Improving Smart Home Security via MQTT: Maximizing Data Privacy and Device Authentication Using Elliptic Curve Cryptography

The rapid adoption of Internet of Things(IoT)technologies has introduced significant security challenges across the physical,network,and application layers,particularly with the widespread use of the Message Queue Telemetry Transport(MQTT)protocol,which,while efficient in bandwidth consumption,lacks inherent security features,making it vulnerable to various cyber threats.This research addresses these challenges by presenting a secure,lightweight communication proxy that enhances the scalability and security of MQTT-based Internet of Things(IoT)networks.The proposed solution builds upon the Dang-Scheme,a mutual authentication protocol designed explicitly for resource-constrained environments and enhances it using Elliptic Curve Cryptography(ECC).This integration significantly improves device authentication,data confidentiality,and energy efficiency,achieving an 87.68%increase in data confidentiality and up to 77.04%energy savings during publish/subscribe communications in smart homes.The Middleware Broker System dynamically manages transaction keys and session IDs,offering robust defences against common cyber threats like impersonation and brute-force attacks.Penetration testing with tools such as Hydra and Nmap further validated the system’s security,demonstrating its potential to significantly improve the security and efficiency of IoT networks while underscoring the need for ongoing research to combat emerging threats.

Lightweight Authentication Protocol Based on Physical Unclonable Function

In the emerging Industrial Internet of Things(IIoT),authentication problems have become an urgent issue for massive resource-constrained devices because traditional costly security mechanisms are not suitable for them.The security protocol designed for resource-constrained systems should not only be secure but also efficient in terms of usage of energy,storage,and processing.Although recently many lightweight schemes have been proposed,to the best of our knowledge,they are unable to address the problem of privacy preservation with the resistance of Denial of Service(DoS)attacks in a practical way.In this paper,we propose a lightweight authentication protocol based on the Physically Unclonable Function(PUF)to overcome the limitations of existing schemes.The protocol provides an ingenious authentication and synchronization mechanism to solve the contradictions amount forward secrecy,DoS attacks,and resource-constrained.The performance analysis and comparison show that the proposed scheme can better improve the authentication security and efficiency for resource-constrained systems in IIoT.

Secured Cloud Communication Using Lightweight Hash Authentication with PUF

Internet-of-Things(IoT)is an awaited technology in real-world applications to process daily tasks using intelligent techniques.The main process of data in IoT involves communication,integration,and coordination with other real-world applications.The security of transferred,stored,and processed data in IoT is not ensured in many constraints.Internet-enabled smart devices are widely used among populations for all types of applications,thus increasing the popularity of IoT among widely used server technologies.Smart grid is used in this article with IoT to manage large data.A smart grid is a collection of numerous users in the network with the fastest response time.This article aims to provide high authentication to the smart grid,which constitutes secure communication in cloud-based IoT.Many IoT devices are deployed openly in all places.This open-access is vulnerable toward cloning attacks.Authentication is a significant process that provides strength while attacking.The security of the cloud and IoT must be computationally high.A lightweight authentication using hashing technique is proposed considering the aforementioned condition.The main factor of the authentication involves physically unclonable functions,which are utilized in improving the performance of the authentication.The proposed approach is evaluated with the existing techniques.Results show that the performance of the proposed algorithm provides high robust security.

Cloud Data Encryption and Authentication Based on Enhanced Merkle Hash Tree Method

Many organizations apply cloud computing to store and effectively process data for various applications.The user uploads the data in the cloud has less security due to the unreliable verification process of data integrity.In this research,an enhanced Merkle hash tree method of effective authentication model is proposed in the multi-owner cloud to increase the security of the cloud data.Merkle Hash tree applies the leaf nodes with a hash tag and the non-leaf node contains the table of hash information of child to encrypt the large data.Merkle Hash tree provides the efficient mapping of data and easily identifies the changesmade in the data due to proper structure.The developed model supports privacy-preserving public auditing to provide a secure cloud storage system.The data owners upload the data in the cloud and edit the data using the private key.An enhanced Merkle hash tree method stores the data in the cloud server and splits it into batches.The data files requested by the data owner are audit by a third-party auditor and the multiowner authentication method is applied during the modification process to authenticate the user.The result shows that the proposed method reduces the encryption and decryption time for cloud data storage by 2–167 ms when compared to the existing Advanced Encryption Standard and Blowfish.

