communication between internet of things which support binary and textual data. The format does not require parsing of user data (or the “payload”) and is thus efficient to use also for large binary values such as digital images, audio and video as well as for short textual values. These can be mixed in the same messages and thus transported over the same communication link. Its structure is influenced by JSON, making it easy to translate between the two formats. We show how it fits seamlessly into the common situation with JavaScript on a client side and Java on a server side, combined by a HTTP-server. The performance evaluation shows that the size of the representation and the time needed to generate and parse it is comparable to that of JSON for small data sizes, but becomes both smaller than JSON and faster to process as data sizes grows, and can yield a tenfold performance increase for binary payloads.

Our paper introduces a novel lightweight protocol for private proximity testing.The proposed protocol clearly outperforms current state of the art.We formally prove that the protocol is secure in the semi-honest model.We present experimental results in Python and C++ and compare it with its peers.We demonstrate an Android application that uses are protocol and proves its efficacy. The wide adoption of smart phones has enabled Online Social Networks (OSNs) to exploit the location awareness capabilities offering users better interaction and context aware content. While these features are very attractive, the publication of users' location in an OSN exposes them to privacy hazards. Recently, various protocols have been proposed for private proximity testing, where users are able to check if their online friends are near, without disclosing their locations. However, the computation cost of the required cryptographic operations utilized in such protocols is not always efficient for mobile devices. In this paper we introduce a lightweight and secure proximity testing protocol, suitable for online mobile users. We show that our protocol is provably secure under the well-known factoring problem and we analyze its efficiency. Our results show that our approach outperforms other existing protocols, by significantly reducing the computational cost and making it practical for devices with limited resources. Finally, we demonstrate the applicability of our proposal in an actual OSN location-based, mobile application.

Radio Frequency Identification (RFID) is one of the leading technologies in the Internet of Things (IoT) to create an efficient and reliable system to securely identify objects in many environments such as business, health, and manufacturing areas. Recent RFID authentication protocols have been proposed to satisfy the security features of RFID communication. In this article, we identify and review some of the most recent and enhanced authentication protocols that mainly focus on the authentication between a reader and a tag. However, the scope of this survey includes only passive tags protocols, due to the large scale of the RFID framework. We examined some of the recent RFID protocols in term of security requirements, computation, and attack resistance. We conclude that only five protocols resist all of the major attacks, while only one protocol satisfies all of the security requirements of the RFID system.

The emergence of the disruptive technologies such as cloud computing, IoT (Internet of Things), machine learning and data analytics has made its mark in different sectors like transportation, agriculture, healthcare, environment monitoring, renewable energy systems, retail, and industry. The IoT provides connectivity of things dynamically to the network whereas cloud computing provides virtualization in storage and processing. In CloudIoT paradigm, cloud and IoT are merged together to provide complementary features in smart applications/services. CloudIoT solutions make it possible to envisage ubiquitous and pervasive connectivity to the users. The source of livelihood for a majority of the population is agriculture; it mantles a dominant role in the economy of the country. The proposed work focuses on CloudIoT architecture for providing any smart solutions in different sectors. A case study of a smart irrigation system is discussed in the paper. A smart irrigation system is developed using the lightweight protocol, MQTT (Message Queue Telemetry Transport). MQTT protocol is 22% more energy efficient and 15% faster when compared with other protocols. The temperature and soil moisture data are collected and managed by Amazon cloud. The data analysis is performed using the Weka (Waikato Environment for Knowledge Analysis) tool. The cost-effective solution is demonstrated and results speak the strength and performance of the system.

The advancement of Wireless Body Area Networks (WBAN) have led to significant progress in medical and health care systems. However, such networks still suffer from major security and privacy threats, especially for the data collected in medical or health care applications. Lack of security and existence of anonymous communication in WBAN brings about the operation failure of these networks. Recently, Li et al. proposed a lightweight protocol for wearable sensors in wireless body area networks. In their paper, the authors claimed that the protocol may provide anonymous mutual authentication and resist against various types of attacks. This study shows that such a protocol is still vulnerable to three types of attacks, i.e., the offline identity guessing attack, the sensor node impersonation attack and the hub node spoofing attack. We then present a secure scheme that addresses these problems, and retains similar efficiency in wireless sensors nodes and mobile phones.

