BDSec:Security Authentication Protocol for BeiDou-Ⅱ Civil Navigation Message

Due to the lack of authentication mechanism in BeiDou navigation satellite system(BDS),BD-Ⅱ civil navigation message(BDⅡ-CNAV) are vulnerable to spoofing attack and replay attack.To solve this problem,we present a security authentication protocol,called as BDSec,which is designed by using China’s cryptography Shangyong Mima(SM) series algorithms,such as SM2/4/9 and Zu Chongzhi(ZUC)algorithm.In BDSec protocol,both of BDⅡ-CNAV and signature information are encrypted using the SM4 algorithm(Symmetric encryption mechanism).The encrypted result is used as the subject authentication information.BDSec protocol applies SM9 algorithm(Identity-based cryptography mechanism) to protect the integrity of the BDⅡ-CNAV,adopts the SM2 algorithm(Public key cryptosystem) to guarantee the confidentiality of the important session information,and uses the ZUC algorithm(Encryption and integrity algorithm) to verify the integrity of the message authentication serial number and initial information and the information in authentication initialization sub-protocol respectively.The results of the SVO logic reasoning and performance analysis show that BDSec protocol meets security requirements for the dual user identity authentication in BDS and can realize the security authentication of BDⅡ-CNAV.

TESLA-Based Authentication for BeiDou Civil Navigation Message

Due to the civil BeiDou navigation system is open,unauthenticated,and non-encrypted,civilian BeiDou navigation signals may have great security loopholes during transmission or reception.The main security loophole here is spoofing attacks.Spoofing attacks make the positioning or timing results of BeiDou civilian receivers wrong.Such errors may cause a series of security problems,which lays a serious hidden danger for Bei-Dou satellite information security.This article proposes an anti-spoofing method for BeiDou navigation system based on the combination of SM commercial cryptographic algorithm and Timed Efficient Stream Loss-tolerant Authentication(TESLA)for spoofing attacks.In this solution,we use the SM3 algorithm to generate a TESLA key chain with time information,and then use the key in the key chain to generate the message authentication code for the BeiDou D2 navigation message.The message authentication code is inserted into a reserved bit of the D2 navigation message.In addition,this solution uses the SM2 algorithm to protect and encrypt time information in the TESLA key chain to prevent key replay attacks in TESLA.The experimental results tested on the experimental platform built in this paper show that this scheme reduces the possibility of the BeiDou navigation system being deceived and enhances the safety of the BeiDou navigation system.

Secure authentication of classical messages with single photons

This paper proposes a scheme for secure authentication of classical messages with single photons and a hashed function. The security analysis of this scheme is also given, which shows that anyone cannot forge valid message authentication codes （MACs）. In addition, the lengths of the authentication key and the MACs are invariable and shorter, in comparison with those presented authentication schemes. Moreover, quantum data storage and entanglement are not required in this scheme. Therefore, this scheme is more efficient and economical.

Message Authentication with a New Quantum Hash Function

To ensure the security during the communication,we often adopt different ways to encrypt the messages to resist various attacks.However,with the computing power improving,the existing encryption and authentication schemes are being faced with big challenges.We take the message authentication as an example into a careful consideration.Then,we proposed a new message authentication scheme with the Advanced Encryption Standard as the encryption function and the new quantum Hash function as the authentication function.Firstly,the Advanced Encryption Standard algorithm is used to encrypt the result of the initial message cascading the corresponding Hash values,which ensures that the initial message can resist eavesdropping attack.Secondly,utilizing the new quantum Hash function with quantum walks can be much more secure than traditional classical Hash functions with keeping the common properties,such as one-wayness,resisting different collisions and easy implementation.Based on these two points,the message authentication scheme can be much more secure than previous ones.Finally,it is a new way to design the message authentication scheme,which provides a new thought for other researchers in the future.Our works will contribute to the study on the new encryption and authentication functions and the combination of quantum computing with traditional cryptology in the future.

Two Modifications on IKE Protocol with Pre-shared Key Authentication

This paper proposed two modifications on IKE protocol with pre-shared key authentication. The first modification can improve its immunity against DDoS attack by authenticating the initiator before the responder generates the computation-intensive Diffie-Hellman public value. The second modification can improve its efficiency when the attack on messages occurs because it can detect the attack quickly by replacing the centralized authentication in origical IKE protocol with immediate authentication. In addition, the two modifications can be integrated into one protocol compactly.

