Search

The rapid evolution of mobile and optical communication technologies is driving the transition from 5G to 6G networks. This transition inevitably brings about changes in authentication scenarios, as new security demands emerge that go beyond the capabilities of existing frameworks. Therefore, it is necessary to address these evolving requirements and the associated key challenges: ensuring Perfect Forward Secrecy (PFS) to protect communications even if long-term keys are compromised and integrating Post-Quantum Cryptography (PQC) techniques to defend against the threats posed by quantum computing. These are essential for both radio and optical communications, which are foundational elements of future 6G infrastructures. The DMRN Protocol, introduced in 2022, represents a major advancement by offering both PFS and PQC while maintaining compatibility with existing 3rd Generation Partnership Project (3GPP) standards. Given the looming quantum-era challenges, it is imperative to analyze the protocol's security architecture through formal verification. Accordingly, we formally analyze the DMRN Protocol using SVO logic and ProVerif to assess its effectiveness in mitigating attack vectors, such as malicious or compromised serving networks (SNs) and home network (HN) masquerading. Our research found that the DMRN Protocol has vulnerabilities in key areas such as mutual authentication and key exchange. In light of these findings, our study provides critical insights into the design of secure and quantum-safe authentication protocols for the transition to 6G networks. Furthermore, by identifying the vulnerabilities in and discussing countermeasures to address the DMRN Protocol, this study lays the groundwork for the future standardization of secure 6G Authentication and Key Agreement protocols. [ABSTRACT FROM AUTHOR]

The internet key exchange (IKE) protocol, integral to the authentication and key negotiation process within the Internet Protocol Security (IPSec) framework, has been utilized for the protection of IP communications. Given the complex protocol logic, security vulnerabilities in the implementation of the IKE protocol are inevitably present. Fuzz testing, recognized as an effective means of detecting potential vulnerabilities in protocol implementations, has been conventionally applied. However, the direct application of existing fuzzing tools to the IKE protocol has been found to present limitations, such as the generation of low-quality test cases and difficulty in exploring deep states. To address these issues, a mutation strategy based on the grammar of the IKE protocol was designed, aiming to reduce the generation of invalid test cases while increasing the diversity of generated test cases. Additionally, an evolutionary strategy-based mutation scheduling scheme was introduced, which automatically optimized the probability distribution of mutation operators, further increasing the likelihood of generating high-quality test cases. A message handler was designed to maintain protocol interaction context information and perform cryptographic operations, thereby supporting testing of the IKE protocol under black-box conditions. This enabled the exploration of deep protocol interaction behavior and state space. Utilizing the aforementioned methods, an IKE protocol stateful fuzz testing tool named IKEChecker was implemented, supporting testing of both IKEv1 and IKEv2 protocols. Testing was conducted on two widely used open-source IKE protocol implementations, strongSwan and Libreswan, resulting in the revelation of 4 undisclosed vulnerabilities. By comparing IKEChecker with other fuzz testing tools, its efficiency in vulnerability detection was evaluated.

The Internet of Things is a network of connected devices that can communicate and share data over the Internet. These devices often have sensors that collect data for various purposes, such as usage statistics, data processing, or performing specific actions based on the collected data. Also, medical Internet of Things devices are crucial in monitoring critical functions, measuring blood glucose levels, indicating when patients require medicine, and ensuring timely medication delivery. Communication in the Internet of Things is demanding, requiring diverse protocols that address communication security concerns. These protocols must be robust and secure, considering technical factors such as the network objective, energy requirements, and the nature of the communication because they can be exploited. This paper proposes an innovative system with a security protocol that supports and improves communication security in modern Internet of Things networks. The protocol aims to enhance communication safety between interconnected devices for information exchange in medicine or healthcare, ensuring the confidentiality and integrity of sent data and devices. The proposed protocol, tested through formal and automated verification, meets all security goals, including identity verification, anonymity protection, and access revokement. It also protects against man-in-the-middle, modification, replay, and impersonation attacks. [ABSTRACT FROM AUTHOR]

