Introducing slicing into integrated satellite-terrestrial networks enables the flexible deployment of network resources and being adaptable for more new applications. However, the heterogeneity of integrated satellite-terrestrial network poses challenges to network resource access control. To ensure users can securely and efficiently access service across multiple management domains, we propose a network slice access authentication and service authorization scheme based on a sharding permissioned blockchain. Slice tenants and wireless network operators with management control act as consortium blockchain nodes, which are divided into shards, and the blockchain is maintained in parallel by multiple shards. First, an efficient public ledger is constructed to establish decentralized trust and manage user identity and service authorization information. Second, utilizing the trapdoor collision resistance of the chameleon hash, users can fully self-select their secret key and generate authentication credentials to register on the blockchain without key escrow problem. When users move into a new network domain, the mutual authentication between users and the visited network can be quickly completed. The session key is negotiated based on the Diffie-Hellman ephemeral protocol with perfect forward secrecy. Then, the editable transaction blocks, storing network slice authorization information and slice templates, are linked using chameleon hashes. This allows the access permissions of slice resources to be dynamically adjusted and easily queried by the service-providing wireless network operators. Performance evaluation and security simulations demonstrate the correctness of the scheme, showing that it can achieve secure access to integrated satellite-terrestrial network slice services with low computational and communication overhead.

5G Proximity-based Service (ProSe) UE-to-Network (U2N) Relay can help a remote 5G User Equipment (UE) out of coverage connect with the network. The 3GPP committee has provided the standard Authentication and Key Agreement (AKA) protocols to achieve secure access for a Remote UE and establish a secure link between a Remote UE and a U2N Relay. However, the security of these AKA protocols is a remaining issue. At first, we present two detailed 5G ProSe AKA protocols over Control Plane (CP) and User Plane (UP) for U2N Relay communication referring to multiple related standards, then transform the security requirements for 5G ProSe U2N Relay communication as formal security properties, and provide two formal faithful security models for the 5G ProSe AKA protocols. We adopt the state-of-the-art formal verification tool Tamarin to achieve automated security analysis on two models through new proof strategies, and then find some significant and unexpected flaws. Finally, we propose corresponding measures that have least impact on standards based on the analysis on the attacks. Given that the version of Release 17 (R17) of the 3GPP standard has just been frozen, our work can provide a reference for the subsequent evolution of the protocols in 5G ProSe.

Modern vehicles are equipped with ECU nodes and intra-vehicle buses. Among these, the CAN bus stands out as the most widely utilized intra-vehicle bus due to its affordability and straightforward deployment. However, the CAN bus suffers from significant security vulnerabilities, such as the absence of access control, identity authentication, message encryption, and authentication. In this paper, we propose a lightweight message-based key distribution scheme aimed at addressing these vulnerabilities. Our scheme facilitates mutual authentication during key distribution and assigns a unique key to each class of message. Formal verification using the Scyther tool demonstrates that our protocol achieves mutual authentication and effectively mitigates several protocol attacks, including replay, tampering, and manin-the-middle attacks. We evaluate our scheme using Arduino UNO boards. Performance analysis indicates that our scheme exhibits superior security capabilities compared to other related schemes and outperforms them in terms of communication and computation overheads.

As an outlook of the terrestrial network, the flexible Unmanned Aerial Vehicle (UAV)-aided satellite-terrestrial integration network would have numerous prospective applications such as service enhancement, maritime communication, military, and emergency communication, which is getting significant attention. However, the public and open-access network must result in various imperative risks including impersonation, sensitive data, and privacy disclosure. Due to several unique characteristics including long transmission distance, unstable communication environment, resource-limited and highly dynamic characteristics of UAVs, diversified terminals that lack the ability of accessing the satellite and may be resource-limited, there are new challenges for the access authentication process in the UAV-Aided Satellite-Terrestrial Integration Networks with 5G. In this paper, we present a novel Physically Unclonable Function (PUF)-based access authentication scheme consisting of two access authentication protocols for the UAV and the ground terminals like 5G User Equipments (UEs), respectively. Two access authentication protocols for the drone and the terminals can both achieve mutual authentication, key agreement, and privacy protection with distinct advantages of no need to store secret key and supporting physical attack resistance. Finally, we propose an efficient handover authentication protocol executed by the ground terminals when the UAV is required to switch. We employ different security analysis tools to analyze the security of all proposed protocols, as well as present informal security analysis on various security properties. The performance comparison and evaluations show our protocols have better advantages.

The fifth-generation (5G) mobile communication technology has already deployed commercially and become a global research focus. The new features of 5G include unlimited information exchange, a large variety of connections with independent energy, and diversified high transmission rate services. Collective synergy of services is expected to change the way of life and future generations and introduce new converged services to the ICT industry. Different application services have to meet differentiated security demands. From the perspective of security, in order to support the multiservice of 5G services, it is necessary to consider the new security mechanism driven by the service. Based on 5G massive data stream, the 5G system can provide customized real-world services for potential users and reduce the user experience gap in different scenarios. However, 3GPP Extensible Authentication Protocol (EAP), which is the present entity authentication mechanism for the 5G service layer, is only an individual authentication architecture and unable to fulfill the flexible security objectives of differentiated services. In this paper, we present a new hierarchical identity management framework as well as an adaptable and composable three-factor authentication and session key agreement protocol for different applications in 5G multiservice systems. Finally, we propose an authorization process by combining with the proposed three-factor authentication mechanism and Service-Based Architecture (SBA) proposed by the 3GPP committee. The proposed mechanism can concurrently provide diverse identity authentication schemes corresponding to four different security levels by easily splitting or assembling three-factor authentication protocol blocks. The proposed scheme can be simultaneously applied to a variety of applications to improve the efficiency and quality of service and reduce the complexity of the whole 5G multiservice system, instead of designing or adopting several different authentication protocols. The performance evaluation results indicate that the proposed scheme can guarantee the multiple security of the system with ideal efficiency.

Summary Mobile social network has become a necessary part in our daily life, and location‐based services (LBSs) provide unprecedented convenience to mobile users. However, these attracting services are accompanied with privacy disclosures, including location privacy and query privacy. Mobile users have to expose their personal information to untrusted location‐based service provider (LSP) in order to obtain relevant service data. To address these privacy issues, we proposed a personalized range‐sensitive privacy‐preserving scheme, called PRPS, which considers the relationship between locations, query ranges, and query contents. Moreover, PRPS employs map storing algorithm (MSA) to facilitate the storage of two‐dimensional local map, reducing the cost of storage. Furthermore, range estimating algorithm (REA) adopts binary quad‐tree to decide the query radius of each submitted location, avoiding inference attacks by adversary. The requirements generating algorithm (RGA) selects relevant query content for each dummy location, guaranteeing mobile user's location privacy and query privacy. Finally, we illustrate the privacy analysis to proof PRPS's privacy degree; then, the performance and privacy evaluation results indicate that the proposed PRPS is effective and efficient.

Error Correcting Output Codes (ECOC) method solves multiclass learning problems by combining the outputs of several binary classifiers according to an error correcting output code matrix. Traditionally, the minimum Hamming distance is adopted as the classification criterion to "vote" among multiple hypotheses, and the focus is given to the choice of error correcting output code matrix. In this paper, we apply a decoding methodology in multiclass learning problems, in which class labels of testing samples are unknown. In other words, without comparing the predicted and actual class labels, it can be known whether testing samples are classified correctly. Based on this property, a new cascade classifier is introduced. The classifier can improve the accuracy and will not result in over fitting. The analytical results show feasibility, accuracy, and the advantages of the proposed method.