The Internet of Things (IoT) introduces many new challenges which cannot be solved using traditional cloud and host computing models. A new architecture known as fog computing is emerging to address these technological and security gaps. Traditional security paradigms focused on providing perimeter-based protections and client/server point to point protocols (e.g., Transport Layer Security (TLS)) are no longer the best choices for addressing new security challenges in fog computing end devices, where energy and computational resources are limited. In this paper, we present a lightweight secure streaming protocol for the fog computing “Fog Node-End Device” layer. This protocol is lightweight, connectionless, supports broadcast and multicast operations, and is able to provide data source authentication, data integrity, and confidentiality. The protocol is based on simple and energy efficient cryptographic methods, such as Hash Message Authentication Codes (HMAC) and symmetrical ciphers, and uses modified User Datagram Protocol (UDP) packets to embed authentication data into streaming data. Data redundancy could be added to improve reliability in lossy networks. The experimental results summarized in this paper confirm that the proposed method efficiently uses energy and computational resources and at the same time provides security properties on par with the Datagram TLS (DTLS) standard.

[Abstract] The Internet of Things (IoT) involves a wide variety of heterogeneous technologies and resource-constrained devices that interact with each other. Due to such constraints, IoT devices usually require lightweight protocols that optimize the use of resources and energy consumption. Among the different commercial IoT devices, Bluetooth and Bluetooth Low Energy (BLE)-based beacons, which broadcast periodically certain data packets to notify their presence, have experienced a remarkable growth, specially due to their application in indoor positioning systems. This article proposes a family of protocols named Lightweight Protocol for Sensors (LP4S) that provides fast responses and enables plug-and-play mechanisms that allow IoT telemetry systems to discover new nodes and to describe and auto-register the sensors and actuators connected to a beacon. Thus, three protocols are defined depending on the beacon hardware characteristics: LP4S-6 (for resource-constraint beacons), LP4S-X (for more powerful beacons) and LP4S-J (for beacons able to run complex firmware). In order to demonstrate the capabilities of the designed protocols, the most restrictive (LP4S-6) is tested after implementing it for a telemetry application in a beacon based on Eddystone (Google’s open beacon format). Thus, the beacon specification is extended in order to increase its ability to manage unlimited sensors in a telemetry system without interfering in its normal operation with Eddystone frames. The performed experiments show the feasibility of the proposed solution and its superiority, in terms of latency and energy consumption, with respect to approaches based on Generic Attribute Profile (GATT) when multiple users connect to a mote or in scenarios where latency is not a restriction, but where low-energy consumption is essential. Xunta de Galicia; ED431C 2016-045 Xunta de Galicia; ED341D R2016/012 Xunta de Galicia; ED431G/01 Agencia Estatal de Investigación; TEC2013-47141-C4-1-R Agencia Estatal de Investigación of Spain; TEC2015-69648-REDC Agencia Estatal de Investigación of Spain; TEC2016-75067-C4-1-R

The routing protocol in connected vehicles (CVs) is vulnerable to wormhole attacks where attackers can deceive legitimate nodes and purport them as if they are immediate or close neighbors. The Ad hoc On-Demand Distance Vector (AODV) protocol is a routing packet protocol designed for mobile nodes. However, AODV may not have been explicitly developed with security issues, specifically wormhole attacks, in mind, thereby requiring a detection algorithm to secure route establishment. This paper introduces the Wormhole-Protocol-Detector ( WPD ), a lightweight protocol for detecting and mitigating wormhole attacks. WPD is designed to work on a highway that is clustered into equal segments and equipped with road side units (RSUs) in predefined locations to monitor each segment. WPD consists of three phases: monitoring and detection of out-of-range packets, estimating the hop count between source and destination nodes, and identification of nodes participating in a wormhole connection. Together, these phases enable legitimate nodes to avoid the wormhole link and obtain secure routing paths between CVs. To validate our approach, we apply WPD to a CVs simulation where different types and lengths of wormhole, including a new wormhole attack method, can be applied to the CV network. Our experimental results suggest that WPD can detect wormhole attacks with a high detection rate and minimum false positives.

