Secured Cloud Communication Using Lightweight Hash Authentication with PUF

Internet-of-Things(IoT)is an awaited technology in real-world applications to process daily tasks using intelligent techniques.The main process of data in IoT involves communication,integration,and coordination with other real-world applications.The security of transferred,stored,and processed data in IoT is not ensured in many constraints.Internet-enabled smart devices are widely used among populations for all types of applications,thus increasing the popularity of IoT among widely used server technologies.Smart grid is used in this article with IoT to manage large data.A smart grid is a collection of numerous users in the network with the fastest response time.This article aims to provide high authentication to the smart grid,which constitutes secure communication in cloud-based IoT.Many IoT devices are deployed openly in all places.This open-access is vulnerable toward cloning attacks.Authentication is a significant process that provides strength while attacking.The security of the cloud and IoT must be computationally high.A lightweight authentication using hashing technique is proposed considering the aforementioned condition.The main factor of the authentication involves physically unclonable functions,which are utilized in improving the performance of the authentication.The proposed approach is evaluated with the existing techniques.Results show that the performance of the proposed algorithm provides high robust security.

Lightweight Authentication Protocol Based on Physical Unclonable Function

In the emerging Industrial Internet of Things(IIoT),authentication problems have become an urgent issue for massive resource-constrained devices because traditional costly security mechanisms are not suitable for them.The security protocol designed for resource-constrained systems should not only be secure but also efficient in terms of usage of energy,storage,and processing.Although recently many lightweight schemes have been proposed,to the best of our knowledge,they are unable to address the problem of privacy preservation with the resistance of Denial of Service(DoS)attacks in a practical way.In this paper,we propose a lightweight authentication protocol based on the Physically Unclonable Function(PUF)to overcome the limitations of existing schemes.The protocol provides an ingenious authentication and synchronization mechanism to solve the contradictions amount forward secrecy,DoS attacks,and resource-constrained.The performance analysis and comparison show that the proposed scheme can better improve the authentication security and efficiency for resource-constrained systems in IIoT.

Cloud Data Encryption and Authentication Based on Enhanced Merkle Hash Tree Method

Many organizations apply cloud computing to store and effectively process data for various applications.The user uploads the data in the cloud has less security due to the unreliable verification process of data integrity.In this research,an enhanced Merkle hash tree method of effective authentication model is proposed in the multi-owner cloud to increase the security of the cloud data.Merkle Hash tree applies the leaf nodes with a hash tag and the non-leaf node contains the table of hash information of child to encrypt the large data.Merkle Hash tree provides the efficient mapping of data and easily identifies the changesmade in the data due to proper structure.The developed model supports privacy-preserving public auditing to provide a secure cloud storage system.The data owners upload the data in the cloud and edit the data using the private key.An enhanced Merkle hash tree method stores the data in the cloud server and splits it into batches.The data files requested by the data owner are audit by a third-party auditor and the multiowner authentication method is applied during the modification process to authenticate the user.The result shows that the proposed method reduces the encryption and decryption time for cloud data storage by 2–167 ms when compared to the existing Advanced Encryption Standard and Blowfish.

Novel Sequence Number Based Secure Authentication Scheme for Wireless LANs

Authentication per frame is an implicit necessity for security in wireless local area networks（WLANs）. We propose a novel per frame secure authentication scheme which provides authentication to data frames in WLANs. The scheme involves no cryptographic overheads for authentication of frames.It utilizes the sequence number of the frame along with the authentication stream generators for authentication.Hence, it requires no extra bits or messages for the authentication purpose and also no change in the existing frame format is required. The scheme provides authentication by modifying the sequence number of the frame at the sender, and that the modification is verified at the receiver. The modified sequence number is protected by using the XOR operation with a random number selected from the random stream. The authentication is lightweight due to the fact that it requires only trivial arithmetic operations like the subtraction and XOR operation.