Novel Sequence Number Based Secure Authentication Scheme for Wireless LANs

Authentication per frame is an implicit necessity for security in wireless local area networks（WLANs）. We propose a novel per frame secure authentication scheme which provides authentication to data frames in WLANs. The scheme involves no cryptographic overheads for authentication of frames.It utilizes the sequence number of the frame along with the authentication stream generators for authentication.Hence, it requires no extra bits or messages for the authentication purpose and also no change in the existing frame format is required. The scheme provides authentication by modifying the sequence number of the frame at the sender, and that the modification is verified at the receiver. The modified sequence number is protected by using the XOR operation with a random number selected from the random stream. The authentication is lightweight due to the fact that it requires only trivial arithmetic operations like the subtraction and XOR operation.

Design of a Mutual Authentication and Key Agreement Protocol for WBANs

Please WBANs are a sensor network for detection and collection of sensitive data to the human body,which is lightweight and mobile.WBANs transmit sensitive and significant messages through the public channel,which makes it easy for an attacker to eavesdrop and modify the messages,thus posing a severe threat to the security of the messages.Therefore,it is essential to put in place authentication and key agreement between different communication nodes in WBANs.In this paper,a lightweight and secure authenticated key agreement protocol in wireless body area networks is designed.It is capable to reduce the cost of sensor node computation while ensuring security.Besides,an informal security analysis is conducted to discuss the security of the protocol against well-known attacks.Finally,the energy consumption of the protocol is evaluated,and the results show that the sensor nodes only need low storage cost,computational cost and communication cost.

一种基于格的轻量级物联网群签密认证方案

5G时代为物联网高速发展带来了机遇,身份认证是保障物联网安全的基础。然而在面对量子攻击时,由于物联网节点众多,基于签密的身份认证方案生成节点密钥将消耗大量资源,难以满足物联网低开销的需求。为此,设计了一种基于格的轻量级群签密认证方案。在密钥生成阶段,设计了改进陷门对角矩阵,优化生成密钥所需的原像采样算法,减小了生成大量密钥时所需的整体时间;在身份认证阶段,基于剩余哈希引理和签密性质,在一个逻辑步骤内对消息同时进行签名和加密,提出了低次数的点乘与哈希运算的交互流程,完成组长代替群组成员进行的接入认证。仿真实验表明,该方案降低了物联网设备接入时的交互次数,减少了身份认证阶段的计算开销,对比现有方案,签密与解签密的总开销降低了至少7%,同时证明了该方案能在物联网中抵抗量子攻击。

V2G中基于PUF的轻量级匿名认证协议

针对现有车辆到电网(V2G)网络认证协议中功能不够完善、通信开销大、计算开销高等问题,提出了一种基于物理不可克隆函数(PUF)的轻量级匿名认证协议,可以抵抗机器学习建模攻击。所提协议采用哈希函数和ASCON密码算法,实现车辆、充电桩和能源提供商之间快速的三方认证与密钥协商。通过模糊提取器结合生物特征和用户密码,实现双因素验证、密码和生物特征更新功能,并通过密码学动态累加器提供有效的用户撤销策略。ROR模型和Scyther形式化验证工具证明了所提协议的安全性,非形式化安全分析表明所提协议能抵抗物理攻击、位置伪造攻击、特权内部攻击等多种安全攻击。与近几年协议的性能对比分析表明,所提协议平均减少了约35.9%的通信开销和29.9%的计算开销,高度适用于资源有限的V2G环境。

轻量级的两方认证密钥协商协议

轻量级的两方认证密钥协商协议允许通信双方在公开信道上建立一个相同且安全的会话密钥。现有的认证协议难以满足轻量级的需求,同时多数轻量级协议仍存在某些安全问题。基于此,提出了一种基于身份的两方匿名轻量级逆向防火墙认证密钥协商协议。该协议在eCK模型下结合BAN逻辑被证明是安全的。协议提供匿名性、完美前向安全性、抗重放攻击、抗Dos攻击、抗中间人攻击。与其他轻量级认证协议对比发现,该协议具有更高的安全性和较短的运行时间,适用于资源受限设备。

面向车联网车辆的轻量级持续身份认证协议

基于云-边缘计算的车联网(Cloud-Edge computing for the Internet of Vehicle,CEIoV)能够支持大规模车辆的实时访问与服务请求,为了保证其内部资源的安全性,需要对车辆进行身份认证而后才能接入CEIoV;但是车辆本身处于运行状态且计算、存储和通信资源受限,给CEIoV车辆的身份认证带来挑战.本文基于具有简单密码操作的变色龙哈希函数,提出了一个连续轻量级身份认证协议(Lightweight Continuous identity Authentication,LCA),实现了对于资源受限车辆的认证和CEIoV内部资源的安全保障.本文在随机预言机模型下证明了LCA协议的语义安全性;并通过实验验证LCA协议在连续认证过程中具有较低的计算和通信成本.

