The rapid evolution of Vehicular Ad Hoc Networks (VANETs) demands authentication mechanisms that are not only secure, but also agile enough to handle the diverse, high-mobility interactions of intelligent transportation systems. This paper introduces a novel lightweight and scalable authentication protocol that unifies security across all major VANET communication modes Vehicle-to-EdgeRSU,Vehicle-to-Vehicle, EdgeRSU-to-EdgeRSU, EdgeRSU-to-IoV Controller, IoV Controller-to-Distributed Server and User-to-Distributed Server. Our approach integrates elliptic-curve cryptography, hash-based commitments, and ephemeral key exchange to provide strong mutual authentication and end-to-end confidentiality, all while maintaining a minimal computational overhead. Extensive formal and informal security assessments, coupled with performance benchmarking, demonstrate the protocol's strong resistance to prevalent threats and its efficiency for deployment in dynamic, real-time vehicular environments.

Vehicle-to-vehicle (V2V) authentication is essential in the Vehicular Ad-hoc Network (VANET). V2V communication improves the safety of drivers and assists them in making the appropriate decision according to road conditions. Since V2V communication happens in open public channels, an adversary takes advantage of it and tries to launch several potential threats. This article designs a blockchain-assisted V2V communication and authentication scheme using Elliptic Curve Cryptography (ECC) and a Physically Unclonable Function (PUF) called DBKE. In DBKE, vehicles perform their registration with their nearest Roadside Unit (RSU) without assisting the centralized cloud server. Then, one vehicle can communicate with another using the information stored in the blockchain. During the communication, both vehicles first perform the process of mutual authentication and then securely generate the session keys without sending the private parameters to the public channels. The formal analysis of DBKE is done with the Scyther and Real-or-Random (ROR) models, which confirm that the DBKE is robust and safe from attacks. Furthermore, the detailed comparative study of the security features reveals that the DBKE scheme provides superior security and low computation cost compared to the existing V2V authentication protocols.

With the rapid development of the Internet of Things (IoT), modern Maritime Transportation Systems (MTS) have played a crucial role in the transport industry. The various potential privacy and security concerns (such as vessels’ location tracking, message tampering, unauthorized access to data, etc.) have increased substantially in IoT-enabled MTS. Considering the above issues, we propose a secure, robust, and efficient authentication scheme for MTS based on Elliptic-Curve Cryptography (ECC) and Hash-based Message Authentication Code (HMAC) called PSAS-MTS. The proposed PSAS-MTS scheme not only monitors the vessel’s condition but also ensures protection against collisions in route management and provides safety to the vessel’s passengers. The scheme uses simple XOR, a cryptographic one-way hash, an ECC cryptosystem, and HMAC to achieve a high level of security in MTS. The formal security analysis is carried out using a well-known Real-Or-Random (ROR) model, which ensures the security harness features. A rigorous informal security analysis is also done, which ensures various privacy and security features such as mutual authentication, anonymity, forward and backward secrecy, etc. The proposed PSAS-MTS scheme resists various possible well-known active and passive security attacks. The performance analysis shows that the proposed PSAS-MTS scheme is more efficient in terms of computation and communication overheads when compared to other competitive schemes.

In the dynamic realm of encrypted communications, traffic analysis and its classification are crucial for efficient resource utilization and network management. The prevalence of encryption technologies , The Onion Router (Tor) a globally recognized privacy-preserving network, poses a challenge for the task at hand by introducing complexity through its innovative onion routing mechanism. To overcome Tor’s limitations not only in terms of achieving better accuracy but also in performing classification in time-constrained scenarios, we propose a classification approach for Tor and non-Tor traffic classification , utilizing multiple models to enhance categorization and application identification. Leveraging the University of New Brunswick (UNB) Tor and non-Tor dataset, initially in a packet capture format, the preprocessing is done by transforming through CICFlowmeter. To expedite classification, we applied feature selection techniques like Principal Component Analysis (PCA) and t-Distributed Stochastic Neighbor Embedding (tSNE). Machine learning algorithms like support vector machine (SVM), Gradient Boosting , Random Forest , and Artificial Neural Network (ANN) are applied. Our approach achieves a remarkable recall score ratio of 1.00, demonstrating high accuracy in Tor traffic identification. Notably, efficient feature selection has significantly reduced classification time. This work also contributes to effective Tor and non-Tor network traffic analysis , offering an efficient model for enhanced security and management.