A Secure Short Message Communication Protocol

According to the security requirement of the short message service （SMS） industry application, a secure short message communication protocol is proposed. This is an application level protocol constructed on the standard SMS communication protocol using public key authentication and key agreement without the need of wireless public key infrastructure （WPKI）. Secure short message transmission and dynamic key agreement between mobile terminals and the accessing gateway axe realized. The security of the proposed protocol is validated through the BAN logic. Compared with the standard SMS protocol, the effective payload rate of our protocol can reach 91.4%, and subscriber identity module （SIM） tool kit （STK） applications based on our protocol suit well for all kinds of mobile terminals in practical application.

A Novel Video Data-Source Authentication Model Based on Digital Watermarking and MAC in Multicast

A novel video data authentication model based on digital video watermarking and MAC （message authentication code） in multicast protocol is proposed in this paper, The digital watermarking which composes of the MAC of the significant vid eo content, the key and instant authentication data is embedded into the insignificant video component by the MLUT （modified look-up table） video watermarking technology. We explain a method that does not require storage of each data packet for a time, thus making receiver not vulnerable to DOS （denial of service） attack. So the video packets can be authenticated instantly without large volume buffer in the receivers. TESLA （timed efficient stream loss tolerant authentication） does not explain how to select the suitable value for d, which is an important parameter in multicast source authentication. So we give a method to calculate the key disclosure delay （number of intervals）. Simulation results show that the proposed algorithms improve the performance of data source authentication in multicast.

Improving Computation Efficiency of Source Authentication by Elliptic Curve Cryptosystem

The overload of traditional cryptosystems is too high for real-time applications so there is a need to design a new encryption and signature scheme for the multicast applications. In this paper, we use the elliptic curve cryptosystem to design a source authentication scheme for real-time applications. The proposed scheme uses the message recovery signature to reduce the computation cost. Thus, the proposed source authentication scheme is more suitable for real-time applications, such as online meeting, online movie, and online music.

Active Authentication Protocol for IoV Environment with Distributed Servers

The Internet of Vehicles(IoV)has evolved as an advancement over the conventional Vehicular Ad-hoc Networks(VANETs)in pursuing a more optimal intelligent transportation system that can provide various intelligent solutions and enable a variety of applications for vehicular traffic.Massive volumes of data are produced and communicated wirelessly among the different relayed entities in these vehicular networks,which might entice adversaries and endanger the system with a wide range of security attacks.To ensure the security of such a sensitive network,we proposed a distributed authentication mechanism for IoV based on blockchain technology as a distributed ledger with an ouroboros algorithm.Using timestamp and challenge-responsemechanisms,the proposed authentication model can withstand several security attacks such asMan-in-Middle(MiM)attacks,Distributed Denial of Service(DDoS)attacks,server spoofing attacks and more.The proposed method also provides a solution for single-point failure,forward secrecy,revocability,etc.We exhibit the security of our proposed model by using formal(mathematical)analysis and informal analysis.We used Random Oracle Model to perform themathematical analysis.In addition,we compared the communication cost,computation cost,and security of the proposed model with the related existing studies.We have verified the security of the model by using AVISPA tool simulation.The security analysis and computation analysis show that the proposed protocol is viable.

Cryptanalysis of quantum broadcast communication and authentication protocol with a one-time pad

Chang et al.[Chin.Phys.623 010305（2014）]have proposed a quantum broadcast communication and authentication protocol.However,we find that an intercept-resend attack can be preformed successfully by a potential eavesdropper,who will be able to destroy the authentication function.Afterwards,he or she can acquire the secret transmitted message or even modify it while escaping detection,by implementing an efficient man-in-the-middle attack.Furthermore,we show a simple scheme to defend this attack,that is,applying non-reusable identity strings.

Design and Implementation of End to End Encrypted Short Message Service (SMS) Using Hybrid Cipher Algorithm

The study on design and implementation of end to end encrypted Short Message Service (SMS) using hybrid cipher algorithm is motivated by high rate of insecurity of data observed during Short Message Service (SMS) on Mobile devices. SMS messages are one of the popular ways of communication. The aim therefore is to design a software for end to end encryption short message service (SMS) that can conceal message while on transit to another mobile device using Hybrid Cipher Algorithm on Android Operating System and implement it for security of mobile SMS. Hybrid encryption incorporates a combination of asymmetric and symmetric encryption to benefit from the strengths of each form of encryption. Various encryption algorithms have been discussed. Secondary sources were employed in gathering useful data. In this research work three methodologies are employed—Structured System Analysis Design Methodology (SSADM), Object Oriented Analysis Design Methodology (OOADM) and prototyping. With the help of the three cryptographic algorithms employed—Message digest 5 (MD5), Blowfish and Rivest-Shamir Adleman (RSA);integrity, confidentiality, authentication and security of messages were achieved. The messages encrypted by developed application are also resistant to brute force attack. The implementing programs were coded in Java.