Short Message Service (SMS) has been widely used in many application areas, including mobile payment, mobile banking, voting and so on. To ensure the integrity of SMS, research has focused on developing authentication techniques to ensure that the SMS message could not be falsified or edited. However, existing approaches still suffer from a lack of suitable security properties to support both confidentiality and integrity properties. Mutual authentication is a key security property that can prevent replay and man-in-the-middle attack. This paper introduces new authentication protocols for SMS communication that provides mutual authentication between engaging parties. The proposed protocols deploy limited-use offline session key generation and distribution techniques to enhance security. Our protocols not only satisfy necessary transaction security properties, but are also simple and compatible with existing SMS infrastructure.

In the vehicular networks, the real-time video reporting service is used to send the recorded videos in the vehicle to the cloud. However, when facilitating the real-time video reporting service in the vehicular networks, the usage of the fourth generation (4G) long term evolution (LTE) was proved to suffer from latency while the IEEE 802.11p standard does not offer sufficient scalability for a such congested environment. To overcome those drawbacks, the fifth-generation (5G)-enabled vehicular network is considered as a promising technology for empowering the real-time video reporting service. In this paper, we note that security and privacy related issues should also be carefully addressed to boost the early adoption of 5G-enabled vehicular networks. There exist a few research works for secure video reporting service in 5G-enabled vehicular networks. However, their usage is limited because of public key certificates and expensive pairing operations. Thus, we propose a secure and lightweight protocol for cloud-assisted video reporting service in 5G-enabled vehicular networks. Compared to the conventional public key certificates, the proposed protocol achieves entities’ authorization through anonymous credential. Also, by using lightweight security primitives instead of expensive bilinear pairing operations, the proposed protocol minimizes the computational overhead. From the evaluation results, we show that the proposed protocol takes the smaller computation and communication time for the cryptographic primitives than that of the well-known Eiza-Ni-Shi protocol.

Recently, Goutham et al. proposed an ID-based user authentication with key agreement on elliptic curve cryptography(ECC), which is suitable to be applied in client-serverenvironment. The scheme mainly negotiates a temporary session key between two parties. However, we find that the scheme contains some security flaws, such as incomplete anonymity, no provision for updating private key and so on. In light of this, we propose a new version of anonymous authentication with key agreement protocol used for client-server environment, especially, the calculation of both sides are lower than the previous scheme. The proposed scheme provides more security features like complete anonymity, dynamic private key updating while keeping the merits of Goutham et al.’s scheme. We also optimize the performance of the scheme to get a lightweight protocol which is more suitable for resource-constrained device applied in Internet of Things(IoT) or wireless sensor network(WSN) applications.

A Radio Frequency Identification (RFID) grouping-proof protocol is to generate an evidence of the simultaneous existence of a group of tags and it has been applied to many different fields. For current grouping-proof protocols, there still exist some flaws such as low grouping-proof efficiency, being vulnerable to trace attack and information leakage. To improve the secure performance and efficiency, we propose a lightweight RFID grouping-proof protocol based on parallel mode and DHCP (Dynamic Host Configuration Protocol) mechanism. Our protocol involves multiple readers and multiple tag groups. During the grouping-proof period, one reader and one tag group are chosen by the verifier by means of DHCP mechanism. When only a part of the tags of the chosen group exist, the protocol can also give the evidence of their co-existence. Our protocol utilizes parallel communication mode between reader and tags so as to ensure its grouping-proof efficiency. It only uses Hash function to complete the mutual authentication among verifier, readers and tags. It can preserve the privacy of the RFID system and resist the attacks such as eavesdropping, replay, trace and impersonation. Therefore the protocol is secure, flexible and efficient. It only uses some lightweight operations such as Hash function and a pseudorandom number generator. Therefore it is very suitable to some low-cost RFID systems.