The intelligent vehicles collect and distribute the data to other vehicles and Roadside Units (RSU), which ultimately strengthens the vehicular services in the Vehicular Ad-hoc Network (VANET). In order to protect against a variety of potential security threats, the VANET system needs a proper authentication mechanism, which requires more computational overheads and cannot perform better, when a cluster of vehicles sends the messages simultaneously. This paper aims to design a decentralized blockchain-based batch authentication protocol using Elliptic Curve Cryptography, where RSU authenticates the group of vehicles together. Moreover. our protocol also supports the verification of both individual messages (signature) generated by the vehicle and batch signature. We have used the Scyther security tool to verify our protocol and found that the protocol is safe and secure. A detailed comparative analysis reveals that the proposed scheme achieves more functionality and security compared to relevant schemes. The security analysis confirms that the proposed scheme is secure against all applicable attacks. Moreover, the ethereum platform simulates the proposed scheme, showing its effectiveness and confirming that it is feasible to deploy and execute transactions in real networks.

The real challenge in Wireless Body Area Network (WBAN) lies in ensuring the security of health-related sensitive data and diagnostic information, preventing unauthorized access by malicious users. Given that information exchange takes place between the WBAN client and the Application Provider (AP), there is a critical need for thorough attention to mutual authentication and secure key generation. Many of the available research works lack the addressing of essential security features such as strong anonymity, key confidentiality, and key-escrow resilience. The primary focus of this research work is to develop a certificateless anonymous mutual authentication scheme that will be computationally efficient and memory-optimized, while maintaining uncompromising security features. Our scheme excels over other schemes due to its utilization of a hybrid approach, which integrates cryptographic operations related to the Discrete Logarithm Problem (DLP), Elliptic Curve Discrete Logarithm Problem (ECDLP), and bi-linear pairings. This approach maintains strong security features and also enhances the performance of the system. The proposed scheme improves computational cost, storage cost, and communication cost by at least 15%, 41%, and 10%, respectively, compared to the best available schemes. We have also verified our protocol using formal and informal approaches. Formal logic analysis and simulation of our scheme ensure its potential to significantly enhance user privacy and strengthen mutual authentication in Smart healthcare systems.

Many applications that are developed for the Intelligent Transport System to ensure safety, efficiency and comfort, depend on communication among mobile vehicular nodes, road side units, fog servers, and trusted authority. Insecure wireless communication used for these applications is vulnerable to many attacks and it can endanger lives, create traffic congestion, and compromise privacy of the users. A robust authentication and key establishment mechanism can prevent security attacks, and also provide additional security features. In this paper, a novel, smart card-based, robust mutual authentication protocol namely VAuth for VANET is proposed. This scheme enables secure communication among entities while also preserving the anonymity and privacy of the users. To preserve unlinkability, VAuth uses pseudo-names, one-time secrets, and verification tokens. Correctness and security goals of the proposed protocol are proved using the formal method BAN logic and the automated tool Scyther respectively. A comparison of the scheme considering communication cost, computation cost, security functionalities, and storage cost is presented. As a proof of concept, our proposed protocol is demonstrated on FPGA boards which offer hardware acceleration capabilities that can handle high mobility of vehicles involved in VANET.

