Search

As many vulnerabilities of one-time authentication systems have already been uncovered, there is a growing need and trend to adopt continuous authentication systems. Biometrics provides an excellent means for periodic verification of the authenticated users without breaking the continuity of a session. Nevertheless, as attacks to computing systems increase, biometric systems demand more user information in their operations, yielding privacy issues for users in biometric-based continuous authentication systems. However, the current state-of-the-art privacy technologies are not viable or costly for the continuous authentication systems, which require periodic real-time verification. In this article, we introduce a novel, lightweight, privacy-aware, and secure continuous authentication protocol called PACA. PACA is initiated through a password-based key exchange (PAKE) mechanism, and it continuously authenticates users based on their biometrics in a privacy-aware manner. Then, we design an actual continuous user authentication system under the proposed protocol. In this concrete system, we utilize a privacy-aware template matching technique and a wearable-assisted keystroke dynamics-based continuous authentication method. This provides privacy guarantees without relying on any trusted third party while allowing the comparison of noisy user inputs (due to biometric data) and yielding an efficient and lightweight protocol. Finally, we implement our system on an Apple smartwatch and perform experiments with real user data to evaluate the accuracy and resource consumption of our concrete system.

Securing messages and protecting them from tampering during transmission in wireless sensor networks is a challenging task. Using message authentication schemes provides security and authentication, but with a high computational and communication cost. Sensors are highly constrained in terms of computational capabilities and power consumption. Therefore, computation is divided into two phases: online (at the sensor) and offline (at a more powerful central node). Moreover, public keys are generated based on the identities to reduce communication overhead. In this article, we propose a message authentication scheme based on identity that uses online/offline signature. We prove that the scheme provides and protects the integrity of messages during the transmission of data over an insecure network. Our scheme is existential unforgeable against chosen message attack.

The Internet of Things (IoT), as one of the hottest topics, supports resource-constrained devices which can communicate with each other at any time. Moreover, the communication must be secure on public networks, and it is sometimes necessary to control remote devices using a secure protocol. Consequently, designing a lightweight protocol is one of the challenging points to be addressed. So far, several lightweight protocols have been proposed―this paper analyzes one of the current lightweight authentication protocols for the IoT. Based on the previous protocol, a secure protocol has been suggested that inherits the benefits of the previous one, while it is completely safe against the proposed attacks. The proposed protocol fulfils mutual authentication using BAN logic, as a broadly accepted formal method in security analysis. Moreover, the proposed protocol resists well-known attacks and its security, communication overhead, and time complexity have been compared with similar protocols that show its efficiency for IoT applications. In the proposed protocol, users and IoT nodes share a secret key in 3.122 ms with 528 bytes communication overhead.

Vehicular Ad Hoc Network (VANET) and Internet of Vehicle (IoV) technologies are particularly attracting attention from industrial communities because of the intelligent transportation systems of smart city technologies. Vehicle-to-vehicle (V2V) communication of VANET can guarantee traffic system management and road safety. However, V2V communication cannot manage many vehicles as a whole, so it needs to be segmented and communicated by region. Therefore, considering locality, key agreement is made for V2V communication of the same or different regions. Moreover, traditional public key infrastructure (PKI) and Kerberos systems to be applied in a real environment incur computational overhead. Therefore, we proposed a lightweight protocol for dynamic properties of vehicles for regional segmentation management and overhead resolution. In addition, because vehicle information is transmitted through public channels, our protocol uses mutual authentication and honey_list technology to ensure security against a variety of attacks. It provides verification of safety through a detailed security analysis using the formal analysis using the widely-accepted Real-Or-Random (ROR) model, and verifies formal security using the Automated Validation of Internet Security Protocols and Applications (AVISPA) software tool and non-mathematical (informal) security analysis. In addition, a detailed comparative study that the proposed scheme can be applied in the communication environment between actual vehicles as compared to other existing competing schemes.