Connected devices that are part of the so-called Internet of Things (IoT) need to update their firmware over their lifetime. The problem is that updates can be used by attackers to inject malicious code. This work presents a lightweight protocol to update each device in a secure way. The cryptographic keys employed are fresh and are not stored but reconstructed by exploiting the Physical Unclonable Functions (PUFs) of the device hardware. The feasibility of the proposal is illustrated with experimental results of IoT devices that use the SRAM PUFs in their Bluetooth Low Energy (BLE) system on chips.

Homomorphic encryption is a well established means for performing operations on encrypted data. In many real-world applications however, the need arises to perform division over integers and yield a floating point result. This cannot be performed in the encrypted domain of most homomorphic encryption schemes. Thus, one has to resort to Secure Two Party Computation which suffers from high communication costs or to a Fully Homomorphic encryption scheme which is still inefficient. In this work, we present a lightweight and flexible protocol that takes as input two homomorphically encrypted integers, privately divides them and returns the result in floating point format. Our tool is designed to support both additive and multiplicative homomorphic schemes. We measure the privacy offered using a well established privacy metric and provide timings for the operations. We evaluate our protocol on a real world application scenario conducting simulations of attacks and present our encouraging results.

Novel hardware-aided trusted execution environments, as provided by Intel's Software Guard Extensions (SGX), enable to execute applications in a secure context that enforces confidentiality and integrity of the application state even when the host system is misbehaving. While this paves the way towards secure and trustworthy cloud computing, essential system support to protect persistent application state against rollback and forking attacks is missing. In this paper we present LCM - a lightweight protocol to establish a collective memory amongst all clients of a remote application to detect integrity and consistency violations. LCM enables the detection of rollback attacks against the remote application, enforces the consistency notion of fork-linearizability and notifies clients about operation stability. The protocol exploits the trusted execution environment, complements it with simple client-side operations, and maintains only small, constant storage at the clients. This simplifies the solution compared to previous approaches, where the clients had to verify all operations initiated by other clients. We have implemented LCM and demonstrated its advantages with a key-value store application. The evaluation shows that it introduces low network and computation overhead; in particular, a LCM-protected key-value store achieves 0.72x - 0.98x of a SGX-secured key-value store throughput., This is the authors' version of an article published in the Proceedings of the 47th International Conference on Dependable Systems and Networks (DSN'17), Denver, USA, 26-29 June 2017

Routing Protocol for Low Power and Lossy Networks (RPL) is the routing protocol for IoT and Wireless Sensor Networks. RPL is a lightweight protocol, having good routing functionality, but has basic security functionality. This may make RPL vulnerable to various attacks. Providing security to IoT networks is challenging, due to their constrained nature and connectivity to the unsecured internet. This survey presents the elaborated review on the security of Routing Protocol for Low Power and Lossy Networks (RPL). This survey is built upon the previous work on RPL security and adapts to the security issues and constraints specific to Internet of Things. An approach to classifying RPL attacks is made based on Confidentiality, Integrity, and Availability. Along with that, we surveyed existing solutions to attacks which are evaluated and given possible solutions (theoretically, from various literature) to the attacks which are not yet evaluated. We further conclude with open research challenges and future work needs to be done in order to secure RPL for Internet of Things (IoT).

The next industrial revolution, generally referred to as Industry 4.0, is already here. This envisions a rapid transformation in the design, operation and service of manufacturing systems, where machines, sensors and actuators are interconnected in the factories in order to enable spontaneous collaboration, monitoring and control. Currently, Cyber-Physical-Systems (CPS) use regular Internet protocols (e.g. SOAP or HTTP) to communicate with each other. However, these protocols inherently present certain drawbacks or disadvantages: large footprint, CPU usage, high memory and energy consumption, etc. In recent years, new Industrial Internet of Things (IIoT) protocols have emerged to solve this issue, such as the Constrained Application Protocol (CoAP) and MQ Telemetry Transport (MQTT). These are lightweight protocols designed to face the challenges of industrial environments with a small footprint and overhead. These protocols have different features in terms of communication model and Quality of Service (QoS), that make them more suitable to an specific domain. Thus, it is important to identify the right metrics to adopt the most appropriate. This paper presents a theoretical and empirical comparison of MQTT and CoAP in terms of network overhead and latency, to assist system designers with this decision. Furthermore we describe the quantitative comparison conducted with their implementation in hardware platforms with high constraints. The achieved results provide useful metrics and guidelines to help designers to choose the appropriate schemes for their implementations.

