Search

Summary: The proposed work introduces two schemes for secure device authentication and key agreement (SDA & KA) mechanisms. Initially, an efficient implicit certificate approach based on the Elliptic curve Qu–Vanstone (EIC‐EcQuV) scheme is developed in the first stage to instantly concur on the session key. The proposed scheme implicitly performs quick authentication of the public key. Also, this scheme prevents the attacker from creating fake key combinations. Through EIC‐EcQuV, the implicit certificate (IC) is distributed which helps to implicitly authenticate the user. This work also proposes ithe developed Public Key Certificateless Cryptosystem (PKCIC) scheme in the second stage, whch was also for the SDA & KA mechanism. In the EIC‐EcQuV scheme, efficient authentication is enabled, but public key theft is possible. However, in the PKCIC scheme, authentication is performed through partial keys, and the public key is secured via the Schnorr signature. The efficiency of the proposed schemes is proved by comparing the attained results with previous schemes. The proposed method obtains the computational cost of 0.0583 s for end‐to‐end devices, 0.06111 for network servers, and 0.00071 s for the gateway, with an execution time of 78.624 for 1000 devices. The attained key agreement of the proposed EIC‐EcQuV is 0.953 s, and PKCIC is 0.9988 s. [ABSTRACT FROM AUTHOR]

Gaia-X, a European initiative, aims to create a digital sovereignty framework for service ecosystems in the future Internet. Its applicability to the health domain was explored in the Gaia-X-Med project, which aimed to establish a common dataspace for various medical use cases based on Gaia-X principles. This paper presents a trust- and consent-based approach to the secure authentication and digital contract negotiation central to this endeavor and discusses the challenges that arose during the adoption of the Gaia-X framework, particularly relating to the strict requirements of the European healthcare domain with regards to privacy and consent regulations. By exploring the practical implications of Gaia-X in the healthcare context, this paper aims to contribute to the ongoing discussions surrounding the digital sovereignty of both citizens and corporations, as well as its realization via future Internet technologies. [ABSTRACT FROM AUTHOR]

The storage of data with access controllability in sharing data between multiple users in a dispersed environment is now the most pressing issue in cloud computing. Cloud computing's unique feature allows its subscribers to exchange and manage their data with one another safely. However, privacy is essential for all cloud users to communicate freely and openly, as data is accessed by unwanted parties in the cloud. Cloud services have employed numerous security-related techniques for efficient and safe user data exchange. These methods provide efficient, flexible, and reliable access control rules between users when exchanging data. But, they each have advantages and disadvantages concerning key generation and data security. To address the need for adaptable, scalable, and trustworthy access control while exchanging data across a dispersed network, this research proposes a novel access control-based privacy-preserving approach. In terms of cipher text and critical policy security, this method is an extension of attribute-based encryption and the only difference is that with cloud computing, users hierarchically share data, and access control policy amongst shared users is evaluated efficiently. Our method includes sophisticated security features like the revocation of users and access rights of users for outsourced data in the cloud. It also provides scalability and dependability in producing critical structures with dynamic qualities. Experimental results demonstrate that the suggested method improves the current system in terms of cloud data sharing efficiency, scalability, and dependability.

In the rapidly evolving landscape of biometric payment systems, the integration of advanced encryption techniques is crucial for ensuring robust security and privacy. This paper explores cutting-edge encryption methodologies tailored for biometric data in the context of big data and artificial intelligence (AI) applications. We investigate how these advanced techniques address the unique challenges posed by the vast amounts of sensitive biometric information generated and processed in modern payment systems. The study provides an overview of various encryption strategies, including homomorphic encryption, secure multi-party computation, and quantum-resistant algorithms, evaluating their effectiveness in safeguarding biometric data against emerging threats. Additionally, the paper examines the role of AI in enhancing encryption mechanisms and optimizing performance, highlighting how machine learning models can predict and mitigate potential vulnerabilities. By analyzing real-world case studies and empirical data, we offer insights into the practical implementation of these technologies and their impact on the security landscape of biometric payments. This research contributes to a deeper understanding of how advanced encryption and AI can collaboratively fortify biometric payment systems, ultimately paving the way for more secure and privacy-preserving financial transactions. [ABSTRACT FROM AUTHOR]