Data provenance is an important security requirement to establish trust in the data produced by an Internet of Things (IoT) device. Existing works on data provenance for IoT are based on complex computations or costly hardware that may not be feasible for IoT systems. To solve this issue, this article uses an analytical model to develop a threshold-based mechanism to establish data provenance in IoT systems. Moreover, using lightweight security primitives, a lightweight security protocol for data provenance is also proposed. The proposed protocol uses physical unclonable functions and fingerprints extracted from the wireless channel to achieve data provenance, mutual authentication, and anonymity. The wireless fingerprints are generated using the link quality indicator values. Experimental validation on MICA Z motes shows that the proposed technique can detect adversarial channels with high accuracy. Security analysis of the proposed protocol using formal proofs as well as simulations shows the robustness against various types of attacks. Moreover, the energy requirements for the proposed protocol are shown to be significantly lower than existing protocols.

Internet of Things (IoT) devices are becoming ubiquitous, and may be arranged to form formal or ad hoc Command and Control (C2) networks. Such networks typically do not have a mechanism to facilitate the sharing of either data or control inputs. This paper examines this problem in the context of IoT devices operating within C2 systems which do not have a trusted relationship with each other. We propose a solution which we call syndication, to provide a controlled mechanism to share data between C2 systems of devices without a fully trusted relationship. This paper builds upon previous work which established a lightweight protocol for secure C2 operations within the IoT. Using the proposed approach enables not only sharing of data but also permits the external controller to submit moderated requests for actions to be performed. The paper concludes by examining how this approach could also be adopted to provide secure guest access to connected systems in a domestic or commercial context.

The Internet of Things (IoT) is increasingly being used in applications ranging from precision agriculture to critical national infrastructure by deploying a large number of resource-constrained devices in hostile environments. These devices are being exploited to launch attacks in cyber systems. As a result, security has become a significant concern in the design of IoT-based applications. In this article, we present a security architecture for IoT networks by leveraging the underlying features supported by software-defined networks (SDNs). Our security architecture not only restricts network access to authenticated IoT devices but also enforces fine granular policies to secure the flows in the IoT network infrastructure. The authentication is achieved using a lightweight protocol to authenticate IoT devices. Authorization is achieved using a dynamic policy driven approach. Such an integrated security approach involving authentication of IoT devices and enables authorized flows to protect IoT networks from malicious IoT devices and attacks. We have implemented and validated our architecture using ONOS SDN Controller and Raspbian Virtual Machines, and demonstrated how the proposed security mechanisms can counteract malware packet injection, DDoS attacks using Mirai, spoofing/masquerading, and man-in-the-middle attacks. An analysis of the security and performance of the proposed security mechanisms and their applications is presented in this article.

The main challenge for the Internet of Things (IoT) is to ensure interoperability between heterogeneous IoT entities. To support the interaction, intercommunication, and interoperability between these devices several solutions are proposed in the literature. The SDN (Software-defined Network) is one of these solutions to resolve the problem of the heterogeneous network used in IoT. To guarantee network interoperability, the SDN uses a centralized controller, which handles the entire network. The role of end devices in IoT is only forwarding data. The MQTT (Message Queuing Telemetry Transport) protocol is another solution for granting interoperability in IoT. Which is a publish/subscribe based messaging protocol that avoids direct connection between devices by relaying data through a central server called the broker. Combination of these two solutions to manage IoT devices makes it easy to add new devices without touching or changing the existing infrastructure. The new devices only need to communicate with the broker. Moreover, the Controller SDN is responsible for handling networks. Consequently, smart devices added don’t need to be compatible with the others. In this paper, we present the design and the implementation of a new IoT architecture, which is a combination of SDN technology and MQTT protocol. That enables heterogeneous IoT devices to be interoperable and interact without any problems. Our system utilizes the lightweight protocol MQTT with a new mechanism using several slave brokers and one master. The slaves manage the group of the end devices in the wireless IoT network, and the master broker installed in the SDN controller supervises the integral network. The SDN controller uses a multicast system to send MQTTdata across the external wireless network. As a result, that reduces transmission delay between wireless IoT network compared with the using of a standard MQTT.

