Summary Wireless sensor networks (WSNs) are widespreadly applicable for information acquisition and processing in various fields such as military, healthcare, envrionment monitoring, and so on. WSNs have three main components: sensors, gateways, and users. The sensing information from sensors is transmitted to users through gateways. However, the public wireless networks are vulnerable to malicious active and passive attacks, which could bring security and privacy issues. Numerous two‐factor based authentication and key agreement (AKA) protocols have been proposed to solve these issues, whereas these schemes still have some deficiencies. Three‐factor based authentication method can make up for the drawbacks of two‐factor based schemes. Kumari and Renuka put forward a biometrics‐based AKA for WSNs with elliptic curve cryptography (ECC). But their scheme cannot maintain anonymity and resist to impersonality attack, replay attack, and DoS attack. In this article, we propose a biometrics‐based anonymous AKA scheme, which is equipped with the covered security requirements of WSNs. Meanwhile, the proposed scheme are provably secure in the three‐party AKA security model. Performance analysis demonstrates that our scheme has better security properties, communication cost, and computational cost compared with five recent and related schemes.

With the popularity of vehicular ad-hoc networks (VANETs), the secure communications between the vehicle and vehicle as well as between the vehicle and infrastructure have attracted people’s great attention. Vehicle privacy protection (including vehicle identity privacy and location privacy), high mobility, density, and limited bandwidth are also a problem that cannot be negligible. In VANETs, it is necessary to design a message authentication protocol to ensure data transmission security, vehicle anonymity, and unlinkability. Considering the resource-constrained environments, the certificateless aggregate signature (CLAS) scheme can compress$n$signatures of$n$messages from$n$vehicles into a single signature, which reduces the signature verification time and storage overhead at the roadside unit. Based on the aforementioned analysis, we design a fully aggregated conditional privacy-preserving CLAS scheme (CPP-CLAS) for VANETs. Instead of using the expensive bilinear pairings and map-to-point hash function operations, the proposed CPP-CLAS scheme uses the elliptic curve cryptosystem (ECC) and general hash functions. Also, with the use of CLAS technology, the computation and communication cost of the scheme are significantly reduced. In addition, based on the elliptic-curve discrete logarithm problem (ECDLP), we prove that the CPP-CLAS scheme is existential unforgeability under adaptively chosen message attacks (EUF-CMAs). Performance and security analyses show that the CPP-CLAS scheme is more efficient and secure than other existing related schemes.

Security in the Industrial Internet of Things (IIoT) is vital as there are some cases where IIoT devices collect sensory information for crucial social production and life. Thus, designing secure and efficient communication channels is always a research hotspot. However, end devices have memory, computation, and power-supplying capacities limitations. Moreover, perfect forward secrecy (PFS), which means that long-term key exposure still discloses previous session keys, is a critical security property for authentication and key exchange (AKE). This article proposes an AKE protocol named SAKE* for the IIoT environment, where two types of keys (i.e., a master key and an evolution key) guarantee PFS. In addition, the SAKE* protocol merely uses concatenation, XOR, and hash-function operations to achieve lightweight authentication, key exchange, and message integrity. We also compare the SAKE* protocol with seven current and IoT-related authentication protocols regarding security properties and performance. Comparison results indicate that the SAKE* protocol consumes the least computation resource and third-least communication cost among eight AKE protocols while equipping 12 security properties.

With the evolvement of the Internet of things (IoT), privacy and security have become the primary indicators for users to deploy IoT applications. In the gateway-based IoT architecture, gateways aggregate data collected by perception-layer devices and upload message packets to platforms, while platforms automatically push different categories of data to different applications. However, security in processes of data transmission via gateways, storage in platforms, access by applications is the major challenge for user privacy protection. To tackle this challenge, this article presents a secure IoT scheme based on a fine-grained multi-receive signcryption scheme to realize end-to-end secure transmission and data access control. To enhance the security of online application decryption keys, we design a distributed threshold decryption scheme based on secret-sharing. Moreover, from the provable security perspective, we demonstrate that the scheme can achieve the expected IND-CCA security and EUF-CMA security. After the performance analysis, evaluation results show that the computational performance is efficient and linearly subject to the number of messages and the number of receivers.

As one of the essential applications of health information technology, the eHealth system plays a significant role in enabling various internet medicine service scenes, most of which primarily rely on service recommendation or an evaluation mechanism. To avoid privacy leakage, some privacy-preserving mechanisms must be adopted to protect raters’ privacy and make evaluation trust reliable. To tackle this challenge, this article proposes an efficient service recommendation and evaluation scheme, called EPRT , which is based on a similarity calculation and trust discovery method. This scheme uses homomorphic encryption technology to encrypt the sensitive data and combines the threshold mechanism and double-trap mechanism to realize the secure computing on the encrypted data, so as to ensure that the plaintexts of the final calculation results (e.g., recommendation value and evaluation truth) are only obtained by the authorized subject. In addition, a detailed security analysis shows that the proposed EPRT scheme can achieve the expected security. In addition, performance comparison results are carried out, demonstrating its effectiveness and accuracy.