The storage of data with access controllability in sharing data between multiple users in a dispersed environment is now the most pressing issue in cloud computing. Cloud computing's unique feature allows its subscribers to exchange and manage their data with one another safely. However, privacy is essential for all cloud users to communicate freely and openly, as data is accessed by unwanted parties in the cloud. Cloud services have employed numerous security-related techniques for efficient and safe user data exchange. These methods provide efficient, flexible, and reliable access control rules between users when exchanging data. But, they each have advantages and disadvantages concerning key generation and data security. To address the need for adaptable, scalable, and trustworthy access control while exchanging data across a dispersed network, this research proposes a novel access control-based privacy-preserving approach. In terms of cipher text and critical policy security, this method is an extension of attribute-based encryption and the only difference is that with cloud computing, users hierarchically share data, and access control policy amongst shared users is evaluated efficiently. Our method includes sophisticated security features like the revocation of users and access rights of users for outsourced data in the cloud. It also provides scalability and dependability in producing critical structures with dynamic qualities. Experimental results demonstrate that the suggested method improves the current system in terms of cloud data sharing efficiency, scalability, and dependability. [ABSTRACT FROM AUTHOR]

Rapid advancements in innovation, the Internet of Things (IoT), and edge computing have provided room for companies, government agencies, well-being administrations, and organizations to offer their kind of assistance through the cloud. Operating these cloud administrations requires monetary and computational assets to acquire and protect information from vindictive elements and to handle the multitude of information these administrations generate through nervous and IoT gadgets. Scalability, system availability, network transmission, and load relocation are some of the issues with the parallel file system. In the literature, few works are reviewed for obtaining load balancing but it does not consider the secure authentication phase in fog computing. Secure authentication and load balancing are critical challenges in a fog computing environment. In this paper, we develop Adaptive Load Balancing and Secure Authentication (ALBSA) for managing load balancing schemes and secure authentication schemes in fog computing. Normally, the Edge Data Centres (EDC) are utilized to set up as a distributed system and it is located among the data source and cloud datacentre. So, the proposed ALBSA is utilized to enable efficient authentication and workload management (load balancing). The proposed method is a combination of Blockchain technology and the Pelican Optimization Algorithm (POA). Based on resource utilization and response time, efficient load balancing is achieved. Additionally, this paper develops a blockchain-based authentication system that utilizes the characteristics and advantages of blockchain and smart contracts to authenticate users securely. The implemented system uses the email address, username, Ethereum address, password, and data from a biometric reader to register and authenticate users. The proposed methodology is implemented and evaluated based on performance metrics. To justify the efficiency of the proposed technique, it is contrasted with the traditional techniques. The proposed method is achieved, Encryption time is 4.2ms, the waiting time is 0.28ms and the decryption time is 10.21ms. [ABSTRACT FROM AUTHOR]

The only thing that sets fog computing apart from the cloud is its proximity to end users, which allows them to process and respond to customers faster. Second, it helps the Internet of Things, sensor networks, and real-time streaming apps—all of which depend on dependable and fast internet access. This study develops the optimal technique for fog computing load balancing and authentication. The Improved Tasmanian devil optimization (ITDO) algorithm and blockchain technology are combined in the suggested strategy. Blockchain technology is applied to data security and user authentication. Fog computing load balancing is optimised by the TDO, which manages optimal load balancing. Blockchain network nodes called fog nodes and edge devices log and verify the load-blanking procedure. In fog computing, load balancing and user authentication are the main research objectives. For load balancing, novel multi-objective function is designed. The performance of presented technique is analysed based on various metrics and performance compared with different techniques. For experimental analysis proposed approach attained the minimum waiting time of 25 s. [ABSTRACT FROM AUTHOR]

Gaia-X, a European initiative, aims to create a digital sovereignty framework for service ecosystems in the future Internet. Its applicability to the health domain was explored in the Gaia-X-Med project, which aimed to establish a common dataspace for various medical use cases based on Gaia-X principles. This paper presents a trust- and consent-based approach to the secure authentication and digital contract negotiation central to this endeavor and discusses the challenges that arose during the adoption of the Gaia-X framework, particularly relating to the strict requirements of the European healthcare domain with regards to privacy and consent regulations. By exploring the practical implications of Gaia-X in the healthcare context, this paper aims to contribute to the ongoing discussions surrounding the digital sovereignty of both citizens and corporations, as well as its realization via future Internet technologies.

