LoRa has emerged as a strong wireless communication technology for IoT devices. The security challenges of LoRa have also raised various concerns. We propose SymScrab, a simple physical layer solution that significantly improves the security of LoRa without affecting the communication performance or consuming more communication resources. SymScrab encrypts the message by scrambling the baseband samples with a pseudo-random permutation, which is easy to recover by the legitimate receiver who has the same permutation, but impossible for an adversary. We further propose a physical layer Message Integrity Check (MIC) that rejects spoofed packets because spoofed packets do not exhibit expected physical layer features. We provide a rigorous security analysis of SymScrab and prove guarantees for confidentiality and integrity. We implement SymScrab as an extension to the open-source implementation of LoRa, and test it with both over-the-air experiments and simulations. The results confirm that SymScrab does not negatively affect communication performance.

Trust and security are critical deployment require-ments for Industrial Internet of Things (IIoT) networks. A recent protocol, called TRUTH, integrates security mechanisms for authentication and privacy alongside a Dempster-Shafer based trust model, to assess the trustworthiness of collected data. We analyze this protocol and show that it does not comply with the implementation requirements of the 5G standard, and that flaws in the identification of involved parties hinder its adoption by 5G devices. We show how to fix this protocol and tailor it for the specific 5G implementation constraints, by enhancing its computational and communication performance. Finally, we show how to prove the security of this fixed protocol (TRUTH +) using the Tamarin automated verification tool.

5G technology is called to support the next generation of wireless communications and realize the “Internet of Everything” through its mMTC (massive Machine-Type-Communications) service. The recently standardized 5G-AKA protocol is intended to deal with security and privacy issues detected in earlier generations. Nevertheless, several 5G-AKA shortcomings have been reported, including a possibly excessive computational complexity for many IoT devices. To address these, a promising lightweight 2-pass authentication and key agreement (AKA) protocol for 5G mobile communications has recently been proposed by Braeken. Compared to the 5G-AKA protocol, this does not require the use of public key encryption. This paper analyzes the security claims of Braeken’s protocol and shows that it does not provide full unlinkability, but only session unlinkability, and is (still) subject to Linkability of AKA Failure Messages (LFM) attacks. We propose solutions to such problems and prove that symmetric-key based protocols cannot offer higher privacy protection levels without compromising availability. We then describe an enhanced version of this protocol that addresses these vulnerabilities and supports forward secrecy, which is a desirable feature for low-cost IoT devices.

The Internet of Medical Things (IoMT) provides ubiquitous healthcare services for patient monitoring and treatment. However, the interaction between doctors, patients, healthcare personnel and device manufacturers, with different and often conflicting security and privacy objectives, make such services vulnerable and subject to exploitation. In addition, since parties may require different access levels and the IoMT devices involve different functionalities, access control can be challenging. In this paper, we propose a blockchain-enabled authorization framework for managing both IoMT devices and medical files by creating a distributed chain of custody and health data privacy scheme. The core idea is to build trust domains for the various stakeholders and IoMT devices, in such a way that fine-grain access is enabled by taking into account critical attributes of the IoMT ecosystem such as a) the different roles and capabilities of the IoMT devices and b) their interaction with the users/stakeholders. A private blockchain is used in combination with on-chain smart contracts to allow for a forensics-by-design management architecture with audit trails for integrity and provenance guarantees as well as health data privacy. The private blockchain ecosystem is authenticated by a proof-of-medical-stake consensus mechanism that is tailored for medical applications.

The Internet of Things (IoT) creates new technological opportunities for a wide range of systems, such as industrial control systems, smart power grids, vehicular networks (VNs) and intelligent transportation systems, body area networks and healthcare monitoring and control systems and smart homes. At the same time, IoT also increases the threat surface for potential adversaries targeting critical interconnected systems that may depend on embedded IoT systems, such as supervisory control and data acquisition (SCADA) systems. At this point, attackers could take advantage from the incorporation of the paradigm to exploit new security gaps, probably caused by unforeseen interoperability and adaptability problems. Indeed, the deployment of Internet-enabled embedded devices that are distributed over major critical domains may create indirect and nonobvious interconnections with the underlying critical infrastructures (CIs). There is a need to further explore the security issues related to IoT technologies and to assure the resilience of CIs against advanced IoT-enabled attacks. The focus of this special issue is therefore to provide readers with the latest advances in securing the interaction between embedded IoT devices and CIs in order to increase their resilience to advanced IoT-enabled threats.

In a recent publication in this journal, K. Buet al.(IEEE Trans. on Information Forensics and Security, vol. 8, no. 3, pp. 429–439, Mar. 2013) presented a protocol that detects cloned tags (replicas of genuine tags) in anonymous radio frequency identification (RFID) systems by leveraging unreconciled collisions in the medium access control layer. This does not require RFID readers to implement cryptographic mechanisms, or know the identities of tags. Improved versions have since been published that claim that detection can also be deterministic. In this paper, we analyze this protocol and show that the physical limitations of collision detection have not been adequately addressed and that, without any further assumptions, unreconcilable collisions cannot be detected. We then propose a solution for which the responses of tags are randomized and show that: 1) there is a tradeoff between the accuracy of detecting cloning attacks and execution time and 2) detection of cloned tags cannot be deterministic.