With the popularity of edge computing, edge nodes are connected with the Internet of Things (IoT) devices to process and analyze IoT-created data, and feedback corresponding results to users, devices, or data centers. In the edge computing environment, multicast is a typical communication pattern to support data transmitting between edges and devices. It allows the sender to send messages to multiple receivers in one broadcast message. To construct a secure multicast channel, the primary issue is to ensure the privacy and credibility of the transmitted message in the open wireless communication. Then, another essential issue for multicast channels is receiver anonymity, i.e., only the sender knows the receivers' identities. Also, efficiency and provable security are critical in scheme design. In this article, we design a certificateless multimessage and multireceiver signcryption (CLMMSC) scheme by using the elliptic curve cryptography. To facilitate lightweight deployment, we adapt the certificateless mechanism to reduce the system operation and maintenance costs. Then, through security proofs, we demonstrate that the proposed scheme can achieve the expected security properties. The performance analysis shows that the proposed scheme has lower communication costs than previous CLMMSC schemes.

With the widespread adoption of Internet of Things and cloud computing in different industry sectors, an increasing number of individuals or organizations are outsourcing their Industrial Internet of Things (IIoT) data in the cloud server to achieve cost saving and collaboration (e.g., data sharing). However, in this environment, preserving the privacy of data remains a key challenge and inhibiting factor to an even wider adoption of IIoT in the cloud environment. To mitigate these issues, in this paper, we design a new secure channel-free certificateless searchable public key encryption with multiple keywords scheme for IIoT deployment. We then demonstrate the security of the scheme in the random oracle model against two types of adversaries, where one adversary is given the power to choose a random public key instead of any user's public key and another adversary is allowed to learn the system master key. In the presence of these types of adversaries, we evaluate the performance of the proposed scheme and demonstrate that it achieves (computational) efficiency with low communication cost.

Abstract Recently, Chen et al. proposed a certificateless aggregate signature scheme with efficient verification. They claimed that their scheme could resist attacks of Type I adversary and Type II adversary. Unfortunately, we present a universal attack to demonstrate that their scheme cannot provide unforgeability. The adversary in the proposed attack can forge a legal signature on any message without any users' secret information. Copyright © 2016 John Wiley & Sons, Ltd.

Abstract With the rapid expansion of technology, the wireless sensor network has been spawned in recent years. Recently, Chi et al. proposed an improved energy‐efficient access control scheme for wireless sensor networks based on elliptic curve cryptography. In this article, we analyze the scheme of Chi et al. and point out that their scheme cannot withstand the replay attack. To surmount the weaknesses of the Chi et al. scheme, we propose a secure energy‐efficient access‐control scheme for wireless sensor networks based on elliptic curve cryptography. In addition, we prove that our scheme is secure and efficient with respect to various types of attacks. Copyright © 2015 John Wiley & Sons, Ltd.

The certificateless public key cryptography has attracted wide attention since it could solve the certificate management problem in the traditional public key cryptography and the key escrow problem in the identity‐based public key cryptography. Recently, several certificateless short signature schemes, which could satisfy the requirement of low‐bandwidth communication environments, have been proposed. However, most of them are not secure against either the Type I adversary or the Type II adversary. In this study, the authors propose a new efficient certificateless short signature scheme. The analysis shows the authors' scheme has better performance than the related schemes and is secure against both of the super Type I and the super Type II adversaries.

ABSTRACT The session initiation protocol (SIP) is one of the most important protocols supporting multimedia services. With the wide spread of the internet, the security of SIP is becoming more and more important. In 2009, Tsai proposed an efficient authentication scheme as an enhancement to SIP. However, Arshad et al. demonstrated that Tsai's scheme was vulnerable to the off‐line password‐guessing attack and the stolen‐verifier attack. They also pointed out that Tsai's scheme did not provide known‐key secrecy and perfect forward secrecy. To overcome the weaknesses, Arshad et al. also proposed an improved authentication scheme based on the elliptic curve discrete logarithm problem for SIP and claimed that their scheme can withstand various attacks. In this paper, we do a cryptanalysis of the scheme by Arshad et al., and we show that their scheme is vulnerable to the off‐line password‐guessing attack. We also propose an improved authentication scheme based on the elliptic curve cryptography for SIP which is immune to the presented attacks. Copyright © 2012 John Wiley & Sons, Ltd.