Design of a Mutual Authentication and Key Agreement Protocol for WBANs

Please WBANs are a sensor network for detection and collection of sensitive data to the human body,which is lightweight and mobile.WBANs transmit sensitive and significant messages through the public channel,which makes it easy for an attacker to eavesdrop and modify the messages,thus posing a severe threat to the security of the messages.Therefore,it is essential to put in place authentication and key agreement between different communication nodes in WBANs.In this paper,a lightweight and secure authenticated key agreement protocol in wireless body area networks is designed.It is capable to reduce the cost of sensor node computation while ensuring security.Besides,an informal security analysis is conducted to discuss the security of the protocol against well-known attacks.Finally,the energy consumption of the protocol is evaluated,and the results show that the sensor nodes only need low storage cost,computational cost and communication cost.

一种基于格的轻量级物联网群签密认证方案

5G时代为物联网高速发展带来了机遇,身份认证是保障物联网安全的基础。然而在面对量子攻击时,由于物联网节点众多,基于签密的身份认证方案生成节点密钥将消耗大量资源,难以满足物联网低开销的需求。为此,设计了一种基于格的轻量级群签密认证方案。在密钥生成阶段,设计了改进陷门对角矩阵,优化生成密钥所需的原像采样算法,减小了生成大量密钥时所需的整体时间;在身份认证阶段,基于剩余哈希引理和签密性质,在一个逻辑步骤内对消息同时进行签名和加密,提出了低次数的点乘与哈希运算的交互流程,完成组长代替群组成员进行的接入认证。仿真实验表明,该方案降低了物联网设备接入时的交互次数,减少了身份认证阶段的计算开销,对比现有方案,签密与解签密的总开销降低了至少7%,同时证明了该方案能在物联网中抵抗量子攻击。

轻量级的两方认证密钥协商协议

轻量级的两方认证密钥协商协议允许通信双方在公开信道上建立一个相同且安全的会话密钥。现有的认证协议难以满足轻量级的需求,同时多数轻量级协议仍存在某些安全问题。基于此,提出了一种基于身份的两方匿名轻量级逆向防火墙认证密钥协商协议。该协议在eCK模型下结合BAN逻辑被证明是安全的。协议提供匿名性、完美前向安全性、抗重放攻击、抗Dos攻击、抗中间人攻击。与其他轻量级认证协议对比发现,该协议具有更高的安全性和较短的运行时间,适用于资源受限设备。

A Lightweight Anonymous Authentication and Key Negotiation Scheme in Smart Home Environments

With the rapid development of Internet of Things(IoT)technology,smart home users can access and control smart devices remotely to enjoy convenient and efficient services.However,sensitive data collected by smart devices is vulnerable to attacks such as eavesdropping and simulation when transmitted through public channels.At the same time,the security of resource-constrained smart devices is low,and attackers may use the controlled devices to carry out malicious operations further.To address the aforementioned existing security issues,this paper proposes a lightweight user anonymous authentication scheme for resource-constrained smart home environments.At the same time,the security analysis is carried out to further prove the proposed scheme's security.Finally,the performance analysis between the proposed scheme and the existing similar schemes proves that the proposed scheme has advantages in calculation cost and safety characteristics.

Toward an RSU-unavailable Lightweight Certificateless Key Agreement Scheme for VANETs

Vehicle ad-hoc networks have developed rapidly these years,whose security and privacy issues are always concerned widely.In spite of a remarkable research on their security solutions,but in which there still lacks considerations on how to secure vehicleto-vehicle communications,particularly when infrastructure is unavailable.In this paper,we propose a lightweight certificateless and oneround key agreement scheme without pairing,and further prove the security of the proposed scheme in the random oracle model.The proposed scheme is expected to not only resist known attacks with less computation cost,but also as an efficient way to relieve the workload of vehicle-to-vehicle authentication,especially in no available infrastructure circumstance.A comprehensive evaluation,including security analysis,efficiency analysis and simulation evaluation,is presented to confirm the security and feasibility of the proposed scheme.

Modified Vanstone’s Construction of lightweight MAC for Vehicular On-Board IT Systems

We propose a lightweight construction, a modification of Vanstone’s MAC construction, for the message authentication of the communication between Electronic Control Units (ECUs) in distributed car control systems. The proposed approach can solve the task of error control and authentication in unified algorithmic technology, called MAC (Message Authentication Code) with ECC (Error Correction Code). We follow a provable approach in the design of the cryptographic primitive, where we quantify the security measures in the parameters of the system. Provable security approaches are missing in the field of secure in-vehicle communication.