Low Earth Orbit (LEO) satellite communication systems typically achieve identity authentication through the encryption and decryption of two-way information, which requires complex key management systems. In contrast, the integration of navigation and communication (NavCom) signals provides novel opportunities for physical observation and authentication solutions due to its measurement functions. This paper introduces a novel signal authentication scheme based on twice two-way satellite time transfer (TWSTT) for LEO satellite systems. It leverages the non-mutated nature of the clock difference to ascertain the legitimacy of the signal by measuring the clock difference of signals at different instances. Unlike traditional authentication methods, this approach directly exploits the temporal and spatial characteristics of the signal, negating the necessity for intricate authorization key systems. Additionally, it adeptly tackles the challenges posed by spoofing interference. The performance analysis indicates that this scheme can achieve a high detection probability for the repeater spoofing signal in the low carrier-to-noise ratio conditions. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) devices are used in almost every aspect of life to automate routine or critical tasks with great precision. The IoT nodes, users, edge nodes, cloud resources, and the connected network are critical components of IoT-Edge-Cloud integration. Any unauthorized access to these resources may halt or bring down the whole IoT infrastructure leading to a severe impact. Hence, authenticating and authorizing these components is essential. Thus, this paper proposes an authentication scheme to securely integrates users, IoT nodes, Edge node, and the cloud infrastructure. We also proposed a reliable cloud data storage and retrieval mechanism using an Erasure Coding strategy in order to store the data generated by IoT infrastructure. We validate the proposed authentication protocols using the well-known and widely used AVISPA simulator tool. The results demonstrate that the proposed authentication protocols are secure against a wide range of security attacks. Further, a comprehensive security analysis was carried out to demonstrate that our protocols are secure against possible attacks and include essential security features. The proposed scheme provides mutual authentication, accessibility, confidentiality, scalability, secure storage, and a secure communication mechanism in the integrated IoT-Edge-Cloud infrastructure with reliable cloud storage. [ABSTRACT FROM AUTHOR]

Internet-of-Things (IoT) in digital healthcare service providers forms large-scale distributed networks where entities at the edge enable dynamic communication and collaboration. Rapid rise in connected devices generates a high volume of real-time data susceptible to various security and privacy attacks. Distributed IoT has escalated the requirement of dynamic scalability in smart healthcare service providers. Secure authentication for accessing healthcare data in distributed IoT becomes essential to prevent impersonation and confirm ethical medical information exchange. Several authors have proposed privacy-preserving authentication protocols over unsecured public networks. However, their protocols lack dynamic scalability concerning collective security and privacy requirements. We propose a privacy-preserving scalable authentication protocol solution jointly fulfilling robust security and achieving content and contextual privacy. We introduce a partially trusted third party (TTP) responsible only for dynamically performing new user authentication without restarting existing communication channels. The proposed protocol incorporates dynamic tokens and secret shared key updation to enable robust security while achieving dynamic scalability. Anonymity and untraceability are attained using selective encryption over partial personally identifiable information. This also achieves automatic fake identity rejection, protecting legitimate credentials on-the-fly and at the TTP storage. We illustrate formal security analysis using Real-or-Random oracle model and formal validation using a scyther security verification tool. Theoretical analysis demonstrates that our protocol is resilient against known security and privacy attacks. Finally, a performance evaluation with relatively similar modeled schemes is elucidated to validate the utility of our solution. [ABSTRACT FROM AUTHOR]

A self-contained connection of wireless links that functions without any infrastructure is known as Mobile Ad Hoc Network (MANET). A MANET's nodes could engage actively and dynamically with one another. However, MANETs, from the other side, are exposed to severe potential threats that are difficult to counter with present security methods. As a result, several safe communication protocols designed to enhance the secure interaction among MANET nodes. In this research, we offer a reputed optimal routing value among network nodes, secure computations, and misbehavior detection predicated on node's trust levels with a Hybrid Trust based Reputation Mechanism (HTRM). In addition, the study designs a robust Public Key Infrastructure (PKI) system using the suggested trust evaluation method in terms of "key" generation, which is a crucial component of a PKI cryptosystem. We also concentrate on the solid node authenticating process that relies on pre-authentication. To ensure edge-to-edge security, we assess safe, trustworthy routes to secure computations and authenticate mobile nodes, incorporating uncertainty into the trust management solution. When compared to other protocols, our recommended approach performs better. Finally, we use simulations data and performance evaluation metrics to verify our suggested approach's validityOur approach outperformed the competing systems in terms of overall end-to-end delay, packet delivery ratio, performance, power consumption, and key-computing time by 3.47%, 3.152%, 2.169%, and 3.527%, 3.762%, significantly. [ABSTRACT FROM AUTHOR]

