Recently, the explosive development of unmanned aerial vehicles (UAVs) promotes its wide application in various services such as package delivery, traffic monitoring. However, due to the high-speed movement, current UAVs usually adopts the unsecure channel without the complicated authentication mechanism to ensure real-time communication. In this paper, we introduce a certificateless authentication scheme with fuzzy batch verification (CLFBV) to achieve once-for-all verification of parallel messages and ensure the real-time secure communication of UAVs. CLBFV defines the error tolerance property for authenticated communication, which allows a tolerance threshold for the messages that are unable to pass authentication. In addition, our proposed scheme is proved to be secure and existentially unforgeable under the chosen message attack and fuzzy identity attack in the random oracle model. The efficiency analysis shows that CLBFV is more efficient and feasible than other existing batch verification schemes.

Internet purification is a necessary technique to defend against Distributed Denial-of-Service (DDoS) attack. It can help Internet Service Provider (ISP) to completely and precisely scrub attack traffic through establishing the sender-receiver pair based filtering rules in networks. However, when faced with the Link Flooding Attacks (LFA), a new kind of DDoS, existing relevant schemes suffer the drawbacks, including the weak willingness of defense cooperation between Autonomous Systems (ASes), lower filtering efficiency and poor robustness. For this, we propose STOP, a service-oriented Internet purification technique designed to defend against LFA. In STOP, malicious traffic filtering is viewed as a value-added service and each filter contributor (i.e., AS) can get some benefit from it. This helps ASes to strengthen the willing of defense cooperation. Moreover, we devise a filter recommendation algorithm to maximize the filtering efficiency, with minimum service cost and bandwidth damages. Furthermore, in the face of the strategic threats that aim to paralyze or bypass STOP, we devise relevant defense techniques to make it more robust. Through rigorous mathematical analysis and extensive experiments based on real-world topology, we demonstrate that compared with prior work, STOP increases the filtering efficiency by 12%.

Abstract With the rapid development of the IoT, smart home plays an increasingly important role in daily life. At the same time, privacy issues have gradually aroused the concern of researchers. Past research proves that there are privacy risks when people use smart home devices and some protection methods are proposed to protect people's privacy. However, attackers can still infer people's behaviour and activities through analysing the wireless traffic of smart home devices. Herein, an attack method under complicated WiFi scenarios is demonstrated, including different locations, different buildings and different networks. In addition, a new protection method, Air‐Padding, is developed, which can change the traffic patterns of smart home devices through injecting constructed packets into the link between devices and routers. The results prove that Air‐Padding can prevent people's behaviour and activities from being analysed and inferred.

With the rapid development of Internet of Vehicles (IoV), vehicle-based spatial crowdsourcing (SC) applications have been proposed and widely applied to various fields. However, location privacy leakage is a serious issue in spatial crowdsourcing because workers who participate in a crowdsourcing task are required to upload their driving locations. In this paper, we propose a decentralized location privacy-preserving SC for IoV, which allows vehicle users to securely participate in SC with ensuring the task's location policy privacy and providing multi-level privacy preservation for workers' locations. Specifically, we introduce blockchain technology into SC, which can eliminate the control of vehicle user data by SC-server. We combine the additively homomorphic encryption and circle-based location verification to ensure the confidentiality of task's location policy. To achieve multi-level privacy preservation for workers' driving locations, we only reveal a grid where workers are located in. The size of the grid represents the level of privacy preservation. We leverage the order-preserving encryption and non-interactive zero-knowledge proof to prevent workers from illegally obtaining rewards by forging their driving locations. The security analysis results show that our framework can satisfy the above requirements. In addition, the experiment results demonstrate that our framework is efficient and feasible in practice.