电力物联网轻量级身份认证及密钥协商方法

随着电力物联网的快速发展,各种设备的大规模接入支撑了电力系统智能化水平的提升。然而,电力业务运营性能的不断提升,给海量设备的计算能力和存储容量带来了新的挑战。资源有限的设备将难以应用现有的公钥密码机制来确保安全性。为了确保设备间的通信安全,电力系统执行身份验证并生成会话密钥,从而保护信息交互的安全性。考虑到电力物联网设备的资源有限,本文提出了一种基于椭圆曲线算法的轻量级身份认证和密钥协商方案,实现了电力物联网环境的各主体间的快速安全认证。实验结果表明,提出方案实现了比传统方案更高的安全等级和运行效率。

A Lightweight Anonymous Authentication and Key Negotiation Scheme in Smart Home Environments

With the rapid development of Internet of Things(IoT)technology,smart home users can access and control smart devices remotely to enjoy convenient and efficient services.However,sensitive data collected by smart devices is vulnerable to attacks such as eavesdropping and simulation when transmitted through public channels.At the same time,the security of resource-constrained smart devices is low,and attackers may use the controlled devices to carry out malicious operations further.To address the aforementioned existing security issues,this paper proposes a lightweight user anonymous authentication scheme for resource-constrained smart home environments.At the same time,the security analysis is carried out to further prove the proposed scheme's security.Finally,the performance analysis between the proposed scheme and the existing similar schemes proves that the proposed scheme has advantages in calculation cost and safety characteristics.

集成多认证源的集团型企业单点登录与统一用户身份认证系统的研究与应用

集团型企业在进行数字化能力建设的过程中,通常都会面临集团总部及所属各层级成员企业信息系统的统筹兼顾的问题。其中,单点登录与统一用户身份认证系统作为基础服务之一,对集团型企业在进行多层级信息系统统筹建设过程中起到必要的支撑性作用。如何设计一套即能实现全集团各层级企业员工用户身份的统一认证,又能够支撑以分层、分级方式来实现对于全集团各层级企业内部员工用户账号的有序、有效的管理,是集团型企业在进行数字化建设过程中必须要解决的一个问题。文章通过设计一种集成多认证源的单点登录与统一用户身份认证系统来有效的解决了这一难题。

Toward an RSU-unavailable Lightweight Certificateless Key Agreement Scheme for VANETs

Vehicle ad-hoc networks have developed rapidly these years,whose security and privacy issues are always concerned widely.In spite of a remarkable research on their security solutions,but in which there still lacks considerations on how to secure vehicleto-vehicle communications,particularly when infrastructure is unavailable.In this paper,we propose a lightweight certificateless and oneround key agreement scheme without pairing,and further prove the security of the proposed scheme in the random oracle model.The proposed scheme is expected to not only resist known attacks with less computation cost,but also as an efficient way to relieve the workload of vehicle-to-vehicle authentication,especially in no available infrastructure circumstance.A comprehensive evaluation,including security analysis,efficiency analysis and simulation evaluation,is presented to confirm the security and feasibility of the proposed scheme.

Modified Vanstone’s Construction of lightweight MAC for Vehicular On-Board IT Systems

We propose a lightweight construction, a modification of Vanstone’s MAC construction, for the message authentication of the communication between Electronic Control Units (ECUs) in distributed car control systems. The proposed approach can solve the task of error control and authentication in unified algorithmic technology, called MAC (Message Authentication Code) with ECC (Error Correction Code). We follow a provable approach in the design of the cryptographic primitive, where we quantify the security measures in the parameters of the system. Provable security approaches are missing in the field of secure in-vehicle communication.

