Since the Federal Aviation Administration (FAA) announced the Remote ID rule in 2021, ensuring drone privacy has become critical. Although the rule aims to increase accountability, it raises privacy concerns by exposing flight paths. Previous privacy-preserving protocols for drones rely on trusted third parties (TTPs) for drone authentication, which is unacceptable in critical infrastructure settings where flight data is sensitive and the ground control server (GCS) must authenticate drones in real-time. Furthermore, since existing studies rely on traditional public-key cryptographic algorithms, such as ECC or RSA, they should migrate to post-quantum cryptography (PQC) to ensure security against future quantum threats. However, applying PQC to existing protocols dramatically enlarges signatures and ciphertexts, causing them to exceed the 255-byte payload limit of Bluetooth/Wi-Fi Remote ID broadcasts. To address these challenges, we propose pqRID, the first method that supports both privacy and quantum-safe authentication under Remote ID constraints. pqRID uses pseudonym certificates for identification while preserving privacy and decouples identification from PQC-based authentication to satisfy broadcast size constraints. In pqRID, drones are provisioned with pseudonym certificates and IDs before flight. During flight, they broadcast their pseudonym IDs and use the corresponding certificate to authenticate themselves when prompted by the GCS without involving a TTP. We formally verified pqRID using ProVerif, ensuring authentication and unique ID non-disclosure. We implemented pqRID on a real UAV: a Raspberry Pi 4B mounted on a DJI-F450 drone. Our experimental results show that generating a PQC-based authentication message takes only 9ms and consumes 0.8J of energy on average.

Post-quantum cryptography (PQC) aims to develop quantum-safe algorithms against attacks by a quantum computer. As quantum-safe algorithms require much larger keys in their operation compared to the current RSA/ECC practice, the networking latency significantly increases when executing the protocols with sending such large keys. This problem gets more challenging in the era of Web-of-Things (WoT) with low-memory devices. To tackle the problem, we propose ExpressPQDelivery, which is, to the best of our knowledge, the first immediately deployable protocol to efficiently transport large keys. It leverages the DNS infrastructure, as DNS is close to clients, guaranteeing express key delivery with a short round-trip time (RTT). We split a large PQ key along with a server's signature and feed them into several DNS records. To show the feasibility of ExpressPQDelivery, we instantiate it with TLS 1.3 and demonstrate that it reduces 27% of network latency between a server and a client on average compared to the standard TLS 1.3. We deploy ExpressPQDelivery on a low-capability board with 256 KB RAM, showing a significant high gain (34%).

A social network has an in-born core-fringe structure. To increase the core nodes resolution, the paper proposes a new method, named KSCNR (K-Shell and Salton index based core node recognition) method, that combines both the local network topology features (Salton index with gravitational centrality) and the global network topology features (K-Shell iteration) to identify core nodes. The KSCNR method utilizes the weights to adjust the influences of the local and the global topology features according to the core nodes preferences, which makes the KSCNR method suitable for different social network scenarios. The experimental results show that the KSCNR method outperforms the known methods such as the K-Shell, the BC, the DC and the CC methods in the light of both effectiveness and accuracy.

Smart cities have become a trend with improved efficiency, resilience, and sustainability, providing citizens with high quality of life. With the increasing demand for a more participatory and bottom–up governance approach, citizens play an active role in the process of policy making, revolutionizing the management of smart cities. In the example of urban infrastructure maintenance, the public participation demand is more remarkable as the infrastructure condition is closely related to their daily life. Although blockchain has been widely explored to benefit data collection and processing in smart city governance, public engagement remains a challenge. In this article, we propose a novel public participation consortium blockchain system for infrastructure maintenance that is expected to encourage citizens to actively participate in the decision-making process and enable them to witness all administrative procedures in a real-time manner. To that aim, we introduced a hybrid blockchain architecture to involve a verifier group, which is randomly and dynamically selected from the public citizens, to verify the transaction. In particular, we devised a private-prior peer-prediction-based truthful verification mechanism to tackle the collusion attacks from public verifiers. Then, we specified a Stackelberg-game-based incentive mechanism for encouraging public participation. Finally, we conducted extensive simulations to reveal the properties and performances of our proposed blockchain system, which indicates its superiority over other variations.

Unmanned Vehicles (UVs) have been being utilized for various applications, such as surveillance, search/rescue, and monitoring. The information they transmit is critical for decision-making. However, UVs are vulnerable to white-box attacks due to improvements in reverse engineering techniques and the openness of their software. Therefore, attackers with sufficient knowledge of a target UV can steal secret information stored in the UV by exploiting its vulnerabilities. Recently, several white-box cryptography techniques have been introduced to protect secret keys from being extracted by converting them into large look-up tables. However, none of them provide approaches to securely update the look-up tables. Thus, once a remote attacker succeeds in extracting the static look-up table from a UV, he/she can use it to decrypt past/future communications or to send false information to the control station by impersonating the UV. In this paper, we propose a look-up table shuffling mechanism that supports white-box cryptography with dynamics. The mechanism makes it hard for attackers to determine the positions of the table entries, and thus to decrypt/encrypt ciphertexts/plaintexts. To show the practicality of the block cipher with our mechanism, we implemented it on a board equipped with a GPU and show its GPU-accelerated performance.