Copyright of Chinese Journal of Network & Information Security is the property of Beijing Xintong Media Co., Ltd. and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Software defined networking (SDN) is a novel networking paradigm that aims to achieve global management for the underlying forwarding plane based on its centralization concept. Unfortunately, the newly designed paradigm does not consider security issues related to unauthenticated and unauthorized activities across various SDN layers. Recently, blockchain (BC) technology has proven successful in providing a decentralized, immutable, and fault tolerant ledger. In this study, we take advantage of blockchain characteristics to provide mutual host-controller, PacketIn/PacketOut and host-host authentication methods. We also provide secure Address Resolution Protocol (ARP) and Identity Resolution Protocol (IRP) to protect layer 3 and layer 2 of the SDN network. In addition, both SDN hosts and controllers utilize lattice-based signatures based on Dilithium scheme and Key Encapsulation Methods (KEMs) based on Kyber scheme to provide protection against quantum adversaries. We also compare our work with AuthFlow (Mattos and Duarte in Ann Telecommun 71:607–615, 2016). The results show that HostSec is more secure than AuthFlow due to its ability to detect both host-based and switch-based PacketIn attacks and also reduces the load on the SDN controller. Overall, the experimental results suggest a trade-off between improved security and lower latency. [ABSTRACT FROM AUTHOR]

To address the shortcomings of existing authentication schemes in vehicle networks, which commonly suffer from key escrow issues, as well as the lack of consideration for lightweight deployment and secure rapid authentication of compute-constrained electronic control unit (ECU), a lightweight certificateless anonymous authentication and key agreement scheme without bilinear pairings was proposed for compute-unconstrained ECU networks. The authentication key pair was securely constructed by elliptic curve cryptography, anonymous authentication and key agreement were realized by lightweight methods such as hash functions and XOR operation. Additionally, a certificateless batch verification scheme was proposed to reduce the authentication costs for compute-constrained ECU networks. Finally, a security verification method based on the colored Petri net (CPN) and Dolev-Yao attacker model was proposed to evaluate the formal security of the proposed scheme. The proposed scheme is proved through security evaluation and performance analysis to effectively resist various types of attacks such as replay, spoofing, tampering, known key, known specific session temporary information attack, etc., with multiple security attributes, small computation and communication cost.

Copyright of Journal of Cryptologic Research (2097-4116) is the property of Editorial Board of Journal of Cryptologic Research and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Advancements in the Internet of things (IoT) make a way for medical devices to coordinate in an environment that is the Internet of Medical Things (IoMT). In IoMT, some dedicated health monitoring devices are coordinated in an environment to accomplish a specified task. In this sector, patient information is periodically collected for early diagnosis of diseases. Various wearable sensors have been developed for smart sensing in the IoMT meanwhile, the sensed data are forwarded to the smart data collecting devices. Besides the advantages of remote monitoring and lower healthcare cost in IoT-based health monitoring systems, intrusion can occur during data transmission. Moreover, the large energy consumption of devices will result in higher system costs. An energy-efficient data routing protocol is developed in this area to cater to these issues. A swarm intelligence based approach is one of the most prominent methods for energy efficient routing of the data in IoT. The major goal of this paper is to provide deep insight into the lightweight, secure energy efficient routing protocol in IoMT. Furthermore, the limitations of existing methodologies are outlined. [ABSTRACT FROM AUTHOR]

The rapid evolution of mobile and optical communication technologies is driving the transition from 5G to 6G networks. This transition inevitably brings about changes in authentication scenarios, as new security demands emerge that go beyond the capabilities of existing frameworks. Therefore, it is necessary to address these evolving requirements and the associated key challenges: ensuring Perfect Forward Secrecy (PFS) to protect communications even if long-term keys are compromised and integrating Post-Quantum Cryptography (PQC) techniques to defend against the threats posed by quantum computing. These are essential for both radio and optical communications, which are foundational elements of future 6G infrastructures. The DMRN Protocol, introduced in 2022, represents a major advancement by offering both PFS and PQC while maintaining compatibility with existing 3rd Generation Partnership Project (3GPP) standards. Given the looming quantum-era challenges, it is imperative to analyze the protocol’s security architecture through formal verification. Accordingly, we formally analyze the DMRN Protocol using SVO logic and ProVerif to assess its effectiveness in mitigating attack vectors, such as malicious or compromised serving networks (SNs) and home network (HN) masquerading. Our research found that the DMRN Protocol has vulnerabilities in key areas such as mutual authentication and key exchange. In light of these findings, our study provides critical insights into the design of secure and quantum-safe authentication protocols for the transition to 6G networks. Furthermore, by identifying the vulnerabilities in and discussing countermeasures to address the DMRN Protocol, this study lays the groundwork for the future standardization of secure 6G Authentication and Key Agreement protocols.