The development of 5G networks has rapidly increased the use of Industrial Internet of Things (IIoT) devices for control, monitoring, and processing purposes. Biometric-based user authentication can prevent unauthorized access to IIoT devices, thereby safeguarding data security during production. However, most biometric authentication systems in the IIoT have no template protection, thus risking raw biometric data stored as templates in central databases or IIoT devices. Moreover, traditional biometric authentication faces slow, limited database holding capacity and data transmission problems. To address these issues, in this paper we propose a secure online fingerprint authentication system for IIoT devices over 5G networks. The core of the proposed system is the design of a cancelable fingerprint template, which protects original minutia features and provides privacy and security guarantee for both entity users and the message content transmitted between IIoT devices and the cloud server via 5G networks.Compared with state-of-the-art methods, the proposed authentication system shows competitive performance on six public fingerprint databases, while saving computational costs and achieving fast online matching. [ABSTRACT FROM AUTHOR]

Recently the IoT technology is widely used in the field of smart cities, smart banking, and smart transportation system, etc. Various sensors can be installed in an open environment which allows users to collect the information in an easy way using the internet of things. However, due to the open environment, it's really difficult to provide security to the communicated information. In this paper, a secure authentication technique is presented for connecting different IoT devices in the smart city infrastructure. This technique shows the legitimacy of IoT sensors (IOi) to the reader (Ri) and Authentication Entity. In this paper, a set of primitives and the cubic equation are used to propose a secure authentication technique. In the proposed technique, an authentication entity is introduced between the IoT sensor and the receiver. The authentication entity will be responsible for performing the authentication process. The proposed authentication technique includes a strong mathematical procedure, which is very complex. The computational cost and Energy cost have also been analyzed and compared with previous techniques. It is providing a secure authentication process for the different IoT sensors, which is useful to start a secure communication with the receiver. The proposed technique offers the best computation and energy cost in comparison with the previous techniques. [ABSTRACT FROM AUTHOR]

The increasing diversity of Internet-of-Things (IoT) application scenarios and explosive growth of access devices have brought more frequent exchanges of resources between different administrative domains. Cross-domain authentication has become a key to safeguard communication and resource interaction among domains. Traditional centralized authentication schemes present heavy management overhead and trust challenges in cross-domain scenarios. Most of existing studies are incapable of establishing trust relationships between domains deployed with different authentication schemes, rendering such high-cost schemes difficult to be generalized. Further, the cross-domain scenario of IoT also raises additional requirements for device privacy and system overhead. In order to tackle these issues, this paper proposes a complete cross-domain authentication and privacy protection scheme, called CCAP, for the IoT based on consortium blockchain. CCAP achieves cross-domain authentication among the IoT domains which may have different configurations from each other. Further, CCAP can be cost-effectively deployed in resource-limited IoT domains and can offer privacy protection and efficient and secure communication for IoT devices. We demonstrate the effectiveness and efficiency of the scheme through experiments in virtual and physical experiment environments as well as comparing and analyzing CCAP with state-of-the-art work. [ABSTRACT FROM AUTHOR]

The significant and rapid development of the Internet of Things (IoT) in recent years has greatly benefited people's lives. However, there are serious security and privacy concerns that need to be addressed when using the IoT for distributed authentication. In this article, we propose a secure fingerprint authentication system to protect user privacy for authentication on IoT devices. The proposed system applies a two-stage feature transformation scheme. Specifically, a weight-based fusion mechanism is designed in the first stage, while the second stage is featured by a linear convolution-based transformation with element removal from the convolution output to increase the security and protection. The proposed authentication system satisfies all the requirements of cancelable biometrics: accuracy, revocability, and diversity, unlinkability, and noninvertibility. Evaluated over six public fingerprint databases, the proposed authentication system exhibits highly competitive performance when compared with the existing cancelable fingerprint templates. Moreover, its energy efficiency on savings in memory space and low computational costs make the proposed scheme a good fit for resource-limited IoT devices. [ABSTRACT FROM AUTHOR]