The authors analyse the security threats caused by personal wireless local area network (WLAN) sharing, propose schemes under two different conditions, and evaluate the performance of their schemes. WLAN is a widely used low‐cost wireless networking technology. Most personal WLANs use the Wi‐Fi‐protected access II (WPA2)‐personal to ensure robust security. Exposing the passphrase of WLAN is the only way to share it. Passphrase exposure can cause three threats, i.e. eavesdropping, evil twin attack, and resource abuse. This study addresses these threats by proposing two schemes under different device upgrade difficulties. For devices that are difficult to upgrade, their scheme only upgrades wireless routers. All WPA2‐personal certified user devices can address these threats without any changes. For easy‐upgrade and new devices, their scheme uses the attribute‐based key exchange to address threats and provide ease of use, anonymity, and fine‐grained access control. To solve the problem practically, they propose a mutual authentication method based on trust‐on‐first‐use and a convenient attribute assignment method based on the existence of social information. The attribute authority already has numerous social information to provide services and cannot obtain more private information from participants in their scheme. The analysis shows that these proposed schemes are secure and practical.

Vehicular networks have become a visible reality enabling information sharing between vehicles to enhance driving safety and provide value-added services to drivers and passengers. However, false information might be injected into the network because of defective sensors, malicious vehicles, and so on. Therefore, an efficient mechanism to guarantee the reliability of information used by vehicles is of great importance in vehicular networks. To solve this problem, this article proposes a context-awareness trust management model to evaluate the trustworthiness of messages received by vehicles to ensure bogus information will not influence the driving decision-making process. In the proposed scheme, the trust evaluation result of an evaluation request is determined by available related information and the evaluation strategy in the current situation, which is unaffected by the presence of conflicting evidence and the trust level of entities in the network. Moreover, we design a reinforcement learning model that allows vehicles to adjust the evaluation strategy so as to maintain an accurate evaluation result in different driving scenarios. Extensive experiments were conducted in different driving scenarios to verify the effectiveness of the proposed model. The results show that our model is adaptive to different driving scenarios with negligible time overhead, regardless of the proportion of malicious nodes in the network. Furthermore, compared with three types of state-of-the-art trust models in different scenarios, our scheme can achieve a higher evaluation precision rate with no more computational and communication overhead in nonrandom road conditions.

Searchable encryption (SE) has been a promising technology which allows users to perform search queries over encrypted data. However, the most of existing SE schemes cannot deal with the shared records that have hierarchical structures. In this paper, we devise a basic cryptographic primitive called as attribute-based keyword search over hierarchical data (ABKS-HD) scheme by using the ciphertext-policy attribute-based encryption (CP-ABE) technique, but this basic scheme cannot satisfy all the desirable requirements of cloud systems. The facts that the single keyword search will yield many irrelevant search results and the revoked users can access the unauthorized data with the old or outdated secret keys make this basic scheme not scale well in practice. To this end, we also propose two improved schemes (ABKS-HD-I, ABKS-HD-II) for the sake of supporting multi-keyword search and user revocation, respectively. In contrast with the state-of-the-art attribute-based keyword search (ABKS) schemes, the computation overhead of our schemes almost linearly increases with the number of users' attributes rather than the number of attributes in systems. Formal security analysis proves that our schemes are secure against both chosen-plaintext attack (CPA) and chosen-keyword attack (CKA) in the random oracle model. Furthermore, empirical study using a real-world dataset shows that our schemes are feasible and efficient in practical applications.

With the rapid development of industrial Internet of things (IIOT), a variety of cloud services have been deployed to store and process the big data of IIOT. The traditional password only authentication is unable to meet the needs of security situation in IIOT. Therefore, a lot of mobile phone assisted password authentication schemes have been proposed. However, in existing schemes, the secret information is required to be stored in the user’s mobile phone. Once the phone is lost, the secret information may be obtained by the opponent, which will bring irreparable loss to the user. To address the above problems, we propose a fingerprint protected password authentication scheme which has no need to store the secret parameter in the mobile phone. When a user logs in, he uses his mobile phone to generate the private key which is used to decrypt the encrypted text generated during the registration phase. The process of generating the private key needs to enter the password and the fingerprint. When the computer interacts with the mobile phone, the user’s password will be blinded so that it can protect the user’s password from adversary’s attacks. Theoretical analysis and experimental results show that our scheme improves the security of the user’s secret. Meanwhile, our scheme can resist the opponent’s dictionary attacks, replay attacks, and phishing attack. Our scheme can reduce the storage pressure of the mobile phone and is easy to deploy.

