The widespread deployment of IoT-enabled smart metering devices (MDs) in smart grid (SG) infrastructures has introduced serious security and privacy concerns, especially in deregulated energy markets where third-party retail energy suppliers (ESs) operate as semi-trusted entities. Since smart meter communications may disclose sensitive consumer behavior patterns, such as energy usage habits and occupancy information, privacy-preserving key sharing protocols (KSPs) are critically required. However, most existing KSPs assume fully trusted ESs, which is impractical in competitive retail environments. Also, they primarily provide anonymity against external adversaries that still allows internal traceability by retail ESs. To overcome these limitations, this paper proposes an efficient KSP specifically designed for semi-trusted retail ES scenarios. In the proposed protocol, IoT-enabled MDs can establish session key with semitrusted ESs without revealing their real identities, while honest-but-curious ESs can authenticate MDs via zero-knowledge authentication. By employing a novel signature-based construction, the protocol achieves strong conditional unlinkability, ensuring that no entity except the fully trusted registration center can trace or link MD sessions. Moreover, the proposed KSP reduces communication rounds and achieves at least 5% decrease in communication overhead with a comparable computational cost. Formal security analyses and comprehensive performance evaluations indicate the suitability of the proposed protocol for privacy-preserving communications in deregulated energy markets.

Authenticated key exchange (AKE) protocols underpin secure bidirectional communications in smart grid, where real-time flows between neighborhood service providers (NSPs) and resource-constrained smart metering devices (SMDs) demand stringent security and efficiency. Recently, Cheng et al. [1] have proposed an AKE protocol for smart grid intended to be leakage-resilient. Without undermining the noteworthy contributions of their work, this paper demonstrates that their proposed protocol is vulnerable tooffline password-guessingandkey compromise impersonation(KCI) attacks, and does not offerperfect forward secrecy(PFS). To address these limitations, we propose a decentralized ultra- lightweight leakage-resilient AKE protocol between NSPs and SMDs that not only mitigates the security shortcomings of prior top-related works but also imposes minimal overhead on resource-constrained SMDs. The protocol leverages the public Solana blockchain to enhance transparency and enable simple key revocation. Furthermore, it is ultra- lightweight, as the SMD only performs hashing, symmetric encryption/decryption, and physical unclonable function operations. Our security analyses indicate the proposed AKE protocol supportsconditional anonymity,PFS, and resists advanced attacks such as theKCIattack. Performance and feature analyses also demonstrate improvements of24%and98%in communication and computational overheads, while offering distinct features.

Quite recently, the authors of [1] (DOI: 10.1109/TDSC.2025.3605538) have proposed an interesting ultra-lightweight authenticated key exchange protocol between a prover and an edge verifier. They further stated that their protocol is resistant to known session-specific temporary information (KSSTI) attack and offers perfect forward secrecy (PFS). Not to undermine the noteworthy contributions of their work, in this comment paper, we show that their proposed protocol cannot offer PFS nor can resist KSSTI attack.

Vehicle to vehicle (V2V) communications can facilitate traffic congestion control, reduce crashes, and enhance general safety. These goals can be reached only if vehicles communicate securely and anonymously. To this end, numerous key sharing protocols have been devised and proposed in recent years. Nevertheless, delving into the current vehicular protocols demonstrates that they have several drawbacks. First and the foremost, near all of them are improper for multi-domain internet of vehicle (IoV) environments and second, most of them failed to reach a proper tradeoff between security and effectiveness. Besides, the existing multi-domain protocols, which have been suggested for other applications, cannot still meet the desired requirements. To bridge this gap, this paper presents a resource-efficient privacy-preserving key sharing protocol for anonymous V2V communications in the IoV environments. In the proposed protocol, we utilize the blockchain and an inventive dual-signature approach. The former eases cross-domain authentication and the latter reduces the communication rounds. Security and efficiency analyses, respectively, indicate the protocol can withstand attacks and execute quite fast. Additionally, comparisons with top-related protocols show the suitable stage and precedence of the proposed multi-domain protocol.

Providing security and privacy in today's digital era is very crucial. In order to ensure that the sensitive user data can only be accessed by a valid server, the user and server should agree on a common key in advance. To do so, in the last decade, a number of dynamic ID-based authenticated key agreement (DIDAKA) protocols have been proposed, which can guarantee subsequent secure communications of users and servers. Nevertheless, investigating the related works indicates that the existing DIDAKA schemes suffer from one or more security challenges. Quite recently, Xie et al. have presented an interesting anonymous DIDAKA protocol to cover the security weaknesses of previous schemes; nonetheless, we found that their scheme is susceptible to three attacks. Therefore, to remedy the security limitations, in this paper, we propose a security-enhanced anonymous DIDAKA protocol, which not only keeps the merits of Xie et al.'s scheme, but also offers better execution time compared to their proposed one. To demonstrate the security of the proposed scheme, we present both formal security proof and automatic formal verification of security and to show its efficiency, we present an extensive comparative performance analysis. In conclusion, the results are indicative of the priority of the proposed scheme.