The photochromic phenomenon has been recently used as a fascinating technology in the development of highly efficient anti-counterfeiting materials with dual-mode security encoding of concurrent photochromism and fluorescence emission. Herein, we successfully developed lanthanide-doped aluminate nanoparticles (LAN)/polystyrene (PS) electrospun nanofibers as novel secure authentication films. Different ratios of lanthanide-doped aluminate nanoparticles were mixed with polystyrene-based copolymer solutions in N,N -dimethylformamide (DMF) and subjected to electrospinning to afford photochromic and fluorescent nanofibers. The generated electrospun nanofibers demonstrated a narrow diameter distribution, a smooth surface and well-defined morphological properties. The produced smart nanofibers were applied onto cellulose paper sheets to demonstrate a dual-mode secure strategy with a simple and rapid authentication. LAN was prepared in the nano-scale for better dispersion in PS, which guarantee the formation of transparent films. LAN was studied by transmission electron microscope (TEM) and X-ray diffraction (XRD). LAN displayed diameters of 5–12 nm. On the other hand, the fibrous diameters of LAN-PS samples were studied by scanning electron microscopy (SEM) to indicate diameters of 200–300 nm. The induced security marking was invisible (363 nm) under visible daylight turning into visible green (520 nm) color under ultraviolet irradiation demonstrating a bathochromic shift. Both excitation and emission displayed high intensities. The security marking was fully reversible under ultraviolet/visible irradiation cycles without fatigue. Those advantageous properties could be attributed to the high surface area of the chromogenic nanofibrous films to result in high absorption of light leading to strong optical dual-mode photo-responsiveness. The generated LAN-PS hybrid films showed improved hydrophobic properties with increasing LAN. The nanofibers showed transparency, stretchability and flexibility. The present strategy can be reported as an efficient technology to develop many anti-counterfeiting products toward a better market with social and economic values to avoid fake products. [ABSTRACT FROM AUTHOR]

Identity authentication technology is a key technology in the Internet of things (IoT)security field which ensures the authenticity of the identity information of users and device nodes connected to the IoT.Due to the low cost,low power consumption,small storage of IoT devices and heterogeneity of IoT network,the identity authentication mechanisms in traditional computer networks are often not applicable.Firstly,the development process of IoT was introduced,the security risks of IoT and the challenges faced by the authentication work were analyzed.Then the emphasis was put on comparison of the advantages and disadvantages among five typical authentication protocols.Moreover,the authentication technologies in several practical scenarios of RFID,smart grid,Internet of vehicles,and smart home were summarized and analyzed.Finally,the future research direction was discussed.

Cloud Computing has emerged as an extensively used technology not only in the IT sector but almost in all sectors. As the nature of the cloud is distributed and dynamic, the jeopardies present in the current implementations of virtualization, numerous security threats and attacks have been reported. Considering the potent architecture and the system complexity, it is indispensable to adopt fundamentals. This paper proposes a secure authentication and data sharing scheme for providing security to the cloud data. An efficient IPSO-KELM is proposed for detecting the malicious behaviour of the user. Initially, the proposed method starts with the authentication phase of the data sender. After authentication, the sender sends the data to the cloud, and the IPSO-KELM identifies if the received data from the sender is an attacked one or normal data i.e. the algorithm identifies if the data is received from a malicious sender or authenticated sender. If the data received from the sender is identified to be normal data, then the data is securely shared with the data receiver using SHA256-RSA algorithm. The upshot of the proposed method are scrutinized by identifying the dissimilarities with the other existing techniques to confirm that the proposed IPSO-KELM and SHA256-RSA works well for malicious user detection and secure data sharing in the cloud. [ABSTRACT FROM AUTHOR]

Space information network composed of a variety of heterogeneous networks is widely concerned.However,the space information network is facing more security threats and more likely to roam due to its complex topology and large user scale.Considering the characteristics of space information network,a secure authentication enhancement scheme for seamless handover and roaming in space information network was presented.The fast mutual authentication and reasonable accounting between the user and the visiting domain based on the combination of Token and Hash chain was achieved.In addition,two seamless handover mechanisms were proposed to ensure the continuity of user communication.Finally,security analysis indicates that the scheme can not only provide essential security properties,but also achieve reasonable accounting.