In this paper, we analyze some recently proposed radio-frequency identification group codes based on low-density parity-check matrices that check the integrity of collections of tagged objects. These codes write additional data to the memory of tags to compute the number of missing tags. By studying the underlying requirements for these computations, we obtain bounds and show that there are simpler group codes that perform better, requiring less tag memory.

With an increasing number of online users, the potential danger of online deception grows accordingly - as does the importance of better understanding human behavior online to mitigate these risks. One critical element to address such online threat is to identify intentional deception in spontaneous online communication. For this study, we designed an interactive online game that creates player scenarios to encourage deception. Data was collected and analyzed in October 2014 to identify certain deceptive cues. Players' interactive dialogue was analyzed using linear regression analysis. The results reveal that certain language features are highly significant predictors of deception in synchronous, spontaneous online communication.

In highly dynamic systems resources may have to be accessed in real-time, within the strict time limits of underlying physical processes, with availability becoming critical. Current access control models such as RBAC and ABAC do not address real-time availability in a scalable way for such scenarios. In this paper we propose a real-time attribute-based access control model that extends the functionality of ABAC by using real-time attributes that reflect the requirements of critical applications. We describe two applications of our model: (a) a substation automation system, and (b) a medical cyber-physical system.

We propose a lightweight RFID authentication protocol that supports forward and backward security. The only cryptographic mechanism that this protocol uses is a pseudorandom number generator (PRNG) that is shared with the backend Server. Authentication is achieved by exchanging a few numbers (3 or 5) drawn from the PRNG. The lookup time is constant, and the protocol can be easily adapted to prevent online man-in-the-middle relay attacks. Security is proven in the UC security framework.

As the number of RFID applications grows, concerns about their security and privacy become greatly amplified. At the same time, the acutely restricted and cost-sensitive nature of RFID tags rules out simple reuse of traditional security/privacy solutions and calls for a new generation of extremely lightweight identification and authentication protocols. This article describes a universally composable security framework designed especially for RFID applications. We adopt RFID-specific setup, communication, and concurrency assumptions in a model that guarantees strong security, privacy, and availability properties. In particular, the framework supports modular deployment, which is most appropriate for ubiquitous applications. We also describe a set of simple, efficient, secure, and anonymous (untraceable) RFID identification and authentication protocols that instantiate the proposed framework. These protocols involve minimal interaction between tags and readers and place only a small computational load on the tag, and a light computational burden on the back-end server. We show that our protocols are provably secure within the proposed framework.

Mobile ad hoc networks (MANETs) are collections of wireless mobile devices with restricted broadcast range and resources, and no fixed infrastructure. Communication is achieved by relaying data along appropriate routes that are dynamically discovered and maintained through collaboration between the nodes. Discovery of such routes is a major task, both from efficiency and security points of view. Recently, a security model tailored to the specific requirements of MANETs was introduced by Acs, Buttyan, and Vajda. Among the novel characteristics of this security model is that it promises security guarantee under concurrent executions, a feature of crucial practical implication for this type of distributed computation. A novel route discovery algorithm called endairA was also proposed, together with a claimed security proof within the same model. In this paper, we show that the security proof for the route discovery algorithm endairA is flawed, and moreover, this algorithm is vulnerable to a hidden channel attack. We also analyze the security framework that was used for route discovery and argue that composability is an essential feature for ubiquitous applications. We conclude by discussing some of the major security challenges for route discovery in MANETs.

A considerable number of anonymous RFID authentication schemes have been proposed. However, current proposals either do not provide robust security guarantees, or suffer from scalability issues when the number of tags issued by the system is very large. In this paper, we focus on approaches that reconcile these important requirements. In particular, we seek to reduce the complexity of identifying tags by the back-end server in anonymous RFID authentication protocols---what we term the key-lookup problem.

In the not so far future, vehicles are expected to be able to communicate with each other and with the road infrastructure, to enhance driving experience and support road safety, among others. Vehicular ad-hoc networks (VANETs) introduce a number of security challenges to the research community, mainly concerning the tradeoff between the privacy of the drivers and the accountability of misbehaving vehicles. Another challenge is how to satisfy privacy in the presence of an adversary that has access to all communication (a global observer), and that can perform traffic analysis in order to link messages and identify vehicles. In this paper we attempt to address such issues and propose a set of cryptographic mechanisms that balance the tradeoff between privacy and accountability in a VANET. Furthermore, we examine techniques for location privacy against adversaries that perform a Bayesian traffic analysis, and propose a strategy to strengthen location privacy in VANETs.