DRM provides a secure solution for the illegal distribution of digital content through communication networks. We propose a Secure and lightweight protocol for mobile DRM based on DRM community cloud (DCC) and banking community cloud (BCC). Non-repudiation property is a very important property that needs to be ensured for DRM. Non-repudiation property in this protocol is achieved using wireless public key infrastructure (WPKI), universal integrated circuit card (UICC) at the client side, DRM community cloud (DCC) at the cloud provider (CP) and banking community cloud (BCC) at the Issuing Bank. BCC and DCC are a Cloud of Secure Elements (CSE). Our proposed protocol achieves end-to-end security from the client to DCC and BCC.

The rapid increase in the number of connected things across the globe has been brought about by the deployment of the Internet of things (IoTs) at home, in organizations and industries. The innovation of smart things has been envisioned through various protocols, but the most prevalent protocols are publish-subscribe protocols such as Message Queue Telemetry Transport (MQTT) and Advanced Message Queuing Protocol (AMQP). One of the major concerns in the adoption of such protocols for the IoTs is the lack of security mechanisms as the existing security protocols cannot be adapted due to their large overhead of computations, storage and communications. To address this issue, we propose a lightweight protocol using Elliptic Curve Cryptography (ECC) for IoT security. We present analytical and simulation results, and compare the results to the existing protocols of traditional Internet.

Communication security is one of the key component of Internet of Things. Now we can communicate with smart device, such as microwave oven, camera, and control it using App in our smart phone, but due to the poor computing power of smart device, it tends to be intractable to protect this communication from attack. By analyzing the security threats faced during the process of smart device and App authenticating each other’s identity, this paper proposed a lightweight transfer protocol for smart device, and introduced “Authentication Center” to help with authentication for smart device and App. In consideration of poor computing power of smart device, the lightweight protocol achieves effective reduction of network resource usage. Acting as a hub, the Authentication Center does the heavy certification and authorization work as well as the management of smart device. This protocol can protect data confidentiality, data integrity against replay attack, man-in-the-middle attack by ensuring the identities of device and App with the help of Authentication Center.

Privacy and anonymity on the Internet have become a serious concern. Even when anonymity tools like Tor or VPNs are used, the IP and therefore the approximate geolocation from which the user connects to such a service is still visible to an adversary who controls the network. Our proposal \(\upmu \)Proxyaims to mitigate this problem by providing a relay of user-controlled hardware proxies that allows to connect to a (potentially public) network over a large physical distance. One endpoint is connected to a public Wifi hotspot, while the other end connects (over a chain of relay nodes) to the user’s computer. \(\upmu \)Proxy uses a lightweight protocol to create a secure channel between two endpoint nodes, whereas the communication can be routed over an arbitrary amount of relay nodes. The employed cryptography is based on NaCl, using Curve25519 for the key exchange as well as Salsa20 and Poly1305 for authenticated payload encryption. \(\upmu \)Proxy tunnels TCP/IP connections and can therefore be used to secure and anonymize existing, unprotected protocols. We implemented \(\upmu \)Proxy on the ESP8266, a popular Wifi microcontroller, and show that \(\upmu \)Proxy incurs a latency of 20.4 ms per hop under normal operating conditions.

The implementation of Smart Cities requires technologies such as the Internet of Things (IoT). This paradigm aims to integrate and use in Internet electronic embedded devices like sensors, in order to share information and allowing interaction from anywhere. Standard communication protocols used in IoT for data transmission are based in general on FSK (Frequency Shift Keying) techniques that do not have the range and necessary performance to deal with this new scenery. With this situation in mind Semtech Technologies have developed a new modulation technique called LoRa (Long Range) based on spread spectrum that offer a new communication model for low power and long range networks, impossible to implement with other techniques. In this paper, we describe a new communication protocol implemented over the physical layer of LoRa providing effectiveness, robustness and low power consumption suitable for IoT applications in the context of smart cities. Results obtained related with the coverage analysis confirm the success of the selection of this technology and opens new horizons for developing useful applications in domains like smart cities, e-health, smart factory, remote monitoring and control, etc. Ministerio de Economía y competitividad, proyecto iPHealth (TIN-2013-47153-C3-1). 0.295 SJR (2017) Q2, 114/548 Computer Science (miscellaneous); Q3, 91/173 Theoretical Computer Science UEM