Smart grids, steering an energy revolution through smart metering infrastructure, face cybersecurity threats and unauthorized access risks. Within these systems, classical authentication protocols validate identities, fostering trust and enabling access to authorized resources, while preventing unauthorized access. However, classical authentication protocols are predominantly dependent on public-key cryptography, rooted in computational hard problems such as integer factorization and discrete logs to uphold security. Nevertheless, these computational hard problems can be easily compromised by quantum adversaries. Furthermore, quantum-resistant smart meter authentication protocols are either deemed impractical or reliant on quantum hard problems, potentially lacking future-proof security. Moreover, maintaining SG entity privacy holds equal significance. Consequently, this article introduces the Quantum-Secure Privacy-Preserving Smart Meter Authentication (Q-Secure-P2-SMA) protocol. It utilizes semi-quantum key distribution and a hash function to facilitate quantum-resistant metering data communication, with a focus on privacy and practicality. The security analysis and performance evaluation conducted for Q-Secure-P2-SMA confirm its resilience against well-known security threats, showcasing improved efficiency compared to existing state-of-art-protocols across computation, communication, and energy overhead. Notably, the Q-Secure-P2-SMA doesn’t necessitate quantum capability among all SG entities, making it more practical and relevant in real-world scenarios.

Port knocking provides an added layer of security on top of the existing security systems of a network. A predefined port knocking sequence is used to open the ports, which are closed by the firewall by default. The server determines the valid request if the knocking sequence is correct and opens the desired port. However, this sequence poses a security threat due to its static nature. This paper presents the port knock sequence-based communication protocol in the Software Defined network (SDN). It provides better management by separating the control plane and data plane. At the same time, it causes a communication overhead between the switches and the controller. To avoid this overhead, we are using the port knocking concept in the data plane without any involvement of the SDN controller. This study proposes three port knock sequence-based protocols (static, partial dynamic, and dynamic) in the data plane. To test the protocol in SDN environment, the P4 implementation of the underlying model is done in the BMV2 (behavioral model version 2) virtual switch. To check the security of the protocols, an informal security analysis is performed, which shows that the proposed protocols are secured to be implemented in the SDN data plane.

Physically unclonable function (PUF) is a physical unit fabricated inside a sensor and generally considered as an assurance anchor of resource inhibited device. Essentially, the function is based on the cryptographic approach, where a key is created and utilized such that it cannot be cloned. More specifically, it is an arbitrary function, which maps inherent properties of the hardware devices to a unique bit stream of information. Authentication and key agreement (AKA) protocols are widely used in electronic commerce, electronic stock trading, and many secured business transaction platforms, because they allow the communicating devices to mutually authenticate each other while exchanging authenticated session key (or secret key) that can be used subsequently to establish a secured communication channel. Yet, these protocols are also vulnerable to a broad range of security outbreaks. In light of these notions and practical applications, this article is intended to: 1) provide an overview of AKA protocols, PUF plus the combined PUF-based AKA; 2) systematically and taxonomically examine and discuss with pros and cons of AKA applications to the fast growing areas of Internet of Things, wireless sensor networks, and smart grids based on a meticulous survey of the existing literature; 3) summarize the challenges to deployment and potential security risks of the underlying technologies and possible remedies or mitigation strategies; and 4) to conduct and report a comparative performance and security analysis with respect to the three focused areas.

With the evolution of Internet Technology, payment methods have undergone drastic changes from entity exchange to Internet banking. Almost every sector has gone through the transformation from conventional technologies to digital technologies. With the arrival of online payment and digital wallet system, making payments has become easier than ever and with the increasing demand for such services, the number of users using instant money transfer systems are growing rapidly. However, the existing online payment system has issues like a single point of failure, transparency, and insider problem. Also, security in such online payments is crucial to mitigate risks and financial inefficiencies. In this paper, a private and permissioned Blockchain-based Payment System for the financial sector in India is proposed. The proposed architecture is based on Istanbul Byzantine Fault Tolerance (IBFT) consensus and it also discusses the integration of banks with the system.