RFID technology has raised a number of both real and imagined security and privacy fears and concerns. Since roughly 2001, a number of researchers have stepped up to the plate and proposed techniques for strengthening RFID security and privacy, while others have focused on attacking (and demonstrating weaknesses in) currently deployed RFID systems. Despite a few PhD theses devoted to this topic, it remains to be seen whether there are any new long-term fundamental issues involved in RFID security & privacy. Therefore, this panel's goal is to present and debate the panelists' diverse perspectives on the future (or lack thereof) of RFID security and privacy research.

Recently, a universally composable framework for RFID authentication protocols providing availability, anonymity, and authenticity was proposed. In this paper we extend that framework to address forward-security issues in the presence of key compromise.We also introduce new, provably secure, and highly practical protocols for anonymous authentication and key-exchange by RFID devices. The new protocols are lightweight, requiring only a pseudo-random bit generator. The new protocols satisfy forward-secure anonymity, authenticity, and availability requirements in the Universal Composability model.

Kohnfelder realized in 1978 that public key schemes require a Public Key Infrastructure (PKI) . X500/X509 were set up to standardize these ideas. PGP, proposed by Zimmermann is an alternative to the original PKI idea. Variants of the PGP based PKI were discussed independently by Reiter-Stubblebine and Burmester-Desmedt-Kabatianskii. The goal of Shamir’s 1984 idea of “identity-based” cryptography was to avoid a Public Key Infrastructure. Instead of having the users have their own public key, the identity of the user is the “public key,” and a trusted center provides each party with a secret key. Several identitybased cryptosystems have been proposed, in particular recently. We analyze Shamir’s identity-based concept critically. We argue the need for at least a registration infrastructure, which we call a”basic Identity-based Key Infrastructure.” Moreover, if secret keys of users can be stolen or lost, the infrastructure required to deal with this is as complex as the one of PKI. We make further comparisons between public key systems and identity-based ones.

Several organizations are setting up Public Key Infrastructures, examples are:the Corporation for Research and Educational Networking (CREN),• the Federal Government plans to fund 7 Public Key Infrastructure Models pilot programs at different federal agencies.However, experts have quite different viewpoints on how to set up such Public Key Infrastructure (PKI).Indeed, X500 and X509 are hierarchically organized (i.e.vertical), but PGP (see also Rivest-Lampson) is horizontally organized.Variants of PGP (see Reiter-Stubblebine (CCCS, ACM) and Burmester-Desmedt-Kabatianski (DIMACS)) require a minimum connectivity, i.e., a minimum number of disjoint paths in order to deal with hackers breaking into certifying entities (authorities).Moreover, Ellison-Schneier have questioned the need for a Public Key Infrastructure (PKI).Before one builds such an expensive infrastructure, experts should debate what method to use and whether a PKI is needed.While a hierarchical PKI may become the next target of computer hackers, a multiple-connected one seems much more expensive to build.

We consider the problem of dependable computation with multiple inputs. The goal is to study when redundancy can help to achieve survivability and when it cannot. We use AND/OR graphs to model fault tolerant computations with multiple inputs. While there is a polynomial time algorithm for finding vertex disjoint paths in networks, we will show that the equivalent problem in computation systems with multiple inputs is NP-hard. Our main results are as follows. (1) We present a general model for fault tolerant computation systems with multiple inputs: AND/OR graphs. (2) We show that it is NP-hard to find two vertex disjoint solution graphs in an AND/OR graph. It follows that in the general case redundancy cannot help to achieve survivability, assuming P≠NP.

In this work we introduce and study threshold (t-out-of-n) secret sharing schemes for families of functions ${\cal F}$. Such schemes allow any set of at least t parties to compute privately the value f(s) of a (previously distributed) secret s, for any $f\in {\cal F}$. Smaller sets of players get no more information about the secret than what follows from the value f(s). The goal is to make the shares as short as possible. Results are obtained for two different settings: we study the case when the evaluation is done on a broadcast channel without interaction, and we examine what can be gained by allowing evaluations to be done interactively via private channels.

Secure key distribution is a critical component in secure communications. Finding 'proven secure' practical key distribution systems is one of the major goals in cryptography. The Diffie-Hellman variants, a family of key distribution systems, achieve some of the objectives of this goal. In particular, the 'non-paradoxical' system (by Matsumoto-Takashima-Imai and Yacobi) is claimed to be secure against a known-key attack. In this paper we show that the argument used to prove this is flawed, and we explain how it can be fixed.

Secure identification is an important security issue to avoid computer fraud due to masquerading. This can be achieved with zero-knowledge based smart cards. We present very efficient new zero-knowledge schemes in a general algebraic setting. Particular cases of our scheme improve the performance of the Guillou–Quisquater and the Chaum–Evertse–van de Graaf schemes. Our scheme is formally proven and, overall, is more efficient than currently available schemes including the Fiat–Shamir scheme. As an application we discuss how our scheme can be used for identification, in particular as an electronic passport scheme.