Security is an indispensable part of smart grid (SG). Key establishment protocols play a vital role in fulfilling the security requirements in SG. In recent years, many key establishment schemes have been proposed for SG. However, only three of them offer the strong smart meter anonymity. In 2015, Tsai and Lo presented an anonymous key establishment scheme to be employed in SG. Recently, Odelu et al. have demonstrated that Tsai and Lo's scheme suffers from the ephemeral secret leakage attack. Furthermore, another scheme has been proposed recently by He et al. that has improved the efficiency of Tsai and Lo's scheme. However, besides its merits, we indicate that He et al.'s scheme suffers from both known session-specific temporary information attack and private key leakage. Additionally, these three anonymous schemes have the key escrow problem since the trusted anchor is aware of entities' private key. Hence, to cover the existing issues, in this paper we propose a key establishment scheme that not only is free from the security challenges of the previous anonymous schemes and key escrow problem, but also is efficient in terms of both computational and communication costs. Finally, yet importantly, we present the performance analysis of our proposed scheme on a state-of-the-art advanced RISC machine (ARM) chip, namely NXP LPC1788, as a suitable hardware for the smart meters.

Security and privacy concerns necessitate the careful management of shared keys in the vehicle to grid (V2G) networks. To do so, in recent years, several interesting key agreement protocols have been proposed to be employed in the context of V2G networks. As the efficiency is of prime significance in V2G networks, many of these protocols have been designed to be as light as possible. Nevertheless, review of the previous works indicates that the existing lightweight schemes cannot provide the desired security properties. Furthermore, the existing secure protocols are not so proper to be used by computationally limited devices in the V2G networks. Therefore, in this article, by utilizing the efficient Chebyshev chaotic map-based public key cryptosystem, we propose an anonymous key agreement scheme, which can not only provide the expected security requirements, but also has a proper level of performance. To demonstrate the security of the proposed scheme, we present a rigorous formal security proof using the random oracle model. In addition, to show its outperformance, we both compare it with several recently published well-known schemes and perform the experimental study. In general, the results indicate the efficiency of the proposed protocol in comparison to the related ones.

Cloud computing is a widespread technology, which has attracted much attention nowadays. Among the many criteria that must be considered for data storage in the cloud, access control plays a vital role. Role-based access control (RBAC) is a well-known technique for secure data storage in the cloud. Since the traditional RBAC models are improper for open and decentralized environments, recently, some works have integrated the trust concept into the RBAC model. Nevertheless, they have not fully addressed the required security metrics of a trust-based system. Therefore, in this paper, we first introduce the security goals that should be considered in an efficient trust-based system. Second, we propose a novel trust and reputation based RBAC model that not only can properly withstand the security threats of trust-based RBAC models, but also is scalable as it has reasonable execution time. Third, we evaluate the proposed model using the famous trust network of advogato dataset. Eventually, we compare the proposed model with recently-published ones in terms of mean absolute error, execution time of indirect trust computation, and provided features. The achieved results are indicative of the priority of the proposed model to be employed in real cloud environments.

In smart grid, key exchange protocols play a vital role in providing secure channels to read consumption reports from the smart meters. Thus far, several key exchange schemes have been proposed for the networked smart meters. However, for the first time, quite recently, Sha et al. have presented an interesting two-phase authentication and key agreement scheme that exclusively aims at the isolated smart meters. In their scheme, they have properly addressed the computationally constrained smart meters by offering a lightweight key exchange protocol. Nevertheless, after meticulous observation, we found that their proposed scheme cannot resist the desynchronization attack and cannot provide the perfect forward secrecy. Moreover, there are some other weaknesses in their scheme. As a result, to tackle the existing security challenges, in this paper, by utilization of the extended Chebyshev chaotic maps, we propose an efficient anonymous password-authenticated key exchange protocol that not only is free from the limitations of Sha et al.'s scheme, but also provides the anonymity. The security analysis in the random oracle model and using the widely accepted ProVerif tool besides the computational and communication costs comparison demonstrate that the proposed scheme has reached a proper level of efficiency without sacrificing the desired security properties.

Investigating the literature reveals the fact that the key management protocols play a vital role in protecting the security and privacy of medical data in telecare medical information systems. Recently, Tseng et al. have proposed an interesting elliptic curve cryptosystem (ECC) based self-certified key management scheme that can yield secure channel for the communications of secure sensors (cluster members) and access point (cluster head). After careful consideration, we found that their scheme suffers from the cluster head impersonation, replay, and key replicating attacks. In addition, in the secure session phase, there are some errata and a point multiplication that is undefined in the ECC and hence is mathematically incorrect. Finally, yet importantly, their presented scheme has been adopted for a similar application by other authors with the same problem. Therefore, in this paper, we first try to elaborate the existing errata and security threats. Second, we propose a modified version, which is free from the challenges of their scheme. Eventually, we propose a novel anonymous ECC-based self-certified two-factor key management scheme that not only provides the desired security features, but also has much better efficiency than several recently-published schemes, such as the presented one by Tseng et al. Our formal security verification and proof besides the efficiency analysis support our claim.