Search

In this paper, we propose a formal security model and a construction methodology of interactive aggregate message authentication codes with detecting functionality (IAMDs). The IAMD is an interactive aggregate MAC protocol which can identify invalid messages with a small amount of tag-size. Several aggregate MAC schemes that can detect invalid messages have been proposed so far by using non-adaptive group testing in the prior work. In this paper, we utilize adaptive group testing to construct IAMD scheme, and we show that the resulting IAMD scheme can identify invalid messages with a small amount of tag-size compared to the previous schemes. To this end, we give the formalization of adaptive group testing and IAMD, and propose a generic construction starting from any aggregate MAC and any adaptive group testing method. In addition, we compare instantiations of our generic constructions, in terms of total tag-size and several properties. Furthermore, we show advantages of IAMD by implementing constructions of (non-)adaptive aggregate message authentication with detecting functionality and comparing these ones in terms of the data-size and running time of verification algorithms. [ABSTRACT FROM AUTHOR]

Medical records are transmitted between medical institutions using cloud-based Electronic health record (EHR) systems, which are intended to improve various medical services. Due to the potential of data breaches and the resultant loss of patient data, medical organizations find it challenging to employ cloud-based electronic medical record systems. EHR systems frequently necessitate high transmission costs, energy use, and time loss for physicians and patients. Furthermore, EHR security is a critical concern that jeopardizes patient privacy. Compared to a single system, cloud-based EHR solutions may bring extra security concerns as the system architecture gets more intricate. Access control strategies and the development of efficient security mechanisms for cloud-based EHR data are critical. For privacy reasons, the Dynamic constrained message authentication (DCMA) technique is used in the proposed system to encrypt the outsourced medical data by using symmetric key cryptography, which uses the Seagull optimization algorithm (SOA) to choose the best random keys for encryption and then resultant data is hashed using the SHA-256 technique. The results of the proposed model are evaluated using performance metrics, and the model attained a security of about 98.58%, which is proven to be superior because it adopts advanced random secret key generation, which adds more security to the system. [ABSTRACT FROM AUTHOR]

In an era of ever-evolving and increasingly sophisticated cyber threats, protecting sensitive information from cyberattacks such as business email compromise (BEC) attacks has become a top priority for individuals and enterprises. Existing methods used to counteract the risks linked to BEC attacks frequently prove ineffective because of the continuous development and evolution of these malicious schemes. This research introduces a novel methodology for safeguarding against BEC attacks called the BEC Defender. The methodology implemented in this paper augments the authentication mechanisms within business emails by employing a multi-layered validation process, which includes a MAC address as an identity token, QR code generation, and the integration of timestamps as unique identifiers. The BEC-Defender algorithm was implemented and evaluated in a laboratory environment, exhibiting promising results against BEC attacks by adding an extra layer of authentication. [ABSTRACT FROM AUTHOR]

Attackers try to forge or delete personal information access records to hide traces of their attacks. As personal information access records can be used to analyze infringement accidents or as legal evidence in the event of malicious attacks, maintaining their integrity is very important. This article presents measures to efficiently prove the integrity of distributed personal information access records. To construct a reliable log system, diversified security requirements are established, and mechanisms such as a hash chain, message authentication code, and Merkle tree are incorporated. Moreover, as integrity is proved through a third-party verification institution, attacks by external as well as internal attackers can be detected. During the validation process, existing log record protection methods fail to detect forgery or deletion of certain data or have difficulty identifying the time of attack, but such drawbacks are addressed by the proposed integrity verification process, with only a minor increase in computational load. [ABSTRACT FROM AUTHOR]

Intelligent vehicular ad hoc networks (VANETs) are the core of intelligent transportation systems, in recent years, it has received increasing attentions from the academic community. However, due to the openness and fragility, VANETs are confronted with many security problems. In order to solve the problems such as two-way authentication between intelligent vehicles and nearby RSUs, exchange of session keys and anonymity of intelligent vehicles, this paper proposes an anonymous authentication and key exchange protocol in the intelligent vehicle networks. In the protocol, an identity-based digital signature algorithm is designed to enable the intelligent vehicle to send authentication information to the nearby road side unit (RSU) in a completely anonymous manner. After the RSU validates the authentication information, a message authentication code will be calculated and sent to the intelligent vehicle as the response to realize two-way authentication. In addition, during the anonymous authentication process, the session key can be negotiated for subsequent secure communication. The protocol is designed based on the identity cryptosystem, which does not need complex certificate management. The performance evaluation shows that this protocol can be effectively deployed in intelligent vehicle application scenarios with highly sensitive information. [ABSTRACT FROM AUTHOR]