边缘计算环境下轻量级终端跨域认证协议

边缘计算由于低时延、高带宽、低成本等众多优点,被广泛应用在各种智能应用场景中,但也因其分布式、实时性和数据多源异构性等特点,面临安全方面的诸多挑战。身份认证是终端接入网络的第一步,也是边缘计算的第一道防线,为了解决边缘计算环境下的安全问题,在“云-边-端”三级网络认证架构基础上,提出了一种适用于边缘计算环境下的终端跨域认证协议。该协议首先基于SM9算法实现终端与本地边缘节点间的接入认证,并协商出会话密钥;然后利用该密钥结合对称加密技术和Hash算法实现终端的跨域认证;认证过程中采用假名机制,保护终端用户的隐私安全,终端只需一次注册,便可在不同安全域之间随机漫游。通过BAN逻辑证明了协议的正确性,并对协议的安全性进行分析。结果表明,该协议可以抵抗物联网场景下的常见攻击,同时具备单点登录、用户匿名等特点。最后从计算成本和通信成本两方面对跨域认证协议进行性能分析,并与现有方案进行对比。实验结果显示,该协议在计算成本和通信开销上优于其他方案,满足资源受限的终端设备需求,是一种轻量级安全的身份认证协议。

面向边缘计算的电力终端轻量级认证协议

边缘计算有效缓解了云平台的计算压力,降低网络带宽消耗,但也带来了新的安全问题,传统的认证机制不再适用于“云边端”网络架构,对此提出一种轻量级云边协同的双向身份认证协议,针对海量资源受限的电力终端,仅基于哈希与异或操作实现认证,减轻终端计算压力与带宽传输压力。利用安全协议与应用自动化验证工具(automated validation of internet security protocols and applications,AVISPA)以及安全特性分析验证协议的安全性,分析和仿真结果表明:所提协议可以抵抗重放攻击和仿冒攻击等,与同类型协议相比,具有更小的计算和通信开销。

联盟链环境下物联网轻量级网关研究

区块链的分布式和去中心化特性能够有效应对传统物联网架构所面临的设备安全和数据安全挑战。网关作为区块链与物联网融合的关键节点,在融合应用中面临算力、存储资源受限的实际困难,亟需可用的轻量级设计与实现方案。针对这一问题,设计并实现了一种基于联盟链的轻量级区块链-物联网网关原型。首先,基于长安链SPV(Simplified Payment Verification)框架,在网关中实现了关键数据的上链存证与交易数据的过滤精简;其次,从感知设备的行为模式、感知数据两方面进行模式提取与异常识别,保证设备的接入安全和运行安全;最后,针对网关轻节点所存储的区块链默克尔树,提出了一种剪枝算法,加速本组织相关交易数据的验证过程。实验结果表明,设计的轻量级网关具备设备身份可信认证和运行时异常行为检测的可行性,与其它方法相比,默克尔树剪枝优化算法能够大幅度降低交易验证时延。

泛在接入中移动身份认证安全模型研究

随着移动互联网、云计算、5G等新技术的不断发展,移动办公展现出越来越多的便利性和快捷性。移动办公场景涉及到电子签批、文件流转、费用报销、流程管理、协助协作等环节。不仅对实时性、易用性要求比较高,同时对系统的信息安全要求也高。从信息安全视角看,移动办公使得传统的安全边界由静态变为动态,对传统安全防护措施带来新的挑战,需要提供全流程安全保护。本文分析了目前业界主流移动办公安全解决方案的技术路线,针对身份认证过程中存在的交互环节多、部署安全设备繁杂等应用问题,提出了基于无证书的轻量级的公钥密码认证模型,选用改进的椭圆曲线算法(ECC),利用时间戳和随机数等技术措施,实现移动终端用户与认证服务器之间双向认证,以及抗重放攻击、抗前向攻击和后向攻击,保障移动办公场景中的泛在接入及安全认证。

基于轻量级CNN和信道特征辅助的多用户物理层认证机制

针对目前物理层的用户认证算法存在的鲁棒性差、复杂度高等问题,提出了一种轻量级卷积神经网络(CNN)信道特征提取算法,通过改变网络输入形式减少训练所需要的信道状态响应,同时基于该算法建立了一种多用户物理层信道特征辅助的认证机制,设计了从用户注册到认证的详细过程,并在线完成多用户认证及网络参数更新。仿真结果表明,所提算法能够完成多用户身份认证,在较小的训练轮次下获得良好的检测性能,且比现有的多用户认证算法需要的训练样本少。