We propose lightweight protocol for securing communication and preserving users' anonymity and location privacy in hybrid ad hoc networks. Symmetric-key-cryptography operations and payment system are used to secure route discovery and data transmission. To reduce the overhead, the payment can be secured without submitting or processing payment proofs (receipts). To preserve users' anonymity with low overhead, we develop efficient pseudonym generation and trapdoor techniques that do not use the resource-consuming asymmetric-key cryptography. Pseudonyms do not require large storage area or frequently contacting a central unit for refilling. Our trapdoor technique uses only lightweight hashing operations. This is important because trapdoors may be processed by a large number of nodes. Developing low-overhead secure and privacy-preserving protocol is a real challenge due to the inherent contradictions: 1) securing the protocol requires each node to use one authenticated identity, but a permanent identity should not be used for privacy preservation; and 2) the low overhead requirement contradicts with the large overhead usually needed for preserving privacy and securing the communication. Our analysis and simulation results demonstrate that our protocol can preserve privacy and secure the communication with low overhead.

Cloud computing has been envisioned as the next generation architecture of the IT enterprise, but there exist many security problems. A significant problem encountered in the context of cloud storage is whether there exists some potential vulnerabilities towards cloud storage system after introducing third parties. Public verification enables a third party auditor (TPA), on behalf of users who lack the resources and expertise, to verify the integrity of the stored data. Many existing auditing schemes always assume TPA is reliable and independent. This work studies the problem what if certain TPAs are semi-trusted or even potentially malicious in some situations. Actually, the authors consider the task of allowing such a TPA to involve in the audit scheme. They propose a feedback-based audit scheme via which users are relaxed from interacting with cloud service provider (CSP) and can check the integrity of stored data by themselves instead of TPA yet. Specifically, TPA generates the feedback through processing the proof from CSP and returns it to user which is yet unforgeable to TPA and checked exclusively by user. Through detailed security and performance analysis, the author's scheme is shown to be more secure and lightweight.

Speaking and hearing plays an important role in effective teaching, individuals who lack these abilities faces an uphill battle. Quantum of researches has focused on designing various approaches to teach deaf and mute students. However, assessing whether students are following the course materials by creating an active learning environment is very difficult in this context. Integrating IoT technologies into their classroom can add an immense value in this area by providing interactive low-cost solution which can solve the purpose and also improve the quality and efficiency of the education system thereby making education more appealing than ever before. This paper presents the review and case study of various existing solutions and design and development of one such system using low cost hardware and MQTT lightweight protocol for efficient device to device communication to encourage active learning environment in the classroom without much modifications in the existing academic infrastructure.

The Voice Over IP (VoIP) environments and the most contemporary ones such as the IP Multimedia Subsystem (IMS) are deployed in order to provide cheap and at the same time high quality services to their users. Video calls, conferences, and applications can be provided to mobile devices with the lowest possible delay, while the Quality of Service (QoS) remains as the top priority for users and providers. Toward this objective, these infrastructures utilize the Session Initiation Protocol (SIP) for signaling handshakes since it is the most flexible and lightweight protocol available. However, according to many researches, it happens to be vulnerable to many attacks that threaten system's security and availability. In this paper, we introduce a cross-layer mechanism that is able to mitigate in real-time spoofing attacks such as SIP signaling, identity theft, masquerading, and Man in the middle, and also single and distributed source flooding. It consists of three components: the policy enforcer which acts as a black list, and the spoofing and flooding modules. We also introduce a classification of SIP flooding attacks for better representation of the detection coverage. To the best of our knowledge, the proposed detection system is the most complete and accurate in terms of the attack range that is able to deter. Concerning its performance, it does not require computational expensive calculations nor resource demanding security protocols, thus being a lightweight mechanism. The experimental results have demonstrated high detection rates with false alarm rates approaching zero. Finally, it is platform independent and transparent to networks' operations and thus can be deployed in both VoIP and IMS environments.