In today's highly competitive environment, it might be difficult to keep sensitive data or information safe. Sharing sensitive information between parties in a cloud environment requires a high level of trust between them. There are numerous methods for achieving data and information security, including cryptography, steganography, etc. This research introduces a new approach to mutual authentication by using a pre-trained model of a convolutional neural network (CNN) to identify malicious activity on the internet. In this research paper, we present a novel approach for enhancing the security of data in cloud computing environments through the design of a mutual authentication method for deep learning-based hybrid cryptography. Our approach combines the strengths of hybrid cryptography and the power of deep learning to provide a robust and adaptable solution for securing data in the cloud. One of the key innovations of our approach is the integration of a pre-trained convolutional neural network (CNN) model. This CNN plays a pivotal role in identifying and mitigating malicious activities on the internet that could pose a threat to cloud-based data. By continuously monitoring network traffic and data patterns, the CNN contributes to the proactive defense mechanism of our system. Secure communication between the involved parties is ensured by combining cryptography with authentication for key agreements. However, no known security method has simultaneously provided a high level of security and a fast execution time. When compared to older encryption systems, hybrid encryption techniques are far superior in terms of providing peace of mind for users. In order to provide robust security, this paper presents hybrid encryption procedures (HEA) by combination of symmetric key (Message Authentication Code [MAC]) and asymmetric key cryptographic procedures (Modified and Enhanced Lattice-Based Cryptography [MELBC]). Results from experiments show that the suggested HEA algorithm offers more security than competing security algorithms. [ABSTRACT FROM AUTHOR]

Authenticated Encryption (AE) protects confidentiality and integrity at the same time. The sponge construction is based on an iterated permutation or transformation that can be used to implement hashing, and AE schemes, among others. Sponge-based AE schemes offer desirable characteristics like parallelizability and incrementality. In addition, they provide security features such as protection against Chosen Plaintext Attacks, Chosen-Ciphertext Attacks, and Side-Channel Attacks (SCAs). Traditionally AE schemes assume the tag length, also called the stretch, as a fixed parameter per key, and the security is proved according to that assumption. However, the variable tag length per key could happen due to misconfiguration or misuse. In that case, the security would be violated, so it is vital to accommodate variable tag length without sacrificing other desirable features. Reyhanitabar et al. proposed Key Equivalent Separation by Stretch feature and concretized it for protection against tag length misuse attacks in block cipher-based AE schemes. However, the problem remains unresolved for sponge-based constructions, where current sponge-based schemes are vulnerable to tag length variation under the same key attacks. This work aims to bridge this gap by proposing a parallel, sponge-based AE scheme with a variable tag length per key that protects against SCAs and suggesting a lower bound for the recommended tag length. Finally, the security of the proposed scheme is discussed, and its performance is analyzed after implementing the proposed AE scheme in the C programming language.

Authenticated encryption (AE) is a cryptographic construction that simultaneously protects confidentiality and integrity. A considerable amount of research has been devoted to the area since its formal inception in 2000. Different lines of research have been proposed to enhance the available schemes in terms of security, efficiency, and design and to implement new ideas. However, a comprehensive systematic literature review (SLR) of the topic has not been provided to the best of the authors’ knowledge. This study fills this gap in the literature by proposing a framework for classifying AE schemes and highlighting past contributions to help researchers familiarize themselves with the current state and directions for future research in the area. This SLR covered AE schemes proposed from 2000 to 2020. A total of 217 articles, selected from eight sources, were categorized into independent schemes, CAESAR competition schemes, and NIST lightweight competition schemes. These schemes were then classified according to their design approaches, security-related properties, and functional features. Our analysis reveals that a significant outstanding challenge in AE is to balance security, efficiency, and the provision of desirable features.

Since its birth in 2000, authenticated encryption (AE) has been a hot research topic, and many new features have been proposed to boost its security or performance. The Block cipher was the dominant primitive in constructing AE schemes, followed by stream ciphers and compression functions until the sponge construction emerged in 2011. Sponge-based AE schemes provide functional characteristics such as parallelizability, incrementality, and being online. They also offer security features for protection against active or passive adversaries. Currently, there exist parallel sponge-based AE schemes, but they are not protected against simple power analysis (SPA) and differential power analysis (DPA). On the other hand, sponge-based AE schemes that protect against such attacks are serial and cannot be parallelized. Furthermore, sponge-based AE schemes handle the nonces in a way that could allow misuse. So, sponge-based AE schemes that hide the nonce from adversaries are also an open problem. This work aims to bridge these gaps by proposing a parallel sponge-based AE with side-channel protection and adversary-invisible nonces (PSASPIN), using parallel fresh rekeying and the duplex mode of the sponge construction. A leveled implementation is used to implement the key generation part using a pseudorandom function (PRF) based on the Galois field multiplication. The data processing (the rekeyed) part is implemented using the sponge-based duplex mode. Finally, the security proof of the proposed scheme is provided using game-based theory according to the PRP/PRF switching lemma, and its performance is analyzed.