Industry 4.0 connects the latest technologies such as cloud computing, Internet of things (IoT), machine learning and artificial intelligence (ML/AI), and blockchain to provide more automation in the industrial process and also bridges the gap between the physical and digital worlds through the cyber-physical system. The inherent feature of IoT devices creates the industry to smart industry (referred to as industrial IoT, i.e., IIoT) through its data-driven decision policies. However, several challenges such as decentralization, security and privacy vulnerability, single point of failure (SPOF), and trust issues exist in the IoT system. Blockchain is one of the promising technologies that can bring about opportunities for addressing the challenges of IoT systems. In this article, we have investigated the integration of IoT with blockchain technology and provided an in-depth study of the blockchain-enabled IoT and IIoT systems. The state-of-the-art research is categorized into data storage and management technique, big data and cloud computing technique (finance and data auditing), and industrial sectors (supply chain, energy, and healthcare sector). The insightful discussion based on the different categories is also presented in the paper. In particular, first, we introduce the IoT and IIoT and then discuss the need for smart contracts in IoT and IIoT systems. Next, we concentrate on the convergence of blockchain and IoT with state-of-the-art research. In addition, this article also provides the open and future research directions towards this era with the highlighted observations.

Secure and efficient file storage and sharing via authenticated physical devices remain challenging to achieve in a cyber-physical cloud environment, particularly due to the diversity of devices used to access the services and data. Thus in this paper, we present a lightweight identity-based authenticated data sharing protocol to provide secure data sharing among geographically dispersed physical devices and clients. The proposed protocol is demonstrated to resist chosen-ciphertext attack (CCA) under the hardness assumption of decisional-Strong Diffie-Hellman (SDH) problem. We also evaluate the performance of the proposed protocol with existing data sharing protocols in terms of computational overhead, communication overhead, and response time.

Cloud Computing offers storage resources as well as network and computing resources to the organizations. This eliminates the high infrastructure cost for the organizations that are using these services as they can now dynamically pay for these services, i.e., pay per use model, which is followed by most of the cloud providers. As the organization does not locally host these resources, these are comparatively far easier to manage and use than the traditional infrastructural resources. As a result of these factors, the popularity of cloud computing is increasing continuously. But this transfer of data and applications to the cloud server also creates some challenges. It poses problems that must be dealt with properly to ensure a secure cloud computing environment. As more and more sensitive data is being uploaded on the cloud in the present scenario, the privacy and security concerns associated with the data is continuously increasing. To address this, issue the data is stored on the cloud in the encrypted form. Also, as the amount of data stored is usually tremendous, so an efficient search scheme is also necessary. So here, we deal with two significant aspects of cloud computing: Encryption and Searching. We are proposing a secure and efficient encryption scheme to encrypt the data stored in the cloud as well as the queries along with a multi-keyword search scheme to search over the encrypted cloud data.

Electronic health systems, such as telecare medical information system (TMIS), allow patients to exchange their health information with a medical center/doctor for diagnosis in real time, and across borders. Given the sensitive nature of health information/medical data, ensuring the security of such systems is crucial. In this paper, we revisit Das et al.'s authentication protocol, which is designed to ensure patient anonymity and untraceability. Then, we demonstrate that the security claims are invalid, by showing how both security features (i.e., patient anonymity and untraceability) can be compromised. We also demonstrate that the protocol suffers from smartcard launch attacks. To mitigate such design flaws, we propose a new lightweight authentication protocol using the cryptographic hash function for TMIS. We then analyze the security of the proposed protocol using AVISPA and Scyther, two widely used formal specification tools. The performance analysis demonstrates that our protocol is more efficient than other competing protocols.

The session initiation protocol (SIP) is an IP-based telephony authentication mechanism for multimedia big data communications over the Internet. It is used to set up, and control voice and video calls, as well as for instant messaging. One of the concerns of this kind of open-text-based protocol is the security for user authentication. The HTTP digest-based challenge-response authentication process is used in the original SIP. However, this kind of authentication procedure is insecure and a pre-existing user configuration on the remote server is required. According to the literature, several authentication mechanisms for SIP are already devised, but none of these SIPs are robust against existing security attacks. Therefore, we design a three-factor SIP (TF-SIP) for multimedia big data communications, which is robust and flexible against existing known security issues. We show that our TF-SIP is provably secure in the random oracle model. We formally verify the mutual authentication and the freshness of the agreed session key between the user and the remote server using the BAN logic analysis. We found that the communication and computation costs are low, but the storage cost is slightly higher for our TF-SIP in comparison with other SIPs.

