Authentication is an important security issue for multi-access edge computing (MEC). However, the existing authentication schemes have not achieved a good balance between privacy preserving, efficiency, and low computation overhead on the device side. To address this issue, we propose an efficiency-improved and conditional privacy-preserving authentication scheme suitable for resource-constrained MEC devices. Our core idea is integrating the merkle hash tree (MHT) into the anonymous authentication scheme constructed by the blockchain and key derivation function (KDF) to improve efficiency. The MHT not only reduces the on-chain storage overhead brought by the increasing pseudo-public keys of KDF, but also utilizes few hash functions to achieve lightweight${\bm {k}}$-times authentications with the same edge server. Despite these advantages, managing pseudo-key pairs in the form of MHT leafs still brings efficiency and unlinkability problems. We construct the partially shuffled merkle hash tree to only shuffle leafs within the device group, and combine with the KDF to update MHTs in a public manner by synchronizing pseudo-key pairs. Consequently, the efficiency of key update can be ensured. Moreover, a time-bound key derivation function based on physically unclonable function and BIP-32 is developed to provide immediate and permanent device revocation. Only the remaining valid pseudo-public keys of the revoked device will be recorded on the blockchain, which reveals no linkable information and avoids frequently reconstructing all the MHTs. We prove the authentication security and discuss other security features. A proof-of-concept prototype was implemented to conduct experiments and comparative analysis for performance evaluation.

Authentication is an important security issue for multi-access edge computing (MEC). To restrict user access from untrusted devices, Bring Your Own Device (BYOD) policy has been proposed to authenticate users and devices simultaneously. However, when integrating BYOD policy into MEC authentication to improve security, issues of efficient binding and user-device conditional anonymity have not been well supported. To address these issues, we propose Bring Your Device Group (BYDG) policy by constructing efficient and privacy-preserving user-device authentication. Our core idea is to use key sequences generated by PUFs-based key derivation functions (KDFs) to not only construct efficient binding relationships, but also achieve conditional anonymity for device groups. Specifically, a flexible and secure binding method is first developed by leveraging Chinese Remainder Theorem (CRT) to bind user with device groups. Each device’s CRT modulus is derived from the key sequence to construct many-to-many user-device binding relationships, which are managed in the form of on-chain Pedersen Commitment. Moreover, we design an identity anonymizing and tracing method for device groups. The key sequence is regarded as traceable device pseudo-identities, and then inserted into the cuckoo filter to reduce the on-chain storage overhead and mitigate malicious login attempts with low costs. Based on above two methods, the combination of Pedersen Commitment and Zero-Knowledge Proof of Knowledge is used to achieve user-device authentication with conditional anonymity. The security analysis was presented to demonstrate important security properties. A proof-of-concept prototype was implemented to conduct performance evaluation and comparative analysis.

Multi-hop broadcasts are more difficult in duty-cycled wireless sensor networks where each node stays awake only for a fraction of a time interval and neighborhood nodes are not simultaneously awake to receive data. In this paper, we exploit the problem of multi-hop broadcasts in low duty-cycled wireless sensor networks, and propose a delay aware broadcast forwarding protocol called DCEB. DCEB neither assumes time synchronization for sleep scheduling, which requires all neighboring nodes to wake up at the same time, nor assumes duty-cycled awareness, which makes the protocol difficult to use in low duty-cycled operations. The decision conditions of broadcast forwarding time with or without delay constraint are deduced. Experimental results prove that DCEB cuts the energy consumption of a multi-hop broadcast by reducing broadcast costs under the decision conditions.

Due to the difficulties and importance of multi-hop broadcasts in low duty-cycled wireless sensor networks, we propose a novel Delay-Constrained and Energy-Balanced (DCEB) broadcast protocol. DCEB neither assumes time synchronization for sleep scheduling, which requires all neighboring nodes to wake up at the same time, nor assumes duty-cycled awareness, which makes the protocol difficult to use in low duty-cycled operations. In our DCEB protocol, a distributed algorithm for constructing a broadcast backbone is presented, including its energy-balanced maintenance mechanism. Then, the decision conditions of broadcast forwarding time with or without delay constraint are deduced. Experimental results prove that DCEB reduces much more broadcast cost under the decision conditions and provides better broadcast performance than the Unicast Scheme.