The information security domain focuses on security needs at all levels in a computing environment in either the Internet of Things, Cloud Computing, Cloud of Things, or any other implementation. Data, devices, services, or applications and communication are required to be protected and provided by information security shields at all levels and in all working states. Remote authentication is required to perform different administrative operations in an information system, and Administrators have full access to the system and may pose insider threats. Superusers and administrators are the most trusted persons in an organisation. “Trust but verify” is an approach to have an eye on the superusers and administrators. Distributed ledger technology (Blockchain-based data storage) is an immutable data storage scheme and provides a built-in facility to share statistics among peers. Distributed ledgers are proposed to provide visible security and non-repudiation, which securely records administrators’ authentications requests. The presence of security, privacy, and accountability measures establish trust among its stakeholders. Securing information in an electronic data processing system is challenging, i.e., providing services and access control for the resources to only legitimate users. Authentication plays a vital role in systems’ security; therefore, authentication and identity management are the key subjects to provide information security services. The leading cause of information security breaches is the failure of identity management/authentication systems and insider threats. In this regard, visible security measures have more deterrence than other schemes. In this paper, an authentication scheme, “VisTAS,” has been introduced, which provides visible security and trusted authentication services to the tenants and keeps the records in the blockchain.

The rapid deployment of biometric authentication systems raises concern over user privacy and security. A biometric template protection scheme emerges as a solution to protect individual biometric templates stored in a database. Among all available protection schemes, a template protection scheme that relies on distance-preserving hashing has received much attention due to its simplicity and efficiency in offering privacy protection while archiving decent authentication performance. In this work, we introduce an efficient attack called known sample attack and demonstrate that most state-of-art template protection schemes that utilize distance-preserving hashing can be compromised in practice (within few seconds), especially when the output is significantly smaller than the original input sample size. These findings further motivated our subsequent work in proposing a secure authentication mechanism to resist such an attack with proper study over the distribution of the input samples. Furthermore, we conducted revocability, unlinkability analysis to demonstrate the satisfactory of general biometric template protection requirements; and showed the resistance of various security and privacy attacks, i.e., false acceptance attack, and attack via record multiplicity. [ABSTRACT FROM AUTHOR]

Low-power secure communication is one of the key enablers of applications, such as secure authentication and remote health monitoring. Radio wave-based communication method, such as Bluetooth, suffers from high-power requirements and physical signal leakage. Electro-quasi-static human body communication (EQS-HBC) utilizes the conductivity of the human body to use it as a communication medium and confine the signal within a close proximity of the body and enable low power consumption through low-frequency operation. This makes EQS-HBC an attractive alternative for such low-power, low-data-rate secure communication. In this article, we present the first >1 kb/s Sub- ${\underline {\mu}} \text{W}$ WeaRable Communication (Sub- $\mu $ WRComm), a secure EQS-HBC node, which uses EQS-HBC for physical security and an AES-256 engine for mathematical security and operate at sub- $\mu \text{W}$ power budget. The signal confinement property of EQS-HBC is demonstrated through finite element method (FEM) simulations and leakage measurements, establishing its security property. The Sub- $\mu $ WRComm system consumes only 415-nW total power, with 108-nW active power at the lowest power mode, operating at a data rate of 1 kb/s with −64-dBm sensitivity making it suitable for authentication and remote monitoring applications. This work presents a $100\times $ improvement compared with state-of-the-art HBC implementations while providing simultaneous physical and mathematical security for the first time. [ABSTRACT FROM AUTHOR]

In random projection (RP) based biometric template protection methods,the generated template and key are vulnerable to attacks,which may cause the leakage of users’ privacy.To solve this problem,an improved RP-based fingerprint template protection method was proposed.First,based on the RP result,the proposed method divided the projection domain into fingerprint matching domain and noise adding domain that were mutually independent,then fused them with two sub-matrices of the random projection matrix and saved the result as template.In addition,re-encryption mechanism was introduced to realize secure storage and transmission of the key (RP matrix).Experimental results show that the proposed method can achieve stronger ability to resist different attacks than existing RP-based biometric template protection methods,and also guarantee high matching accuracy and revocation.