To meet the security requirements of smart airports, a 5G-based smart airport network security solution was proposed.The security characteristics and security requirements of the 5G scenario in smart airport were analyzed, and the pain points of security requirements in the current scenario were summarized in five aspects:unified security management and control, network slicing security, security monitoring and early warning, edge computing security, and IoT-aware node security.And then a 5G network security system was designed for smart airports.The functional components of this system included 5G network unified security management and control functions for ubiquitous networks, lightweight 5G network identity authentication and authentication functions, 5G network slice security protection for multi-service requirements, 5G network security monitoring and early warning based on big data analysis, integrated security protection function based on edge computing, and sensory node security protection function based on device behavior analysis.This comprehensive approach built an all-in-one security platform covering business encryption, network security, terminal trustworthiness, identity trustworthiness, and security management and control.Additionally, the potential counterfeit base station attacks in the existing 5G authentication and key agreement (AKA) were analyzed.Due to the lack of authenticity verification of the messages forwarded by the SN, the attacker can pretend to be the real SN to communicate with the UE and the HN, thus carrying out the base station masquerading attack.This kind of attack may lead to the leakage of smart airport network data, and encounter problems such as tampering and deception by opponents.Aiming at the network security requirements of smart airports and the security issues of 5G authentication and key agreement protocol, an improved 5G authentication and key agreement protocol was designed.Formal security models, security goal definitions, and analysis were performed to ensure the robustness and effectiveness of the protocol against attacks.

Smartphones are usually provided with indoor positioning services by third-party positioning service providers, in which the unique privacy leakage risk has become a major factor limiting its development.How to protect the privacy of users and data in the positioning process has become an important issue to be solved.The research progress of indoor positioning privacy protection in recent years was reviewed.The commonly used indoor positioning technologies were introduced, different implementation architectures of indoor positioning systems and their threat models, privacy protection requirements were discussed, security technologies applied to indoor positioning privacy protection were summarized, indoor positioning privacy protection schemes for different architectures were classified and introduced, and the performance of different schemes and their advantages and disadvantages were comprehensively compared and analyzed, and finally future research trends were summarized and looked forward to.

RFID technology application has made multi label collisions and security privacy issues increasingly prominent in logistics warehousing. A solution that combines RFID and chaotic encryption algorithm has been proposed and applied to anti-collision and security protocols for logistics warehousing labels to address these issues. Firstly, optimization analysis was conducted on the anti-collision of warehouse system labels using chaotic sequences. By comparing different types of labels, it was determined that the 6TypeB label has good anti-collision ability. On this basis, a bidirectional security authentication protocol based on a chaotic encryption algorithm for 6TypeB labels was studied. The data privacy and security of tags can be effectively protected by this protocol. Finally, a detailed analysis was conducted on the performance of 6TypeB logistics warehousing labels used. The 6TypeB system has an average label recognition rate of 73%, an average transmission efficiency of 95.31%, and an average memory usage rate of 93%. Meanwhile, the average stability of the bidirectional security authentication protocol based on the 6TypeB label system is 92.08%. By utilizing 6TypeB, data privacy and security of RFID can be significantly improved, leading to a new application direction for anti-collision and security of logistics warehousing labels.

Copyright of Chinese Journal of Network & Information Security is the property of Beijing Xintong Media Co., Ltd. and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Copyright of Journal on Communication / Tongxin Xuebao is the property of Journal on Communications Editorial Office and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