Computationally lightweight and unconditionally secure key agreement protocols are very useful for secure communication in public networks. Recently, Guan et al. proposed a key agreement protocol whose security is based on the unpredictability of channel noise rather than computationally hard problems. These protocols are efficient, computationally lightweight, and unconditionally secure. However, authentication was not integrated into these protocols. In this article, we propose a new protocol with authentication capability that enables two nodes in the network to establish a secret session key for secure communication. It is more efficient, and it also preserves the lightweight and unconditional secure features of the key agreement protocols proposed by Guan et al. Therefore, it is more suitable for devices with limited computing power, such as sensors in Internet of Things (IoT).

RFID systems usually involve passive tags (with limited computing and storage capacity) to secure data exchange via wireless communication. This paper builds an effective lightweight privacy protection authentication protocol, over the XCro, rotation and XOR functions, to handle the privacy and security problems in RFID systems. We employ both BAN Logic and ProVerif to prove that the new protocol is secure, its writing logic is correct, the query results are true and the protocol is free of all common attacks. We also conduct the OPNET simulation to evaluate the performance of our protocol and the existing lightweight protocol of Fan, in terms of authentication time, throughput, bandwidth consumption rate and queuing delay. The obtained results show that our protocol is more secure and effective—because we can resist all of the mentioned common attacks by a more efficient authentication process which involves less calculations, communications and transmissions.

The current UTXO-based blockchains require the validators to keep the entire ever-growing UTXO set to verify transactions, which is unsuitable for ordinary machines since they occupy a large size of RAM in the long run, resulting in network centralizations. Recently, stateless blockchain technology has been proposed which uses the accumulator to combine the large UTXO set into one short, constant-sized commitment. However, the UTXO commitments in these methods are inefficient since the UXTO set is required dynamic addition and removal of elements as transactions are processed. In this work, we propose MiniChain, which replaces the UTXO set with two append-only data structures: STXO (Spent Transaction Outputs) set and TXO (Transaction Outputs) set. Thus, a valid UTXO must belong to the TXO set, but not in STXO set. Then, we construct a novel STXO commitment and TXO commitment by using a trapdoor-less RSA accumulator and a Merkle Mountain Range (MMR) respectively, greatly increasing the efficiency of accumulator. Besides, we introduce a cache mechanism, by storing the STXOs of latest N blocks, the transaction proof can be kept alive for a period of time, avoiding constantly recomputing proofs for unaccepted transactions. Our evaluation shows that (i) MiniChain only needs a fixed-size RAM and the disk usage grows very slow since only the block headers are stored; (ii) comparing to the state-of-the-art work, the performance of the accumulator update has been improved from O ( n 2 ) to O ( n ) , enabling MiniChain to support a higher TPS.

Smart grid as the future of power system improves efficiency, flexibility, and reliability by employing the information and communication technologies. However, these new technologies cause some challenges in security issues in the smart grid. In addition to the active and passive attacks in the communication link, such as tampering and eavesdropping, the physical attacks can also be performed on smart meters. In the absence of hardware protection, physical attacks could easily disrupt the major performance of the system. On the other hand, the security schemes must be designed as lightweight as possible according to the constrained resource of the smart meters. To solve the mentioned problems simultaneously, this article proposes a secure and lightweight protocol based on physically unclonable function for communication between the neighborhood gateways and smart meters. The security analysis shows that the proposed scheme not only resists against the all possible cyber and physical attacks, but also provides confidentiality, integrity, and mutual authentication. Moreover, the comparative performance evaluation demonstrates that the proposed scheme is efficient in terms of usage of storage space, communication overhead, and computational cost.