联盟链环境下物联网轻量级网关研究

区块链的分布式和去中心化特性能够有效应对传统物联网架构所面临的设备安全和数据安全挑战。网关作为区块链与物联网融合的关键节点,在融合应用中面临算力、存储资源受限的实际困难,亟需可用的轻量级设计与实现方案。针对这一问题,设计并实现了一种基于联盟链的轻量级区块链-物联网网关原型。首先,基于长安链SPV(Simplified Payment Verification)框架,在网关中实现了关键数据的上链存证与交易数据的过滤精简;其次,从感知设备的行为模式、感知数据两方面进行模式提取与异常识别,保证设备的接入安全和运行安全;最后,针对网关轻节点所存储的区块链默克尔树,提出了一种剪枝算法,加速本组织相关交易数据的验证过程。实验结果表明,设计的轻量级网关具备设备身份可信认证和运行时异常行为检测的可行性,与其它方法相比,默克尔树剪枝优化算法能够大幅度降低交易验证时延。

泛在接入中移动身份认证安全模型研究

随着移动互联网、云计算、5G等新技术的不断发展,移动办公展现出越来越多的便利性和快捷性。移动办公场景涉及到电子签批、文件流转、费用报销、流程管理、协助协作等环节。不仅对实时性、易用性要求比较高,同时对系统的信息安全要求也高。从信息安全视角看,移动办公使得传统的安全边界由静态变为动态,对传统安全防护措施带来新的挑战,需要提供全流程安全保护。本文分析了目前业界主流移动办公安全解决方案的技术路线,针对身份认证过程中存在的交互环节多、部署安全设备繁杂等应用问题,提出了基于无证书的轻量级的公钥密码认证模型,选用改进的椭圆曲线算法(ECC),利用时间戳和随机数等技术措施,实现移动终端用户与认证服务器之间双向认证,以及抗重放攻击、抗前向攻击和后向攻击,保障移动办公场景中的泛在接入及安全认证。

边缘计算环境下轻量级终端跨域认证协议

边缘计算由于低时延、高带宽、低成本等众多优点,被广泛应用在各种智能应用场景中,但也因其分布式、实时性和数据多源异构性等特点,面临安全方面的诸多挑战。身份认证是终端接入网络的第一步,也是边缘计算的第一道防线,为了解决边缘计算环境下的安全问题,在“云-边-端”三级网络认证架构基础上,提出了一种适用于边缘计算环境下的终端跨域认证协议。该协议首先基于SM9算法实现终端与本地边缘节点间的接入认证,并协商出会话密钥;然后利用该密钥结合对称加密技术和Hash算法实现终端的跨域认证;认证过程中采用假名机制,保护终端用户的隐私安全,终端只需一次注册,便可在不同安全域之间随机漫游。通过BAN逻辑证明了协议的正确性,并对协议的安全性进行分析。结果表明,该协议可以抵抗物联网场景下的常见攻击,同时具备单点登录、用户匿名等特点。最后从计算成本和通信成本两方面对跨域认证协议进行性能分析,并与现有方案进行对比。实验结果显示,该协议在计算成本和通信开销上优于其他方案,满足资源受限的终端设备需求,是一种轻量级安全的身份认证协议。

面向边缘计算的电力终端轻量级认证协议

边缘计算有效缓解了云平台的计算压力,降低网络带宽消耗,但也带来了新的安全问题,传统的认证机制不再适用于“云边端”网络架构,对此提出一种轻量级云边协同的双向身份认证协议,针对海量资源受限的电力终端,仅基于哈希与异或操作实现认证,减轻终端计算压力与带宽传输压力。利用安全协议与应用自动化验证工具(automated validation of internet security protocols and applications,AVISPA)以及安全特性分析验证协议的安全性,分析和仿真结果表明:所提协议可以抵抗重放攻击和仿冒攻击等,与同类型协议相比,具有更小的计算和通信开销。