The movement of vehicles in and out of the predefined enclosure is an important security protocol that we encounter daily. Identification of vehicles is a very important factor for security surveillance. In a smart campus concept, thousands of vehicles access the campus every day, resulting in massive carbon emissions. Automated monitoring of both aspects (pollution and security) are an essential element for an academic institution. Among the reported methods, the automated identification of number plates is the best way to streamline vehicles. The performances of most of the previously designed similar solutions suffer in the context of light exposure, stationary backgrounds, indoor area, specific driveways, etc. We propose a new hybrid single-shot object detector architecture based on the Haar cascade and MobileNet-SSD. In addition, we adopt a new optical character reader mechanism for character identification on number plates. We prove that the proposed hybrid approach is robust and works well on live object detection. The existing research focused on the prediction accuracy, which in most state-of-the-art methods (SOTA) is very similar. Thus, the precision among several use cases is also a good evaluation measure that was ignored in the existing research. It is evident that the performance of prediction systems suffers due to adverse weather conditions stated earlier. In such cases, the precision between events of detection may result in high variance that impacts the prediction of vehicles in unfavorable circumstances. The performance assessment of the proposed solution yields a precision of 98% on real-time data for Malaysian number plates, which can be generalized in the future to all sorts of vehicles around the globe. [ABSTRACT FROM AUTHOR]

The Medical Internet-of-Things (MIoT) has developed revolutionary ways of delivering medical care to patients. An example system, showing increasing demand, is the artificial pancreas system that offers convenience and reliable support care to patients with Type 1 Diabetes. Despite the apparent benefits, the system cannot escape potential cyber threats that may worsen a patient's condition. The security risks need immediate attention to ensure the privacy of the patient and preserve safe functionality. Motivated by this, we proposed a security protocol for the APS environment wherein support to essential security requirements is guaranteed, the security context negotiation is resource-friendly, and the protocol is resilient to emergencies. Accordingly, the security requirements and correctness of the design protocol were formally verified using BAN logic and AVISPA, and proved its feasibility through the emulation of APS in a controlled environment using commercial off-the-shelf devices. Moreover, the results of our performance analysis indicate that the proposed protocol is more efficient than the other existing works and standards. [ABSTRACT FROM AUTHOR]

Industrial Internet of Things (IIoT) gateways are affected by many cybersecurity threats, compromising their security and dependability. These gateways usually represent single points of failure on the IIoT infrastructure. When compromised, they can disrupt the entire system, including the security of the IIoT devices and the confidentiality and privacy of the data. This paper introduces a Secure IIoT Gateway Architecture that encompasses Trusted Execution Environment concepts and consolidated security algorithms to achieve a secure IIoT environment. Sensitive procedures of the IIoT, like device admission, bootstrapping, key management, authentication, and data exchange among operational technology (OT) and information technology (IT) are handled by the gateway inside the secure execution domain. The bootstrapping does not require devices to have any pre-stored secret or a pre-established secure channel to any trusted third party. Moreover, our architecture includes mechanisms for IIoT devices to safely interact with the Cloud without assuming the integrity of the gateways between them, enabling continuous verification of gateway integrity. A formal proof of the proposed solution security is provided. Finally, the security of the proposed architecture is discussed according to the specified requirements. [ABSTRACT FROM AUTHOR]

In order to achieve the requirement for security and lightweight in unmanned aerial vehicle(UAV)communication,two authentication and key agreement protocols targeted for UAVs with different computational performance are proposed,including an ECC based protocol,DroneSec,and a symmetric cipher based protocol,DroneSec-lite.The two protocols achieve secure mutual authentication and key configuration between ground stations and UAVs.DroneSec protocol achieves relatively low computational overhead while ensuring forward secrecy through combining ECDH and MAC,which is suitable for relatively high-performance platforms.DroneSec-lite protocol achieves extremely low computational overhead through using only symmetric ciphers,which is suitable for low-performance platforms.The security of the proposed protocols under the enhanced Dolve-Yao model is verified using ProVerif,a formal protocol verification tool,and the performance of the protocols is analyzed in the simulation environment.The results show that it is superior to existing protocols in terms of computation overhead,communication overhead and security.