Wireless body area networks (WBAN) is a novel paradigm that is gaining popularity in a scenario of current wireless communication systems. It plays an essential role in healthcare applications like remote monitoring of health data. For instance, the crucial and confidential data about the condition of the patient’s physical health can be gathered and transferred through WBAN. Therefore, authentication and session key-agreements are integral security concerns for wearable sensors in WBAN. Moreover, as the wearable devices are resource-constraints, there is a need to develop a lightweight protocol to ensure authenticity, confidentiality, and integrity of the information. Li et al. presented an anonymous mutual authentication protocol to establish a session-key among wearable sensor nodes and the local hub node. However, after an in-depth analysis, we found that their scheme is susceptible to an intermediate node capture attack, and sensor node/hub node impersonation with intermediate node capture attacks. The scheme also does not provide anonymity with unlinkable sessions. This paper proposes a new anonymous mutual authentication and key agreement protocol in WBAN to overcome the security weaknesses in Li et al.’s protocol. The proposed protocol uses only basic symmetric cryptosystems like simple XOR and cryptographic hash functions; hence, it is efficient and lightweight. The validity and the correctness of the proposed protocol are evaluated using BAN-Logic, Real-Or-Random (ROR) model, and the broadly accepted AVISPA tool. The performance comparison of the proposed protocol with the existing related protocols shows the efficiency regarding communication and computational complexities. Hence, it is suitable to be used in real-life applications.

The communication security of constrained objects such as radio frequency identification (RFID) tags and wireless sensor network (WSN) is very challenging because it is not always possible to use the conventional on-the-shelf solutions for them, due to their limited available power and computational capabilities. To deal with this demand, many security protocols have been developed by the researchers so far. However, in many cases, the later analyses that have been carried out on these protocols have shown that they are vulnerable to one or few attacks, which could be enough to eliminate any application for such protocols. Following this direction, in this article, we analyze the security of four recent ultra-lightweight/lightweight protocols, by presenting important attacks including secret disclosure attack and desynchronization attack against them. To address the shortcoming of the previous protocols, we present a new security protocol based on lightweight block ciphers name it LBCbAP. In this protocol, we use CRAFT as the core security primitive. CRAFT is a tweakable block cipher which has been recently proposed and independent security analysis confirmed its security. Our detailed security analysis of LBCbAP, which is performed both informally and formally through the GNY logic and the Scyther tool, demonstrates its security against various types of attacks including secret disclosure and desynchronization attacks. The cost analysis of the designed protocol and comparison with the related lightweight protocols show that LBCbAP is cost efficient.

While Internet-of-Things (IoT) significantly facilitates the convenience of people's daily life, the lack of security practice raises the risk of privacy-sensitive user data leakage. Securing data transmission among IoT devices is therefore a critical capability of IoT environments such as Intelligent Connected Vehicles, Smart Home, Intelligent City and so forth. However, cryptographic communication scheme is challenged by the limited resource of low-cost IoT devices, even negligible extra CPU usage of battery-powered sensors would result in dramatical decrease of the battery life. In this paper, to minimize the resource consumption, we propose a communication protocol involving only the symmetric key-based scheme, which provides ultra-lightweight yet effective encryptions to protect the data transmissions. Symmetric keys generated in this protocol are delegated based on a chaotic system, i.e., Logistic Map, to resist against the key reset and device capture attacks. We semantically model such protocol and analyze the security properties. Moreover, the resource consumption is also evaluated to guarantee runtime efficacy.

The upsurge in the Internet of Things (IoT) has led towards an increasing interest in simplifying the control mechanism in the wireless network. The control mechanism is a challenge as it involves data acquisition and analysis, decision making, and actuation/control in IoT networks. This has led towards combining Software Defined Networks (SDN) and IoT for easy of controlling the network devices. The mobile application available at the tip of hands to control the connected devices to the internet has led to exponential growth in data. The management and handling the data intensive applications is a challenge to the network operators. SDN is a paradigm shift that enables network programmability, control, and management of diverse networking devices. This paper describes the data transmission in SDN and integration of SDN and IoT. The light weight protocol Message Queue Telemetry Transport (MQTT) is used for data transmission between the IoT devices. The result analysis shows that the light weight protocol MQTT is 30% efficient for data transmission in SDN IoT architecture. The testbed for integrating virtual network in SDN and real-time network for IoT applications using lightweight protocol is described.