In modern cryptography, hash functions are considered as one of the key components for secure communication. They play a vital role in a wide range of applications such as ensuring the authentication and integrity of the data, in forensic investigation, password storage, random number generations for unique session keys, and for creating a unified view in blockchain. The Avalanche effect (also known as diffusion) is an important characteristic of a hash function where a minor change in the hash function’s input will result in a significantly different output. The absence of this property implies that the hash function is vulnerable to various attacks such as collision attack, length extension attack, and preimage attack. Through this research, we have investigated the Avalanche effect of sixteen hash functions and two hash-based applications, namely Hash-based Message Authentication Code (HMAC) and Public Key Cryptography Standards (PKCS). To measure the performance of these hash functions and hash-based applications, we have implemented a generic circuit using CrypTool for automating the simulation process for multiple trials. Simulation results indicate that around half of the inputs of each hash function failed to exhibit the Strict Avalanche Criterion (SAC) and, Bit Independence Criterion (BIC). Moreover, we ranked the hash functions based on Multi Criteria Decision Metrics (MCDM) using intermediate states of simulation results. Furthermore, a total of fifteen statistical tests were carried out to evaluate the randomization property of the hash functions using NIST (National Institute of Standards and Technology) toolkit. This study is aimed to open up a future scope of research to the need for improvement of various hash functions by analyzing the randomization and non-correlation properties of existing functions in terms of the Avalanche effect.

Internet of Things is a valuable tool in various application domains, including smart cities, industrial production, healthcare, and so on. Every connected device can share messages with others in an IoT network. However, since such a network is vulnerable to security breaches, authenticating the integrity of these messages is essential. In addition, the message may contain sensitive information, and a portion of the information in the message needs to be authenticated. In the literature, Prefix Verifiable Message Authentication Code has been proposed under such scenario, but it only works if the portion to be authenticated is a prefix of the message. In this paper, we propose a more general scheme called Scalable Prefix Verifiable Message Authentication Code (SPMAC). It inherits the advantage of PMAC while overcoming the drawbacks. For practical SPMAC construction, we propose two provably secure generic constructions, Fibo-SPMAC and ECP-SPMAC. Both of them have practical applications in IoT scenarios. The experiment results demonstrate the performance advantage of SPMAC in terms of efficiency. Moreover, Fibo-SPMAC has a good performance when the bandwidth is limited, whereas ECP-SPMAC performs better when the bandwidth is large. [ABSTRACT FROM AUTHOR]

IEC61850 is the mainstream of the development for substation automation. This paper presents a practical consideration and analysis for implementing a secure sampled measured value (SeSV) message in substation automation system. Due to the lack of security features in the standard, IEC Working Group 15 of Technical Committee 57 published IEC62351 on security for IEC61850 profiles. However, the use of authentication methods for SV based on IEC62351 standards are still not integrated, and computational capabilities and performance are not validated and tested with commercial grade equipment. Hence, this paper shows the performance of security feature enabled SeSV packets transmitted between protection and control devices by appending a message authentication code (MAC) to the extended IEC61850 packets. A prototype implementation on a low cost commodity embedded system has proved that the MAC-enabled SV message can fully secure the process bus communication in the digital substation with negligible time delay. [ABSTRACT FROM AUTHOR]

In current days cloud domain gained a tremendous increase of user's attention by several small and large scale companies including Software, BPO, Medical, Schools and a lot more. Since there was very less security in the primitive clouds for storing and accessing the information from the remote locations, still there was a lot of demand for the data which is to be stored in the cloud. As we know that in primitive clouds, there are no concepts like privacy for the data in terms of encryption and message digest in order to provide data authorization. In current days cloud servers are almost dishonest in nature by omitting intentionally some qualified results to save computational resources and communication overhead. In this paper, we try to design a new protocol and analyze the importance of Cuckoo filter over encrypted cloud data to provide data search accurately by the cloud users. Here we try to encrypt the data using AES algorithm and try to generate MAC key for the data which is uploaded and downloaded by the cloud users. For data authorization we use MD5 algorithm and with the help of MD5 algorithm, we can generate a short signature to find out the data verification and finally we try to apply Cuckoo filter for data integrity. This cuckoo filter will try to store the data in duplicated manner and try to provide end user with original data. [ABSTRACT FROM AUTHOR]