EBAKE-SE: A novel ECC-based authenticated key exchange between industrial IoT devices using secure element

Industrial IoT(IIoT)aims to enhance services provided by various industries,such as manufacturing and product processing.IIoT suffers from various challenges,and security is one of the key challenge among those challenges.Authentication and access control are two notable challenges for any IIoT based industrial deployment.Any IoT based Industry 4.0 enterprise designs networks between hundreds of tiny devices such as sensors,actuators,fog devices and gateways.Thus,articulating a secure authentication protocol between sensing devices or a sensing device and user devices is an essential step in IoT security.In this paper,first,we present cryptanalysis for the certificate-based scheme proposed for a similar environment by Das et al.and prove that their scheme is vulnerable to various traditional attacks such as device anonymity,MITM,and DoS.We then put forward an interdevice authentication scheme using an ECC(Elliptic Curve Cryptography)that is highly secure and lightweight compared to other existing schemes for a similar environment.Furthermore,we set forth a formal security analysis using the random oracle-based ROR model and informal security analysis over the Doleve-Yao channel.In this paper,we present comparison of the proposed scheme with existing schemes based on communication cost,computation cost and security index to prove that the proposed EBAKE-SE is highly efficient,reliable,and trustworthy compared to other existing schemes for an inter-device authentication.At long last,we present an implementation for the proposed EBAKE-SE using MQTT protocol.

面向BDSBAS电文认证的OTAR设计与仿真

星基增强系统(Satellite Based Augmentation System,SBAS)的电文格式公开,为防止SBAS服务遭受生成式欺骗攻击,国际民航组织积极推进SBAS认证服务标准的制定.本文面向北斗星基增强系统(BeiDou SatelliteBased Augmentation System,BDSBAS)阐述了基于中国商用密码算法的椭圆曲线数字签名(Elliptic Curve Digital Signature Algorithm,ECDSA)电文认证方案与时间效应流丢失容错(Time Efficient Stream Loss-tolerant Authentication,TESLA)电文认证方案,设计了BDSBAS认证电文,依据空中密钥管理OTAR(Over The Air Rekeying)的策略制定了OTAR电文(OTAR Message Type,OMT)与播发方案.通过蒙特卡洛OTAR仿真器开展仿真,对不同OTAR电文接收时间进行分析,本文设计的方案与国外方案对比结果有明显的提升,有效的减少了接收机完成认证使用SBAS增强服务的时间,对BDSBAS电文认证服务提供一定参考与建议.

语音实验室端到端即时通信认证协议设计

为保证语音实验室端到端即时通信安全,确保语音内容不被窃听和篡改,提出一种基于混合加解密的语音实验室端到端即时通信认证协议的设计方法。利用RSA方法加解密发送方传输的即时通信会话密钥,通过3DES方法将发送方发送的明文语音信息进行加解密。在加解密过程中,加密信息打包为加密包后发送至信息接收方,信息接收方获取加密包后,使用RSA方法、3DES方法进行有效的密钥解密认证、明文语音消息解密,获取语音实验室端到端的明文语音信息。实验结果显示,此协议使用下,语音实验室端到端即时通信的认证加速比提升,且仅在密钥输入内容准确的情况下,信息接收方才可得到准确的明文语音消息内容,且不存在内容失真问题。

Intrusion Detection Model Using Chaotic MAP for Network Coding Enabled Mobile Small Cells

Wireless Network security management is difficult because of the ever-increasing number of wireless network malfunctions,vulnerabilities,and assaults.Complex security systems,such as Intrusion Detection Systems(IDS),are essential due to the limitations of simpler security measures,such as cryptography and firewalls.Due to their compact nature and low energy reserves,wireless networks present a significant challenge for security procedures.The features of small cells can cause threats to the network.Network Coding(NC)enabled small cells are vulnerable to various types of attacks.Avoiding attacks and performing secure“peer”to“peer”data transmission is a challenging task in small cells.Due to the low power and memory requirements of the proposed model,it is well suited to use with constrained small cells.An attacker cannot change the contents of data and generate a new Hashed Homomorphic Message Authentication Code(HHMAC)hash between transmissions since the HMAC function is generated using the shared secret.In this research,a chaotic sequence mapping based low overhead 1D Improved Logistic Map is used to secure“peer”to“peer”data transmission model using lightweight H-MAC(1D-LM-P2P-LHHMAC)is proposed with accurate intrusion detection.The proposed model is evaluated with the traditional models by considering various evaluation metrics like Vector Set Generation Accuracy Levels,Key Pair Generation Time Levels,Chaotic Map Accuracy Levels,Intrusion Detection Accuracy Levels,and the results represent that the proposed model performance in chaotic map accuracy level is 98%and intrusion detection is 98.2%.The proposed model is compared with the traditional models and the results represent that the proposed model secure data transmission levels are high.