Sixth-generation (6G) wireless networking studies have begun with the global implementation of fifth-generation (5G) wireless systems. It is predicted that multiple heterogeneity applications and facilities may be supported by modern wireless communication networks (MWCNs) with improved effectiveness and protection. Nevertheless, a variety of trust-related problems that are commonly disregarded in network architectures prevent us from achieving this objective. In the current world, MWCN transmits a lot of sensitive information. It is essential to protect MWCN users from harmful attacks and offer them a secure transmission to meet their requirements. A malicious node causes a major attack on reliable data during transmission. Blockchain offers a potential answer for confidentiality and safety as an innovative transformative tool that has emerged in the last few years. Blockchain has been extensively investigated in several domains, including mobile networks and the Internet of Things, as a feasible option for system protection. Therefore, a blockchain-based modal, Transaction Verification Denied conflict with spurious node (TVDCSN) methodology, was presented in this study for wireless communication technologies to detect malicious nodes and prevent attacks. In the suggested mode, malicious nodes will be found and removed from the MWCN and intrusion will be prevented before the sensitive information is transferred to the precise recipient. Detection accuracy, attack prevention, security, network overhead, and computation time are the performance metrics used for evaluation. Various performance measures are used to assess the method's efficacy, and it is compared with more traditional methods. [ABSTRACT FROM AUTHOR]

With the advent of state-of-art technologies, the Telecare Medicine Information System (TMIS) now offers fast and convenient healthcare services to patients at their doorsteps. However, this architecture engenders new risks and challenges to patients' and the server's confidentiality, integrity and security. In order to avoid any resource abuse and malicious attack, employing an authentication scheme is widely considered as the most effective approach for the TMIS to verify the legitimacy of patients and the server. Therefore, several authentication protocols have been proposed to this end. Very recently, Chaudhry et al. identified that there are vulnerabilities of impersonation attacks in Islam et al.'s scheme. Therefore, they introduced an improved protocol to mitigate those security flaws. Later, Qiu et al. proved that these schemes are vulnerable to the man-in-the-middle, impersonation and offline password guessing attacks. Thus, they introduced an improved scheme based on the fuzzy verifier techniques, which overcome all the security flaws of Chaudhry et al.'s scheme. However, there are still some security flaws in Qiu et al.'s protocol. In this article, we prove that Qiu et al.'s protocol has an incorrect notion of perfect user anonymity and is vulnerable to user impersonation attacks. Therefore, we introduce an improved protocol for authentication, which reduces all the security flaws of Qiu et al.'s protocol. We also make a comparison of our protocol with related protocols, which shows that our introduced protocol is more secure and efficient than previous protocols.

Our everyday lives cannot function without intelligent devices, which create the so-called Internet of Things networks. Internet of Things devices have various sensors and software to manage the work environment and perform specific tasks without human intervention. Internet of Things networks require appropriate security at various levels of their operation. In this article, we present a new security protocol that protects communication in IoT networks and enables interconnected devices to communicate and exchange information to increase the security of people living in urban agglomerations. The Control Station device evaluates the collected data about events that may threaten the life or health of residents and then notifies the Emergency Notification Center about it. The protocol guarantees the security of devices and transmitted data. We verified this using automatic verification technology, formal verification using Burrows, Abadi and Needham logic and informal analysis. The proposed protocol ensures mutual authentication, anonymity and revocation. Also, it is resistant to Man-in-the-middle, modification, replay and impersonation attacks. Compared to other protocols, our solution uses simple cryptographic techniques that are lightweight, stable and do not cause problems related to high communication costs. It does not require specialist equipment, so we can implement it using typical hardware. At each stage of protocol execution, communication occurs between two entities, so it does not require interaction between different entities, which may limit its adaptability in the context of interoperability. [Display omitted] [ABSTRACT FROM AUTHOR]

E-commerce security has recently been an emerging topic due to the escalation in credit card fraud and stolen user accounts. In general, the security bridge and privacy leakage occur on the side of e-commerce companies due to various factors such as flaws in the design of their storage systems. The stored information of users increases the risk on privacy bridge and to remedy such risks e-commerce companies are forced to make costly investments. The security threats also enforce the development of robust security protocols and methods in digital commerce systems. The current protocols and methods generally bring extra communication and computation costs to all parties involving in the e-commerce system and the security risk on the side of e-commerce companies still remains. In this paper, we propose a Secure E-commerce Scheme (SES) which alleviates the security threats on the side of e-commerce companies and reduces communication costs for all parties. The proposed secure e-commerce protocol, SES, is implemented, analyzed and compared to two well-known schemes; Secure Electronic Transaction (SET) and 3D Secure.