With the fast development of Logistics Internet of Things and smart devices, the security of express information processed by mobile devices in Logistics Internet of Things has attracted much attention. However, the existing secure express schemes only focus on privacy protection of personal information but do not consider the security of the logistics information against couriers with malicious mobile devices. For example, a privacy‐preserving delivery path should be required in order to prevent the privacy leakage in the express delivery procedure. Therefore, besides the security of personal information, the privacy protection of logistics information and authentication of mobile devices used in express company are important to security in Logistics Internet of Things. In this paper, we propose a secure logistics information scheme LIP‐PA to provide privacy protection of both personal information and logistics information. First, we define the basic requirements of Logistics Internet of Things. Then, using attribute‐based encryption and position‐based key exchange, we propose a logistics information privacy protection scheme with position and attribute‐based access control for mobile devices. The analysis results show that our scheme satisfies the defined requirements. Finally, the performance of our scheme is evaluated and the experiment results show that our scheme is efficient and feasible for mobile devices in real parcel delivery scenario.

P2P network is one of the most extensive network frameworks for wireless sensor network (WSN) in Internet of Things (IoT). The peers in WSN are rational and often free ride to save power of electricity and calculation, due to the fact that the usability is of great variability and unpredictability. Such a phenomenon tremendously reduces the quality of service (QoS) in WSN. Rational exchange protocol aims at promoting QoS and guaranteeing security and fairness. However, existing schemes have taken only complete information into account, which is not up to realistic environment. The peers in realistic environment indeed possess incomplete information, which is, however, still not thoroughly investigated so far. In this paper, under asymmetric information (a typical incomplete information), an entropy based incentive model is well designed based on Markov model and QoS evaluation model to help peers cooperate in WSNs. A concrete utility function with entropy is constructed to evaluate decision utility in P2P network. Finally, an entropy based rational exchange protocol is proposed based on the presented incentive model and concrete utility function, with analysis of correctness, security, fairness, and robustness, respectively. The proposed protocol can facilitate rational peers positively and sensibly participating in services and prevent free riding for rational peers. Hence, it further promotes QoS and guarantees security and fairness simultaneously in WSNs.

Abstract A framework consisting of the Protocol Derivation System (PDS) and the Protocol Composition Logic (PCL) has been recently proposed by Dattaet al. for the design and analysis of a secure composition of cryptographic protocols. However, the PDS in this proposed framework can only be used for the protocols of the Station‐to‐Station family, which are signature‐based authenticated Diffie–Hellman key exchange protocols. In this paper, the PDS is extended to support key exchange protocols using a trusted third party and an encryption‐based authentication such as those in the Needham–Schroeder family. This is achieved by means of adding new components, refinements, and transformations to the PDS. In addition, the PCL is applied to prove the correctness of the derived protocols. Then, the derivation graph of the Needham−Schroeder family is developed by using the extended PDS. Finally, the derivations and proofs of the protocols in the Needham–Schroeder family are shown in this paper. Copyright © 2012 John Wiley & Sons, Ltd.

A secure and efficient ID-based registration protocol with user anonymity is proposed in this paper for IP-based mobile networks. The protocol minimizes the registration delay through a minimal usage of the identity (ID)-based signature scheme that eliminates expensive pairing operations. User anonymity is achieved via a temporary identity (TID) transmitted by a mobile user, instead of its true identity. Additional replay protection from a Foreign Agent (FA) is included in the registration messages to prevent a possible replay attack. A formal correctness proof of the protocol using Protocol Composition Logic (PCL) is presented. Numerical analysis and computer simulation results demonstrate that the proposed protocol outperforms the existing ones in terms of the registration delay, the registration signaling traffic, and the computational load on a Mobile Node (MN) while improving security. For example, the proposed protocol reduces the registration delay up to 49.3 percent approximately, comparing to Yang's protocol.