智能车载网络中匿名认证与密钥交换协议

智能车载网络是实现智能交通系统的核心,近年来受到学术界越来越多的关注,但车载网络固有的开放性、脆弱性导致其面临许多安全问题。为解决智能车辆与附近RSU之间双向认证和会话密钥的交换以及智能车辆的身份匿名性问题,提出智能车载网络中匿名认证与密钥交换协议。协议中设计了基于身份的数字签名算法,使得智能车辆以身份完全匿名的方式向附近的路边基站单元发送认证信息。当路边基站单元通过认证之后,计算一个消息认证码作为响应信息发送给请求认证的智能车辆,以实现双向认证。此外,在匿名认证的同时还能进行会话密钥的协商,用于后续的安全保密通信。协议是基于身份密码系统设计的,不需要复杂的证书管理。性能评估表明,所提协议能够有效部署在智能车载应用场景。

面向北斗导航电文认证的符号级欺骗方法研究

导航电文认证(NMA)技术已成为抵御生成式欺骗、保护全球卫星导航系统(GNSS)民用信号的重要发展方向之一。针对NMA在不改变导航电文的情况下难以抵御欺骗的漏洞,提出了面向北斗NMA的符号级欺骗(SLA)方法,并设计了最大后验概率(MAP)符号估计改进算法,以历次MAP估计值的众数作为新估计量,实现导航电文的快速恢复。基于北斗B1C信号NMA方案开展了欺骗效果评估试验。结果表明,在载噪比大于45 dB·Hz和短估计时延(小于30μs)条件下,SLA针对北斗B1C认证电文能够达到90%的序列欺骗成功率,与安全码估计-重放(SCER)相比,该方法能够显著降低符号误码率,缩短估计时延,具有更好的欺骗效果,也将为北斗NMA设计优化提供技术支撑。

TuLP: A Family of Lightweight Message Authentication Codes for Body Sensor Networks

A wireless sensor network （WSN） commonly whilst a body sensor network （BSN） must be secured with requires lower level security for public information gathering, strong authenticity to protect personal health information. In this paper, some practical problems with the message authentication codes （MACs）, which were proposed in the popular security architectures for WSNs, are reconsidered. The analysis shows that the recommended MACs for WSNs, e.g., CBC- MAC （TinySec）, OCB-MAC （MiniSec）, and XCBC-MAC （SenSee）, might not be exactly suitable for BSNs. Particularly an existential forgery attack is elaborated on XCBC-MAC. Considering the hardware limitations of BSNs, we propose a new family of tunable lightweight MAC based on the PRESENT block cipher. The first scheme, which is named TukP, is a new lightweight MAC with 64-bit output range. The second scheme, which is named TuLP-128, is a 128-bit variant which provides a higher resistance against internal collisions. Compared with the existing schemes, our lightweight MACs are both time and resource efficient on hardware-constrained devices.

改进的车联网边缘计算负载感知卸载策略研究

针对车联网边缘计算环境中,由于车辆的移动性导致的用户隐私安全问题和计算资源分配不灵活问题,提出了一种优化的负载感知安全卸载策略。首先,介绍了车辆边缘计算(VEC)的模型构建,建立了以时延与计算成本为优化目标的卸载效用模型;其次,描述了一种基于混合加密方式的车联网消息认证方案,并从完整性、防重放攻击、保密性等方面,对安全性能进行了分析;最后,根据车辆的移动性,协调车辆云资源与边缘云资源,提出了改良的负载感知任务卸载策略。仿真结果表明:该方案的平均卸载成功率比负载感知模式(LAM)算法提高了6.8%,平均卸载时延比边缘服务器(ES)汽车服务器(CS)身份验证机制(ECAM)算法降低了5.5%。相比其他现有方案,该方案在车辆切换路侧单元(RSU)情况下对于降低任务的卸载时延,提高卸载成功率有明显优势。