Advancements in the field of wireless and mobile communication motivate academia, industry, and standardisation organisations to explore new technologies to improve overall efficiency, spectrum utilisation, power consumption, and security. One of the most essential technologies proposed for short-range communications, which will play a key role in 5G wireless networks, is device-to-device (D2D) communications. D2D communication enables direct communication between two devices when they are in close proximity without requiring the help of a fixed infrastructure like base stations. Despite the significant benefits provided by D2D communications, this new networking communication paradigm introduces unique security threats to D2D services that should be solved in order to limit any malicious attacks. Towards this end, in this paper, we focus on secure D2D communications and propose a protocol for establishing secure D2D communication using elliptic curve cryptography. The protocol utilises: (i) specific Mobile Identifiers acquired from the hardware of the mobile phone (i.e. IMEI) and the SIM card (i.e. IMSI, MSISDN) provided by the mobile operator and (ii) the SIM storage for saving private keys or signature data. The proposed security protocol is verified and validated with the help of the Scyther tool, and the performance is evaluated in terms of resiliency analysis. [ABSTRACT FROM AUTHOR]

Machine-to-machine (M2M) communication is one of the critical technologies of the industrial Internet of Things (IoT), which consists of sensors, actuators at the edge, and servers. In order to solve the security and availability problems regarding communication between edge devices with constrained resources and servers in M2M communication, in this study we proposed an authentication and session establishment protocol based on physical unclonable functions (PUFs). The scheme does not require clock synchronization among the devices, and it circumvents the situation where the authentication phase has to use a high computational overhead fuzzy extractor due to PUF noise. The protocol contains two message interactions, which provide strong security and availability while being lightweight. The security modelling is based on CPN Tools, which verifies security attributes and attack resistance in the authentication phase. After considering the design of the fuzzy extractor and scalability, the proposed scheme significantly reduces the computational overhead by more than 93.83% in the authentication phase compared with other schemes using PUFs. Meanwhile, under the guarantee of availability, the communication overhead is maintained at a balanced and reasonable level, at least 19.67% lower than the solution using XOR, hashing, or an elliptic curve. [ABSTRACT FROM AUTHOR]

Cryptocurrency‐based transactions are exposed to serious security risks, usually higher than risks related to traditional online transactions. The threats range from unintentional credential leaks, through fraudulent cryptocurrency exchanges and poorly implemented protocols, to broken private keys. Therefore, there is a business need for insurance services dedicated to cryptocurrencies that would be technologically as well as economically secure for both insuring and insured party. In this paper an architecture for cryptocurrency insurance framework along with a set of corresponding communication protocols and a smart contract template that jointly reduce various security risks are proposed. The detailed description of the solution is followed by the security analysis section. Also, the description of the presented solution is preceded by a general risk analysis related to cryptocurrency unit security and countermeasures analysis related to those risks. The authors believe that the presented technological solution can potentially enable new business models based on crypto‐insurance services. [ABSTRACT FROM AUTHOR]

The advent of the Internet of Things has enriched the network field with new themes, among which we find the Internet of Vehicles (IoV). IoV improved the various smart traffic applications for management or security. It makes vehicles autonomously deal with the unexpected by sharing various resources like critical information, computing resources, etc. Nonetheless and as a user of current network technologies, IoV suffers from the same vulnerabilities of these technologies, which makes it vulnerable to various kinds of attacks that affect security and privacy. To overcome these new challenges, researchers have considered different IoV authentication protocols. However, most of them are compromised and contain real security problems. Dealing with IoV authentication protocol security flaws is a real challenge. Recently, Jiang et al. (Comput Commun 173:45–55, 2021) designed a three-factor authentication protocol for IoV environment. The proposed protocol combines lightweight operations that include elliptic curve cryptography, hash function, physically unclonable function, concatenation on one side, and XOR operation on the other side. Contrariwise, it contains several flaws. In this paper, we detailed the security analysis of Jiang et al. protocol that proves the limit of security guarantees between only user and data center due to the possibility for an adversary to deduce a session key shared between vehicle sensor and data center and between vehicle sensor and user. Moreover, regarding these limitations, we propose an improvement to remedy all the said security pitfalls. [ABSTRACT FROM AUTHOR]