Peer Data Management Systems (PDMS) are an attractive solution for managing distributed heterogeneous information. When a peer (client) requests data from another peer (server) with a different schema, translations of the query and its answer are done by a sequence of intermediate peers (translators). There are two privacy issues in this P2P data integration process: (i) answer privacy: no unauthorized parties (including the translators) should learn the query result; (ii) mapping privacy: the schema and the value mappings used by the translators to perform the translation should not be revealed to other peers. Elmeleegy and Ouzzani proposed the PPP protocol that is the first to support privacy-preserving querying in PDMS. However, PPP suffers from several shortcomings. First, PPP does not satisfy the requirement of answer privacy, because it is based on commutative encryption; we show that this issue can be fixed by adopting another cryptographic technique called oblivious transfer. Second, PPP adopts a weaker notion for mapping privacy, which allows the client peer to observe certain mappings done by translators. In this paper, we develop a lightweight protocol, which satisfies mapping privacy and extend it to a more complex one that facilitates parallel translation by peers. Furthermore, we consider a stronger adversary model where there may be collusions among peers and propose an efficient protocol that guards against collusions. We conduct an experimental study on the performance of the proposed protocols using both real and synthetic data. The results show that the proposed protocols not only achieve a better privacy guarantee than PPP, but they are also more efficient.

Objectives: Communication between the clients over the internet poses the main challenge i.e., to build a secured network that keeps up with the demand, by simultaneously reducing the energy consumption. This communication can be achieved by installing certain add-ons in the client and server sides. Methods: In the existing methods, the communication between the end clients using CoAP protocol is a difficult task. In the proposed architecture, the main task is to achieve the communication between the end clients without gateways or intermediate proxies. In this method, the ports used for the HTTP (8000) and CoAP (5683) protocols are to be opened simultaneously for achieving communication. With the help of this protocol, the end clients can be connected over the internet. Findings: CoAP uses Universal Datagram Packets (UDP) since it uses its own DTLS security for the embedded devices. The system makes use of the Web IOPi and the txThings, a framework to communicate with the CoAP. Applications: In this work, txThings and WebIOPi are used in the Raspberry Pi and add-ons are installed along with the txThings and WebIOPi in the Web Browser using the command line interface. Since the Raspberry Pi used which is embedded device, the energy is saved. The implemented system can be used in diverse real time applications. The implementation is done in the frontend so that it can be controlled over the internet with the help of the CoAP protocol.

Authentication and secure communication are challenging in Wireless Sensor Network (WSN) for exchanging confidential information. During recent years, WSN is working in conjunction with Internet of Things (IoT) where sensors sense data, make collaboration and transfer the required information to end users. Authentication and reliable transmission of secure data at end-to-end communication link are challenging in IoT. It requires a lightweight protocol for communication in constrained environments in IoT applications. This paper contributes a Two-level Session Key (TSK) based authentication mechanism for IoT scenario. A node association mechanism is also introduced. TSK provides lightweight and secure communication between end-to-end users. After authenticating and establishing one level session key. The presentation and security investigation give a good reason that the proposed scheme is feasible to set up in a resource constrained environment. Results prove the dominance of TSK over preliminaries and achieve 50% to 100% reduction in energy consumption for communication.

Security counts as a critical barrier to continuing growth of RFID industry due to lack of a proper high performance lightweight protocol-based solution. Amongst recent developments the Fast Lightweight Mutual Authentication Protocol (FLMAP) has been accepted for its superior speed and low complexity features. Here we examine the security strengths of FLMAP through systematic cryptanalysis tests. Outcome of our investigation show that in spite of its superior speed and power saving features FLMAP shows some serious design gaps and shortfalls against two specifically selected desynchronization and ID disclosure attacks. Finally, we propose solutions to fix the FLMAP designing and security flaws.