Journal of Information Science and Technology, 12, 2, 21-30

Data transmission accounts for significant energy consumption in wireless sensor networks where streaming data is generated by the sensors. This impedes their use in many settings, including livestock monitoring over large pastures (which forms our target application). We present Ambrosia, a lightweight protocol that utilizes a window-based timeseries forecasting mechanism for data reduction. Ambrosia employs a configurable error threshold to ensure that the accuracy of end applications is unaffected by the data transfer reduction. Experimental evaluations using LoRa and BLE on a real livestock monitoring deployment demonstrate 60% reduction in data transmission and a 2 $$\times$$ × increase in battery lifetime.

The Internet of Things (IoT) and the Industrial Internet of Things (IIoT) are fast growing areas. Therefore, several protocols are specifically designed for these domains. CoAP (Constrained Application Protocol) is one of the more common ones. This lightweight protocol typically communicates over UDP, but can also use TCP and other carrier protocols, and is particularly suitable for embedded systems. In this work, we investigate CoAP with respect to covert communication and explore a new network hiding technique that is based on Artificial Resets. In addition, we investigate another covert channel by using the pattern PT15 Artificial Reconnections. We also propose and discuss detection methods for both covert channels.

The increase in need of connecting devices gave a path to the Internet of things (IoT). The heterogeneous nature of connecting with different devices through seamless connectivity aids IoT to connect and acquire needed information. The demand for machine-type communications (MTC) has provided way for modern algorithms, diverse services, technology to meet modern IoT needs. Cellular standards also creating a space to incorporate IoT along the sideline of regular network with low-power and long-range specifications. 3GPP release 13 introduced narrow band IoT (NB-IoT) along with LET-advance standard. In this paper, the state-of-the-art of the IoT application requirements in the 3GPP cellular-based low-power wide area solutions for massive to critical IoT is discussed. The need for changes in technology in occurrence to the sensor nodes and transmit information is also focused in this paper with SoC for NB-IoT.

Data transmission accounts for significant energy consumption in wireless sensor networks where streaming data is generatedby the sensors. This impedes their use in many settings, including livestock monitoring over large pastures (which formsour target application). We present Ambrosia, a lightweight protocol that utilizes a window-based timeseries forecastingmechanism for data reduction. Ambrosia employs a configurable error threshold to ensure that the accuracy of end applicationsis unaffected by the data transfer reduction. Experimental evaluations using LoRa and BLE on a real livestock monitoringdeployment demonstrate 60% reduction in data transmission and a 2X increase in battery lifetime., 13 pages, 7 figures, Nature Scientific Reports

Computationally lightweight and unconditionally secure key agreement protocols are very useful for secure communication in public networks, especially for sensors with limited computing res...

Mobile cloud computing has received a particular attention in recent years thanks to the expansion and easy accessibility of smartphones with enhanced capabilities, pushing for data owners to outsource more data to the cloud in order to serve the increasing number of mobile users. To protect data privacy, data have to be encrypted prior to outsourcing. Nevertheless, mobile users should still be able to query data, get the results corresponding to their requests and verify the integrity of the query results, all within a query privacy-preserving and efficient fashion. We focus in this work on the secure range query allowing to search for data belonging to a specific range. At the difference of previous works where data privacy and query results verification require separate structures and thus more overhead, our work achieves both data privacy and query results completeness verification using the encrypted data index and the vector neighbor chain (VNC). As a response to the intrinsic limitations of mobile devices, we design a lightweight protocol based on linear algebra operations for both 1-dimensional and multi-dimensional data. Practical experiments analysis on a real-world U.S. Census demographic dataset shows that our scheme guarantees the privacy-preserving property and is efficient in terms of computation and communication overhead.

Radio Frequency Identification (RFID) systems authenticate products as well as people without any physical contact. Using RFID systems is an inevitable part of recent identifying and shopping affairs. However, RFID systems have huge hardware limitations in tags side because of their need to be as cheap as possible and in access for vast number of products. Moreover, The identity of the tag owners has to be anonymous and secure from the attackers actions. These critical necessities have made researchers to concentrate on designing lightweight secure authentication protocols. In this paper, four new designed lightweight RFID authentication protocols are analyzed. Security and privacy of each protocol is analyzed, and the weaknesses are proved, discussed and modified. We demonstrate that none of them provide even weak privacy level. Each protocol is improved through a solution to overcome the weaknesses and provide at least the weak privacy. All of the privacy and security analysis are done in the Vaudenay model. Also, we propose a new lightweight protocol which uses the pros of the considered protocols and provides weak privacy level. Moreover, some comprehensive methods are proposed to provide weak privacy in the lightweight authentication protocols.

