The ever-increasing world population and the number of vehicles in use have made it more difficult for drivers to find suitable parking lots in large cities. When public parking is insufficient, private parking space sharing could be a solution to alleviate the problem. In the context of private parking reservation, parking owners and drivers share their parking offers and inquiries that consist of private information, such as identity, parking spot, and desired location. Hence, cyber attacks and data leaks can reveal sensitive information about citizens. Therefore, it could be a major barrier to utilize private parking spots. To address this issue, we propose an efficient, secure, and privacy-preserving smart parking system. We use robust security methods, such as proxy re-encryption and certificateless public-key cryptography, to achieve security. We also employ cutting-edge privacy-enhancing technologies, such as (partially) blind signature and symmetric private information retrieval (SPIR), to preserve citizens’ privacy. Moreover, Shamir’s threshold secret sharing is used to provide conditional privacy. Comprehensive security and privacy analysis using the Random Oracle model and the Scyther tool demonstrates that our design is robust against relevant attacks and effectively protects citizens’ privacy. Ultimately, our performance analysis indicates that the proposed scheme is efficient, lightweight, and feasible. In particular, it achieves an average reduction of approximately 73% in communication overhead.

Drones (also referred to as unmanned aerial vehicles) have attracted significant attention within smart city ecosystems due to their ability to detect crises promptly and provide real-time support for disaster management. However, the increasing risks of cyber and physical attacks, along with potential private data leaks, present substantial challenges to their deployment in smart city environments. In this paper, we propose a secure communication protocol that leverages a novel group authentication scheme (GAS), tailored for disaster management scenarios in smart cities. The proposed scheme enables both group key agreement among drones and individual session key establishment between each drone and the control center (CC). Hence, our protocol preserves data confidentiality, message integrity, and data privacy, and verifies the authenticity of communicating parties. We employ physically unclonable functions (PUFs) and reverse fuzzy extractors to withstand critical threats, including machine learning (ML)-based modeling attacks and physical attacks. Our protocol also uses lightweight cryptographic primitives, such as hash-based message authentication codes (HMAC) and exclusive-OR (XOR) operations to ensure efficiency. Comprehensive security analysis using the formal proof and the Scyther tool demonstrates that our scheme resists corresponding attacks and protects data privacy. Ultimately, performance analysis results confirm that the proposed protocol is efficient and feasible.

The ever-increasing global population has caused rapid urbanization in recent decades. Many cities around the world are trying to leverage information and communication technologies to resolve the resulting problems, such as traffic congestion and high energy consumption. This trend is part of the movement towards the development of the so-called smart cities that provide efficient, comfortable, and happy lives to their residents. In this respect, smart cities are indeed promising but have significant underlying complexity due to the number of variety of domains involved, including living, economy, mobility, governance, etc. However, in recent years, numerous cyber attacks and privacy leaks have been major obstacles to the widespread adoption and deployment of smart city applications. In general, smart city domains can be classified into user-centric applications and non-user-centric applications, such as critical infrastructures. This paper examines the key security and privacy challenges associated with recently trending user-centric smart city applications. First, we study the leading technologies along with superior security methods and privacy-enhancing technologies in smart cities. We also provide a critical survey of the security and privacy of novel user-centric smart city applications, namely smart parking, smart charging, and smart home. Our survey provides a detailed review of recent, relevant, and state-of-the-art research works to assist readers in gaining a comprehensive understanding of security and privacy challenges associated with smart cities. Finally, it outlines some research directions worth investigating in the future. The ultimate goal of this survey is to shed light on the pressing security and privacy challenges in smart cities and to provide insights for the development of secure and privacy-preserving smart cities.

Security and privacy are two main concerns in the critical applications in the Internet of Things environments. Long Range Wide Area Network (LoRaWAN) is a protocol, which effectively allows long-range communication for battery-constrained end devices in IoT environments, and it is accepted and used by individuals and industry. In order to facilitate the use of this technology and gain the trust of users, it is necessary to assure security and privacy for the information collected by end devices. The user authentication and key establishment protocols are very paramount in this regard. Although there are some authentication schemes in the literature, they could not be applied in the LoRaWAN networks. Thus, in this article, we introduce a new secure user authenticated key establishment scheme for LoRaWAN networks. The proposed scheme provides mutual authentication among participants, and it allows a user and an end device to establish a secure session key between themselves without trusting the network server unconditionally and completely. In order to prove that the proposed scheme is secure, we constructed formal proof employing the real-or-random model. Besides, we employed Proverif and automated validation of internet security protocols and applications tool to confirm that it satisfies authentication and security characteristics. Further, we show that our proposal is efficient with respect to computation, communication and storage costs in end devices. Eventually, we exhibit a practical demonstration of our proposal applying the NS2 simulator.