基于轻量级CNN和信道特征辅助的多用户物理层认证机制

针对目前物理层的用户认证算法存在的鲁棒性差、复杂度高等问题,提出了一种轻量级卷积神经网络(CNN)信道特征提取算法,通过改变网络输入形式减少训练所需要的信道状态响应,同时基于该算法建立了一种多用户物理层信道特征辅助的认证机制,设计了从用户注册到认证的详细过程,并在线完成多用户认证及网络参数更新。仿真结果表明,所提算法能够完成多用户身份认证,在较小的训练轮次下获得良好的检测性能,且比现有的多用户认证算法需要的训练样本少。

基于云服务标识的轻量型身份认证方法

随着云服务的大规模应用,其带来的安全问题日益凸显。如何防范云服务面临的各类安全威胁,已成为相关行业关注的焦点。由于云服务之间交互频繁,将传统的身份认证机制直接移植到云服务中会极大地降低交互效率,因此提出了一种基于标识的轻量型身份认证方法,主要解决云服务本身的轻量型身份认证问题。该方案具有两个优点:一方面解决了云服务之间的访问安全问题,另一方面降低了认证过程对原业务系统造成的性能影响。

轻量级认证加密算法ASCON的差分功耗分析

针对轻量级认证加密算法ASCON的结构,提出一种差分功耗分析方法。该方法结合算法S盒实现特点,利用汉明重量模型作为功耗区分函数,将功耗曲线分组,并恢复出加密用的主密钥。进一步地,对于DPA攻击中出现的“魅峰”,给出一种功耗曲线预处理方法,先将曲线根据明文分组并求均值,再对预处理后的曲线发起DPA攻击。通过采集s a置换泄露的1500条功耗曲线,能快速恢复出其主密钥的44 bit。此外,直接攻击原始曲线所需时间为21849.8889 ms,引入预处理技术后,攻击预处理的曲线所需时间为198.9113 ms,约为直接攻击原始曲线所需时间的1/109。

电力系统下的轻量级自适应认证系统

电力物联终端种类繁多,绝大多数处于资源受限的状态下,在实际应用上存在安全需求。本文设计了一种基于LBlock加密算法的挑战应答协议和基于国家商用密码认证方案的轻量级自适应身份认证系统。系统通过树莓派仿真资源受限的电力物联终端测试身份认证以及密钥协商效率与安全性。测试结果表明,该轻量级自适应认证系统可以实现边缘物联代理与各类受限电力物联终端的双向身份认证,有效保证了电力系统自适应认证的需求。

基于PRF的RFID轻量级认证协议研究

无线射频识别(radio frequency identification,RFID)认证协议可实现读写器和标签之间的身份识别,保证只有合法的读写器才能访问标签的数据.由于标签的成本限制,设计最轻量级的RFID认证协议是面临的主要挑战.为了达到不可预测性隐私,标签至少需要具有伪随机函数PRF的能力.首先提出了一种基于PRF的RFID轻量级认证协议的基本框架,给出了抽象描述.基于对消息认证函数Fi的实例化,提出了一种新的RFID轻量级认证协议ELAP.与现有协议相比,该协议可以实现读写器和标签之间的双向认证,并能抵抗已知的所有攻击方式.在效率方面,标签只需要进行2次消息摘要运算,让标签的计算代价达到了最小.

基于数字签名的轻量级RFID认证协议

RFID系统的安全和隐私问题已成为阻碍其进一步扩展的瓶颈。针对低代价标签提出了一种基于签名方案的轻量级RFID认证协议,它利用数字签名技术和RFID认证技术的恰当结合,成功实现了RFID系统的轻量级认证机制。性能评估表明新协议除了具有主要的安全隐私性能属性之外,还能够抵抗多种典型的恶意攻击和威胁,其安全性依赖于在有限域上求解离散对数问题的困难性和伪随机数生成器的安全性。新协议将公钥密码技术中代价较高的运算置于服务器端,确保了标签端运算的轻量性,促进了公钥密码技术在RFID系统中的进一步实施。