Securing the network communication represents one of the most important challenges in wireless sensor networks. The key distribution problem has been widely discussed in classical wireless sensor networks contrarily to heterogeneous ones. HWSNs (Heterogeneous Wireless Sensor Networks) have optimized the network capability and opened new security opportunities by introducing high resource capacity sensor nodes in the network. In this paper, an efficient dynamic authentication and key Management scheme is proposed for heterogeneous WSN. The main idea is to provide a single lightweight protocol for both authentication and key establishment while optimizing the security level. The key distribution algorithm is based on preexisting information to generate dynamic keys and does not require any secure channel and sharing phase which improves the security, energy efficiency and reduces the memory consumption. Experimental results have confirmed the performances of our mechanism compared to some of the existing security protocols.

The increased use of radio frequency identification (RFID) technology has made it difficult to maintain secure operations in RFID environments. In addition, establishing a secure system when the internet is unavailable and finding a secure method to share keys are challenges that must be addressed. Considering the limitations of RFID tagging in terms of space, power, and storage, there is a need for practical low-power hardware microcontrollers with lightweight encryption methods suitable for implementation. Our secure system, which is based on the use of hardware-embedded RFID tags, is a novel approach that employs four initialization vectors (IVs) and key pairs to develop solutions for the secure storage, distribution, and alteration of the IVs and keys for use with the MICKEY 2.0 stream cipher. We propose the use of a low-power RFID-compatible device to provide a secure solution for exchanging and storing IVs and key pairs in the absence of an internet or wireless connection. We call this device the near-field secure data extractor (NFSDE). In addition, we demonstrate its operation in a practical eHealth scenario. Software emulation of the device is used to test the related processes and evaluate their efficiency and security. The use of this simple RFID-compatible prototype device with a lightweight encryption system, which provides public-key-like security but is not internet-dependent, alleviates healthcare security issues and encourages the development of similar tools that can be adapted for use in other fields that require sensitive data to be securely handled.

Legacy systems are long-lived applications, with obsolete technology and degraded architecture. These systems hamper digital transformation and innovation, and require a great amount of resources for maintenance. The modernization of monolithic legacy systems is a strategy to promote better evolution and maintenance, taking advantage of new technologies such as microservices. Microservice architectural style is a paradigm to develop systems as a suite of small and autonomous services, communicating through a lightweight protocol. However, the migration of legacy systems to microservices is complex. Although we can find several studies on this topic, they usually focus on specific activities, e.g., the identification of the microservice boundaries in the legacy code. Also, existing pieces of work do not cover real-world scenarios, since they do not take into account organizational, operational, and technical aspects. To overcome this limitation, in this paper we present a roadmap for modernizing monolithic legacy systems with microservices. The roadmap is distilled from the existing body of knowledge, describing common activities and input/output information. The proposed roadmap is composed of eight activities, grouped in four phases, namely initiation, planning, execution, and monitoring. The main contributions are: (i) serve as a basis for practitioners to plan, execute, and monitor the modernization process; (ii) be a reference for researchers to design new studies; and (iii) motivate tool builders to deal with existing needs.

The recent rise in adaptation of Internet of Things (IoT) concepts has potential to transform industries such as healthcare, manufacturing and power-grids. The communication protocols are at the heart of IoT and one such lightweight protocol being in widespread use is the Message Queue Telemetry Transport (MQTT) protocol. In this paper, we address the need to verify the correctness of the MQTT protocol. We have proposed a PlusCal-2 and TLA+ based formal model to both model check the safety and liveness properties and provide execution traces in case of any violation. We have detailed our models and provided performance analysis results to explain the practicality of our technique.