With the rapid development of cloud computing and mobile networks, more and more application scenarios require a secret group key for secure communication. Group Key Exchange (GKE) protocol provides a secret group key for three or more members. Burmester and Desmedt presented an influential GKE protocol, which has a broadcast version and a cyclic version. In this paper, we investigate the security weaknesses of the Burmester-Desmedt protocol. We report that both the broadcast version and the cyclic version of the Burmester-Desmedt protocol suffer member tampering attacks if the two members that belong to both group A and group B are corrupted. That is, two corrupted members can add some unknowing members of group A to group B and trick the legal members of group B to believe that these unknowing members share the secret group key with them after a protocol run. Furthermore, to defeat the member tampering attack, we propose digital signature-based improvements on the broadcast version and the cyclic version of the Burmester-Desmedt protocol. We hope our research results will encourage the development of more robust and effective GKE protocols that stand rigorous security analysis. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) has become one of the most attractive domains nowadays. It works by creating a special network between physical devices such as vehicles, home equipment, and other items. In recent days, the common technologies of communication such as Wi-Fi and 2G/3G/4G cellular networks are insufficient for IoT networks because they are designed to serve appliances with immense processing capabilities such as laptops and PCs. Moreover, most of these technologies are centralized and use an existing infrastructure. Currently, new communication technologies such as Z-Wave, 6LowPAN, and Thread are dedicated to the IoT and have been developed to meet its requirements. These technologies can handle many factors such as range, data requirements, security, power demands, and battery life. Nevertheless, the security issues in IoT systems have major concerns and issues because vulnerabilities in such systems may result in fatal catastrophes. In this paper, an enhanced IoT security framework for authentication and authorization is proposed and implemented to protect the IoT protocols from different types of attacks such as man-in-the-middle attacks, reply attacks, and brute force attacks. The proposed framework combines an enhanced token authentication that has identity verification capabilities and a new sender verification mechanism on the IoT device side based on time stamps, which in turn can mitigate the need for local identity verification methods in IoT devices. The proposed IoT security framework was tested using security analysis with different types of attacks compared with previous related frameworks. The analysis shows the high capability of the proposed framework to protect IoT networks against many types of attacks compared with the currently available security frameworks. Finally, the proposed framework was developed using Windows applications to simulate the framework phases, check its validity through the real network, and calculate the payload time added. [ABSTRACT FROM AUTHOR]

With the development of telecare medical information system (TMIS), doctors and patients are able to access useful medical services via 5G wireless communications without visiting the hospital in person. Unfortunately, TMIS should have the essential security properties, such as anonymity, mutual authentication, and privacy, since the patient's data is transmitted via a public channel. Moreover, the sensing devices deployed in TMIS are resource-limited in terms of communication and computational costs. Thus, we design a physically secure privacy-preserving scheme using physical unclonable functions (PUF) in TMIS, called PUF-PSS to resolve the security requirements and efficiency of the existing related schemes. PUF-PSS prevents the security threats and also guarantees anonymity, key freshness, and authentication. We evaluate the security of PUF-PSS by performing formal and informal security analyses, including AVISPA implementation and ROR oracle model. We perform the test bed experiments utilizing well-known MIRACL based on a Raspberry PI 4 and compare the communication and computational costs of PUF-PSS with the previous schemes for TMIS. Consequently, PUF-PSS guarantees better efficiency and security than previous schemes and can be applied to TMIS environments. [ABSTRACT FROM AUTHOR]

The end user’s Quality of Experience (QoE) will be improved while accessing services in Fifth Generation Mobile Network (5G), supported by enhanced security and privacy. The security guarantees offered by the Authentication and Key Agreement (AKA) protocols will be depended upon by end users and network operators. The AKA protocols have been standardized for 5G networks, and the Extensible Authentication Protocol (EAP)-AKA’ protocol is one of the main authentication mechanisms that has been specified for User Equipment (UE) and network mutual authentication. This article models the EAP-AKA’ protocol and conducts an extensive formal verification of the EAP-AKA’ protocol as defined in the 5G security standard to determine whether the protocol is verifiably secure for 5G. It provides a security evaluation of the EAP-AKA’ protocol based on the current 5G specifications using ProVerif, a security protocol proof verifier. It also presents security properties that support the security verification, as well as quantitative properties that are used to assess the protocol’s performance. Finally, it compares the EAP-AKA’ and 5G-AKA protocols’ security and performance results.