Cryptography has been used as the first line of defense to ensure data integrity. However, it incurs a significant overhead for short packets which represent the most common form of traffic in emerging applications, such as the Internet of Things. In this paper, we propose an interdisciplinary framework for detecting false data in short packets that are collected from multiple sources through a relay. The proposed scheme performs a lightweight cryptographic integrity check that employs a short message authentication code, thereby reducing the overhead for data integrity, followed by the maximum a posteriori (MAP) test at the physical layer that detects any remaining false data that the cryptographic integrity check misses. This interdisciplinary approach interplays between the cryptographic integrity check and the physical-layer integrity check to assure the data integrity of short packets with reduced overhead and low latency. The proposed scheme can also provide a significant reduction in the average probability of detection error over the traditional cryptographic integrity check. [ABSTRACT FROM AUTHOR]

Securing the aggregated data of the wireless sensor networks (WSNs) is a vital issue to minimize energy consumption and face potential attacks. This paper presents a novel end to end encryption scheme defined as Aggregating Secure Data-Separate MAC (SDA-SM). The importance of the SDA-SM is twofold. First, it separates the secured aggregated data and the message authentication codes (MAC) into two different packets. Second, it transmits these packets in a random separate time-slot according to the scheduling of the TDMA. Moreover, the TDMA applied in the LEACH protocol is modified to adequate to the proposed SDA-SM scheme. The SDA-SM uses MACs to verify the integrity of the aggregated data and uses a sensor protected identifier to authenticate the source of data. The simulation results of the experiments assure the SDA-SM objectives can be achieved with less computation of the communication overheads than earlier techniques. Besides, SDA-SM will be able to accomplish the integrity and confidentiality of accurate aggregated data while saving the energy to prolong the network lifetime. [ABSTRACT FROM AUTHOR]

Tweakable block ciphers (TBCs) have proven highly useful to boost the security guarantees of authentication schemes. In 2017, Cogliati et al. proposed two MACs combining TBC and universal hash functions: a nonce-based MAC called NaT and a deterministic MAC called HaT. While both constructions provide high security, their properties are complementary: NaT is almost fully secure when nonces are respected (i.e., n-bit security, where n is the block size of the TBC, and no security degradation in terms of the number of MAC queries when nonces are unique), while its security degrades gracefully to the birthday bound (n/2 bits) when nonces are misused. HaT has n-bit security and can be used naturally as a nonce-based MAC when a message contains a nonce. However, it does not have full security even if nonces are unique. This work proposes two highly secure and efficient MACs to fill the gap: NaT2 and eHaT. Both provide (almost) full security if nonces are unique and more than n/2-bit security when nonces can repeat. Based on NaT and HaT, we aim at achieving these properties in a modular approach. Our first proposal, Nonce-as-Tweak2 (NaT2), is the sum of two NaT instances. Our second proposal, enhanced Hash-as-Tweak (eHaT), extends HaT by adding the output of an additional nonce-depending call to the TBC and prepending nonce to the message. Despite the conceptual simplicity, the security proofs are involved. For NaT2 in particular, we rely on the recent proof framework for Double-block Hash-then-Sum by Kim et al. from Eurocrypt 2020.

Cloud storage has gained increasing attention from the industry and research communities with concerns about data stored in cloud computing environments, despite its many advantages. The reasons come from economic viability to the latency along with behavioral changes that may affect the applications that use data stored remotely. Among those challenges, there is the problem of ensuring the integrity and retrievability of users' data in the cloud. Several schemas have been proposed: proof of data possession (PDP), proof of retrievability (PoR), and proof of ownership (PoW) that differ on the approach to guarantee the effective retrieval of data stored remotely. In this paper, a novel PoR protocol is proposed: hyper-scalability, availability, and integrity layer (Hy-SAIL), where a new PoR scheme adds higher availability to data stored and a flexible manner to perform integrity checks. It is demonstrated that Hy-SAIL leads to an efficient and scalable cryptographic system that meets near-optimal bounds in terms of communication and storage complexities. It is also proposed a new adversarial model that aggregates the main functionalities of a realistic adversary in cloud computing environments. Hy-SAIL operates on data that are not affected by any kind of incremental change or update, which is the characteristic of various file types stored in clouds, such as stored video and audio streams. When compared to other systems, such as HAIL, Hy-SAIL is more scalable and efficient. The results collected with an unoptimized implementation of Hy-SAIL point to a better perspective than other approaches.

Recent advancements in the field of electronic commerce and internet banking have led to the growing need for a secure communication system. Various other areas including military require a highly reliable system so as to make sure that the shared data is confidential and unaltered.A negligence over these factors can lead to a huge and immutable loss. In this paper, a novel and Efficient Hash Algorithm(EHA)is presented which inherits the basic architecture of SHA-160. The performance of the proposed algorithm is evaluated by comparing it with the existing techniques which include MD2, MD5, SHA-160, SHA-256, SHA384 and SHA-512. The comparison is done on the basis of NIST statistical test suite for random numbers and avalanche criteria. The results reveal that the suggested technique is more efficient in terms of randomness and throughput, thus, it can be efficiently used in any data sensitive environments.