To create an environment for IoT devices, securely, it is necessary to establish a cryptographic key for those devices. Conventionally, this key has been stored on the actual device, but this leaves the key vulnerable to physical attacks in the IoT environment. To solve this problem, several research studies have been conducted on how best to conceal the cryptographic key. Recently, these studies have most often focused on generating the key dynamically from noisy data using a fuzzy extractor or providing secure storage using a fuzzy commitment. Thus, far, all of these studies use only one type of noisy source data, such as biometric data or physical unclonable function (PUF). However, since most IoT devices are operated in unmanned environments, where biometric data is unavailable, the method using biometric data cannot be utilized for unmanned IoT devices. Although the method using PUF is applied to these unmanned devices, these are still vulnerable against physical attacks including unintended move or theft. In this paper, we present a novel way to use the fuzzy commitment on such devices, called two-factor fuzzy commitment scheme. The proposed method utilizes two noisy factors from the inside and outside of the IoT device. Therefore, although an attacker acquiring the IoT device can access the internal noisy source, the attacker cannot extract the right key from that information only. We also give a prototype implementation for ensuring the feasibility of our two-factor fuzzy commitment concept by utilizing the image data and PUF data for two noisy factors.

In many envisioned drone-based applications, drones will communicate with many different smart objects, such as sensors and embedded devices. Securing such communications requires an effective and efficient encryption key establishment protocol. However, the design of such a protocol must take into account constrained resources of smart objects and the mobility of drones. In this paper, a secure communication protocol between drones and smart objects is presented. To support the required security functions, such as authenticated key agreement, non-repudiation, and user revocation, we propose an efficient Certificateless Signcryption Tag Key Encapsulation Mechanism (eCLSC-TKEM). eCLSC-TKEM reduces the time required to establish a shared key between a drone and a smart object by minimizing the computational overhead at the smart object. Also, our protocol improves drone's efficiency by utilizing dual channels which allows many smart objects to concurrently execute eCLSC-TKEM. We evaluate our protocol on commercially available devices, namely AR.Drone2.0 and TelosB, by using a parking management testbed. Our experimental results show that our protocol is much more efficient than other protocols.

Recently, wireless sensor networks (WSNs) have been deployed for a wide variety of applications, including military sensing and tracking, patient status monitoring, traffic flow monitoring, where sensory devices often move between different locations. Securing data and communications requires suitable encryption key protocols. In this paper, we propose a certificateless-effective key management (CL-EKM) protocol for secure communication in dynamic WSNs characterized by node mobility. The CL-EKM supports efficient key updates when a node leaves or joins a cluster and ensures forward and backward key secrecy. The protocol also supports efficient key revocation for compromised nodes and minimizes the impact of a node compromise on the security of other communication links. A security analysis of our scheme shows that our protocol is effective in defending against various attacks. We implement CL-EKM in Contiki OS and simulate it using Cooja simulator to assess its time, energy, communication, and memory performance.

CertificateLess Hybrid SignCryption (CL-HSC) scheme is useful for efficiently encapsulating symmetric keys for secure communications. It solves the key escrow problem and the certificate management problem. However, the existing scheme is not suitable for Advanced Metering Infrastructure (AMI) networks because of the utilization of expensive pairing operations. As smart meter devices have limited computing power, we need efficient algorithms for AMI networks. In this poster, we propose a novel CL-HSC scheme without pairing operations. In order to evaluate its performance, we implemented our CL-HSC scheme and conventional hybrid encryption approaches. The experimental results show that our CL-HSC scheme is efficient and suitable for secure communications in AMI networks.

We propose a mediated certificateless encryption scheme without pairing operations for securely sharing sensitive information in public clouds. Mediated certificateless public key encryption (mCL-PKE) solves the key escrow problem in identity based encryption and certificate revocation problem in public key cryptography. However, existing mCL-PKE schemes are either inefficient because of the use of expensive pairing operations or vulnerable against partial decryption attacks. In order to address the performance and security issues, in this paper, we first propose a mCL-PKE scheme without using pairing operations. We apply our mCL-PKE scheme to construct a practical solution to the problem of sharing sensitive information in public clouds. The cloud is employed as a secure storage as well as a key generation center. In our system, the data owner encrypts the sensitive data using the cloud generated users’ public keys based on its access control policies and uploads the encrypted data to the cloud. Upon successful authorization, the cloud partially decrypts the encrypted data for the users. The users subsequently fully decrypt the partially decrypted data using their private keys. The confidentiality of the content and the keys is preserved with respect to the cloud, because the cloud cannot fully decrypt the information. We also propose an extension to the above approach to improve the efficiency of encryption at the data owner. We implement our mCL-PKE scheme and the overall cloud based system, and evaluate its security and performance. Our results show that our schemes are efficient and practical.

We propose a mediated certificateless encryption scheme without pairing operations. Mediated certificateless public key encryption (mCL-PKE) solves the key escrow problem in identity based encryption and certificate revocation problem in public key cryptography. However, existing mCL-PKE schemes are either inefficient because of the use of expensive pairing operations or vulnerable against partial decryption attacks. In order to address the performance and security issues, in this poster, we propose a novel mCL-PKE scheme. We implement our mCL-PKE scheme and a recent scheme, and evaluate the security and performance. Our results show that our algorithms are efficient and practical.