Internet of Things (IoT) plays a major function in the public infrastructure, including power grids, control systems, smart cards, smart cities, intelligent transportation, education, and so on. The IoT networks provide ample benefits arising from transmission of the data between the IoT nodes and the servers. However, security constitutes a major concern in the IoT applications, as secret information may get disclosed to the unauthorized third-party in the network. Thus, secure authentication is a major requirement for managing and communicating with respect to the devices in the IoT environment. In this survey, 50 research papers are reviewed, referring to various authentication protocols used for ensuring adequate security in the network. The authentication methods are categorized on the basis of the security mechanisms, namely, the lightweight approach, the identity approach, the mutual authentication approach, and the cryptography-based authentication approaches, with the challenges faced by these existing methods being reported. Moreover, a simple overview is provided based on authentication protocols, toolsets, and evaluation metrics. Conform to this survey, most of the research articles concentrated on the lightweightbased approaches, and the most commonly applied evaluation metrics include packet loss, throughput, and efficiency. [ABSTRACT FROM AUTHOR]

Mobile devices have their popularity and affordability greatly increased in recent years. As a consequence of their ubiquity, these devices now carry all sorts of personal data that should be accessed only by their owner. Even though knowledge‐based procedures are still the main methods to secure the owner's identity, recently biometric traits have been employed for more secure and effortless authentication. In this work, the authors propose a facial verification method optimised to the mobile environment. It consists of a two‐tiered procedure that combines hand‐crafted features and a convolutional neural network (CNN) to verify if the person depicted in a photograph corresponds to the device owner. To train a CNN for the verification task, the authors propose a hybrid‐image input, which allows the network to process encoded information of a pair of face images. The proposed experiments show that the solution outperforms state of the art face verification methods, providing a 4× speedup when processing an image in recent smartphone models. Additionally, the authors show that the two‐tiered procedure can be coupled with existing face verification CNNs improving their accuracy and efficiency. They also present a new data set of selfie pictures – RECOD Selfie data set – that hopefully will support future research in this scenario. [ABSTRACT FROM AUTHOR]

Copyright of Journal on Communication / Tongxin Xuebao is the property of Journal on Communications Editorial Office and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

In the Bitcoin network, the simplified payment verification protocol (SPV) enables a lightweight device such as a mobile phone to participate in the bitcoin network without needed to download and store the whole Bitcoin blocks. A Bitcoin SPV node initiates and verifies transactions of the Bitcoin network through the Bitcoin wallet software which is deployed on a resource constrained device such as a mobile phone. Thus, the security of the wallet is critical for the SPV nodes as it may affect the security of user’s cryptocurrencies. However, there are some concerns about the security flaws within the SPV nodes which could lead to significant economic losses. Most of these vulnerabilities can be resolved by employing a secure user authentication protocol. Over the years, researchers have engaged in designing a secure authentication protocol. However, most proposals have security flaws or performance issues. Recently, Park et al. proposed a two-party authenticated key exchange protocol for the mobile environment. They claimed that their protocol is not only secure against various attacks but also can be deployed efficiently. However, after a thorough security analysis, we find that the Park et al.’s protocol is vulnerable to user forgery attack, smart card stolen attack and unable to provide user anonymity. To enhance security, we proposed an efficient and secure user authentication protocol for the SPV nodes in the mobile environment which can fulfill all the security requirements and has provable security. Additionally, we provide performance analysis which shows our proposed protocol is efficient for the SPV nodes in the Bitcoin network. [ABSTRACT FROM AUTHOR]

In this paper, an optical transmitter authentication method using hardware fingerprints based on the permutation entropy spectrum (PES) of electro-optic chaos is proposed. By means of permutation analysis of chaotic time series generated by the electro-optic feedback loop, PES is defined and used as the hardware fingerprint of optical transmitters for secure authentication. The time division multiplexing (TDM) module is used to combine the chaotic signal and the message, while the optical temporal encryption (OTE) module is introduced to ensure the security of the fingerprint. At the receiver, the time division demultiplexing (TDD) module and the optical time decryption (TDD) module are introduced to recover the original chaotic signal. The trained support vector machine (SVM) models will then recognize legal and illegal optical transmitters by judging whether the PES of the received chaotic signal is legitimate or not. The simulation and experimental results show that PES of electro-optic chaos has obvious fingerprint characteristics and is sensitive to the feedback delay T in the feedback loop. The authentication system based on PES can recognize both legal and illegal transmitters in optical networks, and the recognition accuracy can reach about 97%. Under the condition of a low signal-to-noise ratio, the authentication system based on the permutation entropy spectrum can still distinguish legal and illegal transmitters effectively. Meanwhile, our scheme has high controllability and flexibility. • We propose a fingerprint construction method of optical transmitters based on the permutation information analysis of electro-optic chaos for secure authentication. The permutation entropy spectrum (PES) is defined and used as the hardware fingerprint in the authentication system. • We achieved the encryption of the fingerprint using the time division multiplexing module and the optical time encryption module. • Comparing with the existing authentication scheme, our work provides a more flexible scheme for secure authentication and has the potential to be combined with more existing encryption methods to realize the integration of encryption and authentication in optical networks. [ABSTRACT FROM AUTHOR]