The concept of two-factor multiserver authentication protocol was developed to avoid multiple number of registrations using multiple smart-cards and passwords. Recently, a variety of two-factor multiserver authentication protocols have been developed. It is observed that the existing RSA-based multiserver authentication protocols are not suitable in terms of computation complexities and security attacks. To provide lower complexities and security resilience against known attacks, this article proposes a two-factor (password and smart-card) user authentication protocol with the RSA cryptosystem for multiserver environments. The comprehensive security discussion proved that the known security attacks are eliminated in our protocol. Besides, our protocol supports session key agreement and mutual authentication between the application server and the user. We analyze the proof of correctness of the mutual authentication and freshness of session key using the BAN logic model. The experimental outcomes obtained through simulation of the Automated Validation of Internet Security Protocols and Applications (AVISPA) S/W show that our protocol is secured. We consider the computation, communication, and storage costs and the comparative explanations show that our protocol is flexible and efficient compared with protocols. In addition, our protocol offers security resilience against known attacks and provides lower computation complexities than existing protocols. Additionally, the protocol offers password change facility to the authorized user.

Abstract Now‐a‐days, the low‐power handheld mobile devices make our life more comfortable. With the fast advancement of mobile communication technologies and Internet, mobile users are accessing remote services at home over the Internet. Recently, Tsai and Lo put forwarded a user authentication scheme for distributing mobile cloud environments. Unfortunately, we observed that Tsai and Lo's scheme suffers from user impersonation attack and known session‐specific temporary information attack. Besides, the scheme does not support the wrong password and fingerprint detection in the authentication phase. The scheme also violates the user anonymity property. Moreover, the password update functionality is absent in Tsai and Lo's scheme. In order to provide more securities and functionalities, this article put forwarded an enhanced scheme for distributing mobile cloud environments. The simulation on automated validation of Internet security protocols and applications tool ensures that our scheme is secure against the active and passive attacks. Our cryptanalysis gives surety that the scheme can defend related security attacks. We also compare our scheme with the previous schemes with respect to computation cost and security aspects. Copyright © 2016 John Wiley & Sons, Ltd.

Abstract At the present time, application of online communication systems are rapidly increasing and most of the clients depend on a set of servers to fulfill their daily needs. In order to access these servers, a client (user) needs to register to each server with different login credentials. To circumvent this situation, the concept of multi‐server authentication has been adopted, where a user can access all the servers using a single login credential. In this paper, a two‐factor multi‐server authentication protocol, which is proposed by Leu and Hsieh, is analyzed and observed that the forgery attack and the off‐line password‐guessing attack can be made on it. Further, the off‐line password‐guessing attack and other security threats are found in similar kind of multi‐server authentication protocol, which is designed by Li et al. This paper mainly focuses on enhancing the securities of the previously mentioned protocols and thus proposed a new protocol. We have employed formal and informal security analysis to analyze the proposed protocol. The performance of our protocol is also compared with the related protocols. It can also be noted that the designed protocol accomplishes mutual authentication, session key verification, and identity and password change phases. Copyright © 2016 John Wiley & Sons, Ltd.

Abstract Client‐server‐based communications provide a facility by which users can get several services from home via the Internet. As the Internet is an insecure channel, it is needed to protect information of communicators. An authentication scheme can fulfill the aforementioned requirements. Recently, Huang et al. presented an elliptic curve cryptosystem‐based password authentication scheme. This work has demonstrated that the scheme of Huang et al. has security weakness against the forgery attack. In addition, this paper also presented that the scheme of Huang et al. has some design drawbacks. Therefore, this paper has focused on excluding the security vulnerabilities of the scheme of Huang et al. by proposing an elliptic curve cryptosystem‐based password authentication scheme using smart card. The security of our scheme is based on the hardness assumption of the one‐way hash functions and elliptic curve discrete logarithm problem. Furthermore, we have demonstrated that our scheme is secured against known attacks. The performance of our scheme is also nearly equal when compared to related competing schemes. Copyright © 2016 John Wiley & Sons, Ltd.