In vehicular ad-hoc networks (VANETs), existing traffic accident handling schemes are adoptable only in the scenario with roadside unit (RSU) deployment, and the generation of accident reports relies on RSUs and witness vehicles. Without the confirmation from involved vehicles in the accident, it will probably cause disputes afterward, and RSU captured attacks may also affect authentication of vehicles and correctness of accident reports. To address the above issues, we propose a vehicle to vehicle (V2V) and vehicle to RSU (V2R) authentication and traffic accident handling protocol, in which accident vehicles are sufficient to generate accident reports, thereby enhancing autonomy of the vehicular communication system and reducing reliance on external infrastructure. Furthermore, for ensuring integrity and traceability of accident reports, we utilize blockchain to keep registration information and jointly signed reports, which realizes efficient and secure mutual authentications in V2V and V2R protocols. Finally, for preserving privacy of vehicles, we integrate elliptic curve cryptosystem (ECC) and symmetric encryption to design a dynamic pseudo-identity strategy, which still allows the registration center to track malicious vehicles. The formal security proof and comparative analysis validate that our protocol preserves higher security and lower overhead by comparison with related schemes.

Ensuring trust within the healthcare system and addressing privacy and security challenges in the Internet of Medical Things (IoMT) is of paramount importance. Based on our preliminary analysis results of Masud et al.’s authentication protocol, we propose an improved solution building upon their protocol. Our improved protocol incorporates various security measures to enhance its security. To validate the effectiveness of our improved protocol, we employ a comprehensive range of heuristic and formal security analysis methods. Comparative evaluations with other relevant protocols reveal that our proposed solution achieves satisfactory operational performance in resource-constrained IoMT scenarios.

In this paper, we propose a scheme to implement hybrid encryption of images using generalized Arnold transformation and matrix nonlinear operations. This scheme consists of two stages. In the first stage, the pixels scrambling encryption is achieved by using generalized Arnold transformation. In the second stage, the pixels sequence encryption is carried out by a nonlinear matrix operation based on the key stream generated by a random matrix. Accordingly, the decryption process is completed by two steps inverse transformations. The hybrid encryption algorithm is one-time pad, and therefore has good anti-attack performance. The algorithm is featured by good confidentiality, low computational complexity, and easy-to-program processing. Moreover, the effectiveness, security and robustness of the algorithm are demonstrated by an image encryption simulation and the encryption performance analysis. Compared with the traditional Arnold scrambling encryption scheme and the chaotic encryption method based on the generalized standard mapping, the superiority of the proposed algorithm is demonstrated.

Authenticated key exchange (AKE) protocol allows a user and a server to authenticate each other and generate a session key for the subsequent communications. With the rapid development of low-power and highly-efficient networks, such as pervasive and mobile computing network in recent years, many efficient AKE protocols have been proposed to achieve user privacy and authentication in the communications. Besides secure session key establishment, those AKE protocols offer some other useful functionalities, such as two-factor user authentication and mutual authentication. However, most of them have one or more weaknesses, such as vulnerability against lost-smart-card attack, offline dictionary attack, de-synchronization attack, or the lack of forward secrecy, and user anonymity or untraceability. Furthermore, an AKE scheme under the public key infrastructure may not be suitable for light-weight computational devices, and the security model of AKE does not capture user anonymity and resist lost-smart-card attack. In this paper, we propose a novel dynamic ID-based anonymous two-factor AKE protocol, which addresses all the above issues. Our protocol also supports smart card revocation and password update without centralized storage. Further, we extend the security model of AKE to support user anonymity and resist lost-smart-card attack, and the proposed scheme is provably secure in extended security model. The low-computational and bandwidth cost indicates that our protocol can be deployed for pervasive computing applications and mobile communications in practice.

Automatic dependent surveillance-broadcast (ADS-B) has become a crucial part of next generation air traffic surveillance technology and will be mandatorily deployed for most of the airspaces worldwide by 2020. Each aircraft equipped with an ADS-B device keeps broadcasting plaintext messages to other aircraft and the ground station controllers once or twice per second. The lack of security measures in ADS-B systems makes it susceptible to different attacks. Among the various security issues, we investigate the integrity and authenticity of ADS-B messages. We propose a new framework for providing ADS-B with authentication based on three-level hierarchical identity-based signature (HIBS) with batch verification. Previous signature-based ADS-B authentication protocols focused on how to generate signatures efficiently, while our schemes can also significantly reduce the verification cost, which is critical to ADS-B systems, since at any time an ADS-B receiver may receive lots of signatures. We design two concrete schemes. The basic scheme supports partial batch verification and the extended scheme provides full batch verification. We give a formal security proof for the extended scheme. Experiment results show that our schemes with batch verification are tremendously more efficient in batch verifying n signatures than verifying n signatures independently. For example, the running time of verifying 100 signatures is 502 and 484 ms for the basic scheme and the extended scheme respectively, while the time is 2500 ms if verifying the signatures independently.

Cloud computing moves the application software and databases to the centralized large data centers, where the management of the data and services may not be fully trustworthy. In this work, we study the problem of ensuring the integrity of data storage in cloud computing. To reduce the computational cost at user side during the integrity verification of their data, the notion of public verifiability has been proposed. However, the challenge is that the computational burden is too huge for the users with resource-constrained devices to compute the public authentication tags of file blocks. To tackle the challenge, we propose OPoR, a new cloud storage scheme involving a cloud storage server and a cloud audit server, where the latter is assumed to be semi-honest. In particular, we consider the task of allowing the cloud audit server, on behalf of the cloud users, to pre-process the data before uploading to the cloud storage server and later verifying the data integrity. OPoR outsources and offloads the heavy computation of the tag generation to the cloud audit server and eliminates the involvement of user in the auditing and in the pre-processing phases. Furthermore, we strengthen the proof of retrievability (PoR) model to support dynamic data operations, as well as ensure security against reset attacks launched by the cloud storage server in the upload phase.

ABSTRACT Recently, Chen et al. proposed a practical authentication protocol for supporting anonymous roaming in wireless access networks, then the protocol is further improved by Hsieh and Leu. In this paper, we demonstrate the adversarial model of this type of protocols and show that Hsieh‐Leu scheme is not as secure as they originally claimed to be. In particular, we show that their protocol does not provide user privacy protection, and it is vulnerable to off‐line password guessing attack mounted by a side channel adversary who has compromised all the information stored in the user's smart card. To fix these weaknesses, a new practical authentication protocol with anonymity for wireless roaming is proposed. We use the formal verification tool ProVerif, which is based on applied pi calculus, to prove the security of the proposed scheme. The experimental results confirm that the new scheme not only achieves many desirable properties, such as strong anonymity, perfect forward secrecy and support of session key update, but also provides robustness against all those attacks that Hsieh–Leu protocol does not resist. Copyright © 2013 John Wiley & Sons, Ltd.