Distributed mobility management (DMM) requires a flattened cellular network architecture to meet ever-increasing traffic demands of mobile users. In order to get rid of centralized mobility entities, it is desirable to manage locations of mobile nodes (MNs) in a distributed but secure and fault-tolerant manner. To address such issues, in this paper, we propose a secure and fault-tolerant mechanism for DMM. The proposed mechanism utilizes a distributed hash table of access nodes for distributed location management, and a ticket-reuse approach is adopted for improving authentication performance while providing secure authentication of the MNs. We present an analytical model to calculate the processing time of a location query. We have evaluated the proposed security mechanism in terms of authentication latency and a number of authentication messages required for secure handover. Analysis results confirm that the proposed mechanism outperforms the popular existing authentication protocol, EAP-TLS, in a DMM environment.

Secret key generation refers to the problem of generating a common secret key without revealing any information about it to an eavesdropper. All users observe correlated components of a common source and can further use a noisy public channel for discussion, which is open to eavesdroppers. A related problem is that of secure authentication, which has structural similarities and connections to the first problem. For authentication, users need to be enrolled and securely authenticated while minimizing the privacy leakage rate. This paper studies the algorithmic computability of the forward secret key capacity and the secure authentication capacity. For the algorithmic computability, the concept of a Turing machine is used as it provides fundamental performance limits for today's digital computers. In this paper, it is shown that the forward secret key capacity with a noisy public channel is not computable and consequently, there is no algorithm that can simulate or compute the secret key capacity; even if there are no limitations on computational complexity and computing power. On the other hand, if the public channel is noiseless so that there are no rate constraints on the public communication, the secret key capacity is a computable continuous function, which is the strongest form of computability. A similar behavior is subsequently observed for the authentication problem: The secure authentication capacity under storage rate and privacy leakage rate constraints is not computable, while the case without privacy leakage rate constraints is computable. [ABSTRACT FROM AUTHOR]

Copyright of Journal on Communication / Tongxin Xuebao is the property of Journal on Communications Editorial Office and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Password has been the most used authentication system these days. However, strong passwords are hard to remember and unique to every account. Unfortunately, even with the strongest passwords, password authentication system can still be breached by some kind of attacks. 2FYSH is two tokens-based authentication protocol designed to replace the password authentication entirely. The two tokens are a mobile phone and an NFC card. By utilizing mobile phones as one of the tokens, 2FYSH is offering third layer of security for users that lock their phone with some kind of security. 2FYSH is secure since it uses public and private key along with challenge-response protocol. 2FYSH protects the user from usual password attacks such as man-in-the-middle attack, phishing, eavesdropping, brute forcing, shoulder surfing, key logging, and verifier leaking. The secure design of 2FYSH has made 90% of the usability test participants to prefer 2FYSH for securing their sensitive information. This fact makes 2FYSH best applied to secure sensitive data needs such as bank accounts and corporate secrets. [ABSTRACT FROM AUTHOR]

Most of the world's power grids are controlled remotely. Their control messages are sent over potentially insecure channels, driving the need for an authentication mechanism. The main communication mechanism for power grids and other utilities is defined by an IEEE standard, referred to as DNP3; this includes the Secure Authentication v5 (SAv5) protocol, which aims to ensure that messages are authenticated. We provide the first security analysis of the complete DNP3: SAv5 protocol. Previous work has considered the message-passing sub-protocol of SAv5 in isolation, and considered some aspects of the intended security properties. In contrast, we formally model and analyse the complex composition of the protocol's sub-protocols. In doing so, we consider the full state machine, the protocol's asymmetric mode, and the possibility of cross-protocol attacks. Furthermore, we model fine-grained security properties that closely match the standard's intended security properties. For our analysis, we leverage the Tamarin prover for the symbolic analysis of security protocols. Our analysis shows that the core DNP3: SAv5 design meets its intended security properties. Notably, we show that a previously reported attack does not apply to the standard. However, our analysis also leads to several concrete recommendations for improving future versions of the standard. [ABSTRACT FROM AUTHOR]